{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,4]],"date-time":"2026-06-04T20:42:12Z","timestamp":1780605732124,"version":"3.54.1"},"reference-count":318,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2021,1,1]],"date-time":"2021-01-01T00:00:00Z","timestamp":1609459200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/100016714","name":"Open UAE research group, University of Sharjah","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100016714","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Access"],"published-print":{"date-parts":[[2021]]},"DOI":"10.1109\/access.2021.3083060","type":"journal-article","created":{"date-parts":[[2021,5,24]],"date-time":"2021-05-24T19:47:47Z","timestamp":1621885667000},"page":"78658-78700","source":"Crossref","is-referenced-by-count":634,"title":["Machine Learning for Anomaly Detection: A Systematic Review"],"prefix":"10.1109","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1570-0897","authenticated-orcid":false,"given":"Ali Bou","family":"Nassif","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3001-0077","authenticated-orcid":false,"given":"Manar Abu","family":"Talib","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Qassim","family":"Nasir","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4917-5149","authenticated-orcid":false,"given":"Fatima Mohamad","family":"Dakalbab","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref275","doi-asserted-by":"publisher","DOI":"10.1109\/MITE.2015.7375291"},{"key":"ref274","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-45823-6_67"},{"key":"ref277","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-10925-7_11"},{"key":"ref276","doi-asserted-by":"publisher","DOI":"10.1016\/j.cviu.2018.02.006"},{"key":"ref271","doi-asserted-by":"publisher","DOI":"10.1109\/RAIT.2016.7507933"},{"key":"ref270","doi-asserted-by":"publisher","DOI":"10.1109\/NAECON.2017.8268745"},{"key":"ref273","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2007.79"},{"key":"ref170","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2008.69"},{"key":"ref272","doi-asserted-by":"publisher","DOI":"10.1145\/3229607.3229612"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1109\/ICSCSE.2016.0011"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.1145\/3230833.3232818"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1109\/CMC.2010.9"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.1109\/PHM.2011.5939470"},{"key":"ref176","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-10925-7_1"},{"key":"ref175","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2018.07.023"},{"key":"ref178","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2015.07.029"},{"key":"ref177","doi-asserted-by":"publisher","DOI":"10.1109\/DINWC.2015.7054228"},{"key":"ref168","doi-asserted-by":"publisher","DOI":"10.1109\/ISCC.2010.5546735"},{"key":"ref169","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCNT.2013.6726604"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2013.08.066"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/ICPRIME.2013.6496489"},{"key":"ref33","first-page":"47","article-title":"Multiple kernel learning for heterogeneous anomaly detection: Algorithm and aviation safety case study categories and subject descriptors","author":"field","year":"2010","journal-title":"Proceedings of Computer"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2016.03.028"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2007.03.025"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/IVS.2018.8500383"},{"key":"ref267","doi-asserted-by":"publisher","DOI":"10.1145\/581376.581378"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2012.05.004"},{"key":"ref268","doi-asserted-by":"publisher","DOI":"10.1109\/IACS.2018.8355459"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1016\/j.proeng.2012.01.849"},{"key":"ref269","doi-asserted-by":"publisher","DOI":"10.1109\/SAINT.2009.11"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLC.2011.6016798"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/2500853.2500857"},{"key":"ref288","doi-asserted-by":"publisher","DOI":"10.1109\/ACCT.2015.131"},{"key":"ref287","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-05677-3_13"},{"key":"ref286","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-23957-1_20"},{"key":"ref285","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-30490-4_56"},{"key":"ref284","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLC.2007.4370710"},{"key":"ref181","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2009.08.007"},{"key":"ref283","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2017.8258164"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1109\/ITHERM.2010.5501330"},{"key":"ref282","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOMW.2012.6193518"},{"key