{"id":"https://openalex.org/W2548810364","doi":"https://doi.org/10.1109/mnet.2016.1500116nm","title":"Big Data Behavioral Analytics Meet Graph Theory: On Effective Botnet Takedowns","display_name":"Big Data Behavioral Analytics Meet Graph Theory: On Effective Botnet Takedowns","publication_year":2016,"publication_date":"2016-11-03","ids":{"openalex":"https://openalex.org/W2548810364","doi":"https://doi.org/10.1109/mnet.2016.1500116nm","mag":"2548810364"},"language":"en","primary_location":{"id":"doi:10.1109/mnet.2016.1500116nm","is_oa":false,"landing_page_url":"https://doi.org/10.1109/mnet.2016.1500116nm","pdf_url":null,"source":{"id":"https://openalex.org/S186584794","display_name":"IEEE Network","issn_l":"0890-8044","issn":["0890-8044","1558-156X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Network","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5039079298","display_name":"Elias Bou\u2010Harb","orcid":"https://orcid.org/0000-0001-8040-4635"},"institutions":[{"id":"https://openalex.org/I63772739","display_name":"Florida Atlantic University","ror":"https://ror.org/05p8w6387","country_code":"US","type":"education","lineage":["https://openalex.org/I63772739"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Elias Bou-Harb","raw_affiliation_strings":["Florida Atlantic University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Florida Atlantic University","institution_ids":["https://openalex.org/I63772739"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028605138","display_name":"Mourad Debbabi","orcid":"https://orcid.org/0000-0003-3015-3043"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mourad Debbabi","raw_affiliation_strings":["Condordia University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Condordia University","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5072393948","display_name":"Chadi Assi","orcid":"https://orcid.org/0000-0002-3161-1846"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chadi Assi","raw_affiliation_strings":["Condordia University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Condordia University","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.9831,"has_fulltext":false,"cited_by_count":33,"citation_normalized_percentile":{"value":0.88436785,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":98},"biblio":{"volume":"31","issue":"1","first_page":"18","last_page":"26"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9965000152587891,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.9662979245185852},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8239213228225708},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6964492797851562},{"id":"https://openalex.org/keywords/big-data","display_name":"Big data","score":0.6690791845321655},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.597179651260376},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.592766284942627},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.49366840720176697},{"id":"https://openalex.org/keywords/analytics","display_name":"Analytics","score":0.45543205738067627},{"id":"https://openalex.org/keywords/cyberspace","display_name":"Cyberspace","score":0.45053738355636597},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.2860504388809204},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.2176811397075653},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.13950863480567932}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.9662979245185852},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8239213228225708},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6964492797851562},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.6690791845321655},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.597179651260376},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.592766284942627},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.49366840720176697},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.45543205738067627},{"id":"https://openalex.org/C2781241145","wikidata":"https://www.wikidata.org/wiki/Q204606","display_name":"Cyberspace","level":3,"score":0.45053738355636597},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.2860504388809204},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2176811397075653},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.13950863480567932}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/mnet.2016.1500116nm","is_oa":false,"landing_page_url":"https://doi.org/10.1109/mnet.2016.1500116nm","pdf_url":null,"source":{"id":"https://openalex.org/S186584794","display_name":"IEEE