Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

LENS-XAI: Redefining Lightweight and Explainable Network Security through Knowledge Distillation and Variational Autoencoders for Scalable Intrusion Detection in Cybersecurity

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read LENS-XAI claims that a VAE-based teacher–student pipeline with attribution explainability reaches state-of-the-art intrusion detection accuracy on four benchmarks while training on 10% of the data.

desk verdict The 10%-data training claim is contradicted by the paper's own Algorithm 2, so the headline accuracies are unsupported as written, despite solid organization and useful engineering detail. read the letter →

arxiv 2501.00790 v2 pith:F72NUVHW submitted 2025-01-01 cs.CR cs.AIcs.CYcs.ET

Muhammet Anil Yagiz , Polat Goktas This is my paper · ORCID
classification cs.CRcs.AIcs.CYcs.ET
keywords intrusiondetectionknowledgedistillationvariationalautoencoderexplainableAIIndustrialInternetofThingsnetworksecurityteacher-studentmodelfeatureattribution
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes LENS-XAI, a lightweight intrusion detection pipeline that combines a variational autoencoder (VAE) with knowledge distillation and an attribution-based explainability step. The central claim is that this pipeline reaches state-of-the-art detection accuracy on four benchmark network datasets while being trained on only 10% of the available labeled data and producing feature-level explanations for each prediction. If the claim holds, resource-constrained IoT and edge deployments could get accurate, interpretable detectors without large labeled training sets. The reported accuracies are 95.34% on Edge-IIoTset, 99.92% on UKM20, 98.42% on CTU-13, and 99.34% on NSL-KDD, with the distilled student model staying close to or above the teacher while using fewer parameters and less inference time.

What carries the argument

The load-bearing mechanism is a three-stage pipeline: a VAE encoder compresses each input into a low-dimensional latent representation; a high-capacity teacher model is trained on those embeddings; and a compact student model learns to match the teacher's temperature-softened output distribution (Equation 3) while also fitting hard labels. The distillation temperature $T=2$ and mixing weight $\alpha=0.5$ control how much soft versus hard signal the student receives. Explainability comes from a variable-attribution decomposition (Equations 4–8) that expresses a prediction as a baseline plus sequential marginal contributions of features, with a two-step heuristic ordering to reduce order sensitivity. This attribution step is what turns the detector's decisions into per-feature explanations for analysts.

What would settle it

Train the VAE, teacher, and student strictly on the 10% partition described in Section 3.6, keep the remaining 90% completely untouched during training, and re-report the four accuracies; if the numbers fall materially below 95.34%, 99.92%, 98.42%, and 99.34%, the central claim is not supported.

Watch

Extended reading notes

Core claim

On its own terms, LENS-XAI is a claim that one architecture can jointly deliver data efficiency, lightweight operation, and explainability for intrusion detection. The teacher model trains on VAE latent embeddings, and the student is distilled from it using temperature-scaled soft targets; variable attribution then breaks each prediction into baseline plus per-feature contributions. Across the four datasets, the framework reports the four accuracies above, with the student model cutting parameter counts substantially and reducing per-batch inference time while keeping accuracy within a fraction of a point (and on NSL-KDD exceeding the teacher). The paper presents this as outperforming the state-of-the-art baselines it compares against on each dataset.

Load-bearing premise

The 10%-data claim collapses if the model components were trained on the full dataset before the 90%/10% split, and the paper's own Algorithm 2 plus Section 3.4.1 both suggest they were.

Editorial extensions

If this is right

  • If the 10%-training result is real, intrusion detection systems could be deployed in settings with very few labeled attack samples.
  • The distilled student model's parameter and inference-time reductions make the approach feasible on edge hardware without sacrificing much accuracy.
  • Feature-level attributions allow security analysts to inspect why a flow was flagged, addressing the black-box objection to deep-learning IDS.
  • The same VAE-plus-distillation pattern could be transferred to other anomaly detection domains where labeled data is scarce.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A strict reading of Algorithm 2 suggests the VAE and distillation steps occur before the 10/90 split, so the data-efficiency advantage may be smaller than advertised; rerunning with a genuine 10% training partition would settle this.
  • The attribution method's dependence on feature ordering means explanations are heuristic; different orderings could change which features appear responsible for a prediction.
  • Because the reported performance on rare attack classes such as SQL Injection and U2R is much lower than the aggregate accuracy, the headline numbers mainly reflect frequent classes; a deployment-focused evaluation should weight rare attacks separately.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes LENS-XAI, a framework that combines variational autoencoders, knowledge distillation, and variable-attribution-based explainability for network intrusion detection in IIoT and edge environments. The central claim is that the framework achieves state-of-the-art performance (95.34% on Edge-IIoTset, 99.92% on UKM20, 98.42% on CTU-13, and 99.34% on NSL-KDD) while training on only 10% of the available data. The methodology describes preprocessing, VAE latent representation learning, teacher-student distillation with a 10/90 train/test split, and attribution-based explanations. The evaluation compares the teacher and student models against several baselines across four datasets and reports complexity, inference time, and explainability results.

