{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,24]],"date-time":"2026-10-24T02:04:12Z","timestamp":1792807452073,"version":"4.5.0"},"reference-count":50,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2020,6,15]],"date-time":"2020-06-15T00:00:00Z","timestamp":1592179200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2020,6,15]],"date-time":"2020-06-15T00:00:00Z","timestamp":1592179200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Inf. Secur."],"published-print":{"date-parts":[[2021,6]]},"DOI":"10.1007\/s10207-020-00508-5","type":"journal-article","created":{"date-parts":[[2020,6,17]],"date-time":"2020-06-17T16:03:31Z","timestamp":1592409811000},"page":"387-403","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":143,"title":["A novel scalable intrusion detection system based on deep learning"],"prefix":"10.1007","volume":"20","author":[{"given":"Soosan Naderi","family":"Mighan","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2603-6066","authenticated-orcid":false,"given":"Mohsen","family":"Kahani","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2020,6,15]]},"reference":[{"key":"508_CR1","doi-asserted-by":"crossref","unstructured":"Abolhasanzadeh, B.: Nonlinear dimensionality reduction for intrusion detection using auto-encoder bottleneck features. In: 2015 7th Conference on Information and Knowledge Technology (IKT), pp. 1\u20135. IEEE (2015)","DOI":"10.1109\/IKT.2015.7288799"},{"key":"508_CR2","doi-asserted-by":"publisher","first-page":"152","DOI":"10.1016\/j.jocs.2017.03.006","volume":"25","author":"S Aljawarneh","year":"2017","unstructured":"Aljawarneh, S., Aldwairi, M., Yassein, M.B.: Anomaly-based intrusion detection system through feature selection analysis and building hybrid efficient model. J. Comput. Sci. 25, 152\u2013160 (2017)","journal-title":"J. Comput. Sci."},{"key":"508_CR3","doi-asserted-by":"crossref","unstructured":"Alom, Md.Z., Bontupalli, V., Taha, T.M.: Intrusion detection using deep belief networks. In: 2015 National Aerospace and Electronics Conference (NAECON), pp. 339\u2013344. IEEE (2015)","DOI":"10.1109\/NAECON.2015.7443094"},{"key":"508_CR4","doi-asserted-by":"crossref","unstructured":"Benaicha, S.E., Saoudi, L., Guermeche, S.E.B., Lounis, O.: Intrusion detection system using genetic algorithm. In: Science and Information Conference (SAI), pp. 564\u2013568. IEEE (2014)","DOI":"10.1109\/SAI.2014.6918242"},{"issue":"3","key":"508_CR5","first-page":"69","volume":"4","author":"M Bijone","year":"2016","unstructured":"Bijone, M.: A survey on secure network: intrusion detection & prevention approaches. Am. J. Inf. Syst. 4(3), 69\u201388 (2016)","journal-title":"Am. J. Inf. Syst."},{"key":"508_CR6","doi-asserted-by":"crossref","unstructured":"Brown, J., Anwar, M., Dozier, G.: Intrusion detection using a multiple-detector set artificial immune system. In: 2016 IEEE 17th International Conference on Information Reuse and Integration (IRI), pp. 283\u2013286. IEEE (2016)","DOI":"10.1109\/IRI.2016.45"},{"key":"508_CR7","doi-asserted-by":"publisher","first-page":"231","DOI":"10.1016\/j.cose.2014.06.006","volume":"45","author":"R Chitrakar","year":"2014","unstructured":"Chitrakar, R., Huang, C.: Selection of candidate support vectors in incremental SVM for network intrusion detection. Comput. Secur. 45, 231\u2013241 (2014)","journal-title":"Comput. Secur."