{"id":"https://openalex.org/W3154602738","doi":"https://doi.org/10.1109/ipccc50635.2020.9391539","title":"FProbe: Detecting Stealthy DGA-based Botnets by Group Activities Analysis","display_name":"FProbe: Detecting Stealthy DGA-based Botnets by Group Activities Analysis","publication_year":2020,"publication_date":"2020-11-06","ids":{"openalex":"https://openalex.org/W3154602738","doi":"https://doi.org/10.1109/ipccc50635.2020.9391539","mag":"3154602738"},"language":"en","primary_location":{"id":"doi:10.1109/ipccc50635.2020.9391539","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ipccc50635.2020.9391539","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2020 IEEE 39th International Performance Computing and Communications Conference (IPCCC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101598822","display_name":"Jiawei Sun","orcid":"https://orcid.org/0000-0003-1332-6758"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiawei Sun","raw_affiliation_strings":["Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049853160","display_name":"Yuan Zhou","orcid":"https://orcid.org/0000-0002-9198-6586"},"institutions":[{"id":"https://openalex.org/I4210087772","display_name":"National Computer Network Emergency Response Technical Team/Coordination Center of Chinar","ror":"https://ror.org/00247dh76","country_code":"CN","type":"nonprofit","lineage":["https://openalex.org/I4210087772"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuan Zhou","raw_affiliation_strings":["Network Emergency Response Technical Team/Coordination Center,Beijing,China","Network Emergency Response Technical Team/Coordination Center, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Network Emergency Response Technical Team/Coordination Center,Beijing,China","institution_ids":["https://openalex.org/I4210087772"]},{"raw_affiliation_string":"Network Emergency Response Technical Team/Coordination Center, Beijing, China","institution_ids":["https://openalex.org/I4210087772"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5010150000","display_name":"Shupeng Wang","orcid":"https://orcid.org/0000-0002-2799-4100"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shupeng Wang","raw_affiliation_strings":["Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100433867","display_name":"Lei Zhang","orcid":"https://orcid.org/0000-0002-0235-8642"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lei Zhang","raw_affiliation_strings":["Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043094583","display_name":"Junjiao Liu","orcid":"https://orcid.org/0000-0003-1987-5627"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junjiao Liu","raw_affiliation_strings":["Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5021877570","display_name":"Junleng Hou","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junleng Hou","raw_affiliation_strings":["Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100745770","display_name":"Zhicheng Liu","orcid":"https://orcid.org/0000-0002-6278-1813"},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhicheng Liu","raw_affiliation_strings":["Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Sciences,Institute of Information Engineering,Beijing,China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"raw_affiliation_string":"School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210165038"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":"12","issue":null,"first_page":"1","last_page":"8"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7953776121139526},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.7343677282333374},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5466951131820679},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.49066197872161865},{"id":"https://openalex.org/keywords/intuition","display_name":"Intuition","score":0.4884268343448639},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.4842810034751892},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.438703715801239},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4160209596157074},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.19001948833465576}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7953776121139526},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.7343677282333374},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5466951131820679},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.49066197872161865},{"id":"https://openalex.org/C132010649","wikidata":"https://www.wikidata.org/wiki/Q189222","display_name":"Intuition","level":2,"score":0.4884268343448639},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.4842810034751892},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.438703715801239},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4160209596157074},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.19001948833465576},{"id":"https://openalex.org/C111472728","wikidata":"https://www.wikidata.org/wiki/Q9471","display_name":"Epistemology","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0},{"id":"https://openalex.org/C202444582","wikidata":"https://www.wikidata.org/wiki/Q837863","display_name":"Pure