{"id":"https://openalex.org/W2327762824","doi":"https://doi.org/10.1109/tcns.2016.2532804","title":"Botnet Detection Based on Anomaly and Community Detection","display_name":"Botnet Detection Based on Anomaly and Community Detection","publication_year":2016,"publication_date":"2016-02-29","ids":{"openalex":"https://openalex.org/W2327762824","doi":"https://doi.org/10.1109/tcns.2016.2532804","mag":"2327762824"},"language":"en","primary_location":{"id":"doi:10.1109/tcns.2016.2532804","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tcns.2016.2532804","pdf_url":null,"source":{"id":"https://openalex.org/S2502544478","display_name":"IEEE Transactions on Control of Network Systems","issn_l":"2325-5870","issn":["2325-5870","2372-2533"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Control of Network Systems","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101984165","display_name":"Jing Wang","orcid":"https://orcid.org/0000-0002-9653-7253"},"institutions":[{"id":"https://openalex.org/I111088046","display_name":"Boston University","ror":"https://ror.org/05qwgg493","country_code":"US","type":"education","lineage":["https://openalex.org/I111088046"]},{"id":"https://openalex.org/I4210155419","display_name":"Center for Systems Biology","ror":"https://ror.org/05r3dyn47","country_code":"US","type":"facility","lineage":["https://openalex.org/I136199984","https://openalex.org/I4210087915","https://openalex.org/I4210155419","https://openalex.org/I48633490"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jing Wang","raw_affiliation_strings":["Center for Information and Systems Engineering, Boston University, Brookline, MA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Center for Information and Systems Engineering, Boston University, Brookline, MA, USA","institution_ids":["https://openalex.org/I4210155419","https://openalex.org/I111088046"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5075696701","display_name":"Ioannis Ch. Paschalidis","orcid":"https://orcid.org/0000-0002-3343-2913"},"institutions":[{"id":"https://openalex.org/I111088046","display_name":"Boston University","ror":"https://ror.org/05qwgg493","country_code":"US","type":"education","lineage":["https://openalex.org/I111088046"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ioannis Ch. Paschalidis","raw_affiliation_strings":["Department of Electrical and Computer Engineering, and Division of Systems Engineering, Boston University, Boston, MA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering, and Division of Systems Engineering, Boston University, Boston, MA, USA","institution_ids":["https://openalex.org/I111088046"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.6339,"has_fulltext":false,"cited_by_count":109,"citation_normalized_percentile":{"value":0.97214213,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":100},"biblio":{"volume":"4","issue":"2","first_page":"392","last_page":"404"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10064","display_name":"Complex Network Analysis Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/3109","display_name":"Statistical and Nonlinear Physics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10064","display_name":"Complex Network Analysis Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/3109","display_name":"Statistical and Nonlinear Physics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9977999925613403,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.8662121295928955},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7372150421142578},{"id":"https://openalex.org/keywords/maximization","display_name":"Maximization","score":0.5065122842788696},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.48029324412345886},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.460659921169281},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.450194388628006},{"id":"https://openalex.org/keywords/node","display_name":"Node (physics)","score":0.4491267204284668},{"id":"https://openalex.org/keywords/modularity","display_name":"Modularity (biology)","score":0.43201613426208496},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.337796151638031},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.2934195399284363},{"id":"https://openalex.org/keywords/mathematical-optimization","display_name":"Mathematical optimization","score":0.20983710885047913},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.15655922889709473}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.8662121295928955},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7372150421142578},{"id":"https://openalex.org/C2776330181","wikidata":"https://www.wikidata.org/wiki/Q18358244","display_name":"Maximization","level":2,"score":0.5065122842788696},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.48029324412345886},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.460659921169281},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.450194388628006},{"id":"https://openalex.org/C62611344","wikidata":"https://www.wikidata.org/wiki/Q1062658","display_name":"Node (physics)","level":2,"score":0.4491267204284668},{"id":"https://openalex.org/C2779478453","wikidata":"https://www.wikidata.org/wiki/Q6889748","display_name":"Modularity (biology)","level":2,"score":0.43201613426208496},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.337796151638031},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.2934195399284363},{"id":"https://openalex.org/C126255220","wikidata":"https://www.wikidata.org/wiki/Q141495","display_name":"Mathematical optimization","level":1,"score":0.20983710885047913},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.15655922889709473},{"id":"https://openalex.org/C66938386","wikidata":"https://www.wikidata.org/wiki/Q633538","display_name":"Structural