Pith. sign in

REVIEW 4 major objections 4 minor 59 references

CITADEL: Continual Anomaly Detection for Enhanced Learning in IoT Intrusion Detection

T0 review · 4 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read CITADEL keeps IoT intrusion detectors from forgetting old attacks

desk verdict A reasonable continual-anomaly-detection pipeline, but the task-construction protocol leaks test data into the curriculum, so the headline lifelong-learning numbers are not trustworthy as evidence. read the letter →

arxiv 2508.19450 v1 pith:CGILQV6O submitted 2025-08-26 cs.CR

Elvin Li , Onat Gungor , Zhengli Shang , Tajana Rosing This is my paper
classification cs.CR
keywords continuallearninganomalydetectionintrusionself-supervisedcatastrophicforgettingIoTsecuritymaskedautoencoderLocalOutlierFactor
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

CITADEL tries to show that a self-supervised continual learning system can detect new IoT attacks without forgetting old ones, and without ever needing labels for attack traffic. The system learns a representation of normal behavior from benign data only, then uses a memory buffer that drops and adds samples by matching feature distributions through KL-divergence optimization, organized into drift-severity levels. On six intrusion datasets it reports an average lifelong precision-recall AUC of 70.60%, positive backward transfer of 20.76%, forward transfer of 70.05%, and up to a 72.9 percentage-point gain in backward transfer over VLAD on CIC-IDS 2017. If these numbers hold in genuinely online deployment, continual intrusion detection could update from unlabeled benign streams while retaining detection of previously seen attack types.

What carries the argument

The load-bearing mechanism is the KL-divergence-based strategic sampling and forgetting loop. Each feature is binned into histograms; a weight vector over memory samples is optimized so the weighted histogram of the buffer approaches the histogram of incoming data, and samples with low weight are dropped; a second optimization weights incoming samples and the k most representative are added. A hierarchical memory then assigns the updated buffer to levels according to a Kolmogorov-Smirnov drift-severity score, with geometrically decaying size allocations, so highly drifted concepts get less space. This mechanism is what the paper credits for retaining old-task detection while absorbing new be

What would settle it

Define tasks online from only the data seen so far (for example, cluster arriving benign traffic into concepts as it streams and hold out future samples for testing), then rerun CITADEL and compare lifelong PR-AUC, backward transfer, and forward transfer with the paper's numbers. If backward transfer drops to near zero or negative, the retention result depends on pre-clustered task structure rather than on the memory mechanism itself.

Watch

Extended reading notes

Core claim

The paper's central claim is that catastrophic forgetting in label-free anomaly detection can be substantially mitigated by coupling a masked autoencoder with a KL-divergence-driven memory. Tabular network features are reduced by PCA, mapped to 8x8 images with t-SNE-based DeepInsight, and used to train a masked autoencoder on benign samples only; the encoder's latent features feed a Local Outlier Factor detector. When new data arrives, a Kolmogorov-Smirnov test measures drift, a temporary copy of the memory buffer is pruned via a weight optimization that minimizes KL divergence between binned feature histograms, k new samples are selected the same way, and the result is placed in a hierarchi

Load-bearing premise

The evaluation clusters the full dataset, including the 30% portion later used for testing, into concepts and pairs them by centroids to decide task order, so the test data influence which tasks exist and when they arrive; if future concepts are not knowable in advance, the reported lifelong metrics may be optimistic.

