{"id":"https://openalex.org/W7163204203","doi":"https://doi.org/10.1109/ojcoms.2026.3698844","title":"EROIKA: Enhanced Recognition of Intrusion Key Actors\u2014A Multi-Stage Botnet Detection Framework With Conditional Autoencoder and Communication Pattern Analysis","display_name":"EROIKA: Enhanced Recognition of Intrusion Key Actors\u2014A Multi-Stage Botnet Detection Framework With Conditional Autoencoder and Communication Pattern Analysis","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7163204203","doi":"https://doi.org/10.1109/ojcoms.2026.3698844"},"language":"en","primary_location":{"id":"doi:10.1109/ojcoms.2026.3698844","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcoms.2026.3698844","pdf_url":null,"source":{"id":"https://openalex.org/S4210202420","display_name":"IEEE Open Journal of the Communications Society","issn_l":"2644-125X","issn":["2644-125X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310316002","host_organization_name":"IEEE Communications Society","host_organization_lineage":["https://openalex.org/P4310316002","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Communications Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Communications Society","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/ojcoms.2026.3698844","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5076285880","display_name":"Muhammad Aidiel Rachman Putra","orcid":"https://orcid.org/0000-0002-2741-6853"},"institutions":[{"id":"https://openalex.org/I166843116","display_name":"Sepuluh Nopember Institute of Technology","ror":"https://ror.org/05kbmmt89","country_code":"ID","type":"education","lineage":["https://openalex.org/I166843116"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Muhammad Aidiel Rachman PUTRA","raw_affiliation_strings":["Department of Informatics, Institut Teknologi Sepuluh Nopember, Surabaya, Indonesia"],"raw_orcid":"https://orcid.org/0000-0002-2741-6853","affiliations":[{"raw_affiliation_string":"Department of Informatics, Institut Teknologi Sepuluh Nopember, Surabaya, Indonesia","institution_ids":["https://openalex.org/I166843116"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137640881","display_name":"Tohari Ahmad","orcid":"https://orcid.org/0000-0002-3390-0756"},"institutions":[{"id":"https://openalex.org/I166843116","display_name":"Sepuluh Nopember Institute of Technology","ror":"https://ror.org/05kbmmt89","country_code":"ID","type":"education","lineage":["https://openalex.org/I166843116"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Tohari Ahmad","raw_affiliation_strings":["Department of Informatics, Institut Teknologi Sepuluh Nopember, Surabaya, Indonesia"],"raw_orcid":"https://orcid.org/0000-0002-3390-0756","affiliations":[{"raw_affiliation_string":"Department of Informatics, Institut Teknologi Sepuluh Nopember, Surabaya, Indonesia","institution_ids":["https://openalex.org/I166843116"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044331844","display_name":"Takashi Obi","orcid":"https://orcid.org/0000-0001-9430-2728"},"institutions":[{"id":"https://openalex.org/I114531698","display_name":"Tokyo Institute of Technology","ror":"https://ror.org/0112mx960","country_code":"JP","type":"education","lineage":["https://openalex.org/I114531698"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Takashi Obi","raw_affiliation_strings":["Research Center for Aggregation of Social and Individual Sustainability, Institute of Science Tokyo, Yokohama, Japan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Research Center for Aggregation of Social and Individual Sustainability, Institute of Science Tokyo, Yokohama, Japan","institution_ids":["https://openalex.org/I114531698"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067082848","display_name":"Joong-Sun Lee","orcid":"https://orcid.org/0000-0002-6976-6472"},"institutions":[{"id":"https://openalex.org/I114531698","display_name":"Tokyo Institute of Technology","ror":"https://ror.org/0112mx960","country_code":"JP","type":"education","lineage":["https://openalex.org/I114531698"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Joong-Sun Lee","raw_affiliation_strings":["Research Center for Aggregation of Social and Individual Sustainability, Institute of Science Tokyo, Yokohama, Japan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Research Center for Aggregation of Social and Individual Sustainability, Institute of Science Tokyo, Yokohama, Japan","institution_ids":["https://openalex.org/I114531698"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137695454","display_name":"Yi-Na Jeong","orcid":null},"institutions":[{"id":"https://openalex.org/I89079967","display_name":"Catholic Kwandong University","ror":"https://ror.org/05n486907","country_code":"KR","type":"education","lineage":["https://openalex.org/I89079967"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Yi-Na Jeong","raw_affiliation_strings":["Department of Software, Catholic Kwandong University, Gangneung-si, Gangwon-do, South Korea"],"raw_orcid":"https://orcid.org/0009-0007-6887-5013","affiliations":[{"raw_affiliation_string":"Department