Significance. If the results were valid, the paper would offer a practically relevant lightweight IDS with a clear integration of VAE-based representation learning, knowledge distillation, and XAI, and the 10%-data training claim would be noteworthy for resource-constrained deployment. The paper also provides an explicit pipeline in Algorithm 2, which is helpful for reproducibility assessment, and it reports a full ablation-free comparison across several public datasets. However, the central empirical claim is not supported by the experimental protocol as described: the pipeline appears to train the VAE, teacher, and student on the full dataset before the 10/90 split, which makes the reported accuracies upper bounds on a genuinely 10%-trained system. Because the main contribution of the paper is empirical, this flaw undermines the significance of the reported results.

major comments (4)
  1. [Algorithm 2, Steps 2-3 and 5; Section 3.4.1] The reported results do not support the claim of training on 10% of the data. Algorithm 2 trains the VAE on mini-batches sampled from the full merged dataset D in Step 2, trains the teacher on all latent embeddings {z} from D and trains the student on the same full-D latent embeddings in Step 3, and only in Step 5 partitions the data into 10% for training and 90% for testing. Section 3.4.1 explicitly states that the teacher is 'Trained on the full dataset.' This means test instances contribute to the VAE's latent space, the teacher's soft targets, and the student's distillation objective before any evaluation is performed. Section 3.6's description of a 'stringent partition' is therefore internally inconsistent with the pipeline in Algorithm 2, and the accuracies in Tables 3-9 cannot be interpreted as the performance of a model trained on 10% of the data.
  2. [Section 4.3.4 and Section 4.2 (NSL-KDD)] The evaluation on NSL-KDD uses a random 10/90 split of the full dataset, whereas the standard NSL-KDD protocol uses the fixed KDDTrain+ and KDDTest+ subsets, as the paper itself notes in Section 4.2. Comparisons with prior results trained and tested on the official split (RNN-IDS, MCNN-DFS, etc. in Table 8) are not valid under a different, nonstandard split. The paper does not report the class distribution of the 10% training partition, so it is unclear whether rare classes like U2R are present at all in training; the very low U2R accuracy (37.14% for the teacher, 23.80% for the student in Table 9) is consistent with a training partition that largely omits or underrepresents that class. The protocol needs to be clarified and, if a nonstandard split is used, justified with the class breakdown.
  3. [Abstract and Conclusion vs. Tables 3, 5, 7, 8] The headline accuracy figures mix teacher and student results without attribution. The 95.34% on Edge-IIoTset, 99.92% on UKM20, and 98.42% on CTU-13 are teacher-model results (Tables 3, 5, and 7), while the 99.34% on NSL-KDD is the student-model result (Table 8; the teacher achieves 98.66%). The abstract and conclusion present these four numbers as a single claim for the framework, which obscures which model is being claimed as the lightweight deployable system. Since the paper argues that the student model is the efficient solution, the student's per-dataset accuracy should be reported consistently and separately.
  4. [Section 4.1, Eq. (2) and Eq. (3)] The framework's central efficiency and performance claims are not supported by any sensitivity analysis or hyperparameter selection procedure. The hyperparameters beta, latent dimension k, temperature T, distillation weight alpha, training epochs, and train_fraction are set to single values without a validation-based criterion or an ablation study. In particular, the observation that the student occasionally outperforms the teacher (e.g., Edge-IIoTset F1 in Table 3 and NSL-KDD accuracy in Table 8) is unexpected under standard knowledge distillation and is not explained. The paper should provide a parameter study or, at minimum, state how these values were chosen and whether performance is stable under small perturbations.
minor comments (5)
  1. [Abstract and Section 4.3] The order of the four datasets in the abstract and conclusion ('Edge-IIoTset, UKM20, CTU-13, NSL-KDD') matches the results order, but the reader must reconstruct which number belongs to which model; please state explicitly, e.g., 'teacher model on Edge-IIoTset, student model on NSL-KDD.'
  2. [Section 1 and throughout] The text contains typographical and formatting issues, including 'artifical intelligence' in the introduction and 'V AEs' with a space throughout; these should be corrected for consistency.
  3. [Section 4.3.4, Table 8] The table caption and the surrounding text use both 'LENS-XAI' and 'LENSXAI' inconsistently; the same applies to 'Teacher' vs. 'T eacher' in Table 4.
  4. [Section 5.3 (Limitations)] The limitations section discusses dependence on labeled data and explainability overhead, but it does not acknowledge the apparent leakage of test data into the training pipeline described in Algorithm 2, nor does it discuss the discrepancy between the 10%-data claim and the full-data teacher training described in Section 3.4.1.
  5. [Algorithm 1] The variable attribution algorithm defines conditional expectations over partially specified feature subsets, but the practical implementation of these expectations (e.g., using background data, a surrogate model, or approximations) is not described; please specify how Equation (6) is computed in the experiments.

