{"id":"https://openalex.org/W3094099251","doi":"https://doi.org/10.1145/3340531.3416022","title":"Helix","display_name":"Helix","publication_year":2020,"publication_date":"2020-10-19","ids":{"openalex":"https://openalex.org/W3094099251","doi":"https://doi.org/10.1145/3340531.3416022","mag":"3094099251"},"language":"en","primary_location":{"id":"doi:10.1145/3340531.3416022","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3340531.3416022","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 29th ACM International Conference on Information & Knowledge Management","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5001331670","display_name":"Lior Sidi","orcid":null},"institutions":[{"id":"https://openalex.org/I124227911","display_name":"Ben-Gurion University of the Negev","ror":"https://ror.org/05tkyf982","country_code":"IL","type":"education","lineage":["https://openalex.org/I124227911"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Lior Sidi","raw_affiliation_strings":["Ben-Gurion University, Beer-Sheva, Israel"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ben-Gurion University, Beer-Sheva, Israel","institution_ids":["https://openalex.org/I124227911"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047995605","display_name":"Yisroel Mirsky","orcid":"https://orcid.org/0000-0001-6367-2734"},"institutions":[{"id":"https://openalex.org/I130701444","display_name":"Georgia Institute of Technology","ror":"https://ror.org/01zkghx44","country_code":"US","type":"education","lineage":["https://openalex.org/I130701444"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yisroel Mirsky","raw_affiliation_strings":["Georgia Institute of Technology, Atlanta, GA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Georgia Institute of Technology, Atlanta, GA, USA","institution_ids":["https://openalex.org/I130701444"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5013424994","display_name":"Asaf Nadler","orcid":"https://orcid.org/0000-0003-4397-3729"},"institutions":[{"id":"https://openalex.org/I124227911","display_name":"Ben-Gurion University of the Negev","ror":"https://ror.org/05tkyf982","country_code":"IL","type":"education","lineage":["https://openalex.org/I124227911"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Asaf Nadler","raw_affiliation_strings":["Ben-Gurion University, Beer-Sheva, Israel"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ben-Gurion University, Beer-Sheva, Israel","institution_ids":["https://openalex.org/I124227911"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072913672","display_name":"Yuval Elovici","orcid":"https://orcid.org/0000-0002-9641-128X"},"institutions":[{"id":"https://openalex.org/I124227911","display_name":"Ben-Gurion University of the Negev","ror":"https://ror.org/05tkyf982","country_code":"IL","type":"education","lineage":["https://openalex.org/I124227911"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Yuval Elovici","raw_affiliation_strings":["Ben-Gurion University, Beer-Sheva, Israel"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ben-Gurion University, Beer-Sheva, Israel","institution_ids":["https://openalex.org/I124227911"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5002391103","display_name":"Asaf Shabtai","orcid":"https://orcid.org/0000-0003-0630-4059"},"institutions":[{"id":"https://openalex.org/I124227911","display_name":"Ben-Gurion University of the Negev","ror":"https://ror.org/05tkyf982","country_code":"IL","type":"education","lineage":["https://openalex.org/I124227911"]}],"countries":["IL"],"is_corresponding":false,"raw_author_name":"Asaf Shabtai","raw_affiliation_strings":["Ben-Gurion University, Beer-Sheva, Israel"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ben-Gurion University, Beer-Sheva, Israel","institution_ids":["https://openalex.org/I124227911"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.7025,"has_fulltext":false,"cited_by_count":8,"citation_normalized_percentile":{"value":0.64292774,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"2741","last_page":"2748"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.9580365419387817},{"id":"https://openalex.org/keywords/autoencoder","display_name":"Autoencoder","score":0.8743578791618347},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7760007381439209},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.6489718556404114},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.6262837648391724},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.6132713556289673},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.5827064514160156},{"id":"https://openalex.org/keywords/convolutional-neural-network","display_name":"Convolutional neural network","score":0.5719195604324341},{"id":"https://openalex.org/keywords/command-and-control","display_name":"Command and