{"id":"https://openalex.org/W3091534692","doi":"https://doi.org/10.1155/2020/8838571","title":"A Host-Based Anomaly Detection Framework Using XGBoost and LSTM for IoT Devices","display_name":"A Host-Based Anomaly Detection Framework Using XGBoost and LSTM for IoT Devices","publication_year":2020,"publication_date":"2020-10-05","ids":{"openalex":"https://openalex.org/W3091534692","doi":"https://doi.org/10.1155/2020/8838571","mag":"3091534692"},"language":"en","primary_location":{"id":"doi:10.1155/2020/8838571","is_oa":true,"landing_page_url":"https://doi.org/10.1155/2020/8838571","pdf_url":"https://downloads.hindawi.com/journals/wcmc/2020/8838571.pdf","source":{"id":"https://openalex.org/S235346","display_name":"Wireless Communications and Mobile Computing","issn_l":"1530-8669","issn":["1530-8669","1530-8677"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320595","host_organization_name":"Wiley","host_organization_lineage":["https://openalex.org/P4310320595"],"host_organization_lineage_names":["Wiley"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Wireless Communications and Mobile Computing","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://downloads.hindawi.com/journals/wcmc/2020/8838571.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101630053","display_name":"Xiali Wang","orcid":"https://orcid.org/0000-0001-7669-7869"},"institutions":[{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiali Wang","raw_affiliation_strings":["Institute of Information Engineering, CAS, 100093, China","School of Cyber Security, UCAS, 100049, China"],"raw_orcid":"https://orcid.org/0000-0001-7669-7869","affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, CAS, 100093, China","institution_ids":["https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, UCAS, 100049, China","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101756189","display_name":"Xiang Lu","orcid":"https://orcid.org/0000-0001-7885-5621"},"institutions":[{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Xiang Lu","raw_affiliation_strings":["Institute of Information Engineering, CAS, 100093, China","School of Cyber Security, UCAS, 100049, China"],"raw_orcid":"https://orcid.org/0000-0001-7885-5621","affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, CAS, 100093, China","institution_ids":["https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, UCAS, 100049, China","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5101756189"],"corresponding_institution_ids":["https://openalex.org/I4210156404"],"apc_list":{"value":2300,"currency":"USD","value_usd":2300},"apc_paid":{"value":2300,"currency":"USD","value_usd":2300},"fwci":3.6244,"has_fulltext":true,"cited_by_count":56,"citation_normalized_percentile":{"value":0.93116748,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":97,"max":100},"biblio":{"volume":"2020","issue":null,"first_page":"1","last_page":"13"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9983000159263611,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8972873091697693},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.6782247424125671},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6246128678321838},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.5559744238853455},{"id":"https://openalex.org/keywords/guard","display_name":"Guard (computer science)","score":0.5182080864906311},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.50909823179245},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.49148261547088623},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4116029739379883},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3768674433231354}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8972873091697693},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.6782247424125671},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6246128678321838},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.5559744238853455},{"id":"https://openalex.org/C141141315","wikidata":"https://www.wikidata.org/wiki/Q2379942","display_name":"Guard (computer science)","level":2,"score":0.5182080864906311},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.50909823179245},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.49148261547088623},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4116029739379883},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3768674433231354},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1155/2020/8838571","is_oa":true,"landing_page_url":"https://doi.org/10.1155/2020/8838571","pdf_url":"https://downloads.hindawi.com/journals/wcmc/2020/8838571.pdf","source":{"id":"https://openalex.org/S235346","display_name":"Wireless Communications and Mobile Computing","issn_l":"1530-8669","issn":["1530-8669","1530-8677"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320595","host_organization_name":"Wiley","host_organization_lineage":["https://openalex.org/P4310320595"],"host_organization_lineage_names":["Wiley"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Wireless Communications and Mobile