{"id":"https://openalex.org/W7138954879","doi":"https://doi.org/10.31449/inf.v50i10.12390","title":"A Hybrid Deep Learning Architecture for Network Security Situation Awareness and Pre-Alarm in Large-Scale Data Environments Using LSTM, Autoencoder, and GNN","display_name":"A Hybrid Deep Learning Architecture for Network Security Situation Awareness and Pre-Alarm in Large-Scale Data Environments Using LSTM, Autoencoder, and GNN","publication_year":2026,"publication_date":"2026-03-18","ids":{"openalex":"https://openalex.org/W7138954879","doi":"https://doi.org/10.31449/inf.v50i10.12390"},"language":null,"primary_location":{"id":"doi:10.31449/inf.v50i10.12390","is_oa":true,"landing_page_url":"https://doi.org/10.31449/inf.v50i10.12390","pdf_url":"https://www.informatica.si/index.php/informatica/article/download/12390/6598","source":{"id":"https://openalex.org/S4210173311","display_name":"Informatica","issn_l":"0350-5596","issn":["0350-5596","1854-3871"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310314525","host_organization_name":"Slovenian Society Informatika","host_organization_lineage":["https://openalex.org/P4310314525"],"host_organization_lineage_names":["Slovenian Society Informatika"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Informatica","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://www.informatica.si/index.php/informatica/article/download/12390/6598","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5129760682","display_name":"Xiaoxia Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I4210157581","display_name":"Jiangsu Police Officer College","ror":"https://ror.org/04k1m2t10","country_code":"CN","type":"education","lineage":["https://openalex.org/I4210157581"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Xiaoxia Wang","raw_affiliation_strings":["School of Information and Network Security, Inner Mongolia Police College, Hohhot 010051, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Information and Network Security, Inner Mongolia Police College, Hohhot 010051, China","institution_ids":["https://openalex.org/I4210157581"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5129760682"],"corresponding_institution_ids":["https://openalex.org/I4210157581"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.29509496,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"50","issue":"10","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.2660999894142151,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.2660999894142151,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.24130000174045563,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T13918","display_name":"Advanced Data and IoT Technologies","score":0.03620000183582306,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/situation-awareness","display_name":"Situation awareness","score":0.722000002861023},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.51910001039505},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.48989999294281006},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.4189000129699707},{"id":"https://openalex.org/keywords/warning-system","display_name":"Warning system","score":0.4153999984264374},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.4099999964237213},{"id":"https://openalex.org/keywords/network-architecture","display_name":"Network architecture","score":0.39399999380111694},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.3747999966144562},{"id":"https://openalex.org/keywords/alarm","display_name":"ALARM","score":0.36070001125335693}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7419999837875366},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.722000002861023},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.51910001039505},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.48989999294281006},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4659000039100647},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.4189000129699707},{"id":"https://openalex.org/C29825287","wikidata":"https://www.wikidata.org/wiki/Q1427940","display_name":"Warning system","level":2,"score":0.4153999984264374},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.4099999964237213},{"id":"https://openalex.org/C193415008","wikidata":"https://www.wikidata.org/wiki/Q639681","display_name":"Network architecture","level":2,"score":0.39399999380111694},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.37529999017715454},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.3747999966144562},{"id":"https://openalex.org/C2779119184","wikidata":"https://www.wikidata.org/wiki/Q294350","display_name":"ALARM","level":2,"score":0.36070001125335693},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.357699990272522},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.3560999929904938},{"id":"https://openalex.org/C193702766","wikidata":"https://www.wikidata.org/wiki/Q1414548","display_name":"Concurrency","level":2,"score":0.35420000553131104},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.35359999537467957},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.34950000047683716},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3467000126838684},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3361000120639801},{"id":"https://openalex.org/C157764524","wikidata":"https://www.wikidata.org/wiki/Q1383412","display_name":"Throughput","level":3,"score":0.32580000162124634},{"id":"https://openalex.org/C104122410","wikidata":"https://www.wikidata.org/wiki/Q1416406","display_name":"Network