{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,16]],"date-time":"2026-03-16T10:56:00Z","timestamp":1773658560966,"version":"3.50.1"},"reference-count":70,"publisher":"Springer Science and Business Media LLC","issue":"2","license":[{"start":{"date-parts":[[2026,2,1]],"date-time":"2026-02-01T00:00:00Z","timestamp":1769904000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,2,2]],"date-time":"2026-02-02T00:00:00Z","timestamp":1769990400000},"content-version":"vor","delay-in-days":1,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"DOI":"10.13039\/501100005222","name":"University of Jyv\u00e4skyl\u00e4","doi-asserted-by":"crossref","id":[{"id":"10.13039\/501100005222","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Mach. Learn. &amp; Cyber."],"published-print":{"date-parts":[[2026,2]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>This paper presents a method for detecting anomalies directly from binary data using Deep Learning techniques. We aimed to support information security in network environments. The approach employs Deep Learning models based on neural networks to analyze raw binary data without preprocessing or transformation, allowing the detection of low-level deviations in the data patterns. The model\u2019s performance with raw binary data was evaluated using three publicly available datasets: CIC-IDS2017, CIC-IDS2018, and IoT-IDS. Evaluation results indicated that the method can detect various types of attacks, with consistent performance on all tested datasets: the F1-scores were .9674 (CIC-IDS2017), .9911 (CIC-IDS2018), and .9957 (IoT-IDS). The paper outlines the method\u2019s design and includes the model architecture, evaluation procedures, and observed performance metrics for anomaly detection tasks. The detection results are also presented and analyzed in detail.<\/jats:p>","DOI":"10.1007\/s13042-025-02853-0","type":"journal-article","created":{"date-parts":[[2026,2,2]],"date-time":"2026-02-02T06:12:19Z","timestamp":1770012739000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Raw binary data usage with deep learning for advanced persistent threat attacks early stage detection"],"prefix":"10.1007","volume":"17","author":[{"given":"Tero","family":"Bodstr\u00f6m","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Timo","family":"H\u00e4m\u00e4l\u00e4inen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,2,2]]},"reference":[{"issue":"1","key":"2853_CR1","doi-asserted-by":"publisher","first-page":"90","DOI":"10.1109\/MSEC.2020.3037448","volume":"19","author":"MS Elsayed","year":"2021","unstructured":"Elsayed MS, Le-Khac N-A, Jurcut AD (2021) Dealing with covid-19 network traffic spikes [cybercrime and forensics]. IEEE Secur Privacy 19(1):90\u201394","journal-title":"IEEE Secur Privacy"},{"key":"2853_CR2","doi-asserted-by":"crossref","unstructured":"Muheidat F, Tawalbeh M, Quwaider M, Saldamli G, et al. (2020) Predicting and preventing cyber attacks during covid-19 time using data analysis and proposed secure iot layered model. In: 2020 Fourth international conference on multimedia computing, networking and applications (MCNA), pp 113\u2013118 (2020). IEEE","DOI":"10.1109\/MCNA50957.2020.9264301"},{"key":"2853_CR3","doi-asserted-by":"crossref","unstructured":"Al\u00a0Shammari A, Maiti RR, Hammer B (2021) Organizational security policy and management during covid-19. In: SoutheastCon 2021. IEEE, pp 1\u20134","DOI":"10.1109\/SoutheastCon45413.2021.9401907"},{"key":"2853_CR4","unstructured":"FireEye: FireEye: Government top target for APT attacks. https:\/\/www.fireeye.com\/content\/dam\/fireeye-www\/global\/en\/solutions\/pdfs\/rpt-government-atr-backgrounder.pdf. [Online; accessed