{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,6]],"date-time":"2026-03-06T03:19:32Z","timestamp":1772767172263,"version":"3.50.1"},"reference-count":65,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2022,9,1]],"date-time":"2022-09-01T00:00:00Z","timestamp":1661990400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2022,9,1]],"date-time":"2022-09-01T00:00:00Z","timestamp":1661990400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2022,9,1]],"date-time":"2022-09-01T00:00:00Z","timestamp":1661990400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2022,9,1]],"date-time":"2022-09-01T00:00:00Z","timestamp":1661990400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2022,9,1]],"date-time":"2022-09-01T00:00:00Z","timestamp":1661990400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2022,9,1]],"date-time":"2022-09-01T00:00:00Z","timestamp":1661990400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2022,9,1]],"date-time":"2022-09-01T00:00:00Z","timestamp":1661990400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Expert Systems with Applications"],"published-print":{"date-parts":[[2022,9]]},"DOI":"10.1016\/j.eswa.2022.117144","type":"journal-article","created":{"date-parts":[[2022,4,6]],"date-time":"2022-04-06T02:24:32Z","timestamp":1649211872000},"page":"117144","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":53,"special_numbering":"C","title":["ROULETTE: A neural attention multi-output model for explainable Network Intrusion Detection"],"prefix":"10.1016","volume":"201","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5272-644X","authenticated-orcid":false,"given":"Giuseppina","family":"Andresini","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9840-844X","authenticated-orcid":false,"given":"Annalisa","family":"Appice","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9434-3562","authenticated-orcid":false,"given":"Francesco Paolo","family":"Caforio","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8432-4608","authenticated-orcid":false,"given":"Donato","family":"Malerba","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0883-2691","authenticated-orcid":false,"given":"Gennaro","family":"Vessio","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.eswa.2022.117144_b1","series-title":"TensorFlow: Large-scale machine learning on heterogeneous systems","author":"Abadi","year":"2015"},{"issue":"3","key":"10.1016\/j.eswa.2022.117144_b2","doi-asserted-by":"crossref","first-page":"233","DOI":"10.1089\/big.2020.0263","article-title":"A convolutional neural network for improved anomaly-based network intrusion detection","volume":"9","author":"Al-Turaiki","year":"2021","journal-title":"Big Data"},{"key":"10.1016\/j.eswa.2022.117144_b3","series-title":"Proceedings of the british machine vision conference","first-page":"57.1","article-title":"Bayesian segnet: Model uncertainty in deep convolutional encoder-decoder architectures for scene understanding","author":"Alex\u00a0Kendall","year":"2017"},{"key":"10.1016\/j.eswa.2022.117144_b4","doi-asserted-by":"crossref","first-page":"108","DOI":"10.1016\/j.future.2021.04.017","article-title":"Gan augmentation to deal with imbalance in imaging-based intrusion detection","volume":"123","author":"Andresini","year":"2021","journal-title":"Future Generation Computer Systems"},{"key":"10.1016\/j.eswa.2022.117144_b5","doi-asserted-by":"crossref","first-page":"706","DOI":"10.1016\/j.ins.2021.05.016","article-title":"Autoencoder-based deep metric learning for network intrusion detection","volume":"569","author":"Andresini","year":"2021","journal-title":"Information Sciences"},{"key":"10.1016\/j.eswa.2022.117144_b6","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2021.106798","article-title":"Nearest cluster-based intrusion detection through convolutional neural networks","volume":"216","author":"Andresini","year":"2021","journal-title":"Knowledge-Based Systems"},{"key":"10.1016\/j.eswa.2022.117144_b7","doi-asserted-by":"crossref","first-page":"53346","DOI":"10.1109\/ACCESS.2020.2980937","article-title":"Multi-channel deep feature learning for intrusion detection","volume":"8","author":"Andresini","year":"2020","journal-title":"IEEE