Circularity Check

1 steps flagged · score 6.0 of 10

Algorithm 2 fits scaler, VAE, teacher, and student on the full dataset before the 10/90 split, so the headline 10%-data accuracies are in-sample fit quality, not measured generalization.

  1. fitted input called prediction [Algorithm 2 (Steps 2, 3, 5); Section 3.4.1; Section 3.6; Abstract]
    "Teacher Model: Trained on the full dataset (or its latent representations) to achieve high accuracy. [§3.4.1] ... Step 2: for each mini-batch x sampled from D do ... Update network parameters ϕ and θ via backpropagation ... Step 3: Train teacher model ft on latent embeddings {z} ... Train student model fs ... Step 5: Partition the data: 10% for training, 90% for testing. Use student model fs to predict anomaly scores ŷs(x). [Alg. 2] ... By leveraging a training set comprising 10% of the available data, the framework optimizes computational efficiency without sacrificing performance. [Abstract]"

    The Abstract's central claim is that 10% of the available data suffices for competitive accuracy, and Section 3.6 promises a 'stringent partition' (10% train / 90% test). The accuracies reported in Section 4.3 are produced by Algorithm 2, whose ordering makes that regime impossible: Step 1 fits the Standard Scaler on the full merged dataset D, Step 2 trains the VAE on mini-batches sampled from D, Step 3 trains the teacher on latent embeddings {z} of D and then distills to the student, and only Step 5 partitions into 10% train / 90% test.

full rationale

One step rises to circularity: the headline 10%-data claim. Algorithm 2 trains the VAE (Step 2) and the teacher/student pair (Step 3) on the full dataset D, and Section 3.4.1 states the teacher is 'Trained on the full dataset'; the 10/90 partition occurs only in Step 5 (with Step 4 even referring to 'test sample xtest' before the split exists). Consequently, the 'test' rows' latent embeddings and labels entered every fitted component, and the Section 4.3 accuracies offered as evidence for the Abstract's 'training set comprising 10% of the available data' are the fit quality of models that consumed the full data including the evaluation rows. This is the fitted-input-called-prediction pattern: the derived quantity (generalization under a 10%-data regime) is, by the algorithm's own construction, in-sample accuracy of full-data training. The self-citation to the authors' prior KD-XVAE [23] (Section 2.4) is noticeable but not load-bearing: the architecture follows the external, standard KD/VAE literature (Hinton [32], Kingma [31]), [23] is a published peer-reviewed workshop artifact, and the benchmark comparisons (Tables 3-9) are made against external baselines not derived from this paper's constants. The attribution decomposition (Eqs. 4-8, Algorithm 1) is the standard local-accuracy identity; contributions are defined to sum to the prediction, presented as methodology rather than as a derived result, so it is not a circular step. No uniqueness theorem or ansatz is smuggled via self-citation. Section 5.3's admitted 'Dependence on Labeled Data' sits uneasily beside the 10%-data claim and is consistent with the full-data protocol actually executed. Had the pipeline genuinely fit scaler, VAE, teacher, and student on the 10% partition before scoring the holdout, the numbers would be independent empirical claims; as written, the paper's central efficiency claim is unsupported by its own protocol, giving partial circularity (6) rather than a clean 0-2.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new scientific entity or mechanism. It relies on standard components plus a set of unstated architecture and hyperparameter choices. The most consequential item is the training protocol: the algorithm trains on the full merged dataset before splitting, which is a free design choice that breaks the claimed 10% training regime.

