{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,11]],"date-time":"2025-09-11T20:24:35Z","timestamp":1757622275515,"version":"3.44.0"},"publisher-location":"Cham","reference-count":34,"publisher":"Springer Nature Switzerland","isbn-type":[{"type":"print","value":"9783032006462"},{"type":"electronic","value":"9783032006448"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-3-032-00644-8_18","type":"book-chapter","created":{"date-parts":[[2025,8,8]],"date-time":"2025-08-08T04:06:27Z","timestamp":1754625987000},"page":"292-309","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["SHAP Insights into Domain Adaptation in\u00a0Netflow-Based Network Intrusion Detection Powered by\u00a0Deep Learning"],"prefix":"10.1007","author":[{"given":"Marek","family":"Pawlicki","sequence":"first","affiliation":[]},{"given":"Sebastian","family":"Szelest","sequence":"additional","affiliation":[]},{"given":"Rafal","family":"Kozik","sequence":"additional","affiliation":[]},{"given":"Micha\u0142","family":"Chora\u015b","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2025,8,9]]},"reference":[{"issue":"1","key":"18_CR1","doi-asserted-by":"publisher","DOI":"10.1002\/ett.4150","volume":"32","author":"Z Ahmad","year":"2021","unstructured":"Ahmad, Z., Shahid Khan, A., Wai Shiang, C., Abdullah, J., Ahmad, F.: Network intrusion detection system: A systematic study of machine learning and deep learning approaches. Transactions on Emerging Telecommunications Technologies 32(1), e4150 (2021)","journal-title":"Transactions on Emerging Telecommunications Technologies"},{"issue":"1","key":"18_CR2","doi-asserted-by":"publisher","first-page":"80","DOI":"10.3390\/electronics14010080","volume":"14","author":"A Amamra","year":"2024","unstructured":"Amamra, A., Terrelonge, V.: Multiple kernel transfer learning for enhancing network intrusion detection in encrypted and heterogeneous network environments. Electronics 14(1), 80 (2024)","journal-title":"Electronics"},{"key":"18_CR3","doi-asserted-by":"publisher","first-page":"405","DOI":"10.1007\/978-3-030-57805-3_38","volume-title":"13th International Conference on Computational Intelligence in Security for Information Systems (CISIS 2020)","author":"V Dutta","year":"2021","unstructured":"Dutta, V., Chora\u015b, M., Kozik, R., Pawlicki, M.: Hybrid model for improving the classification effectiveness of network intrusion detection. In: Herrero, \u00c1., Cambra, C., Urda, D., Sedano, J., Quinti\u00e1n, H., Corchado, E. (eds.) 13th International Conference on Computational Intelligence in Security for Information Systems (CISIS 2020), pp. 405\u2013414. Springer International Publishing, Cham (2021)"},{"key":"18_CR4","doi-asserted-by":"crossref","unstructured":"Ghosh, S., Jameel, A.S.M.M., El\u00a0Gamal, A.: Improving transferability of network intrusion detection in a federated learning setup. In: 2024 IEEE International Conference on Machine Learning for Communication and Networking (ICMLCN). pp. 171\u2013176. IEEE (2024)","DOI":"10.1109\/ICMLCN59089.2024.10624761"},{"issue":"1","key":"18_CR5","first-page":"723","volume":"13","author":"A Gretton","year":"2012","unstructured":"Gretton, A., Borgwardt, K.M., Rasch, M.J., Sch\u00f6lkopf, B., Smola, A.: A kernel two-sample test. The Journal of Machine Learning Research 13(1), 723\u2013773 (2012)","journal-title":"The Journal of Machine Learning Research"},{"issue":"4","key":"18_CR6","first-page":"645","volume":"20","author":"Y Hamid","year":"2018","unstructured":"Hamid, Y., Balasaraswathi, V.R., Journaux, L., Sugumaran, M.: Benchmark datasets for network intrusion detection: A review. Int. J. Netw. Secur. 20(4), 645\u2013654 (2018)","journal-title":"Int. J. Netw. Secur."},{"issue":"2","key":"18_CR7","doi-asserted-by":"publisher","first-page":"1","DOI":"10.5121\/ijdkp.2015.5201","volume":"5","author":"M Hossin","year":"2015","unstructured":"Hossin, M., Sulaiman, M.N.: A review on evaluation metrics for data classification evaluations. International journal of data mining & knowledge management process 5(2), 1 (2015)","journal-title":"International journal of data mining & knowledge management process"},{"issue":"3","key":"18_CR8","doi-asserted-by":"publisher","first-page":"80","DOI":"10.3390\/fi16030080","volume":"16","author":"H Kim","year":"2024","unstructured":"Kim, H., Park, S., Hong, H., Park, J., Kim, S.: A transferable deep learning framework for improving the accuracy of internet of things intrusion detection. Future Internet 16(3), 80 (2024)","journal-title":"Future Internet"},{"key":"18_CR9","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2023.110626","volume":"273","author":"S Layeghy","year":"2023","unstructured":"Layeghy, S., Baktashmotlagh, M., Portmann, M.: Di-nids: Domain invariant network intrusion detection system. Knowl.