{"id":"https://openalex.org/W7116675024","doi":"https://doi.org/10.23919/cnsm67658.2025.11297465","title":"Botnet Detection Through Periodic Patterns in Command-and-Control Network Traffic","display_name":"Botnet Detection Through Periodic Patterns in Command-and-Control Network Traffic","publication_year":2025,"publication_date":"2025-10-27","ids":{"openalex":"https://openalex.org/W7116675024","doi":"https://doi.org/10.23919/cnsm67658.2025.11297465"},"language":null,"primary_location":{"id":"doi:10.23919/cnsm67658.2025.11297465","is_oa":false,"landing_page_url":"https://doi.org/10.23919/cnsm67658.2025.11297465","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 21st International Conference on Network and Service Management (CNSM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120995227","display_name":"Dominik O\u0161kera","orcid":null},"institutions":[{"id":"https://openalex.org/I44504214","display_name":"Czech Technical University in Prague","ror":"https://ror.org/03kqpb082","country_code":"CZ","type":"education","lineage":["https://openalex.org/I44504214"]}],"countries":["CZ"],"is_corresponding":false,"raw_author_name":"Dominik O\u0161kera","raw_affiliation_strings":["Czech Technical University in Prague,Prague,Czech Republic"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Czech Technical University in Prague,Prague,Czech Republic","institution_ids":["https://openalex.org/I44504214"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5121017568","display_name":"Josef Koumar","orcid":null},"institutions":[{"id":"https://openalex.org/I44504214","display_name":"Czech Technical University in Prague","ror":"https://ror.org/03kqpb082","country_code":"CZ","type":"education","lineage":["https://openalex.org/I44504214"]}],"countries":["CZ"],"is_corresponding":false,"raw_author_name":"Josef Koumar","raw_affiliation_strings":["Czech Technical University in Prague,Prague,Czech Republic"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Czech Technical University in Prague,Prague,Czech Republic","institution_ids":["https://openalex.org/I44504214"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5034580250","display_name":"Al\u017eb\u011bta Pokorn\u00e1","orcid":null},"institutions":[{"id":"https://openalex.org/I205984670","display_name":"Czech University of Life Sciences Prague","ror":"https://ror.org/0415vcw02","country_code":"CZ","type":"education","lineage":["https://openalex.org/I205984670"]}],"countries":["CZ"],"is_corresponding":false,"raw_author_name":"Al\u017eb\u011bta Pokorn\u00e1","raw_affiliation_strings":["Czech University of Life Sciences,Prague,Czech Republic"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Czech University of Life Sciences,Prague,Czech Republic","institution_ids":["https://openalex.org/I205984670"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084472511","display_name":"Kamil Je\u0159\u00e1bek","orcid":"https://orcid.org/0000-0002-5317-9222"},"institutions":[{"id":"https://openalex.org/I54634078","display_name":"CESNET, z\u00e1jmov\u00e9 sdru\u017een\u00ed pr\u00e1vnick\u00fdch osob","ror":"https://ror.org/050dkka69","country_code":"CZ","type":"other","lineage":["https://openalex.org/I54634078"]}],"countries":["CZ"],"is_corresponding":false,"raw_author_name":"Kamil Je\u0159\u00e1bek","raw_affiliation_strings":["CESNET, a.l.e.,Prague,Czech Republic"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CESNET, a.l.e.,Prague,Czech Republic","institution_ids":["https://openalex.org/I54634078"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5121021243","display_name":"Tom\u00e1\u0161 \u010cejka","orcid":null},"institutions":[{"id":"https://openalex.org/I54634078","display_name":"CESNET, z\u00e1jmov\u00e9 sdru\u017een\u00ed pr\u00e1vnick\u00fdch osob","ror":"https://ror.org/050dkka69","country_code":"CZ","type":"other","lineage":["https://openalex.org/I54634078"]}],"countries":["CZ"],"is_corresponding":false,"raw_author_name":"Tom\u00e1\u0161 \u010cejka","raw_affiliation_strings":["CESNET, a.l.e.,Prague,Czech Republic"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"CESNET, a.l.e.,Prague,Czech Republic","institution_ids":["https://openalex.org/I54634078"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.52473813,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.5063999891281128,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.5063999891281128,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.4569999873638153,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.003700000001117587,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.9710000157356262},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.6812999844551086},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.6341000199317932},{"id":"https://openalex.org/keywords/traffic-analysis","display_name":"Traffic analysis","score":0.4343000054359436},{"id":"https://openalex.org/keywords/precision-and-recall","display_name":"Precision and