Sep. 26, 2021] (2014)"},{"key":"2853_CR5","doi-asserted-by":"crossref","unstructured":"Bodstr\u00f6m T, H\u00e4m\u00e4l\u00e4inen T (2018) A novel method for detecting apt attacks by using ooda loop and black swan theory. In: International conference on computational social networks, pp 498\u2013509. Springer","DOI":"10.1007\/978-3-030-04648-4_42"},{"key":"2853_CR6","unstructured":"Ramachandran P, Zoph B, Le QV (2017) Searching for activation functions"},{"key":"2853_CR7","unstructured":"Taleb NN (2007) The black swan: the impact of the highly improbable. Random house"},{"key":"2853_CR8","unstructured":"Taleb NN (2020) Statistical consequences of fat tails: real world preasymptotics, epistemology, and applications, 1. arXiv preprint arXiv:2001.10488"},{"key":"2853_CR9","doi-asserted-by":"publisher","first-page":"204","DOI":"10.1016\/j.patrec.2022.05.023","volume":"159","author":"M Esmaeilpour","year":"2022","unstructured":"Esmaeilpour M, Chaalia N, Abusitta A, Devailly FX, Maazoun W, Cardinal P (2022) Bi-discriminator gan for tabular data synthesis. Pattern Recogn Lett 159:204\u2013210","journal-title":"Pattern Recogn Lett"},{"key":"2853_CR10","unstructured":"Xu L, Skoularidou M, Cuesta-Infante A, Veeramachaneni K (2019) Modeling tabular data using conditional gan. Adv Neural Inf Process Syst, 32"},{"key":"2853_CR11","doi-asserted-by":"publisher","DOI":"10.1016\/j.egyai.2022.100177","volume":"9","author":"M Rizzato","year":"2022","unstructured":"Rizzato M, Morizet N, Mar\u00e9chal W, Geissler C (2022) Stress testing electrical grids: generative adversarial networks for load scenario generation. Energy AI 9:100177","journal-title":"Energy AI"},{"key":"2853_CR12","doi-asserted-by":"crossref","unstructured":"Maharana, K., Mondal, S., Nemade, B.: A review: Data pre-processing and data augmentation techniques. Global transitions proceedings, 3(1), 91\u201399. In: International Conference on Intelligent Engineering Approach (ICIEA-2022) (2022)","DOI":"10.1016\/j.gltp.2022.04.020"},{"key":"2853_CR13","doi-asserted-by":"publisher","DOI":"10.3389\/fbinf.2022.927312","volume":"2","author":"N Pudjihartono","year":"2022","unstructured":"Pudjihartono N, Fadason T, Kempa-Liehr AW, O\u2019Sullivan JM (2022) A review of feature selection methods for machine learning-based disease risk prediction. Front Bioinform 2:927312","journal-title":"Front Bioinform"},{"key":"2853_CR14","doi-asserted-by":"publisher","first-page":"547","DOI":"10.1007\/s10207-021-00567-2","volume":"1\u201316","author":"M Soltani","year":"2022","unstructured":"Soltani M, Siavoshani MJ, Jahangir AH (2022) A content-based deep intrusion detection system. Int J Inf Secur 1\u201316:547\u2013562","journal-title":"Int J Inf Secur"},{"issue":"6","key":"2853_CR15","doi-asserted-by":"publisher","first-page":"1055","DOI":"10.3390\/app9061055","volume":"9","author":"T Bodstr\u00f6m","year":"2019","unstructured":"Bodstr\u00f6m T, H\u00e4m\u00e4l\u00e4inen T (2019) A novel deep learning stack for apt detection. Appl Sci 9(6):1055","journal-title":"Appl Sci"},{"key":"2853_CR16","doi-asserted-by":"crossref","unstructured":"Khalid A, Zainal A, Maarof MA, Ghaleb FA (2021) Advanced persistent threat detection: a survey. In: 2021 3rd International cyber resilience conference (CRC), pp 1\u20136. IEEE","DOI":"10.1109\/CRC50527.2021.9392626"},{"key":"2853_CR17","doi-asserted-by":"publisher","first-page":"162642","DOI":"10.1109\/ACCESS.2020.3021499","volume":"8","author":"M Khosravi","year":"2020","unstructured":"Khosravi M, Ladani BT (2020) Alerts correlation and causal analysis for apt based cyber