{"id":"https://openalex.org/W4412446066","doi":"https://doi.org/10.1109/eurocon64445.2025.11073273","title":"TLS-Driven Reverse Shell Detection via Anomaly-Based Methods in Enterprise Network Traffic","display_name":"TLS-Driven Reverse Shell Detection via Anomaly-Based Methods in Enterprise Network Traffic","publication_year":2025,"publication_date":"2025-06-04","ids":{"openalex":"https://openalex.org/W4412446066","doi":"https://doi.org/10.1109/eurocon64445.2025.11073273"},"language":"en","primary_location":{"id":"doi:10.1109/eurocon64445.2025.11073273","is_oa":false,"landing_page_url":"https://doi.org/10.1109/eurocon64445.2025.11073273","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE EUROCON 2025 - 21st International Conference on Smart Technologies","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5081276182","display_name":"V. P Kapustin","orcid":"https://orcid.org/0000-0001-6512-490X"},"institutions":[{"id":"https://openalex.org/I167420956","display_name":"Vilnius Gediminas Technical University","ror":"https://ror.org/02x3e4q36","country_code":"LT","type":"education","lineage":["https://openalex.org/I167420956"]}],"countries":["LT"],"is_corresponding":false,"raw_author_name":"Vsevolod Kapustin","raw_affiliation_strings":["Vilnius Gediminas Technical University,Faculty of Electronics,Vilnius,Lithuania"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Vilnius Gediminas Technical University,Faculty of Electronics,Vilnius,Lithuania","institution_ids":["https://openalex.org/I167420956"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067481874","display_name":"Nerijus Paulauskas","orcid":"https://orcid.org/0000-0003-4796-3413"},"institutions":[{"id":"https://openalex.org/I167420956","display_name":"Vilnius Gediminas Technical University","ror":"https://ror.org/02x3e4q36","country_code":"LT","type":"education","lineage":["https://openalex.org/I167420956"]}],"countries":["LT"],"is_corresponding":false,"raw_author_name":"Nerijus Paulauskas","raw_affiliation_strings":["Vilnius Gediminas Technical University,Faculty of Electronics,Vilnius,Lithuania"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Vilnius Gediminas Technical University,Faculty of Electronics,Vilnius,Lithuania","institution_ids":["https://openalex.org/I167420956"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5000519313","display_name":"\u0160ar\u016bnas Paulikas","orcid":"https://orcid.org/0000-0001-5039-0607"},"institutions":[{"id":"https://openalex.org/I167420956","display_name":"Vilnius Gediminas Technical University","ror":"https://ror.org/02x3e4q36","country_code":"LT","type":"education","lineage":["https://openalex.org/I167420956"]}],"countries":["LT"],"is_corresponding":false,"raw_author_name":"\u0160ar\u016bnas Paulikas","raw_affiliation_strings":["Vilnius Gediminas Technical University,Faculty of Electronics,Vilnius,Lithuania"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Vilnius Gediminas Technical University,Faculty of Electronics,Vilnius,Lithuania","institution_ids":["https://openalex.org/I167420956"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I167420956"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.17524701,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"8"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.7246227264404297},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6310866475105286},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.44410350918769836},{"id":"https://openalex.org/keywords/shell","display_name":"Shell (structure)","score":0.43429985642433167},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3711446523666382},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.24199530482292175},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.12125611305236816}],"concepts":[{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.7246227264404297},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6310866475105286},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.44410350918769836},{"id":"https://openalex.org/C2781052500","wikidata":"https://www.wikidata.org/wiki/Q2230313","display_name":"Shell (structure)","level":2,"score":0.43429985642433167},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3711446523666382},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.24199530482292175},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.12125611305236816},{"id":"https://openalex.org/C147176958","wikidata":"https://www.wikidata.org/wiki/Q77590","display_name":"Civil engineering","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/eurocon64445.2025.11073273","is_oa":false,"landing_page_url":"https://doi.org/10.1109/eurocon64445.2025.11073273","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE EUROCON 2025 - 21st International Conference on Smart Technologies","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":22,"referenced_works":["https://openalex.org/W241231893","https://openalex.org/W1522301498","https://openalex.org/W1555168845","https://openalex.org/W2082290707","https://openalex.org/W2288747313","https://openalex.org/W3134574975","https://openalex.org/W3165205057","https://openalex.org/W3216316500","https://openalex.org/W4226281451","https://openalex.org/W4242478127","https://openalex.org/W4282917363","https://openalex.org/W4321021209","https://openalex.org/W4384080246","https://openalex.org/W4389366465","https://openalex.org/W4392546305","https://openalex.org/W4394952741","https://openalex.org/W4399814247","https://openalex.org/W4402957849","https://openalex.org/W6631190155","https://openalex.org/W6805102669","https://openalex.org/W6858397354","https://openalex.org/W6862629900"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2001405890","https://openalex.org/W4396696052"],"abstract_inverted_index":{"Cybersecurity":[0],"has":[1,34],"become":[2],"a":[3,62,69,123],"prominent":[4],"topic":[5],"in":[6,9,25,32,39,43,58,82,89,127],"enterprise":[7,100,190],"behavior":[8],"Lithuania":[10],"due":[11],"to":[12,36,164,185,201],"new":[13],"regulatory":[14],"standards":[15],"(NIS2":[16],"directive)":[17],"that":[18,159],"will":[19,199],"be":[20,200],"incorporated":[21],"into":[22,136],"national":[23],"law":[24],"Q4":[26],"of":[27,46,64,77,178,183],"2024.":[28],"Furthermore,":[29],"the":[30,44,83,93,152,160,176,188,208],"boost":[31],"computerization":[33],"led":[35],"an":[37,99,130,181],"increase":[38],"network":[40],"traffic,":[41],"particularly":[42],"context":[45],"anomalies":[47,173],"and":[48,104,114,141,206],"intrusion":[49,71],"detections.":[50],"The":[51,132,156,196],"reverse":[52,166],"shell\u2014a":[53],"technique":[54],"used":[55],"by":[56,169],"attackers":[57],"many":[59],"exploits":[60,168],"as":[61,68,86,88,92,151],"method":[63],"establishing":[65],"access\u2014has":[66],"emerged":[67],"significant":[70],"tactic.":[72],"Reverse":[73],"shells":[74],"are":[75],"part":[76],"remote":[78],"execution":[79],"strategies":[80],"outlined":[81],"MITRE":[84],"framework,":[85],"well":[87],"resources":[90],"such":[91],"CVE":[94],"database.":[95],"In":[96],"this":[97],"paper,":[98],"dataset":[101,133,191,205],"was":[102,134,149],"collected,":[103],"several":[105],"machine":[106],"learning":[107,125],"models,":[108],"including":[109],"eXtended":[110],"Gradient":[111],"Boosting":[112],"(XGBoost)":[113],"Support":[115],"Vector":[116],"Machine":[117],"(SVM),":[118],"were":[119],"evaluated":[120],"along":[121],"with":[122,129],"deep":[124],"model":[126],"collaboration":[128],"autoencoder.":[131],"split":[135],"two":[137],"parts,":[138],"representing":[139],"TLS":[140],"TCP":[142],"session":[143],"features.":[144],"Mutual":[145],"Information":[146],"(MI)":[147],"Score":[148],"employed":[150],"feature":[153],"extraction":[154],"method.":[155],"evaluation":[157],"revealed":[158],"most":[161],"effective":[162],"way":[163],"detect":[165],"shell":[167],"examining":[170],"encrypted":[171,194],"traffic":[172],"is":[174],"through":[175],"use":[177],"XGBoost,":[179],"achieving":[180],"F1-Score":[182],"up":[184],"99.6%":[186],"within":[187,210],"self-collected":[189],"containing":[192],"13,000":[193],"sessions.":[195],"future":[197],"work":[198],"collect":[202],"large":[203],"scale":[204],"test":[207],"accuracy":[209],"it.":[211]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}