of Software, Catholic Kwandong University, Gangneung-si, Gangwon-do, South Korea","institution_ids":["https://openalex.org/I89079967"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5030925726","display_name":"Dandy Pramana Hostiadi","orcid":"https://orcid.org/0000-0003-0096-8049"},"institutions":[{"id":"https://openalex.org/I4210165687","display_name":"Universitas Teknologi Indonesia","ror":"https://ror.org/04eqd3f31","country_code":"ID","type":"education","lineage":["https://openalex.org/I4210165687"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Dandy Pramana Hostiadi","raw_affiliation_strings":["Department of Magister Information Systems, Institut Teknologi dan Bisnis STIKOM Bali, Denpasar, Indonesia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Magister Information Systems, Institut Teknologi dan Bisnis STIKOM Bali, Denpasar, Indonesia","institution_ids":["https://openalex.org/I4210165687"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5018533392","display_name":"Royyana Muslim Ijtihadie","orcid":"https://orcid.org/0000-0001-7168-1235"},"institutions":[{"id":"https://openalex.org/I166843116","display_name":"Sepuluh Nopember Institute of Technology","ror":"https://ror.org/05kbmmt89","country_code":"ID","type":"education","lineage":["https://openalex.org/I166843116"]}],"countries":["ID"],"is_corresponding":false,"raw_author_name":"Royyana Muslim Ijtihadie","raw_affiliation_strings":["Department of Informatics, Institut Teknologi Sepuluh Nopember, Surabaya, Indonesia"],"raw_orcid":"https://orcid.org/0000-0001-7168-1235","affiliations":[{"raw_affiliation_string":"Department of Informatics, Institut Teknologi Sepuluh Nopember, Surabaya, Indonesia","institution_ids":["https://openalex.org/I166843116"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1750,"currency":"USD","value_usd":1750},"apc_paid":{"value":1750,"currency":"USD","value_usd":1750},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.63402909,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"7","issue":null,"first_page":"6156","last_page":"6177"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9096999764442444,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9096999764442444,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.00559999980032444,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.0052999998442828655,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5842000246047974},{"id":"https://openalex.org/keywords/autoencoder","display_name":"Autoencoder","score":0.5593000054359436},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.545199990272522},{"id":"https://openalex.org/keywords/pattern-analysis","display_name":"Pattern analysis","score":0.5404999852180481},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5307000279426575},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.4090999960899353},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.400299996137619}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6933000087738037},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5842000246047974},{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.5593000054359436},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.545199990272522},{"id":"https://openalex.org/C2985264313","wikidata":"https://www.wikidata.org/wiki/Q378859","display_name":"Pattern analysis","level":2,"score":0.5404999852180481},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5307000279426575},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4722000062465668},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.41600000858306885},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.4090999960899353},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4072999954223633},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.400299996137619},{"id":"https://openalex.org/C83804111","wikidata":"https://www.wikidata.org/wiki/Q1063558","display_name":"Behavioral pattern","level":2,"score":0.2994999885559082},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.29339998960494995},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2930999994277954},{"id":"https://openalex.org/C192126672","wikidata":"https://www.wikidata.org/wiki/Q1068715","display_name":"Telecommunications network","level":2,"score":0.2815999984741211},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.27799999713897705},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.2660999894142151},{"id":"https://openalex.org/C27061796","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion prevention system","level":3,"score":0.25110000371932983},{"id":"https://openalex.org/C137524506","wikidata":"https://www.wikidata.org/wiki/Q2247688","display_name":"Anomaly-based intrusion detection system","level":3,"score":0.2508000135421753}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/ojcoms.2026.3698844","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcoms.2026.3698844","pdf_url":null,"source":{"id":"https://openalex.org/S4210202420","display_name":"IEEE Open Journal of