{"id":"https://openalex.org/W7160406764","doi":"https://doi.org/10.1186/s42400-025-00495-x","title":"Adaptive DDoS attack detection via packet payload feature selection","display_name":"Adaptive DDoS attack detection via packet payload feature selection","publication_year":2026,"publication_date":"2026-05-07","ids":{"openalex":"https://openalex.org/W7160406764","doi":"https://doi.org/10.1186/s42400-025-00495-x"},"language":"en","primary_location":{"id":"doi:10.1186/s42400-025-00495-x","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-025-00495-x","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00495-x.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00495-x.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5135509082","display_name":"Fengjun Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I2800372957","display_name":"China Electronics Technology Group Corporation","ror":"https://ror.org/0098hst83","country_code":"CN","type":"company","lineage":["https://openalex.org/I2800372957"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fengjun Zhang","raw_affiliation_strings":["Department of Computer Science and Technology, Tsinghua University, Beijing, 100084, China","The 30th Research Institute, China Electronics Technology Group Corporation, Chengdu, 610036, Sichuan, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Technology, Tsinghua University, Beijing, 100084, China","institution_ids":["https://openalex.org/I99065089"]},{"raw_affiliation_string":"The 30th Research Institute, China Electronics Technology Group Corporation, Chengdu, 610036, Sichuan, China","institution_ids":["https://openalex.org/I2800372957"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135491449","display_name":"Yong Cui","orcid":null},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yong Cui","raw_affiliation_strings":["Department of Computer Science and Technology, Tsinghua University, Beijing, 100084, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Technology, Tsinghua University, Beijing, 100084, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135456648","display_name":"Guangcan Cui","orcid":"https://orcid.org/0009-0007-9631-5363"},"institutions":[{"id":"https://openalex.org/I150229711","display_name":"University of Electronic Science and Technology of China","ror":"https://ror.org/04qr3zq92","country_code":"CN","type":"education","lineage":["https://openalex.org/I150229711"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Guangcan Cui","raw_affiliation_strings":["School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, 611731, Sichuan, China"],"raw_orcid":"https://orcid.org/0009-0007-9631-5363","affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, 611731, Sichuan, China","institution_ids":["https://openalex.org/I150229711"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135473035","display_name":"Lisheng Huang","orcid":null},"institutions":[{"id":"https://openalex.org/I150229711","display_name":"University of Electronic Science and Technology of China","ror":"https://ror.org/04qr3zq92","country_code":"CN","type":"education","lineage":["https://openalex.org/I150229711"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lisheng Huang","raw_affiliation_strings":["School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, 611731, Sichuan, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, 611731, Sichuan, China","institution_ids":["https://openalex.org/I150229711"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135487576","display_name":"Qinghua Li","orcid":null},"institutions":[{"id":"https://openalex.org/I2800372957","display_name":"China Electronics Technology Group Corporation","ror":"https://ror.org/0098hst83","country_code":"CN","type":"company","lineage":["https://openalex.org/I2800372957"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qinghua Li","raw_affiliation_strings":["The 30th Research Institute, China Electronics Technology Group Corporation, Chengdu, 610036, Sichuan, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The 30th Research Institute, China Electronics Technology Group Corporation, Chengdu, 610036, Sichuan, China","institution_ids":["https://openalex.org/I2800372957"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135427061","display_name":"Kai Shi","orcid":null},"institutions":[{"id":"https://openalex.org/I2800372957","display_name":"China Electronics Technology Group Corporation","ror":"https://ror.org/0098hst83","country_code":"CN","type":"company","lineage":["https://openalex.org/I2800372957"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kai Shi","raw_affiliation_strings":["The 30th Research Institute, China Electronics Technology Group Corporation, Chengdu, 610036, Sichuan, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"The 30th Research Institute, China Electronics Technology Group Corporation, Chengdu, 610036, Sichuan, China","institution_ids":["https://openalex.org/I2800372957"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5123434362","display_name":"Yunhai Lan","orcid":null},"institutions":[{"id":"https://openalex.org/I4210086825","display_name":"Guangzhou Education Bureau","ror":"https://ror.org/00479t136","country_code":"CN","type":"government","lineage":["https://openalex.org/I4210086825"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yunhai Lan","raw_affiliation_strings":["Network Center of the Central Southern Air Traffic Control Bureau, Guangzhou, 510405, Guangdong, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Network Center of the Central Southern Air Traffic Control Bureau, Guangzhou, 510405, Guangdong, China","institution_ids":["https://openalex.org/I4210086825"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5135456648"],"corresponding_institution_ids":["https://openalex.org/I150229711"],"apc_list":{"value":1230,"currency":"USD","value_usd":1230},"apc_paid":{"value":1230,"currency":"USD","value_usd":1230},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.54742794,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"9","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.6610000133514404,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.6610000133514404,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.027000000700354576,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T14258","display_name":"Legal and Policy Issues","score":0.01360000018030405,"subfield":{"id":"https://openalex.org/subfields/3308","display_name":"Law"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.7990999817848206},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.7527999877929688},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.6425999999046326},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.5672000050544739},{"id":"https://openalex.org/keywords/discriminative-model","display_name":"Discriminative