":"ref281","doi-asserted-by":"publisher","DOI":"10.1109\/ASMC.2017.7969205"},{"key":"ref280","doi-asserted-by":"publisher","DOI":"10.1007\/s11071-009-9650-5"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2016.7727567"},{"key":"ref184","doi-asserted-by":"publisher","DOI":"10.1109\/ICCPS48487.2020.00027"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.1109\/TCYB.2014.2330853"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1109\/PERCOMW.2015.7134058"},{"key":"ref189","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2803446"},{"key":"ref188","doi-asserted-by":"publisher","DOI":"10.1109\/IROS.2011.6094853"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1109\/TENCONSpring.2016.7519380"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1145\/3217871.3217872"},{"key":"ref28","first-page":"1","article-title":"A survey of deep learning-based network anomaly detection","volume":"22","author":"kwon","year":"2017","journal-title":"Cluster Comput"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2018.2826011"},{"key":"ref179","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-10-6875-1_7"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/s11235-018-0475-8"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/2791120"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2009.05.029"},{"key":"ref21","first-page":"9","article-title":"A survey of anomaly intrusion detection techniques","volume":"28","author":"yu","year":"2012","journal-title":"J Comput Sci Coll"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2494502"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2007.02.001"},{"key":"ref278","doi-asserted-by":"publisher","DOI":"10.1109\/CloudCom.2013.57"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2018.2818163"},{"key":"ref279","doi-asserted-by":"publisher","DOI":"10.1109\/IntelliSys.2015.7361264"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-35314-7_50"},{"key":"ref293","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2943249"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/SAI.2014.6918252"},{"key":"ref292","first-page":"210","article-title":"An anomaly-based network intrusion detection system using deep learning","author":"van","year":"2017","journal-title":"Proc Int Conf Syst Sci Eng (ICSSE)"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/IAW.2005.1495950"},{"key":"ref295","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2007.637"},{"key":"ref294","doi-asserted-by":"publisher","DOI":"10.1109\/MINES.2012.146"},{"key":"ref297","doi-asserted-by":"publisher","DOI":"10.1109\/LISAT.2019.8817340"},{"key":"ref296","doi-asserted-by":"publisher","DOI":"10.1145\/2388576.2388596"},{"key":"ref299","doi-asserted-by":"publisher","DOI":"10.1109\/CCWC.2019.8666450"},{"key":"ref298","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-48057-2_9"},{"key":"ref154","doi-asserted-by":"publisher","DOI":"10.1007\/s12559-018-9564-y"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1016\/S1005-8885(07)60105-8"},{"key":"ref156","doi-asserted-by":"publisher","DOI":"10.1016\/j.rse.2015.01.001"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2018.05.027"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2018.04.004"},{"key":"ref291","doi-asserted-by":"publisher","DOI":"10.1109\/UBMK.2017.8093473"},{"key":"ref152","first-page":"59","article-title":"Unsupervised SVM based on p-kernels for anomaly detection","author":"li","year":"2006","journal-title":"Proc 1st Int Conf Innov Comput Inf Control (ICICIC)"},{"key":"ref290","doi-asserted-by":"publisher","DOI":"10.1016\/j.jal.2016.12.002"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1109\/ISA.2008.12"},{"key":"ref146","doi-asserted-by":"publisher","DOI":"10.1109\/ICHIT.2006.253508"},{"key":"ref147","first-page":"1","article-title":"The anomaly detection by using DBSCAN clustering with multiple parameters","author":"thang","year":"2011","journal-title":"Proc Int Conf Inf Sci Appl"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2014.04.073"},{"key":"ref149","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2006.255127"},{"key":"ref289","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE.2009.128"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-012-1263-0"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2015.04.191"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1016\/j.protcy.2012.10.121"},{"key":"ref56","volume":"2","year":"1994","journal-title":"Distribution Restriction Statement Approved for Public Release"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2010.2051543"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/ICNSURV.2016.7486356"},{"key":"ref53","doi-asserted-by":"crossref","first-page":"559","DOI":"10.1109\/TSMCB.2005.860136","article-title":"Evolutionary neural networks for anomaly detection based on the behavior