{"id":"https://openalex.org/W7155354475","doi":"https://doi.org/10.1109/access.2026.3687021","title":"Feature Engineering in Unsupervised DNS Botnet Detectors Based on eXplainable AI","display_name":"Feature Engineering in Unsupervised DNS Botnet Detectors Based on eXplainable AI","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7155354475","doi":"https://doi.org/10.1109/access.2026.3687021"},"language":"en","primary_location":{"id":"doi:10.1109/access.2026.3687021","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3687021","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2026.3687021","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5126912701","display_name":"Eleftheria Arkadopoulou","orcid":null},"institutions":[{"id":"https://openalex.org/I174458059","display_name":"National Technical University of Athens","ror":"https://ror.org/03cx6bg69","country_code":"GR","type":"education","lineage":["https://openalex.org/I174458059"]}],"countries":["GR"],"is_corresponding":false,"raw_author_name":"Eleftheria Arkadopoulou","raw_affiliation_strings":["School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece"],"raw_orcid":"https://orcid.org/0009-0005-3782-3064","affiliations":[{"raw_affiliation_string":"School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece","institution_ids":["https://openalex.org/I174458059"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134363887","display_name":"Nikos Kostopoulos","orcid":"https://orcid.org/0009-0003-6033-0191"},"institutions":[{"id":"https://openalex.org/I174458059","display_name":"National Technical University of Athens","ror":"https://ror.org/03cx6bg69","country_code":"GR","type":"education","lineage":["https://openalex.org/I174458059"]}],"countries":["GR"],"is_corresponding":false,"raw_author_name":"Nikos Kostopoulos","raw_affiliation_strings":["School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece"],"raw_orcid":"https://orcid.org/0009-0003-6033-0191","affiliations":[{"raw_affiliation_string":"School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece","institution_ids":["https://openalex.org/I174458059"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028540494","display_name":"M. Grammatikou","orcid":"https://orcid.org/0000-0002-8673-4739"},"institutions":[{"id":"https://openalex.org/I174458059","display_name":"National Technical University of Athens","ror":"https://ror.org/03cx6bg69","country_code":"GR","type":"education","lineage":["https://openalex.org/I174458059"]}],"countries":["GR"],"is_corresponding":false,"raw_author_name":"Maria Grammatikou","raw_affiliation_strings":["School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece"],"raw_orcid":"https://orcid.org/0000-0002-8673-4739","affiliations":[{"raw_affiliation_string":"School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece","institution_ids":["https://openalex.org/I174458059"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5072274800","display_name":"Vasilis Maglaris","orcid":"https://orcid.org/0000-0002-0352-5713"},"institutions":[{"id":"https://openalex.org/I174458059","display_name":"National Technical University of Athens","ror":"https://ror.org/03cx6bg69","country_code":"GR","type":"education","lineage":["https://openalex.org/I174458059"]}],"countries":["GR"],"is_corresponding":false,"raw_author_name":"Vasilis Maglaris","raw_affiliation_strings":["School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece"],"raw_orcid":"https://orcid.org/0000-0002-0352-5713","affiliations":[{"raw_affiliation_string":"School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece","institution_ids":["https://openalex.org/I174458059"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I174458059"],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.54085047,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"14","issue":null,"first_page":"64220","last_page":"64230"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.3416000008583069,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.3416000008583069,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.22089999914169312,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.029999999329447746,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.8443999886512756},{"id":"https://openalex.org/keywords/feature-engineering","display_name":"Feature engineering","score":0.506600022315979},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.49410000443458557},{"id":"https://openalex.org/keywords/detector","display_name":"Detector","score":0.4643999934196472},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.36329999566078186}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.8443999886512756},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8230999708175659},{"id":"https://openalex.org/C2778827112","wikidata":"https://www.wikidata.org/wiki/Q22245680","display_name":"Feature