Access"},{"key":"10.1016\/j.eswa.2022.117144_b8","series-title":"Proceedings of the 14th ACM workshop on artificial intelligence and security","first-page":"111","article-title":"Insomnia: Towards concept-drift robustness in network intrusion detection","author":"Andresini","year":"2021"},{"key":"10.1016\/j.eswa.2022.117144_b9","doi-asserted-by":"crossref","DOI":"10.1016\/j.eswa.2021.115736","article-title":"Explaining anomalies detected by autoencoders using shapley additive explanations","volume":"186","author":"Antwarg","year":"2021","journal-title":"Expert Systems with Applications"},{"key":"10.1016\/j.eswa.2022.117144_b10","unstructured":"Bahdanau, D., Cho, K., & Bengio, Y. (2015). Neural machine translation by jointly learning to align and translate. In Y. Bengio and Y. LeCun (Ed.), 3rd international conference on learning representations, Conference Track Proceedings."},{"key":"10.1016\/j.eswa.2022.117144_b11","article-title":"I-SiamIDS: An improved siam-ids for handling class imbalance in network-based intrusion detection systems","author":"Bedi","year":"2020","journal-title":"Applied Intelligence: The International Journal of Artificial Intelligence, Neural Networks, and Complex Problem-Solving Technologies"},{"key":"10.1016\/j.eswa.2022.117144_b12","doi-asserted-by":"crossref","first-page":"780","DOI":"10.1016\/j.procs.2020.04.085","article-title":"Siam-IDS: Handling class imbalance problem in intrusion detection systems using siamese neural network","volume":"171","author":"Bedi","year":"2020","journal-title":"Procedia Computer Science"},{"key":"10.1016\/j.eswa.2022.117144_b13","unstructured":"Bergstra, J., Bardenet, R., Bengio, Y., & K\u00e9gl, B. (2011). Algorithms for hyper-parameter optimization. In Advances in Neural Information Processing Systems."},{"key":"10.1016\/j.eswa.2022.117144_b14","unstructured":"Bergstra, J., Yamins, D., & Cox, D. D. (2013). Making a science of model search: Hyperparameter optimization in hundreds of dimensions for vision architectures. In: in Proc. of the International Conference on Machine Learning."},{"issue":"4","key":"10.1016\/j.eswa.2022.117144_b15","doi-asserted-by":"crossref","first-page":"1","DOI":"10.3390\/info10040122","article-title":"A survey of deep learning methods for cyber security","volume":"10","author":"Berman","year":"2019","journal-title":"Information"},{"issue":"84","key":"10.1016\/j.eswa.2022.117144_b16","first-page":"1","article-title":"DALEX: Explainers for complex predictive models in R","volume":"19","author":"Biecek","year":"2018","journal-title":"Journal of Machine Learning Research"},{"key":"10.1016\/j.eswa.2022.117144_b17","series-title":"Machine learning for cyber physical systems","first-page":"83","article-title":"Explanation framework for intrusion detection","author":"Burkart","year":"2021"},{"key":"10.1016\/j.eswa.2022.117144_b18","first-page":"5","article-title":"Leveraging grad-cam to improve the accuracy of network intrusion detection systems","volume":"Vol. 38","author":"Caforio","year":"2021"},{"key":"10.1016\/j.eswa.2022.117144_b19","doi-asserted-by":"crossref","first-page":"96","DOI":"10.1016\/j.comnet.2019.05.013","article-title":"Adversarial environment reinforcement learning algorithm for intrusion detection","volume":"159","author":"Caminero","year":"2019","journal-title":"Computer Networks"},{"issue":"22","key":"10.1016\/j.eswa.2022.117144_b20","doi-asserted-by":"crossref","first-page":"29669","DOI":"10.1007\/s11042-017-5581-1","article-title":"Multi-task neural networks for joint hippocampus segmentation and clinical score regression","volume":"77","author":"Cao","year":"2018","journal-title":"Multimedia Tools and Applications"},{"key":"10.1016\/j.eswa.2022.117144_b21","doi-asserted-by":"crossref","first-page":"64534","DOI":"10.1109\/ACCESS.2020.2984768","article-title":"Crowd detection in aerial images using spatial graphs and fully-convolutional neural networks","volume":"8","author":"Castellano","year":"2020","journal-title":"IEEE Access"},{"key":"10.1016\/j.eswa.2022.117144_b22","first-page":"1890","article-title":"Modeling the spread of active worms","volume":"Vol. 3","author":"Chen","year":"2003"},{"key":"10.1016\/j.eswa.2022.117144_b23","series-title":"Procedia computer