Network","issn_l":"0890-8044","issn":["0890-8044","1558-156X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Network","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.4399999976158142,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W1481472066","https://openalex.org/W1530266714","https://openalex.org/W1598064945","https://openalex.org/W1775772884","https://openalex.org/W1979964565","https://openalex.org/W1995823970","https://openalex.org/W2075986968","https://openalex.org/W2082758646","https://openalex.org/W2091614396","https://openalex.org/W2100307718","https://openalex.org/W2101016216","https://openalex.org/W2102262986","https://openalex.org/W2102671922","https://openalex.org/W2124808847","https://openalex.org/W2126623642","https://openalex.org/W2155372789","https://openalex.org/W2170924378","https://openalex.org/W2173213060","https://openalex.org/W6628600657","https://openalex.org/W6631578680","https://openalex.org/W6638021444"],"related_works":["https://openalex.org/W2294483539","https://openalex.org/W2368745349","https://openalex.org/W2378449000","https://openalex.org/W2901835651","https://openalex.org/W2372005904","https://openalex.org/W144012884","https://openalex.org/W3167675181","https://openalex.org/W2929621094","https://openalex.org/W1996006176","https://openalex.org/W4285325964"],"abstract_inverted_index":{"Cyberspace":[0],"continues":[1],"to":[2,13,60,98,125,146,167],"host":[3],"highly":[4],"sophisticated":[5],"malicious":[6,117,210],"entities":[7,23],"that":[8,154],"have":[9,24,78,92,111],"demonstrated":[10],"their":[11,37],"ability":[12],"launch":[14],"debilitating,":[15],"intimidating,":[16],"and":[17,43,64,100,169,178,247,251,266],"disrupting":[18],"cyber":[19,81,151],"attacks.":[20],"Recently,":[21],"such":[22,88,103,144],"been":[25],"adopting":[26],"orchestrated,":[27],"often":[28],"botmaster-":[29],"coordinated,":[30],"stealthy":[31],"attack":[32],"strategies":[33],"aimed":[34],"at":[35],"maximizing":[36],"targets'":[38],"coverage":[39],"while":[40],"minimizing":[41],"redundancy":[42],"overlap.":[44],"The":[45],"latter":[46],"entities,":[47],"which":[48,204],"are":[49,56],"typically":[50],"dubbed":[51],"as":[52],"bots":[53,173],"within":[54],"botnets,":[55,89],"ominously":[57],"being":[58],"leveraged":[59],"cause":[61],"drastic":[62],"Internet-wide":[63],"enterprise":[65],"impacts":[66],"by":[67,196,256],"means":[68],"of":[69,75,87,96,115,182,192,200,260],"severe":[70],"misdemeanors.":[71],"While":[72],"a":[73,127,148,175,206,232,248],"plethora":[74],"literature":[76],"approaches":[77],"devised":[79],"operational":[80],"security":[82,152],"techniques":[83],"for":[84,185,225],"the":[85,94,106,180,183,190,193,201,241,273],"detection":[86],"very":[90,207],"few":[91],"tackled":[93],"problem":[95],"how":[97],"promptly":[99],"effectively":[101],"takedown":[102],"botnets.":[104],"In":[105],"past":[107],"three":[108],"years,":[109],"we":[110],"received":[112],"12":[113,139],"GB":[114,199],"daily":[116],"real":[118,209,261],"darknet":[119,262],"data":[120,145,157,224,238],"(i.e.,":[121],"Internet":[122],"traffic":[123],"destined":[124],"half":[126],"million":[128],"routable":[129],"but":[130],"unallocated":[131],"IP":[132],"addresses":[133],"or":[134],"sensors)":[135],"from":[136,272],"more":[137,249],"than":[138],"countries.":[140],"This":[141],"article":[142,229],"exploits":[143],"propose":[147],"novel":[149],"Internet-scale":[150,171,211],"capability":[153],"fuses":[155],"big":[156,223,237],"behavioral":[158],"analytics":[159],"in":[160,174],"conjunction":[161],"with":[162,222],"formal":[163],"graph":[164],"theoretical":[165],"concepts":[166],"infer":[168],"attribute":[170],"infected":[172],"prompt":[176],"manner":[177],"identify":[179],"niche":[181],"botnet":[184],"effective":[186],"takedowns.":[187],"We":[188],"validate":[189],"accuracy":[191],"proposed":[194],"approach":[195],"employing":[197,257],"100":[198],"Carna":[202],"botnet,":[203],"is":[205,215],"recent":[208],"botnet.":[212],"Since":[213],"performance":[214],"also":[216],"an":[217],"imperative":[218],"metric":[219],"when":[220],"dealing":[221],"network":[226],"security,":[227],"this":[228,277],"further":[230],"provides":[231],"comparison":[233],"between":[234],"two":[235],"trending":[236],"processing":[239],"architectures:":[240],"almost":[242],"standard":[243],"Apache":[244],"Hadoop":[245],"system,":[246],"traditional":[250],"simplistic":[252],"multi-threaded":[253],"programming":[254],"approach,":[255],"1":[258],"TB":[259],"data.":[263],"Several":[264],"recommendations":[265],"possible":[267],"future":[268],"research":[269],"work":[270],"derived":[271],"previous":[274],"experiments":[275],"conclude":[276],"article.":[278]},"counts_by_year":[{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":5},{"year":2022,"cited_by_count":6},{"year":2021,"cited_by_count":4},{"year":2020,"cited_by_count":5},{"year":2019,"cited_by_count":2},{"year":2018,"cited_by_count":3},{"year":2017,"cited_by_count":2}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}