{"id":"https://openalex.org/W4220969123","doi":"https://doi.org/10.3390/informatics9010029","title":"Benchmarking Deep Learning Methods for Behaviour-Based Network Intrusion Detection","display_name":"Benchmarking Deep Learning Methods for Behaviour-Based Network Intrusion Detection","publication_year":2022,"publication_date":"2022-03-20","ids":{"openalex":"https://openalex.org/W4220969123","doi":"https://doi.org/10.3390/informatics9010029"},"language":"en","primary_location":{"id":"doi:10.3390/informatics9010029","is_oa":true,"landing_page_url":"https://doi.org/10.3390/informatics9010029","pdf_url":"https://www.mdpi.com/2227-9709/9/1/29/pdf?version=1648087048","source":{"id":"https://openalex.org/S2738238905","display_name":"Informatics","issn_l":"2227-9709","issn":["2227-9709"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Informatics","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2227-9709/9/1/29/pdf?version=1648087048","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5085602004","display_name":"M\u00e1rio Antunes","orcid":"https://orcid.org/0000-0003-3448-6726"},"institutions":[{"id":"https://openalex.org/I169427155","display_name":"Instituto Polit\u00e9cnico de Leiria","ror":"https://ror.org/010dvvh94","country_code":"PT","type":"education","lineage":["https://openalex.org/I169427155"]},{"id":"https://openalex.org/I4210166615","display_name":"INESC TEC","ror":"https://ror.org/05fa8ka61","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I4210125590","https://openalex.org/I4210166615"]}],"countries":["PT"],"is_corresponding":true,"raw_author_name":"M\u00e1rio Antunes","raw_affiliation_strings":["Computer Science and Communication Research Centre (CIIC), School of Technology and Management, Polytechnic of Leiria, 2411-901 Leiria, Portugal","Institute for Systems and Computer Engineering, Technology and Science (INESC TEC, CRACS), 4200-465 Porto, Portugal"],"affiliations":[{"raw_affiliation_string":"Computer Science and Communication Research Centre (CIIC), School of Technology and Management, Polytechnic of Leiria, 2411-901 Leiria, Portugal","institution_ids":["https://openalex.org/I169427155"]},{"raw_affiliation_string":"Institute for Systems and Computer Engineering, Technology and Science (INESC TEC, CRACS), 4200-465 Porto, Portugal","institution_ids":["https://openalex.org/I4210166615"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5036003052","display_name":"Lu\u00eds Oliveira","orcid":"https://orcid.org/0000-0001-9412-5012"},"institutions":[{"id":"https://openalex.org/I4210126619","display_name":"Instituto Polit\u00e9cnico de Tomar","ror":"https://ror.org/03gsfpp62","country_code":"PT","type":"education","lineage":["https://openalex.org/I4210126619"]}],"countries":["PT"],"is_corresponding":true,"raw_author_name":"Lu\u00eds Oliveira","raw_affiliation_strings":["Smart Cities Research Center (Ci2), Polytechnic Institute of Tomar, 2300-313 Tomar, Portugal"],"affiliations":[{"raw_affiliation_string":"Smart Cities Research Center (Ci2), Polytechnic Institute of Tomar, 2300-313 Tomar, Portugal","institution_ids":["https://openalex.org/I4210126619"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5056402338","display_name":"Afonso Seguro","orcid":null},"institutions":[{"id":"https://openalex.org/I4210126619","display_name":"Instituto Polit\u00e9cnico de Tomar","ror":"https://ror.org/03gsfpp62","country_code":"PT","type":"education","lineage":["https://openalex.org/I4210126619"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Afonso Seguro","raw_affiliation_strings":["Polytechnic Institute of Tomar, 2300-313 Tomar, Portugal"],"affiliations":[{"raw_affiliation_string":"Polytechnic Institute of Tomar, 2300-313 Tomar, Portugal","institution_ids":["https://openalex.org/I4210126619"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5036645357","display_name":"Jo\u00e3o Ver\u00edssimo","orcid":"https://orcid.org/0000-0002-1264-3017"},"institutions":[{"id":"https://openalex.org/I4210126619","display_name":"Instituto Polit\u00e9cnico de