{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,22]],"date-time":"2026-06-22T10:21:12Z","timestamp":1782123672145,"version":"3.54.5"},"reference-count":123,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"name":"COllective Research NETworking"},{"DOI":"10.13039\/100012331","name":"VLAIO","doi-asserted-by":"publisher","award":["HBC.2018.0491"],"award-info":[{"award-number":["HBC.2018.0491"]}],"id":[{"id":"10.13039\/100012331","id-type":"DOI","asserted-by":"publisher"}]},{"name":"CyberSecurity Research Flanders","award":["VR20192203"],"award-info":[{"award-number":["VR20192203"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2021]]},"DOI":"10.1109\/access.2021.3075066","type":"journal-article","created":{"date-parts":[[2021,4,22]],"date-time":"2021-04-22T20:09:28Z","timestamp":1619122168000},"page":"63995-64015","source":"Crossref","is-referenced-by-count":47,"title":["Machine Learning for Misuse-Based Network Intrusion Detection: Overview, Unified Evaluation and Feature Choice Comparison Framework"],"prefix":"10.1109","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0744-4897","authenticated-orcid":false,"given":"Laurens","family":"Le Jeune","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7477-8961","authenticated-orcid":false,"given":"Toon","family":"Goedeme","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8753-7895","authenticated-orcid":false,"given":"Nele","family":"Mentens","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-45248-5_13"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2019.102419"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2019.06.005"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2019.2896380"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2019.02.056"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/382912.382923"},{"key":"ref36","first-page":"1","article-title":"Results of the DARPA 1998 offline intrusion detection evaluation","author":"lippmann","year":"1999","journal-title":"Proc 2nd Int Workshop Recent Adv Intrusion Detection"},{"key":"ref35","year":"2021","journal-title":"1998 DARPA Intrusion Detection Evaluation Data Set"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.25"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2836950"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2494502"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.3390\/info10040122"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101752"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-13-1444-5"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.3390\/a10020039"},{"key":"ref24","first-page":"61","article-title":"New anomaly network intrusion detection system in cloud environment based on optimized back propagation neural network using improved genetic algorithm","volume":"11","author":"chiba","year":"2019","journal-title":"Int J Commun Netw Inf Secur"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1186\/s13174-018-0087-2"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2015.11.016"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1145\/3065386"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.052213.00046"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/2907070"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2019.02.023"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-010-0487-0"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1088\/1757-899X\/563\/5\/052019"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ICACCI.2017.8126009"},{"key":"ref56","first-page":"81","article-title":"Training all the KDD data set to classify and detect attacks","volume":"17","author":"beghdad","year":"2007","journal-title":"Neural Netw World"},{"key":"ref55","first-page":"313","article-title":"Method of intrusion detection using deep neural network","author":"kim","year":"2017","journal-title":"Proc IEEE Int Conf Big Data Smart Comput (BigComp)"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/TSMCC.2008.923876"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.2"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1016\/S0031-3203(96)00142-2"},{"key":"ref40","year":"2021","journal-title":"KDD Cup 1999 data"},{"key":"ref4","first-page":"1","article-title":"An introduction to intrusion-detection systems","author":"debar","year":"2002","journal-title":"Proc Connect"},{"key":"ref3","year":"2016","journal-title":"Dyn Analysis Summary of Friday October 21 Attack"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1987.232894"},{"key":"ref5","article-title":"Computer security threat monitoring and surveillance","author":"anderson","year":"1980"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/2716260"},{"key":"ref49","first-page":"479","article-title":"A detailed analysis of CICIDS2017 dataset for designing intrusion detection systems","volume":"7","author":"panigrahi","year":"2018","journal-title":"Int J Eng Technol"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-20005-3_2"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/DEXA.2006.21"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1080\/19393555.2015.1125974"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(99)00112-7"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.5220\/0006639801080116"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2895334"},{"key":"ref42","first-page":"5","article-title":"Intrusion detection with unlabeled data using clustering","author":"portnoy","year":"2001","journal-title":"Proc ACM CSS Workshop Data Mining Appl Secur (DMSA)"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-32-9298-7_23"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2011.12.012"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2019.01.063"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2869577"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2018.00178"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2018.8622568"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1145\/3297156.3297230"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.3390\/app9020238"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2019.105612"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/NAECON.2015.7443094"},{"key":"ref78","first-page":"1","article-title":"Intrusion