{"id":"https://openalex.org/W4406181061","doi":"https://doi.org/10.3390/fi17010025","title":"XI2S-IDS: An Explainable Intelligent 2-Stage Intrusion Detection System","display_name":"XI2S-IDS: An Explainable Intelligent 2-Stage Intrusion Detection System","publication_year":2025,"publication_date":"2025-01-08","ids":{"openalex":"https://openalex.org/W4406181061","doi":"https://doi.org/10.3390/fi17010025"},"language":"en","primary_location":{"id":"doi:10.3390/fi17010025","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi17010025","pdf_url":"https://www.mdpi.com/1999-5903/17/1/25/pdf?version=1736323884","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/1999-5903/17/1/25/pdf?version=1736323884","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5047978267","display_name":"Maiada M. Mahmoud","orcid":"https://orcid.org/0000-0001-9374-2270"},"institutions":[{"id":"https://openalex.org/I59272784","display_name":"Arab Academy for Science, Technology, and Maritime Transport","ror":"https://ror.org/0004vyj87","country_code":"EG","type":"education","lineage":["https://openalex.org/I59272784"]}],"countries":["EG"],"is_corresponding":false,"raw_author_name":"Maiada M. Mahmoud","raw_affiliation_strings":["College of Computing and Information Technology, Arab Academy for Science, Technology, and Maritime Transport, Cairo P.O. Box 2033, Egypt"],"raw_orcid":"https://orcid.org/0000-0001-9374-2270","affiliations":[{"raw_affiliation_string":"College of Computing and Information Technology, Arab Academy for Science, Technology, and Maritime Transport, Cairo P.O. Box 2033, Egypt","institution_ids":["https://openalex.org/I59272784"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5080555226","display_name":"Yasser Omar","orcid":"https://orcid.org/0000-0002-7079-1894"},"institutions":[{"id":"https://openalex.org/I8692664","display_name":"University of Oklahoma","ror":"https://ror.org/02aqsxs83","country_code":"US","type":"education","lineage":["https://openalex.org/I8692664"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Yasser Omar Youssef","raw_affiliation_strings":["School of Library and Information Studies, University of Oklahoma, Norman, OK 73019, USA"],"raw_orcid":"https://orcid.org/0000-0002-7079-1894","affiliations":[{"raw_affiliation_string":"School of Library and Information Studies, University of Oklahoma, Norman, OK 73019, USA","institution_ids":["https://openalex.org/I8692664"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5048160775","display_name":"Ayman Abdel-Hamid","orcid":"https://orcid.org/0000-0001-9953-7147"},"institutions":[{"id":"https://openalex.org/I59272784","display_name":"Arab Academy for Science, Technology, and Maritime Transport","ror":"https://ror.org/0004vyj87","country_code":"EG","type":"education","lineage":["https://openalex.org/I59272784"]}],"countries":["EG"],"is_corresponding":false,"raw_author_name":"Ayman A. Abdel-Hamid","raw_affiliation_strings":["College of Computing and Information Technology, Arab Academy for Science, Technology, and Maritime Transport, Alexandria P.O. Box 1029, Egypt"],"raw_orcid":"https://orcid.org/0000-0001-9953-7147","affiliations":[{"raw_affiliation_string":"College of Computing and Information Technology, Arab Academy for Science, Technology, and Maritime Transport, Alexandria P.O. Box 1029, Egypt","institution_ids":["https://openalex.org/I59272784"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5080555226"],"corresponding_institution_ids":["https://openalex.org/I8692664"],"apc_list":{"value":1400,"currency":"CHF","value_usd":1515},"apc_paid":{"value":1400,"currency":"CHF","value_usd":1515},"fwci":23.9117,"has_fulltext":true,"cited_by_count":19,"citation_normalized_percentile":{"value":0.99466369,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":99,"max":100},"biblio":{"volume":"17","issue":"1","first_page":"25","last_page":"25"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9980999827384949,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9940000176429749,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.922944962978363},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.7671504020690918},{"id":"https://openalex.org/keywords/stage","display_name":"Stage (stratigraphy)","score":0.5740676522254944},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.49654442071914673},{"id":"https://openalex.org/keywords/intrusion-prevention-system","display_name":"Intrusion prevention