{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,8]],"date-time":"2026-04-08T16:35:12Z","timestamp":1775666112905,"version":"3.50.1"},"reference-count":31,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2024,10,22]],"date-time":"2024-10-22T00:00:00Z","timestamp":1729555200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,10,22]],"date-time":"2024-10-22T00:00:00Z","timestamp":1729555200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"name":"Jilin Provincial Science and Technology Department Innovation Platform (Base) and Talent Special Project","award":["20220508043RC"],"award-info":[{"award-number":["20220508043RC"]}]},{"name":"Jilin Province Key Research Development Plan Project","award":["20230203037SF"],"award-info":[{"award-number":["20230203037SF"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Supercomput"],"published-print":{"date-parts":[[2025,1]]},"DOI":"10.1007\/s11227-024-06473-3","type":"journal-article","created":{"date-parts":[[2024,10,22]],"date-time":"2024-10-22T18:02:57Z","timestamp":1729620177000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Attack stage detection method based on vector reconstruction error autoencoder and explainable artificial intelligence"],"prefix":"10.1007","volume":"81","author":[{"given":"Jinze","family":"Li","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xiangyu","family":"Meng","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zichen","family":"Qi","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dong","family":"Guo","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Cong","family":"Fu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2024,10,22]]},"reference":[{"key":"6473_CR1","doi-asserted-by":"publisher","first-page":"33","DOI":"10.1016\/j.jnca.2018.12.006","volume":"128","author":"N Moustafa","year":"2019","unstructured":"Moustafa N, Hu J, Slay J (2019) A holistic review of network anomaly detection systems: a comprehensive survey. J Netw Comput Appl 128:33\u201355. https:\/\/doi.org\/10.1016\/j.jnca.2018.12.006","journal-title":"J Netw Comput Appl"},{"key":"6473_CR2","doi-asserted-by":"publisher","first-page":"214","DOI":"10.1016\/j.cose.2018.03.001","volume":"76","author":"J Navarro","year":"2018","unstructured":"Navarro J, Deruyver A, Parrend P (2018) A systematic survey on multi-step attack detection. Comput Secur 76:214\u2013249. https:\/\/doi.org\/10.1016\/j.cose.2018.03.001","journal-title":"Comput Secur"},{"key":"6473_CR3","doi-asserted-by":"publisher","unstructured":"Milajerdi SM, Gjomemo R, Eshete B, et\u00a0al (2019) Holmes: real-time apt detection through correlation of suspicious information flows. In: 2019 IEEE Symposium on Security and Privacy (SP), IEEE, pp 1137\u20131152. https:\/\/doi.org\/10.1109\/SP.2019.00026","DOI":"10.1109\/SP.2019.00026"},{"issue":"1","key":"6473_CR4","doi-asserted-by":"publisher","first-page":"640","DOI":"10.1109\/COMST.2018.2871866","volume":"21","author":"M Hus\u00e1k","year":"2018","unstructured":"Hus\u00e1k M, Kom\u00e1rkov\u00e1 J, Bou-Harb E et al (2018) Survey of attack projection, prediction, and forecasting in cyber security. IEEE Communications Surveys & Tutorials 21(1):640\u2013660. https:\/\/doi.org\/10.1109\/COMST.2018.2871866","journal-title":"IEEE Communications Surveys & Tutorials"},{"issue":"8","key":"6473_CR5","doi-asserted-by":"publisher","first-page":"2874","DOI":"10.3390\/s22082874","volume":"22","author":"X Zhang","year":"2022","unstructured":"Zhang X, Wu T, Zheng Q et al (2022) Multi-step attack detection based on pre-trained hidden Markov models. Sensors 