of a program","volume":"36","author":"han","year":"2006","journal-title":"IEEE Trans Syst Man Cybern B Cybern"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2008.08.003"},{"key":"ref40","first-page":"1","article-title":"Performance metric selection for autonomic anomaly detection on cloud computing systems","author":"fu","year":"2011","journal-title":"Proc IEEE Global Telecommun Conf (GLOBECOM)"},{"key":"ref167","doi-asserted-by":"publisher","DOI":"10.1145\/3152494.3156816"},{"key":"ref166","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2017.2650206"},{"key":"ref165","doi-asserted-by":"publisher","DOI":"10.1109\/IWCMC.2013.6583806"},{"key":"ref164","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2013.317"},{"key":"ref163","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2010.71"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.1109\/ISCISC.2013.6767325"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1109\/NOMS.2012.6211951"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1007\/11425274_2"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2872784"},{"key":"ref3","volume":"10265","author":"schlegl","year":"2017","journal-title":"Unsupervised Anomaly Detection with Generative Adversarial Networks to Guide Marker Discovery"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2018.11.010"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/ICCNC.2019.8685636"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2015.08.220"},{"key":"ref159","doi-asserted-by":"publisher","DOI":"10.1109\/LSENS.2018.2879990"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1093\/comjnl\/bxr026"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/ICOIN.2013.6496342"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1109\/IMIS.2016.50"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijinfomgt.2018.08.006"},{"key":"ref158","doi-asserted-by":"publisher","DOI":"10.1016\/j.iot.2019.100059"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/2827699"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-29038-1_18"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2010.140"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3098593.3098594"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/AHICI.2012.6408446"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1007\/s11227-009-0338-x"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/s10618-011-0234-x"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/ICACCA.2016.7578859"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1155\/2012\/107046"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/TR.2010.2048740"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-33704-8_21"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1016\/j.jocs.2017.03.006"},{"key":"ref318","doi-asserted-by":"publisher","DOI":"10.1145\/1330107.1330148"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2011.08.068"},{"key":"ref317","doi-asserted-by":"publisher","DOI":"10.1145\/3325917.3325946"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/VAST.2010.5652467"},{"key":"ref316","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-65188-0"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2011.08.011"},{"key":"ref315","first-page":"1","article-title":"Network traffic anomalies detection and identification with flow monitoring","author":"nguyen","year":"2008","journal-title":"Proc 5th IFIP Int Conf Wireless Opt Commun Netw (WOCN)"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2017.2762418"},{"key":"ref314","doi-asserted-by":"publisher","DOI":"10.26599\/TST.2019.9010051"},{"key":"ref313","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2020.01.005"},{"key":"ref312","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2020.03.089"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1016\/j.measurement.2014.05.029"},{"key":"ref311","doi-asserted-by":"publisher","DOI":"10.1016\/j.buildenv.2020.107212"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1145\/2500853.2500858"},{"key":"ref310","doi-asserted-by":"publisher","DOI":"10.1016\/j.jmsy.2020.05.013"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijar.2013.03.012"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-30507-8_13"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815679"},{"key":"ref305","doi-asserted-by":"publisher","DOI":"10.1145\/1081870.1081917"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/CICYBS.2011.5949392"},{"key":"ref304","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSAC.2006.40"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2009.10.003"},{"key":"ref307","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2019.105686"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-014-5473-9"},{"key":"ref306","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2019.00216"