science","first-page":"1561","article-title":"Analysis of KDD-Cup\u201999, NSL-KDD and UNSW-NB15 datasets using deep learning in IoT","volume":"vol. 167","author":"Choudhary","year":"2020"},{"key":"10.1016\/j.eswa.2022.117144_b24","series-title":"An image is worth 16x16 words: Transformers for image recognition at scale","author":"Dosovitskiy","year":"2019"},{"key":"10.1016\/j.eswa.2022.117144_b25","doi-asserted-by":"crossref","first-page":"48","DOI":"10.1016\/j.inffus.2021.02.007","article-title":"On learning effective ensembles of deep neural networks for intrusion detection","volume":"72","author":"Folino","year":"2021","journal-title":"Information Fusion"},{"issue":"7","key":"10.1016\/j.eswa.2022.117144_b26","doi-asserted-by":"crossref","DOI":"10.3390\/en12071223","article-title":"Research on network intrusion detection based on incremental extreme learning machine and adaptive principal component analysis","volume":"12","author":"Gao","year":"2019","journal-title":"Energies"},{"issue":"5","key":"10.1016\/j.eswa.2022.117144_b27","doi-asserted-by":"crossref","first-page":"1452","DOI":"10.3390\/s20051452","article-title":"Malicious network traffic detection based on deep neural networks and association analysis","volume":"20","author":"Gao","year":"2020","journal-title":"Sensors"},{"key":"10.1016\/j.eswa.2022.117144_b28","first-page":"249","article-title":"Understanding the difficulty of training deep feedforward neural networks","volume":"9","author":"Glorot","year":"2010","journal-title":"Journal of Machine Learning Research - Proceedings Track"},{"key":"10.1016\/j.eswa.2022.117144_b29","series-title":"AISTATS","first-page":"315","article-title":"Deep sparse rectifier neural networks","author":"Glorot","year":"2011"},{"issue":"1","key":"10.1016\/j.eswa.2022.117144_b30","first-page":"345","article-title":"High efficient deep feature extraction and classification of spectral-spatial hyperspectral image using cross domain convolutional neural networks","volume":"12","author":"Guo","year":"2019","journal-title":"IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing"},{"key":"10.1016\/j.eswa.2022.117144_b31","series-title":"Attention mechanisms in computer vision: A survey","author":"Guo","year":"2021"},{"key":"10.1016\/j.eswa.2022.117144_b32","first-page":"1","article-title":"A review on explainability in multimodal deep neural nets","author":"Joshi","year":"2021","journal-title":"IEEE Access"},{"issue":"105","key":"10.1016\/j.eswa.2022.117144_b33","first-page":"1","article-title":"Performance analysis of intrusion detection systems using a feature selection method on the UNSW-NB15 dataset","volume":"7","author":"Kasongo","year":"2020","journal-title":"Journal of Big Data"},{"issue":"6","key":"10.1016\/j.eswa.2022.117144_b34","doi-asserted-by":"crossref","first-page":"441","DOI":"10.1002\/(SICI)1097-0266(199606)17:6<441::AID-SMJ819>3.0.CO;2-G","article-title":"The application of cluster analysis in strategic management research: An analysis and critique","volume":"17","author":"Ketchen","year":"1996","journal-title":"Strategic Management Journal"},{"key":"10.1016\/j.eswa.2022.117144_b35","unstructured":"Kingma, D. P., & Ba, J. (2014). Adam: A method for stochastic optimization. In ICLR."},{"key":"10.1016\/j.eswa.2022.117144_b36","unstructured":"Komodakis, N., & Zagoruyko, S. (2017). Paying more attention to attention: Improving the performance of convolutional neural networks via attention transfer. In ICLR."},{"key":"10.1016\/j.eswa.2022.117144_b37","doi-asserted-by":"crossref","unstructured":"Lakkaraju, H., Kamar, E., Caruana, R., & Leskovec, J. (2019). Faithful and customizable explanations of black box models. In Proc. of the 2019 AAAI\/ACM Conference on AI, Ethics, and Society (pp. 131\u2013138).","DOI":"10.1145\/3306618.3314229"},{"key":"10.1016\/j.eswa.2022.117144_b38","doi-asserted-by":"crossref","first-page":"67542","DOI":"10.1109\/ACCESS.2020.2983568","article-title":"An intrusion detection model with hierarchical attention mechanism","volume":"8","author":"Liu","year":"2020","journal-title":"IEEE Access"},{"issue":"9","key":"10.1016\/j.eswa.2022.117144_b39","doi-asserted-by":"crossref","first-page":"1","DOI":"10.3390\/s17091967","article-title":"Conditional variational