activity
20162026
most citedNetFlow Datasets for Machine Learning-based Network Intrusion Detection Systems

405 citations · 2.6k across the 32 of their papers we have counts for

collaborators

32 papers

cs.IR2026

SIREN (Luring LLMs onto the Rocks): PAIR-Driven Preference Manipulation in Web-RAG Recommenders

Evan Caville, Spencer Kayser, Siamak Layeghy +3

This paper investigates the adversarial manipulation of the ranked recommendations produced by web-augmented large language models (LLMs). When an LLM answers a recommendation quer…

cs.NI2026

LoRIS: LoRaWAN-based IoT Platform for Sustainability Monitoring in Hotels

Yash Pandey, Angus Gray, Reza Serati +9

The hospitality sector is a major source of global greenhouse gas emissions, water stress, and waste generation, yet sustainability reporting in hotels remains constrained by coars…

cs.CR2026

LLMs for Zero-Shot Threat Detection via Structured Risk Indicators

Abdullah Alghamdi, Siamak Layeghy, Marius Portmann

We propose a two-stage large language model (LLM) framework for zero-shot detection of insider threats and advanced persistent threats (APTs) from heterogeneous security logs. The…

cs.CL2026

T5-CSBoost: Adversarial Perturbation Resistant LLM Fingerprinting

Gayan K. Kulatilleke, Mahsa Baktashmotlagh, Siamak Layeghy +1

While many AI-generated text (AIGT) detectors achieve strong performance on clean inputs, their accuracy degrades significantly under light paraphrasing, word substitutions, charac…

cs.CR2026

MambaNetBurst: Direct Byte-level Network Traffic Classification without Tokenization or Pretraining

Gayan K. Kulatilleke, Siamak Layeghy, Mahsa Baktashmotlagh +1

We present MambaNetBurst, a compact tokenizer-free byte-level sequence classifier for network burst classification based on a Mamba-2 backbone. In contrast to most recent strong tr…

cs.CR2025★ 8 cited

eX-NIDS: A Framework for Explainable Network Intrusion Detection Leveraging Large Language Models

Paul R. B. Houssel, Siamak Layeghy, Priyanka Singh +1

This paper introduces eX-NIDS, a framework designed to enhance interpretability in flow-based Network Intrusion Detection Systems (NIDS) by leveraging Large Language Models (LLMs).…

cs.LG2025★ 8 cited

Temporal Analysis of NetFlow Datasets for Network Intrusion Detection Systems

Majed Luay, Siamak Layeghy, Seyedehfaezeh Hosseininoorbin +3

This paper investigates the temporal analysis of NetFlow datasets for machine learning (ML)-based network intrusion detection systems (NIDS). Although many previous studies have hi…

cs.NI2024★ 2 cited

P4-NIDS: High-Performance Network Monitoring and Intrusion Detection in P4

Yaying Chen, Siamak Layeghy, Liam Daly Manocchio +1

This paper presents a high-performance, scalable network monitoring and intrusion detection system (IDS) implemented in P4. The proposed solution is designed for high-performance e…

cs.CR2024★ 38 cited

Towards Explainable Network Intrusion Detection using Large Language Models

Paul R. B. Houssel, Priyanka Singh, Siamak Layeghy +1

Large Language Models (LLMs) have revolutionised natural language processing tasks, particularly as chat agents. However, their applicability to threat detection problems remains u…

cs.CR2023★ 206 cited

FlowTransformer: A Transformer Framework for Flow-based Network Intrusion Detection Systems

Liam Daly Manocchio, Siamak Layeghy, Wai Weng Lo +3

This paper presents the FlowTransformer framework, a novel approach for implementing transformer-based Network Intrusion Detection Systems (NIDSs). FlowTransformer leverages the st…

cs.CR2022★ 1 cited

DOC-NAD: A Hybrid Deep One-class Classifier for Network Anomaly Detection

Mohanad Sarhan, Gayan Kulatilleke, Wai Weng Lo +2

Machine Learning (ML) approaches have been used to enhance the detection capabilities of Network Intrusion Detection Systems (NIDSs). Recent work has achieved near-perfect performa…

cs.CR2022★ 68 cited

DI-NIDS: Domain Invariant Network Intrusion Detection System

Siamak Layeghy, Mahsa Baktashmotlagh, Marius Portmann

The performance of machine learning based network intrusion detection systems (NIDSs) severely degrades when deployed on a network with significantly different feature distribution…

cs.CR2022

Network Intrusion Detection System in a Light Bulb

Liam Daly Manocchio, Siamak Layeghy, Marius Portmann

Internet of Things (IoT) devices are progressively being utilised in a variety of edge applications to monitor and control home and industry infrastructure. Due to the limited comp…

cs.CR2022★ 4 cited

XG-BoT: An Explainable Deep Graph Neural Network for Botnet Detection and Forensics

