{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,4]],"date-time":"2026-05-04T00:14:52Z","timestamp":1777853692963,"version":"3.51.4"},"reference-count":47,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:00:00Z","timestamp":1785542400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,2,24]],"date-time":"2026-02-24T00:00:00Z","timestamp":1771891200000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100007053","name":"Korea Institute of Energy Technology Evaluation and Planning","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100007053","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Future Generation Computer Systems"],"published-print":{"date-parts":[[2026,8]]},"DOI":"10.1016\/j.future.2026.108447","type":"journal-article","created":{"date-parts":[[2026,2,24]],"date-time":"2026-02-24T16:19:03Z","timestamp":1771949943000},"page":"108447","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["A hybrid ensemble framework for unknown attack detection in IoT networks"],"prefix":"10.1016","volume":"181","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-0410-488X","authenticated-orcid":false,"given":"Chiao-Hsi Joshua","family":"Wang","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2044-1711","authenticated-orcid":false,"given":"Hyunjae","family":"Kang","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0009-0007-2469-5926","authenticated-orcid":false,"given":"Ulysses","family":"Lam","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0971-8548","authenticated-orcid":false,"given":"Jung Taek","family":"Seo","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2605-187X","authenticated-orcid":false,"given":"Dan Dongseong","family":"Kim","sequence":"additional","affiliation":[]}],"member":"78","reference":[{"key":"10.1016\/j.future.2026.108447_bib0001","unstructured":"S. Sinha, State of IoT 2024: Number of connected IoT devices growing 13 globally, 2024, accessed 5 Mar 2025, https:\/\/iot-analytics.com\/number-connected-iot-devices\/."},{"key":"10.1016\/j.future.2026.108447_bib0002","series-title":"Technical Report","article-title":"2023 Enterprise IoT & OT Threat Report","year":"2023"},{"issue":"7","key":"10.1016\/j.future.2026.108447_bib0003","doi-asserted-by":"crossref","DOI":"10.3390\/fi15070243","article-title":"Machine learning for network intrusion detection\u2013a comparative study","volume":"15","author":"Al Lail","year":"2023","journal-title":"Future Internet"},{"issue":"3","key":"10.1016\/j.future.2026.108447_bib0004","doi-asserted-by":"crossref","first-page":"2671","DOI":"10.1109\/COMST.2019.2896380","article-title":"Network intrusion detection for IoT security based on learning techniques","volume":"21","author":"Chaabouni","year":"2019","journal-title":"IEEE Commun. Surv. Tutorials"},{"key":"10.1016\/j.future.2026.108447_bib0005","series-title":"2017IEEE International Conference on Big Data and Smart Computing (BigComp)","first-page":"313","article-title":"Method of intrusion detection using deep neural network","author":"Kim","year":"2017"},{"key":"10.1016\/j.future.2026.108447_bib0006","doi-asserted-by":"crossref","DOI":"10.1016\/j.compeleceng.2023.108626","article-title":"Anomaly based network intrusion detection for IoT attacks using deep learning technique","volume":"107","author":"Sharma","year":"2023","journal-title":"Comput. Electr. Eng."},{"issue":"3","key":"10.1016\/j.future.2026.108447_bib0007","doi-asserted-by":"crossref","first-page":"3915","DOI":"10.1109\/TNSM.2023.3259474","article-title":"A novel multi-stage approach for hierarchical intrusion detection","volume":"20","author":"Verkerken","year":"2023","journal-title":"IEEE Trans. Netw. Serv. Manage."