{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,2]],"date-time":"2026-06-02T09:17:29Z","timestamp":1780391849735,"version":"3.54.1"},"reference-count":49,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2024,2,23]],"date-time":"2024-02-23T00:00:00Z","timestamp":1708646400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100000780","name":"European Commission","doi-asserted-by":"publisher","award":["101020560"],"award-info":[{"award-number":["101020560"]}],"id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>The advent of computer networks and the internet has drastically altered the means by which we share information and interact with each other. However, this technological advancement has also created opportunities for malevolent behavior, with individuals exploiting vulnerabilities to gain access to confidential data, obstruct activity, etc. To this end, intrusion detection systems (IDSs) are needed to filter malicious traffic and prevent common attacks. In the past, these systems relied on a fixed set of rules or comparisons with previous attacks. However, with the increased availability of computational power and data, machine learning has emerged as a promising solution for this task. While many systems now use this methodology in real-time for a reactive approach to mitigation, we explore the potential of configuring it as a proactive time series prediction. In this work, we delve into this possibility further. More specifically, we convert a classic IDS dataset to a time series format and use predictive models to forecast forthcoming malign packets. We propose a new architecture combining convolutional neural networks, long short-term memory networks, and attention. The findings indicate that our model performs strongly, exhibiting an F1 score and AUC that are within margins of 1% and 3%, respectively, when compared to conventional real-time detection. Also, our architecture achieves an \u223c8% F1 score improvement compared to an LSTM (long short-term memory) model.<\/jats:p>","DOI":"10.3390\/fi16030073","type":"journal-article","created":{"date-parts":[[2024,2,23]],"date-time":"2024-02-23T06:07:39Z","timestamp":1708668459000},"page":"73","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":28,"title":["Deep Learning for Intrusion Detection Systems (IDSs) in Time Series Data"],"prefix":"10.3390","volume":"16","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9971-9271","authenticated-orcid":false,"given":"Konstantinos","family":"Psychogyios","sequence":"first","affiliation":[{"name":"Synelixis Solutions S.A., 10 Farmakidou Av., 34100 Chalkida, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1890-5898","authenticated-orcid":false,"given":"Andreas","family":"Papadakis","sequence":"additional","affiliation":[{"name":"Synelixis Solutions S.A., 10 Farmakidou Av., 34100 Chalkida, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6122-4161","authenticated-orcid":false,"given":"Stavroula","family":"Bourou","sequence":"additional","affiliation":[{"name":"Synelixis Solutions S.A., 10 Farmakidou Av., 34100 Chalkida, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nikolaos","family":"Nikolaou","sequence":"additional","affiliation":[{"name":"Synelixis Solutions S.A., 10 Farmakidou Av., 34100 Chalkida, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Apostolos","family":"Maniatis","sequence":"additional","affiliation":[{"name":"Synelixis Solutions S.A., 10 Farmakidou Av., 34100 Chalkida, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2408-4582","authenticated-orcid":false,"given":"Theodore","family":"Zahariadis","sequence":"additional","affiliation":[{"name":"Synelixis Solutions S.A., 10 Farmakidou Av., 34100 Chalkida, Greece"},{"name":"General Department, National and Kapodistrian University of Athens, 15772 Athens, Greece"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2024,2,23]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"1851","DOI":"10.1109\/COMST.2019.2891891","article-title":"A survey on advanced persistent threats: Techniques, solutions, challenges, and research opportunities","volume":"21","author":"Alshamrani","year":"2019","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1186\/s42400-019-0038-7","article-title":"Survey of intrusion detection systems: Techniques, datasets and challenges","volume":"2","author":"Khraisat","year":"2019","journal-title":"Cybersecurity"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"8736","DOI":"10.1021\/acs.chemrev.3c00189","article-title":"Machine learning methods for small data challenges in molecular science","volume":"123","author":"Dou","year":"2023","journal-title":"Chem. Rev."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"21562","DOI":"10.1109\/ACCESS.2023.3251919","article-title":"Missing value imputation methods for electronic health records","volume":"11","author":"Psychogyios","year":"2023","journal-title":"IEEE Access"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Psychogyios, K., Ilias, L., and Askounis, D. (2022, January 27\u201330). Comparison of Missing Data Imputation Methods using the Framingham Heart study dataset. Proceedings of the 2022 IEEE-EMBS International Conference on Biomedical and Health Informatics (BHI), Ioannina, Greece.","DOI":"10.1109\/BHI56158.2022.9926882"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"100256","DOI":"10.1109\/ACCESS.2023.3315235","article-title":"SAMStyler: Enhancing Visual Creativity with Neural Style Transfer and Segment Anything Model (SAM)","volume":"13","author":"Psychogyios","year":"2023","journal-title":"IEEE Access"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"19572","DOI":"10.1109\/ACCESS.2022.3151248","article-title":"Machine learning and deep learning approaches for cybersecuriy: A review","volume":"10","author":"Halbouni","year":"2022","journal-title":"IEEE Access"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"17671","DOI":"10.1021\/acs.est.3c00026","article-title":"Machine learning in environmental research: Common pitfalls and best practices","volume":"57","author":"Zhu","year":"2023","journal-title":"Environ. Sci. Technol."