{"id":"https://openalex.org/W7116733521","doi":"https://doi.org/10.23919/cnsm67658.2025.11297569","title":"IoT Botnet Detection with Drift-Aligned Learning and DNS-Based C2 Identification","display_name":"IoT Botnet Detection with Drift-Aligned Learning and DNS-Based C2 Identification","publication_year":2025,"publication_date":"2025-10-27","ids":{"openalex":"https://openalex.org/W7116733521","doi":"https://doi.org/10.23919/cnsm67658.2025.11297569"},"language":null,"primary_location":{"id":"doi:10.23919/cnsm67658.2025.11297569","is_oa":false,"landing_page_url":"https://doi.org/10.23919/cnsm67658.2025.11297569","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 21st International Conference on Network and Service Management (CNSM)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5093357893","display_name":"Jeffrey A. Adjei","orcid":null},"institutions":[{"id":"https://openalex.org/I129902397","display_name":"Dalhousie University","ror":"https://ror.org/01e6qks80","country_code":"CA","type":"education","lineage":["https://openalex.org/I129902397"]}],"countries":["CA"],"is_corresponding":true,"raw_author_name":"Jeffrey A. Adjei","raw_affiliation_strings":["Dalhousie University,Faculty of Computer Science,Halifax,Canada"],"affiliations":[{"raw_affiliation_string":"Dalhousie University,Faculty of Computer Science,Halifax,Canada","institution_ids":["https://openalex.org/I129902397"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5114702715","display_name":"Nur Zincir-Heywood","orcid":null},"institutions":[{"id":"https://openalex.org/I129902397","display_name":"Dalhousie University","ror":"https://ror.org/01e6qks80","country_code":"CA","type":"education","lineage":["https://openalex.org/I129902397"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Nur Zincir-Heywood","raw_affiliation_strings":["Dalhousie University,Faculty of Computer Science,Halifax,Canada"],"affiliations":[{"raw_affiliation_string":"Dalhousie University,Faculty of Computer Science,Halifax,Canada","institution_ids":["https://openalex.org/I129902397"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059216688","display_name":"M. I. Heywood","orcid":null},"institutions":[{"id":"https://openalex.org/I129902397","display_name":"Dalhousie University","ror":"https://ror.org/01e6qks80","country_code":"CA","type":"education","lineage":["https://openalex.org/I129902397"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Malcom Heywood","raw_affiliation_strings":["Dalhousie University,Faculty of Computer Science,Halifax,Canada"],"affiliations":[{"raw_affiliation_string":"Dalhousie University,Faculty of Computer Science,Halifax,Canada","institution_ids":["https://openalex.org/I129902397"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108562133","display_name":"Biswajit Nandy","orcid":null},"institutions":[{"id":"https://openalex.org/I4210125119","display_name":"Solana Networks (Canada)","ror":"https://ror.org/03336v443","country_code":"CA","type":"company","lineage":["https://openalex.org/I4210125119"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Biswajit Nandy","raw_affiliation_strings":["Solana Networks,Ottawa,Canada"],"affiliations":[{"raw_affiliation_string":"Solana Networks,Ottawa,Canada","institution_ids":["https://openalex.org/I4210125119"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5120952700","display_name":"Nabil Seddigh","orcid":null},"institutions":[{"id":"https://openalex.org/I4210125119","display_name":"Solana Networks (Canada)","ror":"https://ror.org/03336v443","country_code":"CA","type":"company","lineage":["https://openalex.org/I4210125119"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Nabil Seddigh","raw_affiliation_strings":["Solana Networks,Ottawa,Canada"],"affiliations":[{"raw_affiliation_string":"Solana Networks,Ottawa,Canada","institution_ids":["https://openalex.org/I4210125119"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5093357893"],"corresponding_institution_ids":["https://openalex.org/I129902397"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.63617333,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"7"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.847000002861023,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.847000002861023,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.040800001472234726,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12761","display_name":"Data Stream Mining Techniques","score":0.02630000002682209,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.9581000208854675},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.516700029373169},{"id":"https://openalex.org/keywords/generalizability-theory","display_name":"Generalizability theory","score":0.4697999954223633},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.4648999869823456},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.447299987077713},{"id":"https://openalex.org/keywords/random-forest","display_name":"Random