},{"key":"10.1016\/j.future.2026.108447_bib0008","series-title":"Network and Distributed Systems Security (NDSS) Symposium 2018","article-title":"Kitsune: an ensemble of autoencoders for online network intrusion detection","author":"Mirsky","year":"2018"},{"key":"10.1016\/j.future.2026.108447_bib0009","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.104097","article-title":"A survey on privacy and security issues in IoT-based environments: technologies, protection measures and future directions","volume":"148","author":"Sun","year":"2025","journal-title":"Comput. Secur."},{"key":"10.1016\/j.future.2026.108447_bib0010","series-title":"2016 8th IEEE International Conference on Communication Software and Networks (ICCSN)","first-page":"581","article-title":"Comparison deep learning method to traditional methods using for network intrusion detection","author":"Dong","year":"2016"},{"issue":"10","key":"10.1016\/j.future.2026.108447_bib0011","article-title":"Intrusion detection in internet of things using supervised machine learning based on application and transport layer features using UNSW-NB15 data-set","author":"Ahmad","year":"2021","journal-title":"EURASIP J. Wirel. Commun. Netw."},{"key":"10.1016\/j.future.2026.108447_bib0012","doi-asserted-by":"crossref","first-page":"276","DOI":"10.1016\/j.future.2021.09.027","article-title":"A lightweight supervised intrusion detection mechanism for IoT networks","volume":"127","author":"Roy","year":"2022","journal-title":"Future Gener. Comput. Syst."},{"issue":"2","key":"10.1016\/j.future.2026.108447_bib0013","doi-asserted-by":"crossref","first-page":"1805","DOI":"10.1007\/s13369-021-06086-5","article-title":"A new ensemble-based intrusion detection system for internet of things","volume":"47","author":"Abbas","year":"2022","journal-title":"Arabian J. Sci. Eng."},{"issue":"10","key":"10.1016\/j.future.2026.108447_bib0014","doi-asserted-by":"crossref","first-page":"10125","DOI":"10.1109\/TII.2022.3231424","article-title":"A secure ensemble learning-based fog-cloud approach for cyberattack detection in ioMT","volume":"19","author":"Khan","year":"2023","journal-title":"IEEE Trans. Ind. Inf."},{"key":"10.1016\/j.future.2026.108447_bib0015","series-title":"Soft Computing and Signal Processing","first-page":"309","article-title":"A stacked ensemble learning model for enhanced network intrusion detection","author":"Menon","year":"2025"},{"issue":"4","key":"10.1016\/j.future.2026.108447_bib0016","doi-asserted-by":"crossref","first-page":"213","DOI":"10.1007\/s12083-025-02000-0","article-title":"CAT: A simple heterogeneous ensemble learning framework for network intrusion detection","volume":"18","author":"Zhang","year":"2025","journal-title":"Peer-to-Peer Netw. Appl."},{"key":"10.1016\/j.future.2026.108447_bib0017","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2023.110941","article-title":"A stacking ensemble of deep learning models for IoT intrusion detection","volume":"279","author":"Lazzarini","year":"2023","journal-title":"Knowl. Based Syst."},{"key":"10.1016\/j.future.2026.108447_bib0018","doi-asserted-by":"crossref","DOI":"10.1016\/j.iot.2022.100568","article-title":"IoT anomaly detection methods and applications: a survey","volume":"19","author":"Chatterjee","year":"2022","journal-title":"Internet Things"},{"key":"10.1016\/j.future.2026.108447_bib0019","doi-asserted-by":"crossref","first-page":"2809","DOI":"10.1007\/s12652-019-01387-y","article-title":"Unsupervised intelligent system based on one class support vector machine and grey wolf optimization for IoT botnet detection","author":"Shorman","year":"2020","journal-title":"J. Ambient. Intell. Humaniz. Comput."},{"key":"10.1016\/j.future.2026.108447_bib0020","series-title":"2018 Wireless Telecommunications Symposium (WTS)","first-page":"1","article-title":"Autoencoder-based network anomaly detection","author":"Chen","year":"2018"},{"key":"10.1016\/j.future.2026.108447_bib0021","doi-asserted-by":"crossref","DOI":"10.1016\/j.iot.2021.100391","article-title":"DeL-IoT: a deep ensemble learning approach to uncover anomalies in IoT","volume":"14","author":"Tsogbaatar","year":"2021","journal-title":"Internet Things"},{"issue":"11","key":"10.1016\/j.future.2026.108447_bib0022","doi-asserted-by":"crossref","first-page":"11041","DOI":"10.1109\/JIOT.2020.2993410","article-title":"Semisupervised-learning-based security to detect and mitigate intrusions in IoT network","volume":"7","author":"Ravi","year":"2020","journal-title":"IEEE Internet Things J."