free parameters (6)
  • train_fraction = 0.10
    The 10/90 split is a design choice claimed to stress-test generalization; no evidence shows it is optimal and Algorithm 2 contradicts it.
  • beta (VAE KL weight) = not reported
    Eq. (2) includes beta-weighted KL divergence, but no beta value, schedule, or selection procedure is given.
  • latent dimension k = not reported
    VAE encoder and decoder architecture is unspecified; the latent dimensionality controls what information is available to the downstream teacher and student.
  • temperature T = 2
    Knowledge distillation temperature in Eq. (3) is fixed to 2 in Section 4.1 without sensitivity analysis.
  • distillation weight alpha = 0.5
    Knowledge distillation hard and soft label balance is fixed to 0.5 without sensitivity analysis.
  • training epochs per dataset = 100 to 500
    Epoch counts differ by dataset; no early stopping criterion or validation-based selection is reported.
assumptions (5)
  • domain assumption Benchmark datasets faithfully represent IIoT and network attack distributions.
    The generalization claims rest on four public datasets being representative; Section 5.3 acknowledges dynamic threat profiles are not covered.
  • domain assumption Preprocessing, including imputation, one-hot encoding, and z-score scaling, preserves class structure and does not leak information across the split.
    The paper describes preprocessing before the 10/90 split, so scaled statistics may use test data; no safeguards are described.
  • domain assumption A teacher trained on the full dataset can be distilled into a student that retains accuracy on the same distribution.
    Section 3.4.1 states the teacher is trained on the full dataset, yet Section 3.6 claims a 10% training set; the compatibility of these statements is assumed without evidence.
  • domain assumption Variational autoencoder latent representations are sufficient for downstream intrusion classification.
    Section 3.3 assumes anomalies manifest in latent space, but no evaluation isolates whether VAE features or raw features drive performance.
  • standard math VAE reparameterization and standard knowledge distillation losses are as in Kingma and Welling [31] and Hinton et al. [32].
    Used in Eqs. (2) and (3); no derivation is given, but these are textbook results.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LENS-XAI: Redefining Lightweight and Explainable Network Security through Knowledge Distillation and Variational Autoencoders for Scalable Intrusion Detection in Cybersecurity." pith.science (2026). https://pith.science/paper/F72NUVHW

@misc{pith2026250100790,
  author       = {Pith},
  title        = {Pith review of: LENS-XAI: Redefining Lightweight and Explainable Network Security through Knowledge Distillation and Variational Autoencoders for Scalable Intrusion Detection in Cybersecurity},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/F72NUVHW}},
  note         = {Machine review of arXiv:2501.00790}
}
read the original abstract

The rapid proliferation of Industrial Internet of Things (IIoT) systems necessitates advanced, interpretable, and scalable intrusion detection systems (IDS) to combat emerging cyber threats. Traditional IDS face challenges such as high computational demands, limited explainability, and inflexibility against evolving attack patterns. To address these limitations, this study introduces the Lightweight Explainable Network Security framework (LENS-XAI), which combines robust intrusion detection with enhanced interpretability and scalability. LENS-XAI integrates knowledge distillation, variational autoencoder models, and attribution-based explainability techniques to achieve high detection accuracy and transparency in decision-making. By leveraging a training set comprising 10% of the available data, the framework optimizes computational efficiency without sacrificing performance. Experimental evaluation on four benchmark datasets: Edge-IIoTset, UKM-IDS20, CTU-13, and NSL-KDD, demonstrates the framework's superior performance, achieving detection accuracies of 95.34%, 99.92%, 98.42%, and 99.34%, respectively. Additionally, the framework excels in reducing false positives and adapting to complex attack scenarios, outperforming existing state-of-the-art methods. Key strengths of LENS-XAI include its lightweight design, suitable for resource-constrained environments, and its scalability across diverse IIoT and cybersecurity contexts. Moreover, the explainability module enhances trust and transparency, critical for practical deployment in dynamic and sensitive applications. This research contributes significantly to advancing IDS by addressing computational efficiency, feature interpretability, and real-world applicability. Future work could focus on extending the framework to ensemble AI systems for distributed environments, further enhancing its robustness and adaptability.

Figures

Figures reproduced from arXiv: 2501.00790 by the authors.

Figure 1
Figure 1. Class distribution of Edge-IIoTset dataset. [PITH_FULL_IMAGE:figures/full_fig_p019_1.png] view at source ↗
Figure 2
Figure 2. Class distribution of UKM20 dataset. • Normal Traffic: 53,314 instances, • Attack Traffic: 38,898 instances. NSL-KDD Dataset. The NSL-KDD dataset is a refined version of the KDD Cup 1999 dataset, addressing redundancy and imbalance issues. It provides labeled network traffic with 43 features, including protocol type, service, flag, and attack labels. The dataset includes separate training (KD￾DTrain+) and testing (K… view at source ↗
Figure 3
Figure 3. Class distribution of NSL-KDD dataset. Multi-class Classification Results. • Accuracy: The LENS-XAI Teacher model achieved the highest accu￾racy of 95.34%, slightly outperforming the Student model at 95.31%, as well as other models such as NIDS-BAI (94.7%) and BGA (94.2%) [38]. These results highlight the robustness of the framework in han￾dling complex IoT-specific attack scenarios. • Precision and Recall: The Teac… view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Confusion matrices of the LENS-XAI framework on the Edge-IIoTSet dataset: [PITH_FULL_IMAGE:figures/full_fig_p024_4.png]
Figure 5
Figure 5. Figure 5: Confusion matrices of the LENS-XAI framework on the UKM IDS20 dataset: [PITH_FULL_IMAGE:figures/full_fig_p026_5.png]
Figure 6
Figure 6. Figure 6: Confusion matrices of the LENS-XAI framework on the CTU-13 dataset: [PITH_FULL_IMAGE:figures/full_fig_p029_6.png]
Figure 7
Figure 7. Figure 7: Confusion matrices of the LENS-XAI framework on the NSL-KDD dataset: [PITH_FULL_IMAGE:figures/full_fig_p031_7.png]
Figure 8
Figure 8. Figure 8: Variable attribution-based explainability results for the CTU-13 dataset, high [PITH_FULL_IMAGE:figures/full_fig_p035_8.png]
Figure 9
Figure 9. Figure 9: Variable attribution-based explainability results for the UKM20 dataset (binary [PITH_FULL_IMAGE:figures/full_fig_p036_9.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Enhancing IoT Network Security through Adaptive Curriculum Learning and XAI

