{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,26]],"date-time":"2026-03-26T09:06:17Z","timestamp":1774515977144,"version":"3.50.1"},"reference-count":58,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T00:00:00Z","timestamp":1754006400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T00:00:00Z","timestamp":1754006400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T00:00:00Z","timestamp":1754006400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T00:00:00Z","timestamp":1754006400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T00:00:00Z","timestamp":1754006400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T00:00:00Z","timestamp":1754006400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,8,1]],"date-time":"2025-08-01T00:00:00Z","timestamp":1754006400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computer Networks"],"published-print":{"date-parts":[[2025,8]]},"DOI":"10.1016\/j.comnet.2025.111372","type":"journal-article","created":{"date-parts":[[2025,5,26]],"date-time":"2025-05-26T16:07:31Z","timestamp":1748275651000},"page":"111372","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":15,"special_numbering":"C","title":["A new hybrid approach combining GCN and LSTM for real-time anomaly detection from dynamic computer network data"],"prefix":"10.1016","volume":"268","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-6313-2278","authenticated-orcid":false,"given":"Muhammed Onur","family":"Kaya","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2901-2342","authenticated-orcid":false,"given":"Mehmet","family":"Ozdem","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6113-4649","authenticated-orcid":false,"given":"Resul","family":"Das","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.comnet.2025.111372_b1","doi-asserted-by":"crossref","first-page":"65","DOI":"10.13052\/jcsm2245-1439.414","article-title":"Cyber security and the internet of things: vulnerabilities, threats, intruders and attacks","author":"Abomhara","year":"2015","journal-title":"J. Cyber Secur. Mobil."},{"issue":"5","key":"10.1016\/j.comnet.2025.111372_b2","doi-asserted-by":"crossref","first-page":"973","DOI":"10.1016\/j.jcss.2014.02.005","article-title":"A survey of emerging threats in cybersecurity","volume":"80","author":"Jang-Jaccard","year":"2014","journal-title":"J. Comput. System Sci."},{"key":"10.1016\/j.comnet.2025.111372_b3","series-title":"A heterogeneous graph learning model for cyber-attack detection","author":"Lv","year":"2021"},{"key":"10.1016\/j.comnet.2025.111372_b4","doi-asserted-by":"crossref","first-page":"89051","DOI":"10.1109\/ACCESS.2019.2921571","article-title":"Multi-layer network local community detection based on influence relation","volume":"7","author":"Li","year":"2019","journal-title":"IEEE Access"},{"issue":"1","key":"10.1016\/j.comnet.2025.111372_b5","doi-asserted-by":"crossref","DOI":"10.1155\/2018\/5349894","article-title":"Network protocols, schemes, and mechanisms for internet of things (iot): Features, open challenges, and trends","volume":"2018","author":"Triantafyllou","year":"2018","journal-title":"Wirel. Commun. Mob. Comput."},{"key":"10.1016\/j.comnet.2025.111372_b6","series-title":"Automated monitoring and security services in federated software-defined network infrastructures","author":"Pavlidis","year":"2020"},{"key":"10.1016\/j.comnet.2025.111372_b7","article-title":"Analysis and visualization of large complex attack graphs for networks security","author":"Chen","year":"2007","journal-title":"Proc SPIE"},{"key":"10.1016\/j.comnet.2025.111372_b8","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.103821","article-title":"A survey on graph neural networks for intrusion detection systems: Methods, trends and challenges","author":"Zhong","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.comnet.2025.111372_b9","unstructured":"H. Alturkistani, S. Chuprat, Artificial Intelligence and Large Language Models in Advancing Cyber Threat Intelligence: A Systematic Literature Review, Available At SSRN 4903071."