engineering","level":1,"score":0.0},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0},{"id":"https://openalex.org/C54355233","wikidata":"https://www.wikidata.org/wiki/Q7162","display_name":"Genetics","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tcns.2016.2532804","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tcns.2016.2532804","pdf_url":null,"source":{"id":"https://openalex.org/S2502544478","display_name":"IEEE Transactions on Control of Network Systems","issn_l":"2325-5870","issn":["2325-5870","2372-2533"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Control of Network Systems","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.4399999976158142,"id":"https://metadata.un.org/sdg/10","display_name":"Reduced inequalities"}],"awards":[{"id":"https://openalex.org/G2552743231","display_name":null,"funder_award_id":"N00014-10-1-0952","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"},{"id":"https://openalex.org/G5031208370","display_name":null,"funder_award_id":"W911NF-12-1-0390","funder_id":"https://openalex.org/F4320338281","funder_display_name":"Army Research Office"},{"id":"https://openalex.org/G5192761334","display_name":null,"funder_award_id":"CNS-1239021","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G5821627941","display_name":null,"funder_award_id":"IIS-1237022","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G6377098844","display_name":null,"funder_award_id":"W911NF-11-1-0227","funder_id":"https://openalex.org/F4320338281","funder_display_name":"Army Research Office"},{"id":"https://openalex.org/G960070933","display_name":null,"funder_award_id":"CCF-1527292","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320337345","display_name":"Office of Naval Research","ror":"https://ror.org/00rk2pe57"},{"id":"https://openalex.org/F4320338281","display_name":"Army Research Office","ror":"https://ror.org/05epdh915"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":30,"referenced_works":["https://openalex.org/W191098608","https://openalex.org/W1561608006","https://openalex.org/W1568307856","https://openalex.org/W1583098994","https://openalex.org/W1852048826","https://openalex.org/W1975120197","https://openalex.org/W1983014634","https://openalex.org/W1985625141","https://openalex.org/W1998475765","https://openalex.org/W2015953751","https://openalex.org/W2057331964","https://openalex.org/W2057504236","https://openalex.org/W2061455058","https://openalex.org/W2077488147","https://openalex.org/W2098509290","https://openalex.org/W2116892075","https://openalex.org/W2119742497","https://openalex.org/W2125050594","https://openalex.org/W2128366083","https://openalex.org/W2963532220","https://openalex.org/W2964229821","https://openalex.org/W3100229723","https://openalex.org/W3101995529","https://openalex.org/W3122022176","https://openalex.org/W4301258660","https://openalex.org/W6607784307","https://openalex.org/W6633589592","https://openalex.org/W6634779276","https://openalex.org/W6638901537","https://openalex.org/W6658883175"],"related_works":["https://openalex.org/W2294483539","https://openalex.org/W2378449000","https://openalex.org/W3187581118","https://openalex.org/W2938399969","https://openalex.org/W2616994865","https://openalex.org/W3143747655","https://openalex.org/W2002178493","https://openalex.org/W2901835651","https://openalex.org/W2387536556","https://openalex.org/W3094650923"],"abstract_inverted_index":{"We":[0,44,126,143],"introduce":[1],"a":[2,16,54,65,97,114,128],"novel":[3],"two-stage":[4],"approach":[5,56,67],"for":[6],"the":[7,13,20,27,50,58,69,87,140],"important":[8],"cybersecurity":[9],"problem":[10,123],"of":[11,15,40,60,72,102],"detecting":[12],"presence":[14],"botnet":[17,28,149],"and":[18,63,80,135,151],"identifying":[19],"compromised":[21],"nodes":[22,105],"(the":[23],"bots),":[24],"ideally":[25],"before":[26],"becomes":[29],"active.":[30],"The":[31,83,120],"first":[32],"stage":[33,85],"detects":[34,86],"anomalies":[35],"by":[36,112],"leveraging":[37],"large":[38],"deviations":[39],"an":[41,131],"empirical":[42,51],"distribution.":[43],"propose":[45,127],"two":[46],"approaches":[47],"to":[48,147],"create":[49],"distribution:":[52],"1)":[53],"flow-based":[55],"estimating":[57,68],"histogram":[59],"quantized":[61],"flows":[62],"2)":[64],"graph-based":[66],"degree":[70],"distribution":[71],"node":[73],"interaction":[74],"graphs,":[75],"encompassing":[76],"both":[77],"Erd\u00f6s-R\u00e9nyi":[78],"graphs":[79],"scale-free":[81],"graphs.":[82],"second":[84],"bots":[88],"using":[89],"ideas":[90],"from":[91],"social":[92],"network":[93],"community":[94],"detection":[95,109],"in":[96,117],"graph":[98],"that":[99],"captures":[100],"correlations":[101],"interactions":[103],"among":[104],"over":[106],"time.":[107],"Community":[108],"is":[110,124],"performed":[111],"maximizing":[113],"modularity":[115,121],"measure":[116],"this":[118],"graph.":[119],"maximization":[122],"nonconvex.":[125],"convex":[129],"relaxation,":[130],"effective":[132],"randomization":[133],"algorithm,":[134],"establish":[136],"sharp":[137],"bounds":[138],"on":[139],"suboptimality":[141],"gap.":[142],"apply":[144],"our":[145],"method":[146],"real-world":[148],"traffic":[150],"compare":[152],"its":[153],"performance":[154],"with":[155],"other":[156],"methods.":[157]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":12},{"year":2023,"cited_by_count":15},{"year":2022,"cited_by_count":10},{"year":2021,"cited_by_count":18},{"year":2020,"cited_by_count":16},{"year":2019,"cited_by_count":10},{"year":2018,"cited_by_count":14},{"year":2017,"cited_by_count":6}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}