{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,4]],"date-time":"2026-04-04T06:24:08Z","timestamp":1775283848281,"version":"3.50.1"},"reference-count":34,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2021,11,29]],"date-time":"2021-11-29T00:00:00Z","timestamp":1638144000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2021,11,29]],"date-time":"2021-11-29T00:00:00Z","timestamp":1638144000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Big Data"],"published-print":{"date-parts":[[2021,12]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Network attacks are illegal activities on digital resources within an organizational network with the express intention of compromising systems. A cyber attack can be directed by individuals, communities, states or even from an anonymous source. Hackers commonly conduct network attacks to alter, damage, or steal private data. Intrusion detection systems (IDS) are the best and most effective techniques when it comes to tackle these threats. An IDS is a software application or hardware device that monitors traffic to search for malevolent activity or policy breaches. Moreover, IDSs are designed to be deployed in different environments, and they can either be host-based or network-based. A host-based intrusion detection system is installed on the client computer, while a network-based intrusion detection system is located on the network. IDSs based on deep learning have been used in the past few years and proved their effectiveness. However, these approaches produce a big false negative rate, which impacts the performance and potency of network security. In this paper, a detection model based on long short-term memory (LSTM) and Attention mechanism is proposed. Furthermore, we used four reduction algorithms, namely: Chi-Square, UMAP, Principal Components Analysis (PCA), and Mutual information. In addition, we evaluated the proposed approaches on the NSL-KDD dataset. The experimental results demonstrate that using Attention with all features and using PCA with 03 components had the best performance, reaching an accuracy of 99.09% and 98.49% for binary and multiclass classification, respectively.<\/jats:p>","DOI":"10.1186\/s40537-021-00544-5","type":"journal-article","created":{"date-parts":[[2021,11,29]],"date-time":"2021-11-29T12:02:49Z","timestamp":1638187369000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":54,"title":["IDS-attention: an efficient algorithm for intrusion detection systems using attention mechanism"],"prefix":"10.1186","volume":"8","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-6490-3677","authenticated-orcid":false,"given":"FatimaEzzahra","family":"Laghrissi","sequence":"first","affiliation":[]},{"given":"Samira","family":"Douzi","sequence":"additional","affiliation":[]},{"given":"Khadija","family":"Douzi","sequence":"additional","affiliation":[]},{"given":"Badr","family":"Hssina","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2021,11,29]]},"reference":[{"issue":"2","key":"544_CR1","doi-asserted-by":"publisher","first-page":"222","DOI":"10.1109\/TSE.1987.232894","volume":"SE\u201313","author":"DE Denning","year":"1987","unstructured":"Denning DE. An intrusion-detection model. IEEE Trans Soft Eng. 1987;SE\u201313(2):222\u201332.","journal-title":"IEEE Trans Soft Eng."},{"key":"544_CR2","doi-asserted-by":"publisher","DOI":"10.33166\/aetic.2020.05.004","author":"RA Ramadan","year":"2020","unstructured":"Ramadan RA, Yadav K. A novel hybrid intrusion detection system (IDS) for the detection of internet of things (IoT) network attacks. Ann Emerg Technol Comput. 2020. https:\/\/doi.org\/10.33166\/aetic.2020.05.004.","journal-title":"Ann Emerg Technol Comput"},{"issue":"110145","key":"544_CR3","doi-asserted-by":"publisher","first-page":"0263","DOI":"10.1016\/j.measurement.2021.110145","volume":"186","author":"M Maha","year":"2021","unstructured":"Maha M, Althobaiti K, Mohan KP, Deepak G, Sachin K, Mansour RF. An intelligent cognitive computing based intrusion detection for industrial cyber-physical systems. Measurement. 2021;186(110145):0263\u20132241. https:\/\/doi.org\/10.1016\/j.measurement.2021.110145.","journal-title":"Measurement"},{"key":"544_CR4","first-page":"6689134","volume":"16","author":"A Derhab","year":"2020","unstructured":"Derhab A, Aldweesh A, Emam AZ, Khan FA. Intrusion detection system for internet of things based on temporal convolution neural network and efficient feature engineering. Wireless Commun Mobile Comput. 