Wai Weng Lo, Gayan K. Kulatilleke, Mohanad Sarhan +2

In this paper, we propose XG-BoT, an explainable deep graph neural network model for botnet node detection. The proposed model comprises a botnet detector and an explainer for auto…

cs.LG2022★ 254 cited

Anomal-E: A Self-Supervised Network Intrusion Detection System based on Graph Neural Networks

Evan Caville, Wai Weng Lo, Siamak Layeghy +1

This paper investigates Graph Neural Networks (GNNs) application for self-supervised network intrusion and anomaly detection. GNNs are a deep learning approach for graph-based data…

cs.NI2022★ 44 cited

On Generalisability of Machine Learning-based Network Intrusion Detection Systems

Siamak Layeghy, Marius Portmann

Many of the proposed machine learning (ML) based network intrusion detection systems (NIDSs) achieve near perfect detection performance when evaluated on synthetic benchmark datase…

cs.CR2022★ 7 cited

HBFL: A Hierarchical Blockchain-based Federated Learning Framework for a Collaborative IoT Intrusion Detection

Mohanad Sarhan, Wai Weng Lo, Siamak Layeghy +1

The continuous strengthening of the security posture of IoT ecosystems is vital due to the increasing number of interconnected devices and the volume of sensitive data shared. The…

cs.CR2022★ 3 cited

Inspection-L: Self-Supervised GNN Node Embeddings for Money Laundering Detection in Bitcoin

Wai Weng Lo, Gayan K. Kulatilleke, Mohanad Sarhan +2

Criminals have become increasingly experienced in using cryptocurrencies, such as Bitcoin, for money laundering. The use of cryptocurrencies can hide criminal identities and transf…

cs.CR2022★ 3 cited

Graph Neural Network-based Android Malware Classification with Jumping Knowledge

Wai Weng Lo, Siamak Layeghy, Mohanad Sarhan +2

This paper presents a new Android malware detection method based on Graph Neural Networks (GNNs) with Jumping-Knowledge (JK). Android function call graphs (FCGs) consist of a set o…

cs.LG2021★ 163 cited

A Cyber Threat Intelligence Sharing Scheme based on Federated Learning for Network Intrusion Detection

Mohanad Sarhan, Siamak Layeghy, Nour Moustafa +1

The uses of Machine Learning (ML) in detection of network attacks have been effective when designed and evaluated in a single organisation. However, it has been very challenging to…

cs.LG2021★ 15 cited

Exploring Deep Neural Networks on Edge TPU

Seyedehfaezeh Hosseininoorbin, Siamak Layeghy, Brano Kusy +2

This paper explores the performance of Google's Edge TPU on feed forward neural networks. We consider Edge TPU as a hardware platform and explore different architectures of deep ne…

cs.LG2021★ 113 cited

From Zero-Shot Machine Learning to Zero-Day Attack Detection

Mohanad Sarhan, Siamak Layeghy, Marcus Gallagher +1

The standard ML methodology assumes that the test samples are derived from a set of pre-observed classes used in the training phase. Where the model extracts and learns useful patt…

cs.CR2021★ 4 cited

Feature Analysis for Machine Learning-based IoT Intrusion Detection

Mohanad Sarhan, Siamak Layeghy, Marius Portmann

Internet of Things (IoT) networks have become an increasingly attractive target of cyberattacks. Powerful Machine Learning (ML) models have recently been adopted to implement netwo…

cs.NI2021★ 199 cited

Feature Extraction for Machine Learning-based Intrusion Detection in IoT Networks

Mohanad Sarhan, Siamak Layeghy, Nour Moustafa +2

A large number of network security breaches in IoT networks have demonstrated the unreliability of current Network Intrusion Detection Systems (NIDSs). Consequently, network interr…