-Based Syst. 273, 110626 (2023)","journal-title":"Knowl.-Based Syst."},{"key":"18_CR10","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2023.108692","volume":"108","author":"S Layeghy","year":"2023","unstructured":"Layeghy, S., Portmann, M.: Explainable cross-domain evaluation of ml-based network intrusion detection systems. Comput. Electr. Eng. 108, 108692 (2023)","journal-title":"Comput. Electr. Eng."},{"key":"18_CR11","doi-asserted-by":"crossref","unstructured":"Liu, X., Yoo, C., Xing, F., Oh, H., El\u00a0Fakhri, G., Kang, J.W., Woo, J., et\u00a0al.: Deep unsupervised domain adaptation: A review of recent advances and perspectives. APSIPA Transactions on Signal and Information Processing 11(1) (2022)","DOI":"10.1561\/116.00000192"},{"key":"18_CR12","unstructured":"Long, M., CAO, Z., Wang, J., Jordan, M.I.: Conditional adversarial domain adaptation. In: Bengio, S., Wallach, H., Larochelle, H., Grauman, K., Cesa-Bianchi, N., Garnett, R. (eds.) Advances in Neural Information Processing Systems. vol.\u00a031. Curran Associates, Inc. (2018)"},{"key":"18_CR13","unstructured":"Lopes, R.H., Reid, I., Hobson, P.R.: The two-dimensional kolmogorov-smirnov test (2007)"},{"key":"18_CR14","unstructured":"Lundberg, S.M., Lee, S.I.: A unified approach to interpreting model predictions. Advances in neural information processing systems 30 (2017)"},{"key":"18_CR15","doi-asserted-by":"publisher","first-page":"719","DOI":"10.1016\/j.ins.2023.02.031","volume":"629","author":"W Ma","year":"2023","unstructured":"Ma, W., Liu, R., Li, K., Yan, S., Guo, J.: An adversarial domain adaptation approach combining dual domain pairing strategy for iot intrusion detection under few-shot samples. Inf. Sci. 629, 719\u2013745 (2023)","journal-title":"Inf. Sci."},{"key":"18_CR16","unstructured":"Van\u00a0der Maaten, L., Hinton, G.: Visualizing data using t-sne. Journal of machine learning research 9(11) (2008)"},{"key":"18_CR17","doi-asserted-by":"crossref","unstructured":"Moustafa, N., Slay, J.: Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set). In: 2015 military communications and information systems conference (MilCIS). pp.\u00a01\u20136. IEEE (2015)","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"18_CR18","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"749","DOI":"10.1007\/978-3-030-26763-6_72","volume-title":"Intelligent Computing Theories and Application","author":"M Pawlicki","year":"2019","unstructured":"Pawlicki, M., Kozik, R., Chora\u015b, M.: Artificial Neural Network Hyperparameter Optimisation for Network Intrusion Detection. In: Huang, D.-S., Bevilacqua, V., Premaratne, P. (eds.) ICIC 2019. LNCS, vol. 11643, pp. 749\u2013760. Springer, Cham (2019). https:\/\/doi.org\/10.1007\/978-3-030-26763-6_72"},{"key":"18_CR19","doi-asserted-by":"publisher","first-page":"1075","DOI":"10.1016\/j.neucom.2022.06.002","volume":"500","author":"M Pawlicki","year":"2022","unstructured":"Pawlicki, M., Kozik, R., Chora\u015b, M.: A survey on neural networks for (cyber-) security and (cyber-) security of neural networks. Neurocomputing 500, 1075\u20131087 (2022)","journal-title":"Neurocomputing"},{"key":"18_CR20","doi-asserted-by":"crossref","unstructured":"Pawlicki, M., Kozik, R., Chora\u015b, M.: Towards deployment shift inhibition through transfer learning in network intrusion detection. In: Proceedings of the 17th International Conference on Availability, Reliability and Security. pp.\u00a01\u20136 (2022)","DOI":"10.1145\/3538969.3544428"},{"key":"18_CR21","unstructured":"Qui\u00f1onero-Candela, J., Sugiyama, M., Schwaighofer, A., Lawrence, N.D.: Dataset shift in machine learning. Mit Press (2022)"},{"key":"18_CR22","doi-asserted-by":"crossref","unstructured":"Redko, I., Morvant, E., Habrard, A., Sebban, M., Bennani, Y.: A survey on domain adaptation theory: learning bounds and theoretical guarantees. arXiv preprint arXiv:2004.11829 (2020)","DOI":"10.1016\/B978-1-78548-236-6.50002-7"},{"key":"18_CR23","unstructured":"Rodofile, N.R.: Generating attacks and labelling attack datasets for industrial control intrusion detection systems. Ph.D. thesis, Queensland University of Technology (2018)"},{"key":"18_CR24","doi-asserted-by":"publisher","first-page":"99","DOI":"10.1023\/A:1026543900054","volume":"40","author":"Y Rubner","year":"2000","unstructured":"Rubner, Y., Tomasi, C., Guibas, L.J.: The earth mover\u2019s distance as a metric for image retrieval. Int. J. Comput. Vision 40, 99\u2013121 (2000)","journal-title":"Int. J. Comput. Vision"},{"key":"18_CR25","doi-asserted-by":"crossref","unstructured":"Sarhan, M., Layeghy, S., Moustafa, N., Portmann, M.: Netflow datasets for machine learning-based network intrusion detection systems. In: Big Data Technologies and Applications: 10th EAI International Conference, BDTA 2020, and 13th EAI International Conference on Wireless Internet, WiCON 2020, Virtual Event, December 11, 2020, Proceedings 10. pp. 117\u2013135. Springer (2021)","DOI":"10.1007\/978-3-030-72802-1_9"},{"key":"18_CR26","first-page":"108","volume":"1","author":"I Sharafaldin","year":"2018","unstructured":"Sharafaldin, I., Lashkari, A.H., Ghorbani, A.A.: Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp 1, 108\u2013116 (2018)","journal-title":"ICISSp"},{"key":"18_CR27","doi-asserted-by":"publisher","first-page":"6973","DOI":"10.1109\/ACCESS.2023.3237025","volume":"11","author":"P Singhal","year":"2023","unstructured":"Singhal, P., Walambe, R., Ramanna, S., Kotecha, K.: Domain adaptation: challenges, methods, datasets, and applications. IEEE access 11, 6973\u20137020 (2023)","journal-title":"IEEE access"},{"key":"18_CR28","doi-asserted-by":"crossref","unstructured":"Singla, A., Bertino, E., Verma, D.: Preparing network intrusion detection deep learning models with minimal data using adversarial domain adaptation. In: Proceedings of the 15th ACM Asia conference on computer and communications security. pp. 127\u2013140 (2020)","DOI":"10.1145\/3320269.3384718"},{"issue":"4","key":"18_CR29","doi-asserted-by":"publisher","first-page":"427","DOI":"10.1016\/j.ipm.2009.03.002","volume":"45","author":"M Sokolova","year":"2009","unstructured":"Sokolova, M., Lapalme, G.: A systematic analysis of performance measures for classification tasks. Information processing & management 45(4), 427\u2013437 (2009)","journal-title":"Information processing & management"},{"key":"18_CR30","doi-asserted-by":"crossref","unstructured":"Sun, B., Feng, J., Saenko, K.: Correlation alignment for unsupervised domain adaptation. Domain adaptation in computer vision applications pp. 153\u2013171 (2017)","DOI":"10.1007\/978-3-319-58347-1_8"},{"key":"18_CR31","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"443","DOI":"10.1007\/978-3-319-49409-8_35","volume-title":"Computer Vision \u2013 ECCV 2016 Workshops","author":"B Sun","year":"2016","unstructured":"Sun, B., Saenko, K.: Deep CORAL: Correlation Alignment for Deep Domain Adaptation. In: Hua, G., J\u00e9gou, H. (eds.) ECCV 2016. LNCS, vol. 9915, pp. 443\u2013450. Springer, Cham (2016). https:\/\/doi.org\/10.1007\/978-3-319-49409-8_35"},{"key":"18_CR32","doi-asserted-by":"crossref","unstructured":"Tzeng, E., Hoffman, J., Saenko, K., Darrell, T.: Adversarial discriminative domain adaptation. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 7167\u20137176 (2017)","DOI":"10.1109\/CVPR.2017.316"},{"key":"18_CR33","doi-asserted-by":"crossref","unstructured":"Yu, C., Wang, J., Chen, Y., Huang, M.: Transfer learning with dynamic adversarial adaptation network. In: 2019 IEEE international conference on data mining (ICDM). pp. 778\u2013786. IEEE (2019)","DOI":"10.1109\/ICDM.2019.00088"},{"key":"18_CR34","doi-asserted-by":"crossref","unstructured":"Zhang, J., Yu, L., Zhang, F.: Network intrusion detection system based on domain adaptation for industrial control system. In: Artificial Intelligence Technologies and Applications, pp. 430\u2013441. IOS Press (2024)","DOI":"10.3233\/FAIA231326"}],"container-title":["Lecture Notes in Computer Science","Availability, Reliability and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-00644-8_18","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,8]],"date-time":"2025-09-08T18:06:30Z","timestamp":1757354790000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-00644-8_18"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9783032006462","9783032006448"],"references-count":34,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-00644-8_18","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"9 August 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ARES","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Availability, Reliability and Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Ghent","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Belgium","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"11 August 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"14 August 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"20","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"ares-12025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/2025.ares-conference.eu","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}