model","level":2,"score":0.31790000200271606},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.2989000082015991},{"id":"https://openalex.org/C2778137410","wikidata":"https://www.wikidata.org/wiki/Q2732820","display_name":"Government (linguistics)","level":2,"score":0.2922999858856201},{"id":"https://openalex.org/C58489278","wikidata":"https://www.wikidata.org/wiki/Q1172284","display_name":"Data set","level":2,"score":0.29089999198913574},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.28700000047683716},{"id":"https://openalex.org/C19012869","wikidata":"https://www.wikidata.org/wiki/Q578372","display_name":"Response time","level":2,"score":0.2849999964237213},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.27630001306533813},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.27390000224113464}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.31449/inf.v50i10.12390","is_oa":true,"landing_page_url":"https://doi.org/10.31449/inf.v50i10.12390","pdf_url":"https://www.informatica.si/index.php/informatica/article/download/12390/6598","source":{"id":"https://openalex.org/S4210173311","display_name":"Informatica","issn_l":"0350-5596","issn":["0350-5596","1854-3871"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310314525","host_organization_name":"Slovenian Society Informatika","host_organization_lineage":["https://openalex.org/P4310314525"],"host_organization_lineage_names":["Slovenian Society Informatika"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Informatica","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.31449/inf.v50i10.12390","is_oa":true,"landing_page_url":"https://doi.org/10.31449/inf.v50i10.12390","pdf_url":"https://www.informatica.si/index.php/informatica/article/download/12390/6598","source":{"id":"https://openalex.org/S4210173311","display_name":"Informatica","issn_l":"0350-5596","issn":["0350-5596","1854-3871"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310314525","host_organization_name":"Slovenian Society Informatika","host_organization_lineage":["https://openalex.org/P4310314525"],"host_organization_lineage_names":["Slovenian Society Informatika"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Informatica","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.6146082878112793,"id":"https://metadata.un.org/sdg/1","display_name":"No poverty"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7138954879.pdf","grobid_xml":"https://content.openalex.org/works/W7138954879.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"In":[0,157],"the":[1,12,74,97,102,140,154,158,163,171,180,193,198],"large-scale":[2],"data":[3,113],"environment,":[4,162],"network":[5,56,62,216],"security":[6,217],"situational":[7],"awareness":[8],"(NSSA)":[9],"often":[10],"faces":[11],"problems":[13],"of":[14,53,119,142,182,197],"poor":[15],"real-time":[16],"performance":[17],"and":[18,59,69,87,100,115,124,131,179,195,205,214],"low":[19],"early":[20,29],"warning":[21,30],"accuracy.":[22],"Therefore,":[23],"this":[24,143],"article":[25],"proposes":[26],"an":[27,212],"intelligent":[28,213],"model":[31,38,144,200],"that":[32,139],"integrates":[33,48],"multi-source":[34],"heterogeneous":[35],"data.":[36],"This":[37,190],"constructs":[39],"a":[40,49,77,88,116,120,207],"distributed":[41],"processing":[42],"architecture":[43],"based":[44],"on":[45,110,147],"Spark+Flink,":[46],"which":[47,149],"hybrid":[50],"analysis":[51],"mechanism":[52,80],"long-term":[54],"memory":[55],"(LSTM),":[57],"self-encoder":[58],"graph":[60],"neural":[61],"(GNN)":[63],"to":[64,95,168],"efficiently":[65],"detect":[66],"abnormal":[67],"behaviors":[68],"infer":[70],"attack":[71],"paths.":[72],"At":[73],"same":[75],"time,":[76],"situation":[78],"scoring":[79],"with":[81],"dynamic":[82],"weight":[83],"adjustment":[84],"is":[85,93,145,150,166,175,185],"designed,":[86],"time":[89],"decay":[90],"suppression":[91],"strategy":[92],"introduced":[94],"optimize":[96],"alarm":[98,104,133],"output":[99],"reduce":[101],"false":[103],"rate.":[105],"The":[106,136],"experiment":[107],"was":[108],"conducted":[109],"CICIDS2017":[111],"public":[112],"set":[114],"real":[117,159],"log":[118],"provincial":[121],"government":[122,160],"cloud,":[123],"evaluated":[125],"by":[126,187],"F1-score,":[127],"AUC,":[128],"response":[129,173],"delay":[130,174],"effective":[132,183],"compression":[134],"ratio.":[135],"results":[137],"show":[138],"F1-score":[141],"0.93":[146],"CICIDS2017,":[148],"significantly":[151],"better":[152],"than":[153],"traditional":[155],"method.":[156],"cloud":[161],"system":[164],"throughput":[165],"up":[167],"183,000":[169],"pieces/second,":[170],"average":[172],"controlled":[176],"within":[177],"300ms,":[178],"number":[181],"alarms":[184],"reduced":[186],"over":[188],"65%.":[189],"study":[191],"verifies":[192],"feasibility":[194],"superiority":[196],"proposed":[199],"in":[201],"high":[202],"concurrency":[203],"scenarios,":[204],"provides":[206],"practical":[208],"basis":[209],"for":[210],"building":[211],"extensible":[215],"defense":[218],"system.":[219]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2026-03-20T00:00:00"}