{"id":"https://openalex.org/W7134213253","doi":"https://doi.org/10.5220/0014470300004061","title":"Multi-Modal Model for Embedding Network and Audit Data for IoT Anomaly Detection","display_name":"Multi-Modal Model for Embedding Network and Audit Data for IoT Anomaly Detection","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7134213253","doi":"https://doi.org/10.5220/0014470300004061"},"language":"en","primary_location":{"id":"doi:10.5220/0014470300004061","is_oa":false,"landing_page_url":"https://doi.org/10.5220/0014470300004061","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 12th International Conference on Information Systems Security and Privacy","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://hdl.handle.net/1983/66d5c776-c202-458e-8af3-2e6bbe88b421","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5128343505","display_name":"Pratyush Singh","orcid":null},"institutions":[{"id":"https://openalex.org/I36234482","display_name":"University of Bristol","ror":"https://ror.org/0524sp257","country_code":"GB","type":"education","lineage":["https://openalex.org/I36234482"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Pratyush Singh","raw_affiliation_strings":["School of Engineering Mathematics and Technology, University of Bristol, U.K"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Engineering Mathematics and Technology, University of Bristol, U.K","institution_ids":["https://openalex.org/I36234482"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yuxiang Huang","orcid":null},"institutions":[{"id":"https://openalex.org/I36234482","display_name":"University of Bristol","ror":"https://ror.org/0524sp257","country_code":"GB","type":"education","lineage":["https://openalex.org/I36234482"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Yuxiang Huang","raw_affiliation_strings":["School of Electrical, Electronic and Mechanical Engineering, University of Bristol, U.K"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Electrical, Electronic and Mechanical Engineering, University of Bristol, U.K","institution_ids":["https://openalex.org/I36234482"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054551484","display_name":"H. Li","orcid":null},"institutions":[{"id":"https://openalex.org/I36234482","display_name":"University of Bristol","ror":"https://ror.org/0524sp257","country_code":"GB","type":"education","lineage":["https://openalex.org/I36234482"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Haoxiang Li","raw_affiliation_strings":["School of Electrical, Electronic and Mechanical Engineering, University of Bristol, U.K"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Electrical, Electronic and Mechanical Engineering, University of Bristol, U.K","institution_ids":["https://openalex.org/I36234482"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072981915","display_name":"George Oikonomou","orcid":"https://orcid.org/0000-0002-1684-6989"},"institutions":[{"id":"https://openalex.org/I36234482","display_name":"University of Bristol","ror":"https://ror.org/0524sp257","country_code":"GB","type":"education","lineage":["https://openalex.org/I36234482"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"George Oikonomou","raw_affiliation_strings":["School of Electrical, Electronic and Mechanical Engineering, University of Bristol, U.K"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Electrical, Electronic and Mechanical Engineering, University of Bristol, U.K","institution_ids":["https://openalex.org/I36234482"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5124621842","display_name":"James Pope","orcid":null},"institutions":[{"id":"https://openalex.org/I36234482","display_name":"University of Bristol","ror":"https://ror.org/0524sp257","country_code":"GB","type":"education","lineage":["https://openalex.org/I36234482"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"James Pope","raw_affiliation_strings":["School of Engineering Mathematics and Technology, University of Bristol, U.K"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Engineering Mathematics and Technology, University of Bristol, U.K","institution_ids":["https://openalex.org/I36234482"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I36234482"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.24198294,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"396","last_page":"405"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.22789999842643738,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.22789999842643738,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.1890999972820282,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.08380000293254852,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5424000024795532},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.5023999810218811},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.4359000027179718},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.37929999828338623},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.33009999990463257}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6292999982833862},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5424000024795532},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.5023999810218811},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.4359000027179718},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3986999988555908},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.37929999828338623},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.33009999990463257},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.32109999656677246},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2777000069618225},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.25949999690055847}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.5220/0014470300004061","is_oa":false,"landing_page_url":"https://doi.org/10.5220/0014470300004061","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 12th International Conference on Information Systems Security and Privacy","raw_type":"proceedings-article"},{"id":"pmh:oai:research-information.bris.ac.uk:openaire/66d5c776-c202-458e-8af3-2e6bbe88b421","is_oa":false,"landing_page_url":"https://research-information.bris.ac.uk/en/publications/66d5c776-c202-458e-8af3-2e6bbe88b421","pdf_url":null,"source":{"id":"https://openalex.org/S4306400895","display_name":"Bristol