attack detection. IEEE Access 8:162642\u2013162656","journal-title":"IEEE Access"},{"issue":"1","key":"2853_CR18","doi-asserted-by":"publisher","first-page":"22223","DOI":"10.1038\/s41598-024-72957-0","volume":"14","author":"CD Xuan","year":"2024","unstructured":"Xuan CD, Nguyen TT (2024) A novel approach for apt attack detection based on an advanced computing. Sci Rep 14(1):22223","journal-title":"Sci Rep"},{"issue":"6","key":"2853_CR19","doi-asserted-by":"publisher","first-page":"0305618","DOI":"10.1371\/journal.pone.0305618","volume":"19","author":"C Do Xuan","year":"2024","unstructured":"Do Xuan C, Cuong NH (2024) A novel approach for apt attack detection based on feature intelligent extraction and representation learning. PLoS ONE 19(6):0305618","journal-title":"PLoS ONE"},{"issue":"1","key":"2853_CR20","first-page":"023","volume":"10","author":"NI Che Mat","year":"2024","unstructured":"Che Mat NI, Jamil N, Yusoff Y, Mat Kiah ML (2024) A systematic literature review on advanced persistent threat behaviors and its detection strategy. J Cybersecur 10(1):023","journal-title":"J Cybersecur"},{"key":"2853_CR21","doi-asserted-by":"crossref","unstructured":"Yan H, Zhang Q, Xie J, Lu Z, Chen S, Guo D (2021) An intelligent game theory framework for detecting advanced persistent threats. In: 2021 IEEE 27th international conference on parallel and distributed systems (ICPADS), pp 450\u2013457 (2021). IEEE","DOI":"10.1109\/ICPADS53394.2021.00062"},{"key":"2853_CR22","doi-asserted-by":"crossref","unstructured":"Klyaus T, Gatchin YA (2020) Mathematical model for information security system effectiveness evaluation against advanced persistent threat attacks. In: 2020 Wave electronics and its application in information and telecommunication systems (WECONF), pp 1\u20135. IEEE","DOI":"10.1109\/WECONF48837.2020.9131540"},{"issue":"12","key":"2853_CR23","doi-asserted-by":"publisher","first-page":"92","DOI":"10.1109\/MC.2020.3021548","volume":"53","author":"Q Zou","year":"2020","unstructured":"Zou Q, Sun X, Liu P, Singhal A (2020) An approach for detection of advanced persistent threat attacks. Computer 53(12):92\u201396","journal-title":"Computer"},{"key":"2853_CR24","doi-asserted-by":"crossref","unstructured":"Neuschmied H, Winter M, Hofer-Schmitz K, Stojanovic B, Kleb U (2021) Two stage anomaly detection for network intrusion detection. In: ICISSP, pp 450\u2013457","DOI":"10.5220\/0010233404500457"},{"key":"2853_CR25","doi-asserted-by":"publisher","first-page":"104695","DOI":"10.1109\/ACCESS.2021.3100087","volume":"9","author":"B Min","year":"2021","unstructured":"Min B, Yoo J, Kim S, Shin D, Shin D (2021) Network anomaly detection using memory-augmented deep autoencoder. IEEE Access 9:104695\u2013104706","journal-title":"IEEE Access"},{"issue":"4","key":"2853_CR26","doi-asserted-by":"publisher","first-page":"165","DOI":"10.33851\/JMIS.2019.6.4.165","volume":"6","author":"J Kim","year":"2019","unstructured":"Kim J, Shin Y, Choi E (2019) An intrusion detection model based on a convolutional neural network. J Multimedia Inf Syst 6(4):165\u2013172","journal-title":"J Multimedia Inf Syst"},{"issue":"20","key":"2853_CR27","doi-asserted-by":"publisher","first-page":"13251","DOI":"10.1007\/s00521-021-05952-5","volume":"33","author":"C Do Xuan","year":"2021","unstructured":"Do Xuan C, Dao MH (2021) A novel approach for apt attack detection based on combined deep learning model. Neural Comput Appl 33(20):13251\u201313264","journal-title":"Neural Comput Appl"},{"key":"2853_CR28","doi-asserted-by":"publisher","first-page":"186125","DOI":"10.1109\/ACCESS.2020.3029202","volume":"8","author":"JH