},{"key":"10.1016\/j.comnet.2025.111372_b10","series-title":"Looking beyond iocs: automatically extracting attack patterns from external cti","author":"Alam","year":"2023"},{"issue":"2","key":"10.1016\/j.comnet.2025.111372_b11","doi-asserted-by":"crossref","first-page":"1851","DOI":"10.1109\/COMST.2019.2891891","article-title":"A survey on advanced persistent threats: Techniques, solutions, challenges, and research opportunities","volume":"21","author":"Alshamrani","year":"2019","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"10.1016\/j.comnet.2025.111372_b12","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2021.108086","article-title":"Cyber threat prediction using dynamic heterogeneous graph learning","volume":"240","author":"Zhao","year":"2022","journal-title":"Knowl.-Based Syst."},{"key":"10.1016\/j.comnet.2025.111372_b13","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2022.102847","article-title":"A survey on adversarial attacks in computer vision: Taxonomy, visualization and future directions","volume":"121","author":"Long","year":"2022","journal-title":"Comput. Secur."},{"issue":"1","key":"10.1016\/j.comnet.2025.111372_b14","doi-asserted-by":"crossref","first-page":"740","DOI":"10.1109\/TDSC.2022.3143551","article-title":"DeepAG: Attack graph construction and threats prediction with bi-directional deep learning","volume":"20","author":"Li","year":"2023","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"10.1016\/j.comnet.2025.111372_b15","doi-asserted-by":"crossref","DOI":"10.1109\/TC.2025.3541143","article-title":"A low-rate DoS attack mitigation scheme based on port and traffic state in SDN","author":"Tang","year":"2025","journal-title":"IEEE Trans. Comput."},{"issue":"1","key":"10.1016\/j.comnet.2025.111372_b16","doi-asserted-by":"crossref","first-page":"640","DOI":"10.1109\/COMST.2018.2871866","article-title":"Survey of attack projection, prediction, and forecasting in cyber security","volume":"21","author":"Husak","year":"2019","journal-title":"IEEE Commun. Surv. Tutor."},{"issue":"5","key":"10.1016\/j.comnet.2025.111372_b17","doi-asserted-by":"crossref","first-page":"3309","DOI":"10.3906\/elk-1812-86","article-title":"SoftSwitch: a centralized honeypot-based security approach usingsoftware-defined switching for secure management of vlan networks","volume":"27","author":"Baykara","year":"2019","journal-title":"Turk. J. Electr. Eng. Comput. Sci."},{"key":"10.1016\/j.comnet.2025.111372_b18","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2021.102380","article-title":"A review of amplification-based distributed denial of service attacks and their mitigation","volume":"109","author":"Ismail","year":"2021","journal-title":"Comput. Secur."},{"key":"10.1016\/j.comnet.2025.111372_b19","first-page":"1","article-title":"An efficient ddos attack detection using chaos henry gas solubility optimization weight initialization based rectified linear unit","author":"Lakshmanan","year":"2023","journal-title":"Cybern. Syst."},{"key":"10.1016\/j.comnet.2025.111372_b20","doi-asserted-by":"crossref","DOI":"10.1109\/MNET.2024.3413543","article-title":"Intelligent sensing, communication, computation and caching for satellite-ground integrated networks","author":"Gong","year":"2024","journal-title":"IEEE Netw."},{"key":"10.1016\/j.comnet.2025.111372_b21","article-title":"A comprehensive review of AI based intrusion detection system","volume":"28","author":"Sowmya","year":"2023","journal-title":"Meas.: Sensors"},{"key":"10.1016\/j.comnet.2025.111372_b22","doi-asserted-by":"crossref","first-page":"51691","DOI":"10.1109\/ACCESS.2019.2908998","article-title":"Comprehensive review of artificial intelligence and statistical approaches in distributed denial of service attack and defense methods","volume":"7","author":"Khalaf","year":"2019","journal-title":"IEEE