{"id":"https://openalex.org/W7169784498","doi":"https://doi.org/10.48550/arxiv.2607.15389","title":"Improving Network Anomaly Detection via Choquet-Integral-Based Feature Aggregation","display_name":"Improving Network Anomaly Detection via Choquet-Integral-Based Feature Aggregation","publication_year":2026,"publication_date":"2026-07-16","ids":{"openalex":"https://openalex.org/W7169784498","doi":"https://doi.org/10.48550/arxiv.2607.15389"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2607.15389","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.15389","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2607.15389","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5114234346","display_name":"Abreu Quevedo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Quevedo, Abreu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135301142","display_name":"Roger Immich","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Immich, Roger","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5031787326","display_name":"Giancarlo Lucca","orcid":"https://orcid.org/0000-0002-3776-0260"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lucca, Giancarlo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137004391","display_name":"Gra\u00e7aliz Dimuro","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dimuro, Gra\u00e7aliz","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5135344333","display_name":"Bruno L. Dalmazo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dalmazo, Bruno L.","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.7319999933242798,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.7319999933242798,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.0706000030040741,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.06949999928474426,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/feature-selection","display_name":"Feature selection","score":0.7139999866485596},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.6642000079154968},{"id":"https://openalex.org/keywords/weighting","display_name":"Weighting","score":0.6507999897003174},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5715000033378601},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.5278000235557556},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5091000199317932},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.4733000099658966},{"id":"https://openalex.org/keywords/raw-data","display_name":"Raw data","score":0.4507000148296356},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.4140999913215637}],"concepts":[{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.7139999866485596},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.6642000079154968},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6557999849319458},{"id":"https://openalex.org/C183115368","wikidata":"https://www.wikidata.org/wiki/Q856577","display_name":"Weighting","level":2,"score":0.6507999897003174},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5979999899864197},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5715000033378601},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.5278000235557556},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5091000199317932},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4796000123023987},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.4733000099658966},{"id":"https://openalex.org/C132964779","wikidata":"https://www.wikidata.org/wiki/Q2110223","display_name":"Raw data","level":2,"score":0.4507000148296356},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.4140999913215637},{"id":"https://openalex.org/C101814296","wikidata":"https://www.wikidata.org/wiki/Q5439685","display_name":"Feature model","level":3,"score":0.319599986076355},{"id":"https://openalex.org/C20556612","wikidata":"https://www.wikidata.org/wiki/Q4469374","display_name":"Volume (thermodynamics)","level":2,"score":0.3163999915122986},{"id":"https://openalex.org/C70136482","wikidata":"https://www.wikidata.org/wiki/Q13583781","display_name":"A-weighting","level":3,"score":0.31610000133514404},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.3100000023841858},{"id":"https://openalex.org/C2778207910","wikidata":"https://www.wikidata.org/wiki/Q397610","display_name":"Agr\u00e9gation","level":3,"score":0.29159998893737793},{"id":"https://openalex.org/C2776257435","wikidata":"https://www.wikidata.org/wiki/Q1576430","display_name":"Bandwidth (computing)","level":2,"score":0.27070000767707825},{"id":"https://openalex.org/C81917197","wikidata":"https://www.wikidata.org/wiki/Q628760","display_name":"Selection (genetic algorithm)","level":2,"score":0.26980000734329224},{"id":"https://openalex.org/C12997251","wikidata":"https://www.wikidata.org/wiki/Q567560","display_name":"Anomaly (physics)","level":2,"score":0.2678000032901764},{"id":"https://openalex.org/C82578977","wikidata":"https://www.wikidata.org/wiki/Q16773055","display_name":"Data aggregator","level":3,"score":0.2565999925136566},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.2531999945640564},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2531000077724457},{"id":"https://openalex.org/C74746147","wikidata":"https://www.wikidata.org/wiki/Q5324652","display_name":"EWMA chart","level":4,"score":0.25290000438690186}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2607.15389","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.15389","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2607.15389","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.15389","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Life in Land","score":0.583431601524353,"id":"https://metadata.un.org/sdg/15"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"This":[0],"work":[1],"investigates":[2],"a":[3],"generalized":[4],"Choquet-integral-based":[5],"feature":[6,25,29,49,97],"aggregation":[7,54,85],"framework":[8],"to":[9,27,57,69],"improve":[10],"anomaly":[11],"detection":[12,105],"in":[13,93],"high-dimensional":[14],"network":[15],"traffic":[16],"data.":[17],"The":[18,52],"approach":[19],"combines":[20],"adaptive":[21],"weighting":[22],"with":[23,41,95],"incremental":[24],"selection":[26],"address":[28],"redundancy.":[30],"Using":[31],"Random":[32],"Forest":[33],"and":[34,44,74,108],"XGBoost":[35],"classifiers,":[36],"we":[37],"evaluate":[38],"models":[39],"trained":[40],"both":[42],"raw":[43],"Choquet-aggregated":[45],"features":[46],"under":[47,106],"varying":[48],"subset":[50],"sizes.":[51],"proposed":[53],"achieves":[55],"up":[56],"$7\\%$":[58],"higher":[59],"accuracy":[60],"while":[61],"reducing":[62],"data":[63],"volume":[64],"by":[65],"$77.5\\%$":[66],"(from":[67],"$214$~MB":[68],"$48$~MB),":[70],"without":[71],"degrading":[72],"precision":[73],"recall.":[75],"Results":[76],"averaged":[77],"over":[78],"multiple":[79],"stratified":[80],"repetitions":[81],"indicate":[82],"that":[83],"Choquet-based":[84],"yields":[86],"statistically":[87],"significant":[88],"gains":[89],"($p":[90],"<":[91],"0.05$)":[92],"scenarios":[94],"limited":[96],"availability,":[98],"highlighting":[99],"its":[100],"suitability":[101],"for":[102],"real-time":[103],"intrusion":[104],"bandwidth":[107],"feature-availability":[109],"constraints.":[110]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-21T00:00:00"}