Joloudari","year":"2020","unstructured":"Joloudari JH, Haderbadi M, Mashmool A, GhasemiGol M, Band SS, Mosavi A (2020) Early detection of the advanced persistent threat attack using performance analysis of deep learning. IEEE Access 8:186125\u2013186137","journal-title":"IEEE Access"},{"key":"2853_CR29","first-page":"108","volume":"1","author":"I Sharafaldin","year":"2018","unstructured":"Sharafaldin I, Lashkari AH, Ghorbani AA (2018) Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp 1:108\u2013116","journal-title":"ICISSp"},{"key":"2853_CR30","doi-asserted-by":"publisher","first-page":"100","DOI":"10.1016\/j.cose.2014.05.011","volume":"45","author":"S Garcia","year":"2014","unstructured":"Garcia S, Grill M, Stiborek J, Zunino A (2014) An empirical comparison of botnet detection methods. Comput Secur 45:100\u2013123","journal-title":"Comput Secur"},{"key":"2853_CR31","unstructured":"The NSL-KDD Data Set - web.archive.org (1999) https:\/\/web.archive.org\/web\/20150205070216\/http:\/\/nsl.cs.unb.ca\/NSL-KDD\/. Accessed 11 June 2025"},{"key":"2853_CR32","doi-asserted-by":"crossref","unstructured":"Kabir MA, Luo X (2020) Unsupervised learning for network flow based anomaly detection in the era of deep learning. In: 2020 IEEE sixth international conference on big data computing service and applications (BigDataService), pp 165\u2013168. IEEE","DOI":"10.1109\/BigDataService49289.2020.00032"},{"key":"2853_CR33","doi-asserted-by":"crossref","unstructured":"Dawoud A, Sianaki OA, Shahristani S, Raun C (2020) Internet of things intrusion detection: a deep learning approach. In: 2020 IEEE symposium series on computational intelligence (SSCI), pp 1516\u20131522. IEEE","DOI":"10.1109\/SSCI47803.2020.9308293"},{"key":"2853_CR34","doi-asserted-by":"crossref","unstructured":"Sun Y, Ochiai H, Esaki H (2021) Deep learning-based anomaly detection in lan from raw network traffic measurement. In: 2021 55th annual conference on information sciences and systems (CISS), pp 1\u20135. IEEE","DOI":"10.1109\/CISS50987.2021.9400241"},{"key":"2853_CR35","doi-asserted-by":"crossref","unstructured":"Chapaneri R, Shah S (2019) Detection of malicious network traffic using convolutional neural networks. In: 2019 10th international conference on computing, communication and networking technologies (ICCCNT), pp 1\u20136. IEEE","DOI":"10.1109\/ICCCNT45670.2019.8944814"},{"key":"2853_CR36","doi-asserted-by":"crossref","unstructured":"Liu S, Jiang H, Li S, Yang Y, Shen L. A feature compression technique for anomaly detection using convolutional neural networks. In: 2020 IEEE 14th international conference on anti-counterfeiting, security, and identification (ASID). IEEE, pp 39\u201342","DOI":"10.1109\/ASID50160.2020.9271685"},{"issue":"6","key":"2853_CR37","doi-asserted-by":"publisher","first-page":"821","DOI":"10.26599\/TST.2020.9010041","volume":"26","author":"W Wang","year":"2021","unstructured":"Wang W, Wang Z, Zhou Z, Deng H, Zhao W, Wang C, Guo Y (2021) Anomaly detection of industrial control systems based on transfer learning. Tsinghua Sci Technol 26(6):821\u2013832","journal-title":"Tsinghua Sci Technol"},{"key":"2853_CR38","doi-asserted-by":"crossref","unstructured":"Wang B, Su Y, Nie J (2020) C-gru: a parallel neural network for malicious traffic classification. In: 2020 International conference on artificial intelligence and education (ICAIE), pp 32\u201335. IEEE","DOI":"10.1109\/ICAIE50891.2020.00015"},{"key":"2853_CR39","doi-asserted-by":"crossref","unstructured":"Nagisetty A, Gupta GP (2019) Framework for detection of malicious activities in iot networks using keras deep learning library. In: 2019 3rd