{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T18:32:49Z","timestamp":1775068369546,"version":"3.50.1"},"reference-count":35,"publisher":"Springer Science and Business Media LLC","issue":"11","license":[{"start":{"date-parts":[[2019,8,7]],"date-time":"2019-08-07T00:00:00Z","timestamp":1565136000000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2019,8,7]],"date-time":"2019-08-07T00:00:00Z","timestamp":1565136000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"funder":[{"DOI":"10.13039\/501100010801","name":"Xunta de Galicia","doi-asserted-by":"publisher","award":["ED431G\/01"],"award-info":[{"award-number":["ED431G\/01"]}],"id":[{"id":"10.13039\/501100010801","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100007434","name":"Ag\u00eancia Nacional de Inova\u00e7\u00e3o","doi-asserted-by":"publisher","award":["ANI|P2020 17775"],"award-info":[{"award-number":["ANI|P2020 17775"]}],"id":[{"id":"10.13039\/501100007434","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001871","name":"Funda\u00e7\u00e3o para a Ci\u00eancia e a Tecnologia","doi-asserted-by":"publisher","award":["UID\/EEA\/00760\/2019"],"award-info":[{"award-number":["UID\/EEA\/00760\/2019"]}],"id":[{"id":"10.13039\/501100001871","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Ambient Intell Human Comput"],"published-print":{"date-parts":[[2020,11]]},"DOI":"10.1007\/s12652-019-01417-9","type":"journal-article","created":{"date-parts":[[2019,8,7]],"date-time":"2019-08-07T13:02:56Z","timestamp":1565182976000},"page":"4477-4489","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":49,"title":["Performance evaluation of unsupervised techniques in cyber-attack anomaly detection"],"prefix":"10.1007","volume":"11","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1502-780X","authenticated-orcid":false,"given":"Jorge","family":"Meira","sequence":"first","affiliation":[]},{"given":"Rui","family":"Andrade","sequence":"additional","affiliation":[]},{"given":"Isabel","family":"Pra\u00e7a","sequence":"additional","affiliation":[]},{"given":"Jo\u00e3o","family":"Carneiro","sequence":"additional","affiliation":[]},{"given":"Ver\u00f3nica","family":"Bol\u00f3n-Canedo","sequence":"additional","affiliation":[]},{"given":"Amparo","family":"Alonso-Betanzos","sequence":"additional","affiliation":[]},{"given":"Goreti","family":"Marreiros","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2019,8,7]]},"reference":[{"key":"1417_CR1","doi-asserted-by":"publisher","unstructured":"Aleroud A, Karabatis G (2013) Toward zero-day attack identification using linear data transformation techniques. In: Proceedings of 7th international conference on software security and reliability, SERE 2013, pp 159\u201368. https:\/\/doi.org\/10.1109\/SERE.2013.16","DOI":"10.1109\/SERE.2013.16"},{"key":"1417_CR2","unstructured":"Bishop CM (1995) Neural networks for pattern recognition. Oxford University Press, Oxford. http:\/\/citeseerx.ist.psu.edu\/viewdoc\/download?doi=10.1.1.679.1104&rep=rep1&type=pdf"},{"key":"1417_CR3","doi-asserted-by":"publisher","unstructured":"Casale P, Pujol O, Radeva P (2011) Approximate convex hulls family for one-class classification. In: International workshop on multiple classifier systems, pp 106\u2013115.\u00a0https:\/\/doi.org\/10.1007\/978-3-642-21557-5_13","DOI":"10.1007\/978-3-642-21557-5_13"},{"issue":"7","key":"1417_CR4","doi-asserted-by":"publisher","first-page":"772","DOI":"10.1016\/j.comcom.2012.01.016","volume":"35","author":"P Casas","year":"2012","unstructured":"Casas P, Mazel J, Owezarski P (2012) Unsupervised network intrusion detection systems: detecting the unknown without knowledge. Comput Commun 35(7):772\u2013783. https:\/\/doi.org\/10.1016\/j.comcom.2012.01.016","journal-title":"Comput Commun"},{"issue":"07","key":"1417_CR5","doi-asserted-by":"publisher","first-page":"1550029","DOI":"10.1142\/S012906571550029X","volume":"25","author":"E