{"id":"https://openalex.org/W7123674658","doi":"https://doi.org/10.1109/iscc65549.2025.11326287","title":"Insight of Command & Control Behavior: Identifying Red-Team Traffic from Sub-flow Aspect","display_name":"Insight of Command & Control Behavior: Identifying Red-Team Traffic from Sub-flow Aspect","publication_year":2025,"publication_date":"2025-07-02","ids":{"openalex":"https://openalex.org/W7123674658","doi":"https://doi.org/10.1109/iscc65549.2025.11326287"},"language":null,"primary_location":{"id":"doi:10.1109/iscc65549.2025.11326287","is_oa":false,"landing_page_url":"https://doi.org/10.1109/iscc65549.2025.11326287","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Symposium on Computers and Communications (ISCC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5122974418","display_name":"Qiang Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qiang Wang","raw_affiliation_strings":["Institute of Information Engineering CAS,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering CAS,Beijing,China","institution_ids":["https://openalex.org/I4210156404"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5059058463","display_name":"Gang Yang","orcid":"https://orcid.org/0000-0003-2576-013X"},"institutions":[{"id":"https://openalex.org/I4210136246","display_name":"China Telecom (China)","ror":"https://ror.org/03jgnzt20","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210136246"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Gang Yang","raw_affiliation_strings":["China Telecom Cybersecurity Technology Co.,Ltd,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"China Telecom Cybersecurity Technology Co.,Ltd,Beijing,China","institution_ids":["https://openalex.org/I4210136246"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.5992000102996826,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.5992000102996826,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.2328999936580658,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.042100001126527786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.652899980545044},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.6222000122070312},{"id":"https://openalex.org/keywords/perspective","display_name":"Perspective (graphical)","score":0.5174999833106995},{"id":"https://openalex.org/keywords/command-and-control","display_name":"Command and control","score":0.5078999996185303},{"id":"https://openalex.org/keywords/block","display_name":"Block (permutation group theory)","score":0.4846000075340271},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.4244000017642975},{"id":"https://openalex.org/keywords/traffic-flow","display_name":"Traffic flow (computer networking)","score":0.4226999878883362},{"id":"https://openalex.org/keywords/representation","display_name":"Representation (politics)","score":0.38659998774528503}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6938999891281128},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.652899980545044},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.6222000122070312},{"id":"https://openalex.org/C12713177","wikidata":"https://www.wikidata.org/wiki/Q1900281","display_name":"Perspective (graphical)","level":2,"score":0.5174999833106995},{"id":"https://openalex.org/C506615639","wikidata":"https://www.wikidata.org/wiki/Q21662260","display_name":"Command and control","level":2,"score":0.5078999996185303},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.4846000075340271},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.4244000017642975},{"id":"https://openalex.org/C207512268","wikidata":"https://www.wikidata.org/wiki/Q3074551","display_name":"Traffic flow (computer networking)","level":2,"score":0.4226999878883362},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.38659998774528503},{"id":"https://openalex.org/C2781317605","wikidata":"https://www.wikidata.org/wiki/Q7832483","display_name":"Traffic analysis","level":2,"score":0.36980000138282776},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3677999973297119},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.33959999680519104},{"id":"https://openalex.org/C103278499","wikidata":"https://www.wikidata.org/wiki/Q254465","display_name":"Similarity (geometry)","level":3,"score":0.32019999623298645},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.31630000472068787},{"id":"https://openalex.org/C2779304628","wikidata":"https://www.wikidata.org/wiki/Q3503480","display_name":"Face (sociological concept)","level":2,"score":0.3131999969482422},{"id":"https://openalex.org/C46451311","wikidata":"https://www.wikidata.org/wiki/Q262550","display_name":"Traffic shaping","level":4,"score":0.30970001220703125},{"id":"https://openalex.org/C144745244","wikidata":"https://www.wikidata.org/wiki/Q4927286","display_name":"Blocking (statistics)","level":2,"score":0.29330000281333923},{"id":"https://openalex.org/C176715033","wikidata":"https://www.wikidata.org/wiki/Q2080768","display_name":"Traffic generation model","level":2,"score":0.28940001130104065},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.27070000767707825},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2632000148296356},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2574999928474426}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/iscc65549.2025.11326287","is_oa":false,"landing_page_url":"https://doi.org/10.1109/iscc65549.2025.11326287","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Symposium on Computers and Communications (ISCC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":19,"referenced_works":["https://openalex.org/W2040920300","https://openalex.org/W2085313531","https://openalex.org/W2149193850","https://openalex.org/W2156453323","https://openalex.org/W2190207511","https://openalex.org/W2314393098","https://openalex.org/W2537766808","https://openalex.org/W2737801898","https://openalex.org/W2743735681","https://openalex.org/W2765312167","https://openalex.org/W2768426510","https://openalex.org/W2884975379","https://openalex.org/W2915004662","https://openalex.org/W2919493784","https://openalex.org/W2924689635","https://openalex.org/W2964136807","https://openalex.org/W3007562398","https://openalex.org/W3021740526","https://openalex.org/W4285238962"],"related_works":[],"abstract_inverted_index":{"Identifying":[0],"malicious":[1,115],"Command":[2],"&":[3],"Control":[4],"(C&C)":[5],"traffic":[6,23,33,137,148,158],"in":[7,72],"cyberattacks":[8],"is":[9],"critically":[10],"important,":[11],"yet":[12],"current":[13],"approaches":[14],"face":[15],"numerous":[16],"challenges.":[17],"This":[18,119],"paper":[19],"focuses":[20],"on":[21,110,156],"C&C":[22,57,74,90,97,136,147,157],"generated":[24],"by":[25,36,154],"real-world":[26,160],"red-team":[27],"cyberattacks,":[28],"diverging":[29],"from":[30,40,100,159],"traditional":[31],"botnet":[32],"identification":[34],"studies":[35],"approaching":[37],"the":[38,41,53,67,73,92],"issue":[39],"perspective":[42],"of":[43,56,69],"understanding":[44],"complex":[45,63],"cyberattack":[46],"behaviors.":[47],"Leveraging":[48],"expert":[49],"knowledge,":[50],"we":[51,76,95],"distill":[52],"intrinsic":[54],"characteristics":[55],"traffic,":[58],"emphasizing":[59],"longduration":[60],"flow":[61],"and":[62,114,128],"interaction.":[64],"To":[65],"address":[66],"lack":[68],"refined":[70],"labels":[71],"phase,":[75],"design":[77],"a":[78,101,105,151],"filtering":[79],"method":[80,120,145],"that":[81],"aggregates":[82],"long-duration":[83],"flow,":[84],"providing":[85],"label":[86],"dataset":[87],"support":[88],"for":[89,146],"characterization.For":[91],"first":[93],"time,":[94],"analyze":[96],"network":[98],"behavior":[99,112,117],"sub-flow":[102,111,122],"aspect,":[103],"proposing":[104],"novel":[106],"representation":[107],"approach":[108,140],"based":[109],"block":[113],"interaction":[116],"vector.":[118],"integrates":[121],"aggregation":[123],"feature,":[124,127],"subflow":[125],"similarity":[126],"long-flow":[129],"characteristic,":[130],"achieving":[131],"robust":[132],"recognition":[133],"performance":[134],"across":[135],"datasets.":[138],"Our":[139],"offers":[141],"an":[142],"effective":[143],"new":[144],"identification,":[149],"addressing":[150],"research":[152],"gap":[153],"focusing":[155],"red-team.":[161]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-01-14T00:00:00"}