international conference on computing methodologies and communication (ICCMC), pp 633\u2013637. IEEE","DOI":"10.1109\/ICCMC.2019.8819688"},{"key":"2853_CR40","doi-asserted-by":"crossref","unstructured":"Hannan A, Gruhl C, Sick B (2021) Anomaly based resilient network intrusion detection using inferential autoencoders. In: 2021 IEEE international conference on cyber security and resilience (CSR), pp 1\u20137. IEEE","DOI":"10.1109\/CSR51186.2021.9527980"},{"key":"2853_CR41","doi-asserted-by":"crossref","unstructured":"Moustafa N, Slay J (2015) Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set). In: 2015 Military Communications and Information Systems Conference (MilCIS), pp 1\u20136. IEEE","DOI":"10.1109\/MilCIS.2015.7348942"},{"issue":"3","key":"2853_CR42","doi-asserted-by":"publisher","first-page":"357","DOI":"10.1016\/j.cose.2011.12.012","volume":"31","author":"A Shiravi","year":"2012","unstructured":"Shiravi A, Shiravi H, Tavallaee M, Ghorbani AA (2012) Toward developing a systematic approach to generate benchmark datasets for intrusion detection. Comput Secur 31(3):357\u2013374","journal-title":"Comput Secur"},{"key":"2853_CR43","doi-asserted-by":"crossref","unstructured":"Beaver JM, Borges-Hink RC, Buckner MA (2013) An evaluation of machine learning methods to detect malicious scada communications. In: 2013 12th international conference on machine learning and applications, vol 2, pp 54\u201359. IEEE","DOI":"10.1109\/ICMLA.2013.105"},{"key":"2853_CR44","unstructured":"KDD Cup 1999 Data\u2014kdd.ics.uci.edu. https:\/\/kdd.ics.uci.edu\/databases\/kddcup99\/kddcup99.html. [Accessed 11-06-2025] (1999)"},{"issue":"5","key":"2853_CR45","doi-asserted-by":"publisher","first-page":"1775","DOI":"10.3390\/app10051775","volume":"10","author":"R Mag\u00e1n-Carri\u00f3n","year":"2020","unstructured":"Mag\u00e1n-Carri\u00f3n R, Urda D, D\u00edaz-Cano I, Dorronsoro B (2020) Towards a reliable comparison and evaluation of network intrusion detection systems based on machine learning approaches. Appl Sci 10(5):1775","journal-title":"Appl Sci"},{"key":"2853_CR46","doi-asserted-by":"crossref","unstructured":"Nevavuori P, Kokkonen T (2019) Requirements for training and evaluation dataset of network and host intrusion detection system. In: World conference on information systems and technologies, pp 534\u2013546. Springer","DOI":"10.1007\/978-3-030-16184-2_51"},{"key":"2853_CR47","doi-asserted-by":"publisher","first-page":"709","DOI":"10.1016\/j.procs.2017.12.091","volume":"125","author":"A Verma","year":"2018","unstructured":"Verma A, Ranga V (2018) Statistical analysis of cidds-001 dataset for network intrusion detection systems using distance-based machine learning. Procedia Comput Sci 125:709\u2013716","journal-title":"Procedia Comput Sci"},{"key":"2853_CR48","doi-asserted-by":"crossref","unstructured":"Gamayunov D (2014) Falsifiability of network security research: the good, the bad, and the ugly. In: Proceedings of the 1st ACM SIGPLAN workshop on reproducible research methodologies and new publication models in computer engineering, pp 1\u20133","DOI":"10.1145\/2618137.2618141"},{"key":"2853_CR49","doi-asserted-by":"crossref","unstructured":"Mhamdi L, McLernon D, El-moussa F, Zaidi SAR, Ghogho M, Tang T (2020) A deep learning approach combining autoencoder with one-class svm for ddos attack detection in sdns. In: 2020 IEEE eighth international conference on communications and networking (ComNet), pp 1\u20136. IEEE","DOI":"10.1109\/ComNet47917.2020.9306073"},{"key":"2853_CR50","doi-asserted-by":"crossref","unstructured":"Le DC, Zincir-Heywood AN, Heywood MI (2016) Data analytics on network