2020;16:6689134.","journal-title":"Wireless Commun Mobile Comput"},{"issue":"1","key":"544_CR5","doi-asserted-by":"publisher","first-page":"4","DOI":"10.3390\/sym13010004","volume":"13","author":"M Mulyanto","year":"2021","unstructured":"Mulyanto M, Faisal M, Prakosa SW, Leu J-S. Effectiveness of focal loss for minority classification in network intrusion detection systems. Symmetry. 2021;13(1):4. https:\/\/doi.org\/10.3390\/sym13010004.","journal-title":"Symmetry"},{"key":"544_CR6","doi-asserted-by":"publisher","unstructured":"Azmin S, Islam AAABM. A network intrusion detection system based on conditional variational laplace autoEncoder. 7th International Conference on Networking, Systems and Security; 2020. https:\/\/doi.org\/10.1145\/3428363.3428371.","DOI":"10.1145\/3428363.3428371"},{"issue":"107049","key":"544_CR7","doi-asserted-by":"publisher","first-page":"0045","DOI":"10.1016\/j.compeleceng.2021.107049","volume":"91","author":"L Jie","year":"2021","unstructured":"Jie L, Yu ZZ, Wang LH. An intrusion detection method for industrial control systems based on bidirectional simple recurrent unit. Comput Electrical Eng. 2021;91(107049):0045\u20137906. https:\/\/doi.org\/10.1016\/j.compeleceng.2021.107049.","journal-title":"Comput Electrical Eng"},{"key":"544_CR8","doi-asserted-by":"publisher","unstructured":"Mahboob AS, Moghaddam MRO. \u201cAn Anomaly-based Intrusion Detection System Using Butterfly Optimization Algorithm,\u201d 2020 6th Iranian Conference on Signal Processing and Intelligent Systems (ICSPIS), 2020; pp. 1\u20136. https:\/\/doi.org\/10.1109\/ICSPIS51611.2020.9349537.","DOI":"10.1109\/ICSPIS51611.2020.9349537"},{"key":"544_CR9","doi-asserted-by":"publisher","unstructured":"Sahar N, Mishra R, Kalam S. Deep learning approach-based network intrusion detection system for fog-assisted IoT. In: Tiwari S, Suryani E, Ng AK, Mishra KK, Singh N, eds. Proceedings of International Conference on Big Data, Machine Learning and their Applications. Lecture Notes in Networks and Systems, vol 150. 2021; Springer: Singapore. https:\/\/doi.org\/10.1007\/978-981-15-8377-3_4.","DOI":"10.1007\/978-981-15-8377-3_4"},{"key":"544_CR10","doi-asserted-by":"publisher","unstructured":"Khan RU, Zhang X, Alazab M, Kumar R. IEEE 2019 Cybersecurity and Cyberforensics Conference (CCC). Melbourne, Australia (2019.5.8\u20132019.5.9) 2019 Cybersecurity and Cyberforensics Conference (CCC)\u2014an improved convolutional neural network model for intrusion detection in networks. 2019;74\u201377. https:\/\/doi.org\/10.1109\/CCC.2019.000-6.","DOI":"10.1109\/CCC.2019.000-6"},{"key":"544_CR11","doi-asserted-by":"publisher","first-page":"3","DOI":"10.4018\/JITR.2021070102","volume":"14","author":"AK Bediya","year":"2021","unstructured":"Bediya AK, Kumar R. A novel intrusion detection system for internet of things network security. J Inform Technol Res. 2021;14:3. https:\/\/doi.org\/10.4018\/JITR.2021070102.","journal-title":"J Inform Technol Res"},{"issue":"5","key":"544_CR12","doi-asserted-by":"publisher","first-page":"834","DOI":"10.3390\/pr9050834","volume":"9","author":"MA Khan","year":"2021","unstructured":"Khan MA. HCRNNIDS: hybrid convolutional recurrent neural network-based network intrusion detection system. Processes. 2021; 9(5): 834. https:\/\/doi.org\/10.3390\/pr9050834.","journal-title":"Processes"},{"issue":"107044","key":"544_CR13","doi-asserted-by":"publisher","first-page":"0045","DOI":"10.1016\/j.compeleceng.2021.107044","volume":"91","author":"S Thakur","year":"2021","unstructured":"Thakur S, Chakraborty A, De R, Kumar N, Sarkar R. Intrusion detection in cyber-physical systems using a generic and domain specific deep autoencoder model. Comput Electrical Eng. 2021;91(107044):0045\u20137906. https:\/\/doi.org\/10.1016\/j.compeleceng.2021.107044.","journal-title":"Comput Electrical Eng"},{"key":"544_CR14","doi-asserted-by":"publisher","first-page":"594","DOI":"10.1007\/s42452-021-04579-4","volume":"3","author":"R Sekhar","year":"2021","unstructured":"Sekhar R, Sasirekha K, Raja PS, et al. A novel GPU based intrusion detection system using deep autoencoder with Fruitfly optimization. SN Appl Sci. 2021;3:594. https:\/\/doi.org\/10.1007\/s42452-021-04579-4.","journal-title":"SN Appl Sci."