{"id":"https://openalex.org/W4414070722","doi":"https://doi.org/10.32604/cmc.2025.067211","title":"Adapting Convolutional Autoencoder for DDoS Attack Detection via Joint Reconstruction Learning and Refined Anomaly Scoring","display_name":"Adapting Convolutional Autoencoder for DDoS Attack Detection via Joint Reconstruction Learning and Refined Anomaly Scoring","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4414070722","doi":"https://doi.org/10.32604/cmc.2025.067211"},"language":"en","primary_location":{"id":"doi:10.32604/cmc.2025.067211","is_oa":true,"landing_page_url":"https://doi.org/10.32604/cmc.2025.067211","pdf_url":null,"source":{"id":"https://openalex.org/S4210191605","display_name":"Computers, materials & continua/Computers, materials & continua (Print)","issn_l":"1546-2218","issn":["1546-2218","1546-2226"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers, Materials & Continua","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.32604/cmc.2025.067211","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5050613485","display_name":"Seul Ki Han","orcid":"https://orcid.org/0000-0002-8294-3517"},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Seulki Han","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065014631","display_name":"Sang-Ho Son","orcid":"https://orcid.org/0000-0002-4239-2458"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sangho Son","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5093089156","display_name":"Won Sakong","orcid":"https://orcid.org/0000-0002-8353-9380"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Won Sakong","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5053677671","display_name":"Haemin Jung","orcid":"https://orcid.org/0000-0002-1182-9303"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Haemin Jung","raw_affiliation_strings":[],"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5050613485"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.29010904,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"85","issue":"2","first_page":"2893","last_page":"2912"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9986000061035156,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9986000061035156,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9934999942779541,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.967199981212616,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/autoencoder","display_name":"Autoencoder","score":0.8170999884605408},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7591000199317932},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.6710000038146973},{"id":"https://openalex.org/keywords/anomaly","display_name":"Anomaly (physics)","score":0.49129998683929443},{"id":"https://openalex.org/keywords/weighting","display_name":"Weighting","score":0.45660001039505005},{"id":"https://openalex.org/keywords/convolutional-neural-network","display_name":"Convolutional neural network","score":0.4377000033855438},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.4043999910354614}],"concepts":[{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.8170999884605408},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7817999720573425},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7591000199317932},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.6710000038146973},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5748999714851379},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.49129998683929443},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4848000109195709},{"id":"https://openalex.org/C183115368","wikidata":"https://www.wikidata.org/wiki/Q856577","display_name":"Weighting","level":2,"score":0.45660001039505005},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4422000050544739},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.4377000033855438},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.4043999910354614},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.40149998664855957},{"id":"https://openalex.org/C88796919","wikidata":"https://www.wikidata.org/wiki/Q1142907","display_name":"Backbone network","level":2,"score":0.37779998779296875},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.36880001425743103},{"id":"https://openalex.org/C18555067","wikidata":"https://www.wikidata.org/wiki/Q8375051","display_name":"Joint (building)","level":2,"score":0.35679998993873596},{"id":"https://openalex.org/C106131492","wikidata":"https://www.wikidata.org/wiki/Q3072260","display_name":"Filter (signal processing)","level":2,"score":0.2721000015735626},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2669000029563904}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.32604/cmc.2025.067211","is_oa":true,"landing_page_url":"https://doi.org/10.32604/cmc.2025.067211","pdf_url":null,"source":{"id":"https://openalex.org/S4210191605","display_name":"Computers, materials & continua/Computers, materials & continua (Print)","issn_l":"1546-2218","issn":["1546-2218","1546-2226"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers, Materials & Continua","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.32604/cmc.2025.067211","is_oa":true,"landing_page_url":"https://doi.org/10.32604/cmc.2025.067211","pdf_url":null,"source":{"id":"https://openalex.org/S4210191605","display_name":"Computers, materials & continua/Computers, materials & continua (Print)","issn_l":"1546-2218","issn":["1546-2218","1546-2226"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers, Materials & Continua","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":13,"referenced_works":["https://openalex.org/W2027320593","https://openalex.org/W2100495367","https://openalex.org/W2778685442","https://openalex.org/W2900708792","https://openalex.org/W2963166639","https://openalex.org/W3010704846","https://openalex.org/W3027227991","https://openalex.org/W3166389143","https://openalex.org/W3186512740","https://openalex.org/W4313060919","https://openalex.org/W4392045078","https://openalex.org/W4398787743","https://openalex.org/W4407836453"],"related_works":["https://openalex.org/W3186512740","https://openalex.org/W4363671829","https://openalex.org/W2780476542","https://openalex.org/W2806741695","https://openalex.org/W4290647774","https://openalex.org/W3189286258","https://openalex.org/W3207797160","https://openalex.org/W3210364259","https://openalex.org/W4300558037","https://openalex.org/W2667207928"],"abstract_inverted_index":{"As":[0],"cyber":[1],"threats":[2],"become":[3],"increasingly":[4],"sophisticated,":[5],"Distributed":[6],"Denial-of-Service":[7],"(DDoS)":[8],"attacks":[9,255],"continue":[10],"to":[11,16,40,52,61,81,129,138,210],"pose":[12],"a":[13,75,121,152,240,247],"serious":[14],"threat":[15],"network":[17,43,154,232],"infrastructure,":[18],"often":[19],"disrupting":[20],"critical":[21],"services":[22],"through":[23,85,181],"overwhelming":[24],"traffic.":[25,117],"Although":[26],"unsupervised":[27,227],"anomaly":[28,66,77,92],"detection":[29,78,84,229,252],"using":[30,158],"convolutional":[31],"autoencoders":[32],"(CAEs)":[33],"has":[34],"gained":[35],"attention":[36],"for":[37,108,115,226,250],"its":[38],"ability":[39],"model":[41,237],"normal":[42,56,116,164],"behavior":[44],"without":[45,256],"requiring":[46],"labeled":[47,259],"data,":[48],"conventional":[49],"CAEs":[50,98],"struggle":[51],"effectively":[53],"distinguish":[54],"between":[55],"and":[57,64,90,133,145,166,187,212,222],"attack":[58,260],"traffic":[59,135,155],"due":[60],"over-generalized":[62],"reconstructions":[63],"naive":[65],"scoring.":[67,93],"To":[68],"address":[69],"these":[70],"limitations,":[71],"we":[72,119],"propose":[73],"CA-CAE,":[74],"novel":[76],"framework":[79,180,245],"designed":[80],"improve":[82],"DDoS":[83,228,254],"asymmetric":[86,101],"joint":[87],"reconstruction":[88,106],"learning":[89],"refined":[91],"Our":[94],"architecture":[95,238],"connects":[96],"two":[97],"sequentially":[99],"with":[100,189,239],"filter":[102],"allocation,":[103],"which":[104],"amplifies":[105],"errors":[107,114],"anomalous":[109,169],"data":[110],"while":[111],"preserving":[112],"low":[113],"Additionally,":[118],"introduce":[120],"scoring":[122,242],"mechanism":[123],"that":[124],"incorporates":[125],"exponential":[126],"decay":[127],"weighting":[128],"emphasize":[130],"recent":[131],"anomalies":[132],"relative":[134],"volume":[136],"adjustment":[137],"highlight":[139],"high-risk":[140],"instances,":[141],"enabling":[142],"more":[143],"accurate":[144],"timely":[146],"detection.":[147],"We":[148,176],"evaluate":[149],"CA-CAE":[150,225],"on":[151,258],"real-world":[153],"dataset":[156],"collected":[157],"Cisco":[159],"NetFlow,":[160],"containing":[161],"over":[162],"190,000":[163],"instances":[165],"only":[167],"78":[168],"instances\u2014an":[170],"extremely":[171],"imbalanced":[172],"scenario":[173],"(0.0004%":[174],"anomalies).":[175],"validate":[177],"the":[178,201,207,219],"proposed":[179],"extensive":[182],"experiments,":[183],"including":[184],"statistical":[185],"tests":[186],"comparisons":[188],"baseline":[190,208],"models.":[191,215],"Despite":[192],"this":[193],"challenge,":[194],"our":[195,244],"method":[196],"achieves":[197],"significant":[198],"improvement,":[199],"increasing":[200],"F1-score":[202],"from":[203],"0.515":[204],"obtained":[205],"by":[206],"CAE":[209],"0.934,":[211],"outperforming":[213],"other":[214],"These":[216],"results":[217],"demonstrate":[218],"effectiveness,":[220],"scalability,":[221],"practicality":[223],"of":[224,253],"in":[230],"realistic":[231],"environments.":[233],"By":[234],"combining":[235],"lightweight":[236],"domain-aware":[241],"strategy,":[243],"provides":[246],"robust":[248],"solution":[249],"early":[251],"relying":[257],"data.":[261]},"counts_by_year":[],"updated_date":"2026-03-07T16:01:11.037858","created_date":"2025-10-10T00:00:00"}