Access"},{"issue":"6","key":"10.1016\/j.comnet.2025.111372_b23","doi-asserted-by":"crossref","first-page":"2043","DOI":"10.1002\/rnc.7777","article-title":"Resilient formation tracking for networked swarm systems under malicious data deception attacks","volume":"35","author":"Liu","year":"2025","journal-title":"Internat. J. Robust Nonlinear Control"},{"key":"10.1016\/j.comnet.2025.111372_b24","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s42400-021-00077-7","article-title":"A critical review of intrusion detection systems in the internet of things: techniques, deployment strategy, validation strategy, attacks, public datasets and challenges","volume":"4","author":"Khraisat","year":"2021","journal-title":"Cybersecurity"},{"key":"10.1016\/j.comnet.2025.111372_b25","series-title":"2020 International Conference on Cyber Situational Awareness, Data Analytics and Assessment (CyberSA)","first-page":"1","article-title":"Graphical analysis of captured network packets for detection of suspicious network nodes","author":"Aryeh","year":"2020"},{"key":"10.1016\/j.comnet.2025.111372_b26","doi-asserted-by":"crossref","first-page":"447","DOI":"10.1007\/s11235-018-0475-8","article-title":"A comprehensive survey on network anomaly detection","volume":"70","author":"Fernandes","year":"2019","journal-title":"Telecommun. Syst."},{"key":"10.1016\/j.comnet.2025.111372_b27","series-title":"Principles and Applications of Adaptive Artificial Intelligence","first-page":"52","article-title":"Adaptive AI for dynamic cybersecurity systems: Enhancing protection in a rapidly evolving digital landscap","author":"Babu","year":"2024"},{"issue":"1","key":"10.1016\/j.comnet.2025.111372_b28","article-title":"[Retracted] analysis of intrusion detection approaches for network traffic anomalies with comparative analysis on botnets (2008\u20132020)","volume":"2022","author":"Ahmad","year":"2022","journal-title":"Secur. Commun. Netw."},{"issue":"104896","key":"10.1016\/j.comnet.2025.111372_b29","article-title":"A key review on graph data science: The power of graphs in scientific studies","volume":"240","author":"Das","year":"2023","journal-title":"Chemometr. Intell. Lab. Syst."},{"issue":"6","key":"10.1016\/j.comnet.2025.111372_b30","doi-asserted-by":"crossref","first-page":"1417","DOI":"10.1080\/01969722.2023.2240651","article-title":"Multi-instance attention network for anomaly detection from multivariate time series","volume":"55","author":"Jang","year":"2024","journal-title":"Cybern. Syst."},{"issue":"1","key":"10.1016\/j.comnet.2025.111372_b31","doi-asserted-by":"crossref","first-page":"1609","DOI":"10.1080\/09540091.2022.2078281","article-title":"A novel anomaly detection method for multimodal WSN data flow via a dynamic graph neural network","volume":"34","author":"Zhang","year":"2022","journal-title":"Connect. Sci."},{"issue":"5","key":"10.1016\/j.comnet.2025.111372_b32","doi-asserted-by":"crossref","DOI":"10.1177\/1550147720921309","article-title":"Multivariate statistical network monitoring\u2013sensor: an effective tool for real-time monitoring and anomaly detection in complex networks and systems","volume":"16","author":"Mag\u00e1n-Carri\u00f3n","year":"2020","journal-title":"Int. J. Distrib. Sens. Netw."},{"key":"10.1016\/j.comnet.2025.111372_b33","series-title":"2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)","first-page":"870","article-title":"A flexible attentive temporal graph networks for anomaly detection in dynamic networks","author":"Zhu","year":"2020"},{"key":"10.1016\/j.comnet.2025.111372_b34","series-title":"2017 IEEE Wireless Communications and Networking Conference","first-page":"1","article-title":"IEEE 802.11 network anomaly detection and attack classification: A deep learning approach","author":"Thing","year":"2017"},{"issue":"2","key":"10.1016\/j.comnet.2025.111372_b35","doi-asserted-by":"crossref","first-page":"577","DOI":"10.1109\/TNSE.2021.3127557","article-title":"GraphAttacker: A general multi-task graph attack