Editorial extensions

If this is right

  • An IDS built this way could update continuously on unlabeled benign traffic, removing the need to manually label each new attack campaign.
  • Previously seen attack types should remain detectable after learning new concepts, because backward transfer is positive instead of negative.
  • Zero-day detection can benefit from forward transfer: the model's average forward transfer of 70% suggests earlier concepts speed up detection on later ones.
  • The reported per-sample inference cost of 0.0493 ms on X-IIoTID is small relative to typical flow durations, suggesting compatibility with resource-constrained IoT settings.
  • The evaluations span both IoT-specific and general intrusion benchmarks, indicating the pipeline is not tied to one traffic profile.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: The reported gains are measured on tasks built by clustering the complete dataset, including the 30% test split, and ordering concepts by centroid distance; on a truly online stream where future concepts are unknown, the KL-based memory updates may not reproduce the same positive backward transfer.
  • Inference: Because the KL optimization matches each feature's marginal histogram independently, it may preserve marginals while losing joint feature correlations; a multivariate or copula-based memory objective could be tested against CITADEL to see whether marginal-only matching is the active ingredient.
  • Inference: Since CITADEL is trained exclusively on benign data and detects anomalies by local density in latent space, an adversarial attack that maps close to benign image representations could evade detection; testing CITADEL against adversarial perturbations of the tabular features would clarify this boundary.
  • Inference: The largest improvement over VLAD appears on CIC-IDS 2017, where VLAD's backward transfer is most negative; this suggests memory management yields the biggest payoff under severe drift, which could be tested by estimating drift severity per dataset and correlating it with backward-transfer gain.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes CITADEL, a continual anomaly-detection framework for IoT intrusion detection. It combines a tabular-to-image transformation, a masked autoencoder trained on benign data, a Local Outlier Factor novelty detector, and a continual-learning memory module that performs KL-divergence-based strategic sampling/forgetting together with a hierarchical memory. The authors evaluate on six intrusion datasets and report average lifelong PR-AUC of 70.60%, backward transfer of 20.76%, and forward transfer of 70.05%, with a claimed BWT improvement of up to 72.9 percentage points over VLAD on CIC-IDS 2017.

Significance. If the results were validated, the paper would address a practically important problem: label-efficient, continually adapting intrusion detection. The combination of self-supervised representation learning with a memory-based continual-learning mechanism is a sensible direction, and the inference-overhead analysis is a useful addition. However, the evaluation protocol has a serious test-information leakage problem, and several components of the method are underspecified or internally inconsistent. These issues currently prevent the central empirical claims from being accepted.

major comments (4)
  1. [Section III.B.1, Algorithm 1, Section IV.A.3] Concept construction leaks test information. The complete dataset D is partitioned into normal and anomaly subsets and clustered by k-means before the 70/30 train/test split; the normal-anomaly pairing then uses centroids computed on the full D. Consequently, the task definitions and their presentation order are inferred from the same data later used for testing. This does not model an online stream where future task structure is unknown. The comparison to baselines is internally consistent, but the reported LL PR-AUC, BWT, and FWT cannot support the real-world continual-learning claim. Please re-run with clustering and matching performed only on training portions (or a temporal split) and report whether the VLAD margin survives.
  2. [Section III.A.4 vs. Section IV.A.3] The method is described as label-free and trained exclusively on benign data, but tasks are defined as T_train^i = phi_train^i ∪ gamma_train^i, i.e., including attack samples, and the text states that only T_train^t is used for model update. Clarify whether attack labels are used to train SAFE/LOF or only for evaluation. If attack data are used for model updates, the self-supervised, no-label claim in the abstract is not supported; if they are not used, specify how gamma_train participates in training.
  3. [Section III.B.2] The forgetting optimization constrains wf ∈ [0.5,1]^l, but the text then drops samples with wf_i^* < 0.5. Under the stated constraint, no sample can be dropped. This is not merely a typo: the memory-update mechanism depends on removing low-weight samples. Correct the constraint/decision rule and re-evaluate the affected experiments.
  4. [Section IV.A.4 and Section III.B.2] Several control parameters of the CL mechanism are unspecified or described only as 'selected through rigorous analysis': γ and Lmin in the level mapping, the number of histogram bins b, the exact iterative optimizer for the two KL problems, and stopping criteria. Moreover, Tables V–VII report single-run results without seed variation or confidence intervals. Please provide these details and repeat runs to establish that the reported margins are not noise.
minor comments (4)
  1. [Figure 7, Table IV, Table III] Figure 7 and Table IV include Edge-IIoTset, but Table III and Section IV.B list only six datasets. Reconcile this discrepancy and add the missing dataset description/citation.
  2. [Figure 7] The figure caption/axis labels contain garbled model names (e.g., 'SAFE ICLSLAD RDP Anomal-E'); clean up the typesetting.
  3. [Table VIII] Table VIII refers to 'X-IIoT dataset' while the rest of the paper uses 'X-IIoTID'; standardize the name.
  4. [Abstract and Section III.B.2] The abstract contains a spacing typo ('V AE'); also, in the sampling objective, specify whether the histograms are normalized to densities before averaging.

Circularity Check

1 steps flagged · score 5.0 of 10

Task construction uses the held-out test data, making the lifelong evaluation circular; the method itself is not a fitted tautology.