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"538","DOI":"10.1109\/COMST.2022.3233793","article-title":"Adversarial machine learning for network intrusion detection systems: A comprehensive survey","volume":"25","author":"He","year":"2023","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"217","DOI":"10.1007\/s11416-022-00441-2","article-title":"XAI for intrusion detection system: Comparing explanations based on global and local scope","volume":"19","author":"Hariharan","year":"2023","journal-title":"J. Comput. Virol. Hacking Tech."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"930","DOI":"10.11591\/eei.v12i2.4466","article-title":"DDoS attacks detection using machine learning and deep learning techniques: Analysis and comparison","volume":"12","author":"Manickam","year":"2023","journal-title":"Bull. Electr. Eng. Inform."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"110214","DOI":"10.1016\/j.asoc.2023.110214","article-title":"A long-term multivariate time series forecasting network combining series decomposition and convolutional neural networks","volume":"139","author":"Wang","year":"2023","journal-title":"Appl. Soft Comput."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"85","DOI":"10.1016\/j.ins.2023.03.062","article-title":"Deep generation network for multivariate spatio-temporal data based on separated attention","volume":"633","author":"Wang","year":"2023","journal-title":"Inf. Sci."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"107","DOI":"10.1016\/j.neucom.2019.05.023","article-title":"Multiple convolutional neural networks for multivariate time series prediction","volume":"360","author":"Wang","year":"2019","journal-title":"Neurocomputing"},{"key":"ref_15","unstructured":"Tsay, R.S. (2013). Multivariate Time Series Analysis: With R and Financial Applications, John Wiley & Sons."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"12521","DOI":"10.1007\/s10489-022-04100-3","article-title":"Foreformer: An enhanced transformer-based framework for multivariate time series forecasting","volume":"53","author":"Yang","year":"2023","journal-title":"Appl. Intell."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"690","DOI":"10.1177\/0972150920916564","article-title":"Interest rate deregulation, financial development and economic growth: Evidence from Bangladesh","volume":"24","author":"Hossin","year":"2023","journal-title":"Glob. Bus. Rev."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"101996","DOI":"10.1016\/j.jobe.2020.101996","article-title":"Multivariate time series clustering and forecasting for building energy analysis: Application to weather data quality control","volume":"35","author":"Sanhudo","year":"2021","journal-title":"J. Build. Eng."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"1977","DOI":"10.1109\/TII.2022.3198670","article-title":"Multivariate Time-Series Prediction in Industrial Processes via a Deep Hybrid Network Under Data Uncertainty","volume":"19","author":"Yao","year":"2022","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_20","first-page":"2","article-title":"Recurrent neural networks","volume":"5","author":"Medsker","year":"2001","journal-title":"Des. Appl."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Shumway, R.H., Stoffer, D.S., Shumway, R.H., and Stoffer, D.S. (2017). Time Series Analysis and Its Applications: With R Examples, Springer.","DOI":"10.1007\/978-3-319-52452-8"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Le, T.T.H., Oktian, Y.E., and Kim, H. (2022). XGBoost for imbalanced multiclass classification-based industrial internet of things intrusion detection systems. Sustainability, 14.","DOI":"10.3390\/su14148707"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"10344","DOI":"10.1109\/JIOT.2023.3237797","article-title":"Agnostic CH-DT technique for SCADA network high-dimensional data-aware intrusion detection system","volume":"10","author":"Ahakonye","year":"2023","journal-title":"IEEE Internet Things J."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"1839","DOI":"10.1007\/s11277-022-10022-7","article-title":"IoT routing attacks detection using machine learning algorithms","volume":"128","author":"Rabhi","year":"2023","journal-title":"Wirel. Pers. Commun."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"37","DOI":"10.1016\/j.comnet.2018.02.028","article-title":"A hybrid intrusion detection system based on ABC-AFS algorithm for misuse and anomaly detection","volume":"136","author":"Hajisalem","year":"2018","journal-title":"Comput. Netw."},{"key":"ref_26","first-page":"1","article-title":"Deep learning for anomaly detection: A review","volume":"54","author":"Pang","year":"2021","journal-title":"ACM Comput. Surv. CSUR"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"103622","DOI":"10.1016\/j.jnca.2023.103622","article-title":"Scalable anomaly-based intrusion detection for secure Internet of Things using generative adversarial networks in fog environment","volume":"214","author":"Yao","year":"2023","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"3183","DOI":"10.1007\/s10489-022-03412-8","article-title":"Robust anomaly-based intrusion detection system for in-vehicle network by graph neural network framework","volume":"53","author":"Xiao","year":"2023","journal-title":"Appl. Intell."},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_30","unstructured":"Psychogyios, K., Bourou, S., Papadakis, A., Nikolaou, N., and Zahariadis, T. (2023). International Symposium on Distributed Computing and Artificial Intelligence, Springer Nature."