{"id":"https://openalex.org/W7125155865","doi":"https://doi.org/10.1186/s42400-025-00527-6","title":"SIP-DDoS framework based on federated learning for collaborative anomaly detection","display_name":"SIP-DDoS framework based on federated learning for collaborative anomaly detection","publication_year":2026,"publication_date":"2026-01-21","ids":{"openalex":"https://openalex.org/W7125155865","doi":"https://doi.org/10.1186/s42400-025-00527-6"},"language":"en","primary_location":{"id":"doi:10.1186/s42400-025-00527-6","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-025-00527-6","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00527-6.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00527-6.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5019083615","display_name":"Oussama Sbai","orcid":"https://orcid.org/0000-0003-4826-4446"},"institutions":[{"id":"https://openalex.org/I126477371","display_name":"Mohammed V University","ror":"https://ror.org/00r8w8f84","country_code":"MA","type":"education","lineage":["https://openalex.org/I126477371"]}],"countries":["MA"],"is_corresponding":true,"raw_author_name":"Oussama Sbai","raw_affiliation_strings":["ANISSE, Faculty of Sciences, Mohammed V University in Rabat, 10000, Rabat, Morocco"],"affiliations":[{"raw_affiliation_string":"ANISSE, Faculty of Sciences, Mohammed V University in Rabat, 10000, Rabat, Morocco","institution_ids":["https://openalex.org/I126477371"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050001967","display_name":"Benjamin Allaert","orcid":"https://orcid.org/0000-0002-4291-9803"},"institutions":[{"id":"https://openalex.org/I205703379","display_name":"Institut Mines-T\u00e9l\u00e9com","ror":"https://ror.org/025vp2923","country_code":"FR","type":"facility","lineage":["https://openalex.org/I205703379"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Benjamin Allaert","raw_affiliation_strings":["Centre for Digital Systems, IMT Nord Europe, Institut Mines-T\u00e9l\u00e9com, 59000, Lille, France"],"affiliations":[{"raw_affiliation_string":"Centre for Digital Systems, IMT Nord Europe, Institut Mines-T\u00e9l\u00e9com, 59000, Lille, France","institution_ids":["https://openalex.org/I205703379"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079360048","display_name":"Patrick Sondi","orcid":"https://orcid.org/0000-0001-9484-7357"},"institutions":[{"id":"https://openalex.org/I205703379","display_name":"Institut Mines-T\u00e9l\u00e9com","ror":"https://ror.org/025vp2923","country_code":"FR","type":"facility","lineage":["https://openalex.org/I205703379"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Patrick Sondi","raw_affiliation_strings":["Centre for Digital Systems, IMT Nord Europe, Institut Mines-T\u00e9l\u00e9com, 59000, Lille, France"],"affiliations":[{"raw_affiliation_string":"Centre for Digital Systems, IMT Nord Europe, Institut Mines-T\u00e9l\u00e9com, 59000, Lille, France","institution_ids":["https://openalex.org/I205703379"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5123511642","display_name":"Ahmed Meddahi","orcid":null},"institutions":[{"id":"https://openalex.org/I205703379","display_name":"Institut Mines-T\u00e9l\u00e9com","ror":"https://ror.org/025vp2923","country_code":"FR","type":"facility","lineage":["https://openalex.org/I205703379"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Ahmed Meddahi","raw_affiliation_strings":["Centre for Digital Systems, IMT Nord Europe, Institut Mines-T\u00e9l\u00e9com, 59000, Lille, France"],"affiliations":[{"raw_affiliation_string":"Centre for Digital Systems, IMT Nord Europe, Institut Mines-T\u00e9l\u00e9com, 59000, Lille, France","institution_ids":["https://openalex.org/I205703379"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5019083615"],"corresponding_institution_ids":["https://openalex.org/I126477371"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.18772967,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"9","issue":"1","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.6783000230789185,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.6783000230789185,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.022199999541044235,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.019899999722838402,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.6820999979972839},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.6818000078201294},{"id":"https://openalex.org/keywords/flooding","display_name":"Flooding (psychology)","score":0.6391000151634216},{"id":"https://openalex.org/keywords/session-initiation-protocol","display_name":"Session Initiation Protocol","score":0.5961999893188477},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5831999778747559},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.5320000052452087},{"id":"https://openalex.org/keywords/federated-learning","display_name":"Federated learning","score":0.5012999773025513},{"id":"https://openalex.org/keywords/neighbor-discovery-protocol","display_name":"Neighbor