{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,3]],"date-time":"2026-05-03T11:04:54Z","timestamp":1777806294071,"version":"3.51.4"},"reference-count":40,"publisher":"SAGE Publications","issue":"3","license":[{"start":{"date-parts":[[2026,2,10]],"date-time":"2026-02-10T00:00:00Z","timestamp":1770681600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["Journal of Computer Security"],"published-print":{"date-parts":[[2026,5]]},"abstract":"<jats:p>\n                    Network intrusion detection is a crucial line of defense for protecting network security. Despite the significant advancements made by deep learning in this field, existing methods are primarily based on closed-set classification and are ineffective in detecting unknown attacks. To address this research gap, we propose an open-set recognition-based network intrusion detection method. We first provide a network traffic classification model based on open-set recognition,\n                    <jats:sans-serif>OpenPN<\/jats:sans-serif>\n                    , to classify known classes of network traffic and recognize unknown network traffic. Then we introduce a novel attack detection algorithm involving expert intervention, which reduces manual costs through expert verification and utilizes a density-based k-reciprocal nearest neighbor clustering algorithm for optimization. Finally, we perform continuous learning for the classes that have been verified as novel attacks. Extensive experiments conducted on three public datasets demonstrate that the proposed method outperforms existing methods in both closed-set classification and open-set recognition. In addition, the impact of each critical parameter on the performance of the relevant algorithms is comprehensively analyzed.\n                  <\/jats:p>","DOI":"10.1177\/0926227x251414058","type":"journal-article","created":{"date-parts":[[2026,2,10]],"date-time":"2026-02-10T17:56:16Z","timestamp":1770746176000},"page":"193-210","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":0,"title":["An expert-in-the-loop framework for unknown attack detection via open-set recognition"],"prefix":"10.1177","volume":"34","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5103-5866","authenticated-orcid":false,"given":"Xinjing","family":"Yuan","sequence":"first","affiliation":[{"name":"College of Computer Science and DISSec, Nankai University, Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Peiran","family":"Yu","sequence":"additional","affiliation":[{"name":"College of Computer Science and DISSec, Nankai University, Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Song","family":"Liu","sequence":"additional","affiliation":[{"name":"College of Computer Science and DISSec, Nankai University, Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhe","family":"Sun","sequence":"additional","affiliation":[{"name":"College of Computer Science and DISSec, Nankai University, Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yu","family":"Zhang","sequence":"additional","affiliation":[{"name":"College of Computer Science and DISSec, Nankai University, Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2173-4076","authenticated-orcid":false,"given":"Jingdong","family":"Xu","sequence":"additional","affiliation":[{"name":"College of Computer Science and DISSec, Nankai University, Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2026,2,10]]},"reference":[{"key":"e_1_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2020.102767"},{"key":"e_1_3_2_3_2","unstructured":"Snort an open source intrusion prevention system 1998 https:\/\/www.snort.org\/ (accessed 27 June 2023)."},{"key":"e_1_3_2_4_2","unstructured":"Zeek an open source network security monitoring tool 1998 https:\/\/zeek.org\/ (accessed 27 June 2023)."},{"key":"e_1_3_2_5_2","unstructured":"Zeek a server intrusion detection for every platform 2006 https:\/\/www.ossec.net\/ (accessed 27 June 2023)."