engineering","level":3,"score":0.506600022315979},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.49410000443458557},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4724000096321106},{"id":"https://openalex.org/C94915269","wikidata":"https://www.wikidata.org/wiki/Q1834857","display_name":"Detector","level":2,"score":0.4643999934196472},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.36329999566078186},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3325999975204468},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.2994999885559082},{"id":"https://openalex.org/C8038995","wikidata":"https://www.wikidata.org/wiki/Q1152135","display_name":"Unsupervised learning","level":2,"score":0.2879999876022339},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.26350000500679016},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2524000108242035}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2026.3687021","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3687021","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:3eca459a331a46d4a3b8edb50c050518","is_oa":true,"landing_page_url":"https://doaj.org/article/3eca459a331a46d4a3b8edb50c050518","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 14, Pp 64220-64230 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2026.3687021","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2026.3687021","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3313410933","display_name":null,"funder_award_id":"101194278 (GN5-2)","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"}],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Botnet":[0],"communications":[1],"often":[2],"rely":[3],"on":[4,22,57,78,110,126,161,184],"Domain":[5,32],"Generation":[6],"Algorithms":[7],"(DGAs)":[8],"to":[9,26,40,61,71,157],"establish":[10],"channels":[11],"among":[12],"attack":[13],"orchestrators":[14],"and":[15,30,42,67,112,123,154,178,207,217],"compromised":[16],"hosts":[17],"(bots).":[18],"Our":[19,46,74,132],"approach":[20,191,212],"leverages":[21],"Artificial":[23,147],"Intelligence":[24,148],"(AI)":[25],"differentiate":[27],"between":[28],"legitimate":[29,96],"DGA":[31,105],"Name":[33],"System":[34],"(DNS)":[35],"messages,":[36],"thereby":[37],"enabling":[38],"defenders":[39],"identify":[41],"block":[43],"botnet":[44],"communications.":[45],"unsupervised":[47,228],"Machine":[48],"Learning":[49],"(ML)":[50],"model":[51,162,180,199],"involves":[52],"deep":[53],"AutoEncoders":[54],"(AEs),":[55],"trained":[56],"large":[58],"unlabeled":[59],"datasets":[60,80,186],"avoid":[62],"time-consuming,":[63],"error-prone":[64],"labeling":[65],"procedures":[66],"risks":[68],"of":[69,81,226],"overfitting":[70],"training":[72,79],"data.":[73],"experiments":[75],"are":[76],"based":[77],"frequently":[82],"requested":[83],"names":[84,102],"in":[85,203],"public":[86],"repositories;":[87],"request":[88],"frequencies":[89],"point":[90],"towards":[91],"name":[92,97],"legitimacy.":[93],"AEs":[94],"infer":[95],"characteristics,":[98],"eventually":[99],"discerning":[100],"benign":[101],"from":[103,117],"malicious":[104],"anomalies.":[106],"Model":[107],"evaluation":[108],"relies":[109],"statistical":[111],"linguistic":[113],"features":[114],"directly":[115],"extracted":[116],"domain":[118],"names,":[119],"thus":[120],"avoiding":[121],"costly":[122],"privacy-sensitive":[124],"operations":[125],"historical":[127],"databases":[128],"with":[129,230],"DNS":[130,221],"information.":[131],"proposed":[133,190],"schema":[134],"interprets":[135],"black-box":[136],"models":[137],"by":[138],"employing":[139],"SHapley":[140],"Additive":[141],"exPlanation":[142],"(SHAP),":[143],"a":[144,167,214],"prominent":[145],"eXplainable":[146],"(XAI)":[149],"technique":[150],"that":[151,172,188],"derives":[152],"model-agnostic":[153],"post-hoc":[155],"interpretations":[156],"assess":[158],"feature":[159,169,176],"contributions":[160],"decisions.":[163],"Specifically,":[164],"we":[165],"introduce":[166],"SHAP-driven":[168],"augmentation":[170],"mechanism":[171],"systematically":[173],"re-engineers":[174],"the":[175,189,197,224],"space":[177],"improves":[179],"performance.":[181],"Experimental":[182],"results":[183],"large-scale":[185],"demonstrate":[187],"effectively":[192],"detects":[193],"DGA-generated":[194],"domains,":[195],"while":[196],"augmented":[198],"achieves":[200],"noticeable":[201],"improvements":[202],"both":[204],"detection":[205],"accuracy":[206],"F1-score.":[208],"In":[209],"summary,":[210],"our":[211],"provides":[213],"scalable,":[215],"interpretable,":[216],"privacy-aware":[218],"framework":[219],"for":[220],"security,":[222],"highlighting":[223],"potential":[225],"combining":[227],"learning":[229],"XAI.":[231]},"counts_by_year":[],"updated_date":"2026-06-26T08:34:08.712188","created_date":"2026-04-24T00:00:00"}