{"id":"https://openalex.org/W2962590879","doi":"https://doi.org/10.1109/tnsm.2020.2972405","title":"BotChase: Graph-Based Bot Detection Using Machine Learning","display_name":"BotChase: Graph-Based Bot Detection Using Machine Learning","publication_year":2020,"publication_date":"2020-02-07","ids":{"openalex":"https://openalex.org/W2962590879","doi":"https://doi.org/10.1109/tnsm.2020.2972405","mag":"2962590879"},"language":"en","primary_location":{"id":"doi:10.1109/tnsm.2020.2972405","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2020.2972405","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5054077020","display_name":"Abbas Abou Daya","orcid":"https://orcid.org/0000-0003-4994-8559"},"institutions":[{"id":"https://openalex.org/I151746483","display_name":"University of Waterloo","ror":"https://ror.org/01aff2v68","country_code":"CA","type":"education","lineage":["https://openalex.org/I151746483"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Abbas Abou Daya","raw_affiliation_strings":["David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, Canada"],"raw_orcid":"https://orcid.org/0000-0003-4994-8559","affiliations":[{"raw_affiliation_string":"David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, Canada","institution_ids":["https://openalex.org/I151746483"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5039801401","display_name":"Mohammad A. Salahuddin","orcid":"https://orcid.org/0000-0002-5431-3278"},"institutions":[{"id":"https://openalex.org/I151746483","display_name":"University of Waterloo","ror":"https://ror.org/01aff2v68","country_code":"CA","type":"education","lineage":["https://openalex.org/I151746483"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Mohammad A. Salahuddin","raw_affiliation_strings":["David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, Canada"],"raw_orcid":"https://orcid.org/0000-0002-5431-3278","affiliations":[{"raw_affiliation_string":"David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, Canada","institution_ids":["https://openalex.org/I151746483"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062253146","display_name":"Noura Limam","orcid":"https://orcid.org/0000-0002-7759-3751"},"institutions":[{"id":"https://openalex.org/I151746483","display_name":"University of Waterloo","ror":"https://ror.org/01aff2v68","country_code":"CA","type":"education","lineage":["https://openalex.org/I151746483"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Noura Limam","raw_affiliation_strings":["David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, Canada"],"raw_orcid":"https://orcid.org/0000-0002-7759-3751","affiliations":[{"raw_affiliation_string":"David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, Canada","institution_ids":["https://openalex.org/I151746483"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5038723583","display_name":"Raouf Boutaba","orcid":"https://orcid.org/0000-0001-7936-6862"},"institutions":[{"id":"https://openalex.org/I151746483","display_name":"University of Waterloo","ror":"https://ror.org/01aff2v68","country_code":"CA","type":"education","lineage":["https://openalex.org/I151746483"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Raouf Boutaba","raw_affiliation_strings":["David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, Canada"],"raw_orcid":"https://orcid.org/0000-0001-7936-6862","affiliations":[{"raw_affiliation_string":"David R. Cheriton School of Computer Science, University of Waterloo, Waterloo, Canada","institution_ids":["https://openalex.org/I151746483"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I151746483"],"apc_list":{"value":2045,"currency":"USD","value_usd":2045},"apc_paid":null,"fwci":6.5109,"has_fulltext":false,"cited_by_count":74,"citation_normalized_percentile":{"value":0.96608993,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":100},"biblio":{"volume":"17","issue":"1","first_page":"15","last_page":"29"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9941999912261963,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8783326148986816},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.6185399293899536},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.59395432472229},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.5349084138870239},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5158244967460632},{"id":"https://openalex.org/keywords/network-topology","display_name":"Network topology","score":0.49617084860801697},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4740842580795288},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.42410916090011597},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.38057100772857666},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.36274829506874084},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.27102500200271606},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.1997481882572174}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8783326148986816},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6185399293899536},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.59395432472229},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.5349084138870239},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5158244967460632},{"id":"https://openalex.org/C199845137","wikidata":"https://www.wikidata.org/wiki/Q145490","display_name":"Network topology","level":2,"score":0.49617084860801697},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4740842580795288},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.42410916090011597},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.38057100772857666},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.36274829506874084},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.27102500200271606},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.1997481882572174},{"id":"https://openalex.org/C104317684","wikidata":"https://www.wikidata.org/wiki/Q7187","display_name":"Gene","level":2,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C185592680","wikidata":"https://www.wikidata.org/wiki/Q2329","display_name":"Chemistry","level":0,"score":0.0},{"id":"https://openalex.org/C55493867","wikidata":"https://www.wikidata.org/wiki/Q7094","display_name":"Biochemistry","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tnsm.2020.2972405","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnsm.2020.2972405","pdf_url":null,"source":{"id":"https://openalex.org/S173527311","display_name":"IEEE