the Communications Society","issn_l":"2644-125X","issn":["2644-125X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310316002","host_organization_name":"IEEE Communications Society","host_organization_lineage":["https://openalex.org/P4310316002","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Communications Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Communications Society","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:c213ccb1c54543ba866ea8f1506fe06d","is_oa":true,"landing_page_url":"https://doaj.org/article/c213ccb1c54543ba866ea8f1506fe06d","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Open Journal of the Communications Society, Vol 7, Pp 6156-6177 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/ojcoms.2026.3698844","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcoms.2026.3698844","pdf_url":null,"source":{"id":"https://openalex.org/S4210202420","display_name":"IEEE Open Journal of the Communications Society","issn_l":"2644-125X","issn":["2644-125X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310316002","host_organization_name":"IEEE Communications Society","host_organization_lineage":["https://openalex.org/P4310316002","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Communications Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Communications Society","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2450794153","display_name":null,"funder_award_id":"4299/B3/DT.03.08/2025 & No 3029/PKS/ITS/2025","funder_id":"https://openalex.org/F4320328515","funder_display_name":"Lembaga Pengelola Dana Pendidikan"}],"funders":[{"id":"https://openalex.org/F4320328515","display_name":"Lembaga Pengelola Dana Pendidikan","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Botnets":[0],"pose":[1],"a":[2,80,110,139,171,176,193],"persistent":[3],"and":[4,17,28,105,112,148,162,238,254],"significant":[5],"threat":[6],"to":[7,63,74,86,92,158,196],"network":[8,119],"security":[9],"by":[10,128,170],"concealing":[11],"their":[12],"presence":[13],"within":[14],"legitimate":[15],"traffic":[16,120,150],"executing":[18],"various":[19],"attacks,":[20],"including":[21],"distributed":[22],"denial-of-service":[23],"(DDoS)":[24],"assaults,":[25],"phishing":[26],"schemes,":[27],"malware":[29],"dissemination.":[30],"Existing":[31],"research":[32],"on":[33,39,145,207],"botnet":[34,65,88,149,186,210],"detection":[35,135,154,219],"has":[36],"primarily":[37],"focused":[38],"recognizing":[40],"malicious":[41],"activities,":[42],"often":[43],"overlooking":[44],"the":[45,64,70,94,153,180,198,202],"identification":[46],"of":[47,182,227,230,233,236,240],"key":[48,56,96,199],"individuals":[49],"responsible":[50,98],"for":[51,99,251,257],"these":[52,55],"intrusions.":[53],"Recognizing":[54],"actors":[57,97,200],"is":[58,136,143,168],"essential,":[59],"as":[60,125],"blocking":[61],"access":[62],"attacker":[66],"does":[67],"not":[68,84],"solve":[69],"problem.":[71],"In":[72],"response":[73],"this":[75],"gap,":[76],"we":[77],"propose":[78],"EROIKA,":[79],"multi-stage":[81],"framework":[82,116,222],"designed":[83],"only":[85],"detect":[87],"activities":[89],"but":[90],"also":[91],"identify":[93],"intrusion":[95],"them.":[100],"EROIKA":[101,243],"integrates":[102],"class-conditional":[103,140],"autoencoders":[104],"communication":[106,160],"pattern":[107],"analysis":[108,167,195],"with":[109,212],"correlation":[111],"confidence-score":[113],"approach.":[114],"The":[115,188,221],"initially":[117],"preprocesses":[118],"data,":[121],"tackling":[122],"issues":[123],"such":[124],"data":[126],"imbalance":[127],"filtering":[129],"out":[130],"prominent":[131],"background":[132],"activities.":[133,204],"Anomaly":[134],"achieved":[137],"through":[138],"autoencoder,":[141],"which":[142],"trained":[144],"both":[146],"normal":[147],"patterns.":[151],"Subsequently,":[152],"outcomes":[155],"are":[156],"examined":[157],"uncover":[159],"patterns":[161],"categorize":[163],"attack":[164,214],"clusters.":[165],"This":[166],"followed":[169],"decision-making":[172,246],"phase":[173],"that":[174],"assigns":[175],"confidence":[177],"score":[178],"indicating":[179],"likelihood":[181],"host":[183],"participation":[184],"in":[185],"activity.":[187],"final":[189],"stage":[190],"involves":[191],"conducting":[192],"root-cause":[194],"pinpoint":[197],"behind":[201],"invasive":[203],"Evaluations":[205],"conducted":[206],"three":[208],"well-known":[209],"datasets":[211],"varying":[213],"characteristics":[215],"demonstrate":[216],"EROIKA\u2019s":[217],"impressive":[218],"capabilities.":[220],"achieves":[223],"an":[224],"average":[225],"accuracy":[226],"99.61%,":[228],"precision":[229],"83.18%,":[231],"recall":[232],"94.46%,":[234],"F1-score":[235],"87.79%,":[237],"F2-score":[239],"91.39%.":[241],"Furthermore,":[242],"exhibits":[244],"efficient":[245],"times,":[247],"averaging":[248],"0.61":[249],"milliseconds":[250,256],"bulk":[252],"processing":[253],"5.78":[255],"real-time":[258],"scenarios.":[259]},"counts_by_year":[],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2026-06-03T00:00:00"}