control","score":0.518242597579956},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3942519724369049},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.3604389429092407},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.22035866975784302},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.07661446928977966}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.9580365419387817},{"id":"https://openalex.org/C101738243","wikidata":"https://www.wikidata.org/wiki/Q786435","display_name":"Autoencoder","level":3,"score":0.8743578791618347},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7760007381439209},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.6489718556404114},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.6262837648391724},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6132713556289673},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.5827064514160156},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.5719195604324341},{"id":"https://openalex.org/C506615639","wikidata":"https://www.wikidata.org/wiki/Q21662260","display_name":"Command and control","level":2,"score":0.518242597579956},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3942519724369049},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3604389429092407},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.22035866975784302},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.07661446928977966},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.0},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3340531.3416022","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3340531.3416022","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 29th ACM International Conference on Information & Knowledge Management","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","score":0.5299999713897705,"id":"https://metadata.un.org/sdg/9"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":27,"referenced_works":["https://openalex.org/W2055234825","https://openalex.org/W2082550445","https://openalex.org/W2113054345","https://openalex.org/W2137345105","https://openalex.org/W2528500008","https://openalex.org/W2528572867","https://openalex.org/W2546910111","https://openalex.org/W2565766771","https://openalex.org/W2618017145","https://openalex.org/W2620022311","https://openalex.org/W2625935159","https://openalex.org/W2750680860","https://openalex.org/W2762467223","https://openalex.org/W2768793959","https://openalex.org/W2773270814","https://openalex.org/W2781626870","https://openalex.org/W2786906486","https://openalex.org/W2787538540","https://openalex.org/W2794229234","https://openalex.org/W2917948814","https://openalex.org/W2950621961","https://openalex.org/W2951559648","https://openalex.org/W2954590176","https://openalex.org/W2963379686","https://openalex.org/W2963403868","https://openalex.org/W4206836069","https://openalex.org/W4319779871"],"related_works":["https://openalex.org/W2898126008","https://openalex.org/W86804927","https://openalex.org/W1583098994","https://openalex.org/W2386447999","https://openalex.org/W2130216882","https://openalex.org/W2091214382","https://openalex.org/W2376288852","https://openalex.org/W2100671106","https://openalex.org/W2364035342","https://openalex.org/W2061455058"],"abstract_inverted_index":{"Botnets":[0],"have":[1],"been":[2],"using":[3,117,127,175,209],"domain":[4,18,41],"generation":[5],"algorithms":[6],"(DGA)":[7],"for":[8,71,149],"over":[9],"a":[10,50,69,78],"decade":[11],"to":[12,36,46,57,84,98,187],"covertly":[13],"and":[14,23,42,73,95,111,115,123,168,170,200],"robustly":[15],"identify":[16,172],"the":[17,39,93,100,131,146,176,193,205],"name":[19],"of":[20,142,192,204],"their":[21],"command":[22],"control":[24],"servers":[25],"(C&C).":[26],"Recent":[27],"advancements":[28],"in":[29,60,136,190],"DGA":[30,94,166],"detection":[31],"has":[32,53],"motivated":[33],"botnet":[34,162],"owners":[35],"rapidly":[37],"alter":[38],"C&C":[40],"use":[43],"adversarial":[44,178],"techniques":[45,118],"evade":[47],"detection.":[48],"As":[49],"result,":[51],"it":[52],"become":[54],"increasingly":[55],"difficult":[56],"track":[58,161,188],"botnets":[59,189],"DNS":[61],"traffic.":[62],"In":[63,153],"this":[64],"paper,":[65],"we":[66,156,201],"present":[67],"Helix,":[68],"method":[70],"tracking":[72],"exploring":[74],"botnets.":[75],"Helix":[76,159,182],"uses":[77],"spatio-temporal":[79],"deep":[80],"neural":[81],"network":[82,132],"autoencoder":[83,129],"convert":[85],"domains":[86,173],"into":[87],"numerical":[88],"vectors":[89],"(embeddings)":[90],"which":[91,144],"capture":[92],"seed":[96],"used":[97,186],"create":[99],"domain.":[101],"This":[102],"is":[103,183],"made":[104],"possible":[105],"by":[106,116,126],"leveraging":[107],"both":[108],"convolutional":[109],"(spatial)":[110],"recurrent":[112],"(temporal)":[113],"layers,":[114],"such":[119],"as":[120],"attention":[121],"mechanisms":[122],"highways.":[124],"Furthermore,":[125],"an":[128,137],"architecture,":[130],"can":[133,160,171],"be":[134],"trained":[135],"unsupervised":[138],"manner":[139],"(no":[140],"labeling":[141],"data)":[143],"makes":[145],"system":[147],"practical":[148],"real":[150],"world":[151],"deployments.":[152],"our":[154,210],"evaluation,":[155],"found":[157],"that":[158],"campaigns,":[163],"distinguish":[164],"between":[165],"families":[167],"seeds,":[169],"generated":[174],"latest":[177],"machine":[179],"learning":[180],"techniques.":[181],"currently":[184],"being":[185],"one":[191],"world's":[194],"largest":[195],"Internet":[196],"Service":[197],"Providers":[198],"(ISP),":[199],"include":[202],"some":[203],"ISP's":[206],"analysis":[207],"work":[208],"method.":[211]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2024,"cited_by_count":3},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":2}],"updated_date":"2026-08-12T21:12:35.861297","created_date":"2020-10-29T00:00:00"}