Discovery Protocol","score":0.43299999833106995},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.40880000591278076}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8039000034332275},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.6820999979972839},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.6818000078201294},{"id":"https://openalex.org/C186594467","wikidata":"https://www.wikidata.org/wiki/Q1429176","display_name":"Flooding (psychology)","level":2,"score":0.6391000151634216},{"id":"https://openalex.org/C41878487","wikidata":"https://www.wikidata.org/wiki/Q191018","display_name":"Session Initiation Protocol","level":3,"score":0.5961999893188477},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5831999778747559},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.5320000052452087},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.5300999879837036},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.520799994468689},{"id":"https://openalex.org/C2992525071","wikidata":"https://www.wikidata.org/wiki/Q50818671","display_name":"Federated learning","level":2,"score":0.5012999773025513},{"id":"https://openalex.org/C165932591","wikidata":"https://www.wikidata.org/wiki/Q1547947","display_name":"Neighbor Discovery Protocol","level":4,"score":0.43299999833106995},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.40880000591278076},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.3952000141143799},{"id":"https://openalex.org/C177212765","wikidata":"https://www.wikidata.org/wiki/Q627335","display_name":"Workflow","level":2,"score":0.38499999046325684},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.3416999876499176},{"id":"https://openalex.org/C12269588","wikidata":"https://www.wikidata.org/wiki/Q132364","display_name":"Communications protocol","level":2,"score":0.3190999925136566},{"id":"https://openalex.org/C2779182362","wikidata":"https://www.wikidata.org/wiki/Q17126187","display_name":"Session (web analytics)","level":2,"score":0.31060001254081726},{"id":"https://openalex.org/C110994511","wikidata":"https://www.wikidata.org/wiki/Q661020","display_name":"Next-generation network","level":3,"score":0.30970001220703125},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.3019999861717224},{"id":"https://openalex.org/C82578977","wikidata":"https://www.wikidata.org/wiki/Q16773055","display_name":"Data aggregator","level":3,"score":0.29269999265670776},{"id":"https://openalex.org/C77714075","wikidata":"https://www.wikidata.org/wiki/Q5452017","display_name":"Firewall (physics)","level":5,"score":0.2856999933719635},{"id":"https://openalex.org/C82876162","wikidata":"https://www.wikidata.org/wiki/Q17096504","display_name":"Latency (audio)","level":2,"score":0.2815000116825104},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.2791999876499176},{"id":"https://openalex.org/C489000","wikidata":"https://www.wikidata.org/wiki/Q747385","display_name":"Data flow diagram","level":2,"score":0.27880001068115234},{"id":"https://openalex.org/C169851745","wikidata":"https://www.wikidata.org/wiki/Q1331985","display_name":"Overlay network","level":3,"score":0.27799999713897705},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.27619999647140503},{"id":"https://openalex.org/C100776233","wikidata":"https://www.wikidata.org/wiki/Q2532492","display_name":"Bridge (graph theory)","level":2,"score":0.27480000257492065},{"id":"https://openalex.org/C2982881601","wikidata":"https://www.wikidata.org/wiki/Q132364","display_name":"Protocol design","level":3,"score":0.2685999870300293},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.25600001215934753}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1186/s42400-025-00527-6","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-025-00527-6","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00527-6.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},{"id":"pmh:oai:HAL:hal-05386229v1","is_oa":true,"landing_page_url":"https://imt-nord-europe.hal.science/hal-05386229","pdf_url":"https://imt-nord-europe.hal.science/hal-05386229v1/document","source":{"id":"https://openalex.org/S4406922466","display_name":"SPIRE - Sciences Po Institutional REpository","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Cybersecurity, 2026, 9 (109), ⟨10.1186/s42400-025-00527-6⟩","raw_type":"Journal articles"},{"id":"pmh:oai:doaj.org/article:277ece83a82445228c3ff7d1936281eb","is_oa":true,"landing_page_url":"https://doaj.org/article/277ece83a82445228c3ff7d1936281eb","pdf_url":null,"source":{"id":"https://openalex.org/S112646816","display_name":"SHILAP Revista de lepidopterolog\u00eda","issn_l":"0300-5267","issn":["0300-5267","2340-4078"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Cybersecurity, Vol 9, Iss 1, Pp 1-25 