    cs.CR 2025-01 conditional novelty 4.0 of 10

    A curriculum-learning neural network with LIME feature un-learning and ensemble stacking reports 97 to 98 percent accuracy on Edge-IIoT, CIC-APT-IIoT-2024, and CIC-IoV-2024 intrusion detection benchmarks.

Reference graph

Works this paper leans on

57 extracted references · 39 canonical work pages · cited by 1 Pith paper

  1. [1]

    Alrashdi, K

    I. Alrashdi, K. M. Sallam, M. A. Alrowaily, O. Alruwaili, B. Arain, Fidwatch: Federated incremental distillation for continuous monitoring of iot security threats, Ad Hoc Networks 165 (2024) 103637. doi:10. 1016/j.adhoc.2024.103637

    work page arXiv 2024

  2. [2]

    Ullah, S

    F. Ullah, S. Ullah, G. Srivastava, J. C.-W. Lin, Ids-int: Intrusion de- tection system using transformer-based transfer learning for imbalanced network traffic, Digital Communications and Networks 10 (1) (2024) 190–204. doi:10.1016/j.dcan.2023.03.008

    work page doi:10.1016/j.dcan.2023.03.008 2024

  3. [3]

    E. C. Nkoro, J. N. Njoku, C. I. Nwakanma, J.-M. Lee, D.-S. Kim, Zero- trust marine cyberdefense for iot-based communications: An explainable approach, Electronics (Switzerland) 13 (2) (2024) 276. doi:10.3390/ electronics13020276

    work page 2024

  4. [4]

    Fatema, M

    K. Fatema, M. Anannya, S. K. Dey, C. Su, R. Mazumder, Securing networks: A deep learning approach with explainable ai (xai) and fed- erated learning for intrusion detection, in: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Vol. 15215 LNCS, 2025, pp. 260–275. doi:10.10...

    work page doi:10.1007/978-981-97-8540-7_16 2025

  5. [5]

    Kumar, A

    R. Kumar, A. Aljuhani, D. Javeed, P. Kumar, S. Islam, A. K. M. N. Islam, Blockchain and explainable ai for enhanced decision making in cyber threat detection, Software - Practice and Experience 54 (8) (2024) 1337–1360. doi:10.1002/spe.3319. 43

    work page doi:10.1002/spe.3319 2024

  6. [6]

    Javeed, T

    D. Javeed, T. Gao, P. Kumar, S. Shoukat, I. Ahmad, R. Kumar, An intelligent and interpretable intrusion detection system for unmanned aerial vehicles, in: IEEE International Conference on Communications, 2024, pp. 1951–1956. doi:10.1109/ICC51166.2024.10622703

    arXiv 2024

  7. [7]

    Bellegdi, A

    S. Bellegdi, A. Selamat, S. O. Olatunji, H. Fujita, O. Krejcar, Explain- able machine learning for intrusion detection 14748 LNAI (2024) 122–

    work page 2024

  8. [8]

    Gaspar, P

    D. Gaspar, P. Silva, C. Silva, Explainable ai for intrusion detection systems: Lime and shap applicability on multi-layer perceptron, IEEE Access 12 (2024) 30164–30175. doi:10.1109/ACCESS.2024.3368377

    work page arXiv 2024

Show all 57 references
  1. [9]

    Nalini, B

    M. Nalini, B. Yamini, P. Sinthia, S. Praveena Rachel Kamala, Deep- roughnetid: A robust framework for network anomaly intrusion detec- tion with high detection rates, IETE Journal of Research 70 (9) (2024) 7137–7148. doi:10.1080/03772063.2024.2350932

    2024

  2. [10]

    Krishnaveni, S

    S. Krishnaveni, S. Sivamohan, B. Jothi, T. M. Chen, M. Sathiya- narayanan, Twinsec-ids: An enhanced intrusion detection system in sdn-digital-twin-based industrial cyber-physical systems, Concurrency and Computation: Practice and Experience (2024). doi:10.1002/cpe. 8334

