{"id":"https://openalex.org/W3000410487","doi":"https://doi.org/10.1109/ipccc47392.2019.8958732","title":"A New C&C Channel Detection Framework Using Heuristic Rule and Transfer Learning","display_name":"A New C&C Channel Detection Framework Using Heuristic Rule and Transfer Learning","publication_year":2019,"publication_date":"2019-10-01","ids":{"openalex":"https://openalex.org/W3000410487","doi":"https://doi.org/10.1109/ipccc47392.2019.8958732","mag":"3000410487"},"language":"en","primary_location":{"id":"doi:10.1109/ipccc47392.2019.8958732","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ipccc47392.2019.8958732","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2019 IEEE 38th International Performance Computing and Communications Conference (IPCCC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102722080","display_name":"Jianguo Jiang","orcid":"https://orcid.org/0000-0002-0947-9500"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianguo Jiang","raw_affiliation_strings":["Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001953231","display_name":"Qilei Yin","orcid":"https://orcid.org/0000-0002-0148-2772"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qilei Yin","raw_affiliation_strings":["Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108660469","display_name":"Zhixin Shi","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhixin Shi","raw_affiliation_strings":["Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015816825","display_name":"LI Mei-mei","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Meimei Li","raw_affiliation_strings":["Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101977068","display_name":"Bin Lv","orcid":"https://orcid.org/0000-0001-6961-7082"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Bin Lv","raw_affiliation_strings":["Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences, Institute of Information Engineering, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":7,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"9"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.8528674244880676},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.76810222864151},{"id":"https://openalex.org/keywords/heuristic","display_name":"Heuristic","score":0.7309651374816895},{"id":"https://openalex.org/keywords/transfer-of-learning","display_name":"Transfer of learning","score":0.6626433730125427},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.58724445104599},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.5609055161476135},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5474671125411987},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5352671146392822},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5086875557899475},{"id":"https://openalex.org/keywords/channel","display_name":"Channel (broadcasting)","score":0.501439094543457},{"id":"https://openalex.org/keywords/aggregate","display_name":"Aggregate (composite)","score":0.4439302384853363},{"id":"https://openalex.org/keywords/function","display_name":"Function (biology)","score":0.4150625467300415}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.8528674244880676},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.76810222864151},{"id":"https://openalex.org/C173801870","wikidata":"https://www.wikidata.org/wiki/Q201413","display_name":"Heuristic","level":2,"score":0.7309651374816895},{"id":"https://openalex.org/C150899416","wikidata":"https://www.wikidata.org/wiki/Q1820378","display_name":"Transfer of learning","level":2,"score":0.6626433730125427},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.58724445104599},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.5609055161476135},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5474671125411987},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5352671146392822},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5086875557899475},{"id":"https://openalex.org/C127162648","wikidata":"https://www.wikidata.org/wiki/Q16858953","display_name":"Channel (broadcasting)","level":2,"score":0.501439094543457},{"id":"https://openalex.org/C4679612","wikidata":"https://www.wikidata.org/wiki/Q866298","display_name":"Aggregate (composite)","level":2,"score":0.4439302384853363},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.4150625467300415},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0},{"id":"https://openalex.org/C78458016","wikidata":"https://www.wikidata.org/wiki/Q840400","display_name":"Evolutionary biology","level":1,"score":0.0},{"id":"https://openalex.org/C159985019","wikidata":"https://www.wikidata.org/wiki/Q181790","display_name":"Composite