recall","score":0.3871000111103058},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.3521000146865845},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.3434000015258789}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.9710000157356262},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7321000099182129},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.6812999844551086},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.6341000199317932},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5131999850273132},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.506600022315979},{"id":"https://openalex.org/C2781317605","wikidata":"https://www.wikidata.org/wiki/Q7832483","display_name":"Traffic analysis","level":2,"score":0.4343000054359436},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.3871000111103058},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3521000146865845},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3434000015258789},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3215000033378601},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3075000047683716},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.28540000319480896},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.28209999203681946},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.274399995803833},{"id":"https://openalex.org/C169988225","wikidata":"https://www.wikidata.org/wiki/Q7832484","display_name":"Traffic classification","level":3,"score":0.27230000495910645},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2619999945163727},{"id":"https://openalex.org/C81877898","wikidata":"https://www.wikidata.org/wiki/Q1965787","display_name":"Network monitoring","level":2,"score":0.2538999915122986},{"id":"https://openalex.org/C127162648","wikidata":"https://www.wikidata.org/wiki/Q16858953","display_name":"Channel (broadcasting)","level":2,"score":0.2529999911785126},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.2526000142097473},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.25060001015663147}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.23919/cnsm67658.2025.11297465","is_oa":false,"landing_page_url":"https://doi.org/10.23919/cnsm67658.2025.11297465","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 21st International Conference on Network and Service Management (CNSM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320311687","display_name":"Ministry of Education","ror":"https://ror.org/03m01yf64"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":25,"referenced_works":["https://openalex.org/W2077488147","https://openalex.org/W2120256168","https://openalex.org/W2613920221","https://openalex.org/W2807831642","https://openalex.org/W2885743621","https://openalex.org/W2914411038","https://openalex.org/W2947484346","https://openalex.org/W2963586838","https://openalex.org/W2972689670","https://openalex.org/W3000410487","https://openalex.org/W3005017592","https://openalex.org/W3081118847","https://openalex.org/W3103037241","https://openalex.org/W3129339224","https://openalex.org/W3133725389","https://openalex.org/W3187104866","https://openalex.org/W4283395623","https://openalex.org/W4283724983","https://openalex.org/W4310614613","https://openalex.org/W4360838285","https://openalex.org/W4389077420","https://openalex.org/W4389077856","https://openalex.org/W4390546166","https://openalex.org/W4400033187","https://openalex.org/W4400727271"],"related_works":[],"abstract_inverted_index":{"Detecting":[0],"botnet":[1,27,77,141],"Command-and-Control":[2],"(C&C)":[3],"communication":[4,34],"in":[5,13,16,47,63,109,127],"encrypted":[6,129],"network":[7,130],"traffic":[8,79,82],"is":[9,119],"a":[10,23,69,120,136],"persistent":[11],"challenge":[12],"cybersecurity,":[14],"particularly":[15],"environments":[17],"without":[18],"endpoint":[19],"visibility.":[20],"We":[21],"present":[22],"novel":[24],"approach":[25],"for":[26,55,139],"detection":[28,142],"based":[29],"on":[30,111],"the":[31,40,99],"inherent":[32],"periodic":[33,45],"patterns":[35],"of":[36,123],"C&C":[37,78,124],"channels.":[38],"Leveraging":[39],"Lomb-Scargle":[41],"periodogram,":[42],"we":[43,66],"identify":[44],"behaviour":[46],"multiflow":[48],"time":[49],"series":[50],"and":[51,71,80,88,104,132],"extract":[52],"periodic-based":[53],"features":[54],"classification":[56],"using":[57],"machine":[58],"learning.":[59],"To":[60],"address":[61],"limitations":[62],"existing":[64],"datasets,":[65],"introduce":[67],"CESNET-CC25,":[68,105],"comprehensive":[70],"publicly":[72],"available":[73],"dataset":[74,103],"comprising":[75],"real-world":[76],"benign":[81],"collected":[83],"from":[84],"an":[85],"ISP":[86],"backbone":[87],"controlled":[89],"laboratory":[90],"settings.":[91],"Our":[92],"method":[93],"achieves":[94],"high":[95],"precision":[96],"across":[97],"both":[98],"widely":[100],"used":[101],"CTU-13":[102],"with":[106],"significant":[107],"improvements":[108],"recall":[110],"long-duration":[112],"captures.":[113],"The":[114],"results":[115],"demonstrate":[116],"that":[117,133],"periodicity":[118],"reliable":[121],"indicator":[122],"behaviour,":[125],"even":[126],"modern,":[128],"environments,":[131],"CESNET-CC25":[134],"provides":[135],"realistic":[137],"benchmark":[138],"future":[140],"research.":[143]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-12-22T00:00:00"}