},{"key":"508_CR8","doi-asserted-by":"crossref","unstructured":"Deshmukh, D.H., Ghorpade, T., Padiya, P.: Intrusion detection system by improved preprocessing methods and na\u00efve bayes classifier using NSL-KDD 99 dataset. In: 2014 International Conference on Electronics and Communication Systems (ICECS), pp. 1\u20137. IEEE (2014)","DOI":"10.1109\/ECS.2014.6892542"},{"key":"508_CR9","doi-asserted-by":"crossref","unstructured":"Dong, B., Wang, X.: Comparison deep learning method to traditional methods using for network intrusion detection. In: 2016 8th IEEE International Conference on Communication Software and Networks (ICCSN), pp. 581\u2013585 (2016)","DOI":"10.1109\/ICCSN.2016.7586590"},{"key":"508_CR10","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1016\/j.simpat.2016.01.010","volume":"64","author":"E-SM El-Alfy","year":"2016","unstructured":"El-Alfy, E.-S.M., Alshammari, M.A.: Towards scalable rough set based attribute subset selection for intrusion detection using parallel genetic algorithm in mapreduce. Simul. Model. Pract. Theory 64, 18\u201329 (2016)","journal-title":"Simul. Model. Pract. Theory"},{"key":"508_CR11","doi-asserted-by":"crossref","unstructured":"Essid, M., Jemili, F.: Combining intrusion detection datasets using Mapreduce. In: 2016 IEEE International Conference on Systems, Man, and Cybernetics (SMC), pp. 4724\u20134728. IEEE (2016)","DOI":"10.1109\/SMC.2016.7844977"},{"key":"508_CR12","doi-asserted-by":"publisher","first-page":"13","DOI":"10.1016\/j.neucom.2012.11.050","volume":"122","author":"U Fiore","year":"2013","unstructured":"Fiore, U., Palmieri, F., Castiglione, A., De Santis, A.: Network anomaly detection with the restricted Boltzmann machine. Neurocomputing 122, 13\u201323 (2013)","journal-title":"Neurocomputing"},{"key":"508_CR13","doi-asserted-by":"crossref","unstructured":"Gao, N., Gao, L., Gao, Q., Wang, H.: An intrusion detection model based on deep belief networks. In: 2014 Second International Conference on Advanced Cloud and Big Data (CBD), pp. 247\u2013252. IEEE (2014)","DOI":"10.1109\/CBD.2014.41"},{"key":"508_CR14","doi-asserted-by":"crossref","unstructured":"Gouveia, A., Correia, M.: Feature set tuning in statistical learning network intrusion detection. In: 2016 IEEE 15th International Symposium on Network Computing and Applications (NCA), pp. 68\u201375. IEEE (2016)","DOI":"10.1109\/NCA.2016.7778595"},{"key":"508_CR15","doi-asserted-by":"crossref","unstructured":"Gouveia, A., Correia, M.: A systematic approach for the application of restricted Boltzmann machines in network intrusion detection. In: International Work-Conference on Artificial Neural Networks, Vol. 10305, pp. 432\u2013446. Springer, Berlin (2017)","DOI":"10.1007\/978-3-319-59153-7_38"},{"key":"508_CR16","doi-asserted-by":"publisher","first-page":"824","DOI":"10.1016\/j.procs.2016.07.238","volume":"93","author":"GP Gupta","year":"2016","unstructured":"Gupta, G.P., Kulariya, M.: A framework for fast and efficient cyber security network intrusion detection using Apache Spark. Procedia Comput. Sci. 93, 824\u2013831 (2016)","journal-title":"Procedia Comput. Sci."},{"key":"508_CR17","doi-asserted-by":"crossref","unstructured":"Han, L.: Using a dynamic k-means algorithm to detect anomaly activities. In: 2011 Seventh International Conference on Computational Intelligence and Security (CIS)","DOI":"10.1109\/CIS.2011.233"},{"issue":"1\u20132","key":"508_CR18","doi-asserted-by":"publisher","first-page":"305","DOI":"10.1007\/s10710-017-9314-z","volume":"19","author":"J Heaton","year":"2018","unstructured":"Heaton, J., Goodfellow, I., Bengio, Y., Courville, A.: Deep Learning. Genet. Program. Evolvable. Mach. 19(1\u20132), 305\u2013307 (2018)","journal-title":"Genet. Program. Evolvable. Mach."