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1007\/s11036-015-0644-x"},{"key":"ref301","doi-asserted-by":"publisher","DOI":"10.1145\/2592791.2592797"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-14229-6_2"},{"key":"ref300","doi-asserted-by":"publisher","DOI":"10.1145\/2890508"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2016.0040"},{"key":"ref303","doi-asserted-by":"publisher","DOI":"10.1109\/WIFS.2016.7823921"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2017.04.070"},{"key":"ref302","doi-asserted-by":"publisher","DOI":"10.1016\/j.jpdc.2012.09.004"},{"key":"ref309","doi-asserted-by":"publisher","DOI":"10.1155\/2015\/923792"},{"key":"ref308","doi-asserted-by":"publisher","DOI":"10.1109\/PQ.2019.8818236"},{"key":"ref197","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4615-0953-0_4"},{"key":"ref198","doi-asserted-by":"publisher","DOI":"10.1007\/s11036-008-0113-x"},{"key":"ref199","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2003.1250987"},{"key":"ref193","doi-asserted-by":"publisher","DOI":"10.1016\/j.sigpro.2005.03.014"},{"key":"ref194","doi-asserted-by":"publisher","DOI":"10.1023\/A:1026195112518"},{"key":"ref195","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2017.08.074"},{"key":"ref196","doi-asserted-by":"publisher","DOI":"10.1109\/CEC.2002.1007012"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1145\/1774088.1774434"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/EALS.2014.7009497"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-29009-6_7"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/JSTARS.2014.2311995"},{"key":"ref191","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-34500-5_43"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1007\/s10762-010-9630-3"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-45931-8_6"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2013.6655254"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1145\/2783258.2788611"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/WCICSS.2015.7420322"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/JSTSP.2012.2234722"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/DeSE.2011.19"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2010.05.002"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2012.09.004"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2015.10.026"},{"key":"ref84","first-page":"67","article-title":"A close look on n -grams in intrusion detection","author":"wressnegger","year":"2013","journal-title":"Proc ACM Workshop Artif Intell Secur (AISec)"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/LGRS.2017.2657818"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1016\/j.envsoft.2009.08.010"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2012.99"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1007\/s13042-011-0017-0"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098052"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1145\/2371536.2371572"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2011.52"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.1109\/SECCOMW.2006.359572"},{"key":"ref101","first-page":"603","article-title":"Anomaly detection on time series","author":"teng","year":"2010","journal-title":"Proc IEEE Int Conf Prog Informat Comput"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/COMPSACW.2010.72"},{"key":"ref209","doi-asserted-by":"publisher","DOI":"10.1145\/775047.775103"},{"key":"ref203","doi-asserted-by":"publisher","DOI":"10.1016\/j.addma.2017.11.009"},{"key":"ref204","doi-asserted-by":"publisher","DOI":"10.1145\/1639562.1639592"},{"key":"ref201","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2009.5061947"},{"key":"ref202","doi-asserted-by":"publisher","DOI":"10.1145\/1068009.1068061"},{"key":"ref207","doi-asserted-by":"publisher","DOI":"10.1007\/11430919_92"},{"key":"ref208","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2009.5061975"},{"key":"ref205","doi-asserted-by":"publisher","DOI":"10.1007\/11427469_67"},{"key":"ref206","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2016.0172"},{"key":"ref211","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-016-5586-4"},{"key":"ref210","doi-asserted-by":"publisher","DOI":"10.1109\/WCNC.2017.7925567"},{"key":"ref212","doi-asserted-by":"publisher","DOI":"10.1109\/ICME.2007.4284843"},{"key":"ref213","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134015"},{"key":"ref214","doi-asserted-by":"publisher","DOI":"10.1016\/j.jocs.2016.11.016"},{"key":"ref215","doi-asserted-by":"publisher","DOI":"10.1109\/TSC.2018.2824809"},{"key":"ref216","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2004.01.006"},{"key":"ref217","first-page":"236","article-title":"Evolutionary learning program’s behavior in neural networks for anomaly