Transactions on Network and Service Management","issn_l":"1932-4537","issn":["1932-4537","2373-7379"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network and Service Management","raw_type":"journal-article"},{"id":"pmh:oai:uwspace.uwaterloo.ca:10012/14654","is_oa":false,"landing_page_url":"http://hdl.handle.net/10012/14654","pdf_url":null,"source":{"id":"https://openalex.org/S4306401661","display_name":"UWSpace (University of Waterloo)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I151746483","host_organization_name":"University of Waterloo","host_organization_lineage":["https://openalex.org/I151746483"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"Master Thesis"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3134926896","display_name":null,"funder_award_id":"530335","funder_id":"https://openalex.org/F4320321487","funder_display_name":"Canadian Network for Research and Innovation in Machining Technology, Natural Sciences and Engineering Research Council of Canada"}],"funders":[{"id":"https://openalex.org/F4320313506","display_name":"Royal Bank of Canada","ror":"https://ror.org/03hgnwx26"},{"id":"https://openalex.org/F4320321487","display_name":"Canadian Network for Research and Innovation in Machining Technology, Natural Sciences and Engineering Research Council of Canada","ror":"https://ror.org/01h531d29"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":63,"referenced_works":["https://openalex.org/W47988595","https://openalex.org/W1462349742","https://openalex.org/W1485364724","https://openalex.org/W1493609275","https://openalex.org/W1525647652","https://openalex.org/W1550514379","https://openalex.org/W1551705282","https://openalex.org/W1594972289","https://openalex.org/W1650881334","https://openalex.org/W1676351273","https://openalex.org/W1775772884","https://openalex.org/W1909494783","https://openalex.org/W1925187733","https://openalex.org/W1964267679","https://openalex.org/W1994212840","https://openalex.org/W2003967425","https://openalex.org/W2026621111","https://openalex.org/W2027355980","https://openalex.org/W2057685268","https://openalex.org/W2065323196","https://openalex.org/W2077488147","https://openalex.org/W2099452399","https://openalex.org/W2105140491","https://openalex.org/W2108898793","https://openalex.org/W2110675786","https://openalex.org/W2112639538","https://openalex.org/W2123976890","https://openalex.org/W2135335717","https://openalex.org/W2148323889","https://openalex.org/W2149706766","https://openalex.org/W2151298633","https://openalex.org/W2167240430","https://openalex.org/W2170214103","https://openalex.org/W2171707538","https://openalex.org/W2545374358","https://openalex.org/W2588857280","https://openalex.org/W2613920221","https://openalex.org/W2748868501","https://openalex.org/W2755326359","https://openalex.org/W2758096849","https://openalex.org/W2768896713","https://openalex.org/W2783034914","https://openalex.org/W2788194436","https://openalex.org/W2809684781","https://openalex.org/W2887132990","https://openalex.org/W2899354255","https://openalex.org/W2915130643","https://openalex.org/W2964276313","https://openalex.org/W3003253354","https://openalex.org/W3101263800","https://openalex.org/W3104735167","https://openalex.org/W4236137412","https://openalex.org/W6601890406","https://openalex.org/W6628628164","https://openalex.org/W6632893704","https://openalex.org/W6632924670","https://openalex.org/W6635614179","https://openalex.org/W6636713437","https://openalex.org/W6637214718","https://openalex.org/W6638021444","https://openalex.org/W6680192438","https://openalex.org/W6743493502","https://openalex.org/W6759742124"],"related_works":["https://openalex.org/W2086397253","https://openalex.org/W2133122801","https://openalex.org/W600422426","https://openalex.org/W2007156430","https://openalex.org/W2770593030","https://openalex.org/W3081478936","https://openalex.org/W3154990682","https://openalex.org/W2560201613","https://openalex.org/W2785612136","https://openalex.org/W2171975302"],"abstract_inverted_index":{"Bot":[0],"detection":[1,46,86,108],"using":[2,53],"machine":[3],"learning":[4],"(ML),":[5],"with":[6,109],"network":[7,33,74,132],"flow-level":[8],"features,":[9],"has":[10],"been":[11],"extensively":[12],"studied":[13],"in":[14,157],"the":[15,32,103,142],"literature.":[16],"However,":[17],"existing":[18],"flow-based":[19,151],"approaches":[20],"typically":[21],"incur":[22],"a":[23,82],"high":[24,110],"computational":[25],"overhead":[26],"and":[27,92,122,134,153],"do":[28],"not":[29],"completely":[30],"capture":[31],"communication":[34,50],"patterns,":[35],"which":[36],"can":[37],"expose":[38],"additional":[39],"aspects":[40],"of":[41,73,115,120],"malicious":[42],"hosts.":[43],"Recently,":[44],"bot":[45,85,107],"systems":[47],"that":[48,88,149],"leverage":[49],"graph":[51],"analysis":[52],"ML":[54],"have":[55],"gained":[56],"attention":[57],"to":[58,125,141],"overcome":[59],"these":[60],"limitations.":[61],"A":[62],"graph-based":[63,84],"approach":[64],"is":[65,135],"rather":[66],"intuitive,":[67],"as":[68],"graphs":[69],"are":[70],"true":[71],"representation":[72],"communications.":[75],"In":[76],"this":[77],"paper,":[78],"we":[79],"propose":[80],"BotChase,":[81],"two-phased":[83],"system":[87,148],"leverages":[89],"both":[90],"unsupervised":[91],"supervised":[93],"ML.":[94],"The":[95],"first":[96],"phase":[97,105],"prunes":[98],"presumable":[99],"benign":[100],"hosts,":[101],"while":[102],"second":[104],"achieves":[106],"precision.":[111],"Our":[112],"prototype":[113],"implementation":[114],"BotChase":[116,144],"detects":[117],"multiple":[118],"types":[119],"bots":[121],"exhibits":[123],"robustness":[124],"zero-day":[126],"attacks.":[127],"It":[128],"also":[129],"accommodates":[130],"different":[131],"topologies":[133],"suitable":[136],"for":[137],"large-scale":[138],"data.":[139],"Compared":[140],"state-of-the-art,":[143],"outperforms":[145],"an":[146,158],"end-to-end":[147],"employs":[150],"features":[152],"performs":[154],"particularly":[155],"well":[156],"online":[159],"setting.":[160]},"counts_by_year":[{"year":2026,"cited_by_count":9},{"year":2025,"cited_by_count":11},{"year":2024,"cited_by_count":8},{"year":2023,"cited_by_count":14},{"year":2022,"cited_by_count":12},{"year":2021,"cited_by_count":13},{"year":2020,"cited_by_count":7}],"updated_date":"2026-08-28T12:50:07.497085","created_date":"2025-10-10T00:00:00"}