},{"key":"508_CR19","unstructured":"Hodo, E., Bellekens, X., Hamilton, A., Tachtatzis, C., Atkinson, R.: Shallow and deep networks intrusion detection system: a taxonomy and survey. CoRR, arXiv:1701.02145 (2017)"},{"key":"508_CR20","unstructured":"Information and Irvine Computer Science University of California: KDD Cup 1999 Data. http:\/\/kdd.ics.uci.edu\/databases\/kddcup99\/kddcup99.html (1999)"},{"key":"508_CR21","unstructured":"Jakkula, V.: Tutorial on Support Vector Machine (SVM), p. 37. School of EECS, Washington State University (2006)"},{"key":"508_CR22","doi-asserted-by":"crossref","unstructured":"Kato, K., Klyuev, V.: Development of a network intrusion detection system using apache Hadoop and spark. In: 2017 IEEE Conference on Dependable and Secure Computing, pp. 416\u2013423. IEEE (2017)","DOI":"10.1109\/DESEC.2017.8073860"},{"key":"508_CR23","doi-asserted-by":"crossref","unstructured":"Kim, J., Kim, J., Thu, H.L.T., Kim, H.: Long short term memory recurrent neural network classifier for intrusion detection. In: 2016 International Conference on Platform Technology and Service (PlatCon), pp. 1\u20135. IEEE (2016)","DOI":"10.1109\/PlatCon.2016.7456805"},{"key":"508_CR24","doi-asserted-by":"publisher","first-page":"178","DOI":"10.1016\/j.asoc.2014.01.028","volume":"18","author":"F Kuang","year":"2014","unstructured":"Kuang, F., Weihong, X., Zhang, S.: A novel hybrid KPCA and SVM with GA model for intrusion detection. Appl. Soft Comput. 18, 178\u2013184 (2014)","journal-title":"Appl. Soft Comput."},{"key":"508_CR25","doi-asserted-by":"crossref","unstructured":"Kulariya, M., Saraf, P., Ranjan, R., Gupta, G.P.: Performance analysis of network intrusion detection schemes using Apache Spark. In: 2016 International Conference on Communication and Signal Processing (ICCSP), pp. 1973\u20131977. IEEE (2016)","DOI":"10.1109\/ICCSP.2016.7754517"},{"issue":"70","key":"508_CR26","first-page":"1","volume":"6","author":"D Laney","year":"2001","unstructured":"Laney, D.: 3d data management: controlling data volume, velocity and variety. META Group Res. Note 6(70), 1 (2001)","journal-title":"META Group Res. Note"},{"issue":"5","key":"508_CR27","first-page":"205","volume":"9","author":"Y Li","year":"2015","unstructured":"Li, Y., Ma, R., Jiao, R.: A hybrid malicious code detection method based on deep learning. Methods 9(5), 205\u2013216 (2015)","journal-title":"Methods"},{"key":"508_CR28","doi-asserted-by":"crossref","unstructured":"Li, Z., Li, Y., Xu, L.: Anomaly intrusion detection method based on k-means clustering algorithm with particle swarm optimization. In: 2011 International Conference on Information Technology, Computer Engineering and Management Sciences (ICM), Vol.\u00a02, pp. 157\u2013161. IEEE (2011)","DOI":"10.1109\/ICM.2011.184"},{"key":"508_CR29","doi-asserted-by":"crossref","unstructured":"Masarat, S., Taheri, H., Sharifian, S.: A novel framework, based on fuzzy ensemble of classifiers for intrusion detection systems. In: 2014 4th International eConference on Computer and Knowledge Engineering (ICCKE), pp. 165\u2013170. IEEE (2014)","DOI":"10.1109\/ICCKE.2014.6993345"},{"key":"508_CR30","doi-asserted-by":"crossref","unstructured":"Muda, Z., Yassin, W., Sulaiman, M.N., Udzir, N.I.: Intrusion detection based on k-means clustering and na\u00efve bayes classification. In: 2011 7th International Conference on Information Technology in Asia (CITA 11), pp. 1\u20136. IEEE (2011)","DOI":"10.1109\/ISIAS.2011.6122818"},{"key":"508_CR31","unstructured":"Mukkamala, S., Janoski, G., Sung, A.: Intrusion detection: support vector machines and neural networks. In: Proceedings of the IEEE International Joint Conference on Neural Networks (ANNIE), St. Louis, MO, pp. 1702\u20131707 (2002)"},{"issue":"6","key":"508_CR32","first-page":"275","volume":"18","author":"AJ Myles","year":"2004","unstructured":"Myles, A.J., Feudale, R.N., Liu, Y., Woody, N.A., Brown, S.D.: An introduction to decision tree modeling. J. Chemom. A J. Chemom. Soc. 18(6), 275\u2013285 (2004)","journal-title":"J. Chemom. A J. Chemom. Soc."