{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,4]],"date-time":"2026-08-04T20:51:53Z","timestamp":1785876713422,"version":"3.56.0"},"reference-count":40,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/501100012639","name":"Prince Sultan University","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100012639","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Internet of Things"],"published-print":{"date-parts":[[2026,9]]},"DOI":"10.1016\/j.iot.2026.102010","type":"journal-article","created":{"date-parts":[[2026,6,25]],"date-time":"2026-06-25T15:27:59Z","timestamp":1782401279000},"page":"102010","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["NEXUS-IDS: From structural to semantic explainability in flow-node graph neural networks for IoT intrusion detection"],"prefix":"10.1016","volume":"39","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8236-8746","authenticated-orcid":false,"given":"Maha","family":"Driss","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0796-3507","authenticated-orcid":false,"given":"Safa","family":"Ben Atitallah","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0795-132X","authenticated-orcid":false,"given":"Adel","family":"Ammar","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2133-0757","authenticated-orcid":false,"given":"Wadii","family":"Boulila","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.iot.2026.102010_sbref0001","doi-asserted-by":"crossref","first-page":"699","DOI":"10.1016\/j.future.2018.07.058","article-title":"Internet of things (IoT): operating system, applications and protocols design, and validation techniques","volume":"88","author":"Zikria","year":"2018","journal-title":"Future Gener. Comput. Syst."},{"issue":"22","key":"10.1016\/j.iot.2026.102010_bib0002","doi-asserted-by":"crossref","first-page":"22133","DOI":"10.1109\/JIOT.2021.3106898","article-title":"Deep learning in security of internet of things","volume":"9","author":"Li","year":"2021","journal-title":"IEEE Internet Things J."},{"issue":"8","key":"10.1016\/j.iot.2026.102010_bib0003","doi-asserted-by":"crossref","first-page":"4117","DOI":"10.3390\/s23084117","article-title":"A critical cybersecurity analysis and future research directions for the internet of things: a comprehensive review","volume":"23","author":"Tariq","year":"2023","journal-title":"Sensors"},{"issue":"6","key":"10.1016\/j.iot.2026.102010_bib0004","doi-asserted-by":"crossref","first-page":"310","DOI":"10.1109\/MNET.011.2000286","article-title":"Internet of things intrusion detection: centralized, on-device, or federated learning?","volume":"34","author":"Rahman","year":"2020","journal-title":"IEEE Netw."},{"issue":"20","key":"10.1016\/j.iot.2026.102010_bib0005","doi-asserted-by":"crossref","first-page":"8362","DOI":"10.3390\/s23208362","article-title":"Deep neural decision forest (DNDF): a novel approach for enhancing intrusion detection systems in network traffic analysis","volume":"23","author":"Alrayes","year":"2023","journal-title":"Sensors"},{"issue":"5","key":"10.1016\/j.iot.2026.102010_bib0006","doi-asserted-by":"crossref","first-page":"4059","DOI":"10.1109\/JIOT.2022.3203249","article-title":"A survey on IoT intrusion detection: federated learning, game theory, social psychology, and explainable AI as future directions","volume":"10","author":"Arisdakessian","year":"2022","journal-title":"IEEE Internet Things J."},{"issue":"5","key":"10.1016\/j.iot.2026.102010_bib0007","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3711122","article-title":"Can graph neural networks be adequately explained? a survey","volume":"57","author":"Li","year":"2025","journal-title":"ACM Comput. Surv."},{"issue":"7","key":"10.1016\/j.iot.2026.102010_bib0008","doi-asserted-by":"crossref","first-page":"6968","DOI":"10.1109\/TKDE.2022.3187455","article-title":"Graphlime: local interpretable model explanations for graph neural networks","volume":"35","author":"Huang","year":"2022","journal-title":"IEEE Trans. Knowl. Data Eng."},{"issue":"1","key":"10.1016\/j.iot.2026.102010_bib0009","doi-asserted-by":"crossref","first-page":"10","DOI":"10.1186\/s13638-021-01893-8","article-title":"Intrusion detection in internet of things using supervised machine learning based on application and transport layer features using UNSW-NB15 data-set","volume":"2021","author":"Ahmad","year":"2021","journal-title":"EURASIP J. Wirel. Commun. Netw."},{"issue":"3","key":"10.1016\/j.iot.2026.102010_bib0010","doi-asserted-by":"crossref","first-page":"573","DOI":"10.3390\/electronics12030573","article-title":"Anomaly detection of zero-day attacks based on CNN and regularization techniques","volume":"12","author":"Ibrahim Hairab","year":"2023","journal-title":"Electronics"},{"key":"10.1016\/j.iot.2026.102010_sbref0011","article-title":"IDS\u2013GraphMamba: a Markov-enhanced graph mamba framework for real-time intrusion detection in IoMT edge networks","volume":"275","author":"Atitallah","year":"2025","journal-title":"Comput. Netw."