},{"key":"e_1_3_2_6_2","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/6623554"},{"key":"e_1_3_2_7_2","doi-asserted-by":"crossref","unstructured":"Khan RU Zhang X Alazab M. An improved convolutional neural network model for intrusion detection in networks 2019.","DOI":"10.1109\/CCC.2019.000-6"},{"key":"e_1_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1007\/s00500-020-05017-0"},{"key":"e_1_3_2_9_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2017.2762418"},{"key":"e_1_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108117"},{"key":"e_1_3_2_11_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2021.103266"},{"key":"e_1_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2905041"},{"key":"e_1_3_2_13_2","doi-asserted-by":"crossref","unstructured":"Wang Jenq-Haur Septian Tri Wanda. Combining oversampling with recurrent neural networks for intrusion detection. In: Jensen CS Lam E-P Yang D-N et al. (eds) International Conference on Database Systems for Advanced Applications 2021 pp.305\u2013320. Cham: Springer.","DOI":"10.1007\/978-3-030-73216-5_21"},{"key":"e_1_3_2_14_2","first-page":"9947059","article-title":"A GAN and feature selection-based oversampling technique for intrusion detection","volume":"2021","author":"Liu X","year":"2021","unstructured":"Liu X, Li T, Zhang R. A GAN and feature selection-based oversampling technique for intrusion detection. Sec Commun Netw 2021; 2021: 9947059.","journal-title":"Sec Commun Netw"},{"key":"e_1_3_2_15_2","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2020.2991876"},{"key":"e_1_3_2_16_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102262"},{"key":"e_1_3_2_17_2","first-page":"4027900","article-title":"Intrusion detection for industrial control systems based on open set artificial neural network","volume":"2021","author":"Wang C","year":"2021","unstructured":"Wang C, Wang B, Sun Y. Intrusion detection for industrial control systems based on open set artificial neural network. Sec Commun Netw 2021; 2021: 4027900.","journal-title":"Sec Commun Netw"},{"key":"e_1_3_2_18_2","doi-asserted-by":"publisher","DOI":"10.1007\/s13042-020-01264-7"},{"key":"e_1_3_2_19_2","doi-asserted-by":"publisher","DOI":"10.1613\/jair.1.11192"},{"key":"e_1_3_2_20_2","doi-asserted-by":"publisher","DOI":"10.1109\/MCI.2015.2437512"},{"key":"e_1_3_2_21_2","first-page":"2358","article-title":"Convolutional prototype network for open set recognition","volume":"44","author":"Yang HM","year":"2020","unstructured":"Yang HM, Zhang XY, Yin F. Convolutional prototype network for open set recognition. IEEE Trans Pattern Anal Mach Intell 2020; 44: 2358\u20132370.","journal-title":"IEEE Trans Pattern Anal Mach Intell"},{"key":"e_1_3_2_22_2","unstructured":"Snell J Swersky K Zemel R. Prototypical networks for few-shot learning. In: 31st Conference on neural information processing system Long Beach CA USA 2017."},{"key":"e_1_3_2_23_2","unstructured":"Sohn K. Improved deep metric learning with multi-class n-pair loss objective. In: Advances in neural information processing systems Barcelona Spain 2016."},{"key":"e_1_3_2_24_2","doi-asserted-by":"crossref","unstructured":"Chai C Cao L Li G. Human-in-the-loop outlier detection. In: Proceedings of the 2020 ACM SIGMOD international conference on management of data OR Portland USA June 14\u201319 2020 pp.19\u201333.","DOI":"10.1145\/3318464.3389772"},{"key":"e_1_3_2_25_2","doi-asserted-by":"publisher","DOI":"10.1007\/s40745-015-0040-1"},{"key":"e_1_3_2_26_2","unstructured":"Ester M Kriegel HP Sander J. A density-based algorithm for discovering clusters in large spatial databases with noise. In: Proceedings of the second international conference on knowledge discovery and data mining 1996 pp.226\u2013231."