{"id":"https://openalex.org/W4415195857","doi":"https://doi.org/10.3390/jcp5040085","title":"Evaluating the Generalization Gaps of Intrusion Detection Systems Across DoS Attack Variants","display_name":"Evaluating the Generalization Gaps of Intrusion Detection Systems Across DoS Attack Variants","publication_year":2025,"publication_date":"2025-10-11","ids":{"openalex":"https://openalex.org/W4415195857","doi":"https://doi.org/10.3390/jcp5040085"},"language":"en","primary_location":{"id":"doi:10.3390/jcp5040085","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040085","pdf_url":"https://www.mdpi.com/2624-800X/5/4/85/pdf?version=1760155952","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2624-800X/5/4/85/pdf?version=1760155952","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5030759399","display_name":"Roshan Jameel","orcid":"https://orcid.org/0000-0001-6782-1741"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Roshan Jameel","raw_affiliation_strings":["Westford University College, Sharjah, United Arab Emirates"],"raw_orcid":"https://orcid.org/0000-0001-6782-1741","affiliations":[{"raw_affiliation_string":"Westford University College, Sharjah, United Arab Emirates","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5117783778","display_name":"Khyati Marwah","orcid":null},"institutions":[{"id":"https://openalex.org/I109703491","display_name":"Rochester Institute of Technology - Dubai","ror":"https://ror.org/03zmfa837","country_code":"AE","type":"education","lineage":["https://openalex.org/I109703491"]},{"id":"https://openalex.org/I4210164135","display_name":"Birla Institute of Technology and Science, Pilani - Dubai Campus","ror":"https://ror.org/05jnbme07","country_code":"AE","type":"education","lineage":["https://openalex.org/I4210164135","https://openalex.org/I74796645"]}],"countries":["AE"],"is_corresponding":false,"raw_author_name":"Khyati Marwah","raw_affiliation_strings":["Demont Institute of Management and Technology, Dubai, United Arab Emirates"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Demont Institute of Management and Technology, Dubai, United Arab Emirates","institution_ids":["https://openalex.org/I109703491","https://openalex.org/I4210164135"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Sheikh Mohammad Idrees","orcid":"https://orcid.org/0000-0003-3342-4187"},"institutions":[{"id":"https://openalex.org/I204778367","display_name":"Norwegian University of Science and Technology","ror":"https://ror.org/05xg72x27","country_code":"NO","type":"education","lineage":["https://openalex.org/I204778367"]}],"countries":["NO"],"is_corresponding":true,"raw_author_name":"Sheikh Mohammad Idrees","raw_affiliation_strings":["Department of Computer Science (IDI), Norwegian University of Science and Technology, 2802 Gj\u00f8vik, Norway"],"raw_orcid":"https://orcid.org/0000-0003-3342-4187","affiliations":[{"raw_affiliation_string":"Department of Computer Science (IDI), Norwegian University of Science and Technology, 2802 Gj\u00f8vik, Norway","institution_ids":["https://openalex.org/I204778367"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5076908748","display_name":"Mariusz Nowostawski","orcid":"https://orcid.org/0000-0002-2809-8615"},"institutions":[{"id":"https://openalex.org/I204778367","display_name":"Norwegian University of Science and Technology","ror":"https://ror.org/05xg72x27","country_code":"NO","type":"education","lineage":["https://openalex.org/I204778367"]}],"countries":["NO"],"is_corresponding":false,"raw_author_name":"Mariusz Nowostawski","raw_affiliation_strings":["Department of Computer Science (IDI), Norwegian University of Science and Technology, 2802 Gj\u00f8vik, Norway"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science (IDI), Norwegian University of Science and Technology, 2802 Gj\u00f8vik, Norway","institution_ids":["https://openalex.org/I204778367"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I204778367"],"apc_list":{"value":1000,"currency":"CHF","value_usd":1207},"apc_paid":{"value":1000,"currency":"CHF","value_usd":1207},"fwci":0.5754,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.73179347,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"5","issue":"4","first_page":"85","last_page":"85"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9980999827384949,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9951000213623047,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/generalization","display_name":"Generalization","score":0.6708999872207642},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5543000102043152},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.5388000011444092},{"id":"https://openalex.org/keywords/dimensionality-reduction","display_name":"Dimensionality