{"id":"https://openalex.org/W4200163930","doi":"https://doi.org/10.3390/fi14010006","title":"An Automated Behaviour-Based Clustering of IoT Botnets","display_name":"An Automated Behaviour-Based Clustering of IoT Botnets","publication_year":2021,"publication_date":"2021-12-23","ids":{"openalex":"https://openalex.org/W4200163930","doi":"https://doi.org/10.3390/fi14010006"},"language":"en","primary_location":{"id":"doi:10.3390/fi14010006","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi14010006","pdf_url":null,"source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/fi14010006","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5083504056","display_name":"Tolijan Trajanovski","orcid":"https://orcid.org/0000-0002-4552-2297"},"institutions":[{"id":"https://openalex.org/I28407311","display_name":"University of Manchester","ror":"https://ror.org/027m9bs27","country_code":"GB","type":"education","lineage":["https://openalex.org/I28407311"]}],"countries":["GB"],"is_corresponding":true,"raw_author_name":"Tolijan Trajanovski","raw_affiliation_strings":["School of Computer Science, University of Manchester, Kilburn Building, Manchester M13 9PL, UK"],"raw_orcid":"https://orcid.org/0000-0002-4552-2297","affiliations":[{"raw_affiliation_string":"School of Computer Science, University of Manchester, Kilburn Building, Manchester M13 9PL, UK","institution_ids":["https://openalex.org/I28407311"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100404886","display_name":"Ning Zhang","orcid":"https://orcid.org/0000-0002-8781-4925"},"institutions":[{"id":"https://openalex.org/I28407311","display_name":"University of Manchester","ror":"https://ror.org/027m9bs27","country_code":"GB","type":"education","lineage":["https://openalex.org/I28407311"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Ning Zhang","raw_affiliation_strings":["School of Computer Science, University of Manchester, Kilburn Building, Manchester M13 9PL, UK"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer Science, University of Manchester, Kilburn Building, Manchester M13 9PL, UK","institution_ids":["https://openalex.org/I28407311"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5083504056"],"corresponding_institution_ids":["https://openalex.org/I28407311"],"apc_list":{"value":1400,"currency":"CHF","value_usd":1512},"apc_paid":{"value":1400,"currency":"CHF","value_usd":1512},"fwci":0.4106,"has_fulltext":true,"cited_by_count":7,"citation_normalized_percentile":{"value":0.66962284,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":97},"biblio":{"volume":"14","issue":"1","first_page":"6","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.989603579044342},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8650672435760498},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8111681938171387},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.7446630597114563},{"id":"https://openalex.org/keywords/sandbox","display_name":"Sandbox (software development)","score":0.6582439541816711},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.6129623651504517},{"id":"https://openalex.org/keywords/internet-of-things","display_name":"Internet of Things","score":0.6129553318023682},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4088074862957001},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.33814138174057007},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3334258794784546},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.32469695806503296},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.18170860409736633},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.07322847843170166}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.989603579044342},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8650672435760498},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8111681938171387},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.7446630597114563},{"id":"https://openalex.org/C167981075","wikidata":"https://www.wikidata.org/wiki/Q2667186","display_name":"Sandbox (software development)","level":2,"score":0.6582439541816711},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.6129623651504517},{"id":"https://openalex.org/C81860439","wikidata":"https://www.wikidata.org/wiki/Q251212","display_name":"Internet of