{"id":"https://openalex.org/W2154096079","doi":"https://doi.org/10.1145/1413140.1413185","title":"Peer to peer botnet detection for cyber-security","display_name":"Peer to peer botnet detection for cyber-security","publication_year":2008,"publication_date":"2008-05-12","ids":{"openalex":"https://openalex.org/W2154096079","doi":"https://doi.org/10.1145/1413140.1413185","mag":"2154096079"},"language":"en","primary_location":{"id":"doi:10.1145/1413140.1413185","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1413140.1413185","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 4th annual workshop on Cyber security and information intelligence research: developing strategies to meet the cyber security and information intelligence challenges ahead","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5029798067","display_name":"Mohammad Mehedy Masud","orcid":"https://orcid.org/0000-0002-5274-5982"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mohammad M. Masud","raw_affiliation_strings":["University of Texas at Dallas"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Texas at Dallas","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5077201324","display_name":"Jing Gao","orcid":"https://orcid.org/0000-0003-1778-8909"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jing Gao","raw_affiliation_strings":["University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005002693","display_name":"Latifur Khan","orcid":"https://orcid.org/0000-0002-9300-1576"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Latifur Khan","raw_affiliation_strings":["University of Texas at Dallas"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Texas at Dallas","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019539533","display_name":"Jiawei Han","orcid":"https://orcid.org/0000-0002-3629-2696"},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jiawei Han","raw_affiliation_strings":["University of Illinois at Urbana-Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5072193842","display_name":"Bhavani Thuraisingham","orcid":"https://orcid.org/0000-0003-4653-2080"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Bhavani Thuraisingham","raw_affiliation_strings":["University of Texas at Dallas"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Texas at Dallas","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.259,"has_fulltext":false,"cited_by_count":17,"citation_normalized_percentile":{"value":0.80482178,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"2"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9961000084877014,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.9802389740943909},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7564175128936768},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6072779297828674},{"id":"https://openalex.org/keywords/peer-to-peer","display_name":"Peer-to-peer","score":0.5485599040985107},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.5415002107620239},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.4508313238620758},{"id":"https://openalex.org/keywords/data-stream-mining","display_name":"Data stream mining","score":0.4325902462005615},{"id":"https://openalex.org/keywords/data-stream","display_name":"Data stream","score":0.417235791683197},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.40854060649871826},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.3711339831352234},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.26706549525260925},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.23587724566459656},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.15854641795158386}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.9802389740943909},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7564175128936768},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6072779297828674},{"id":"https://openalex.org/C534932454","wikidata":"https://www.wikidata.org/wiki/Q161410","display_name":"Peer-to-peer","level":2,"score":0.5485599040985107},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.5415002107620239},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.4508313238620758},{"id":"https://openalex.org/C89198739","wikidata":"https://www.wikidata.org/wiki/Q3079880","display_name":"Data