    2024 doi

  3. [11]

    Alzu’bi, O

    A. Alzu’bi, O. Darwish, A. Albashayreh, Y. Tashtoush, Cyberattack event logs classification using deep learning with semantic feature anal- ysis, Computers and Security 150 (2025) 104222.doi:10.1016/j.cose. 2024.104222

    2025

  4. [12]

    Walczyna, D

    T. Walczyna, D. Jankowski, Z. Piotrowski, Enhancing anomaly de- tection through latent space manipulation in autoencoders: A com- parative analysis, Applied Sciences 15 (1) (2024) 286. doi:10.3390/ app15010286

    2024

  5. [13]

    AL-Essa, G

    M. AL-Essa, G. Andresini, A. Appice, D. Malerba, Panacea: A neural model ensemble for cyber-threat detection, Machine Learning 113 (8) (2024) 5379–5422. doi:10.1007/s10994-023-06470-2

    2024 doi

  6. [14]

    Y. K. Saheed, J. E. Chukwuere, Xaiensembletl-iov: A new explainable artificial intelligence ensemble transfer learning for zero-day botnet at- 44 tack detection in the internet of vehicles, Results in Engineering 24 (2024) 103171. doi:10.1016/j.rineng.2024.103171

    2024

  7. [15]

    S. R. Sindiramutty, C. E. Tan, S. P. Lau, R. Thangaveloo, A. H. Gharib, Explainable ai for cybersecurity, Advances in Explainable AI Applica- tions for Smart Cities (2024) 31–97.doi:10.4018/978-1-6684-6361-1. ch002

    2024 doi

  8. [16]

    S. R. Alotaibi, H. K. Alkahtani, M. Aljebreen, A. Alshuhail, M. K. Saeed, S. A. Ebad, W. S. Almukadi, M. Alotaibi, Explainable artificial intelligence in web phishing classification on secure iot with cloud-based cyber-physical systems, Alexandria Engineering Journal 110 (2025) 490–

    2025

  9. [17]

    R. Zhao, Y. Chen, Y. Wang, Y. Shi, Z. Xue, An efficient and lightweight approach for intrusion detection based on knowledge distillation, in: Proceedings of the IEEE International Conference on Communications, 2021, pp. 1–8. doi:10.1109/ICC42927.2021.9500574

    2021

  10. [18]

    Y. Chen, S. Al-Rubaye, A. Tsourdos, L. Baker, C. Gillingham, Differentially-private federated intrusion detection via knowledge dis- tillation in third-party iot systems of smart airports, IEEE Interna- tional Conference on Communications 2023-May (2023) 603–608. doi: 10.1109/...

    2023

  11. [19]

    Bacevicius, A

    M. Bacevicius, A. Paulauskaite-Taraseviciene, Machine learning algo- rithms for raw and unbalanced intrusion detection data in a multi-class classification problem, Applied Sciences (Switzerland) 13 (2023) 7328. doi:10.3390/app13127328

    2023 doi

  12. [20]

    S. Roy, J. Li, V. Pandey, Y. Bai, An explainable deep neural frame- work for trustworthy network intrusion detection, in: Proceedings of the 2022 10th IEEE International Conference on Mobile Cloud Com- puting, Services, and Engineering (MobileCloud), 2022, pp. 25–30. doi:10.11...

    2022

  13. [21]

    Ahmed, Z

    U. Ahmed, Z. Jiangbin, A. Almogren, S. Khan, M. T. Sadiq, A. Al- tameem, A. U. Rehman, Explainable ai-based innovative hybrid ensem- ble model for intrusion detection, Journal of Cloud Computing 13 (1) (2024) 150. doi:10.1186/s13677-024-00712-x . 45

    2024 doi

  14. [22]

    Moustafa, N

    N. Moustafa, N. Koroniotis, M. Keshk, A. Y. Zomaya, Z. Tari, Explain- able intrusion detection for cyber defences in the internet of things: Op- portunities and solutions, IEEE Communications Surveys and Tutorials 25 (3) (2023) 1775–1807. doi:10.1109/COMST.2023.3280465

    2023

  15. [23]

    M. A. Yagiz, P. MohajerAnsari, M. D. Pes´ e, P. Goktas, Transform- ing in-vehicle network intrusion detection: Vae-based knowledge dis- tillation meets explainable ai, in: Proceedings of the Sixth Workshop on CPS&IoT Security and Privacy, ACM, 2024, pp. 93–103. doi: 10.1145/36...