reduction","score":0.5379999876022339},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.5212000012397766},{"id":"https://openalex.org/keywords/similarity","display_name":"Similarity (geometry)","score":0.45910000801086426},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.4456000030040741},{"id":"https://openalex.org/keywords/curse-of-dimensionality","display_name":"Curse of dimensionality","score":0.41990000009536743},{"id":"https://openalex.org/keywords/projection","display_name":"Projection (relational algebra)","score":0.3962000012397766},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.3959999978542328}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6714000105857849},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.6708999872207642},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6215000152587891},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.6036999821662903},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5543000102043152},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.5388000011444092},{"id":"https://openalex.org/C70518039","wikidata":"https://www.wikidata.org/wiki/Q16000077","display_name":"Dimensionality reduction","level":2,"score":0.5379999876022339},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.5212000012397766},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.45910000801086426},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.4456000030040741},{"id":"https://openalex.org/C111030470","wikidata":"https://www.wikidata.org/wiki/Q1430460","display_name":"Curse of dimensionality","level":2,"score":0.41990000009536743},{"id":"https://openalex.org/C57493831","wikidata":"https://www.wikidata.org/wiki/Q3134666","display_name":"Projection (relational algebra)","level":2,"score":0.3962000012397766},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.3959999978542328},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3939000070095062},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.3659999966621399},{"id":"https://openalex.org/C27438332","wikidata":"https://www.wikidata.org/wiki/Q2873","display_name":"Principal component analysis","level":2,"score":0.3630000054836273},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3540000021457672},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.33869999647140503},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.33059999346733093},{"id":"https://openalex.org/C2776836416","wikidata":"https://www.wikidata.org/wiki/Q1364844","display_name":"False alarm","level":2,"score":0.328000009059906},{"id":"https://openalex.org/C33676613","wikidata":"https://www.wikidata.org/wiki/Q13415176","display_name":"Dimension (graph theory)","level":2,"score":0.3244999945163727},{"id":"https://openalex.org/C2777036070","wikidata":"https://www.wikidata.org/wiki/Q18393452","display_name":"Random projection","level":2,"score":0.3237000107765198},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.3179999887943268},{"id":"https://openalex.org/C151876577","wikidata":"https://www.wikidata.org/wiki/Q7049464","display_name":"Nonlinear dimensionality reduction","level":3,"score":0.3158999979496002},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.3147999942302704},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.30250000953674316},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2996000051498413},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.28290000557899475},{"id":"https://openalex.org/C142853389","wikidata":"https://www.wikidata.org/wiki/Q744778","display_name":"Association (psychology)","level":2,"score":0.2612999975681305},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.26100000739097595},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2565999925136566}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/jcp5040085","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040085","pdf_url":"https://www.mdpi.com/2624-800X/5/4/85/pdf?version=1760155952","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:5028e81aeb71432196dea3b4a36b50b0","is_oa":true,"landing_page_url":"https://doaj.org/article/5028e81aeb71432196dea3b4a36b50b0","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Journal