autoencoder for prediction and feature recovery applied to intrusion detection in IoT","volume":"17","author":"Lopez-Martin","year":"2017","journal-title":"Sensors"},{"key":"10.1016\/j.eswa.2022.117144_b40","series-title":"Proceedings of the 31st international conference on neural information processing systems","first-page":"4768","article-title":"A unified approach to interpreting model predictions","author":"Lundberg","year":"2017"},{"key":"10.1016\/j.eswa.2022.117144_b41","series-title":"Explaining network intrusion detection system using explainable AI framework","author":"Mane","year":"2021"},{"key":"10.1016\/j.eswa.2022.117144_b42","doi-asserted-by":"crossref","unstructured":"Marino, D. L., Wickramasinghe, C. S., & Manic, M. (2018). An adversarial approach for explainable AI in intrusion detection systems. In IECON 2018-44th Annual Conference of the IEEE Industrial Electronics Society (pp. 3237\u20133243).","DOI":"10.1109\/IECON.2018.8591457"},{"key":"10.1016\/j.eswa.2022.117144_b43","doi-asserted-by":"crossref","unstructured":"Moustafa, N., & Slay, J. (2015). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In 2015 Military Communications and Information Systems Conference (pp. 1\u20136).","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"10.1016\/j.eswa.2022.117144_b44","doi-asserted-by":"crossref","first-page":"48231","DOI":"10.1109\/ACCESS.2018.2863036","article-title":"Enhanced network anomaly detection based on deep neural networks","volume":"6","author":"Naseer","year":"2018","journal-title":"IEEE Access"},{"key":"10.1016\/j.eswa.2022.117144_b45","series-title":"28th USENIX security symposium","article-title":"TESSERACT: Eliminating experimental bias in malware classification across space and time","author":"Pendlebury","year":"2019"},{"key":"10.1016\/j.eswa.2022.117144_b46","doi-asserted-by":"crossref","unstructured":"Phaisangittisagul, E. (2016). An analysis of the regularization between l2 and dropout in single hidden layer neural network. In 2016 7th International Conference on Intelligent Systems, Modelling and Simulation (pp. 174\u2013179).","DOI":"10.1109\/ISMS.2016.14"},{"key":"10.1016\/j.eswa.2022.117144_b47","article-title":"An explainable machine learning-based network intrusion detection system for enabling generalisability in securing IoT networks","author":"Sarhan","year":"2021","journal-title":"CoRR"},{"key":"10.1016\/j.eswa.2022.117144_b48","series-title":"The impact of the general data protection regulation (GDPR) on artificial intelligence","author":"Sartor","year":"2020"},{"key":"10.1016\/j.eswa.2022.117144_b49","doi-asserted-by":"crossref","unstructured":"Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., & Batra, D. (2017). Grad-CAM: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE international conference on computer vision (pp. 618\u2013626).","DOI":"10.1109\/ICCV.2017.74"},{"issue":"2","key":"10.1016\/j.eswa.2022.117144_b50","doi-asserted-by":"crossref","first-page":"336","DOI":"10.1007\/s11263-019-01228-7","article-title":"Grad-cam: Visual explanations from deep networks via gradient-based localization","volume":"128","author":"Selvaraju","year":"2020","journal-title":"International Journal of Computer Vision"},{"key":"10.1016\/j.eswa.2022.117144_b51","doi-asserted-by":"crossref","DOI":"10.1016\/j.eswa.2020.113577","article-title":"A comparative evaluation of unsupervised deep architectures for intrusion detection in sequential data streams","volume":"159","author":"Sovilj","year":"2020","journal-title":"Expert Systems with Applications"},{"issue":"56","key":"10.1016\/j.eswa.2022.117144_b52","first-page":"1929","article-title":"Dropout: A simple way to prevent neural networks from overfitting","volume":"15","author":"Srivastava","year":"2014","journal-title":"Journal of Machine Learning Research"},{"key":"10.1016\/j.eswa.2022.117144_b53","doi-asserted-by":"crossref","unstructured":"Szczepa\u0144ski, M., Chora\u015b, M., Pawlicki, M., & Kozik, R. (2020). Achieving explainability of intrusion detection system by hybrid oracle-explainer approach. In 2020 International Joint Conference on Neural Networks (pp. 1\u20138).","DOI":"10.1109\/IJCNN48605.2020.9207199"},{"issue":"10","key":"10.1016\/j.eswa.2022.117144_b54","doi-asserted-by":"crossref","first-page":"1","DOI":"10.3390\/sym12101695","article-title":"SAAE-DNN: Deep learning method on intrusion detection\u2019","volume":"12","author":"Tang","year":"2020","journal-title":"Symmetry"},{"key":"10.1016\/j.eswa.2022.117144_b55","series-title":"CISDA","first-page":"1","article-title":"A detailed analysis of the KDD CUP 99 data set","author":"Tavallaee","year":"2009"},{"key":"10.1016\/j.eswa.2022.117144_b56","doi-asserted-by":"crossref","first-page":"41525","DOI":"10.1109\/ACCESS.2019.2895334","article-title":"Deep learning approach for intelligent intrusion detection system","volume":"7","author":"Vinayakumar","year":"2019","journal-title":"IEEE Access"},{"key":"10.1016\/j.eswa.2022.117144_b57","series-title":"Explainable AI and random forest based reliable intrusion detection system","author":"Wali","year":"2021"},{"key":"10.1016\/j.eswa.2022.117144_b58","doi-asserted-by":"crossref","first-page":"73127","DOI":"10.1109\/ACCESS.2020.2988359","article-title":"An explainable machine learning framework for intrusion detection systems","volume":"8","author":"Wang","year":"2020","journal-title":"IEEE Access"},{"key":"10.1016\/j.eswa.2022.117144_b59","series-title":"2020 IEEE european symposium on security and privacy","first-page":"158","article-title":"Evaluating explanation methods for deep learning in security","author":"Warnecke","year":"2020"},{"issue":"7","key":"10.1016\/j.eswa.2022.117144_b60","first-page":"2409","article-title":"Survey on multi-output learning","volume":"31","author":"Xu","year":"2019","journal-title":"IEEE Transactions on Neural Networks and Learning Systems"},{"key":"10.1016\/j.eswa.2022.117144_b61","series-title":"Natural language processing and chinese computing","first-page":"563","article-title":"Explainable ai: A brief survey on history, research areas, approaches and challenges","author":"Xu","year":"2019"},{"key":"10.1016\/j.eswa.2022.117144_b62","doi-asserted-by":"crossref","first-page":"83286","DOI":"10.1109\/ACCESS.2019.2922692","article-title":"A simple recurrent unit model based intrusion detection system with DCGAN","volume":"7","author":"Yang","year":"2019","journal-title":"IEEE Access"},{"key":"10.1016\/j.eswa.2022.117144_b63","doi-asserted-by":"crossref","first-page":"21954","DOI":"10.1109\/ACCESS.2017.2762418","article-title":"A deep learning approach for intrusion detection using recurrent neural networks","volume":"5","author":"Yin","year":"2017","journal-title":"IEEE Access"},{"issue":"1","key":"10.1016\/j.eswa.2022.117144_b64","doi-asserted-by":"crossref","first-page":"1","DOI":"10.4018\/IJISP.290832","article-title":"Intrusion detection model using temporal convolutional network blend into attention mechanism","volume":"16","author":"Zhao","year":"2022","journal-title":"International Journal of Information Security and Privacy"},{"key":"10.1016\/j.eswa.2022.117144_b65","series-title":"European conference on computer vision","first-page":"56","article-title":"Efficient image super-resolution using pixel attention","author":"Zhao","year":"2020"}],"container-title":["Expert Systems with Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0957417422005395?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0957417422005395?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2025,10,17]],"date-time":"2025-10-17T05:39:48Z","timestamp":1760679588000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0957417422005395"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,9]]},"references-count":65,"alternative-id":["S0957417422005395"],"URL":"https:\/\/doi.org\/10.1016\/j.eswa.2022.117144","relation":{},"ISSN":["0957-4174"],"issn-type":[{"value":"0957-4174","type":"print"}],"subject":[],"published":{"date-parts":[[2022,9]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"ROULETTE: A neural attention multi-output model for explainable Network Intrusion Detection","name":"articletitle","label":"Article Title"},{"value":"Expert Systems with Applications","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.eswa.2022.117144","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2022 Elsevier Ltd. All rights reserved.","name":"copyright","label":"Copyright"}],"article-number":"117144"}}