Tomar","ror":"https://ror.org/03gsfpp62","country_code":"PT","type":"education","lineage":["https://openalex.org/I4210126619"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Jo\u00e3o Ver\u00edssimo","raw_affiliation_strings":["Polytechnic Institute of Tomar, 2300-313 Tomar, Portugal"],"affiliations":[{"raw_affiliation_string":"Polytechnic Institute of Tomar, 2300-313 Tomar, Portugal","institution_ids":["https://openalex.org/I4210126619"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102446064","display_name":"Ruben Salgado","orcid":null},"institutions":[{"id":"https://openalex.org/I4210126619","display_name":"Instituto Polit\u00e9cnico de Tomar","ror":"https://ror.org/03gsfpp62","country_code":"PT","type":"education","lineage":["https://openalex.org/I4210126619"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Ruben Salgado","raw_affiliation_strings":["Polytechnic Institute of Tomar, 2300-313 Tomar, Portugal"],"affiliations":[{"raw_affiliation_string":"Polytechnic Institute of Tomar, 2300-313 Tomar, Portugal","institution_ids":["https://openalex.org/I4210126619"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5019093489","display_name":"Tiago Murteira","orcid":null},"institutions":[{"id":"https://openalex.org/I4210126619","display_name":"Instituto Polit\u00e9cnico de Tomar","ror":"https://ror.org/03gsfpp62","country_code":"PT","type":"education","lineage":["https://openalex.org/I4210126619"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Tiago Murteira","raw_affiliation_strings":["Polytechnic Institute of Tomar, 2300-313 Tomar, Portugal"],"affiliations":[{"raw_affiliation_string":"Polytechnic Institute of Tomar, 2300-313 Tomar, Portugal","institution_ids":["https://openalex.org/I4210126619"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":6,"corresponding_author_ids":["https://openalex.org/A5036003052","https://openalex.org/A5085602004"],"corresponding_institution_ids":["https://openalex.org/I169427155","https://openalex.org/I4210126619","https://openalex.org/I4210166615"],"apc_list":{"value":1600,"currency":"CHF","value_usd":1732},"apc_paid":{"value":1600,"currency":"CHF","value_usd":1732},"fwci":2.485,"has_fulltext":true,"cited_by_count":20,"citation_normalized_percentile":{"value":0.89198857,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":100},"biblio":{"volume":"9","issue":"1","first_page":"29","last_page":"29"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9951000213623047,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8365305662155151},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.7733541131019592},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.7459971308708191},{"id":"https://openalex.org/keywords/benchmarking","display_name":"Benchmarking","score":0.7178134322166443},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.6726574897766113},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6424397230148315},{"id":"https://openalex.org/keywords/autoencoder","display_name":"Autoencoder","score":0.6276652812957764},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.6181057691574097},{"id":"https://openalex.org/keywords/convolutional-neural-network","display_name":"Convolutional neural network","score":0.5699928998947144},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.552214503288269},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.5076504945755005},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.42712274193763733},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.4264410138130188},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.40359118580818176},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.07515642046928406}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8365305662155151},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.7733541131019592},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.7459971308708191},{"id":"https://openalex.org/C86251818","wikidata":"https://www.wikidata.org/wiki/Q816754","display_name":"Benchmarking","level":2,"score":0.7178134322166443},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