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1186/s42400-025-00527-6","is_oa":true,"landing_page_url":"https://doi.org/10.1186/s42400-025-00527-6","pdf_url":"https://link.springer.com/content/pdf/10.1186/s42400-025-00527-6.pdf","source":{"id":"https://openalex.org/S3035238565","display_name":"Cybersecurity","issn_l":"2523-3246","issn":["2523-3246"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319965","host_organization_name":"Springer Nature","host_organization_lineage":["https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Cybersecurity","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure","score":0.6421347260475159}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7125155865.pdf","grobid_xml":"https://content.openalex.org/works/W7125155865.grobid-xml"},"referenced_works_count":39,"referenced_works":["https://openalex.org/W1504192099","https://openalex.org/W2099947903","https://openalex.org/W2151599190","https://openalex.org/W2488367420","https://openalex.org/W2760556897","https://openalex.org/W2896282713","https://openalex.org/W3034976607","https://openalex.org/W3092855438","https://openalex.org/W3113341839","https://openalex.org/W3169765494","https://openalex.org/W3171802458","https://openalex.org/W3180418185","https://openalex.org/W3191470662","https://openalex.org/W3217726181","https://openalex.org/W4205599972","https://openalex.org/W4206045618","https://openalex.org/W4210951404","https://openalex.org/W4213245394","https://openalex.org/W4220810976","https://openalex.org/W4242138061","https://openalex.org/W4285106051","https://openalex.org/W4285169553","https://openalex.org/W4293239788","https://openalex.org/W4318586189","https://openalex.org/W4364322239","https://openalex.org/W4367316377","https://openalex.org/W4377107432","https://openalex.org/W4385078986","https://openalex.org/W4386453656","https://openalex.org/W4387491243","https://openalex.org/W4387872076","https://openalex.org/W4389117942","https://openalex.org/W4390421955","https://openalex.org/W4390748831","https://openalex.org/W4391023335","https://openalex.org/W4392902282","https://openalex.org/W4393349419","https://openalex.org/W4394627330","https://openalex.org/W4396768380"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"With":[1],"their":[2,106],"inherent":[3],"capacity":[4],"for":[5,62],"massive":[6],"connectivity,":[7],"ultra-low":[8],"latency":[9],"and":[10,23,37,65,133,163,221],"high":[11],"reliability,":[12],"B5G":[13],"networks":[14],"provide":[15],"an":[16],"ideal":[17],"infrastructure":[18],"to":[19,34,139,209],"support":[20],"the":[21,44,54,156,159,186,189,199,227],"diverse":[22],"dynamic":[24],"requirements":[25],"of":[26,29,75,78,105,143,151,158,171,188,201],"IoT":[27,68],"(Internet":[28],"Things)":[30],"communication.":[31],"Originally":[32],"designed":[33],"initiate,":[35],"modify":[36],"terminate":[38],"multimedia":[39],"sessions":[40],"over":[41],"IP":[42],"networks,":[43],"Session":[45],"Initiation":[46],"Protocol":[47],"(SIP),":[48],"a":[49,59,73,88,111,126,169,218,222],"standardized":[50],"protocol":[51,61],"developed":[52],"by":[53,149],"3GPP,":[55],"has":[56],"emerged":[57],"as":[58,87],"promising":[60],"enabling":[63],"communication":[64],"coordination":[66],"in":[67,120,134,161,231],"environments.":[69],"Nonetheless,":[70],"SIP":[71,176,202],"encounters":[72],"multitude":[74],"Distributed":[76],"Denial":[77],"Service":[79],"(DDoS)":[80],"threats,":[81],"with":[82,217],"INVITE":[83,145,165],"flooding":[84,146,166,203],"attacks":[85,167],"emerging":[86],"notable":[89],"challenge.":[90],"Traditional":[91],"IoT-IDS":[92],"(Intrusion":[93],"Detection":[94],"System)":[95],"relies":[96],"on":[97,102,130],"machine":[98],"learning":[99,196],"models":[100],"trained":[101],"local":[103],"data":[104],"deployment":[107,122],"context.":[108],"However,":[109],"such":[110],"model":[112,216],"may":[113],"not":[114],"detect":[115],"some":[116],"attack":[117,147],"patterns":[118],"observed":[119],"other":[121],"contexts.":[123],"We":[124],"propose":[125],"design":[127],"approach":[128],"based":[129],"federated":[131,195],"learning,":[132],"which":[135],"different":[136,182],"IDS":[137],"collaborate":[138],"achieve":[140],"early":[141],"detection":[142],"any":[144,150],"faced":[148],"them.":[152],"The":[153,214],"results":[154],"show":[155,193],"effectiveness":[157],"framework":[160],"detecting":[162],"mitigating":[164],"across":[168],"various":[170],"flow":[172],"intensities":[173],"under":[174,181],"realistic":[175],"operational":[177],"conditions.":[178],"Performance":[179],"evaluations":[180],"relevant":[183],"scenarios":[184],"demonstrate":[185],"robustness":[187],"proposed":[190],"framework.":[191],"Experiments":[192],"that":[194],"(FL)":[197],"enhances":[198],"analysis":[200],"attacks,":[204],"improving":[205],"accuracy":[206],"from":[207],"47":[208],"99%":[210],"through":[211],"knowledge":[212],"sharing.":[213],"FL":[215],"GRU":[219],"architecture":[220],"FedAvgM":[223],"aggregation":[224],"function":[225],"delivers":[226],"best":[228],"performance,":[229],"even":[230],"varied":[232],"scenarios.":[233]},"counts_by_year":[],"updated_date":"2026-03-17T09:09:15.849793","created_date":"2026-01-22T00:00:00"}