system","score":0.42304620146751404},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.35981810092926025},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.35402315855026245},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.3251805901527405},{"id":"https://openalex.org/keywords/geology","display_name":"Geology","score":0.09442070126533508}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.922944962978363},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.7671504020690918},{"id":"https://openalex.org/C146357865","wikidata":"https://www.wikidata.org/wiki/Q1123245","display_name":"Stage (stratigraphy)","level":2,"score":0.5740676522254944},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.49654442071914673},{"id":"https://openalex.org/C27061796","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion prevention system","level":3,"score":0.42304620146751404},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.35981810092926025},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.35402315855026245},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3251805901527405},{"id":"https://openalex.org/C127313418","wikidata":"https://www.wikidata.org/wiki/Q1069","display_name":"Geology","level":0,"score":0.09442070126533508},{"id":"https://openalex.org/C17409809","wikidata":"https://www.wikidata.org/wiki/Q161764","display_name":"Geochemistry","level":1,"score":0.0},{"id":"https://openalex.org/C151730666","wikidata":"https://www.wikidata.org/wiki/Q7205","display_name":"Paleontology","level":1,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.3390/fi17010025","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi17010025","pdf_url":"https://www.mdpi.com/1999-5903/17/1/25/pdf?version=1736323884","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},{"id":"pmh:oai:RePEc:gam:jftint:v:17:y:2025:i:1:p:25-:d:1562283","is_oa":false,"landing_page_url":"https://www.mdpi.com/1999-5903/17/1/25/","pdf_url":null,"source":{"id":"https://openalex.org/S4306401271","display_name":"RePEc: Research Papers in Economics","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I77793887","host_organization_name":"Federal Reserve Bank of St. Louis","host_organization_lineage":["https://openalex.org/I77793887"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},{"id":"pmh:oai:doaj.org/article:19a6d0a120764a0ca85991f460c91cb1","is_oa":true,"landing_page_url":"https://doaj.org/article/19a6d0a120764a0ca85991f460c91cb1","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Future Internet, Vol 17, Iss 1, p 25 (2025)","raw_type":"article"},{"id":"pmh:oai:shareok.org:11244/342384","is_oa":true,"landing_page_url":"https://shareok.org//handle/11244/342384","pdf_url":null,"source":{"id":"https://openalex.org/S4306401290","display_name":"SHAREOK (University of Oklahoma)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I8692664","host_organization_name":"University of Oklahoma","host_organization_lineage":["https://openalex.org/I8692664"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"}],"best_oa_location":{"id":"doi:10.3390/fi17010025","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi17010025","pdf_url":"https://www.mdpi.com/1999-5903/17/1/25/pdf?version=1736323884","source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.7400000095367432,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4406181061.pdf","grobid_xml":"https://content.openalex.org/works/W4406181061.grobid-xml"},"referenced_works_count":64,"referenced_works":["https://openalex.org/W2002900768","https://openalex.org/W2296509296","https://openalex.org/W2334853001","https://openalex.org/W2342408547","https://openalex.org/W2521705161","https://openalex.org/W2601474892","https://openalex.org/W2602255610","https://openalex.org/W2618851150","https://openalex.org/W2625602624","https://openalex.org/W2732560875","https://openalex.org/W2740755977","https://openalex.org/W2768211408","https://openalex.org/W2768348081","https://openalex.org/W2783741806","https://openalex.org/W2789828921","https://openalex.org/W2793130454","https://openalex.org/W2807786182","https://openalex.org/W2809178492","https://openalex.org/W2883554196","https://openalex.org/W2886020981","https://openalex.org/W2911964244","https://openalex.org/W2913330314","https://openalex.org/W2914968227","https://openalex.org/W2924689635","https://openalex.org/W2926701059","https://openalex.org/W2958489519","https://openalex.org/W2963197901","