22(8):2874. https:\/\/doi.org\/10.3390\/s22082874","journal-title":"Sensors"},{"issue":"6","key":"6473_CR6","doi-asserted-by":"publisher","first-page":"1989","DOI":"10.1007\/s10207-023-00729-4","volume":"22","author":"S Farhat","year":"2023","unstructured":"Farhat S, Abdelkader M, Meddeb-Makhlouf A et al (2023) Cads-ml\/dl: efficient cloud-based multi-attack detection system. Int J Inf Secur 22(6):1989\u20132013. https:\/\/doi.org\/10.1007\/s10207-023-00729-4","journal-title":"Int J Inf Secur"},{"issue":"6","key":"6473_CR7","doi-asserted-by":"publisher","first-page":"8644","DOI":"10.1007\/s11227-021-04201-9","volume":"78","author":"M Panahnejad","year":"2022","unstructured":"Panahnejad M, Mirabi M (2022) Apt-dt-kc: advanced persistent threat detection based on kill-chain model. J Supercomput 78(6):8644\u20138677. https:\/\/doi.org\/10.1007\/s11227-021-04201-9","journal-title":"J Supercomput"},{"issue":"2","key":"6473_CR8","doi-asserted-by":"publisher","first-page":"604","DOI":"10.1002\/acs.3717","volume":"38","author":"A Kumar","year":"2024","unstructured":"Kumar A, Noliya A, Makani R (2024) Fuzzy inference based feature selection and optimized deep learning for advanced persistent threat attack detection. Int J Adapt Control Signal Process 38(2):604\u2013620. https:\/\/doi.org\/10.1002\/acs.3717","journal-title":"Int J Adapt Control Signal Process"},{"issue":"4","key":"6473_CR9","doi-asserted-by":"publisher","first-page":"45","DOI":"10.1016\/j.eij.2022.06.005","volume":"23","author":"J Al-Saraireh","year":"2022","unstructured":"Al-Saraireh J et al (2022) A novel approach for detecting advanced persistent threats. Egyptian Inf J 23(4):45\u201355. https:\/\/doi.org\/10.1016\/j.eij.2022.06.005","journal-title":"Egyptian Inf J"},{"key":"6473_CR10","doi-asserted-by":"crossref","unstructured":"Ahmed Y, Asyhari AT, Rahman MA (2021) A cyber kill chain approach for detecting advanced persistent threats. Comput Mater Continua 67(2), 2497\u20132513. https:\/\/doi.org\/10.32604\/cmc.2021.014223","DOI":"10.32604\/cmc.2021.014223"},{"key":"6473_CR11","doi-asserted-by":"publisher","unstructured":"Xie L, Li X, Yang H, et\u00a0al (2022) A multi-stage apt attack detection method based on sample enhancement. In: International Symposium on Cyberspace Safety and Security, Springer, pp 209\u2013216. https:\/\/doi.org\/10.1007\/978-3-031-18067-5_15","DOI":"10.1007\/978-3-031-18067-5_15"},{"key":"6473_CR12","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102203","volume":"105","author":"P Zhou","year":"2021","unstructured":"Zhou P, Zhou G, Wu D et al (2021) Detecting multi-stage attacks using sequence-to-sequence model. Comput Secur 105:102203. https:\/\/doi.org\/10.1016\/j.cose.2021.102203","journal-title":"Comput Secur"},{"key":"6473_CR13","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101974","volume":"97","author":"T Li","year":"2020","unstructured":"Li T, Liu Y, Liu Y et al (2020) Attack plan recognition using hidden Markov and probabilistic inference. Comput Secur 97:101974. https:\/\/doi.org\/10.1016\/j.cose.2020.101974","journal-title":"Comput Secur"},{"key":"6473_CR14","doi-asserted-by":"publisher","first-page":"811","DOI":"10.1016\/j.future.2019.05.032","volume":"100","author":"J Shin","year":"2019","unstructured":"Shin J, Choi SH, Liu P et al (2019) Unsupervised multi-stage attack detection framework without details on single-stage attacks. Futur Gener Comput Syst 100:811\u2013825. https:\/\/doi.org\/10.1016\/j.future.2019.05.032","journal-title":"Futur Gener Comput Syst"},{"key":"6473_CR15","doi-asserted-by":"publisher","unstructured":"Kumar A, Thing VL (2023) Raptor: advanced persistent threat detection in industrial iot via attack stage correlation. In: 2023 20th Annual International Conference on