stream mining","level":2,"score":0.4325902462005615},{"id":"https://openalex.org/C2778484313","wikidata":"https://www.wikidata.org/wiki/Q1172540","display_name":"Data stream","level":2,"score":0.417235791683197},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.40854060649871826},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3711339831352234},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.26706549525260925},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.23587724566459656},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.15854641795158386},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/1413140.1413185","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1413140.1413185","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 4th annual workshop on Cyber security and information intelligence research: developing strategies to meet the cyber security and information intelligence challenges ahead","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":6,"referenced_works":["https://openalex.org/W187875600","https://openalex.org/W1968980002","https://openalex.org/W2009727399","https://openalex.org/W2068714596","https://openalex.org/W2102671922","https://openalex.org/W2118778444"],"related_works":["https://openalex.org/W2929621094","https://openalex.org/W1996006176","https://openalex.org/W4285325964","https://openalex.org/W2119207053","https://openalex.org/W2062822216","https://openalex.org/W4388937261","https://openalex.org/W4389449520","https://openalex.org/W127192698","https://openalex.org/W2570600173","https://openalex.org/W2893008024"],"abstract_inverted_index":{"Botnet":[0],"is":[1,56,99,123,141,203,258,290,336,350,367,381,399,478,588],"a":[2,13,47,57,195,204,338,352,361,409,416,515,548,577,589,648],"network":[3,106,652],"of":[4,12,61,79,175,190,222,311,326,355,363,372,377,457,491,550,564,603,661],"compromised":[5],"hosts":[6],"or":[7,36],"bots,":[8],"under":[9],"the":[10,18,80,88,95,148,168,173,177,181,188,199,207,217,223,230,255,277,293,317,347,369,373,383,390,393,427,451,454,481,488,492,509,524,544,553,562,592,601,636,643,658],"control":[11],"human":[14],"attacker":[15],"known":[16],"as":[17,30,46,113,408],"botmaster":[19,178],"[7,":[20],"8].":[21],"Botnets":[22],"are":[23,66,72,86,130,234],"used":[24],"to":[25,49,53,74,135,143,211,215,280,291],"perform":[26],"malicious":[27],"actions,":[28],"such":[29,447],"launching":[31],"DDoS":[32],"attacks,":[33],"sending":[34],"spam":[35],"phishing":[37],"emails":[38],"and":[39,68,76,145,159,247,375,459,502,569,618,654],"so":[40,633],"on.":[41],"Thus,":[42,220,358],"botnets":[43,62,65,104],"have":[44,453,571],"emerged":[45],"threat":[48],"internet":[50],"community.":[51],"Peer":[52,54],"(P2P)":[55],"relatively":[58],"new":[59,218,410,417,525],"architecture":[60],"[4].":[63],"These":[64],"distributed,":[67],"small.":[69],"So,":[70,118],"they":[71],"difficult":[73],"locate":[75],"destroy.":[77],"Most":[78],"recent":[81,429],"works":[82],"in":[83,87,167,172,194,198,206,262,286,346,665],"P2P":[84,103,615],"botnet":[85,191,616,630,666],"analysis":[89],"phase":[90],"[4,":[91],"5,":[92],"6].":[93],"On":[94],"contrary,":[96],"our":[97,119,213,565,604,610],"work":[98],"aimed":[100],"at":[101,368,382],"detecting":[102,614],"using":[105],"traffic":[107,109],"mining.Network":[108],"can":[110],"be":[111,165,227],"considered":[112],"an":[114,269,323],"infinite":[115,157],"data":[116,120,137,150,225,241,282,289,295,404,411,431,585,626,663],"stream.":[117],"mining":[121,126],"approach":[122,245,250,272,285,566],"specialized":[124],"for":[125,151,239,273,583,613,651],"stream":[127,136,240,281,288,294,584,625,637,662],"data.":[128,169,200],"There":[129,233],"two":[131,235],"major":[132],"problems":[133,278],"related":[134,279],"classification.":[138],"First,":[139,574],"it":[140,154,655],"impractical":[142],"store":[144,316,322],"use":[146,660],"all":[147,450],"historical":[149,313],"training,":[152],"since":[153],"would":[155],"require":[156],"storage":[158],"running":[160],"time.":[161],"Second,":[162,598],"there":[163,202],"may":[164,186],"concept-drift":[166