{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,26]],"date-time":"2026-03-26T15:33:04Z","timestamp":1774539184020,"version":"3.50.1"},"reference-count":36,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2024,2,3]],"date-time":"2024-02-03T00:00:00Z","timestamp":1706918400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,2,3]],"date-time":"2024-02-03T00:00:00Z","timestamp":1706918400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Cloud Comp"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>With the exponential growth of various data interactions on network systems, network intrusions are also increasing. The emergence of edge computing technology brings a new solution to network security. However, due to the difficulty of processing massive and unbalanced data at the edge, higher accuracy requirements are necessary for deployed detection models. This paper proposes a multi-classification model for network intrusion detection based on reconstruction and feature matching. This model can be deployed on small-scale edge nodes, effectively identifying various attack behaviors through the utilization of reconstruction errors and adaptive scaling. Furthermore, we proposed a model transfer method based on feature matching to enhance the training and detection efficiency of multi-classification models under different data distribution conditions. The proposed model has been evaluated on the CICIDS2017 dataset in terms of accuracy, recall, precision and F1 score. The model demonstrates high accuracy for normal flows in the network, majority class attacks, and minority class attacks, achieving an overall multi-class accuracy of 99.81%, outperforming similar models. Furthermore, this model demonstrates faster convergence and training speed after feature matching, exhibiting better robustness and outstanding performance at the edge.<\/jats:p>","DOI":"10.1186\/s13677-023-00584-7","type":"journal-article","created":{"date-parts":[[2024,2,3]],"date-time":"2024-02-03T02:03:43Z","timestamp":1706925823000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":7,"title":["A multi-classification detection model for imbalanced data in NIDS based on reconstruction and feature matching"],"prefix":"10.1186","volume":"13","author":[{"given":"Yue","family":"Yang","sequence":"first","affiliation":[]},{"given":"Jieren","family":"Cheng","sequence":"additional","affiliation":[]},{"given":"Zhaowu","family":"Liu","sequence":"additional","affiliation":[]},{"given":"Huimin","family":"Li","sequence":"additional","affiliation":[]},{"given":"Ganglou","family":"Xu","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2024,2,3]]},"reference":[{"key":"584_CR1","doi-asserted-by":"publisher","first-page":"1809","DOI":"10.1007\/s11280-021-00943-x","volume":"25","author":"F Wang","year":"2022","unstructured":"Wang F, Wang L, Li G et al (2022) Edge-cloud-enabled matrix factorization for diversified APIs recommendation in mashup creation. World Wide Web 25:1809\u20131829. https:\/\/doi.org\/10.1007\/s11280-021-00943-x","journal-title":"World Wide Web"},{"key":"584_CR2","doi-asserted-by":"publisher","first-page":"3007","DOI":"10.1109\/TNSE.2022.3157730","volume":"10","author":"Y Yang","year":"2023","unstructured":"Yang Y, Yang X, Heidari M et al (2023) ASTREAM: data-stream-driven scalable anomaly detection with accuracy guarantee in IIoT environment. IEEE Trans Netw Sci Eng 10:3007\u20133016. https:\/\/doi.org\/10.1109\/TNSE.2022.3157730","journal-title":"IEEE Trans Netw Sci Eng"},{"key":"584_CR3","doi-asserted-by":"publisher","first-page":"36","DOI":"10.1109\/MCOM.002.2200424","volume":"61","author":"X