},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"3211","DOI":"10.1007\/s11831-020-09496-0","article-title":"A review on machine learning and deep learning perspectives of IDS for IoT: Recent updates, security issues, and challenges","volume":"28","author":"Thakkar","year":"2021","journal-title":"Arch. Comput. Methods Eng."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"1251","DOI":"10.1016\/j.procs.2020.04.133","article-title":"Performance analysis of machine learning algorithms in intrusion detection system: A review","volume":"171","author":"Saranya","year":"2020","journal-title":"Procedia Comput. Sci."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Nikolaou, N., Papadakis, A., Psychogyios, K., and Zahariadis, T. (2023). Vulnerability Identification and Assessment for Critical Infrastructures in the Energy Sector. Electronics, 12.","DOI":"10.3390\/electronics12143185"},{"key":"ref_34","first-page":"3945","article-title":"DeepIoT. IDS: Hybrid deep learning for enhancing IoT network intrusion detection. Computers","volume":"69","author":"Maseer","year":"2021","journal-title":"Mater. Contin."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Sharafaldin, I., Lashkari, A.H., and Ghorbani, A.A. (2018, January 22\u201324). Toward generating a new intrusion detection dataset and intrusion traffic characterization. Proceedings of the 4th International Conference on Information Systems Security and Privacy, Madeira, Portugal.","DOI":"10.5220\/0006639801080116"},{"key":"ref_36","first-page":"107764","article-title":"An intelligent and efficient network intrusion detection system using deep learning","volume":"69","author":"Imran","year":"2022","journal-title":"Comput. Electr. Eng."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"81","DOI":"10.1145\/380995.381030","article-title":"The UCI KDD archive of large data sets for data mining research and experimentation","volume":"2","author":"Bay","year":"2000","journal-title":"Acm Sigkdd Explor. Newsl."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"107810","DOI":"10.1016\/j.compeleceng.2022.107810","article-title":"Anomaly-based intrusion detection system for IoT networks through deep learning model","volume":"99","author":"Saba","year":"2022","journal-title":"Comput. Electr. Eng."},{"key":"ref_39","doi-asserted-by":"crossref","first-page":"779","DOI":"10.1016\/j.future.2019.05.041","article-title":"Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset","volume":"100","author":"Koroniotis","year":"2019","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_40","first-page":"36","article-title":"Performance of machine learning techniques in anomaly detection with basic feature selection strategy\u2014A network intrusion detection system","volume":"13","author":"Pranto","year":"2022","journal-title":"J. Adv. Inf. Technol."},{"key":"ref_41","unstructured":"Tahri, R., Jarrar, A., Lasbahani, A., and Balouki, Y. (July, January 29). A comparative study of Machine learning Algorithms on the UNSW-NB 15 Dataset. Proceedings of the ITM Web of Conferences, Craiova, Romania."},{"key":"ref_42","unstructured":"Anton, S.D., Ahrens, L., Fraunholz, D., and Schotten, H.D. (2018, January 17\u201320). Time is of the essence: Machine learning-based intrusion detection in industrial time series data. Proceedings of the IEEE International Conference on Data Mining Workshops (ICDMW), Singapore."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long Short-term Memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."},{"key":"ref_44","first-page":"1596","article-title":"Multivariate time series imputation with generative adversarial networks","volume":"31","author":"Luo","year":"2018","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Su, Y., Zhao, Y., Niu, C., Liu, R., Sun, W., and Pei, D. (2019, January 4\u20138). Robust anomaly detection for multivariate time series through stochastic recurrent neural network. Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Anchorage, AK, USA.","DOI":"10.1145\/3292500.3330672"},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"123","DOI":"10.1016\/j.jbi.2008.05.003","article-title":"A multivariate time series approach to modeling and forecasting demand in the emergency department","volume":"42","author":"Jones","year":"2009","journal-title":"J. Biomed. Inform."},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"317","DOI":"10.1007\/s41060-022-00349-6","article-title":"Graph neural networks for multivariate time series regression with application to seismic data","volume":"16","author":"Bloemheuvel","year":"2023","journal-title":"Int. J. Data Sci. Anal."},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Gorbett, M., Shirazi, H., and l Ray, I. (2023, January 6\u201310). Sparse Binary Transformers for Multivariate Time Series Modeling. Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, Long Beach, CA, USA.","DOI":"10.1145\/3580305.3599508"},{"key":"ref_49","doi-asserted-by":"crossref","first-page":"9523230","DOI":"10.1155\/2023\/9523230","article-title":"Spatiotemporal Self-Attention-Based LSTNet for Multivariate Time Series Prediction","volume":"2023","author":"Wang","year":"2023","journal-title":"Int. J. Intell. Syst."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/16\/3\/73\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T14:03:39Z","timestamp":1760105019000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/16\/3\/73"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,2,23]]},"references-count":49,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2024,3]]}},"alternative-id":["fi16030073"],"URL":"https:\/\/doi.org\/10.3390\/fi16030073","relation":{},"ISSN":["1999-5903"],"issn-type":[{"value":"1999-5903","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,2,23]]}}}