{"id":"https://openalex.org/W7135077417","doi":"https://doi.org/10.1093/comjnl/bxag022","title":"BIFM: an effective similar payload attribution approach for cybercriminal detection using bitmap index table and fuzzy matching","display_name":"BIFM: an effective similar payload attribution approach for cybercriminal detection using bitmap index table and fuzzy matching","publication_year":2026,"publication_date":"2026-02-23","ids":{"openalex":"https://openalex.org/W7135077417","doi":"https://doi.org/10.1093/comjnl/bxag022"},"language":"en","primary_location":{"id":"doi:10.1093/comjnl/bxag022","is_oa":false,"landing_page_url":"https://doi.org/10.1093/comjnl/bxag022","pdf_url":null,"source":{"id":"https://openalex.org/S44643521","display_name":"The Computer Journal","issn_l":"0010-4620","issn":["0010-4620","1460-2067"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310311648","host_organization_name":"Oxford University Press","host_organization_lineage":["https://openalex.org/P4310311648","https://openalex.org/P4310311647"],"host_organization_lineage_names":["Oxford University Press","University of Oxford"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The Computer Journal","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5115596565","display_name":"Yifan Yang","orcid":"https://orcid.org/0009-0003-0588-1812"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yifan Yang","raw_affiliation_strings":["College of Computer Science and Technology , National University of Defense Technology, No. 109 Deya Road, Kaifu District, Hunan Province, Changsha 410073,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology , National University of Defense Technology, No. 109 Deya Road, Kaifu District, Hunan Province, Changsha 410073,","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5065610283","display_name":"Changsheng Hou","orcid":"https://orcid.org/0000-0002-3039-4325"},"institutions":[{"id":"https://openalex.org/I2802541053","display_name":"Academy of Military Medical Sciences","ror":"https://ror.org/02bv3c993","country_code":"CN","type":"facility","lineage":["https://openalex.org/I2802541053"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Changsheng Hou","raw_affiliation_strings":["Academy of Military Sciences , Beijing 100091,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Academy of Military Sciences , Beijing 100091,","institution_ids":["https://openalex.org/I2802541053"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091321590","display_name":"Lei Hu","orcid":"https://orcid.org/0000-0003-3562-9178"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ling Hu","raw_affiliation_strings":["College of Computer Science and Technology , National University of Defense Technology, No. 109 Deya Road, Kaifu District, Hunan Province, Changsha 410073,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology , National University of Defense Technology, No. 109 Deya Road, Kaifu District, Hunan Province, Changsha 410073,","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5056607788","display_name":"Xionglve Li","orcid":"https://orcid.org/0000-0001-6650-7259"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Xionglve Li","raw_affiliation_strings":["College of Computer Science and Technology , National University of Defense Technology, No. 109 Deya Road, Kaifu District, Hunan Province, Changsha 410073,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology , National University of Defense Technology, No. 109 Deya Road, Kaifu District, Hunan Province, Changsha 410073,","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5042450189","display_name":"Bingnan Hou","orcid":"https://orcid.org/0000-0001-5862-7883"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Bingnan Hou","raw_affiliation_strings":["College of Computer Science and Technology , National University of Defense Technology, No. 109 Deya Road, Kaifu District, Hunan Province, Changsha 410073,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology , National University of Defense Technology, No. 109 Deya Road, Kaifu District, Hunan Province, Changsha 410073,","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5128817928","display_name":"Zhiping Cai","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Zhiping Cai","raw_affiliation_strings":["College of Computer Science and Technology , National University of Defense Technology, No. 109 Deya Road, Kaifu District, Hunan Province, Changsha 410073,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology , National University of Defense Technology, No. 109 Deya Road, Kaifu District, Hunan Province, Changsha 