},{"key":"508_CR33","doi-asserted-by":"crossref","unstructured":"Mighan, S.N., Kahani, M.: Deep learning based latent feature extraction for intrusion detection. In: 26th Iranian Conference on Electrical Engineering (ICEE2018) (2018)","DOI":"10.1109\/ICEE.2018.8472418"},{"key":"508_CR34","doi-asserted-by":"crossref","unstructured":"Nazari, Z., Noferesti, M., Jalili, R.: DSCA: an inline and adaptive application identification approach in encrypted network traffic. In: Proceedings of the 3rd International Conference on Cryptography, Security and Privacy, pp. 39\u201343. ACM (2019)","DOI":"10.1145\/3309074.3309102"},{"issue":"9","key":"508_CR35","doi-asserted-by":"publisher","first-page":"3489","DOI":"10.1007\/s11227-015-1615-5","volume":"72","author":"MM Rathore","year":"2016","unstructured":"Rathore, M.M., Ahmad, A., Paul, A.: Real time intrusion detection system for ultra-high-speed big data environments. J. Supercomput. 72(9), 3489\u20133510 (2016)","journal-title":"J. Supercomput."},{"key":"508_CR36","series-title":"Advances in Intelligent and Soft Computing","doi-asserted-by":"publisher","first-page":"293","DOI":"10.1007\/978-3-642-20505-7_26","volume-title":"Soft Computing in Industrial Applications","author":"MA Salama","year":"2011","unstructured":"Salama, M.A., Eid, H.F., Ramadan, R.A., Darwish, A., Hassanien, A.E.: Hybrid intelligent intrusion detection scheme. In: Gaspar-Cunha, A., Takahashi, R., Schaefer, G., Costa, L. (eds.) Soft Computing in Industrial Applications. Advances in Intelligent and Soft Computing, vol. 96, pp. 293\u2013303. Springer, Berlin (2011)"},{"issue":"3","key":"508_CR37","doi-asserted-by":"publisher","first-page":"357","DOI":"10.1016\/j.cose.2011.12.012","volume":"31","author":"A Shiravi","year":"2012","unstructured":"Shiravi, A., Shiravi, H., Tavallaee, M., Ghorbani, A.A.: Toward developing a systematic approach to generate benchmark datasets for intrusion detection. Comput. Secur. 31(3), 357\u2013374 (2012)","journal-title":"Comput. Secur."},{"issue":"9","key":"508_CR38","doi-asserted-by":"publisher","first-page":"197","DOI":"10.3390\/sym9090197","volume":"9","author":"K Siddique","year":"2017","unstructured":"Siddique, K., Akhtar, Z., Lee, H., Kim, W., Kim, Y.: Toward bulk synchronous parallel-based machine learning techniques for anomaly detection in high-speed big data networks. Symmetry 9(9), 197 (2017)","journal-title":"Symmetry"},{"key":"508_CR39","doi-asserted-by":"crossref","unstructured":"Soheily-Khah, S., Marteau, P.-F., \u00e9chet, N.: Intrusion detection in network systems through hybrid supervised and unsupervised mining process a detailed case study on the ISCX benchmark dataset. In: 2018 1st International Conference on Data Intelligence and Security (ICDIS). IEEE (2017)","DOI":"10.1109\/ICDIS.2018.00043"},{"key":"508_CR40","volume-title":"Cryptography and Network Security: Principles and Practice","author":"W Stallings","year":"2017","unstructured":"Stallings, W.: Cryptography and Network Security: Principles and Practice. Pearson, Upper Saddle River (2017)"},{"key":"508_CR41","doi-asserted-by":"crossref","unstructured":"Thaseen, I.S., Kumar, Ch.A.: Intrusion detection model using fusion of PCA and optimized SVM. In: 2014 International Conference on Contemporary Computing and Informatics (IC3I), pp. 879\u2013884. IEEE (2014)","DOI":"10.1109\/IC3I.2014.7019692"},{"key":"508_CR42","unstructured":"UNB-ISCX: NSL KDD Dataset. http:\/\/www.unb.ca\/research\/iscx\/dataset\/iscx-NSL-KDD-dataset.html (2009)"},{"key":"508_CR43","doi-asserted-by":"publisher","first-page":"308","DOI":"10.1016\/j.comnet.2015.02.026","volume":"81","author":"B Wang","year":"2015","unstructured":"Wang, B., Zheng, Y., Lou, W., Hou, Y.T.: Ddos attack protection in the era of cloud computing and software-defined networking. Comput. Netw. 81, 308\u2013319 (2015)","journal-title":"Comput. Netw."