model","score":0.5419999957084656},{"id":"https://openalex.org/keywords/feature-selection","display_name":"Feature selection","score":0.5254999995231628},{"id":"https://openalex.org/keywords/constant-false-alarm-rate","display_name":"Constant false alarm rate","score":0.44769999384880066},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.43810001015663147},{"id":"https://openalex.org/keywords/feature-vector","display_name":"Feature vector","score":0.4323999881744385}],"concepts":[{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.7990999817848206},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7687000036239624},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.7527999877929688},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.6425999999046326},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5672000050544739},{"id":"https://openalex.org/C97931131","wikidata":"https://www.wikidata.org/wiki/Q5282087","display_name":"Discriminative model","level":2,"score":0.5419999957084656},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5346999764442444},{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.5254999995231628},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4690999984741211},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.44769999384880066},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.43810001015663147},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.4323999881744385},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.4106999933719635},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.39980000257492065},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3917999863624573},{"id":"https://openalex.org/C177606310","wikidata":"https://www.wikidata.org/wiki/Q5674297","display_name":"Adaptability","level":2,"score":0.34689998626708984},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3278999924659729},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.3068999946117401},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.3059000074863434},{"id":"https://openalex.org/C204241405","wikidata":"https://www.wikidata.org/wiki/Q461499","display_name":"Transformation (genetics)","level":3,"score":0.3027999997138977},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.29980000853538513},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.2948000133037567},{"id":"https://openalex.org/C2776836416","wikidata":"https://www.wikidata.org/wiki/Q1364844","display_name":"False alarm","level":2,"score":0.28380000591278076},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2757999897003174},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.26820001006126404}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1186/s42400-025-00495-x","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-025-00495-x","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00495-x.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:60a3d0b2040e43c3935fc3ca1bac5f47","is_oa":true,"landing_page_url":"https://doaj.org/article/60a3d0b2040e43c3935fc3ca1bac5f47","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Cybersecurity, Vol 9, Iss 1 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s42400-025-00495-x","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-025-00495-x","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00495-x.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/10","score":0.7225375771522522,"display_name":"Reduced inequalities"}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7160406764.pdf","grobid_xml":"https://content.openalex.org/works/W7160406764.grobid-xml"},"referenced_works_count":25,"referenced_works":["https://openalex.org/W1869854851","https://openalex.org/W2111942706","https://openalex.org/W2597472767","https://openalex.org/W2885505758","https://openalex.org/W2897202622","https://openalex.org/W2982682021","https://openalex.org/W2998008813","https://openalex.org/W3009061343","https://openalex.org/W3124423925","https://openalex.org/W3161554626","https://openalex.org/W3162299608","https://openalex.org/W3204548492","https://openalex.org/W4220698544","https://openalex.org/W4294192982","https://openalex.org/W4311374878","https://openalex.org/W4311521084","https://openalex.org/W4313546724","https://openalex.org/W4313830756","https://openalex.org/W4377024351","https://openalex.org/W4377691173","https://openalex.org/W4388281493","https://openalex.org/W4392028635","https://openalex.org/W4392386117","https://openalex.org/W4401277758","https://openalex.org/W4410741201"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"Distributed":[1,21],"Denial":[2],"of":[3,20,44,52,161],"Service":[4],"attacks":[5,24],"(DDoS)":[6,23],"are":[7],"a":[8,26,82,94],"common":[9],"and":[10,17,101,113,123,153,172],"influential":[11],"network":[12,45],"malicious":[13],"behavior.":[14],"The":[15,75],"timely":[16],"accurate":[18],"detection":[19,66,143,159],"Denial-of-Service":[22],"constitutes":[25],"critically":[27],"significant":[28],"research":[29,36],"imperative":[30],"in":[31,135,164],"cyber":[32],"security.":[33],"Most":[34],"current":[35],"focuses":[37],"on":[38,41,88,147],"classification":[39,85],"based":[40,87],"statistical":[42],"characteristics":[43],"traffic,":[46],"but":[47],"less":[48],"considers":[49],"the":[50,148,157,162,173],"significance":[51],"packet":[53,89],"payload":[54,72,99],"feature":[55,73,102,107,124,129],"for":[56,119,169],"DDoS":[57,65,136],"attack":[58,137,170],"identification.":[59],"This":[60,127],"paper":[61,166],"proposes":[62],"an":[63],"adaptive":[64],"framework":[67],"integrating":[68],"machine":[69],"learning":[70,117],"with":[71],"engineering.":[74],"methodology":[76],"comprises":[77],"three":[78],"phases:":[79],"1)":[80],"constructing":[81],"heterogeneous":[83],"task":[84],"system":[86],"metadata":[90],"analysis,":[91],"2)":[92],"establishing":[93],"hierarchical":[95],"keyword":[96],"lexicon":[97],"through":[98],"decomposition":[100],"pattern":[103,138],"mining,":[104],"followed":[105],"by":[106],"vector":[108],"transformation":[109],"via":[110],"numerical":[111],"encoding,":[112],"3)":[114],"implementing":[115],"supervised":[116],"algorithms":[118],"discriminative":[120],"model":[121],"training":[122],"validity":[125],"verification.":[126],"multilevel":[128],"engineering":[130],"approach":[131],"demonstrates":[132],"enhanced":[133],"adaptability":[134],"recognition":[139],"compared":[140],"to":[141],"conventional":[142],"paradigms.":[144],"Test":[145],"results":[146],"public":[149],"datasets":[150],"CIC-DDoS-2019,":[151],"ISCX-SlowDoS-2016":[152],"DoS/DDoS-MQTT-IoT":[154],"show":[155],"that":[156],"average":[158],"rate":[160,176],"method":[163],"this":[165],"reaches":[167],"98.9%":[168],"behaviors,":[171],"false":[174],"alarm":[175],"is":[177],"only":[178],"0.1%.":[179]},"counts_by_year":[],"updated_date":"2026-07-23T08:03:31.855105","created_date":"2026-05-07T00:00:00"}