{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,6]],"date-time":"2026-06-06T23:00:56Z","timestamp":1780786856318,"version":"3.54.1"},"reference-count":25,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,10,1]],"date-time":"2026-10-01T00:00:00Z","timestamp":1790812800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Information Sciences"],"published-print":{"date-parts":[[2026,10]]},"DOI":"10.1016\/j.ins.2026.123704","type":"journal-article","created":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T23:34:16Z","timestamp":1780443256000},"page":"123704","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["SDAE: Similarity-guided dual-masking feature level multi-class anomaly explanation for cluster-based models on data streams"],"prefix":"10.1016","volume":"754","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0876-2694","authenticated-orcid":false,"given":"Bin","family":"Li","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Li","family":"Cheng","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jingtao","family":"Qi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Haoxiang","family":"Jin","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"issue":"3","key":"10.1016\/j.ins.2026.123704_bib0005","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/1541880.1541882","article-title":"Anomaly detection: a survey","volume":"41","author":"Chandola","year":"2009","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"10.1016\/j.ins.2026.123704_bib0010","series-title":"Proceedings of the Eighteenth ACM International Conference on Web Search and Data Mining","first-page":"651","article-title":"Density-aware and cluster-based federated anomaly detection on data streams","author":"Li","year":"2025"},{"issue":"5","key":"10.1016\/j.ins.2026.123704_bib0015","doi-asserted-by":"crossref","first-page":"977","DOI":"10.1007\/s00778-021-00721-1","article-title":"A survey on outlier explanations","volume":"31","author":"Panjei","year":"2022","journal-title":"VLDB J."},{"key":"10.1016\/j.ins.2026.123704_bib0020","series-title":"CCS \u201921: 2021 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, Republic of Korea, November 15\u201319, 2021","first-page":"3197","article-title":"DeepAID: interpreting and improving deep learning-based anomaly detection in security applications","author":"Han","year":"2021"},{"key":"10.1016\/j.ins.2026.123704_bib0025","series-title":"30th USENIX Security Symposium, USENIX Security 2021, August 11\u201313, 2021","first-page":"2327","article-title":"CADE: detecting and explaining concept drift samples for security applications","author":"Yang","year":"2021"},{"key":"10.1016\/j.ins.2026.123704_bib0030","series-title":"7th IEEE Conference on Communications and Network Security, CNS 2019, Washington, DC, USA, June 10\u201312, 2019","first-page":"91","article-title":"GEE: a gradient-based explainable variational autoencoder for network anomaly detection","author":"Nguyen","year":"2019"},{"key":"10.1016\/j.ins.2026.123704_bib0035","series-title":"Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS 2018, Toronto, ON, Canada, October 15\u201319, 2018","first-page":"364","article-title":"LEMNA: explaining deep learning based security applications","author":"Guo","year":"2018"},{"key":"10.1016\/j.ins.2026.123704_bib0040","series-title":"Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, San Francisco, CA, USA, August 13\u201317, 2016","first-page":"1135","article-title":"\u201cWhy should I trust you?\u201d: explaining the predictions of any classifier","author":"Ribeiro","year":"2016"},{"key":"10.1016\/j.ins.2026.123704_bib0045","series-title":"Advances in Neural Information Processing Systems 30: Annual Conference on Neural Information Processing Systems 2017, December 4\u20139, 2017, Long Beach, CA, USA","first-page":"4765","article-title":"A unified approach to interpreting model predictions","author":"Lundberg","year":"2017"},{"key":"10.1016\/j.ins.2026.123704_bib0050","series-title":"Proceedings of the Twenty-Seventh International Joint Conference on Artificial Intelligence, IJCAI 2018, July 13\u201319, 2018, Stockholm, Sweden","first-page":"2461","article-title":"Contextual outlier interpretation","author":"Liu","year":"2018"},{"key":"10.1016\/j.ins.2026.123704_bib0055","doi-asserted-by":"crossref","DOI":"10.1016\/j.datak.2024.102302","article-title":"Leveraging an isolation forest to anomaly detection and data clustering","volume":"151","author":"Yepmo","year":"2024","journal-title":"Data Knowl. Eng."