Xu","year":"2023","unstructured":"Xu X, Tang S, Qi L et al (2023) CNN partitioning and offloading for vehicular edge networks in Web3. IEEE Commun Mag 61:36\u201342. https:\/\/doi.org\/10.1109\/MCOM.002.2200424","journal-title":"IEEE Commun Mag"},{"key":"584_CR4","doi-asserted-by":"publisher","first-page":"771","DOI":"10.1109\/TCSS.2022.3168595","volume":"10","author":"S Wu","year":"2023","unstructured":"Wu S, Shen S, Xu X et al (2023) Popularity-aware and diverse web APIs recommendation based on correlation graph. IEEE Trans Comput Soc Syst 10:771\u2013782. https:\/\/doi.org\/10.1109\/TCSS.2022.3168595","journal-title":"IEEE Trans Comput Soc Syst"},{"key":"584_CR5","doi-asserted-by":"publisher","first-page":"3094","DOI":"10.1109\/JIOT.2021.3112159","volume":"10","author":"Y Wu","year":"2023","unstructured":"Wu Y, Nie L, Wang S et al (2023) Intelligent intrusion detection for internet of things security: a deep convolutional generative adversarial network-enabled approach. IEEE Internet Things J 10:3094\u20133106. https:\/\/doi.org\/10.1109\/JIOT.2021.3112159","journal-title":"IEEE Internet Things J"},{"key":"584_CR6","doi-asserted-by":"publisher","first-page":"27","DOI":"10.1186\/s40537-023-00697-5","volume":"10","author":"A Shiravani","year":"2023","unstructured":"Shiravani A, Sadreddini MH, Nahook HN (2023) Network intrusion detection using data dimensions reduction techniques. J Big Data 10:27. https:\/\/doi.org\/10.1186\/s40537-023-00697-5","journal-title":"J Big Data"},{"key":"584_CR7","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3555308","volume":"55","author":"L Kong","year":"2023","unstructured":"Kong L, Tan J, Huang J et al (2023) Edge-computing-driven internet of things: a survey. ACM Comput Surv 55:1\u201341. https:\/\/doi.org\/10.1145\/3555308","journal-title":"ACM Comput Surv"},{"key":"584_CR8","doi-asserted-by":"publisher","first-page":"975","DOI":"10.1016\/j.jacr.2022.03.016","volume":"19","author":"E Darzidehkalani","year":"2022","unstructured":"Darzidehkalani E, Ghasemi-rad M, Van Ooijen PMA (2022) Federated learning in medical imaging: part II: methods, challenges, and considerations. J Am Coll Radiol 19:975\u2013982. https:\/\/doi.org\/10.1016\/j.jacr.2022.03.016","journal-title":"J Am Coll Radiol"},{"key":"584_CR9","doi-asserted-by":"publisher","unstructured":"Chalapathy R, Chawla S (2019) Deep learning for anomaly detection: a survey. https:\/\/doi.org\/10.48550\/arXiv.1901.03407","DOI":"10.48550\/arXiv.1901.03407"},{"key":"584_CR10","doi-asserted-by":"publisher","first-page":"2119","DOI":"10.32604\/cmc.2023.035077","volume":"75","author":"J Yin","year":"2023","unstructured":"Yin J, Shi Y, Deng W et al (2023) Internet of things intrusion detection system based on convolutional neural network. Comput Mater Contin 75:2119\u20132135. https:\/\/doi.org\/10.32604\/cmc.2023.035077","journal-title":"Comput Mater Contin"},{"key":"584_CR11","doi-asserted-by":"publisher","first-page":"3460","DOI":"10.1109\/TFUZZ.2021.3117441","volume":"30","author":"J Xie","year":"2022","unstructured":"Xie J, Wang H, Garibaldi JM, Wu D (2022) Network intrusion detection based on dynamic intuitionistic fuzzy sets. IEEE Trans Fuzzy Syst 30:3460\u20133472. https:\/\/doi.org\/10.1109\/TFUZZ.2021.3117441","journal-title":"IEEE Trans Fuzzy Syst"},{"key":"584_CR12","doi-asserted-by":"publisher","first-page":"332","DOI":"10.1016\/j.knosys.2018.08.036","volume":"163","author":"H Liu","year":"2019","unstructured":"Liu H, Lang B, Liu M, Yan H (2019) CNN and