},{"issue":"11","key":"508_CR44","doi-asserted-by":"publisher","first-page":"1520","DOI":"10.1002\/sec.1441","volume":"9","author":"Y Wang","year":"2016","unstructured":"Wang, Y., Cai, W., Wei, P.: A deep learning approach for detecting malicious Javascript code. Secur. Commun. Netw. 9(11), 1520\u20131534 (2016)","journal-title":"Secur. Commun. Netw."},{"key":"508_CR45","doi-asserted-by":"publisher","first-page":"232","DOI":"10.1016\/j.neucom.2015.08.104","volume":"184","author":"Y Wang","year":"2016","unstructured":"Wang, Y., Yao, H., Zhao, S.: Auto-encoder based dimensionality reduction. Neurocomputing 184, 232\u2013242 (2016)","journal-title":"Neurocomputing"},{"key":"508_CR46","unstructured":"Wang, Z.: The Applications of Deep Learning on Traffic Identification. BlackHat USA (2015)"},{"key":"508_CR47","unstructured":"Watson, G.: A Comparison of Header and Deep Packet Features When Detecting Network Intrusions. Technical Report (2018)"},{"issue":"1","key":"508_CR48","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1016\/j.asoc.2009.06.019","volume":"10","author":"SX Wu","year":"2010","unstructured":"Wu, S.X., Banzhaf, W.: The use of computational intelligence in intrusion detection systems: a review. Appl. Soft Comput. 10(1), 1\u201335 (2010)","journal-title":"Appl. Soft Comput."},{"key":"508_CR49","volume-title":"Harness the Power of Big Data: The IBM Big Data Platform","author":"P Zikopoulos","year":"2013","unstructured":"Zikopoulos, P., Deroos, D., Parasuraman, K., Deutsch, T., Giles, J., Corrigan, D.: Harness the Power of Big Data: The IBM Big Data Platform. McGraw-Hill, New York (2013)"},{"issue":"1","key":"508_CR50","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1186\/s40537-015-0013-4","volume":"2","author":"R Zuech","year":"2015","unstructured":"Zuech, R., Khoshgoftaar, T.M., Wald, R.: Intrusion detection and big heterogeneous data: a survey. J. Big Data 2(1), 3 (2015)","journal-title":"J. Big Data"}],"container-title":["International Journal of Information Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-020-00508-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10207-020-00508-5\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-020-00508-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,6,14]],"date-time":"2021-06-14T19:08:56Z","timestamp":1623697736000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10207-020-00508-5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,6,15]]},"references-count":50,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2021,6]]}},"alternative-id":["508"],"URL":"https:\/\/doi.org\/10.1007\/s10207-020-00508-5","relation":{},"ISSN":["1615-5262","1615-5270"],"issn-type":[{"value":"1615-5262","type":"print"},{"value":"1615-5270","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,6,15]]},"assertion":[{"value":"15 June 2020","order":1,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Compliance with ethical standards"}},{"value":"The authors declare that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"This article does not contain any studies with animals performed by any of the authors.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical approval"}},{"value":"Informed consent was obtained from all individual participants included in the study.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Informed consent"}}]}}