{"id":"https://openalex.org/W2921489229","doi":"https://doi.org/10.1109/malware.2018.8659359","title":"An adversarial coupon-collector model of asynchronous moving-target defense against botnet reconnaissance","display_name":"An adversarial coupon-collector model of asynchronous moving-target defense against botnet reconnaissance","publication_year":2018,"publication_date":"2018-10-01","ids":{"openalex":"https://openalex.org/W2921489229","doi":"https://doi.org/10.1109/malware.2018.8659359","mag":"2921489229"},"language":"en","primary_location":{"id":"doi:10.1109/malware.2018.8659359","is_oa":false,"landing_page_url":"https://doi.org/10.1109/malware.2018.8659359","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2018 13th International Conference on Malicious and Unwanted Software (MALWARE)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5063903486","display_name":"George Kesidis","orcid":"https://orcid.org/0000-0001-7947-8127"},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"George Kesidis","raw_affiliation_strings":["Pennsylvania State University, University Park, PA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Pennsylvania State University, University Park, PA, USA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5112054372","display_name":"Yuquan Shan","orcid":null},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yuquan Shan","raw_affiliation_strings":["Pennsylvania State University, University Park, PA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Pennsylvania State University, University Park, PA, USA","institution_ids":["https://openalex.org/I130769515"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5022805840","display_name":"Daniel Fleck","orcid":null},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Daniel Fleck","raw_affiliation_strings":["George Mason University, Fairfax, VA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"George Mason University, Fairfax, VA, USA","institution_ids":["https://openalex.org/I162714631"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041500780","display_name":"Angelos Stavrou","orcid":"https://orcid.org/0000-0001-9888-0592"},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Angelos Stavrou","raw_affiliation_strings":["George Mason University, Fairfax, VA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"George Mason University, Fairfax, VA, USA","institution_ids":["https://openalex.org/I162714631"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5003056962","display_name":"Takis Konstantopoulos","orcid":"https://orcid.org/0000-0002-4258-6420"},"institutions":[{"id":"https://openalex.org/I146655781","display_name":"University of Liverpool","ror":"https://ror.org/04xs57h96","country_code":"GB","type":"education","lineage":["https://openalex.org/I146655781"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Takis Konstantopoulos","raw_affiliation_strings":["University of Liverpool, Liverpool, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Liverpool, Liverpool, UK","institution_ids":["https://openalex.org/I146655781"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.1976,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.61370534,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"61","last_page":"67"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9983999729156494,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9937999844551086,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11017","display_name":"Chaos-based Image/Signal Encryption","score":0.9909999966621399,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.8393404483795166},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.7758437395095825},{"id":"https://openalex.org/keywords/asynchronous-communication","display_name":"Asynchronous communication","score":0.6838338375091553},{"id":"https://openalex.org/keywords/coupon","display_name":"Coupon","score":0.6692147254943848},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6030388474464417},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5864994525909424},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.3103201389312744},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.2552841901779175},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.1447526514530182},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.11128115653991699},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.11068910360336304}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.8393404483795166},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.7758437395095825},{"id":"https://openalex.org/C151319957","wikidata":"https://www.wikidata.org/wiki/Q752739","display_name":"Asynchronous communication","level":2,"score":0.6838338375091553},{"id":"https://openalex.org/C2779307704","wikidata":"https://www.wikidata.org/wiki/Q11794832","display_name":"Coupon","level":2,"score":0.6692147254943848},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6030388474464417},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5864994525909424},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3103201389312744},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2552841901779175},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.1447526514530182},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.11128115653991699},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.11068910360336304},{"id":"https://openalex.org/C10138342","wikidata":"https://www.wikidata.org/wiki/Q43015","display_name":"Finance","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/malware.2018.8659359","is_oa":false,"landing_page_url":"https://doi.org/10.1109/malware.2018.8659359","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2018 13th International Conference on Malicious and Unwanted Software (MALWARE)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":8,"referenced_works":["https://openalex.org/W1512308554","https://openalex.org/W1997857984","https://openalex.org/W2086802441","https://openalex.org/W2766180430","https://openalex.org/W2793664539","https://openalex.org/W2798794862","https://openalex.org/W6630681825","https://openalex.org/W6649740811"],"related_works":["https://openalex.org/W2294483539","https://openalex.org/W2378449000","https://openalex.org/W3187581118","https://openalex.org/W2938399969","https://openalex.org/W3143747655","https://openalex.org/W2002178493","https://openalex.org/W2901835651","https://openalex.org/W2883616266","https://openalex.org/W186576250","https://openalex.org/W2372254325"],"abstract_inverted_index":{"We":[0],"consider":[1,47],"a":[2,6,23,26,43,48,83,92,122],"moving-target":[3],"defense":[4],"of":[5,10,35,95,111,121],"proxied":[7],"multiserver":[8],"tenant":[9],"the":[11,14,30,33,53,63,98,107,115,119,133,138,146,149],"cloud":[12],"where":[13,37,52],"proxies":[15,39,54,89,112,142],"dynamically":[16],"change":[17,40,56,90,143],"to":[18,71,105,145],"defeat":[19],"reconnaissance":[20],"activity":[21],"by":[22,114,132],"botnet":[24],"planning":[25],"DDoS":[27],"attack":[28],"targeting":[29],"tenant.":[31],"Unlike":[32],"system":[34,51],"[4]":[36],"all":[38],"simultaneously":[41],"at":[42,140],"fixed":[44],"rate,":[45],"we":[46,81,117],"more":[49,57],"\u201cresponsive\u201d":[50],"may":[55],"rapidly":[58],"and":[59],"selectively":[60],"based":[61],"on":[62],"current":[64],"session":[65],"request":[66,152],"intensity,":[67],"which":[68,141],"is":[69,154],"expected":[70],"be":[72],"abnormally":[73],"large":[74],"during":[75],"active":[76],"reconnaissance.":[77],"In":[78,103],"this":[79],"paper,":[80],"study":[82,118],"tractable":[84],"\u201cadversarial\u201d":[85],"coupon-collector":[86],"model":[87],"wherein":[88],"after":[91],"random":[93],"period":[94],"time":[96],"from":[97],"latest":[99],"request,":[100],"i.e.,":[101],"asynchronously.":[102],"addition":[104],"determining":[106],"stationary":[108],"mean":[109],"number":[110],"discovered":[113],"attacker,":[116],"age":[120],"proxy":[123],"(coupon":[124],"type)":[125],"when":[126,148],"it":[127],"has":[128],"been":[129],"identified":[130],"(requested)":[131],"botnet.":[134],"This":[135],"gives":[136],"us":[137],"rate":[139],"(cost":[144],"defender)":[147],"nominal":[150],"client":[151],"load":[153],"relatively":[155],"negligible.":[156]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1},{"year":2020,"cited_by_count":1}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}