    2024

  16. [24]

    T.-T.-H. Le, R. W. Wardhani, D. S. C. Putranto, U. Jo, H. Kim, To- ward enhanced attack detection and explanation in intrusion detection system-based iot environment data, IEEE Access 11 (2023) 131661– 131676. doi:10.1109/ACCESS.2023.3336678

    2023

  17. [25]

    Kostopoulos, D

    N. Kostopoulos, D. Kalogeras, D. Pantazatos, M. Grammatikou, V. Maglaris, Shap interpretations of tree and neural network dns clas- sifiers for analyzing dga family characteristics, IEEE Access 11 (2023) 61144–61160. doi:10.1109/ACCESS.2023.3286313

    2023

  18. [26]

    M. M. Shtayat, M. K. Hasan, R. Sulaiman, S. Islam, A. U. R. Khan, An explainable ensemble deep learning approach for intrusion detection in industrial internet of things, IEEE Access 11 (2023) 115047–115061. doi:10.1109/ACCESS.2023.3323573

    2023

  19. [27]

    Sivamohan, S

    S. Sivamohan, S. Sridhar, S. Krishnaveni, Tea-ekho-ids: An intrusion detection system for industrial cps with trustworthy explainable ai and enhanced krill herd optimization, Peer-to-Peer Networking and Appli- cations 16 (4) (2023) 1993–2021. doi:10.1007/s12083-023-01507-8

    2023 doi

  20. [28]

    Hattak, G

    A. Hattak, G. Iadarola, F. Martinelli, F. Mercaldo, A. Santone, A method for robust and explainable image-based network traffic clas- sification with deep learning, in: Proceedings of the International Conference on Security and Cryptography, 2023, pp. 385–393. doi: 10.5220/00...

    2023 doi

  21. [29]

    Arisdakessian, O

    S. Arisdakessian, O. A. Wahab, A. Mourad, H. Otrok, M. Guizani, A survey on iot intrusion detection: Federated learning, game theory, so- cial psychology, and explainable ai as future directions, IEEE Internet 46 of Things Journal 10 (5) (2023) 4059–4092. doi:10.1109/JIOT.2022...

    2023 doi

  22. [30]

    Kumar, A

    R. Kumar, A. Aljuhani, D. Javeed, P. Kumar, S. Islam, A. N. Islam, Dig- ital twins-enabled zero touch network: A smart contract and explainable ai integrated cybersecurity framework, Future Generation Computer Systems 156 (2024) 191–205. doi:10.1016/j.future.2024.02.015

    2024 doi

  23. [31]

    D. P. Kingma, M. Welling, Auto-encoding variational bayes, in: Inter- national Conference on Learning Representations (ICLR), 2014. URL https://arxiv.org/abs/1312.6114

    2014 arXiv

  24. [32]

    Hinton, O

    G. Hinton, O. Vinyals, J. Dean, Distilling the knowledge in a neural net- work, in: NIPS Deep Learning and Representation Learning Workshop, Curran Associates, Inc., 2015. URL https://arxiv.org/abs/1503.02531

    2015 arXiv

  25. [33]

    Gosiewska, P

    A. Gosiewska, P. Biecek, ibreakdown: Uncertainty of model explana- tions for non-additive predictive models, arXiv (2019). URL https://arxiv.org/abs/1903.11420v1

    2019 arXiv

  26. [34]

    Robnik- ˇSikonja, I

    M. Robnik- ˇSikonja, I. Kononenko, Explaining classifications for individ- ual instances, IEEE Transactions on Knowledge and Data Engineering 20 (5) (2008) 589–600. doi:10.1109/tkde.2007.190734

    2008

  27. [35]

    Robnik- ˇSikonja, Explainprediction: Explanation of predictions for classification and regression models, r package (2018)

    M. Robnik- ˇSikonja, Explainprediction: Explanation of predictions for classification and regression models, r package (2018). URL https://CRAN.R-project.org/package=ExplainPrediction

    2018

  28. [36]

    Biecek, T

    P. Biecek, T. Burzykowski, Explore, Explain, and Examine Predictive Models: With Examples in R and Python, CRC Press, 2020

    2020

  29. [37]

    Break-down plots for additive attributions, https://ema.drwhy.ai/ breakDown.html#BDMethodGen, accessed: 2024-12-28

    2024

  30. [38]

    K. Yang, J. Wang, M. Li, An improved intrusion detection method for iiot using attention mechanisms, bigru, and inception-cnn, Scientific Re- ports 14 (1) (2024) 19339. doi:10.1038/s41598-024-70094-2 . 47

    2024 doi

  31. [39]

    W. N. H. Ibrahim, S. Anuar, A. Selamat, O. Krejcar, R. G. Crespo, E. Herrera-Viedma, H. Fujita, Multilayer framework for botnet detec- tion using machine learning algorithms, IEEE Access: Practical Inno- vations, Open Solutions 9 (2021) 48753–48768. doi:10.1109/ACCESS. 2021.3060778