,205],"For":[170],"example,":[171],"context":[174],"botnets,":[176],"usually":[179],"updates":[180],"bot":[182],"software":[183],"frequently,":[184],"which":[185,587],"change":[187],"characteristics":[189],"traffic,":[192,617],"resulting":[193],"concept":[196,264],"drift":[197],"If":[201],"data,":[208,314],"we":[209,315,359,414,507,542,575,599,608],"need":[210],"refine":[212],"hypothesis":[214],"accommodate":[216],"concept.":[219],"most":[221,428],"old":[224],"must":[226],"discarded":[228],"from":[229],"training":[231],"set.":[232],"mainstream":[236],"techniques":[237,632],"available":[238],"classification:":[242],"single":[243],"classifier":[244,249,257,344,476,498],"[1],":[246],"ensemble":[248,256,270,324,334,348,397,419,493,511,517,526,556,581,596,645],"[10,":[251],"9].":[252],"Among":[253],"these,":[254],"often":[259],"more":[260],"robust":[261],"handling":[263],"drifts.":[265],"We":[266,304,320,435,462,486,560,640],"also":[267,305],"propose":[268,576],"classification":[271,627,638,664],"that":[274,448,642],"solves":[275],"both":[276,567],"classification.A":[283],"common":[284],"classifying":[287],"divide":[292,437],"into":[296,439],"equal":[297,441],"sized":[298],"chunks":[299,432],"[2,":[300],"10,":[301],"9,":[302],"3].":[303],"follow":[306],"this":[307,538],"approach.":[308,639],"However,":[309],"instead":[310],"storing":[312],"trained":[318,400,479],"classifiers.":[319,357],"always":[321],"A":[325,335,349,366,512],"best":[327],"K":[328],"classifiers":[329,468],"{A1,":[330],"...,":[331,424,445,472],"AK}.":[332],"The":[333,386],"actually":[337,351],"two-level":[339],"ensemble.":[340],"That":[341],"is,":[342],"each":[343,376,475,497],"Ai":[345,380,398],"collection":[353],"(ensemble)":[354],"v":[356,440,467],"build":[360,464],"hierarchy":[362],"ensembles,":[364],"where":[365,474],"top":[370],"level":[371,388],"hierarchy,":[374],"its":[378],"children":[379],"middle":[384],"level.":[385],"lowest":[387],"(or":[389],"leaves)":[391],"contains":[392],"actual":[394],"classifiers.Each":[395],"middle-level":[396,418,516],"with":[401,466,480,523],"r":[402,430],"consecutive":[403],"chunks.":[405],"As":[406],"soon":[407],"chunk":[412],"appears,":[413],"train":[415],"An.":[420],"Let":[421],"D={Dn,":[422],"Dn-1,":[423],"Dn-r+1},":[425],"i.e,":[426],"including":[433],"Dn.":[434],"randomly":[436],"D":[438,483],"parts":[442,452],"=":[443,469],"{d1,":[444],"dv},":[446],"roughly,":[449],"same":[455],"number":[456],"positive":[458],"negative":[460],"examples.":[461],"then":[463],"An":[465,494,529],"{An(1),":[470],"An(2),":[471],"An(v)},":[473],"An(j)":[477,499],"dataset":[482],"-":[484],"{dj}.":[485],"compute":[487],"expected":[489,545],"error":[490,532,546],"by":[495,513,547],"testing":[496],"on":[500,612],"dj":[501],"averaging":[503],"their":[504],"error.":[505],"Finally,":[506,607],"update":[508],"top-level":[510],"replacing":[514],"Ai(1":[518],"\u2264":[519,521],"i":[520],"K)":[522],"An,":[527],"if":[528],"has":[530],"lower":[531],"rate":[533],"than":[534,623],"Ai.":[535],"By":[536],"introducing":[537],"multi-chunk":[539],"multi-level":[540,580],"ensemble,":[541],"reduce":[543],"factor":[549],"rv":[551],"over":[552,591],"single-chunk,":[554],"single-level":[555,595],"method":[557],"(e.g.":[558],"[10]).":[559],"prove":[561,600],"effectiveness":[563,602],"theoretically":[568],"empirically.We":[570],"several":[572],"contributions.":[573],"novel":[578],"multi-chunk,":[579],"technique":[582,605,611,646],"classification,":[586],"generalization":[590],"existing":[593],"single-chunk":[594],"techniques.":[597,628],"theoretically.":[606],"apply":[609],"achieve":[619],"better":[620],"detection":[621,631],"accuracies":[622],"other":[624],"No":[629],"far":[634],"applied":[635],"believe":[641],"proposed":[644],"provides":[647],"powerful":[649],"tool":[650],"security":[653],"will":[656],"encourage":[657],"future":[659],"detection.":[667]},"counts_by_year":[{"year":2020,"cited_by_count":1},{"year":2018,"cited_by_count":2},{"year":2017,"cited_by_count":1},{"year":2015,"cited_by_count":1},{"year":2014,"cited_by_count":1},{"year":2013,"cited_by_count":1},{"year":2012,"cited_by_count":5}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}