{"id":"https://openalex.org/W7105612586","doi":"https://doi.org/10.1109/jiot.2025.3632406","title":"BotEvolver: Continuous Botnet Detection in Unlabeled Incremental Network Flows","display_name":"BotEvolver: Continuous Botnet Detection in Unlabeled Incremental Network Flows","publication_year":2025,"publication_date":"2025-11-13","ids":{"openalex":"https://openalex.org/W7105612586","doi":"https://doi.org/10.1109/jiot.2025.3632406"},"language":null,"primary_location":{"id":"doi:10.1109/jiot.2025.3632406","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2025.3632406","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Fan Li","orcid":"https://orcid.org/0000-0002-0631-118X"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Fan Li","raw_affiliation_strings":["School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0002-0631-118X","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, China","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Xi Luo","orcid":"https://orcid.org/0009-0008-8991-0153"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xi Luo","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0009-0008-8991-0153","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Weihong Han","orcid":"https://orcid.org/0000-0001-9997-1509"},"institutions":[{"id":"https://openalex.org/I4210136793","display_name":"Peng Cheng Laboratory","ror":"https://ror.org/03qdqbt06","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4210136793"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weihong Han","raw_affiliation_strings":["Department of New Networks, Peng Cheng Laboratory, Shenzhen, Guangdong, China"],"raw_orcid":"https://orcid.org/0000-0001-9997-1509","affiliations":[{"raw_affiliation_string":"Department of New Networks, Peng Cheng Laboratory, Shenzhen, Guangdong, China","institution_ids":["https://openalex.org/I4210136793"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Binxing Fang","orcid":"https://orcid.org/0000-0003-0305-2132"},"institutions":[{"id":"https://openalex.org/I204983213","display_name":"Harbin Institute of Technology","ror":"https://ror.org/01yqg2h08","country_code":"CN","type":"education","lineage":["https://openalex.org/I204983213"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Binxing Fang","raw_affiliation_strings":["School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, China"],"raw_orcid":"https://orcid.org/0000-0003-0305-2132","affiliations":[{"raw_affiliation_string":"School of Computer Science and Technology, Harbin Institute of Technology, Shenzhen, China","institution_ids":["https://openalex.org/I204983213"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Lihua Yin","orcid":"https://orcid.org/0000-0001-8829-4442"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lihua Yin","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0001-8829-4442","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]},{"author_position":"last","author":{"id":null,"display_name":"Jianye Yang","orcid":"https://orcid.org/0000-0003-3417-823X"},"institutions":[{"id":"https://openalex.org/I37987034","display_name":"Guangzhou University","ror":"https://ror.org/05ar8rn06","country_code":"CN","type":"education","lineage":["https://openalex.org/I37987034"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianye Yang","raw_affiliation_strings":["Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-3417-823X","affiliations":[{"raw_affiliation_string":"Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou, China","institution_ids":["https://openalex.org/I37987034"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.48500808,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"13","issue":"3","first_page":"4374","last_page":"4390"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10036","display_name":"Advanced Neural Network Applications","score":0.17080000042915344,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10036","display_name":"Advanced Neural Network Applications","score":0.17080000042915344,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.13050000369548798,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.08030000329017639,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.8644999861717224},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.6121000051498413},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.48919999599456787},{"id":"https://openalex.org/keywords/incremental-learning","display_name":"Incremental learning","score":0.48820000886917114},{"id":"https://openalex.org/keywords/annotation","display_name":"Annotation","score":0.4442000091075897},{"id":"https://openalex.org/keywords/forgetting","display_name":"Forgetting","score":0.4350000023841858},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.39890000224113464},{"id":"https://openalex.org/keywords/data-modeling","display_name":"Data modeling","score":0.39809998869895935},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.39340001344680786}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.8644999861717224},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8555999994277954},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.6121000051498413},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.48919999599456787},{"id":"https://openalex.org/C2780735816","wikidata":"https://www.wikidata.org/wiki/Q28324931","display_name":"Incremental learning","level":2,"score":0.48820000886917114},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4611000120639801},{"id":"https://openalex.org/C2776321320","wikidata":"https://www.wikidata.org/wiki/Q857525","display_name":"Annotation","level":2,"score":0.4442000091075897},{"id":"https://openalex.org/C7149132","wikidata":"https://www.wikidata.org/wiki/Q1377840","display_name":"Forgetting","level":2,"score":0.4350000023841858},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.39890000224113464},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.39809998869895935},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.39340001344680786},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.39239999651908875},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.38830000162124634},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.3878999948501587},{"id":"https://openalex.org/C157764524","wikidata":"https://www.wikidata.org/wiki/Q1383412","display_name":"Throughput","level":3,"score":0.3720000088214874},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.36579999327659607},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.359499990940094},{"id":"https://openalex.org/C89198739","wikidata":"https://www.wikidata.org/wiki/Q3079880","display_name":"Data