{"id":"https://openalex.org/W1988070923","doi":"https://doi.org/10.1109/icc.2010.5502092","title":"A Novel IRC Botnet Detection Method Based on Packet Size Sequence","display_name":"A Novel IRC Botnet Detection Method Based on Packet Size Sequence","publication_year":2010,"publication_date":"2010-05-01","ids":{"openalex":"https://openalex.org/W1988070923","doi":"https://doi.org/10.1109/icc.2010.5502092","mag":"1988070923"},"language":"en","primary_location":{"id":"doi:10.1109/icc.2010.5502092","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icc.2010.5502092","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2010 IEEE International Conference on Communications","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5003951925","display_name":"Xiaobo Ma","orcid":"https://orcid.org/0000-0002-0934-5035"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"X. Ma","raw_affiliation_strings":["MOE Key Laboratory of Intelligent Networks and Network Security, State Key Laboratory of Manufacturing Systems, Xi''an Jiaotong University, Xi'an, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"MOE Key Laboratory of Intelligent Networks and Network Security, State Key Laboratory of Manufacturing Systems, Xi''an Jiaotong University, Xi'an, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075845093","display_name":"Xiaohong Guan","orcid":"https://orcid.org/0000-0002-8826-0362"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"X. Guan","raw_affiliation_strings":["Department of Automation, TNLIST Laboratory, Tsinghua University, Beijing, China","MOE Key Laboratory of Intelligent Networks and Network Security, State Key Laboratory of Manufacturing Systems, Xi''an Jiaotong University, Xi'an, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Automation, TNLIST Laboratory, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]},{"raw_affiliation_string":"MOE Key Laboratory of Intelligent Networks and Network Security, State Key Laboratory of Manufacturing Systems, Xi''an Jiaotong University, Xi'an, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101516220","display_name":"Jing Tao","orcid":"https://orcid.org/0009-0009-3911-4260"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"J. Tao","raw_affiliation_strings":["MOE Key Laboratory of Intelligent Networks and Network Security, State Key Laboratory of Manufacturing Systems, Xi''an Jiaotong University, Xi'an, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"MOE Key Laboratory of Intelligent Networks and Network Security, State Key Laboratory of Manufacturing Systems, Xi''an Jiaotong University, Xi'an, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041083459","display_name":"Qinghua Zheng","orcid":"https://orcid.org/0000-0002-8436-4754"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Q. Zheng","raw_affiliation_strings":["MOE Key Laboratory of Intelligent Networks and Network Security, State Key Laboratory of Manufacturing Systems, Shaanxi Province Key Laboratory of Satellite and Terrestrial Network Technology Research and Development, Xi''an Jiaotong University, Xi'an, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"MOE Key Laboratory of Intelligent Networks and Network Security, State Key Laboratory of Manufacturing Systems, Shaanxi Province Key Laboratory of Satellite and Terrestrial Network Technology Research and Development, Xi''an Jiaotong University, Xi'an, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028142707","display_name":"Yanhui Guo","orcid":"https://orcid.org/0000-0002-5444-3822"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Y. Guo","raw_affiliation_strings":["MOE Key Laboratory of Intelligent Networks and Network Security, State Key Laboratory of Manufacturing Systems, Xi''an Jiaotong University, Xi'an, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"MOE Key Laboratory of Intelligent Networks and Network Security, State Key Laboratory of Manufacturing Systems, Xi''an Jiaotong University, Xi'an, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079281573","display_name":"Limin Liu","orcid":"https://orcid.org/0000-0001-8577-1661"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"L. Liu","raw_affiliation_strings":["MOE Key Laboratory of Intelligent Networks and Network Security, State Key Laboratory of Manufacturing Systems, Xi''an Jiaotong University, Xi'an, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"MOE Key Laboratory of Intelligent Networks and Network Security, State Key Laboratory of Manufacturing Systems, Xi''an Jiaotong University, Xi'an, China","institution_ids":["https://openalex.org/I87445476"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5078515949","display_name":"Shiyuan Zhao","orcid":"https://orcid.org/0000-0003-1114-7297"},"institutions":[{"id":"https://openalex.org/I87445476","display_name":"Xi'an Jiaotong University","ror":"https://ror.org/017zhmm22","country_code":"CN","type":"education","lineage":["https://openalex.org/I87445476"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"S. Zhao","raw_affiliation_strings":["MOE Key Laboratory of Intelligent Networks and Network Security, State Key Laboratory of Manufacturing Systems, Xi''an Jiaotong University, Xi'an, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"MOE Key Laboratory of Intelligent Networks and Network Security, State Key Laboratory of Manufacturing Systems, Xi''an Jiaotong University, Xi'an, China","institution_ids":["https://openalex.org/I87445476"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.0536,"has_fulltext":false,"cited_by_count":23,"citation_normalized_percentile":{"value":0.86433566,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"5"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.9816558361053467},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7492228746414185},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.6776300668716431},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.6217270493507385},{"id":"https://openalex.org/keywords/command-and-control","display_name":"Command