  1. self definitional [Section III.B.1 (Concept Creation / Algorithm 1) and Section IV.A.3 (Concept Creation Setup)]
    "To represent this in our experiments, the dataset D is first partitioned into normal samples Dnorm and anomaly samples Danom... Both subsets are clustered into c disjoint concepts using k-means clustering... we apply a greedy matching procedure that pairs each normal concept with its closest anomaly concept based on the Euclidean distance between their centroids. ... each matched pair Ti = (ϕi, γi) in T1, . . . ,T5 is partitioned into training and testing subsets in a 70/30 ratio."

    Algorithm 1 runs on the complete D before the 70/30 split, so the k-means centroids, concept boundaries, and centroid-distance task order are computed with the test 30% already included. The test samples (ϕtest_i, γtest_i) are then used to compute LL PR-AUC, BWT, and FWT on tasks whose feature distributions were used to define those tasks. Thus the 'new concept stream' is not an unseen future; it is reverse-engineered from the evaluation data. The reported lifelong metrics are therefore not an out-of-sample prediction of adaptation to unknown drift, but an in-sample measure of a curriculum constructed from the test set.

full rationale

CITADEL's internal derivation (KL-divergence sampling/forgetting, hierarchical memory, MAE+LOF) is not circular by itself: the objectives minimize histogram KL divergence between new data and buffer, and the reported metrics are genuine empirical outputs. The main circularity is at the evaluation-protocol level. Section III.B.1 and Algorithm 1 define concepts by k-means over the entire dataset, including the 30% later held out; Section IV.A.3 then splits each matched concept 70/30. This means the test data help determine the concept geometry and task order, so the lifelong results are partially self-fulfilling. This affects all baselines equally, so the relative ranking may survive, but the paper's real-world 'continually evolving stream' claim is not supported by the current protocol. A secondary non-circular bug: Section III.B.2 constrains wf to [0.5,1]^l and then drops samples with wf_i<0.5, which is impossible; this is a correctness inconsistency, not a circular reduction. The self-citation of the SAFE backbone is not load-bearing in a circular way because the paper re-evaluates SAFE in-paper against external baselines. Score 5 reflects partial circularity: the central evaluation reduces to a curriculum constructed from the test set, though the method itself is not a fitted tautology.

Assumptions & free parameters 11 free parameters · 4 assumptions · 0 invented entities

The method introduces no new physical entities, but it depends on a large set of user-chosen hyperparameters and on several untested modeling assumptions. The high free-parameter count and the absence of sensitivity analyses make it hard to separate genuine capability from tuning to the specific benchmarks.

free parameters (11)
  • PCA explained variance threshold = 95%
    Used to select the number of principal components M for feature ranking; chosen without sensitivity analysis.
  • number of selected features k = 31
    Top 31 features retained after PCA-based ranking; fixed across datasets.
  • image matrix dimension d' = 8x8
    All feature vectors converted to 8x8 grayscale images; no ablation.
  • MAE mask ratio = 75%
    Fraction of image patches masked during training; fixed, no sensitivity study.
  • MAE training epochs = 20
    Training length fixed; no early stopping or variation reported.
  • number of concepts c = 5
    Each dataset partitioned into five concepts for task construction.
  • memory buffer capacity l = 5000
    Fixed replay buffer size for all datasets and methods.
  • forgetting and sampling quota k = 1000
    Number of samples dropped and added at each update; set identically for all datasets.
  • histogram bins b = unspecified
    Number of bins used to estimate feature distributions in the KL objectives; not reported, so the optimization is underspecified.
  • level mapping parameters (Lmin, gamma) and lambda = lambda=5.5, Lmin and gamma not reported
    Control hierarchical memory level assignment and memory allocation; no sensitivity analysis is presented.
  • weight lower bound 0.5 = 0.5
    Lower bound in the forgetting weight optimization and threshold for dropping samples; in practice the rule reduces to dropping the k lowest-weighted samples because all weights are >= 0.5.
assumptions (4)
  • domain assumption t-SNE projection used by DeepInsight preserves enough structure in the feature space to make the resulting image matrices meaningful for masked autoencoders.
    The entire image-based representation learning rests on this premise, which is not proven for tabular network data. It is adopted from prior work [44].
  • ad hoc to paper Optimizing KL divergence between binned feature histograms is a sufficient proxy for preserving old-task detection performance.
    The memory update objective is assumed to reduce catastrophic forgetting in the MAE+LOF model, but this connection is not validated directly; it is only evaluated through the final metrics.
  • domain assumption LOF on the MAE latent space will separate novel attacks from benign representations.
    This is a standard anomaly detection assumption, evaluated only indirectly through the benchmarks and not stress-tested against different latent geometries.
  • ad hoc to paper k-means clustering on the full dataset produces concepts that represent meaningful task boundaries for continual learning.
    Used to create the task stream in Algorithm 1. Because the clustering is performed on the complete dataset including the test split, it can leak test information into the task definitions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CITADEL: Continual Anomaly Detection for Enhanced Learning in IoT Intrusion Detection." pith.science (2026). https://pith.science/paper/CGILQV6O

