{"id":"https://openalex.org/W7133356412","doi":"https://doi.org/10.1007/s11280-026-01406-x","title":"Learning to detect malicious bots in computer networks via heterophily-aware isotropic out-of-distribution detection","display_name":"Learning to detect malicious bots in computer networks via heterophily-aware isotropic out-of-distribution detection","publication_year":2026,"publication_date":"2026-03-01","ids":{"openalex":"https://openalex.org/W7133356412","doi":"https://doi.org/10.1007/s11280-026-01406-x"},"language":"en","primary_location":{"id":"doi:10.1007/s11280-026-01406-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11280-026-01406-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11280-026-01406-x.pdf","source":{"id":"https://openalex.org/S129236917","display_name":"World Wide Web","issn_l":"1386-145X","issn":["1386-145X","1573-1413"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"World Wide Web","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://link.springer.com/content/pdf/10.1007/s11280-026-01406-x.pdf","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5127906936","display_name":"Bradley Ashmore","orcid":null},"institutions":[{"id":"https://openalex.org/I19648265","display_name":"Wright State University","ror":"https://ror.org/04qk6pt94","country_code":"US","type":"education","lineage":["https://openalex.org/I19648265"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Bradley Ashmore","raw_affiliation_strings":["Department of Computer Science and Engineering, Wright State University, Dayton, OH, 45435, USA"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, Wright State University, Dayton, OH, 45435, USA","institution_ids":["https://openalex.org/I19648265"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5017524689","display_name":"Lingwei Chen","orcid":"https://orcid.org/0000-0003-1550-6170"},"institutions":[{"id":"https://openalex.org/I155173764","display_name":"Rochester Institute of Technology","ror":"https://ror.org/00v4yb702","country_code":"US","type":"education","lineage":["https://openalex.org/I155173764"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Lingwei Chen","raw_affiliation_strings":["Department of Cybersecurity, Rochester Institute of Technology, Rochester, NY, 14623, USA"],"affiliations":[{"raw_affiliation_string":"Department of Cybersecurity, Rochester Institute of Technology, Rochester, NY, 14623, USA","institution_ids":["https://openalex.org/I155173764"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5017524689"],"corresponding_institution_ids":["https://openalex.org/I155173764"],"apc_list":{"value":2390,"currency":"EUR","value_usd":2990},"apc_paid":{"value":2390,"currency":"EUR","value_usd":2990},"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.51612135,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"29","issue":"2","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.3109999895095825,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.3109999895095825,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.21940000355243683,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11652","display_name":"Imbalanced Data Classification Techniques","score":0.10170000046491623,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.6345000267028809},{"id":"https://openalex.org/keywords/isotropy","display_name":"Isotropy","score":0.5976999998092651},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.5038999915122986},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.47780001163482666},{"id":"https://openalex.org/keywords/initialization","display_name":"Initialization","score":0.42170000076293945},{"id":"https://openalex.org/keywords/node","display_name":"Node (physics)","score":0.3862999975681305},{"id":"https://openalex.org/keywords/topology","display_name":"Topology (electrical circuits)","score":0.35740000009536743},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.3447999954223633}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8105999827384949},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.6345000267028809},{"id":"https://openalex.org/C184050105","wikidata":"https://www.wikidata.org/wiki/Q273163","display_name":"Isotropy","level":2,"score":0.5976999998092651},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.5038999915122986},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.47780001163482666},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.46070000529289246},{"id":"https://openalex.org/C114466953","wikidata":"https://www.wikidata.org/wiki/Q6034165","display_name":"Initialization","level":2,"score":0.42170000076293945},{"id":"https://openalex.org/C62611344","wikidata":"https://www.wikidata.org/wiki/Q1062658","display_name":"Node (physics)","level":2,"score":0.3862999975681305},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3643999993801117},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3610999882221222},{"id":"https://openalex.org/C184720557","wikidata":"https://www.wikidata.org/wiki/Q7825049","display_name":"Topology (electrical circuits)","level":2,"score":0.35740000009536743},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.3447999954223633},{"id":"https://openalex.org/C64339825","wikidata":"https://www.wikidata.org/wiki/Q722659","display_name":"Graph property","level":5,"score":0.3375000059604645},{"id":"https://openalex.org/C157406716","wikidata":"https://www.wikidata.org/wiki/Q4115842","display_name":"Topological graph theory","level":5,"score":0.30489999055862427},{"id":"https://openalex.org/C192126672","wikidata":"https://www.wikidata.org/wiki/Q1068715","display_name":"Telecommunications network","level":2,"score":0.30160000920295715},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.296999990940094},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.2888000011444092},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.2883000075817108},{"id":"https://openalex.org/C75564084","wikidata":"https://www.wikidata.org/wiki/Q5597085","display_name":"Graph embedding","level":3,"score":0.2838999927043915},{"id":"https://openalex.org/C88230418","wikidata":"https://www.wikidata.org/wiki/Q131476","display_name":"Graph theory","level":2,"score":0.27790001034736633},{"id":"https://openalex.org/C76444178","wikidata":"https://www.wikidata.org/wiki/Q72897900","display_name":"Connectivity","level":3,"score":0.2777999937534332},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.27720001339912415},{"id":"https://openalex.org/C34947359","wikidata":"https://www.wikidata.org/wiki/Q665189","display_name":"Complex network","level":2,"score":0.26840001344680786},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.26350000500679016},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.2581999897956848}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1007/s11280-026-01406-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11280-026-01406-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11280-026-01406-x.pdf","source":{"id":"https://openalex.org/S129236917","display_name":"World Wide Web","issn_l":"1386-145X","issn":["1386-145X","1573-1413"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"World Wide Web","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1007/s11280-026-01406-x","is_oa":true,"landing_page_url":"https://doi.org/10.1007/s11280-026-01406-x","pdf_url":"https://link.springer.com/content/pdf/10.1007/s11280-026-01406-x.pdf","source":{"id":"https://openalex.org/S129236917","display_name":"World Wide Web","issn_l":"1386-145X","issn":["1386-145X","1573-1413"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319900","host_organization_name":"Springer Science+Business Media","host_organization_lineage":["https://openalex.org/P4310319900","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Springer Science+Business Media","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"World Wide Web","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3437486379","display_name":null,"funder_award_id":"CNS-2245968","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G4228357142","display_name":"CRII: SaTC: Towards Data-effective and Cost-efficient Security Attack