RNN based payload classification methods for attack detection. Knowl-Based Syst 163:332\u2013341. https:\/\/doi.org\/10.1016\/j.knosys.2018.08.036","journal-title":"Knowl-Based Syst"},{"key":"584_CR13","doi-asserted-by":"publisher","unstructured":"Yuan S, Ren K, Zhang C et al (2022) Canet: a hierarchical Cnn-attention model for network intrusion detection. SSRN J. https:\/\/doi.org\/10.2139\/ssrn.4243555","DOI":"10.2139\/ssrn.4243555"},{"key":"584_CR14","doi-asserted-by":"publisher","first-page":"750","DOI":"10.1109\/ITAIC54216.2022.9836915","volume-title":"2022 IEEE 10th joint international information technology and artificial intelligence conference (ITAIC)","author":"X Huang","year":"2022","unstructured":"Huang X, Li Y, Ou L et al (2022) Research and implementation of industrial control network security intrusion detection classification based on deep learning. In: 2022 IEEE 10th joint international information technology and artificial intelligence conference (ITAIC). IEEE, Chongqing, China, pp 750\u2013754"},{"key":"584_CR15","doi-asserted-by":"publisher","first-page":"5693","DOI":"10.1007\/s40747-023-01013-7","volume":"9","author":"N Thockchom","year":"2023","unstructured":"Thockchom N, Singh MM, Nandi U (2023) A novel ensemble learning-based model for network intrusion detection. Complex Intell Syst 9:5693\u20135714. https:\/\/doi.org\/10.1007\/s40747-023-01013-7","journal-title":"Complex Intell Syst"},{"key":"584_CR16","doi-asserted-by":"publisher","first-page":"141","DOI":"10.1109\/ICTAI.2019.00028","volume-title":"2019 IEEE 31st international conference on tools with artificial intelligence (ICTAI)","author":"PC Ngo","year":"2019","unstructured":"Ngo PC, Winarto AA, Kou CKL et al (2019) Fence GAN: towards better anomaly detection. In: 2019 IEEE 31st international conference on tools with artificial intelligence (ICTAI). IEEE, Portland, OR, USA, pp 141\u2013148"},{"key":"584_CR17","doi-asserted-by":"publisher","first-page":"185","DOI":"10.1016\/j.future.2022.08.011","volume":"138","author":"I Debicha","year":"2023","unstructured":"Debicha I, Bauwens R, Debatty T et al (2023) TAD: transfer learning-based multi-adversarial detection of evasion attacks against network intrusion detection systems. Futur Gener Comput Syst 138:185\u2013197. https:\/\/doi.org\/10.1016\/j.future.2022.08.011","journal-title":"Futur Gener Comput Syst"},{"key":"584_CR18","doi-asserted-by":"publisher","first-page":"109542","DOI":"10.1016\/j.knosys.2022.109542","volume":"253","author":"E Mahdavi","year":"2022","unstructured":"Mahdavi E, Fanian A, Mirzaei A, Taghiyarrenani Z (2022) ITL-IDS: incremental transfer learning for intrusion detection systems. Knowl-Based Syst 253:109542. https:\/\/doi.org\/10.1016\/j.knosys.2022.109542","journal-title":"Knowl-Based Syst"},{"key":"584_CR19","doi-asserted-by":"publisher","first-page":"1173","DOI":"10.1109\/TBME.2021.3117407","volume":"69","author":"H Guan","year":"2022","unstructured":"Guan H, Liu M (2022) Domain adaptation for medical image analysis: a survey. IEEE Trans Biomed Eng 69:1173\u20131185. https:\/\/doi.org\/10.1109\/TBME.2021.3117407","journal-title":"IEEE Trans Biomed Eng"},{"key":"584_CR20","doi-asserted-by":"publisher","first-page":"739","DOI":"10.1016\/j.ins.2022.05.114","volume":"607","author":"Y Ye","year":"2022","unstructured":"Ye Y, Lin Q, Ma L et al (2022) Multiple source transfer learning for dynamic multiobjective optimization. Inf Sci 607:739\u2013757. https:\/\/doi.org\/10.1016\/j.ins.2022.05.114","journal-title":"Inf Sci"},{"key":"584_CR21","doi-asserted-by":"publisher","unstructured":"Li