of Cybersecurity and Privacy, Vol 5, Iss 4, p 85 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/jcp5040085","is_oa":true,"landing_page_url":"https://doi.org/10.3390/jcp5040085","pdf_url":"https://www.mdpi.com/2624-800X/5/4/85/pdf?version=1760155952","source":{"id":"https://openalex.org/S4210232532","display_name":"Journal of Cybersecurity and Privacy","issn_l":"2624-800X","issn":["2624-800X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Journal of Cybersecurity and Privacy","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4415195857.pdf","grobid_xml":"https://content.openalex.org/works/W4415195857.grobid-xml"},"referenced_works_count":21,"referenced_works":["https://openalex.org/W1985987493","https://openalex.org/W2077488147","https://openalex.org/W2157496457","https://openalex.org/W2399941526","https://openalex.org/W2622610444","https://openalex.org/W2732560875","https://openalex.org/W2762776925","https://openalex.org/W2889326414","https://openalex.org/W2919868916","https://openalex.org/W2924689635","https://openalex.org/W2926701059","https://openalex.org/W2962862931","https://openalex.org/W3108630703","https://openalex.org/W3140854437","https://openalex.org/W3164437351","https://openalex.org/W3196738623","https://openalex.org/W4220846496","https://openalex.org/W4361296232","https://openalex.org/W4402634640","https://openalex.org/W4403094383","https://openalex.org/W4403677670"],"related_works":[],"abstract_inverted_index":{"Intrusion":[0],"Detection":[1],"Systems":[2],"(IDS)":[3],"play":[4],"a":[5,146],"vital":[6],"role":[7],"in":[8,20],"safeguarding":[9],"networks,":[10],"yet":[11],"their":[12],"effectiveness":[13],"is":[14],"often":[15,51],"challenged,":[16],"as":[17,79],"cyberattacks":[18],"evolve":[19],"new":[21],"and":[22,72,82,96,102,119,163,170,175,203],"unexpected":[23],"ways.":[24],"Machine":[25],"learning":[26],"models,":[27],"although":[28],"very":[29],"powerful,":[30],"usually":[31],"perform":[32],"well":[33],"only":[34],"on":[35,65,138,150],"data":[36],"that":[37,121,153],"closely":[38],"resembles":[39],"what":[40],"they":[41,50],"were":[42],"trained":[43],"on.":[44],"When":[45],"faced":[46],"with":[47,91],"unfamiliar":[48],"traffic,":[49],"misclassify.":[52],"In":[53],"this":[54,58],"work,":[55],"we":[56,111,166],"examine":[57],"generalization":[59],"gap":[60],"by":[61],"training":[62,98,174],"IDS":[63,206],"models":[64,142],"one":[66],"Denial-of-Service":[67],"(DoS)":[68],"variant,":[69],"DoS":[70],"Hulk,":[71],"testing":[73,176],"them":[74],"against":[75],"other":[76],"variants":[77],"such":[78],"Goldeneye,":[80],"Slowloris,":[81],"Slowhttptest.":[83],"Our":[84,187],"approach":[85],"combines":[86],"careful":[87],"preprocessing,":[88],"dimensionality":[89],"reduction":[90],"Principal":[92],"Component":[93],"Analysis":[94],"(PCA),":[95],"model":[97,109],"using":[99,159],"Random":[100],"Forests":[101],"Deep":[103],"Neural":[104],"Networks.":[105],"To":[106],"better":[107],"understand":[108],"behavior,":[110],"tuned":[112],"decision":[113],"thresholds":[114],"beyond":[115],"the":[116,141],"default":[117],"0.5":[118],"found":[120],"small":[122],"adjustments":[123],"can":[124],"significantly":[125],"affect":[126],"results.":[127],"We":[128],"also":[129],"applied":[130],"Shapley":[131],"Additive":[132],"Explanations":[133],"(SHAP)":[134],"to":[135,148,209],"shed":[136],"light":[137],"which":[139],"features":[140],"rely":[143],"on,":[144],"revealing":[145],"tendency":[147],"focus":[149],"fixed":[151],"components":[152],"do":[154],"not":[155,181,200],"generalize":[156],"well.":[157],"Finally,":[158],"Uniform":[160],"Manifold":[161],"Approximation":[162],"Projection":[164],"(UMAP),":[165],"visualized":[167],"feature":[168],"distributions":[169],"observed":[171],"overlaps":[172],"between":[173,197],"datasets,":[177],"but":[178],"these":[179],"did":[180],"translate":[182],"into":[183],"improved":[184],"detection":[185],"performance.":[186],"findings":[188],"highlight":[189],"an":[190],"important":[191],"lesson:":[192],"visual":[193],"or":[194],"apparent":[195],"similarity":[196],"datasets":[198],"does":[199],"guarantee":[201],"generalization,":[202],"building":[204],"robust":[205],"requires":[207],"exposure":[208],"diverse":[210],"attack":[211],"patterns":[212],"during":[213],"training.":[214]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-08-25T07:29:55.448023","created_date":"2025-10-15T00:00:00"}