410073,","institution_ids":["https://openalex.org/I170215575"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":["https://openalex.org/A5042450189","https://openalex.org/A5056607788","https://openalex.org/A5128817928"],"corresponding_institution_ids":["https://openalex.org/I170215575"],"apc_list":{"value":2877,"currency":"GBP","value_usd":3794},"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.21216517,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"69","issue":"7","first_page":"1237","last_page":"1254"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.5849999785423279,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.5849999785423279,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.30160000920295715,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.0142000000923872,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.824400007724762},{"id":"https://openalex.org/keywords/bitmap","display_name":"Bitmap","score":0.8144000172615051},{"id":"https://openalex.org/keywords/fuzzy-logic","display_name":"Fuzzy logic","score":0.58160001039505},{"id":"https://openalex.org/keywords/matching","display_name":"Matching (statistics)","score":0.5292999744415283},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.459199994802475},{"id":"https://openalex.org/keywords/table","display_name":"Table (database)","score":0.4528000056743622},{"id":"https://openalex.org/keywords/fuzzy-rule","display_name":"Fuzzy rule","score":0.40400001406669617},{"id":"https://openalex.org/keywords/reduction","display_name":"Reduction (mathematics)","score":0.35249999165534973}],"concepts":[{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.824400007724762},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8198999762535095},{"id":"https://openalex.org/C3115412","wikidata":"https://www.wikidata.org/wiki/Q1194708","display_name":"Bitmap","level":2,"score":0.8144000172615051},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6744999885559082},{"id":"https://openalex.org/C58166","wikidata":"https://www.wikidata.org/wiki/Q224821","display_name":"Fuzzy logic","level":2,"score":0.58160001039505},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.5292999744415283},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.459199994802475},{"id":"https://openalex.org/C45235069","wikidata":"https://www.wikidata.org/wiki/Q278425","display_name":"Table (database)","level":2,"score":0.4528000056743622},{"id":"https://openalex.org/C2780049643","wikidata":"https://www.wikidata.org/wiki/Q5511139","display_name":"Fuzzy rule","level":4,"score":0.40400001406669617},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.36469998955726624},{"id":"https://openalex.org/C111335779","wikidata":"https://www.wikidata.org/wiki/Q3454686","display_name":"Reduction (mathematics)","level":2,"score":0.35249999165534973},{"id":"https://openalex.org/C32610155","wikidata":"https://www.wikidata.org/wiki/Q1798621","display_name":"Approximate string matching","level":3,"score":0.3303000032901764},{"id":"https://openalex.org/C75165309","wikidata":"https://www.wikidata.org/wiki/Q2258979","display_name":"Search engine indexing","level":2,"score":0.3246000111103058},{"id":"https://openalex.org/C2777382242","wikidata":"https://www.wikidata.org/wiki/Q6017816","display_name":"Index (typography)","level":2,"score":0.31459999084472656},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3068999946117401},{"id":"https://openalex.org/C61455927","wikidata":"https://www.wikidata.org/wiki/Q1030529","display_name":"Blossom algorithm","level":3,"score":0.29260000586509705},{"id":"https://openalex.org/C59276292","wikidata":"https://www.wikidata.org/wiki/Q580427","display_name":"Database index","level":3,"score":0.28610000014305115},{"id":"https://openalex.org/C207512268","wikidata":"https://www.wikidata.org/wiki/Q3074551","display_name":"Traffic flow (computer networking)","level":2,"score":0.2777999937534332},{"id":"https://openalex.org/C42011625","wikidata":"https://www.wikidata.org/wiki/Q1055058","display_name":"Fuzzy set","level":3,"score":0.26649999618530273},{"id":"https://openalex.org/C19012869","wikidata":"https://www.wikidata.org/wiki/Q578372","display_name":"Response time","level":2,"score":0.25600001215934753},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.25}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1093/comjnl/bxag022","is_oa":false,"landing_page_url":"https://doi.org/10.1093/comjnl/bxag022","pdf_url":null,"source":{"id":"https://openalex.org/S44643521","display_name":"The Computer Journal","issn_l":"0010-4620","issn":["0010-4620","1460-2067"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310311648","host_organization_name":"Oxford