Research (University of Bristol)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I36234482","host_organization_name":"University of Bristol","host_organization_lineage":["https://openalex.org/I36234482"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Singh, P, Huang, Y, Li, H, Oikonomou, G & Pope, J 2026, Multi-Modal Model for Embedding Network and Audit Data for IoT Anomaly Detection. in R Di Pietro, K Renaud & P Mori (eds), Proceedings of the 12th International Conference on Information Systems Security and Privacy - Volume 2: ICISSP. vol. 2, International Conference on Information Systems Security and Privacy, SciTePress, pp. 396-405. https://doi.org/10.5220/0014470300004061","raw_type":"contributionToPeriodical"},{"id":"pmh:oai:research-information.bris.ac.uk:openaire_cris_publications/66d5c776-c202-458e-8af3-2e6bbe88b421","is_oa":true,"landing_page_url":"https://hdl.handle.net/1983/66d5c776-c202-458e-8af3-2e6bbe88b421","pdf_url":null,"source":{"id":"https://openalex.org/S4306400895","display_name":"Bristol Research (University of Bristol)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I36234482","host_organization_name":"University of Bristol","host_organization_lineage":["https://openalex.org/I36234482"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Singh, P, Huang, Y, Li, H, Oikonomou, G & Pope, J 2026, Multi-Modal Model for Embedding Network and Audit Data for IoT Anomaly Detection. in R Di Pietro, K Renaud & P Mori (eds), Proceedings of the 12th International Conference on Information Systems Security and Privacy - Volume 2: ICISSP. vol. 2, International Conference on Information Systems Security and Privacy, SciTePress, pp. 396-405. https://doi.org/10.5220/0014470300004061","raw_type":"contributionToPeriodical"}],"best_oa_location":{"id":"pmh:oai:research-information.bris.ac.uk:openaire_cris_publications/66d5c776-c202-458e-8af3-2e6bbe88b421","is_oa":true,"landing_page_url":"https://hdl.handle.net/1983/66d5c776-c202-458e-8af3-2e6bbe88b421","pdf_url":null,"source":{"id":"https://openalex.org/S4306400895","display_name":"Bristol Research (University of Bristol)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I36234482","host_organization_name":"University of Bristol","host_organization_lineage":["https://openalex.org/I36234482"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Singh, P, Huang, Y, Li, H, Oikonomou, G & Pope, J 2026, Multi-Modal Model for Embedding Network and Audit Data for IoT Anomaly Detection. in R Di Pietro, K Renaud & P Mori (eds), Proceedings of the 12th International Conference on Information Systems Security and Privacy - Volume 2: ICISSP. vol. 2, International Conference on Information Systems Security and Privacy, SciTePress, pp. 396-405. https://doi.org/10.5220/0014470300004061","raw_type":"contributionToPeriodical"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Current":[0],"IoT":[1,94,228],"infrastructures":[2],"generate":[3],"heterogeneous":[4],"telemetry":[5,61],"and":[6,12,59,84,98,102,142,220,244],"primarily":[7],"include":[8],"network":[9,22,58,97],"(inter-host":[10],"information)":[11],"audit":[13],"data":[14,62],"(intra-host":[15],"information).":[16],"Most":[17],"intrusion":[18,65],"detection":[19,45,66,119],"approaches":[20],"use":[21],"or":[23],"host":[24,60,99],"information":[25],"but":[26,201],"not":[27],"both.":[28],"Specific":[29],"to":[30,63,81,136,159,176,217],"resource-constrained":[31],"environments,":[32,229],"like":[33],"Internet":[34],"of":[35,43],"Things":[36],"(IoT)":[37],"systems,":[38],"there":[39],"remains":[40],"a":[41,52,92],"lack":[42],"anomaly":[44],"research":[46],"into":[47],"multimodal":[48,53],"techniques.":[49],"We":[50,87,190],"propose":[51],"fusion":[54,116],"approach":[55,77,90,214],"that":[56,167,192],"combines":[57],"improve":[64],"accuracy":[67,120,185,200],"while":[68,138,182],"maintaining":[69,183],"computational":[70,85,188],"efficiency.":[71],"To":[72],"address":[73],"resource":[74,226],"constraints,":[75],"our":[76,89],"applies":[78],"dimensionality":[79],"reduction":[80],"reduce":[82],"memory":[83],"requirements.":[86,189],"evaluated":[88,123],"on":[91],"suitable":[93],"dataset":[95],"with":[96,153,230],"(Windows":[100],"7":[101],"10)":[103],"features":[104,181],"already":[105],"extracted.":[106],"Our":[107],"experimental":[108],"evaluation":[109],"demonstrates":[110,215],"two":[111],"critical":[112],"findings.":[113],"First,":[114],"multi-modal":[115],"significantly":[117],"improved":[118,129],"across":[121,233],"all":[122],"models.":[124],"The":[125,212],"1D-CNN":[126],"mod":[127],"el":[128],"by":[130],"17.60":[131],"percentage":[132],"points":[133],"from":[134,157],"81.72%":[135],"99.32%,":[137],"tree":[139],"ensembles":[140],"(XGBoost":[141],"Random":[143],"Forest)":[144],"achieved":[145],"ideal":[146],"accuracy.":[147],"Unsupervised":[148],"methods":[149],"also":[150],"benefited":[151],"substantially,":[152],"Agglomerative":[154],"Clustering":[155],"increasing":[156],"0.2173":[158],"0.6304":[160],"Adjusted":[161],"Rand":[162],"Index.":[163],"Second,":[164],"we":[165],"demonstrate":[166],"the":[168,180,209],"fused":[169],"feature":[170,210],"space":[171],"can":[172],"be":[173],"dimensionally":[174],"reduced":[175],"less":[177],"than":[178],"half":[179],"comparable":[184],"performance,":[186],"reducing":[187,208],"found":[191],"PCA":[193],"performed":[194],"as":[195,197],"well":[196],"UMAP":[198],"regarding":[199],"was":[202],"considerably":[203],"faster":[204],"(54x":[205],"speedup)":[206],"at":[207],"space.":[211],"proposed":[213],"robustness":[216],"class":[218],"imbalance":[219],"provides":[221],"practical":[222],"deployment":[223],"guidance":[224],"for":[225],"constrained":[227],"comprehensive":[231],"benchmarking":[232],"over":[234],"15":[235],"model":[236],"architectures":[237],"including":[238],"traditional":[239],"machine":[240],"learning,":[241,243],"deep":[242],"transformer-based":[245],"approaches.":[246]},"counts_by_year":[],"updated_date":"2026-07-02T09:51:11.867554","created_date":"2026-03-09T00:00:00"}