Privacy, Security and Trust (PST), IEEE, pp 1\u201312. https:\/\/doi.org\/10.1109\/PST58708.2023.10320192","DOI":"10.1109\/PST58708.2023.10320192"},{"key":"6473_CR16","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2023.119000","volume":"639","author":"M Keshk","year":"2023","unstructured":"Keshk M, Koroniotis N, Pham N et al (2023) An explainable deep learning-enabled intrusion detection framework in iot networks. Inf Sci 639:119000. https:\/\/doi.org\/10.1016\/j.ins.2023.119000","journal-title":"Inf Sci"},{"issue":"1","key":"6473_CR17","doi-asserted-by":"publisher","first-page":"1000","DOI":"10.1109\/TITS.2022.3188671","volume":"24","author":"A Oseni","year":"2022","unstructured":"Oseni A, Moustafa N, Creech G et al (2022) An explainable deep learning framework for resilient intrusion detection in IoT-enabled transportation networks. IEEE Trans Intell Transp Syst 24(1):1000\u20131014. https:\/\/doi.org\/10.1109\/TITS.2022.3188671","journal-title":"IEEE Trans Intell Transp Syst"},{"issue":"19","key":"6473_CR18","doi-asserted-by":"publisher","first-page":"3079","DOI":"10.3390\/electronics11193079","volume":"11","author":"S Patil","year":"2022","unstructured":"Patil S, Varadarajan V, Mazhar SM et al (2022) Explainable artificial intelligence for intrusion detection system. Electronics 11(19):3079. https:\/\/doi.org\/10.3390\/electronics11193079","journal-title":"Electronics"},{"key":"6473_CR19","doi-asserted-by":"publisher","unstructured":"Abou El Houda Z, Brik B, Khoukhi L (2022) \u201cwhy should i trust your ids?\u201d: an explainable deep learning framework for intrusion detection systems in internet of things networks. IEEE Open J Commun Soc 3:1164\u20131176. https:\/\/doi.org\/10.1109\/OJCOMS.2022.3188750","DOI":"10.1109\/OJCOMS.2022.3188750"},{"issue":"3","key":"6473_CR20","doi-asserted-by":"publisher","first-page":"1154","DOI":"10.3390\/s22031154","volume":"22","author":"TTH Le","year":"2022","unstructured":"Le TTH, Kim H, Kang H et al (2022) Classification and explanation for intrusion detection system based on ensemble trees and shap method. Sensors 22(3):1154. https:\/\/doi.org\/10.3390\/s22031154","journal-title":"Sensors"},{"issue":"9","key":"6473_CR21","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3472753","volume":"54","author":"D Chou","year":"2021","unstructured":"Chou D, Jiang M (2021) A survey on data-driven network intrusion detection. ACM Comput Surveys (CSUR) 54(9):1\u201336. https:\/\/doi.org\/10.1145\/3472753","journal-title":"ACM Comput Surveys (CSUR)"},{"key":"6473_CR22","doi-asserted-by":"publisher","first-page":"11","DOI":"10.1016\/j.neucom.2016.12.038","volume":"234","author":"W Liu","year":"2017","unstructured":"Liu W, Wang Z, Liu X et al (2017) A survey of deep neural network architectures and their applications. Neurocomputing 234:11\u201326. https:\/\/doi.org\/10.1016\/j.neucom.2016.12.038","journal-title":"Neurocomputing"},{"issue":"1","key":"6473_CR23","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1186\/s42400-022-00134-9","volume":"6","author":"H Torabi","year":"2023","unstructured":"Torabi H, Mirtaheri SL, Greco S (2023) Practical autoencoder based anomaly detection by using vector reconstruction error. Cybersecurity 6(1):1. https:\/\/doi.org\/10.1186\/s42400-022-00134-9","journal-title":"Cybersecurity"},{"key":"6473_CR24","doi-asserted-by":"publisher","DOI":"10.1111\/exsy.13403","author":"A Khalane","year":"2023","unstructured":"Khalane A, Makwana R, Shaikh T et al (2023) Evaluating significant features in context-aware multimodal emotion recognition with XAI methods. Expert Syst. https:\/\/doi.org\/10.1111\/exsy.13403","journal-title":"Expert