@misc{pith2026250819450,
  author       = {Pith},
  title        = {Pith review of: CITADEL: Continual Anomaly Detection for Enhanced Learning in IoT Intrusion Detection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CGILQV6O}},
  note         = {Machine review of arXiv:2508.19450}
}
read the original abstract

The Internet of Things (IoT), with its high degree of interconnectivity and limited computational resources, is particularly vulnerable to a wide range of cyber threats. Intrusion detection systems (IDS) have been extensively studied to enhance IoT security, and machine learning-based IDS (ML-IDS) show considerable promise for detecting malicious activity. However, their effectiveness is often constrained by poor adaptability to emerging threats and the issue of catastrophic forgetting during continuous learning. To address these challenges, we propose CITADEL, a self-supervised continual learning framework designed to extract robust representations from benign data while preserving long-term knowledge through optimized memory consolidation mechanisms. CITADEL integrates a tabular-to-image transformation module, a memory-aware masked autoencoder for self-supervised representation learning, and a novelty detection component capable of identifying anomalies without dependence on labeled attack data. Our design enables the system to incrementally adapt to emerging behaviors while retaining its ability to detect previously observed threats. Experiments on multiple intrusion datasets demonstrate that CITADEL achieves up to a 72.9% improvement over the VAE-based lifelong anomaly detector (VLAD) in key detection and retention metrics, highlighting its effectiveness in dynamic IoT environments.

Figures

Figures reproduced from arXiv: 2508.19450 by the authors.

Figure 1
Figure 1. State-of-the-art supervised ML intrusion detection [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Forgetting performance of state-of-the-art models [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Proposed Anomaly Detection Framework (CITADEL). Upon detecting drift in incoming data, a temporary memory [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Self-supervised Learning Component (SAFE) [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: CITADEL Continual Learning Component incorporates concept creation, strategic sampling and forget￾ting mechanisms, and a hierarchical memory architecture. Our CL component is memory-based and designed to retain representative information over time. It maintains a compa…
Figure 6
Figure 6. Figure 6: Selected image matrices of normal (top) and attack [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: State-of-the-art Precision and Recall Comparison [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]
Figure 8
Figure 8. Figure 8: Top 5 models averaged across datasets based on (top) [PITH_FULL_IMAGE:figures/full_fig_p009_8.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

59 extracted references · 50 canonical work pages

  1. [1]

    Unleashing the power of iot: A comprehensive review of iot applications and future prospects in healthcare, agriculture, smart homes, smart cities, and industry 4.0,

    R. Chataut, A. Phoummalayvane, and R. Akl, “Unleashing the power of iot: A comprehensive review of iot applications and future prospects in healthcare, agriculture, smart homes, smart cities, and industry 4.0,” Sensors, vol. 23, no. 16, p. 7194, 2023

    work page 2023

  2. [2]

    Security and privacy for low power iot devices on 5g and beyond networks: Challenges and future directions,

    J. Cook, S. U. Rehman, and M. A. Khan, “Security and privacy for low power iot devices on 5g and beyond networks: Challenges and future directions,” IEEE Access, vol. 11, pp. 39 295–39 317, 2023

    work page 2023

  3. [3]

    A survey on intelligent internet of things: Applications, security, privacy, and future directions,

    O. Aouedi et al., “A survey on intelligent internet of things: Applications, security, privacy, and future directions,” IEEE communications surveys & tutorials, 2024

    work page 2024

  4. [4]

    Rigorous evaluation of machine learning-based intrusion detection against adversarial attacks,