Y, Peng X (2019) Learning domain adaptive features with unlabeled domain bridges. https:\/\/doi.org\/10.48550\/arXiv.1912.05004","DOI":"10.48550\/arXiv.1912.05004"},{"key":"584_CR22","doi-asserted-by":"publisher","first-page":"118738","DOI":"10.1016\/j.eswa.2022.118738","volume":"212","author":"Z Kang","year":"2023","unstructured":"Kang Z, Nielsen M, Yang B et al (2023) Online transfer learning with partial feedback. Expert Syst Appl 212:118738. https:\/\/doi.org\/10.1016\/j.eswa.2022.118738","journal-title":"Expert Syst Appl"},{"key":"584_CR23","doi-asserted-by":"publisher","first-page":"109526","DOI":"10.1016\/j.knosys.2022.109526","volume":"253","author":"T Yang","year":"2022","unstructured":"Yang T, Yu X, Ma N et al (2022) Deep representation-based transfer learning for deep neural networks. Knowl-Based Syst 253:109526. https:\/\/doi.org\/10.1016\/j.knosys.2022.109526","journal-title":"Knowl-Based Syst"},{"key":"584_CR24","doi-asserted-by":"publisher","first-page":"1193","DOI":"10.1109\/CVPR52688.2022.00127","volume-title":"2022 IEEE\/CVF conference on computer vision and pattern recognition (CVPR)","author":"J Huang","year":"2022","unstructured":"Huang J, Guan D, Xiao A et al (2022) Category contrast for unsupervised domain adaptation in visual tasks. In: 2022 IEEE\/CVF conference on computer vision and pattern recognition (CVPR). IEEE, New Orleans, LA, USA, pp 1193\u20131204"},{"key":"584_CR25","unstructured":"Wang L, Wang M, Zhang D, Fu H (2022) Unsupervised domain adaptation via style-aware self-intermediate Domain. arXiv preprint arXiv:2209.01870, 2022"},{"key":"584_CR26","doi-asserted-by":"publisher","first-page":"778","DOI":"10.1109\/ICDM.2019.00088","volume-title":"2019 IEEE international conference on data mining (ICDM)","author":"C Yu","year":"2019","unstructured":"Yu C, Wang J, Chen Y, Huang M (2019) Transfer learning with dynamic adversarial adaptation network. In: 2019 IEEE international conference on data mining (ICDM). IEEE, Beijing, China, pp 778\u2013786"},{"key":"584_CR27","first-page":"4723","volume-title":"2018 international conference on machine learning","author":"S Srinivas","year":"2018","unstructured":"Srinivas S, Fleuret F (2018) Knowledge transfer with jacobian matching. In: 2018 international conference on machine learning. PMLR, Sweden, pp 4723\u20134731"},{"key":"584_CR28","doi-asserted-by":"publisher","unstructured":"Zagoruyko S, Komodakis N (2017) Paying more attention to attention: improving the performance of convolutional neural networks via attention transfer. https:\/\/doi.org\/10.48550\/arXiv.1612.03928","DOI":"10.48550\/arXiv.1612.03928"},{"key":"584_CR29","doi-asserted-by":"publisher","unstructured":"Romero A, Ballas N, Kahou SE, et al (2015) FitNets: hints for thin deep nets. https:\/\/doi.org\/10.48550\/arXiv.1412.6550","DOI":"10.48550\/arXiv.1412.6550"},{"key":"584_CR30","first-page":"3030","volume-title":"International conference on machine learning","author":"Y Jang","year":"2019","unstructured":"Jang Y, Lee H, Hwang SJ et al (2019) Learning what and where to transfer. In: International conference on machine learning. PMLR, California, USA, pp 3030\u20133039"},{"key":"584_CR31","doi-asserted-by":"publisher","first-page":"4618","DOI":"10.1007\/s11227-020-03447-z","volume":"77","author":"R Chapaneri","year":"2021","unstructured":"Chapaneri R, Shah S (2021) Multi-level Gaussian mixture modeling for detection of malicious network traffic. J Supercomput 77:4618\u20134638. https:\/\/doi.org\/10.1007\/s11227-020-03447-z","journal-title":"J