{
  "abstract": "Open-set IoT intrusion detection must distinguish unfamiliar attacks from uncertain known traffic. OpenTriIDS implements a three-action policy: a random forest accepts high-confidence predictions, routes uncertain samples to a compact known-class prototype memory, and rejects routed samples beyond a standardized Euclidean distance boundary. At the representative S1 operating points on Edge-IIoTset and CIC-IoT-2023, the operational macro-F1 reaches 68.44% and 76.81%, with routing rates of 4.53% and 4.13%, respectively. The representative S1 analysis shows that the confidence gate defines the selected subset, while the three-prototype support rule improves macro-F1 and changes the balance between known-class retention and unknown rejection; the magnitude and direction depend on the dataset and operating point. The prototype-distance module records the matched label and distance for each routed sample. A complementary controlled protocol evaluates three seeds across multiple held-out-family settings, while a seven-method S1 comparison evaluates MSP, OpenMax, ORI open recognition, EFC, post hoc Energy OOD, single-layer Mahalanobis scoring, and OpenTriIDS at their documented operating points. OpenTriIDS achieves the highest macro-F1 among the evaluated methods in both datasets under this comparison. Together, the analyses characterize a selective open-set policy whose matched-gate macro-F1 advantage is accompanied by dataset- and holdout-dependent unknown-recall trade-offs, while distinguishing predictive performance from routing and computational cost.",
  "abstract_shown": true,
  "affiliations": [
    "College of Air and Missile Defense, Air Force Engineering University, Xi'an 710051, China.",
    "Academy of Military Science, Beijing 100091, China."
  ],
  "article_type": "research article",
  "arxiv": null,
  "author_total": 4,
  "authors": [
    {
      "affs": [
        0
      ],
      "name": "Xuan Wu",
      "orcid": "0009-0006-7435-8584"
    },
    {
      "affs": [
        1
      ],
      "name": "Peng Wang",
      "orcid": "0000-0001-5552-0618"
    },
    {
      "affs": [
        0
      ],
      "name": "Yafei Song",
      "orcid": "0000-0003-0962-0671"
    },
    {
      "affs": [
        0
      ],
      "name": "Xiaodan Wang",
      "orcid": "0000-0003-2785-9539"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/9eyyjhj5xx8g5.bib",
  "cited_by": 0,
  "doi": "10.3390/s26206369",
  "fulltext_url": "https://europepmc.org/articles/PMC13709266",
  "id": "9eyyjhj5xx8g5",
  "issns": [
    "1424-8220"
  ],
  "landing_url": "https://europepmc.org/article/MED/42944230",
  "language": "eng",
  "licence": "CC-BY",
  "licence_label": "CC BY",
  "licence_source": "article",
  "licence_url": "https://creativecommons.org/licenses/by/4.0/",
  "metadata_licence": null,
  "native_subjects": [
    [
      "openalex",
      "1705|Network Security and Intrusion Detection"
    ]
  ],
  "openalex": "W7221073821",
  "pdf_url": "https://europepmc.org/articles/PMC13709266?pdf=render",
  "pmcid": "PMC13709266",
  "pmid": "42944230",
  "published": "2026-10-09",
  "publisher": null,
  "ris": "https://research.draconitic.com/paper/9eyyjhj5xx8g5.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T12:22:24Z",
      "native_id": "MED:42944230",
      "source": "europepmc",
      "url": "https://europepmc.org/article/MED/42944230"
    }
  ],
  "subjects": [],
  "title": "OpenTriIDS: Confidence-Guided Open-Set Intrusion Triage for Unknown Attack Detection in IoT Devices.",
  "title_text": "OpenTriIDS: Confidence-Guided Open-Set Intrusion Triage for Unknown Attack Detection in IoT Devices.",
  "type": "peer-reviewed",
  "updated_at": "2026-10-30T12:22:24Z",
  "url": "https://research.draconitic.com/paper/9eyyjhj5xx8g5",
  "venue": "Sensors (Basel, Switzerland)",
  "versions": []
}