    O. Gungor, E. Li, Z. Shang, Y . Guo, J. Chen, J. Davis, and T. Rosing, “Rigorous evaluation of machine learning-based intrusion detection against adversarial attacks,” in 2024 IEEE International Conference on Cyber Security and Resilience (CSR) . IEEE, 2024, pp. 152–158

    work page 2024

  5. [5]

    Roldef: Robust layered defense for intrusion detection against adversarial attacks,

    O. Gungor, T. Rosing, and B. Aksanli, “Roldef: Robust layered defense for intrusion detection against adversarial attacks,” in 2024 Design, Automation & Test in Europe Conference & Exhibition (DATE) . IEEE, 2024, pp. 1–6

    work page 2024

  6. [6]

    A survey on deep learning for cybersecurity: Progress, challenges, and opportunities,

    M. Macas, C. Wu, and W. Fuertes, “A survey on deep learning for cybersecurity: Progress, challenges, and opportunities,” Computer Networks, vol. 212, p. 109032, 2022

    work page 2022

  7. [7]

    Online self-supervised deep learning for in- trusion detection systems,

    M. Nakıp and E. Gelenbe, “Online self-supervised deep learning for in- trusion detection systems,” IEEE Transactions on Information Forensics and Security, 2024

    work page 2024

  8. [8]

    Anomal-e: A self- supervised network intrusion detection system based on graph neural networks,

    E. Caville, W. W. Lo, S. Layeghy, and M. Portmann, “Anomal-e: A self- supervised network intrusion detection system based on graph neural networks,” Knowledge-Based Systems, vol. 258, p. 110030, 2022

    work page 2022

Show all 59 references
  1. [9]

    Contrastive learning enhanced intrusion detection,

    Y . Yue, X. Chen, Z. Han, X. Zeng, and Y . Zhu, “Contrastive learning enhanced intrusion detection,” IEEE Transactions on Network and Service Management, vol. 19, no. 4, pp. 4232–4247, 2022

    2022

  2. [10]

    Ts-ids: Traffic-aware self-supervised learn- ing for iot network intrusion detection,

    H. Nguyen and R. Kashef, “Ts-ids: Traffic-aware self-supervised learn- ing for iot network intrusion detection,” Knowledge-Based Systems, vol. 279, p. 110966, 2023

    2023

  3. [11]

    Intrusion detection in the iot under data and concept drifts: Online deep learning approach,

    O. A. Wahab, “Intrusion detection in the iot under data and concept drifts: Online deep learning approach,” IEEE Internet of Things Journal, vol. 9, no. 20, pp. 19 706–19 716, 2022

    2022

  4. [12]

    Continual learning: Applications and the road forward,

    E. Verwimp et al. , “Continual learning: Applications and the road forward,” arXiv preprint arXiv:2311.11908 , 2023

    2023 arXiv

  5. [13]

    A continual learning survey: Defying forgetting in classification tasks,

    M. De Lange et al., “A continual learning survey: Defying forgetting in classification tasks,” IEEE transactions on pattern analysis and machine intelligence, vol. 44, no. 7, pp. 3366–3385, 2021

    2021

  6. [14]

    A comprehensive survey of continual learning: theory, method and application,

    L. Wang, X. Zhang, H. Su, and J. Zhu, “A comprehensive survey of continual learning: theory, method and application,” IEEE Transactions on Pattern Analysis and Machine Intelligence , 2024. 12

    2024

  7. [15]

    On handling class imbalance in continual learning based network intrusion detection systems,

    S. K. Amalapuram, T. T. Reddy, S. S. Channappayya, and B. R. Tamma, “On handling class imbalance in continual learning based network intrusion detection systems,” in Proceedings of the First International Conference on AI-ML Systems , 2021, pp. 1–7

    2021

  8. [16]

    Lifelong continual learning for anomaly detection: New challenges, perspectives, and insights,

    K. Faber, R. Corizzo, B. Sniezynski, and N. Japkowicz, “Lifelong continual learning for anomaly detection: New challenges, perspectives, and insights,” IEEE Access, vol. 12, pp. 41 364–41 380, 2024

    2024

  9. [17]

    Learning without forgetting: A new framework for network cyber security threat detection,

    R. R. Karn, P. Kudva, and I. M. Elfadel, “Learning without forgetting: A new framework for network cyber security threat detection,” IEEE Access, vol. 9, pp. 137 042–137 062, 2021