traffic flows for botnet behaviour detection. In: 2016 IEEE symposium series on computational intelligence (SSCI), pp 1\u20137. IEEE","DOI":"10.1109\/SSCI.2016.7850078"},{"key":"2853_CR51","doi-asserted-by":"crossref","unstructured":"Htwe CS, Thant YM, Thwin MMS (2020) Botnets attack detection using machine learning approach for iot environment. In: Journal of Physics: Conference Series, vol. 1646, p 012101. IOP Publishing","DOI":"10.1088\/1742-6596\/1646\/1\/012101"},{"issue":"2","key":"2853_CR52","doi-asserted-by":"publisher","first-page":"41","DOI":"10.1109\/MC.2018.2888764","volume":"52","author":"K Siddique","year":"2019","unstructured":"Siddique K, Akhtar Z, Khan FA, Kim Y (2019) Kdd cup 99 data sets: a perspective on the role of data sets in network intrusion detection research. Computer 52(2):41\u201351","journal-title":"Computer"},{"key":"2853_CR53","doi-asserted-by":"crossref","unstructured":"Ali O, Cotae P (2018) Towards dos\/ddos attack detection using artificial neural networks. In: 2018 9th IEEE annual ubiquitous computing, electronics & mobile communication conference (UEMCON), pp 229\u2013234. IEEE","DOI":"10.1109\/UEMCON.2018.8796637"},{"key":"2853_CR54","doi-asserted-by":"crossref","unstructured":"Yulianto A, Sukarno P, Suwastika NA (2019) Improving adaboost-based intrusion detection system (ids) performance on cic ids 2017 dataset. In: Journal of Physics: Conference Series, vol 1192, p 012018. IOP Publishing","DOI":"10.1088\/1742-6596\/1192\/1\/012018"},{"issue":"18","key":"2853_CR55","first-page":"15","volume":"7","author":"T Brugger","year":"2007","unstructured":"Brugger T (2007) Kdd cup\u201999 dataset (network intrusion) considered harmful. KDnuggets Newsl 7(18):15","journal-title":"KDnuggets Newsl"},{"key":"2853_CR56","unstructured":"Chollet F (2021) Deep learning with Python. Simon and Schuster"},{"key":"2853_CR57","first-page":"2","volume":"1","author":"H Odikwa","year":"2020","unstructured":"Odikwa H, Ifeanyi-Reuben N, Thom-Manuel OM (2020) An improved approach for hidden nodes selection in artificial neural network. Diabetes 1:2","journal-title":"Diabetes"},{"issue":"3","key":"2853_CR58","doi-asserted-by":"publisher","first-page":"2855","DOI":"10.1007\/s11063-020-10234-7","volume":"51","author":"TK Gupta","year":"2020","unstructured":"Gupta TK, Raza K (2020) Optimizing deep feedforward neural network architecture: a tabu search based approach. Neural Process Lett 51(3):2855\u20132870","journal-title":"Neural Process Lett"},{"issue":"8","key":"2853_CR59","doi-asserted-by":"publisher","first-page":"1352","DOI":"10.1109\/TNN.2009.2024147","volume":"20","author":"G Feng","year":"2009","unstructured":"Feng G, Huang G-B, Lin Q, Gay R (2009) Error minimized extreme learning machine with growth of hidden nodes and incremental learning. IEEE Trans Neural Netw 20(8):1352\u20131357","journal-title":"IEEE Trans Neural Netw"},{"key":"2853_CR60","first-page":"28811","volume":"34","author":"S Bubeck","year":"2021","unstructured":"Bubeck S, Sellke M (2021) A universal law of robustness via isoperimetry. Adv Neural Inf Process Syst 34:28811\u201328822","journal-title":"Adv Neural Inf Process Syst"},{"key":"2853_CR61","doi-asserted-by":"crossref","unstructured":"Bodstr\u00f6m T, H\u00e4m\u00e4l\u00e4inen T (2018) State of the art literature review on network anomaly detection with deep learning. Springer, pp 64\u201376","DOI":"10.1007\/978-3-030-01168-0_7"},{"key":"2853_CR62","doi-asserted-by":"crossref","unstructured":"Myneni S, Chowdhary A, Sabur A, Sengupta S, Agrawal G, Huang D, Kang M (2020) Dapt 2020-constructing a benchmark dataset for advanced persistent