Syst"},{"key":"6473_CR25","doi-asserted-by":"publisher","first-page":"52138","DOI":"10.1109\/ACCESS.2018.2870052","volume":"6","author":"A Adadi","year":"2018","unstructured":"Adadi A, Berrada M (2018) Peeking inside the black-box: a survey on explainable artificial intelligence (XAI). IEEE Access 6:52138\u201352160. https:\/\/doi.org\/10.1109\/ACCESS.2018.2870052","journal-title":"IEEE Access"},{"issue":"1","key":"6473_CR26","doi-asserted-by":"publisher","first-page":"68","DOI":"10.1145\/3359786","volume":"63","author":"M Du","year":"2019","unstructured":"Du M, Liu N, Hu X (2019) Techniques for interpretable machine learning. Commun ACM 63(1):68\u201377. https:\/\/doi.org\/10.1145\/3359786","journal-title":"Commun ACM"},{"key":"6473_CR27","doi-asserted-by":"publisher","first-page":"5","DOI":"10.1023\/A:1010933404324","volume":"45","author":"L Breiman","year":"2001","unstructured":"Breiman L (2001) Random forests. Machine learning 45:5\u201332. https:\/\/doi.org\/10.1023\/A:1010933404324","journal-title":"Random forests. Machine learning"},{"key":"6473_CR28","doi-asserted-by":"publisher","unstructured":"Fisher A, Rudin C, Dominici F (2019) All models are wrong, but many are useful: Learning a variable\u2019s importance by studying an entire class of prediction models simultaneously. J Mach Learn Res 20(177):1\u201381. https:\/\/doi.org\/10.48550\/arXiv.1801.01489","DOI":"10.48550\/arXiv.1801.01489"},{"key":"6473_CR29","doi-asserted-by":"publisher","first-page":"108","DOI":"10.5220\/0006639801080116","volume":"1","author":"I Sharafaldin","year":"2018","unstructured":"Sharafaldin I, Lashkari AH, Ghorbani AA et al (2018) Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp 1:108\u2013116. https:\/\/doi.org\/10.5220\/0006639801080116","journal-title":"ICISSp"},{"issue":"4","key":"6473_CR30","doi-asserted-by":"publisher","first-page":"2171","DOI":"10.3390\/s23042171","volume":"23","author":"YC Wang","year":"2023","unstructured":"Wang YC, Houng YC, Chen HX et al (2023) Network anomaly intrusion detection based on deep learning approach. Sensors 23(4):2171. https:\/\/doi.org\/10.3390\/s23042171","journal-title":"Sensors"},{"key":"6473_CR31","doi-asserted-by":"publisher","unstructured":"Gopalan SS, Ravikumar D, Linekar D, et\u00a0al (2021) Balancing approaches towards ml for ids: a survey for the cse-cic ids dataset. In: 2020 International Conference on Communications, Signal Processing, and Their Applications (ICCSPA), IEEE, pp 1\u20136. https:\/\/doi.org\/10.1109\/ICCSPA49915.2021.9385742","DOI":"10.1109\/ICCSPA49915.2021.9385742"}],"container-title":["The Journal of Supercomputing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11227-024-06473-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11227-024-06473-3\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11227-024-06473-3.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,10,22]],"date-time":"2024-10-22T18:04:50Z","timestamp":1729620290000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11227-024-06473-3"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,10,22]]},"references-count":31,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2025,1]]}},"alternative-id":["6473"],"URL":"https:\/\/doi.org\/10.1007\/s11227-024-06473-3","relation":{},"ISSN":["0920-8542","1573-0484"],"issn-type":[{"value":"0920-8542","type":"print"},{"value":"1573-0484","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,10,22]]},"assertion":[{"value":"2 October 2024","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"22 October 2024","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no conflict of  interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"62"}}