    2021

  10. [18]

    Continual learning with strategic selection and forgetting for network intrusion detection,

    X. Zhang, R. Zhao, Z. Jiang, H. Chen, Y . Ding, E. C. Ngai, and S.- H. Yang, “Continual learning with strategic selection and forgetting for network intrusion detection,” arXiv preprint arXiv:2412.16264 , 2024

    2024 arXiv

  11. [19]

    Analysis of continual learning models for intrusion detection system,

    S. Prasath et al. , “Analysis of continual learning models for intrusion detection system,” IEEE Access, vol. 10, pp. 121 444–121 464, 2022

    2022

  12. [20]

    Augmented memory replay-based continual learning approaches for network intrusion detection,

    S. Channappayya et al. , “Augmented memory replay-based continual learning approaches for network intrusion detection,” Advances in Neu- ral Information Processing Systems , vol. 36, pp. 17 156–17 169, 2023

    2023

  13. [21]

    Cnd-ids: Continual novelty detection for intrusion detection systems,

    S. Fuhrman, O. Gungor, and T. Rosing, “Cnd-ids: Continual novelty detection for intrusion detection systems,” arXiv preprint arXiv:2502.14094, 2025

    2025 arXiv

  14. [22]

    Vlad: Task-agnostic vae-based lifelong anomaly detec- tion,

    K. Faber et al., “Vlad: Task-agnostic vae-based lifelong anomaly detec- tion,” Neural Networks, vol. 165, pp. 248–273, 2023

    2023

  15. [23]

    Securing constrained iot systems: A lightweight machine learning approach for anomaly detection and prevention,

    Z. Alwaisi, T. Kumar, E. Harjula, and S. Soderi, “Securing constrained iot systems: A lightweight machine learning approach for anomaly detection and prevention,” Internet of Things , vol. 28, p. 101398, 2024

    2024

  16. [24]

    Intrusion detection systems for the internet of thing: a survey study,

    H. A. Hassan et al., “Intrusion detection systems for the internet of thing: a survey study,” Wireless Personal Communications, vol. 128, no. 4, pp. 2753–2778, 2023

    2023

  17. [25]

    Deep learning for intrusion detection and security of internet of things (iot): current analysis, challenges, and possible solutions,

    A. R. Khan, M. Kashif, R. H. Jhaveri, R. Raut, T. Saba, and S. A. Bahaj, “Deep learning for intrusion detection and security of internet of things (iot): current analysis, challenges, and possible solutions,” Security and Communication Networks, vol. 2022, no. 1, p. 4016073, 2022

    2022

  18. [26]

    Dynamite: Dy- namic defense selection for enhancing machine learning-based intrusion detection against adversarial attacks,

    J. Chen, O. Gungor, Z. Shang, E. Li, and T. Rosing, “Dynamite: Dy- namic defense selection for enhancing machine learning-based intrusion detection against adversarial attacks,” in2025 IEEE Security and Privacy Workshops (SPW). IEEE, 2025, pp. 213–219

    2025

  19. [27]

    Testing the performance of multi-class ids public dataset using supervised machine learning algorithms,

    V . Malele and T. E. Mathonsi, “Testing the performance of multi-class ids public dataset using supervised machine learning algorithms,” arXiv preprint arXiv:2302.14374, 2023

    2023 arXiv

  20. [28]

    Towards model generalization for intrusion detec- tion: Unsupervised machine learning techniques,

    M. Verkerken et al., “Towards model generalization for intrusion detec- tion: Unsupervised machine learning techniques,” Journal of Network and Systems Management , vol. 30, pp. 1–25, 2022

    2022

  21. [29]

    En- hancing iot network security: Unveiling the power of self-supervised learning against ddos attacks,

    J. G. Almaraz-Rivera, J. A. Cantoral-Ceballos, and J. F. Botero, “En- hancing iot network security: Unveiling the power of self-supervised learning against ddos attacks,” Sensors, vol. 23, no. 21, p. 8701, 2023

    2023

  22. [30]

    Safe: Self-supervised anomaly detection framework for intrusion detection,

    E. Li, Z. Shang, O. Gungor, and T. Rosing, “Safe: Self-supervised anomaly detection framework for intrusion detection,” arXiv preprint arXiv:2502.07119, 2025

    2025 arXiv

  23. [31]