and control","score":0.6124538779258728},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.5480407476425171},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.5325006246566772},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.47331058979034424},{"id":"https://openalex.org/keywords/honeypot","display_name":"Honeypot","score":0.44971737265586853},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.444539338350296},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4159102439880371},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.36584359407424927},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.1238439679145813},{"id":"https://openalex.org/keywords/telecommunications","display_name":"Telecommunications","score":0.10415658354759216}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.9816558361053467},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7492228746414185},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.6776300668716431},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.6217270493507385},{"id":"https://openalex.org/C506615639","wikidata":"https://www.wikidata.org/wiki/Q21662260","display_name":"Command and control","level":2,"score":0.6124538779258728},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5480407476425171},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.5325006246566772},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.47331058979034424},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.44971737265586853},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.444539338350296},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4159102439880371},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.36584359407424927},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.1238439679145813},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.10415658354759216}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icc.2010.5502092","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icc.2010.5502092","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2010 IEEE International Conference on Communications","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.7200000286102295,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":24,"referenced_works":["https://openalex.org/W47988595","https://openalex.org/W191098608","https://openalex.org/W202500387","https://openalex.org/W1462349742","https://openalex.org/W1550514379","https://openalex.org/W1583098994","https://openalex.org/W1775772884","https://openalex.org/W1988741337","https://openalex.org/W2059513841","https://openalex.org/W2102671922","https://openalex.org/W2119425658","https://openalex.org/W2124060729","https://openalex.org/W2139361335","https://openalex.org/W2147767253","https://openalex.org/W2148323889","https://openalex.org/W2149274049","https://openalex.org/W2152955531","https://openalex.org/W2168248885","https://openalex.org/W6601890406","https://openalex.org/W6607784307","https://openalex.org/W6628628164","https://openalex.org/W6632893704","https://openalex.org/W6634779276","https://openalex.org/W6638021444"],"related_works":["https://openalex.org/W2038807247","https://openalex.org/W2097156747","https://openalex.org/W2559738661","https://openalex.org/W2147314218","https://openalex.org/W2164525836","https://openalex.org/W2898126008","https://openalex.org/W86804927","https://openalex.org/W1583098994","https://openalex.org/W2386447999","https://openalex.org/W2130216882"],"abstract_inverted_index":{"Botnets":[0],"have":[1],"become":[2],"a":[3,14,34,77,147],"serious":[4],"threat":[5],"to":[6,12,96],"Internet":[7],"and":[8,19,28,58,61,105,145],"are":[9],"often":[10],"deployed":[11],"control":[13,62],"large":[15],"pool":[16],"of":[17,47,51,79,109],"zombies":[18,57],"perform":[20],"notorious":[21],"activities":[22],"such":[23],"as":[24,83],"DDoS,":[25],"information":[26],"theft":[27],"spam":[29],"sending.":[30],"In":[31,65],"this":[32,86],"paper,":[33],"new":[35],"method":[36,93,119,133],"is":[37,94],"developed":[38],"for":[39],"detecting":[40],"IRC":[41,56,68,74,98,110,122,137,140],"botnets":[42,75,99,138],"by":[43,100],"analyzing":[44],"the":[45,52,70,102],"characteristic":[46],"packet":[48,106],"size":[49,108],"sequence":[50],"TCP":[53,71],"conversation":[54],"between":[55],"their":[59],"command":[60],"(C&C)":[63],"servers.":[64],"comparison":[66],"with":[67,142],"chat,":[69],"conversations":[72,111],"within":[73],"show":[76,130],"nature":[78],"approximate":[80],"periodicity":[81],"defined":[82],"quasi-periodicity":[84,103],"in":[85],"paper.":[87],"A":[88],"simple":[89],"yet":[90],"effective":[91],"detection":[92],"presented":[95],"detect":[97,135],"measuring":[101],"degree":[104],"average":[107],"based":[112],"on":[113],"ukkonen":[114],"algorithm.":[115],"We":[116],"evaluated":[117],"our":[118,132],"using":[120],"real-world":[121,136],"botnet":[123],"traces":[124],"captured":[125],"from":[126,139],"honeynet.":[127],"The":[128],"results":[129],"that":[131],"can":[134],"traffic":[141],"high":[143],"accuracy":[144],"has":[146],"low":[148],"false":[149],"positive":[150],"rate.":[151]},"counts_by_year":[{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":2},{"year":2018,"cited_by_count":1},{"year":2017,"cited_by_count":1},{"year":2016,"cited_by_count":2},{"year":2015,"cited_by_count":4},{"year":2014,"cited_by_count":4},{"year":2012,"cited_by_count":5}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}