},{"issue":"3","key":"10.1016\/j.future.2026.108447_bib0023","doi-asserted-by":"crossref","DOI":"10.1145\/1541880.1541882","article-title":"Anomaly detection: a survey","volume":"41","author":"Chandola","year":"2009","journal-title":"ACM Comput. Surv."},{"key":"10.1016\/j.future.2026.108447_bib0024","article-title":"A deep learning ensemble approach to detecting unknown network attacks","volume":"67","author":"Ahmad","year":"2022","journal-title":"J. Inf. Secur. Appl."},{"key":"10.1016\/j.future.2026.108447_bib0025","article-title":"An adaptable deep learning-based intrusion detection system to zero-day attacks","volume":"76","author":"Soltani","year":"2023","journal-title":"J. Inf. Secur. Appl."},{"key":"10.1016\/j.future.2026.108447_bib0026","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.103713","article-title":"An active learning framework using deep q-network for zero-day attack detection","volume":"139","author":"Wu","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.future.2026.108447_bib0027","doi-asserted-by":"crossref","DOI":"10.1016\/j.iot.2023.100851","article-title":"Robust detection of unknown DoS\/DDos attacks in IoT networks using a hybrid learning model","volume":"23","author":"Nguyen","year":"2023","journal-title":"Internet Things"},{"key":"10.1016\/j.future.2026.108447_bib0028","article-title":"NERO: NEural Algorithmic reasoning for zeRO-day attack detection in the IoT: a hybrid approach","volume":"142","author":"Jes\u00fas","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.future.2026.108447_bib0029","doi-asserted-by":"crossref","first-page":"3930","DOI":"10.1109\/JIOT.2021.3100755","article-title":"Federated deep learning for zero-day botnet attack detection in IoT-edge devices","volume":"9","author":"Popoola","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"10.1016\/j.future.2026.108447_bib0030","doi-asserted-by":"crossref","first-page":"13278","DOI":"10.1109\/TVT.2024.3392793","article-title":"MS-Zerowall: detecting zero-day multi-step attack in smart home using VAE and HMM","volume":"73","author":"Li","year":"2024","journal-title":"IEEE Trans. Veh. Technol."},{"key":"10.1016\/j.future.2026.108447_bib0031","doi-asserted-by":"crossref","first-page":"5564","DOI":"10.1109\/TNSM.2025.3600378","article-title":"Empirical study of hierarchical intrusion detection systems for unknown attacks","volume":"22","author":"Arthur","year":"2025","journal-title":"IEEE Trans. Netw. Serv. Manage."},{"key":"10.1016\/j.future.2026.108447_bib0032","doi-asserted-by":"crossref","first-page":"2064","DOI":"10.1109\/TNSM.2026.3652529","article-title":"A novel contrastive loss for zero-day network intrusion detection","volume":"23","author":"Wilkie","year":"2026","journal-title":"IEEE Trans. Netw. Serv. Manage."},{"key":"10.1016\/j.future.2026.108447_bib0033","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1016\/j.neunet.2014.09.003","article-title":"Deep learning in neural networks: an overview","volume":"61","author":"Schmidhuber","year":"2015","journal-title":"Neural Netw."},{"key":"10.1016\/j.future.2026.108447_bib0034","series-title":"Dimensionality Reduction with Unsupervised Nearest Neighbors","first-page":"13","article-title":"K-Nearest Neighbors","author":"Kramer","year":"2013"},{"key":"10.1016\/j.future.2026.108447_bib0035","series-title":"Proceedings of the 27th International Conference on International Conference on Machine Learning","first-page":"807-814","article-title":"Rectified linear units improve restricted boltzmann machines","author":"Nair","year":"2010"},{"key":"10.1016\/j.future.2026.108447_bib0036","series-title":"Pattern Recognition and Machine Learning","author":"Bishop","year":"2006"},{"key":"10.1016\/j.future.2026.108447_bib0037","series-title":"UQ IoT IDS dataset 2021","author":"He","year":"2022"},{"key":"10.1016\/j.future.2026.108447_bib0038","unstructured":"H. Kang, D.H. Ahn, G.M. Lee, J.D. Yoo, K.H. Park, H.K. Kim, IoT Network Intrusion Dataset, 2019. 