Castillo","year":"2015","unstructured":"Castillo E, Peteiro-Barral D, Berdi\u00f1as BG, Fontenla-Romero O (2015) Distributed one-class support vector machine. Int J Neural Syst 25(07):1550029. https:\/\/doi.org\/10.1142\/S012906571550029X","journal-title":"Int J Neural Syst"},{"key":"1417_CR6","doi-asserted-by":"publisher","unstructured":"Chen J, Sathe S, Aggarwal C, Turaga D (2017) Outlier detection with autoencoder ensembles. In: Proceedings of the 2017 SIAM international conference on data mining, pp 90\u201398. https:\/\/doi.org\/10.1137\/1.9781611974973.11","DOI":"10.1137\/1.9781611974973.11"},{"key":"1417_CR7","first-page":"1","volume":"7","author":"J Dem\u0161ar","year":"2006","unstructured":"Dem\u0161ar J (2006) Statistical comparisons of classifiers over multiple data sets. J Mach Learn Res 7:1\u201330","journal-title":"J Mach Learn Res"},{"issue":"3\u20134","key":"1417_CR8","doi-asserted-by":"publisher","first-page":"197","DOI":"10.1561\/2000000039","volume":"7","author":"L Deng","year":"2014","unstructured":"Deng L, Yu D et al (2014) Deep learning: methods and applications. Found Trends Signal Process 7(3\u20134):197\u2013387. https:\/\/doi.org\/10.1561\/2000000039","journal-title":"Found Trends Signal Process"},{"key":"1417_CR9","doi-asserted-by":"publisher","DOI":"10.17148\/IJARCCE.2015.4696","author":"L Dhanabal","year":"2015","unstructured":"Dhanabal L, Shantharajah SP (2015) A study on NSL-KDD dataset for intrusion detection system based on classification algorithms. Int J Adv Res Comput Commun Eng. https:\/\/doi.org\/10.17148\/IJARCCE.2015.4696","journal-title":"Int J Adv Res Comput Commun Eng"},{"key":"1417_CR10","first-page":"226","volume":"96","author":"M Ester","year":"1996","unstructured":"Ester M, Kriegel H-P, Sander J, Xiaowei X et al (1996) A density-based algorithm for discovering clusters in large spatial databases with noise. Kdd 96:226\u2013231","journal-title":"Kdd"},{"key":"1417_CR11","doi-asserted-by":"publisher","unstructured":"Fern\u00e1ndez-Francos D, Fontenla-Romero \u00d3, Alonso-Betanzos A (2017) One-class convex hull-based algorithm for classification in distributed environments. In: IEEE transactions on systems, man, and cybernetics: systems.\u00a0https:\/\/doi.org\/10.1109\/TSMC.2017.2771341","DOI":"10.1109\/TSMC.2017.2771341"},{"issue":"6","key":"1417_CR12","doi-asserted-by":"publisher","first-page":"835","DOI":"10.1109\/TPAMI.2005.113","volume":"27","author":"ALN Fred","year":"2005","unstructured":"Fred ALN, Jain AK (2005) Combining multiple clusterings using evidence accumulation. IEEE Trans Pattern Anal Mach Intell 27(6):835\u2013850","journal-title":"IEEE Trans Pattern Anal Mach Intell"},{"key":"1417_CR13","unstructured":"Gama J, de Leon Carvalho AP, Faceli K, Lorena AC, Oliveira M (2015) Extra\u00e7\u00e3o de Conhecimento de Dados.\u00a0http:\/\/www.silabo.pt\/Conteudos\/8117_PDF.pdf"},{"key":"1417_CR14","first-page":"1025","volume":"7","author":"AB Gardner","year":"2006","unstructured":"Gardner AB, Krieger AM, Vachtsevanos G, Litt B (2006) One-class novelty detection for seizure analysis from intracranial EEG. J Mach Learn Res 7:1025\u20131044","journal-title":"J Mach Learn Res"},{"issue":"1","key":"1417_CR15","doi-asserted-by":"publisher","first-page":"69","DOI":"10.1016\/j.inffus.2006.10.002","volume":"9","author":"G Giacinto","year":"2008","unstructured":"Giacinto G, Perdisci R,  Del Rio M,  Roli F (2008) Intrusion detection in computer networks by a modular ensemble of one-class classifiers. Inf Fusion 9(1):69\u201382. https:\/\/doi.org\/10.1016\/j.inffus.2006.10.002","journal-title":"Inf Fusion"},{"key":"1417_CR16","doi-asserted-by":"publisher","DOI":"10.7910\/DVN\/OPQMVF","author":"M Goldstein","year":"2016","unstructured":"Goldstein M, Uchida S (2016) A comparative evaluation of unsupervised anomaly detection algorithms for multivariate data. PLoS One. https:\/\/doi.org\/10.7910\/DVN\/OPQMVF","journal-title":"PLoS