stream mining","level":2,"score":0.32899999618530273},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.3188999891281128},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.3140000104904175},{"id":"https://openalex.org/C10144332","wikidata":"https://www.wikidata.org/wiki/Q14645","display_name":"Rootkit","level":3,"score":0.30390000343322754},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.29679998755455017},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.2892000079154968},{"id":"https://openalex.org/C114809511","wikidata":"https://www.wikidata.org/wiki/Q1412924","display_name":"Flow network","level":2,"score":0.28859999775886536},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2793999910354614},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2770000100135803},{"id":"https://openalex.org/C147168706","wikidata":"https://www.wikidata.org/wiki/Q1457734","display_name":"Recurrent neural network","level":3,"score":0.27149999141693115},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.26989999413490295},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2685999870300293},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.2639999985694885},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.2502000033855438}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/jiot.2025.3632406","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jiot.2025.3632406","pdf_url":null,"source":{"id":"https://openalex.org/S2480266640","display_name":"IEEE Internet of Things Journal","issn_l":"2327-4662","issn":["2327-4662","2372-2541"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Internet of Things Journal","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":39,"referenced_works":["https://openalex.org/W2077488147","https://openalex.org/W2093331366","https://openalex.org/W2099940443","https://openalex.org/W2296509296","https://openalex.org/W2743151379","https://openalex.org/W2799758613","https://openalex.org/W2898017895","https://openalex.org/W2963748489","https://openalex.org/W2983270658","https://openalex.org/W3001902713","https://openalex.org/W3033091443","https://openalex.org/W3117376990","https://openalex.org/W3124724827","https://openalex.org/W3131930169","https://openalex.org/W3167523712","https://openalex.org/W3173515311","https://openalex.org/W3185153723","https://openalex.org/W3197159805","https://openalex.org/W3208773001","https://openalex.org/W3208954293","https://openalex.org/W4205577106","https://openalex.org/W4212857616","https://openalex.org/W4226085896","https://openalex.org/W4226427282","https://openalex.org/W4283209458","https://openalex.org/W4285234540","https://openalex.org/W4285252602","https://openalex.org/W4289929824","https://openalex.org/W4290875619","https://openalex.org/W4290877727","https://openalex.org/W4296179092","https://openalex.org/W4296347973","https://openalex.org/W4311609954","https://openalex.org/W4324029729","https://openalex.org/W4376480418","https://openalex.org/W4386997170","https://openalex.org/W4400762160","https://openalex.org/W4407003114","https://openalex.org/W4409872302"],"related_works":[],"abstract_inverted_index":{"In":[0],"dynamic":[1],"Internet":[2],"of":[3,18,98,126],"Things":[4],"(IoT)":[5],"networks,":[6],"unlabeled":[7],"incremental":[8,49,61,104,136],"network":[9],"flows":[10],"with":[11],"evolving":[12],"distributions":[13],"severely":[14],"degrade":[15],"the":[16,96,107],"performance":[17],"deep":[19],"learning-based":[20],"botnet":[21,46,75],"detection":[22,47,62],"systems,":[23],"primarily":[24],"due":[25],"to":[26,77,110],"catastrophic":[27,79],"forgetting":[28,80],"and":[29,44,81,131,157,160],"reliance":[30],"on":[31,114],"labeled":[32],"data.":[33],"This":[34],"work":[35],"proposes":[36],"BotEvolver,":[37],"a":[38,85],"novel":[39],"framework":[40],"for":[41,168],"continuous,":[42],"efficient,":[43],"interpretable":[45],"in":[48,103,128],"flow":[50],"environments.":[51],"BotEvolver":[52,119],"integrates":[53],"two":[54],"core":[55],"components:":[56],"(1)":[57],"an":[58,65,124],"experience":[59],"replay-enabled":[60],"model":[63,89],"via":[64],"attention-based":[66],"inductive":[67],"Graph":[68],"Neural":[69],"Network":[70],"(GNN),":[71],"that":[72,90],"preserves":[73],"key":[74],"subgraphs":[76],"mitigate":[78],"enhance":[82],"interpretability;":[83],"(2)":[84],"multi-feature":[86],"active":[87],"annotation":[88,102],"generates":[91],"high-precision":[92],"pseudo-labels":[93],"while":[94],"reducing":[95],"number":[97],"IPs":[99],"requiring":[100],"manual":[101],"data":[105],"from":[106],"CTU13":[108],"dataset":[109],"<2%.":[111],"Comprehensive":[112],"evaluations":[113],"three":[115],"public":[116],"datasets":[117],"show":[118],"outperforms":[120],"state-of-the-art":[121],"methods":[122],"by":[123],"average":[125],"14.8%":[127],"online":[129],"scenarios":[130],"maintains":[132],">98.6%":[133],"F1-score":[134],"across":[135],"rounds.":[137],"Overhead":[138],"tests":[139],"confirm":[140],"its":[141],"practicality":[142],"where":[143],"peak":[144],"Graphics":[145],"Processing":[146],"Unit":[147],"(GPU)":[148],"VRAM":[149],"occupancy":[150],"is":[151],"\u22481GB,":[152],"throughput":[153],"reaches":[154],"55.46k":[155],"flows/sec":[156],"12.83k":[158],"IPs/sec,":[159],"pre-trained":[161],"models":[162],"are":[163],"\u224812MB,":[164],"enabling":[165],"distributed":[166],"deployment":[167],"real-time":[169],"monitoring.":[170]},"counts_by_year":[],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-11-13T00:00:00"}