Computing","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:2a837e945c4c45b9a8a34fe7fff04605","is_oa":false,"landing_page_url":"https://doaj.org/article/2a837e945c4c45b9a8a34fe7fff04605","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Wireless Communications and Mobile Computing, Vol 2020 (2020)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1155/2020/8838571","is_oa":true,"landing_page_url":"https://doi.org/10.1155/2020/8838571","pdf_url":"https://downloads.hindawi.com/journals/wcmc/2020/8838571.pdf","source":{"id":"https://openalex.org/S235346","display_name":"Wireless Communications and Mobile Computing","issn_l":"1530-8669","issn":["1530-8669","1530-8677"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320595","host_organization_name":"Wiley","host_organization_lineage":["https://openalex.org/P4310320595"],"host_organization_lineage_names":["Wiley"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Wireless Communications and Mobile Computing","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Zero hunger","id":"https://metadata.un.org/sdg/2","score":0.6600000262260437}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3091534692.pdf","grobid_xml":"https://content.openalex.org/works/W3091534692.grobid-xml"},"referenced_works_count":3,"referenced_works":["https://openalex.org/W1596717185","https://openalex.org/W1995443851","https://openalex.org/W2955014922"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W2772446090","https://openalex.org/W3152891574","https://openalex.org/W2249809453","https://openalex.org/W4284893819","https://openalex.org/W4316881845"],"abstract_inverted_index":{"The":[0,183],"Internet":[1],"of":[2,34,43,103,126,180,229,294],"Things":[3],"(IoT)":[4],"is":[5,39,112,199,213],"rapidly":[6],"spreading":[7],"in":[8,16,69,93,120,124,136,220,276],"various":[9,53],"application":[10],"scenarios":[11],"through":[12],"its":[13],"salient":[14],"features":[15],"ubiquitous":[17],"device":[18,78],"connections,":[19],"ranging":[20],"from":[21,81],"agriculture":[22],"and":[23,27,67,87,152,240,266,291],"industry":[24],"to":[25,48,73,114,144,215,270],"transportation":[26],"other":[28,261],"fields.":[29],"As":[30],"the":[31,44,60,76,90,146,153,161,166,173,178,192,209,221,227,230,247,256,283,292],"increasing":[32],"spread":[33],"IoT":[35,37,50,57,77,94,109,131,167,244],"applications,":[36],"security":[38],"gradually":[40],"becoming":[41],"one":[42],"most":[45],"significant":[46],"issues":[47],"guard":[49],"devices":[51,58],"against":[52],"cybersecurity":[54],"threats.":[55],"Usually,":[56],"are":[59,188,268],"main":[61],"components":[62],"responsible":[63],"for":[64,108,160,204],"sensing,":[65],"computing,":[66],"transmitting;":[68],"this":[70,134,137],"case,":[71],"how":[72],"efficiently":[74],"protect":[75],"itself":[79],"away":[80],"cyber":[82],"attacks,":[83],"like":[84],"malware,":[85],"virus,":[86],"worm,":[88],"becomes":[89],"vital":[91],"point":[92],"security.":[95],"This":[96],"paper":[97],"presents":[98],"a":[99,121,141,200,235,272],"brand":[100],"new":[101],"architecture":[102],"intrusion":[104,206],"detection":[105,264],"system":[106,174,185,222,239],"(IDS)":[107],"devices,":[110],"which":[111,198],"designed":[113],"identify":[115,216],"device-":[116],"or":[117],"host-oriented":[118],"attacks":[119,245],"lightweight":[122],"manner":[123],"consideration":[125],"limited":[127],"computation":[128],"resources":[129],"on":[130,165,246],"devices.":[132,168],"To":[133,225],"end,":[135],"paper,":[138],"we":[139,171,233,267],"propose":[140],"stacking":[142,211,257,285],"model":[143,151,158,212,258,286],"couple":[145],"Extreme":[147],"Gradient":[148],"Boosting":[149],"(XGBoost)":[150],"Long":[154],"Short-Term":[155],"Memory":[156],"(LSTM)":[157],"together":[159],"abnormal":[162,181,217],"state":[163],"analysis":[164],"More":[169],"specifically,":[170],"adopt":[172],"call":[175,186,223],"sequence":[176],"as":[177],"indicators":[179],"behaviors.":[182],"collected":[184],"sequences":[187],"firstly":[189],"processed":[190],"by":[191],"famous":[193],"<mml:math":[194],"xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"":[195],"id=\"M1\"><mml:mi>n</mml:mi></mml:math>-gram":[196],"model,":[197,232],"common":[201],"method":[202],"used":[203,214],"host-based":[205],"detections.":[207],"Then,":[208],"proposed":[210,231],"behaviors":[218],"hidden":[219],"sequences.":[224],"evaluate":[226],"performance":[228],"establish":[234],"real-setting":[236],"IP":[237,249],"camera":[238],"place":[241],"several":[242],"typical":[243],"victim":[248],"camera.":[250],"Extensive":[251],"experimental":[252],"evaluations":[253],"show":[254],"that":[255,282],"has":[259,287],"outperformed":[260],"existing":[262],"anomaly":[263],"solutions,":[265],"able":[269],"achieve":[271],"0.983":[273],"AUC":[274],"score":[275],"real-world":[277],"data.":[278],"Numerical":[279],"testing":[280],"demonstrates":[281],"XGBoost-LSTM":[284],"excellent":[288],"performance,":[289],"stability,":[290],"ability":[293],"generalization.":[295]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":15},{"year":2024,"cited_by_count":11},{"year":2023,"cited_by_count":11},{"year":2022,"cited_by_count":12},{"year":2021,"cited_by_count":4}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-10T00:00:00"}