},{"key":"e_1_3_2_27_2","doi-asserted-by":"publisher","DOI":"10.1145\/304181.304187"},{"key":"e_1_3_2_28_2","doi-asserted-by":"crossref","unstructured":"Qin D Gammeter S Bossard L. Hello neighbor: Accurate object retrieval with k-reciprocal nearest neighbors. In: CVPR Colorado Springs CO USA June 21\u201325 2011 pp.777\u2013784 IEEE.","DOI":"10.1109\/CVPR.2011.5995373"},{"key":"e_1_3_2_29_2","doi-asserted-by":"crossref","unstructured":"Zhong Z Zheng L Cao D et al. Re-ranking person re-identification with k-reciprocal encoding. In: CVPR June 21\u201325 2017\u00a0IEEE.","DOI":"10.1109\/CVPR.2017.389"},{"key":"e_1_3_2_30_2","first-page":"125","article-title":"A t-SNE based non linear dimension reduction for network intrusion detection","volume":"12","author":"Hamid Y","year":"2020","unstructured":"Hamid Y, Sugumaran M. A t-SNE based non linear dimension reduction for network intrusion detection. Int J Inf Technol 2020; 12: 125\u2013134.","journal-title":"Int J Inf Technol"},{"key":"e_1_3_2_31_2","first-page":"2579","article-title":"Visualizing data using t-SNE","volume":"9","author":"Van der Maaten L","year":"2008","unstructured":"Van der Maaten L, Hinton G. Visualizing data using t-SNE. Journal of machine learning research 2008; 9: 2579\u20132605.","journal-title":"Journal of machine learning research"},{"key":"e_1_3_2_32_2","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2020.2981604"},{"key":"e_1_3_2_33_2","doi-asserted-by":"crossref","unstructured":"Shu L Xu H Liu B. DOC: Deep open classification of text documents. In: Proceedings of the 2017 conference on empirical methods in natural language processing Copenhagen Denmark 2017 pp.2911\u20132916: Association for Computational Linguistics.","DOI":"10.18653\/v1\/D17-1314"},{"key":"e_1_3_2_34_2","doi-asserted-by":"crossref","unstructured":"Miller D S\u00fcnderhauf N Milford M. Class anchor clustering: A loss for distance-based open set recognition. In: 2021 IEEE Winter conference on applications of computer vision Virtual January 5\u20139 2021 pp.3570\u20133578: IEEE.","DOI":"10.1109\/WACV48630.2021.00361"},{"key":"e_1_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1007\/s11042-024-18458-8"},{"key":"e_1_3_2_36_2","first-page":"155","article-title":"Intelligent data classification using optimized fuzzy neural network and improved cuckoo search optimization","volume":"20","author":"Patro P","year":"2023","unstructured":"Patro P, Kumar K, Kumar GS, et al. Intelligent data classification using optimized fuzzy neural network and improved cuckoo search optimization. Iranian J Fuzzy Syst 2023; 20: 155\u2013169.","journal-title":"Iranian J Fuzzy Syst"},{"key":"e_1_3_2_37_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2024.109098"},{"key":"e_1_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.103807"},{"key":"e_1_3_2_39_2","doi-asserted-by":"crossref","unstructured":"Ling X Wu L Deng W et al. Malgraph: Hierarchical graph neural networks for robust windows malware detection. In: INFOCOM London United Kingdom May 02-05.\u00a0 2022. IEEE.","DOI":"10.1109\/INFOCOM48880.2022.9796786"},{"key":"e_1_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2022.3153844"},{"key":"e_1_3_2_41_2","unstructured":"Zongyuan Ge SD Garnavi R. Generative openmax for multi-class open set classification. In: Proceedings of the British machine vision conference London Sep 04 2017.\u00a0BMVA."}],"container-title":["Journal of Computer Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/0926227X251414058","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/full-xml\/10.1177\/0926227X251414058","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/0926227X251414058","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T20:45:57Z","timestamp":1777495557000},"score":1,"resource":{"primary":{"URL":"https:\/\/journals.sagepub.com\/doi\/10.1177\/0926227X251414058"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,10]]},"references-count":40,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2026,5]]}},"alternative-id":["10.1177\/0926227X251414058"],"URL":"https:\/\/doi.org\/10.1177\/0926227x251414058","relation":{},"ISSN":["0926-227X","1875-8924"],"issn-type":[{"value":"0926-227X","type":"print"},{"value":"1875-8924","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,2,10]]}}}