detection","volume":"3316","author":"han","year":"2004","journal-title":"Proc Int Conf Neural Inf Process"},{"key":"ref218","doi-asserted-by":"publisher","DOI":"10.1145\/3123266.3123451"},{"key":"ref219","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2012.6195548"},{"key":"ref220","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330871"},{"key":"ref222","doi-asserted-by":"publisher","DOI":"10.1145\/3359992.3366641"},{"key":"ref221","doi-asserted-by":"publisher","DOI":"10.1016\/j.cam.2020.112982"},{"key":"ref229","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2007.03.001"},{"key":"ref228","doi-asserted-by":"publisher","DOI":"10.1016\/j.enbuild.2017.02.058"},{"key":"ref227","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2015.7363883"},{"key":"ref226","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLC.2005.1527630"},{"key":"ref225","doi-asserted-by":"publisher","DOI":"10.1109\/LGRS.2007.903083"},{"key":"ref224","doi-asserted-by":"publisher","DOI":"10.1007\/s12652-019-01645-z"},{"key":"ref223","doi-asserted-by":"publisher","DOI":"10.1109\/ICIoT48696.2020.9089575"},{"key":"ref127","doi-asserted-by":"publisher","DOI":"10.1109\/ICNIDC.2018.8525714"},{"key":"ref126","doi-asserted-by":"publisher","DOI":"10.1109\/CCCS.2015.7374168"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1109\/ICCIKE47802.2019.9004325"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1109\/SMC.2013.9"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1109\/COMSNETS.2011.5716425"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1109\/ATIT49449.2019.9030505"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1109\/ICAICT.2016.7991732"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1109\/EITCE47263.2019.9094916"},{"key":"ref134","doi-asserted-by":"publisher","DOI":"10.1007\/0-387-24230-9_3"},{"key":"ref131","doi-asserted-by":"publisher","DOI":"10.1109\/iCMLDE.2018.00035"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLC.2006.259008"},{"key":"ref232","first-page":"1","article-title":"Detecting errors within a corpus using anomaly detection","author":"eskin","year":"2000","journal-title":"Proc 1st Meeting North Amer Chapter Assoc Comput Linguistics"},{"key":"ref233","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-71249-9_2"},{"key":"ref230","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2011.152"},{"key":"ref231","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2008.11.011"},{"key":"ref239","doi-asserted-by":"publisher","DOI":"10.1016\/j.jare.2014.02.009"},{"key":"ref238","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijcip.2015.05.001"},{"key":"ref235","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2015.2433898"},{"key":"ref234","doi-asserted-by":"publisher","DOI":"10.1109\/CC.2018.8357700"},{"key":"ref237","doi-asserted-by":"publisher","DOI":"10.1109\/HASE.2017.36"},{"key":"ref236","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2016.04.007"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1109\/ICISE.2009.235"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1109\/CSCloud.2017.15"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2008.311"},{"key":"ref137","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2863036"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1109\/IRI.2016.74"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1145\/1363686.1363897"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2007.44"},{"key":"ref142","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2017.08.013"},{"key":"ref143","first-page":"358","article-title":"Anomaly intrusion detection using one class SVM","author":"wang","year":"2004","journal-title":"Proc 5th Annu IEEE Syst Man Cybern Inf Assurance Workshop (SMC)"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOM.2018.8647714"},{"key":"ref144","doi-asserted-by":"publisher","DOI":"10.1145\/1644893.1644895"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/1541880.1541882"},{"key":"ref145","doi-asserted-by":"publisher","DOI":"10.1109\/CCECE.2013.6567739"},{"key":"ref241","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCCEE.2017.7867661"},{"key":"ref242","doi-asserted-by":"publisher","DOI":"10.1109\/SRDS.2013.29"},{"key":"ref243","doi-asserted-by":"publisher","DOI":"10.1109\/ICIEA.2015.7334166"},{"key":"ref244","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2006.165"},{"key":"ref240","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-38998-6_8"},{"key":"ref248","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2005.08.005"},{"key":"ref247","doi-asserted-by":"publisher","DOI":"10.1145\/545186.545187"},{"key":"ref246","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45665-1_15"},{"key":"ref245","doi-asserted-by":"publisher","DOI":"10.1109\/CFIS.2018.8336654"},{"key":"ref249","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-76485-6_8"