{"id":"https://openalex.org/W4409681853","doi":"https://doi.org/10.3390/sym17050628","title":"Harnessing AI for Cyber Defense: Honeypot-Driven Intrusion Detection Systems","display_name":"Harnessing AI for Cyber Defense: Honeypot-Driven Intrusion Detection Systems","publication_year":2025,"publication_date":"2025-04-22","ids":{"openalex":"https://openalex.org/W4409681853","doi":"https://doi.org/10.3390/sym17050628"},"language":"en","primary_location":{"id":"doi:10.3390/sym17050628","is_oa":true,"landing_page_url":"https://doi.org/10.3390/sym17050628","pdf_url":"https://www.mdpi.com/2073-8994/17/5/628/pdf?version=1745311811","source":{"id":"https://openalex.org/S190787756","display_name":"Symmetry","issn_l":"2073-8994","issn":["2073-8994"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Symmetry","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2073-8994/17/5/628/pdf?version=1745311811","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5088718175","display_name":"Eman Alatawi","orcid":null},"institutions":[{"id":"https://openalex.org/I72264486","display_name":"University of Tabuk","ror":"https://ror.org/04yej8x59","country_code":"SA","type":"education","lineage":["https://openalex.org/I72264486"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Eman Alatawi","raw_affiliation_strings":["College of Computing and Information Technology, University of Tabuk, Tabuk 71491, Saudi Arabia"],"raw_orcid":"https://orcid.org/0009-0000-4472-5247","affiliations":[{"raw_affiliation_string":"College of Computing and Information Technology, University of Tabuk, Tabuk 71491, Saudi Arabia","institution_ids":["https://openalex.org/I72264486"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5032835173","display_name":"Umar Albalawi","orcid":"https://orcid.org/0000-0002-4852-3981"},"institutions":[{"id":"https://openalex.org/I72264486","display_name":"University of Tabuk","ror":"https://ror.org/04yej8x59","country_code":"SA","type":"education","lineage":["https://openalex.org/I72264486"]}],"countries":["SA"],"is_corresponding":true,"raw_author_name":"Umar Albalawi","raw_affiliation_strings":["College of Computing and Information Technology, University of Tabuk, Tabuk 71491, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0002-4852-3981","affiliations":[{"raw_affiliation_string":"College of Computing and Information Technology, University of Tabuk, Tabuk 71491, Saudi Arabia","institution_ids":["https://openalex.org/I72264486"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5032835173"],"corresponding_institution_ids":["https://openalex.org/I72264486"],"apc_list":{"value":2000,"currency":"CHF","value_usd":2227},"apc_paid":{"value":2000,"currency":"CHF","value_usd":2227},"fwci":6.6787,"has_fulltext":true,"cited_by_count":10,"citation_normalized_percentile":{"value":0.96796733,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":"17","issue":"5","first_page":"628","last_page":"628"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9973999857902527,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/honeypot","display_name":"Honeypot","score":0.9588727951049805},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6649562120437622},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5877155065536499},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5716657042503357},{"id":"https://openalex.org/keywords/cyberwarfare","display_name":"Cyberwarfare","score":0.44345730543136597},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.43564194440841675}],"concepts":[{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.9588727951049805},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6649562120437622},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5877155065536499},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5716657042503357},{"id":"https://openalex.org/C171769113","wikidata":"https://www.wikidata.org/wiki/Q849340","display_name":"Cyberwarfare","level":2,"score":0.44345730543136597},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.43564194440841675},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.0},{"id":"https://openalex.org/C17409809","wikidata":"https://www.wikidata.org/wiki/Q161764","display_name":"Geochemistry","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.3390/sym17050628","is_oa":true,"landing_page_url":"https://doi.org/10.3390/sym17050628","pdf_url":"https://www.mdpi.com/2073-8994/17/5/628/pdf?version=1745311811","source":{"id":"https://openalex.org/S190787756","display_name":"Symmetry","issn_l":"2073