},{"key":"10.1016\/j.ins.2026.123704_bib0060","series-title":"WWW \u201921: The Web Conference 2021, Virtual Event \/ Ljubljana, Slovenia, April 19\u201323, 2021","first-page":"1328","article-title":"Beyond outlier detection: outlier interpretation by attention-guided triplet deviation network","author":"Xu","year":"2021"},{"key":"10.1016\/j.ins.2026.123704_bib0065","series-title":"2019 IEEE International Conference on Big Data (IEEE BigData), Los Angeles, CA, USA, December 9\u201312, 2019","first-page":"1991","article-title":"ACE - an anomaly contribution explainer for cyber-security applications","author":"Zhang","year":"2019"},{"key":"10.1016\/j.ins.2026.123704_bib0070","series-title":"IEEE International Conference on Computer Vision, ICCV 2017, Venice, Italy, October 22\u201329, 2017","first-page":"3449","article-title":"Interpretable explanations of black boxes by meaningful perturbation","author":"Fong","year":"2017"},{"issue":"8","key":"10.1016\/j.ins.2026.123704_bib0075","article-title":"Clustering-based real-time anomaly detection\u2014a breakthrough in big data technologies","volume":"33","author":"Ariyaluran Habeeb","year":"2022","journal-title":"Trans. Emerg. Telecommun. Technol."},{"key":"10.1016\/j.ins.2026.123704_bib0080","series-title":"35th IEEE International Conference on Data Engineering, ICDE 2019, Macao, China, April 8\u201311, 2019","first-page":"1418","article-title":"Robust high dimensional stream classification with novel class detection","author":"Wang","year":"2019"},{"key":"10.1016\/j.ins.2026.123704_bib0085","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2022.102719","article-title":"DFAID: density-aware and feature-deviated active intrusion detection over network traffic streams","volume":"118","author":"Li","year":"2022","journal-title":"Comput. Secur."},{"issue":"3","key":"10.1016\/j.ins.2026.123704_bib0090","doi-asserted-by":"crossref","first-page":"1416","DOI":"10.1109\/TKDE.2020.2993193","article-title":"SACCOS: a semi-supervised framework for emerging class detection and concept drift adaption over data streams","volume":"34","author":"Gao","year":"2022","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"10.1016\/j.ins.2026.123704_bib0095","series-title":"Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence, IJCAI 2021, Virtual Event \/ Montreal, Canada, 19\u201327 August 2021","first-page":"3257","article-title":"A clustering-based framework for classifying data streams","author":"Yan","year":"2021"},{"key":"10.1016\/j.ins.2026.123704_bib0100","series-title":"2016 IEEE 2nd International Conference on Big Data Security on Cloud (BigDataSecurity), IEEE International Conference on High Performance and Smart Computing (HPSC), and IEEE International Conference on Intelligent Data and Security (IDS)","first-page":"49","article-title":"Ai\u22272: training a big data machine to defend","author":"Veeramachaneni","year":"2016"},{"key":"10.1016\/j.ins.2026.123704_bib0105","doi-asserted-by":"crossref","first-page":"404","DOI":"10.1016\/j.ins.2019.08.050","article-title":"Exploiting evolving micro-clusters for data stream classification with emerging class detection","volume":"507","author":"Din","year":"2020","journal-title":"Inf. Sci."},{"key":"10.1016\/j.ins.2026.123704_bib0110","series-title":"International Conference on Learning Representations","article-title":"The concrete distribution: a continuous relaxation of discrete random variables","author":"Maddison","year":"2016"},{"key":"10.1016\/j.ins.2026.123704_bib0115","series-title":"Proceedings of the 4th International Conference on Information Systems Security and Privacy, ICISSP 2018, Funchal, Madeira - Portugal, January 22\u201324, 2018","first-page":"108","article-title":"Toward generating a new intrusion detection dataset and intrusion traffic characterization","author":"Sharafaldin","year":"2018"},{"key":"10.1016\/j.ins.2026.123704_bib0120","series-title":"IEEE International Conference on Consumer Electronics-Taiwan, ICCE-TW 2021, Penghu, Taiwan, September 15\u201317, 2021","first-page":"1","article-title":"ZYELL-NCTU NetTraffic-1.0: a large-scale dataset for real-world network anomaly detection","author":"Chen","year":"2021"},{"key":"10.1016\/j.ins.2026.123704_bib0125","doi-asserted-by":"crossref","DOI":"10.1016\/j.engappai.2022.105730","article-title":"Interpretable anomaly detection with diffi: depth-based feature importance of isolation forest","volume":"119","author":"Carletti","year":"2023","journal-title":"Eng. Appl. Artif. Intell."}],"container-title":["Information Sciences"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0020025526006353?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0020025526006353?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,6,6]],"date-time":"2026-06-06T22:35:59Z","timestamp":1780785359000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0020025526006353"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,10]]},"references-count":25,"alternative-id":["S0020025526006353"],"URL":"https:\/\/doi.org\/10.1016\/j.ins.2026.123704","relation":{},"ISSN":["0020-0255"],"issn-type":[{"value":"0020-0255","type":"print"}],"subject":[],"published":{"date-parts":[[2026,10]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"SDAE: Similarity-guided dual-masking feature level multi-class anomaly explanation for cluster-based models on data streams","name":"articletitle","label":"Article Title"},{"value":"Information Sciences","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.ins.2026.123704","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier Inc. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"123704"}}