One"},{"issue":"4","key":"1417_CR17","doi-asserted-by":"publisher","first-page":"18","DOI":"10.1109\/5254.708428","volume":"13","author":"MA Hearst","year":"1998","unstructured":"Hearst MA, Dumais ST, Osuna E, Platt J, Scholkopf B (1998) Support vector machines. IEEE Intell Syst Appl 13(4):18\u201328. https:\/\/doi.org\/10.1109\/5254.708428","journal-title":"IEEE Intell Syst Appl"},{"key":"1417_CR18","volume-title":"Concept-learning in the absence of counter-examples: an autoassociation-based approach to classification","author":"N Japkowicz","year":"1999","unstructured":"Japkowicz N (1999) Concept-learning in the absence of counter-examples: an autoassociation-based approach to classification. Rutgers University, New Brunswick.\u00a0https:\/\/pdfs.semanticscholar.org\/03ed\/0a73d1f7a7b16505d6cb9c8bfbeeef7b19bb.pdf"},{"issue":"3","key":"1417_CR20","doi-asserted-by":"publisher","first-page":"345","DOI":"10.1017\/S026988891300043X","volume":"29","author":"SS Khan","year":"2014","unstructured":"Khan SS, Madden MG (2014) One-class classification: taxonomy of study and review of techniques. Knowl Eng Rev 29(3):345\u2013374","journal-title":"Knowl Eng Rev"},{"key":"1417_CR21","unstructured":"Liu H, Hussain F, Tan CL, Dash M (2002) Discretization: an enabling technique, pp 393\u2013423. https:\/\/pdfs.semanticscholar.org\/2d18\/73800b294a104a836168ac5bba11edeadc7f.pdf"},{"issue":"7","key":"1417_CR19","doi-asserted-by":"publisher","first-page":"1215","DOI":"10.1109\/TNN.2009.2022399","volume":"20","author":"Z Liu","year":"2009","unstructured":"Liu Z, Liu JG, Pan C, Wang G (2009) A novel geometric approach to binary classification base. IEEE Trans Neural Networks\u00a020(7):1215\u20131220.\u00a0https:\/\/doi.org\/10.1109\/TNN.2009.2022399","journal-title":"IEEE Trans Neural Networks"},{"issue":"1","key":"1417_CR22","doi-asserted-by":"publisher","first-page":"3:1","DOI":"10.1145\/2133360.2133363","volume":"6","author":"FT Liu","year":"2012","unstructured":"Liu FT, Ting KM, Zhou Z-H (2012) Isolation-based anomaly detection. ACM Trans Knowl Discov Data 6(1):3:1\u20133:39. https:\/\/doi.org\/10.1145\/2133360.2133363","journal-title":"ACM Trans Knowl Discov Data"},{"key":"1417_CR23","first-page":"139","volume":"2","author":"LM Manevitz","year":"2001","unstructured":"Manevitz LM, Yousef M (2001) One-class SVMs for document classification. J Mach Learn Res 2:139\u2013154","journal-title":"J Mach Learn Res"},{"key":"1417_CR24","unstructured":"Mazhelis O (2016) One-class classifiers: a review and analysis of suitability in the context of mobile-masquerader detection Oleksiy Mazhelis to cite this version: HAL Id: Hal-01262354 One-Class Classifiers: a review and analysis of suitability in the context of mobile.\u00a0https:\/\/hal.inria.fr\/hal-01262354\/document"},{"key":"1417_CR25","doi-asserted-by":"publisher","unstructured":"Niyaz Q, Sun W, Javaid AY, Alam M (2015) A deep learning approach for network intrusion detection system. In: Proceedings of the 9th EAI international conference on bio-inspired information and communications technologies. https:\/\/doi.org\/10.4108\/eai.3-12-2015.2262516","DOI":"10.4108\/eai.3-12-2015.2262516"},{"issue":"1","key":"1417_CR26","doi-asserted-by":"publisher","first-page":"109","DOI":"10.1007\/s10618-011-0234-x","volume":"25","author":"K Noto","year":"2012","unstructured":"Noto K, Brodley C, Slonim D (2012) FRaC: a feature-modeling approach for semi-supervised and unsupervised anomaly detection. Data Min Knowl Discov 25(1):109\u2013133. https:\/\/doi.org\/10.1007\/s10618-011-0234-x","journal-title":"Data Min Knowl Discov"},{"issue":"1","key":"1417_CR27","doi-asserted-by":"publisher","first-page":"90","DOI":"10.1145\/1007730.1007731","volume":"6","author":"L Parsons","year":"2004","unstructured":"Parsons L, Haque E, Liu H (2004) Subspace clustering for high dimensional data: a review. ACM SIGKDD Explor Newsl 