    2021

  32. [40]

    Sharma, H

    A. Sharma, H. Babbar, Detecting cyber threats in real-time: A super- vised learning perspective on the ctu-13 dataset, in: 2024 5th Inter- national Conference for Emerging Technology (INCET), 2024, pp. 1–5. doi:10.1109/INCET61516.2024.10593100

    2024

  33. [41]

    Letteri, G

    I. Letteri, G. Della Penna, P. Caianiello, Feature selection strategies for http botnet traffic detection, in: 2019 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), IEEE, 2019, pp. 202–

    2019

  34. [42]

    Pekta¸ s, T

    A. Pekta¸ s, T. Acarman, Botnet detection based on network flow sum- mary and deep learning, International Journal of Network Management 28 (6) (Nov. 2018). doi:10.1002/nem.2039

    2018 doi

  35. [43]

    Taheri, M

    S. Taheri, M. Salem, J. S. Yuan, Leveraging image representation of net- work traffic data and transfer learning in botnet detection, Big Data and Cognitive Computing 2 (4) (2018) 1–16. doi:10.3390/bdcc2040037. URL https://stars.library.ucf.edu/scopus2015/7328

    2018 doi

  36. [44]

    Al-Qatf, Y

    M. Al-Qatf, Y. Lasheng, M. Al-Habib, K. Al-Sabahi, Deep learning approach combining sparse autoencoder with svm for network intrusion detection, IEEE Access 6 (2018) 52843–52856. doi:10.1109/ACCESS. 2018.2869577

    2018

  37. [45]

    Ingre, A

    B. Ingre, A. Yadav, Performance analysis of nsl-kdd dataset using ann, in: 2015 International Conference on Signal Processing and Commu- nication Engineering Systems, IEEE, 2015, pp. 92–96. doi:10.1109/ SPACES.2015.7058223

    2015

  38. [46]

    Javaid, Q

    A. Javaid, Q. Niyaz, W. Sun, M. Alam, A deep learning approach for net- work intrusion detection system, in: Proceedings of the 9th EAI Inter- national Conference on Bio-inspired Information and Communications Technologies, 2016, pp. 21–26. doi:10.4108/eai.3-12-2015.2262516 . 48

    2016

  39. [47]

    Vinayakumar, M

    R. Vinayakumar, M. Alazab, K. P. Soman, P. Poornachandran, A. Al- Nemrat, S. Venkatraman, Deep learning approach for intelligent in- trusion detection system, IEEE Access 7 (2019) 41525–41550. doi: 10.1109/ACCESS.2019.2895334

    2019

  40. [48]

    C. Yin, Y. Zhu, J. Fei, X. He, A deep learning approach for intrusion detection using recurrent neural networks, IEEE Access 5 (2017) 21954– 21961. doi:10.1109/ACCESS.2017.2762418

    2017

  41. [49]

    K. Wu, Z. Chen, W. Li, A novel intrusion detection model for a mas- sive network using convolutional neural networks, IEEE Access 6 (2018) 50850–50859. doi:10.1109/ACCESS.2018.2868993

    2018

  42. [50]

    Altwaijry, A

    N. Altwaijry, A. ALQahtani, I. AlTuraiki, A deep learning approach for anomaly-based network intrusion detection, in: International Con- ference on Big Data and Security, Springer, 2019, pp. 603–615. doi: 10.1007/978-981-15-7530-3_46

    2019 doi

  43. [51]

    Al-Turaiki, N

    I. Al-Turaiki, N. Altwaijry, A convolutional neural network for improved anomaly-based network intrusion detection, Big Data 9 (3) (2021) 233–

    2021

  44. [56]

    ping traffic

    Overview of Attack Types • Backdoor: A covert method to bypass standard authentication mech- anisms, granting unauthorized access to a system. Often introduced via malware. • Distributed Denial of Service (DDoS): A coordinated cyberattack that disrupts the normal functioning o...

  45. [57]

    Available at: 5

    Dataset Accessibility • Edge-IIoTset Dataset: A comprehensive and realistic cyber-security dataset for Internet of Things (IoT) and Industrial IoT (IIoT) applica- tions. Available at: 5. • UKM-IDS20 Dataset: Focused on Unmanned Aerial Vehicle (UA V) communication security, thi...

    1999

  46. [134]

    doi:10.1007/978-981-97-4677-4_11

    doi

  47. [210]

    doi:10.1109/EuroSPW.2019.00029

    2019

  48. [252]

    49 Appendix I: Attack Types and Definitions

    doi:10.1089/big.2020.0263. 49 Appendix I: Attack Types and Definitions

    2020

  49. [505]

    doi:10.1016/j.aej.2024.09.115

    2024 doi

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.