threats. In: International workshop on deployable machine learning for security defense, pp 138\u2013163. Springer","DOI":"10.1007\/978-3-030-59621-7_8"},{"key":"2853_CR63","unstructured":"Kang H, Ahn DH, Lee GM, Yoo JD, Park KH, Kim HK (2019) IoT network intrusion dataset (2019). http:\/\/ocslab.hksecurity.net\/Datasets\/iot-network-intrusion-dataset"},{"key":"2853_CR64","unstructured":"Knuth\u00a0Donald E (1998) The art of computer programming vol 3: sorting and searching. Addison-Wesley Professional"},{"key":"2853_CR65","doi-asserted-by":"crossref","unstructured":"Hooshmand MK, Hosahalli D (2022) Network anomaly detection using deep learning techniques. CAAI Trans Intell Technol (2022)","DOI":"10.1049\/cit2.12078"},{"issue":"10","key":"2853_CR66","doi-asserted-by":"publisher","first-page":"1531","DOI":"10.3390\/electronics11101531","volume":"11","author":"M-T Kao","year":"2022","unstructured":"Kao M-T, Sung D-Y, Kao S-J, Chang F-M (2022) A novel two-stage deep learning structure for network flow anomaly detection. Electronics 11(10):1531","journal-title":"Electronics"},{"key":"2853_CR67","doi-asserted-by":"publisher","first-page":"205","DOI":"10.1016\/j.neucom.2021.01.146","volume":"485","author":"J Liu","year":"2022","unstructured":"Liu J, Song X, Zhou Y, Peng X, Zhang Y, Liu P, Wu D, Zhu C (2022) Deep anomaly detection in packet payload. Neurocomputing 485:205\u2013218","journal-title":"Neurocomputing"},{"key":"2853_CR68","first-page":"6576023","volume":"2022","author":"Z Fu","year":"2022","unstructured":"Fu Z (2022) Computer network intrusion anomaly detection with recurrent neural network. Mob Inf Syst 2022:6576023","journal-title":"Mob Inf Syst"},{"key":"2853_CR69","doi-asserted-by":"crossref","unstructured":"Dutta V, Pawlicki M, Kozik R, Chora\u015b M (2022) Unsupervised network traffic anomaly detection with deep autoencoders. Logic J IGPL","DOI":"10.1093\/jigpal\/jzac002"},{"issue":"3","key":"2853_CR70","doi-asserted-by":"publisher","first-page":"1759","DOI":"10.3390\/app12031759","volume":"12","author":"F Carrera","year":"2022","unstructured":"Carrera F, Dentamaro V, Galantucci S, Iannacone A, Impedovo D, Pirlo G (2022) Combining unsupervised approaches for near real-time network traffic anomaly detection. Appl Sci 12(3):1759","journal-title":"Appl Sci"}],"container-title":["International Journal of Machine Learning and Cybernetics"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s13042-025-02853-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s13042-025-02853-0","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s13042-025-02853-0.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,16]],"date-time":"2026-03-16T09:57:12Z","timestamp":1773655032000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s13042-025-02853-0"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2]]},"references-count":70,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2026,2]]}},"alternative-id":["2853"],"URL":"https:\/\/doi.org\/10.1007\/s13042-025-02853-0","relation":{},"ISSN":["1868-8071","1868-808X"],"issn-type":[{"value":"1868-8071","type":"print"},{"value":"1868-808X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2]]},"assertion":[{"value":"23 August 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"17 November 2025","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"2 February 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no Conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"This article did not involve human participants or animals.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Compliance with ethical standards"}}],"article-number":"64"}}