},{"key":"544_CR15","doi-asserted-by":"publisher","DOI":"10.18280\/ama_b.631-403","author":"SR Khonde","year":"2020","unstructured":"Khonde SR, Ulagamuthalvi V. An hybrid architecture for distributed intrusion detection system using semi-supervised classifiers in ensemble approach. Adv Model Anal B. 2020. https:\/\/doi.org\/10.18280\/ama_b.631-403.","journal-title":"Adv Model Anal B"},{"issue":"4","key":"544_CR16","doi-asserted-by":"publisher","first-page":"526","DOI":"10.1093\/comjnl\/bxx101","volume":"61","author":"Y Shen","year":"2018","unstructured":"Shen Y, Zheng K, Wu C, Zhang M, Niu X, Yang Y. An ensemble method based on selection using bat algorithm for intrusion detection. Comput J. 2018;61(4):526\u201338.","journal-title":"Comput J."},{"key":"544_CR17","doi-asserted-by":"publisher","DOI":"10.1088\/1757-899x\/993\/1\/012049","author":"M Deepa","year":"2020","unstructured":"Deepa M, Sumitra Dr P. An intrusion detection system using K-means based on cuckoo search optimization. IOP Conf Series Mater Sci Eng. 2020. https:\/\/doi.org\/10.1088\/1757-899x\/993\/1\/012049.","journal-title":"IOP Conf Series Mater Sci Eng."},{"key":"544_CR18","doi-asserted-by":"publisher","unstructured":"Divakar S, Priyadarshini R, Kishore M. \u201cA Robust Intrusion Detection System using Ensemble Machine Learning,\u201d 2020 IEEE International Women in Engineering (WIE) Conference on Electrical and Computer Engineering (WIECON-ECE); 2020. pp. 344\u2013347. https:\/\/doi.org\/10.1109\/WIECON-ECE52138.2020.9397969.","DOI":"10.1109\/WIECON-ECE52138.2020.9397969"},{"issue":"8","key":"544_CR19","doi-asserted-by":"publisher","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","volume":"9","author":"S Hochreiter","year":"1997","unstructured":"Hochreiter S, Schmidhuber J. Long short-term memory\u2019. Neural Comput. 1997;9(8):1735\u201380. https:\/\/doi.org\/10.1162\/neco.1997.9.8.1735.","journal-title":"Neural Comput"},{"key":"544_CR20","doi-asserted-by":"publisher","first-page":"89","DOI":"10.1007\/s10032-020-00350-4","volume":"23","author":"V Carbune","year":"2020","unstructured":"Carbune V, Gonnet P, Deselaers T, et al. Fast multi-language LSTM-based online handwriting recognition. IJDAR. 2020;23:89\u2013102. https:\/\/doi.org\/10.1007\/s10032-020-00350-4.","journal-title":"IJDAR"},{"key":"544_CR21","doi-asserted-by":"publisher","first-page":"378","DOI":"10.1007\/s11704-018-8030-z","volume":"14","author":"W Ying","year":"2020","unstructured":"Ying W, Zhang L, Deng H. Sichuan dialect speech recognition with deep LSTM network. Front Comput Sci. 2020;14:378\u201387. https:\/\/doi.org\/10.1007\/s11704-018-8030-z.","journal-title":"Front Comput Sci."},{"key":"544_CR22","doi-asserted-by":"publisher","unstructured":"Preethi D, Khare N. EFS-LSTM (Ensemble-Based Feature Selection With LSTM) classifier for Intrusion Detection System. IJEC 16.4. 2020; pp. 72\u201386. Web. 4 May 2021. https:\/\/doi.org\/10.4018\/IJeC.2020100106.","DOI":"10.4018\/IJeC.2020100106"},{"key":"544_CR23","doi-asserted-by":"publisher","first-page":"246","DOI":"10.1007\/s11263-020-01374-3","volume":"129","author":"AB Vasudevan","year":"2021","unstructured":"Vasudevan AB, Dai D, Van Gool L. Talk2Nav: long-range vision-and-language navigation with dual attention and spatial memory. Int J Comput Vis. 2021;129:246\u201366. https:\/\/doi.org\/10.1007\/s11263-020-01374-3.","journal-title":"Int J Comput Vis"},{"key":"544_CR24","doi-asserted-by":"publisher","first-page":"33654","DOI":"10.1109\/ACCESS.2021.3059806","volume":"9","author":"L Bian","year":"2021","unstructured":"Bian L, Zhang L, Zhao K, Wang H, Gong S. Image-based scam detection method using an attention capsule network. IEEE Access. 2021;9:33654\u201365. https:\/\/doi.org\/10.1109\/ACCESS.2021.3059806.","journal-title":"IEEE Access"},{"key":"544_CR25","unstructured":"Bahdanau D, Cho K, Bengio Y. Neural machine translation by jointly learning to align and translate. ArXiv.1409; 2014"},{"key":"544_CR26","doi-asserted-by":"publisher","first-page":"861","DOI":"10.21105\/joss.00861","volume":"3","author":"M Leland","year":"2018","unstructured":"Leland M, John H, Nathaniel S, Lukas G. UMAP: uniform manifold approximation and projection. J Open Source Softw. 