},{"key":"10.1016\/j.iot.2026.102010_bib0012","series-title":"NOMS 2022-2022 IEEE\/iFIP Network Operations and Management Symposium","first-page":"1","article-title":"E-GraphSage: a graph neural network based intrusion detection system for IoT","author":"Lo","year":"2022"},{"key":"10.1016\/j.iot.2026.102010_bib0013","series-title":"Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining","first-page":"1135","article-title":"\u201cWhy should i trust you?\u201d explaining the predictions of any classifier","author":"Ribeiro","year":"2016"},{"key":"10.1016\/j.iot.2026.102010_bib0014","first-page":"4765","article-title":"A unified approach to interpreting model predictions","volume":"30","author":"Lundberg","year":"2017","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"10.1016\/j.iot.2026.102010_bib0015","first-page":"9240","article-title":"GNNExplainer: generating explanations for graph neural networks","volume":"32","author":"Ying","year":"2019","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"10.1016\/j.iot.2026.102010_bib0016","first-page":"19620","article-title":"Parameterized explainer for graph neural network","volume":"33","author":"Luo","year":"2020","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"10.1016\/j.iot.2026.102010_bib0017","doi-asserted-by":"crossref","DOI":"10.3389\/frai.2025.1526221","article-title":"A systematic review on the integration of explainable artificial intelligence in intrusion detection systems to enhancing transparency and interpretability in cybersecurity","volume":"8","author":"Mohale","year":"2025","journal-title":"Front. Artif. Intell."},{"issue":"3","key":"10.1016\/j.iot.2026.102010_bib0018","doi-asserted-by":"crossref","first-page":"1775","DOI":"10.1109\/COMST.2023.3280465","article-title":"Explainable intrusion detection for cyber defences in the internet of things: opportunities and solutions","volume":"25","author":"Moustafa","year":"2023","journal-title":"IEEE Commun. Surv. Tutor."},{"issue":"10","key":"10.1016\/j.iot.2026.102010_bib0019","doi-asserted-by":"crossref","first-page":"4170","DOI":"10.3390\/app14104170","article-title":"Xai-ids: toward proposing an explainable artificial intelligence framework for enhancing network intrusion detection systems","volume":"14","author":"Arreche","year":"2024","journal-title":"Appl. Sci."},{"issue":"6","key":"10.1016\/j.iot.2026.102010_bib0020","doi-asserted-by":"crossref","first-page":"1666","DOI":"10.3390\/s25061666","article-title":"Generative AI and LLMs for critical infrastructure protection: evaluation benchmarks, agentic AI, challenges, and opportunities","volume":"25","author":"Yigit","year":"2025","journal-title":"Sensors"},{"key":"10.1016\/j.iot.2026.102010_bib0021","series-title":"2024 IEEE\/ACM International Conference on Big Data Computing, Applications and Technologies (BDCAT)","first-page":"67","article-title":"Towards explainable network intrusion detection using large language models","author":"Houssel","year":"2024"},{"key":"10.1016\/j.iot.2026.102010_bib0022","first-page":"1877","article-title":"Language models are few-shot learners","volume":"33","author":"Brown","year":"2020","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"10.1016\/j.iot.2026.102010_bib0023","doi-asserted-by":"crossref","first-page":"4014","DOI":"10.1016\/j.procs.2025.09.526","article-title":"Adaptive diffusion Markov-enhanced GCN with LLM explanations for IoT attack detection","volume":"270","author":"Atitallah","year":"2025","journal-title":"Procedia Comput. Sci."},{"key":"10.1016\/j.iot.2026.102010_bib0024","series-title":"Findings of the Association for Computational Linguistics: EMNLP 2021","first-page":"3784","article-title":"Retrieval augmentation reduces hallucination in conversation","author":"Shuster","year":"2021"},{"key":"10.1016\/j.iot.2026.102010_bib0025","series-title":"Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies","first-page":"5271","article-title":"On the origin of hallucinations in conversational models: is it the datasets or the models?","author":"Dziri","year":"2022"},{"issue":"12","key":"10.1016\/j.iot.2026.102010_bib0026","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3571730","article-title":"Survey of hallucination in natural language generation","volume":"55","author":"Ji","year":"2023","journal-title":"ACM Comput. Surv."},{"key":"10.1016\/j.iot.2026.102010_bib0027","doi-asserted-by":"crossref","unstructured":"D. Li, B. Jiang, L. Huang, A. Beigi, C. Zhao, Z. Tan, A. Bhattacharjee, Y. Jiang, C. Chen, T. Wu, K. Shu, L. Cheng, H. Liu, From generation to judgment: opportunities and challenges of LLM-as-a-judge, in: Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, Association for Computational Linguistics, Suzhou, China, 2025, pp. 2757\u20132791. https:\/\/aclanthology.org\/2025.emnlp-main.138\/. 