Supercomput"},{"key":"584_CR32","first-page":"108","volume-title":"Toward generating a new intrusion detection dataset and intrusion traffic characterization: in: proceedings of the 4th international conference on information systems security and privacy","author":"I Sharafaldin","year":"2018","unstructured":"Sharafaldin I, Habibi Lashkari A, Ghorbani AA (2018) Toward generating a new intrusion detection dataset and intrusion traffic characterization: in: proceedings of the 4th international conference on information systems security and privacy. SCITEPRESS - Science and Technology Publications, Funchal, Madeira, Portugal, pp 108\u2013116"},{"key":"584_CR33","doi-asserted-by":"publisher","first-page":"469","DOI":"10.1016\/j.aej.2023.07.063","volume":"78","author":"R Harini","year":"2023","unstructured":"Harini R, Maheswari N, Ganapathy S, Sivagami M (2023) An effective technique for detecting minority attacks in NIDS using deep learning and sampling approach. Alex Eng J 78:469\u2013482. https:\/\/doi.org\/10.1016\/j.aej.2023.07.063","journal-title":"Alex Eng J"},{"key":"584_CR34","doi-asserted-by":"publisher","first-page":"102499","DOI":"10.1016\/j.cose.2021.102499","volume":"112","author":"N Gupta","year":"2022","unstructured":"Gupta N, Jindal V, Bedi P (2022) CSE-IDS: using cost-sensitive deep learning and ensemble algorithms to handle class imbalance in network-based intrusion detection systems. Comput Secur 112:102499. https:\/\/doi.org\/10.1016\/j.cose.2021.102499","journal-title":"Comput Secur"},{"key":"584_CR35","doi-asserted-by":"publisher","first-page":"181","DOI":"10.26599\/BDMA.2020.9020003","volume":"3","author":"W Zhong","year":"2020","unstructured":"Zhong W, Yu N, Ai C (2020) Applying big data based deep learning system to intrusion detection. Big Data Min Anal 3:181\u2013195. https:\/\/doi.org\/10.26599\/BDMA.2020.9020003","journal-title":"Big Data Min Anal"},{"key":"584_CR36","doi-asserted-by":"publisher","first-page":"1805","DOI":"10.1007\/s13369-021-06086-5","volume":"47","author":"A Abbas","year":"2022","unstructured":"Abbas A, Khan MA, Latif S et al (2022) A new ensemble-based intrusion detection system for internet of things. Arab J Sci Eng 47:1805\u20131819. https:\/\/doi.org\/10.1007\/s13369-021-06086-5","journal-title":"Arab J Sci Eng"}],"container-title":["Journal of Cloud Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13677-023-00584-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s13677-023-00584-7\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s13677-023-00584-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,2,3]],"date-time":"2024-02-03T02:05:14Z","timestamp":1706925914000},"score":1,"resource":{"primary":{"URL":"https:\/\/journalofcloudcomputing.springeropen.com\/articles\/10.1186\/s13677-023-00584-7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,2,3]]},"references-count":36,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2024,12]]}},"alternative-id":["584"],"URL":"https:\/\/doi.org\/10.1186\/s13677-023-00584-7","relation":{},"ISSN":["2192-113X"],"issn-type":[{"value":"2192-113X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,2,3]]},"assertion":[{"value":"10 October 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"28 December 2023","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"3 February 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"Not applicable.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval and consent to participate"}},{"value":"The authors declare no competing interests.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"31"}}