University Press","host_organization_lineage":["https://openalex.org/P4310311648","https://openalex.org/P4310311647"],"host_organization_lineage_names":["Oxford University Press","University of Oxford"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The Computer Journal","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.5157745480537415,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G1532720608","display_name":null,"funder_award_id":"62472434","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":36,"referenced_works":["https://openalex.org/W95177030","https://openalex.org/W405205512","https://openalex.org/W1614703486","https://openalex.org/W1892063863","https://openalex.org/W1972374951","https://openalex.org/W2053744180","https://openalex.org/W2066197655","https://openalex.org/W2076271114","https://openalex.org/W2076342816","https://openalex.org/W2083331665","https://openalex.org/W2117354552","https://openalex.org/W2123845384","https://openalex.org/W2151114655","https://openalex.org/W2153568114","https://openalex.org/W2168154523","https://openalex.org/W2169047570","https://openalex.org/W2210675186","https://openalex.org/W2752395945","https://openalex.org/W2766849988","https://openalex.org/W2944742272","https://openalex.org/W3007562398","https://openalex.org/W3008443984","https://openalex.org/W3196052036","https://openalex.org/W3206762762","https://openalex.org/W4241715970","https://openalex.org/W4280493558","https://openalex.org/W4293004633","https://openalex.org/W4296229353","https://openalex.org/W4312935532","https://openalex.org/W4319966459","https://openalex.org/W4390062779","https://openalex.org/W4393219177","https://openalex.org/W4399532372","https://openalex.org/W4402468436","https://openalex.org/W4410492229","https://openalex.org/W7131297096"],"related_works":[],"abstract_inverted_index":{"Abstract":[0],"The":[1],"payload":[2,49,67],"attribution":[3,50],"system":[4],"has":[5],"been":[6],"proposed":[7],"to":[8,21,44,53,89],"analyze":[9],"network":[10,87,195],"traffic":[11,88],"and":[12,24,36,59,91,110,134,141,179],"assist":[13],"investigators":[14],"in":[15],"identifying":[16],"flows":[17,147],"containing":[18,148],"specific":[19],"excerpts":[20,149],"locate":[22],"criminals":[23],"potential":[25],"victims.":[26],"However,":[27],"various":[28],"attacks":[29],"or":[30,122,150,160],"data":[31,56],"leakage":[32],"behaviors":[33],"can":[34],"obscure":[35],"scatter":[37],"the":[38,55,107,111,137,164],"crucial":[39],"portion":[40],"of":[41,94,211],"flow":[42,113],"payloads":[43,119],"evade":[45],"detection.":[46],"Although":[47],"existing":[48,204],"techniques":[51],"strive":[52],"enhance":[54,172],"reduction":[57],"ratio":[58],"reduce":[60],"false":[61],"positive":[62],"rates,":[63],"research":[64],"on":[65],"similar":[66],"querying":[68],"is":[69],"notably":[70],"lacking.":[71],"In":[72],"this":[73,126],"study,":[74],"we":[75,175],"introduce":[76],"bitmap":[77,138],"index":[78,139],"table":[79,140],"fuzzy":[80,132,142],"matching":[81,133,165],"(BIFM),":[82],"a":[83,189],"method":[84],"for":[85,167],"digesting":[86],"query":[90,108],"trace":[92],"variants":[93,152],"malicious":[95,169],"traffic.":[96],"Unlike":[97],"deterministic":[98,103],"bitmap-index":[99],"PAS":[100],"that":[101,154,201],"require":[102],"bit":[104],"co-occurrence/alignment":[105],"between":[106],"excerpt":[109],"stored":[112],"bitmap,":[114],"an":[115,208],"assumption":[116],"violated":[117],"when":[118],"are":[120],"split":[121],"jumbled,":[123],"BIFM":[124,144,202],"overcomes":[125],"limitation":[127],"via":[128],"progressive":[129],"relaxation":[130],"with":[131],"verification.":[135],"Leveraging":[136],"matching,":[143],"efficiently":[145],"identifies":[146],"their":[151,156],"(excerpts":[153],"change":[155],"appearance":[157],"by":[158,162],"splitting":[159],"jumbling)":[161],"relaxing":[163],"conditions":[166],"candidate":[168],"flows.":[170],"To":[171],"BIFM\u2019s":[173,186],"accuracy,":[174],"also":[176],"propose":[177],"no-shingling":[178],"packet":[180],"caching":[181],"mechanisms.":[182],"We":[183],"extensively":[184],"evaluate":[185],"performance":[187],"using":[188],"dataset":[190],"constructed":[191],"from":[192],"real":[193],"campus":[194],"IP-trace":[196],"data.":[197],"Our":[198],"results":[199],"demonstrate":[200],"outperforms":[203],"state-of-the-art":[205],"solutions,":[206],"achieving":[207],"accuracy":[209],"improvement":[210],"$\\sim":[212],"$10%":[213],"without":[214],"significantly":[215],"increasing":[216],"processing":[217],"time.":[218]},"counts_by_year":[],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2026-03-13T00:00:00"}