framework","volume":"9","author":"Chen","year":"2022","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"10.1016\/j.comnet.2025.111372_b36","doi-asserted-by":"crossref","unstructured":"W. Yu, W. Cheng, C.C. Aggarwal, K. Zhang, H. Chen, W. Wang, Netwalk: A flexible deep embedding approach for anomaly detection in dynamic networks, in: Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2018, pp. 2672\u20132681.","DOI":"10.1145\/3219819.3220024"},{"key":"10.1016\/j.comnet.2025.111372_b37","first-page":"289","article-title":"Real-time big data processing for anomaly detection: A survey","volume":"45","author":"Habeeb","year":"2019","journal-title":"Int. J. Inf. Manage."},{"key":"10.1016\/j.comnet.2025.111372_b38","first-page":"975","article-title":"Malicious traffic analysis using wireshark by collection of indicators of compromise","volume":"183","author":"Dodiya","year":"2022","journal-title":"Int. J. Comput. Appl."},{"issue":"3","key":"10.1016\/j.comnet.2025.111372_b39","doi-asserted-by":"crossref","first-page":"2587","DOI":"10.1109\/TNSM.2021.3069000","article-title":"Highly-efficient and adaptive network monitoring: When int meets segment routing","volume":"18","author":"Zheng","year":"2021","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"10.1016\/j.comnet.2025.111372_b40","doi-asserted-by":"crossref","DOI":"10.1016\/j.ijcip.2023.100612","article-title":"Protocol study and anomaly detection for server-driven traffic in scada networks","volume":"42","author":"Lin","year":"2023","journal-title":"Int. J. Crit. Infrastruct. Prot."},{"issue":"2","key":"10.1016\/j.comnet.2025.111372_b41","article-title":"A novel approach for graph-based real-time anomaly detection from dynamic network data listened by wireshark","volume":"12","author":"Kaya","year":"2025","journal-title":"EAI Endorsed Trans. Ind. Netw. Intell. Syst."},{"key":"10.1016\/j.comnet.2025.111372_b42","doi-asserted-by":"crossref","DOI":"10.1109\/TNSE.2024.3371384","article-title":"Delay-aware routing in software-defined networks via network tomography and reinforcement learning","author":"Tao","year":"2024","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"10.1016\/j.comnet.2025.111372_b43","article-title":"Tradeoff of code estimation error rate and terminal gain in scer attack","author":"Li","year":"2024","journal-title":"IEEE Trans. Instrum. Meas."},{"key":"10.1016\/j.comnet.2025.111372_b44","series-title":"Understanding Audiences, Customers, and Users Via Analytics: An Introduction To the Employment of Web, Social, and Other Types of Digital People Data","first-page":"65","article-title":"Data preprocessing","author":"Jansen","year":"2023"},{"key":"10.1016\/j.comnet.2025.111372_b45","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2020.102084","article-title":"A tfidfvectorizer and singular value decomposition based host intrusion detection system framework for detecting anomalous system processes","volume":"100","author":"Subba","year":"2021","journal-title":"Comput. Secur."},{"issue":"4","key":"10.1016\/j.comnet.2025.111372_b46","doi-asserted-by":"crossref","DOI":"10.1016\/j.ipm.2025.104107","article-title":"Effectively detecting and diagnosing distributed multivariate time series anomalies via unsupervised federated hypernetwork","volume":"62","author":"Hao","year":"2025","journal-title":"Inf. Process. Manage."},{"key":"10.1016\/j.comnet.2025.111372_b47","doi-asserted-by":"crossref","first-page":"158261","DOI":"10.1109\/ACCESS.2021.3128181","article-title":"A network traffic classification method based on graph convolution and lstm","volume":"9","author":"Pan","year":"2021","journal-title":"IEEE Access"},{"key":"10.1016\/j.comnet.2025.111372_b48","doi-asserted-by":"crossref","DOI":"10.1109\/TCYB.2024.3412149","article-title":"Flow2gnn: Flexible two-way flow message passing for enhancing gnns beyond homophily","author":"Huang","year":"2024","journal-title":"IEEE Trans. Cybern."