10.18653\/v1\/2025.emnlp-main.138.","DOI":"10.18653\/v1\/2025.emnlp-main.138"},{"key":"10.1016\/j.iot.2026.102010_bib0028","series-title":"Advances in Neural Information Processing Systems","first-page":"46595","article-title":"Judging LLM-as-a-judge with MT-bench and chatbot arena","volume":"36","author":"Zheng","year":"2023"},{"key":"10.1016\/j.iot.2026.102010_bib0029","unstructured":"S. Tan, S. Zhuang, K. Montgomery, W.Y. Tang, A. Cuadron, C. Wang, R.A. Popa, I. Stoica, JudgeBench: a benchmark for evaluating LLM-based judges, 2025, https:\/\/arxiv.org\/abs\/2410.12784."},{"key":"10.1016\/j.iot.2026.102010_bib0030","series-title":"2025 9th International Conference on Inventive Systems and Control (ICISC)","first-page":"405","article-title":"Privacy-preserving graph-based intrusion detection system: a federated learning approach with GNN and XAI","author":"Venkateswarlu","year":"2025"},{"key":"10.1016\/j.iot.2026.102010_bib0031","doi-asserted-by":"crossref","first-page":"122187","DOI":"10.1109\/ACCESS.2025.3588076","article-title":"Hybrid AI for predictive cyber risk assessment: federated graph-transformer architecture with explainability","volume":"13","author":"Govea","year":"2025","journal-title":"IEEE Access"},{"key":"10.1016\/j.iot.2026.102010_bib0032","doi-asserted-by":"crossref","DOI":"10.1016\/j.eswa.2025.128089","article-title":"XG-NID: dual-modality network intrusion detection using a heterogeneous graph neural network and large language model","volume":"287","author":"Farrukh","year":"2025","journal-title":"Expert Syst. Appl."},{"key":"10.1016\/j.iot.2026.102010_bib0033","doi-asserted-by":"crossref","first-page":"40281","DOI":"10.1109\/ACCESS.2022.3165809","article-title":"Edge-IIoTset: a new comprehensive realistic cyber security dataset of IoT and IIoT applications for centralized and federated learning","volume":"10","author":"Ferrag","year":"2022","journal-title":"IEEE Access"},{"key":"10.1016\/j.iot.2026.102010_bib0034","doi-asserted-by":"crossref","unstructured":"I. Ullah, Q.H. Mahmoud, A scheme for generating a dataset for anomalous activity detection in iot networks, in: C. Goutte, X. Zhu (Eds.), Advances in Artificial Intelligence, Springer International Publishing, Cham, 2020, pp. 508\u2013520.","DOI":"10.1007\/978-3-030-47358-7_52"},{"key":"10.1016\/j.iot.2026.102010_bib0035","series-title":"International Conference on Machine Learning","first-page":"3319","article-title":"Axiomatic attribution for deep networks","author":"Sundararajan","year":"2017"},{"key":"10.1016\/j.iot.2026.102010_bib0036","unstructured":"H. Li, Q. Dong, J. Chen, H. Su, Y. Zhou, Q. Ai, Z. Ye, Y. Liu, LLMs-as-judges: a comprehensive survey on LLM-based evaluation methods, 2024, https:\/\/arxiv.org\/abs\/2412.05579."},{"issue":"2","key":"10.1016\/j.iot.2026.102010_bib0037","doi-asserted-by":"crossref","first-page":"661","DOI":"10.1162\/coli_a_00561","article-title":"LLM-based NLG evaluation: current status and challenges","volume":"51","author":"Gao","year":"2025","journal-title":"Comput. Linguist."},{"key":"10.1016\/j.iot.2026.102010_bib0038","series-title":"Proceedings of the 2016 Conference on Empirical Methods in Natural Language Processing","first-page":"2122","article-title":"How not to evaluate your dialogue system: an empirical study of unsupervised evaluation metrics for dialogue response generation","author":"Liu","year":"2016"},{"issue":"3","key":"10.1016\/j.iot.2026.102010_bib0039","doi-asserted-by":"crossref","first-page":"393","DOI":"10.1162\/coli_a_00322","article-title":"A structured review of the validity of BLEU","volume":"44","author":"Reiter","year":"2018","journal-title":"Comput. Linguist."},{"key":"10.1016\/j.iot.2026.102010_bib0040","doi-asserted-by":"crossref","first-page":"68772","DOI":"10.52202\/079017-2197","article-title":"LLM evaluators recognize and favor their own generations","volume":"37","author":"Panickssery","year":"2024","journal-title":"Adv. Neural Inf. Process. Syst."}],"container-title":["Internet of Things"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S254266052600140X?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S254266052600140X?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,8,4]],"date-time":"2026-08-04T20:33:59Z","timestamp":1785875639000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S254266052600140X"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9]]},"references-count":40,"alternative-id":["S254266052600140X"],"URL":"https:\/\/doi.org\/10.1016\/j.iot.2026.102010","relation":{},"ISSN":["2542-6605"],"issn-type":[{"value":"2542-6605","type":"print"}],"subject":[],"published":{"date-parts":[[2026,9]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"NEXUS-IDS: From structural to semantic explainability in flow-node graph neural networks for IoT intrusion detection","name":"articletitle","label":"Article Title"},{"value":"Internet of Things","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.iot.2026.102010","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"102010"}}