    A cookbook of self-supervised learning,

    R. Balestriero, M. Ibrahim, V . Sobal, A. Morcos, S. Shekhar, T. Gold- stein, F. Bordes, A. Bardes, G. Mialon, Y . Tian et al., “A cookbook of self-supervised learning,” arXiv preprint arXiv:2304.12210 , 2023

    2023 arXiv

  24. [32]

    Self-supervised learning for anomaly detection in iot networks,

    H. Kour, P. Bavadiya, and S. Kumar, “Self-supervised learning for anomaly detection in iot networks,” in 2025 3rd International Con- ference on Advancement in Computation & Computer Technologies (InCACCT). IEEE, 2025, pp. 644–648

    2025

  25. [33]

    Malicious traffic identification with self-supervised contrastive learning,

    J. Yang et al. , “Malicious traffic identification with self-supervised contrastive learning,” Sensors, vol. 23, no. 16, p. 7215, 2023

    2023

  26. [34]

    Robust unsuper- vised network intrusion detection with self-supervised masked context reconstruction,

    W. Wang, S. Jian, Y . Tan, Q. Wu, and C. Huang, “Robust unsuper- vised network intrusion detection with self-supervised masked context reconstruction,” Computers & Security , vol. 128, p. 103131, 2023

    2023

  27. [35]

    A review of local outlier factor algorithms for outlier detection in big data streams,

    O. Alghushairy, R. Alsini, T. Soule, and X. Ma, “A review of local outlier factor algorithms for outlier detection in big data streams,” Big Data and Cognitive Computing , vol. 5, no. 1, p. 1, 2020

    2020

  28. [36]

    Isolation forest based anomaly detection: A systematic literature review,

    W. S. Al Farizi, I. Hidayah, and M. N. Rizal, “Isolation forest based anomaly detection: A systematic literature review,” in 2021 8th Interna- tional Conference on Information Technology, Computer and Electrical Engineering (ICITACEE). IEEE, 2021, pp. 118–122

    2021

  29. [37]

    Deep isolation forest for anomaly detection,

    H. Xu et al. , “Deep isolation forest for anomaly detection,” IEEE Transactions on Knowledge and Data Engineering , vol. 35, no. 12, pp. 12 591–12 604, 2023

    2023

  30. [38]

    Mitigating catastrophic forgetting in online continual learning by mod- eling previous task interrelations via pareto optimization,

    Y . Wu, H. Wang, P. Zhao, Y . Zheng, Y . Wei, and L.-K. Huang, “Mitigating catastrophic forgetting in online continual learning by mod- eling previous task interrelations via pareto optimization,” in Forty-first International Conference on Machine Learning , 2024

    2024

  31. [39]

    A multi-class intrusion detection system based on continual learning,

    C. Oikonomou et al., “A multi-class intrusion detection system based on continual learning,” in 2023 IEEE International Conference on Cyber Security and Resilience (CSR) . IEEE, 2023, pp. 86–91

    2023

  32. [40]

    Aug- mented memory replay-based continual learning approaches for network intrusion detection,

    S. kumar Amalapuram, S. S. Channappayya, and B. Tamma, “Aug- mented memory replay-based continual learning approaches for network intrusion detection,” in Thirty-seventh Conference on Neural Information Processing Systems, 2023

    2023

  33. [41]

    Unsupervised continual learning in streaming environments,

    A. Ashfahani and M. Pratama, “Unsupervised continual learning in streaming environments,” IEEE transactions on neural networks and learning systems, vol. 34, no. 12, pp. 9992–10 003, 2022

    2022

  34. [42]

    Efficient mae towards large-scale vision transformers,

    Q. Han, G. Zhang, J. Huang, P. Gao, Z. Wei, and S. Lu, “Efficient mae towards large-scale vision transformers,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , 2024, pp. 606–615

    2024

  35. [43]

    Feature selection using principal component analysis,

    F. Song et al. , “Feature selection using principal component analysis,” in 2010 international conference on system science, engineering design and manufacturing informatization , vol. 1. IEEE, 2010, pp. 27–30

    2010

  36. [44]

    Deepinsight- convolutional neural network for intrusion detection systems,

    T. P. Tran, V . C. Nguyen, L. Vu, and Q. U. Nguyen, “Deepinsight- convolutional neural network for intrusion detection systems,” in 2021 8th NAFOSTED Conference on Information and Computer Science (NICS), 2021, pp. 120–125