Detections","funder_award_id":"2549995","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G848032724","display_name":null,"funder_award_id":"Science","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8628047365","display_name":null,"funder_award_id":"22459","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7133356412.pdf","grobid_xml":"https://content.openalex.org/works/W7133356412.grobid-xml"},"referenced_works_count":38,"referenced_works":["https://openalex.org/W1985902740","https://openalex.org/W2026621111","https://openalex.org/W2058314598","https://openalex.org/W2114996745","https://openalex.org/W2148143831","https://openalex.org/W2770182958","https://openalex.org/W2787296320","https://openalex.org/W2801118360","https://openalex.org/W2912472718","https://openalex.org/W2945822178","https://openalex.org/W2972665508","https://openalex.org/W3026820624","https://openalex.org/W3033335743","https://openalex.org/W3034230713","https://openalex.org/W3081534155","https://openalex.org/W3085955590","https://openalex.org/W3090999459","https://openalex.org/W3106636111","https://openalex.org/W3110435694","https://openalex.org/W3125205424","https://openalex.org/W3130640456","https://openalex.org/W3134509497","https://openalex.org/W3162956350","https://openalex.org/W3209445167","https://openalex.org/W3210034512","https://openalex.org/W4200635484","https://openalex.org/W4205577106","https://openalex.org/W4214530306","https://openalex.org/W4290875057","https://openalex.org/W4307940854","https://openalex.org/W4324029729","https://openalex.org/W4327652764","https://openalex.org/W4378419380","https://openalex.org/W4380558608","https://openalex.org/W4382239867","https://openalex.org/W4387848839","https://openalex.org/W4402029609","https://openalex.org/W7133209411"],"related_works":[],"abstract_inverted_index":{"Malicious":[0],"bots":[1],"typically":[2],"operate":[3],"within":[4],"networks":[5,18,31,202],"through":[6,196],"peer-to-peer":[7],"(P2P)":[8],"communication":[9],"structures,":[10],"leading":[11],"to":[12,48,85,93,132,135,174],"the":[13,60,103,111],"emergence":[14],"of":[15,42,62,71,113],"graph":[16,105,231],"neural":[17],"(GNNs)":[19],"as":[20,59,81],"a":[21,39,74,121,143],"promising":[22],"bot":[23,140,190,212,225],"detection":[24,77,131,141,226],"method.":[25],"However,":[26],"communications":[27],"graphs":[28,184,228],"representing":[29],"bot-infected":[30],"often":[32],"exhibit":[33],"an":[34,82,100],"inherent":[35],"imbalance,":[36],"coupled":[37],"with":[38,56,110,147,229],"high":[40,230],"degree":[41],"heterophily.":[43],"Graph":[44],"oversampling":[45],"techniques,":[46],"employed":[47],"address":[49,86],"class":[50,235],"imbalance":[51,88,180],"on":[52,99,199,227],"graphs,":[53,94],"are":[54],"burdened":[55],"downsides,":[57],"such":[58],"creation":[61],"complex":[63],"and":[64,157,181,185,233],"noisy":[65],"topological":[66],"structures":[67],"or":[68],"further":[69,164],"amplification":[70],"heterophily":[72,182,232],"in":[73,142,183,223],"graph.":[75],"Out-of-distribution":[76],"(ODD)":[78],"is":[79,97,163],"considered":[80],"alternative":[83],"solution":[84],"data":[87,114],"issues,":[89],"but":[90],"when":[91],"applied":[92],"this":[95,117],"belief":[96,160],"built":[98],"assumption":[101],"that":[102,151,218],"underlying":[104],"structure":[106],"does":[107],"not":[108],"interfere":[109],"learning":[112],"distributions.":[115],"In":[116],"paper,":[118],"we":[119],"propose":[120],"new":[122],"ODD":[123,137,188],"model":[124],"HistNet":[125,145,173,219],"which":[126,162,208],"implements":[127],"Heterophily-aware":[128],"isotropic":[129,154,187],"out-of-distribution":[130],"explore":[133],"how":[134],"leverage":[136],"for":[138,189],"malicious":[139,224],"Network.":[144],"proceeds":[146],"heterophily-aware":[148],"node":[149],"embedding":[150],"facilitates":[152],"enhanced":[153],"distance":[155],"calculation":[156],"homophily-augmented":[158],"distance-based":[159],"propagation,":[161],"regularized":[165],"by":[166,179],"implicit":[167],"clustering.":[168],"These":[169],"technical":[170],"designs":[171],"enable":[172],"overcome":[175],"performance":[176,222],"issues":[177],"caused":[178],"improve":[186],"detection.":[191],"We":[192],"validate":[193],"our":[194],"claims":[195],"extensive":[197],"experiments":[198],"10":[200],"computer":[201],"derived":[203],"from":[204],"TON":[205],"IoT":[206],"datasets,":[207],"comprise":[209],"real":[210],"captured":[211],"data.":[213],"The":[214],"experimental":[215],"results":[216],"demonstrate":[217],"achieves":[220],"state-of-the-art":[221],"extreme":[234],"imbalance.":[236]},"counts_by_year":[],"updated_date":"2026-04-10T15:06:20.359241","created_date":"2026-03-04T00:00:00"}