material","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C192562407","wikidata":"https://www.wikidata.org/wiki/Q228736","display_name":"Materials science","level":0,"score":0.0},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.0},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ipccc47392.2019.8958732","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ipccc47392.2019.8958732","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2019 IEEE 38th International Performance Computing and Communications Conference (IPCCC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.5,"display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":46,"referenced_works":["https://openalex.org/W47988595","https://openalex.org/W70584117","https://openalex.org/W1504269120","https://openalex.org/W1583098994","https://openalex.org/W1673310716","https://openalex.org/W1775772884","https://openalex.org/W1820098372","https://openalex.org/W1910686388","https://openalex.org/W1916198581","https://openalex.org/W1919803322","https://openalex.org/W2018175892","https://openalex.org/W2021753915","https://openalex.org/W2026621111","https://openalex.org/W2077488147","https://openalex.org/W2084979543","https://openalex.org/W2096118443","https://openalex.org/W2096943734","https://openalex.org/W2098027503","https://openalex.org/W2101234009","https://openalex.org/W2102671922","https://openalex.org/W2114250523","https://openalex.org/W2114996745","https://openalex.org/W2115403315","https://openalex.org/W2120256168","https://openalex.org/W2121973001","https://openalex.org/W2122838776","https://openalex.org/W2157949690","https://openalex.org/W2165698076","https://openalex.org/W2184678913","https://openalex.org/W2331488455","https://openalex.org/W2748868501","https://openalex.org/W2890486498","https://openalex.org/W2963693396","https://openalex.org/W3035219538","https://openalex.org/W6601890406","https://openalex.org/W6602816918","https://openalex.org/W6634779276","https://openalex.org/W6637131181","https://openalex.org/W6638021444","https://openalex.org/W6638648299","https://openalex.org/W6639864006","https://openalex.org/W6674763908","https://openalex.org/W6675354045","https://openalex.org/W6743493502","https://openalex.org/W6780052409","https://openalex.org/W6981170678"],"related_works":["https://openalex.org/W2294483539","https://openalex.org/W2378449000","https://openalex.org/W3187581118","https://openalex.org/W2938399969","https://openalex.org/W3143747655","https://openalex.org/W2002178493","https://openalex.org/W2901835651","https://openalex.org/W2883616266","https://openalex.org/W186576250","https://openalex.org/W2372254325"],"abstract_inverted_index":{"A":[0],"great":[1],"many":[2],"of":[3,15,67,84,150],"botnet":[4],"detection":[5,26,95],"methods":[6,40],"focus":[7],"on":[8,141],"recognizing":[9],"the":[10,65,89,146,157],"significant":[11],"C&C":[12,19,56,115,135,148],"channels.":[13,136],"Most":[14],"them":[16],"require":[17],"a":[18,24,51,71,103,117,127],"training":[20,32,72],"set":[21,33,73],"to":[22,63,92,110,121,132],"build":[23],"behavior":[25,167],"model.":[27],"However,":[28],"when":[29],"lacking":[30],"such":[31],"for":[34,55],"new":[35,52],"or":[36,44,69],"unknown":[37],"botnets,":[38],"these":[39],"may":[41],"become":[42],"inefficient":[43],"even":[45],"invalid.To":[46],"overcome":[47],"it,":[48],"we":[49,100],"propose":[50],"general":[53],"framework":[54,140],"channel":[57],"detection.":[58],"It":[59],"neither":[60],"needs":[61],"us":[62],"know":[64],"families":[66],"bots":[68],"prepare":[70],"nor":[74],"requires":[75],"deploying":[76],"malicious":[77],"activity":[78],"monitors.":[79],"Also,":[80],"it":[81],"is":[82],"capable":[83],"mining":[85],"useful":[86,123],"knowledge":[87,125],"from":[88],"historical":[90,124],"dataset":[91],"boost":[93],"its":[94,162],"performance.":[96],"In":[97],"our":[98,139],"framework,":[99],"put":[101],"forward":[102],"clustering":[104],"method":[105],"and":[106,112,126,144,153,165],"several":[107],"heuristic":[108],"rules":[109],"aggregate":[111],"label":[113],"partial":[114],"traffic,":[116],"sample":[118],"selection":[119],"function":[120],"mine":[122],"transfer":[128],"learning":[129,168],"based":[130],"model":[131],"find":[133],"other":[134],"We":[137],"evaluated":[138],"two":[142],"datasets":[143],"achieved":[145],"best":[147],"F-measure":[149],"about":[151],"0.886":[152],"0.960":[154],"respectively.":[155],"Moreover,":[156],"comparison":[158],"result":[159],"further":[160],"indicates":[161],"performance":[163],"advantage":[164],"better":[166],"ability.":[169]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":1},{"year":2021,"cited_by_count":3},{"year":2020,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}