    2021

  37. [45]

    Visualizing data using t-sne

    L. Van der Maaten and G. Hinton, “Visualizing data using t-sne.” Journal of machine learning research , vol. 9, no. 11, 2008

    2008

  38. [46]

    Outlier detection using isolation forest and local outlier factor,

    Z. Cheng, C. Zou, and J. Dong, “Outlier detection using isolation forest and local outlier factor,” in Proceedings of the conference on research in adaptive and convergent systems , 2019, pp. 161–168

    2019

  39. [47]

    Lifelong continual learning for anomaly detection: New challenges, perspectives, and insights,

    K. Faber, R. Corizzo, B. Sniezynski, and N. Japkowicz, “Lifelong continual learning for anomaly detection: New challenges, perspectives, and insights,” IEEE Access , vol. 12, p. 41364–41380, 2024. [Online]. Available: http://dx.doi.org/10.1109/ACCESS.2024.3377690

    2024

  40. [48]

    Kolmogorov–smirnov test: Overview,

    V . W. Berger and Y . Zhou, “Kolmogorov–smirnov test: Overview,”Wiley statsref: Statistics reference online , 2014

    2014

  41. [49]

    Mqttset, a new dataset for machine learning techniques on mqtt,

    I. Vaccari, G. Chiola, M. Aiello, M. Mongelli, and E. Cambiaso, “Mqttset, a new dataset for machine learning techniques on mqtt,” Sensors, vol. 20, no. 22, p. 6578, 2020

    2020

  42. [50]

    Wustl-iiot-2021 dataset for iiot cybersecurity research,

    M. Zolanvari et al. , “Wustl-iiot-2021 dataset for iiot cybersecurity research,” Washington University in St. Louis, USA , 2021

    2021

  43. [51]

    X-iiotid: A connectivity-agnostic and device- agnostic intrusion data set for industrial internet of things,

    M. Al-Hawawreh et al., “X-iiotid: A connectivity-agnostic and device- agnostic intrusion data set for industrial internet of things,”IEEE Internet of Things Journal , vol. 9, no. 5, pp. 3962–3977, 2021

    2021

  44. [52]

    Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set),

    N. Moustafa and J. Slay, “Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set),” in 2015 military communications and information systems conference (MilCIS). IEEE, 2015, pp. 1–6

    2015

  45. [53]

    Toward generating a new intrusion detection dataset and intrusion traffic characterization,

    I. Sharafaldin et al. , “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in International Conference on Information Systems Security and Privacy , 2018. [Online]. Available: https://api.semanticscholar.org/CorpusID:4707749

    2018

  46. [54]

    Isolation forest,

    F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in 2008 eighth ieee international conference on data mining. IEEE, 2008, pp. 413–422

    2008

  47. [55]

    Scalable and interpretable one-class svms with deep learning and random fourier features,

    M.-N. Nguyen and N. A. Vien, “Scalable and interpretable one-class svms with deep learning and random fourier features,” in Machine Learning and Knowledge Discovery in Databases: European Confer- ence, ECML PKDD 2018, Dublin, Ireland, September 10–14, 2018, Proceedings, Part I...

    2018

  48. [56]

    Fascinating supervisory signals and where to find them: Deep anomaly detection with scale learning,

    H. Xu, Y . Wang, J. Wei, S. Jian, Y . Li, and N. Liu, “Fascinating supervisory signals and where to find them: Deep anomaly detection with scale learning,” in International Conference on Machine Learning . PMLR, 2023, pp. 38 655–38 673

    2023

  49. [57]

    Anomaly detection for tabular data with internal contrastive learning,

    T. Shenkar and L. Wolf, “Anomaly detection for tabular data with internal contrastive learning,” in International Conference on Learning Representations, 2022

    2022

  50. [58]

    Rca: A deep collaborative autoencoder approach for anomaly detection,

    B. Liu, D. Wang, K. Lin, P.-N. Tan, and J. Zhou, “Rca: A deep collaborative autoencoder approach for anomaly detection,” in IJCAI: proceedings of the conference , vol. 2021, 2021, p. 1505

    2021

  51. [59]

    Unsupervised representation learning by predicting random distances,

    H. Wang et al. , “Unsupervised representation learning by predicting random distances,” arXiv preprint arXiv:1912.12186 , 2019

    1912 arXiv

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.