forest","score":0.4442000091075897},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.4375999867916107},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.42989999055862427}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.9581000208854675},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7067999839782715},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.516700029373169},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.47290000319480896},{"id":"https://openalex.org/C27158222","wikidata":"https://www.wikidata.org/wiki/Q5532422","display_name":"Generalizability theory","level":2,"score":0.4697999954223633},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.4648999869823456},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.447299987077713},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.44449999928474426},{"id":"https://openalex.org/C169258074","wikidata":"https://www.wikidata.org/wiki/Q245748","display_name":"Random forest","level":2,"score":0.4442000091075897},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.4375999867916107},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.42989999055862427},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.40400001406669617},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.39070001244544983},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.3828999996185303},{"id":"https://openalex.org/C148483581","wikidata":"https://www.wikidata.org/wiki/Q446488","display_name":"Feature selection","level":2,"score":0.3587999939918518},{"id":"https://openalex.org/C35026560","wikidata":"https://www.wikidata.org/wiki/Q8767","display_name":"Domain Name System","level":3,"score":0.3549000024795532},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.3488999903202057},{"id":"https://openalex.org/C136389625","wikidata":"https://www.wikidata.org/wiki/Q334384","display_name":"Supervised learning","level":3,"score":0.3384000062942505},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3093999922275543},{"id":"https://openalex.org/C79581498","wikidata":"https://www.wikidata.org/wiki/Q1367530","display_name":"Suite","level":2,"score":0.3075999915599823},{"id":"https://openalex.org/C58489278","wikidata":"https://www.wikidata.org/wiki/Q1172284","display_name":"Data set","level":2,"score":0.27900001406669617},{"id":"https://openalex.org/C506615639","wikidata":"https://www.wikidata.org/wiki/Q21662260","display_name":"Command and control","level":2,"score":0.27639999985694885},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.2646999955177307},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.25459998846054077}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.23919/cnsm67658.2025.11297569","is_oa":false,"landing_page_url":"https://doi.org/10.23919/cnsm67658.2025.11297569","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 21st International Conference on Network and Service Management (CNSM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.6824442744255066,"display_name":"Life in Land","id":"https://metadata.un.org/sdg/15"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320322675","display_name":"Mitacs","ror":"https://ror.org/00cjrc276"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W2154874878","https://openalex.org/W2733765803","https://openalex.org/W2932169476","https://openalex.org/W2961130895","https://openalex.org/W2963027473","https://openalex.org/W3108033379","https://openalex.org/W3160194885","https://openalex.org/W3216826992","https://openalex.org/W4225730496","https://openalex.org/W4236145735","https://openalex.org/W4297100040","https://openalex.org/W4323342839","https://openalex.org/W4382281941","https://openalex.org/W4383112368","https://openalex.org/W4393145828","https://openalex.org/W4400234828","https://openalex.org/W4405937840","https://openalex.org/W4406261718","https://openalex.org/W4409495377","https://openalex.org/W4412445373","https://openalex.org/W4415424815"],"related_works":[],"abstract_inverted_index":{"Botnet":[0,38],"detection":[1,20,28],"in":[2,67],"Internet":[3],"of":[4,18,79],"Things":[5],"(IoT)":[6],"environments":[7],"remain":[8],"challenging":[9],"due":[10],"to":[11,50,52],"evolving":[12],"attack":[13],"behaviors":[14],"and":[15,83],"limited":[16],"generalizability":[17],"traditional":[19],"methods.":[21],"This":[22],"paper":[23],"introduces":[24],"a":[25,32,37,45,75],"lightweight,":[26],"two-stage":[27],"framework":[29],"that":[30],"combines":[31],"Random":[33],"Forest":[34],"classifier":[35],"with":[36],"Validation":[39],"Layer.":[40],"The":[41],"proposed":[42,93],"system":[43,94],"leverages":[44],"Drift-Aligned":[46],"Learning":[47],"Curve":[48],"(DALC)":[49],"adapt":[51],"data":[53],"drifts":[54],"by":[55],"incorporating":[56],"Domain":[57],"Name":[58],"System":[59],"(DNS)":[60],"based":[61],"analysis":[62],"for":[63],"botnet":[64],"validation":[65],"particularly":[66],"Command":[68],"&":[69],"Control":[70],"(C2)":[71],"activities.":[72],"We":[73],"utilize":[74],"feature":[76],"set":[77],"comprising":[78],"20":[80],"flow":[81],"level":[82,86],"4":[84],"DNS":[85],"features.":[87],"Evaluated":[88],"on":[89],"diverse":[90],"datasets,":[91],"the":[92],"achieves":[95],"99.7%":[96],"F1-Score":[97],"during":[98],"testing":[99],"while":[100],"demonstrating":[101],"strong":[102],"generalization.":[103]},"counts_by_year":[],"updated_date":"2026-04-09T08:11:56.329763","created_date":"2025-12-22T00:00:00"}