https://openalex.org/W2964473287","https://openalex.org/W2981025625","https://openalex.org/W2982853004","https://openalex.org/W2996061341","https://openalex.org/W3008195198","https://openalex.org/W3011040471","https://openalex.org/W3015392399","https://openalex.org/W3025093231","https://openalex.org/W3043530913","https://openalex.org/W3043844898","https://openalex.org/W3092771185","https://openalex.org/W3102359135","https://openalex.org/W3111730645","https://openalex.org/W3113693716","https://openalex.org/W3140854437","https://openalex.org/W3145733289","https://openalex.org/W3162620147","https://openalex.org/W3169729391","https://openalex.org/W3185895012","https://openalex.org/W3216145890","https://openalex.org/W4220668406","https://openalex.org/W4285058242","https://openalex.org/W4285294415","https://openalex.org/W4303022245","https://openalex.org/W4309939034","https://openalex.org/W4367309662","https://openalex.org/W4382286784","https://openalex.org/W4383821253","https://openalex.org/W4384927829","https://openalex.org/W4387007843","https://openalex.org/W4387490462","https://openalex.org/W4388326161","https://openalex.org/W4392103307","https://openalex.org/W4393210626","https://openalex.org/W4393346275","https://openalex.org/W4400975882","https://openalex.org/W4403400523"],"related_works":["https://openalex.org/W2392603527","https://openalex.org/W2390009783","https://openalex.org/W2348767155","https://openalex.org/W2388497169","https://openalex.org/W3120393658","https://openalex.org/W4283700121","https://openalex.org/W1496376327","https://openalex.org/W2357468538","https://openalex.org/W1513478798","https://openalex.org/W2133389611"],"abstract_inverted_index":{"The":[0,51,114],"rapid":[1],"evolution":[2],"of":[3,9,21,32,85],"technologies":[4],"such":[5],"as":[6],"the":[7,19,57,105,138,146,169,175],"Internet":[8],"Things":[10],"(IoT),":[11],"5G,":[12],"and":[13,68,94,128,168,177,202],"cloud":[14],"computing":[15],"has":[16],"exponentially":[17],"increased":[18],"complexity":[20],"cyber":[22],"attacks.":[23,132],"Modern":[24],"Intrusion":[25,111],"Detection":[26,112],"Systems":[27],"(IDSs)":[28],"must":[29],"be":[30],"capable":[31],"identifying":[33],"not":[34],"only":[35],"frequent,":[36],"well-known":[37],"attacks":[38],"but":[39],"also":[40],"low-frequency,":[41],"subtle":[42],"intrusions":[43],"that":[44,59],"are":[45,97],"often":[46],"missed":[47],"by":[48,56,142],"traditional":[49],"systems.":[50],"challenge":[52],"is":[53,87,135],"further":[54],"compounded":[55],"fact":[58],"most":[60],"IDS":[61],"rely":[62],"on":[63,174],"black-box":[64],"machine":[65],"learning":[66,70],"(ML)":[67],"deep":[69],"(DL)":[71],"models,":[72],"making":[73],"it":[74],"difficult":[75],"for":[76,130,194],"security":[77,159],"teams":[78],"to":[79,161],"interpret":[80],"their":[81],"decisions.":[82],"This":[83],"lack":[84],"transparency":[86,155],"particularly":[88],"problematic":[89],"in":[90,137,145,156,183,190],"environments":[91],"where":[92],"quick":[93],"informed":[95],"responses":[96],"crucial.":[98],"To":[99],"address":[100],"these":[101],"challenges,":[102],"we":[103],"introduce":[104],"XI2S-IDS":[106,115,153],"framework\u2014an":[107],"Explainable,":[108],"Intelligent":[109],"2-Stage":[110],"System.":[113],"framework":[116],"uniquely":[117],"combines":[118],"a":[119,187],"two-stage":[120],"approach":[121],"with":[122,186],"SHAP-based":[123],"explanations,":[124],"offering":[125],"improved":[126],"detection":[127,184],"interpretability":[129],"low-frequency":[131,195],"Binary":[133],"classification":[134,144],"conducted":[136,173],"first":[139],"stage":[140],"followed":[141],"multi-class":[143],"second":[147],"stage.":[148],"By":[149],"leveraging":[150],"SHAP":[151],"values,":[152],"enhances":[154],"decision-making,":[157],"allowing":[158],"analysts":[160],"gain":[162],"clear":[163],"insights":[164],"into":[165],"feature":[166],"importance":[167],"model\u2019s":[170],"rationale.":[171],"Experiments":[172],"UNSW-NB15":[176],"CICIDS2017":[178],"datasets":[179],"demonstrate":[180],"significant":[181],"improvements":[182],"performance,":[185],"notable":[188],"reduction":[189],"false":[191],"negative":[192],"rates":[193],"attacks,":[196],"while":[197],"maintaining":[198],"high":[199],"precision,":[200],"recall,":[201],"F1-scores.":[203]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":14}],"updated_date":"2026-05-12T08:28:47.272897","created_date":"2025-10-10T00:00:00"}