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/CEC.2004.1330898"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1007\/11427995_51"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2005.05.002"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2019.2893549"},{"key":"ref105","doi-asserted-by":"publisher","DOI":"10.1016\/j.cviu.2011.03.003"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/DSAA.2015.7344872"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/ICCAIE.2011.6162198"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2011.05.058"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-13-1747-7_66"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2013.172"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46454-1_21"},{"key":"ref250","doi-asserted-by":"publisher","DOI":"10.1109\/INDICON.2015.7443752"},{"key":"ref251","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.02.015"},{"key":"ref254","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-77690-1_6"},{"key":"ref255","doi-asserted-by":"publisher","DOI":"10.1109\/ICINIS.2010.133"},{"key":"ref252","doi-asserted-by":"crossref","first-page":"631","DOI":"10.1109\/TKDE.2007.1009","article-title":"Conditional anomaly detection","volume":"19","author":"xiuyao","year":"2007","journal-title":"IEEE Trans Knowl Data Eng"},{"key":"ref253","doi-asserted-by":"publisher","DOI":"10.1109\/ICONSIP.2016.7857445"},{"key":"ref257","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLC.2011.6017032"},{"key":"ref256","doi-asserted-by":"publisher","DOI":"10.1145\/1068009.1068064"},{"key":"ref259","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2016.09.063"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2010.235"},{"key":"ref258","doi-asserted-by":"publisher","DOI":"10.1109\/CSCloud.2017.39"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.052213.00046"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1016\/S0378-7206(01)00091-X"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2012.11.050"},{"key":"ref14","first-page":"1051","article-title":"Guidelines for performing systematic literature reviews in software engineering version 2.3","volume":"45","author":"kitchenham","year":"2007","journal-title":"Engineering"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1023\/B:AIRE.0000045502.10941.a9"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2015.01.001"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.7873\/DATE.2013.112"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TSMCC.2012.2215319"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1109\/SMC-IT.2006.79"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1007\/s11053-017-9345-4"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2016.21"},{"key":"ref119","first-page":"3077","article-title":"Improving one-class SVM for anomaly detection","volume":"5","author":"li","year":"2003","journal-title":"Proc Int Conf Mach Learn Cybern"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/JLT.2019.2902487"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1007\/s10994-016-5567-7"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1109\/DRCN.2015.7149025"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1007\/s10844-015-0388-x"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-20757-0_3"},{"key":"ref121","doi-asserted-by":"publisher","DOI":"10.1109\/ICDMW.2017.149"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1145\/1229285.1229292"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1145\/1368506.1368514"},{"key":"ref260","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-20893-6_39"},{"key":"ref261","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-02085-8_6"},{"key":"ref262","first-page":"769","article-title":"Genetic algorithm with different feature selection techniques for anomaly detectors generation","author":"aziz","year":"2013","journal-title":"Proc Federated Conf Comput Sci Inf Syst"},{"key":"ref263","doi-asserted-by":"publisher","DOI":"10.1145\/3234200.3234238"},{"key":"ref264","doi-asserted-by":"publisher","DOI":"10.1109\/CloudNet.2017.8071525"},{"key":"ref265","doi-asserted-by":"publisher","DOI":"10.1109\/ICON.2004.1409210"},{"key":"ref266","doi-asserted-by":"publisher","DOI":"10.1109\/INISTA.2011.5946083"}],"container-title":["IEEE Access"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6287639\/9312710\/09439459.pdf?arnumber=9439459","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,12,17]],"date-time":"2021-12-17T19:56:16Z","timestamp":1639770976000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9439459\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021]]},"references-count":318,"URL":"https:\/\/doi.org\/10.1109\/access.2021.3083060","relation":{},"ISSN":["2169-3536"],"issn-type":[{"value":"2169-3536","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021]]}}}