.6726574897766113},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6424397230148315},{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.6276652812957764},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.6181057691574097},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.5699928998947144},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.552214503288269},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.5076504945755005},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.42712274193763733},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.4264410138130188},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.40359118580818176},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.07515642046928406},{"id":"https://openalex.org/C162853370","wikidata":"https://www.wikidata.org/wiki/Q39809","display_name":"Marketing","level":1,"score":0.0},{"id":"https://openalex.org/C13280743","wikidata":"https://www.wikidata.org/wiki/Q131089","display_name":"Geodesy","level":1,"score":0.0},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C205649164","wikidata":"https://www.wikidata.org/wiki/Q1071","display_name":"Geography","level":0,"score":0.0},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.0},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.3390/informatics9010029","is_oa":true,"landing_page_url":"https://doi.org/10.3390/informatics9010029","pdf_url":"https://www.mdpi.com/2227-9709/9/1/29/pdf?version=1648087048","source":{"id":"https://openalex.org/S2738238905","display_name":"Informatics","issn_l":"2227-9709","issn":["2227-9709"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Informatics","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:9c839efef4c04c88ad6005824ceadc05","is_oa":true,"landing_page_url":"https://doaj.org/article/9c839efef4c04c88ad6005824ceadc05","pdf_url":null,"source":{"id":"https://openalex.org/S112646816","display_name":"SHILAP Revista de lepidopterolog\u00eda","issn_l":"0300-5267","issn":["0300-5267","2340-4078"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Informatics, Vol 9, Iss 1, p 29 (2022)","raw_type":"article"},{"id":"pmh:oai:mdpi.com:/2227-9709/9/1/29/","is_oa":true,"landing_page_url":"https://dx.doi.org/10.3390/informatics9010029","pdf_url":null,"source":{"id":"https://openalex.org/S4306400947","display_name":"MDPI (MDPI AG)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210097602","host_organization_name":"Multidisciplinary Digital Publishing Institute (Switzerland)","host_organization_lineage":["https://openalex.org/I4210097602"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Informatics; Volume 9; Issue 1; Pages: 29","raw_type":"Text"}],"best_oa_location":{"id":"doi:10.3390/informatics9010029","is_oa":true,"landing_page_url":"https://doi.org/10.3390/informatics9010029","pdf_url":"https://www.mdpi.com/2227-9709/9/1/29/pdf?version=1648087048","source":{"id":"https://openalex.org/S2738238905","display_name":"Informatics","issn_l":"2227-9709","issn":["2227-9709"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Informatics","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.47999998927116394,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4220969123.pdf","grobid_xml":"https://content.openalex.org/works/W4220969123.grobid-xml"},"referenced_works_count":37,"referenced_works":["https://openalex.org/W1480235938","https://openalex.org/W1988918299","https://openalex.org/W2099940443","https://openalex.org/W2129429132","https://openalex.org/W2149726907","https://openalex.org/W2756489700","https://openalex.org/W2789828921","https://openalex.org/W2797025766","https://openalex.org/W2807786182","https://openalex.org/W2874136421","https://openalex.org/W2885195348","https://openalex.org/W2890988085","https://openalex.org/W2919936975","https://openalex.org/W2928016897","https://openalex.org/W2934699052","https://openalex.org/W2952066300","https://openalex.org/W2989009480","https://openalex.org/W2991507433","https://openalex.org/W2997301451","https://openalex.org/W3011424859","https://openalex.org/W3015