6(1):90\u2013105. https:\/\/doi.org\/10.1145\/1007730.1007731","journal-title":"ACM SIGKDD Explor Newsl"},{"key":"1417_CR28","first-page":"582","volume":"12","author":"B Sch\u00f6lkopf","year":"2000","unstructured":"Sch\u00f6lkopf B, Williamson R, Smola A, Shawe-Taylor J, Platt J (2000) Support vector method for novelty detection. Adv Neural Inf Process Syst 12:582\u2013588","journal-title":"Adv Neural Inf Process Syst"},{"issue":"2","key":"1417_CR29","doi-asserted-by":"publisher","first-page":"395","DOI":"10.1016\/j.cie.2005.01.009","volume":"48","author":"HJ Shin","year":"2005","unstructured":"Shin HJ, Eom D-H, Kim S-S (2005) One-class support vector machines\u2014an application in machine fault detection and classification. Comput Ind Eng 48(2):395\u2013408. https:\/\/doi.org\/10.1016\/j.cie.2005.01.009","journal-title":"Comput Ind Eng"},{"issue":"3","key":"1417_CR30","doi-asserted-by":"publisher","first-page":"357","DOI":"10.1016\/j.cose.2011.12.012","volume":"31","author":"A Shiravi","year":"2012","unstructured":"Shiravi A, Shiravi H, Tavallaee M, Ghorbani AA (2012) Toward developing a systematic approach to generate benchmark datasets for intrusion detection. Comput Secur 31(3):357\u2013374. https:\/\/doi.org\/10.1016\/j.cose.2011.12.012","journal-title":"Comput Secur"},{"key":"1417_CR31","doi-asserted-by":"publisher","unstructured":"Stadler T (2011) R Topics Documented. Package \u201a\u00c4\u00f2TreePar\u201a \u00c4\u00f4, 2. https:\/\/doi.org\/10.2307\/2533043","DOI":"10.2307\/2533043"},{"key":"1417_CR32","doi-asserted-by":"publisher","unstructured":"Tavallaee M, Bagheri E, Lu W, Ghorbani AA (2009) A detailed analysis of the KDD CUP 99 data set. In: IEEE symposium on computational intelligence for security and defense applications, CISDA 2009, pp 1\u20136. https:\/\/doi.org\/10.1109\/CISDA.2009.5356528","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"1417_CR33","unstructured":"Tax DMJ (2001) One-class classification: concept learning in the absence of counter-examples. http:\/\/homepage.tudelft.nl\/n9d04\/thesis.pdf"},{"issue":"2","key":"1417_CR34","first-page":"26","volume":"4","author":"T Tieleman","year":"2012","unstructured":"Tieleman T, Hinton G (2012) Lecture 6.5-Rmsprop: divide the gradient by a running average of its recent magnitude. COURSERA Neural Netw Mach Learn 4(2):26\u201331","journal-title":"COURSERA Neural Netw Mach Learn"},{"issue":"10","key":"1417_CR35","doi-asserted-by":"publisher","first-page":"11994","DOI":"10.1016\/j.eswa.2009.05.029","volume":"36","author":"CF Tsai","year":"2009","unstructured":"Tsai CF, Hsu YF, Lin CY, Lin WY (2009) Intrusion Detection by machine learning: a review. Expert Syst Appl 36(10):11994. https:\/\/doi.org\/10.1016\/j.eswa.2009.05.029","journal-title":"Expert Syst Appl"}],"container-title":["Journal of Ambient Intelligence and Humanized Computing"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s12652-019-01417-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s12652-019-01417-9\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s12652-019-01417-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,11,12]],"date-time":"2020-11-12T16:01:14Z","timestamp":1605196874000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s12652-019-01417-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,8,7]]},"references-count":35,"journal-issue":{"issue":"11","published-print":{"date-parts":[[2020,11]]}},"alternative-id":["1417"],"URL":"https:\/\/doi.org\/10.1007\/s12652-019-01417-9","relation":{},"ISSN":["1868-5137","1868-5145"],"issn-type":[{"value":"1868-5137","type":"print"},{"value":"1868-5145","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,8,7]]},"assertion":[{"value":"28 November 2018","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"1 August 2019","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"7 August 2019","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}