},{"key":"10.1016\/j.comnet.2025.111372_b49","article-title":"GrabPhisher: Phishing scams detection in ethereum via temporally evolving GNNs","author":"Zhang","year":"2024","journal-title":"IEEE Trans. Serv. Comput."},{"key":"10.1016\/j.comnet.2025.111372_b50","article-title":"Hifusion: An unsupervised infrared and visible image fusion framework with a hierarchical loss function","author":"Xu","year":"2025","journal-title":"IEEE Trans. Instrum. Meas."},{"key":"10.1016\/j.comnet.2025.111372_b51","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2025.104165","article-title":"CBRFL: A framework for committee-based Byzantine-resilient federated learning","author":"Xu","year":"2025","journal-title":"J. Netw. Comput. Appl."},{"key":"10.1016\/j.comnet.2025.111372_b52","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.104155","article-title":"Hidim: A novel framework of network intrusion detection for hierarchical dependency and class imbalance","volume":"148","author":"Zhou","year":"2025","journal-title":"Comput. Secur."},{"key":"10.1016\/j.comnet.2025.111372_b53","doi-asserted-by":"crossref","DOI":"10.1016\/j.inffus.2023.101944","article-title":"MFIR: Multimodal fusion and inconsistency reasoning for explainable fake news detection","volume":"100","author":"Wu","year":"2023","journal-title":"Inf. Fusion"},{"issue":"6","key":"10.1016\/j.comnet.2025.111372_b54","doi-asserted-by":"crossref","first-page":"6606","DOI":"10.1109\/TMC.2023.3323280","article-title":"Real-time contactless eye blink detection using UWB radar","volume":"23","author":"Hu","year":"2023","journal-title":"IEEE Trans. Mob. Comput."},{"key":"10.1016\/j.comnet.2025.111372_b55","doi-asserted-by":"crossref","first-page":"30387","DOI":"10.1109\/ACCESS.2020.2973023","article-title":"An unsupervised deep learning model for early network traffic anomaly detection","volume":"8","author":"Hwang","year":"2020","journal-title":"IEEE Access"},{"key":"10.1016\/j.comnet.2025.111372_b56","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2019.107049","article-title":"HELAD: A novel network anomaly detection model based on heterogeneous ensemble learning","volume":"169","author":"Zhong","year":"2020","journal-title":"Comput. Netw."},{"key":"10.1016\/j.comnet.2025.111372_b57","series-title":"Cloud Computing\u2013CLOUD 2019: 12th International Conference, Held As Part of the Services Conference Federation, SCF 2019, San Diego, CA, USA, June 25\u201330, 2019, Proceedings 12","first-page":"161","article-title":"Dynamic network anomaly detection system by using deep learning techniques","author":"Lin","year":"2019"},{"key":"10.1016\/j.comnet.2025.111372_b58","doi-asserted-by":"crossref","first-page":"390","DOI":"10.1016\/j.eswa.2017.09.013","article-title":"Network anomaly detection system using genetic algorithm and fuzzy logic","volume":"92","author":"Hamamoto","year":"2018","journal-title":"Expert Syst. Appl."}],"container-title":["Computer Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128625003391?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128625003391?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2025,6,6]],"date-time":"2025-06-06T17:39:22Z","timestamp":1749231562000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S1389128625003391"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,8]]},"references-count":58,"alternative-id":["S1389128625003391"],"URL":"https:\/\/doi.org\/10.1016\/j.comnet.2025.111372","relation":{},"ISSN":["1389-1286"],"issn-type":[{"value":"1389-1286","type":"print"}],"subject":[],"published":{"date-parts":[[2025,8]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"A new hybrid approach combining GCN and LSTM for real-time anomaly detection from dynamic computer network data","name":"articletitle","label":"Article Title"},{"value":"Computer Networks","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.comnet.2025.111372","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2025 Published by Elsevier B.V.","name":"copyright","label":"Copyright"}],"article-number":"111372"}}