108593","https://openalex.org/W3027870121","https://openalex.org/W3032021129","https://openalex.org/W3035510612","https://openalex.org/W3048668222","https://openalex.org/W3080177360","https://openalex.org/W3088919849","https://openalex.org/W3091379954","https://openalex.org/W3108630703","https://openalex.org/W3127678453","https://openalex.org/W3195193442","https://openalex.org/W3200617211","https://openalex.org/W4200593832","https://openalex.org/W6748503732","https://openalex.org/W6770850057","https://openalex.org/W6772070325","https://openalex.org/W6811959033"],"related_works":["https://openalex.org/W2061466315","https://openalex.org/W2376886931","https://openalex.org/W2010561419","https://openalex.org/W2374845301","https://openalex.org/W2351448539","https://openalex.org/W1977863481","https://openalex.org/W2384741105","https://openalex.org/W1495178644","https://openalex.org/W2185594426","https://openalex.org/W3157271777"],"abstract_inverted_index":{"Network":[0],"security":[1],"encloses":[2],"a":[3,41,167],"wide":[4,71],"set":[5,72,168],"of":[6,16,52,59,73,91,127,130,169,213,232,245,262],"technologies":[7],"dealing":[8],"with":[9,84],"intrusions":[10,92],"detection.":[11],"Despite":[12],"the":[13,50,110,115,197,204,211,215,230,257,265],"massive":[14],"adoption":[15],"signature-based":[17,45],"network":[18,35,61,121,156],"intrusion":[19,122],"detection":[20,123,206,267],"systems":[21],"(IDSs),":[22],"they":[23,144],"fail":[24],"in":[25,196,203,264],"detecting":[26,88],"zero-day":[27],"attacks":[28],"and":[29,63,93,113,132,150,165,177,183,200,235,243],"previously":[30,246],"unseen":[31,240],"vulnerabilities":[32],"exploits.":[33],"Behaviour-based":[34],"IDSs":[36,83],"have":[37,99],"been":[38,78],"seen":[39],"as":[40,143],"way":[42],"to":[43,55,64,80,104,138,161,192,218,228,238],"overcome":[44],"IDS":[46],"flaws,":[47],"namely":[48,101,172],"through":[49],"implementation":[51],"machine-learning-based":[53],"methods,":[54,171],"tolerate":[56],"new":[57,89],"forms":[58,90],"normal":[60,131,241],"behaviour,":[62],"identify":[65],"yet":[66],"unknown":[67],"malicious":[68,133],"activities.":[69],"A":[70],"machine":[74,96,140],"learning":[75,97,141,222],"methods":[76,188,237,255],"has":[77],"applied":[79,191],"implement":[81],"behaviour-based":[82,120],"promising":[85],"results":[86,209,250],"on":[87,153],"attacks.":[94,248],"Innovative":[95],"techniques":[98],"emerged,":[100],"deep-learning-based":[102,170],"techniques,":[103],"process":[105],"unstructured":[106],"data,":[107],"speed":[108],"up":[109],"classification":[111],"process,":[112],"improve":[114],"overall":[116,205,266],"performance":[117],"obtained":[118],"by":[119],"systems.":[124],"The":[125,208,249],"use":[126],"realistic":[128,154],"datasets":[129],"networking":[134,148],"activities":[135],"is":[136],"crucial":[137],"benchmark":[139,166,219],"models,":[142],"should":[145],"represent":[146],"real-world":[147],"scenarios":[149],"be":[151],"based":[152],"computers":[155],"activity.":[157],"This":[158],"paper":[159],"aims":[160],"evaluate":[162,193,229],"CSE-CIC-IDS2018":[163,216],"dataset":[164,199,217],"convolutional":[173],"neural":[174],"networks":[175],"(CNN)":[176],"long":[178],"short-term":[179],"memory":[180],"(LSTM).":[181],"Autoencoder":[182],"principal":[184],"component":[185],"analysis":[186],"(PCA)":[187],"were":[189],"also":[190,226],"features":[194],"reduction":[195,254],"original":[198],"its":[201],"implications":[202],"performance.":[207,268],"revealed":[210],"appropriateness":[212],"using":[214,233],"supervised":[220],"deep":[221],"models.":[223],"It":[224],"was":[225],"possible":[227],"robustness":[231],"CNN":[234],"LSTM":[236],"detect":[239],"activity":[242],"variations":[244],"trained":[247],"reveal":[251],"that":[252],"feature":[253],"decreased":[256],"processing":[258],"time":[259],"without":[260],"loss":[261],"accuracy":[263]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":8},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":2}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2022-04-03T00:00:00"}