2018;3: 861. https:\/\/doi.org\/10.21105\/joss.00861.","journal-title":"J Open Source Softw"},{"issue":"1","key":"544_CR27","doi-asserted-by":"publisher","first-page":"59","DOI":"10.2307\/1402731","volume":"51","author":"R Plackett","year":"1983","unstructured":"Plackett R. Karl Pearson and the Chi-Squared test. Int Stat Rev Revue Internationale De Statistique. 1983;51(1):59\u201372. https:\/\/doi.org\/10.2307\/1402731.","journal-title":"Int Stat Rev Revue Internationale De Statistique"},{"key":"544_CR28","doi-asserted-by":"publisher","unstructured":"Cover TM, Thomas JA. Information theory and statistics. In: Elements of information theory, 2nd edn. Wiley; 2005. https:\/\/doi.org\/10.1002\/047174882X.ch11.","DOI":"10.1002\/047174882X.ch11"},{"key":"544_CR29","unstructured":"NSL-KDD Dataset. https:\/\/www.unb.ca\/cic\/datasets\/nsl.html."},{"key":"544_CR30","unstructured":"KDDCUP99 Dataset. http:\/\/kdd.ics.uci.edu\/databases\/kddcup99\/."},{"key":"544_CR31","doi-asserted-by":"crossref","unstructured":"Tavallaee M, Bagheri E, Lu W, Ghorbani A. \u201cA detailed analysis of the KDD CUP 99 Data Set,\u201d Submitted to Second IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA); 2009.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"544_CR32","doi-asserted-by":"publisher","first-page":"51","DOI":"10.1016\/j.neucom.2019.11.016","volume":"387","author":"C Ieracitano","year":"2020","unstructured":"Ieracitano C, Adeel A, Morabito FC, Hussain A. A novel statistical analysis and autoencoder driven intelligent intrusion detection approach. Neurocomputing. 2020;387:51\u201362. https:\/\/doi.org\/10.1016\/j.neucom.2019.11.016.","journal-title":"Neurocomputing"},{"key":"544_CR33","doi-asserted-by":"publisher","first-page":"29575","DOI":"10.1109\/ACCESS.2020.2972627","volume":"8","author":"T Su","year":"2020","unstructured":"Su T, Sun H, Zhu J, Wang S, Li Y. BAT: deep learning methods on network intrusion detection using NSL-KDD dataset. IEEE Access. 2020;8:29575\u201385. https:\/\/doi.org\/10.1109\/ACCESS.2020.2972627.","journal-title":"IEEE Access"},{"issue":"2019","key":"544_CR34","doi-asserted-by":"publisher","first-page":"1561","DOI":"10.1016\/j.procs.2020.03.367","volume":"167","author":"S Choudhary","year":"2020","unstructured":"Choudhary S, Kesswani N. Analysis of KDD-Cup\u201999, NSL-KDD and UNSW-NB15 datasets using deep learning in IoT. Procedia Comput Sci. 2020;167(2019):1561\u201373. https:\/\/doi.org\/10.1016\/j.procs.2020.03.367.","journal-title":"Procedia Comput Sci"}],"container-title":["Journal of Big Data"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s40537-021-00544-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s40537-021-00544-5\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s40537-021-00544-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,11,29]],"date-time":"2021-11-29T12:16:16Z","timestamp":1638188176000},"score":1,"resource":{"primary":{"URL":"https:\/\/journalofbigdata.springeropen.com\/articles\/10.1186\/s40537-021-00544-5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,11,29]]},"references-count":34,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2021,12]]}},"alternative-id":["544"],"URL":"https:\/\/doi.org\/10.1186\/s40537-021-00544-5","relation":{},"ISSN":["2196-1115"],"issn-type":[{"value":"2196-1115","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,11,29]]},"assertion":[{"value":"23 August 2021","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"16 November 2021","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"29 November 2021","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The author confirms the sole responsibility for this manuscript. The author read and approved the final manuscript","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval and consent to participate"}},{"value":"Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article\u2019s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article\u2019s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit .","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Consent for publication"}},{"value":"The authors declare that they have no competing interests.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"149"}}