mathematics","level":1,"score":0.0},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ipccc50635.2020.9391539","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ipccc50635.2020.9391539","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2020 IEEE 39th International Performance Computing and Communications Conference (IPCCC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.6000000238418579,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":17,"referenced_works":["https://openalex.org/W1498756827","https://openalex.org/W1561983441","https://openalex.org/W1954903228","https://openalex.org/W1983776999","https://openalex.org/W2003967425","https://openalex.org/W2010562718","https://openalex.org/W2100307718","https://openalex.org/W2135349594","https://openalex.org/W2136495567","https://openalex.org/W2396855773","https://openalex.org/W2410666586","https://openalex.org/W2464432954","https://openalex.org/W2528500008","https://openalex.org/W2889547652","https://openalex.org/W2982485713","https://openalex.org/W6633578641","https://openalex.org/W6719105664"],"related_works":["https://openalex.org/W2294483539","https://openalex.org/W2378449000","https://openalex.org/W3187581118","https://openalex.org/W2938399969","https://openalex.org/W3143747655","https://openalex.org/W2002178493","https://openalex.org/W2901835651","https://openalex.org/W2883616266","https://openalex.org/W186576250","https://openalex.org/W2388837172"],"abstract_inverted_index":{"Nowadays,":[0],"we":[1,78,168,193],"have":[2,115],"witnessed":[3],"the":[4,30,53,96,137,145,177,186,195,222,255],"rise":[5],"of":[6,61,98,147,179,184,199,248,259],"botnet":[7],"malicious":[8,214],"activities.":[9],"These":[10],"botnets,":[11],"as":[12],"expected,":[13],"are":[14,36,130],"launched":[15],"by":[16],"Domain":[17],"generation":[18],"algorithm":[19],"(DGA)":[20],"to":[21,39,159,203,212],"evade":[22,46],"detection.":[23,57],"There":[24],"is":[25,67,141],"a":[26,81,108,116],"growing":[27],"concern":[28],"that":[29,111],"artificially":[31],"designed":[32],"DGA":[33,113],"detection":[34,50,66],"features":[35],"being":[37],"vulnerable":[38],"attackers,":[40],"where":[41],"any":[42],"well-designed":[43],"manipulations":[44],"would":[45],"these":[47,125,156],"existing":[48,62],"feature-based":[49],"and":[51,87,103,121,127,150,154,171,208,232,257],"even":[52],"more":[54],"robust":[55],"behavior-based":[56],"One":[58],"common":[59],"point":[60],"evasion":[63],"for":[64,188],"behavior":[65],"using":[68,84],"domain":[69,187,206],"names":[70],"with":[71],"low":[72,100,180],"query":[73,101,181],"rate.":[74],"In":[75,163],"this":[76,166],"paper,":[77],"propose":[79],"FProbe,":[80],"novel":[82],"technology":[83],"co-occurrence":[85,138],"matrix":[86],"relaxed":[88],"clustering":[89],"procedure,":[90],"which":[91,140],"performs":[92],"excellent":[93],"performance":[94],"in":[95,144,176,221,228],"scene":[97,178],"detecting":[99],"rate":[102,247],"multi-domain":[104],"evasion.":[105],"We":[106],"use":[107,155,194,209],"simple":[109],"intuition,":[110],"is,":[112],"queries":[114,238],"strong":[117],"correlation":[118],"between":[119],"temporal":[120,126],"spatial":[122,128],"features,":[123],"but":[124],"correlations":[129],"not":[131],"very":[132],"synchronous.":[133],"The":[134,216,241],"FProbe":[135,217],"uses":[136],"matrix,":[139,167],"widely":[142],"used":[143],"field":[146],"product":[148],"recommendation":[149],"word":[151],"frequency":[152],"co-occurrence,":[153],"unsupervised":[157],"methods":[158],"cluster":[160,204],"infected":[161,174],"hosts.":[162],"particular,":[164],"through":[165],"can":[169],"quickly":[170],"effectively":[172],"locate":[173],"hosts":[175],"rate,":[182],"instead":[183],"discarding":[185],"its":[189],"high":[190],"threshold.":[191],"Then,":[192],"relax":[196],"association":[197],"rules":[198],"Frequent":[200],"Sequence":[201],"Tree":[202],"related":[205],"names,":[207],"supervised":[210],"learning":[211],"determine":[213],"clusters.":[215],"has":[218],"been":[219],"evaluated":[220],"campus":[223],"network":[224],"(4000":[225],"active":[226],"users":[227],"peak":[229],"load":[230],"hours)":[231],"ISP":[233],"DNS":[234],"traffic":[235],"(one":[236],"billion":[237],"per":[239],"hour).":[240],"experimental":[242],"results":[243],"(":[244],"96.3%":[245],"accuracy":[246,258],"1.9%":[249],"false":[250],"positive":[251],"on":[252],"average)":[253],"illustrate":[254],"efficiency":[256],"FProbe.":[260]},"counts_by_year":[{"year":2022,"cited_by_count":1}],"updated_date":"2026-07-27T08:26:11.824852","created_date":"2025-10-10T00:00:00"}