10.21227\/q70p-q449."},{"key":"10.1016\/j.future.2026.108447_bib0039","series-title":"2020 11th International Conference on Information and Communication Systems (ICICS)","first-page":"243","article-title":"Machine learning with oversampling and undersampling techniques: overview study and experimental results","author":"Mohammed","year":"2020"},{"issue":"2","key":"10.1016\/j.future.2026.108447_bib0040","article-title":"An overview of overfitting and its solutions","volume":"1168","author":"Ying","year":"2019","journal-title":"J. Phys. Conf. Ser."},{"key":"10.1016\/j.future.2026.108447_bib0041","series-title":"2020 Third International Conference on Smart Systems and Inventive Technology (ICSSIT)","first-page":"729","article-title":"Study the influence of normalization\/transformation process on the accuracy of supervised classification","author":"Raju","year":"2020"},{"issue":"2065","key":"10.1016\/j.future.2026.108447_bib0042","article-title":"Principal component analysis: a review and recent developments","volume":"374","author":"Jolliffe","year":"2016","journal-title":"Phil. Trans. R. Soc. A Math. Phys. Eng. Sci."},{"key":"10.1016\/j.future.2026.108447_bib0043","doi-asserted-by":"crossref","DOI":"10.1109\/TNSM.2025.3565614","article-title":"DM-IDS -A network intrusion detection method based on dual-modal fusion","author":"Zha","year":"2025","journal-title":"IEEE Trans. Netw. Serv. Manage."},{"key":"10.1016\/j.future.2026.108447_bib0044","series-title":"Computer Security - ESORICS 2017","first-page":"344","article-title":"Network intrusion detection based on semi-supervised variational auto-encoder","author":"Osada","year":"2017"},{"key":"10.1016\/j.future.2026.108447_bib0045","doi-asserted-by":"crossref","DOI":"10.1016\/j.knosys.2022.110030","article-title":"Anomal-E: a self-supervised network intrusion detection system based on graph neural networks","volume":"258","author":"Caville","year":"2022","journal-title":"Knowl. Based Syst."},{"issue":"13","key":"10.1016\/j.future.2026.108447_bib0046","doi-asserted-by":"crossref","first-page":"5941","DOI":"10.3390\/s23135941","article-title":"CICIoT2023: a real-time dataset and benchmark for large-scale attacks in IoT environment","volume":"23","author":"Neto","year":"2023","journal-title":"Sensors"},{"key":"10.1016\/j.future.2026.108447_bib0047","doi-asserted-by":"crossref","unstructured":"L. McInnes, J. Healy, J. Melville, UMAP: uniform manifold approximation and projection for dimension reduction, ArXiv e-prints (2018). 1802.03426.","DOI":"10.21105\/joss.00861"}],"container-title":["Future Generation Computer Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167739X26000816?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167739X26000816?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T22:56:01Z","timestamp":1777503361000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167739X26000816"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8]]},"references-count":47,"alternative-id":["S0167739X26000816"],"URL":"https:\/\/doi.org\/10.1016\/j.future.2026.108447","relation":{},"ISSN":["0167-739X"],"issn-type":[{"value":"0167-739X","type":"print"}],"subject":[],"published":{"date-parts":[[2026,8]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"A hybrid ensemble framework for unknown attack detection in IoT networks","name":"articletitle","label":"Article Title"},{"value":"Future Generation Computer Systems","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.future.2026.108447","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Author(s). Published by Elsevier B.V.","name":"copyright","label":"Copyright"}],"article-number":"108447"}}