-8994","issn":["2073-8994"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Symmetry","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.3390/sym17050628","is_oa":true,"landing_page_url":"https://doi.org/10.3390/sym17050628","pdf_url":"https://www.mdpi.com/2073-8994/17/5/628/pdf?version=1745311811","source":{"id":"https://openalex.org/S190787756","display_name":"Symmetry","issn_l":"2073-8994","issn":["2073-8994"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Symmetry","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4409681853.pdf","grobid_xml":"https://content.openalex.org/works/W4409681853.grobid-xml"},"referenced_works_count":25,"referenced_works":["https://openalex.org/W2026863602","https://openalex.org/W2123840312","https://openalex.org/W3014887427","https://openalex.org/W3039222472","https://openalex.org/W3046155323","https://openalex.org/W3158704653","https://openalex.org/W3162111110","https://openalex.org/W4207002770","https://openalex.org/W4285141068","https://openalex.org/W4319083919","https://openalex.org/W4376288669","https://openalex.org/W4384948624","https://openalex.org/W4392010342","https://openalex.org/W4393405725","https://openalex.org/W4394744176","https://openalex.org/W4395113884","https://openalex.org/W4400323427","https://openalex.org/W4402264250","https://openalex.org/W4402265033","https://openalex.org/W4402617097","https://openalex.org/W4403400573","https://openalex.org/W6839582370","https://openalex.org/W6861556217","https://openalex.org/W6873426926","https://openalex.org/W6905010448"],"related_works":["https://openalex.org/W2312996858","https://openalex.org/W2392120181","https://openalex.org/W2307276533","https://openalex.org/W2390124310","https://openalex.org/W178168142","https://openalex.org/W2254955413","https://openalex.org/W2182300180","https://openalex.org/W4316658914","https://openalex.org/W2956011222","https://openalex.org/W2352475565"],"abstract_inverted_index":{"Anomaly":[0],"detection":[1,81,125,169,183],"is":[2,95],"essential":[3],"in":[4,38,42,55,82,122,179],"cybersecurity":[5],"for":[6,72,191],"identifying":[7,192],"abnormal":[8],"activities,":[9],"a":[10,31,98,118,186],"requirement":[11],"that":[12,101],"has":[13],"grown":[14],"increasingly":[15],"critical":[16],"with":[17,127],"the":[18,25,51,70,123,131,144,151,174],"complexity":[19],"of":[20,50,138,148,176],"cyberthreats.":[21,193],"This":[22,76],"study":[23,77],"leverages":[24],"BPF-Extended":[26],"Tracking":[27],"Honeypot":[28],"(BETH)":[29],"dataset,":[30],"comprehensive":[32],"resource":[33],"designed":[34],"to":[35,58],"benchmark":[36],"robustness":[37],"detecting":[39],"anomalous":[40],"behavior":[41],"kernel-level":[43,65,83],"process":[44,66,84],"and":[45,61,112,159,188],"network":[46],"logs.":[47],"The":[48,114],"symmetry":[49,178],"proposed":[52,115],"system":[53],"lies":[54],"its":[56],"ability":[57],"identify":[59],"balanced":[60,168],"consistent":[62],"patterns":[63],"within":[64],"logs,":[67],"which":[68,94],"form":[69],"foundation":[71],"accurately":[73],"distinguishing":[74],"anomalies.":[75],"focuses":[78],"on":[79],"anomaly":[80,124],"logs":[85],"by":[86],"introducing":[87],"an":[88,128],"enhanced":[89],"Isolation":[90],"Forest":[91],"(iForest)":[92],"model,":[93],"integrated":[96],"into":[97],"structured":[99,187],"framework":[100],"includes":[102],"exploratory":[103],"data":[104,107],"analysis":[105],"(EDA),":[106],"pre-processing,":[108],"model":[109,152],"training,":[110],"validation,":[111],"evaluation.":[113],"approach":[116],"achieves":[117],"significant":[119],"performance":[120],"improvement":[121],"results,":[126],"area":[129],"under":[130],"receiver":[132],"operating":[133],"characteristic":[134],"curve":[135],"(AUROC)":[136],"score":[137],"0.917\u2014an":[139],"approximate":[140],"7.88%":[141],"increase":[142],"over":[143],"baseline":[145],"model\u2019s":[146],"AUROC":[147],"0.850.":[149],"Additionally,":[150],"demonstrates":[153],"high":[154],"precision":[155],"(99.57%),":[156],"F1-score":[157],"(91.69%),":[158],"accuracy":[160],"(86.03%),":[161],"effectively":[162],"minimizing":[163],"false":[164],"positives":[165],"while":[166],"maintaining":[167],"capabilities.":[170],"These":[171],"results":[172],"underscore":[173],"role":[175],"leveraging":[177],"designing":[180],"advanced":[181],"intrusion":[182],"systems,":[184],"offering":[185],"efficient":[189],"solution":[190]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":5}],"updated_date":"2026-07-30T17:31:21.811387","created_date":"2025-10-10T00:00:00"}