{"id":"https://openalex.org/W7135024960","doi":"https://doi.org/10.3390/fi18030145","title":"A Stage-Wise Framework Using Class-Incremental Learning for Unknown DoS Attack Detection","display_name":"A Stage-Wise Framework Using Class-Incremental Learning for Unknown DoS Attack Detection","publication_year":2026,"publication_date":"2026-03-12","ids":{"openalex":"https://openalex.org/W7135024960","doi":"https://doi.org/10.3390/fi18030145"},"language":"en","primary_location":{"id":"doi:10.3390/fi18030145","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi18030145","pdf_url":"https://www.mdpi.com/1999-5903/18/3/145/pdf?version=1773294337","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/1999-5903/18/3/145/pdf?version=1773294337","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5059754631","display_name":"Juncheng Ge","orcid":null},"institutions":[{"id":"https://openalex.org/I135598925","display_name":"Kyushu University","ror":"https://ror.org/00p4k0j84","country_code":"JP","type":"education","lineage":["https://openalex.org/I135598925"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Juncheng Ge","raw_affiliation_strings":["Graduate School of Information Science and Electrical Engineering, Kyushu University, Fukuoka 819-0395, Japan"],"raw_orcid":"https://orcid.org/0009-0002-4331-5726","affiliations":[{"raw_affiliation_string":"Graduate School of Information Science and Electrical Engineering, Kyushu University, Fukuoka 819-0395, Japan","institution_ids":["https://openalex.org/I135598925"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5128860770","display_name":"Yaokai Feng","orcid":null},"institutions":[{"id":"https://openalex.org/I135598925","display_name":"Kyushu University","ror":"https://ror.org/00p4k0j84","country_code":"JP","type":"education","lineage":["https://openalex.org/I135598925"]}],"countries":["JP"],"is_corresponding":true,"raw_author_name":"Yaokai Feng","raw_affiliation_strings":["Faculty of Information Science and Electrical Engineering, Kyushu University, Fukuoka 819-0395, Japan"],"raw_orcid":"https://orcid.org/0000-0001-6074-2514","affiliations":[{"raw_affiliation_string":"Faculty of Information Science and Electrical Engineering, Kyushu University, Fukuoka 819-0395, Japan","institution_ids":["https://openalex.org/I135598925"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5128883167","display_name":"Kouichi Sakurai","orcid":null},"institutions":[{"id":"https://openalex.org/I135598925","display_name":"Kyushu University","ror":"https://ror.org/00p4k0j84","country_code":"JP","type":"education","lineage":["https://openalex.org/I135598925"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Kouichi Sakurai","raw_affiliation_strings":["Faculty of Information Science and Electrical Engineering, Kyushu University, Fukuoka 819-0395, Japan"],"raw_orcid":"https://orcid.org/0000-0003-4621-1674","affiliations":[{"raw_affiliation_string":"Faculty of Information Science and Electrical Engineering, Kyushu University, Fukuoka 819-0395, Japan","institution_ids":["https://openalex.org/I135598925"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5128860770"],"corresponding_institution_ids":["https://openalex.org/I135598925"],"apc_list":{"value":1400,"currency":"CHF","value_usd":1515},"apc_paid":{"value":1400,"currency":"CHF","value_usd":1515},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.44918862,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"18","issue":"3","first_page":"145","last_page":"145"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9541000127792358,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9541000127792358,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.00430000014603138,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11652","display_name":"Imbalanced Data Classification Techniques","score":0.0035000001080334187,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6823999881744385},{"id":"https://openalex.org/keywords/attack-model","display_name":"Attack model","score":0.6003999710083008},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5824000239372253},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.44269999861717224},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.42559999227523804},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.3912000060081482},{"id":"https://openalex.org/keywords/anomaly-based-intrusion-detection-system","display_name":"Anomaly-based intrusion detection system","score":0.3797999918460846},{"id":"https://openalex.org/keywords/cyber-attack","display_name":"Cyber-attack","score":0.3192000091075897}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.886900007724762},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6823999881744385},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.6003999710083008},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5824000239372253},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4447999894618988},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.44269999861717224},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.42559999227523804},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4180999994277954},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.3912000060081482},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.3797999918460846},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3668000102043152},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.33309999108314514},{"id":"https://openalex.org/C201307755","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber-attack","level":2,"score":0.3192000091075897},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.30730000138282776},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.2994000017642975},{"id":"https://openalex.org/C2776973144","wikidata":"https://www.wikidata.org/wiki/Q6880649","display_name":"Misuse