detection using deep sparse auto-encoder and self-taught learning","volume":"32","author":"qureshi","year":"2019","journal-title":"Neural Comput Appl"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2017.2780250"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.18489\/sacj.v56i1.248"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2016.0040"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1007\/s11227-016-1766-z"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2016.09.041"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2017.2772792"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.3390\/electronics8090968"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-30285-0_27"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1002\/tee.22606"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2017.2762418"},{"key":"ref2","year":"2016","journal-title":"Massive Brute-Force Attack on Alibaba Affects Millions"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-70139-4_87"},{"key":"ref1","year":"2020","journal-title":"Cisco Annual Internet Report—Cisco Annual Internet Report (2018–2023) White Paper—Cisco"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2017.05.063"},{"key":"ref95","first-page":"528","article-title":"Hidden Markov model based anomaly intrusion detection","author":"jain","year":"2012","journal-title":"Proc Int Conf Internet Technol Secured Trans"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1049\/iet-its.2016.0208"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2017.07.005"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/TASLP.2016.2520371"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2012.11.050"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/ICBDA.2019.8713213"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-35289-8_32"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-70139-4_87"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2005.12.126"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1145\/1921168.1921179"},{"key":"ref90","doi-asserted-by":"crossref","first-page":"278","DOI":"10.1109\/ICDAR.1995.598994","article-title":"Random decision forests","volume":"1","author":"ho","year":"1995","journal-title":"Proc 3rd Int Conf Document Anal Recognition"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.3115\/v1\/D14-1181"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.91"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"ref112","first-page":"1017","article-title":"Generating text with recurrent neural networks","author":"sutskever","year":"2011","journal-title":"Proc 28th Int Conf Mach Learn (ICML)"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1155\/2016\/4731953"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1145\/1978672.1978676"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2015.01.009"},{"key":"ref97","first-page":"1","article-title":"Unsupervised anomaly detection in network intrusion detection using clusters","author":"leung","year":"2005","journal-title":"Proc ACSC"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/65.484228"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-87353-2_9"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-99807-7_19"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2017.02.009"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1016\/j.adhoc.2013.04.014"},{"key":"ref15","article-title":"DÏoT: A federated self-learning anomaly detection system for IoT","author":"nguyen","year":"2018","journal-title":"arXiv 1804 07474"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/PlatCon.2016.7456805"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.sysarc.2019.101701"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/SEGE.2019.8859773"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2863036"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/s00500-020-05017-0"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCN.2019.8847179"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2978035"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.3390\/electronics8030322"},{"key":"ref119","first-page":"267","author":"hinton","year":"2010","journal-title":"Deep Belief Nets"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/s12652-020-02228-z"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-99807-7_20"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1016\/S0166-4115(97)80111-2"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/RISP.1992.213257"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1109\/ICCNC.2018.8390278"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2018.07.025"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1016\/0364-0213(90)90002-E"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1126\/science.1242072"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1023\/A:1009744630224"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-67422-3_13"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.05.011"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1016\/j.ipm.2009.03.002"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2933165"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1007\/BF00994018"},{"key":"ref87","first-page":"168","article-title":"Robust support vector machines for anomaly detection in computer security","author":"hu","year":"2003","journal-title":"Proc Int Conf Mach Learn Appl (ICMLA)"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2010.12.141"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/9312710\/09410557.pdf?arnumber=9410557","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,12,17]],"date-time":"2021-12-17T19:55:46Z","timestamp":1639770946000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9410557\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"references-count":123,"URL":"https:\/\/doi.org\/10.1109\/access.2021.3075066","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021]]}}}