detection","level":4,"score":0.29829999804496765},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.2962999939918518},{"id":"https://openalex.org/C164866538","wikidata":"https://www.wikidata.org/wiki/Q367351","display_name":"Cluster (spacecraft)","level":2,"score":0.2822999954223633},{"id":"https://openalex.org/C4679612","wikidata":"https://www.wikidata.org/wiki/Q866298","display_name":"Aggregate (composite)","level":2,"score":0.2651999890804291},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.2615000009536743},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2612999975681305},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.25220000743865967}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/fi18030145","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi18030145","pdf_url":"https://www.mdpi.com/1999-5903/18/3/145/pdf?version=1773294337","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:da078fcf38ed4dee9235dd77f45c425e","is_oa":true,"landing_page_url":"https://doaj.org/article/da078fcf38ed4dee9235dd77f45c425e","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Future Internet, Vol 18, Iss 3, p 145 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/fi18030145","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi18030145","pdf_url":"https://www.mdpi.com/1999-5903/18/3/145/pdf?version=1773294337","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7135024960.pdf","grobid_xml":"https://content.openalex.org/works/W7135024960.grobid-xml"},"referenced_works_count":28,"referenced_works":["https://openalex.org/W2099940443","https://openalex.org/W2127979711","https://openalex.org/W2342408547","https://openalex.org/W2473930607","https://openalex.org/W2560647685","https://openalex.org/W2601243251","https://openalex.org/W2604589052","https://openalex.org/W2758497020","https://openalex.org/W2901114541","https://openalex.org/W2958285686","https://openalex.org/W2963197901","https://openalex.org/W2964189064","https://openalex.org/W3081229243","https://openalex.org/W3203064512","https://openalex.org/W3211972406","https://openalex.org/W4291278258","https://openalex.org/W4312227194","https://openalex.org/W4313058617","https://openalex.org/W4386211285","https://openalex.org/W4386911245","https://openalex.org/W4388624483","https://openalex.org/W4391093278","https://openalex.org/W4391857464","https://openalex.org/W4400316410","https://openalex.org/W4400945578","https://openalex.org/W4410405915","https://openalex.org/W4415918357","https://openalex.org/W7133187870"],"related_works":[],"abstract_inverted_index":{"Denial-of-Service":[0],"(DoS)":[1],"attacks":[2],"remain":[3],"one":[4],"of":[5,26,36,102,164,183,197,227],"the":[6,130,145,161,180,184,189,225,228],"most":[7],"dangerous":[8],"threats":[9],"in":[10],"modern":[11],"Internet":[12],"environments.":[13],"They":[14],"aim":[15],"to":[16,44,58,113,129,135,231],"overwhelm":[17],"networks,":[18],"servers,":[19],"or":[20],"online":[21],"services":[22],"with":[23,140],"massive":[24],"volumes":[25],"traffic,":[27],"and":[28,65,92,206],"maintaining":[29,169],"service":[30],"availability":[31],"is":[32,111,127,148],"a":[33,79,96,124,156],"core":[34],"pillar":[35],"cybersecurity.":[37],"More":[38],"importantly,":[39],"DoS":[40,62,117,133,181,199,236],"attack":[41,55,63,88,90,118,138,166,204,211],"techniques":[42],"continue":[43],"evolve.":[45],"However,":[46],"traditional":[47],"intrusion":[48,82],"detection":[49,83,109,171],"systems":[50],"(IDS)":[51],"trained":[52],"on":[53,173,179,218],"fixed":[54],"categories":[56],"struggle":[57],"identify":[59],"previously":[60,174,219],"unknown":[61,87,116,132,198,235],"types":[64],"cannot":[66],"dynamically":[67],"incorporate":[68],"newly":[69,152,209],"emerging":[70,137,203,234],"classes.":[71,122,176,221],"To":[72],"address":[73],"this":[74,76],"challenge,":[75],"study":[77],"proposes":[78],"stage-wise":[80,191],"network":[81],"framework":[84,100,192,230],"that":[85,188],"integrates":[86],"detection,":[89],"discovery,":[91],"class-incremental":[93,157],"learning":[94,158],"into":[95],"unified":[97],"pipeline.":[98],"The":[99],"consists":[101],"three":[103],"stages.":[104],"First,":[105],"an":[106],"autoencoder-based":[107],"anomaly":[108],"approach":[110],"used":[112],"separate":[114],"potential":[115],"samples":[119,134,196],"from":[120],"known":[121],"Second,":[123],"clustering-and-merging":[125],"strategy":[126],"applied":[128],"detected":[131],"discover":[136],"clusters":[139],"similar":[141],"structural":[142],"characteristics.":[143],"Third,":[144],"classifier":[146],"architecture":[147],"expanded":[149],"for":[150],"each":[151],"discovered":[153,210],"cluster":[154],"through":[155],"mechanism,":[159],"enabling":[160],"continual":[162],"incorporation":[163],"new":[165],"classes":[167,212],"while":[168],"stable":[170],"performance":[172,217],"learned":[175,220],"Experimental":[177],"results":[178,223],"category":[182],"NSL-KDD":[185],"dataset":[186],"demonstrate":[187],"proposed":[190,229],"can":[193],"effectively":[194],"isolate":[195],"attacks,":[200],"accurately":[201],"aggregate":[202],"clusters,":[205],"incrementally":[207],"integrate":[208],"without":[213],"significantly":[214],"degrading":[215],"recognition":[216],"These":[222],"confirm":[224],"capability":[226],"handle":[232],"progressively":[233],"attacks.":[237]},"counts_by_year":[],"updated_date":"2026-05-06T08:25:59.206177","created_date":"2026-03-13T00:00:00"}