Things","level":2,"score":0.6129553318023682},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4088074862957001},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.33814138174057007},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3334258794784546},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.32469695806503296},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.18170860409736633},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.07322847843170166},{"id":"https://openalex.org/C59822182","wikidata":"https://www.wikidata.org/wiki/Q441","display_name":"Botany","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.3390/fi14010006","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi14010006","pdf_url":null,"source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},{"id":"pmh:oai:pure.atira.dk:openaire/76985bc7-e0b7-4520-8512-6a551d5200f7","is_oa":true,"landing_page_url":"https://research.manchester.ac.uk/en/publications/76985bc7-e0b7-4520-8512-6a551d5200f7","pdf_url":null,"source":{"id":"https://openalex.org/S4306400662","display_name":"Research Explorer (The University of Manchester)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I28407311","host_organization_name":"University of Manchester","host_organization_lineage":["https://openalex.org/I28407311"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Trajanovski, T & Zhang, N 2021, 'An Automated Behaviour-Based Clustering of IoT Botnets', Future Internet, vol. 14, no. 1, pp. 6. https://doi.org/10.3390/fi14010006","raw_type":"info:eu-repo/semantics/article"},{"id":"pmh:oai:pure.atira.dk:openaire_cris_publications/76985bc7-e0b7-4520-8512-6a551d5200f7","is_oa":true,"landing_page_url":"https://www.mdpi.com/1999-5903/14/1/6","pdf_url":"https://www.mdpi.com/1999-5903/14/1/6/pdf?version=1640249857","source":{"id":"https://openalex.org/S4306400662","display_name":"Research Explorer (The University of Manchester)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I28407311","host_organization_name":"University of Manchester","host_organization_lineage":["https://openalex.org/I28407311"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Trajanovski, T & Zhang, N 2021, 'An Automated Behaviour-Based Clustering of IoT Botnets', Future Internet, vol. 14, no. 1, pp. 6. https://doi.org/10.3390/fi14010006","raw_type":"info:eu-repo/semantics/article"},{"id":"pmh:oai:doaj.org/article:32669c319bd346c291c94bc8fd3bcf0f","is_oa":true,"landing_page_url":"https://doaj.org/article/32669c319bd346c291c94bc8fd3bcf0f","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Future Internet, Vol 14, Iss 1, p 6 (2021)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/fi14010006","is_oa":true,"landing_page_url":"https://doi.org/10.3390/fi14010006","pdf_url":null,"source":{"id":"https://openalex.org/S34838331","display_name":"Future Internet","issn_l":"1999-5903","issn":["1999-5903"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Future Internet","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":28,"referenced_works":["https://openalex.org/W2188648436","https://openalex.org/W2733765803","https://openalex.org/W2740924709","https://openalex.org/W2748868501","https://openalex.org/W2794801050","https://openalex.org/W2799758613","https://openalex.org/W2810674385","https://openalex.org/W2883730939","https://openalex.org/W2915626801","https://openalex.org/W2958212520","https://openalex.org/W2997620615","https://openalex.org/W3011282767","https://openalex.org/W3017821103","https://openalex.org/W3035678078","https://openalex.org/W3042785344","https://openalex.org/W3043811680","https://openalex.org/W3048252966","https://openalex.org/W3113371616","https://openalex.org/W3122864121","https://openalex.org/W3157039573","https://openalex.org/W3158610871","https://openalex.org/W3164537065","https://openalex.org/W3172909833","https://openalex.org/W4239025696","https://openalex.org/W4248166950","https://openalex.org/W6743493502","https://openalex.org/W6752918806","https://openalex.org/W6772300549"],"related_works":["https://openalex.org/W2929621094","https://openalex.org/W1996006176","https://openalex.org/W4285325964","https://openalex.org/W2034129977","https://openalex.org/W3099773647","https://openalex.org/W1745773915","https://openalex.org/W2765820957","https://openalex.org/W2311131113","https://openalex.org/W4367595269","https://openalex.org/W2294212083"],"abstract_inverted_index":{"The":[0,117,130,148],"leaked":[1],"IoT":[2,11,37,73,82,97,142,160,191],"botnet":[3,12,38,74,83,98,161,192],"source-codes":[4],"have":[5],"facilitated":[6],"the":[7,29,40,50,90,93,96,111,115,127,146,152,174,180,185],"proliferation":[8],"of":[9,15,31,36,42,72,81,95,138,159],"different":[10],"variants,":[13],"some":[14],"which":[16,167],"are":[17,120],"equipped":[18,85,163],"with":[19,86,164],"new":[20,43,87,165,175],"capabilities":[21],"and":[22,105,124,177,189],"may":[23],"be":[24,54],"difficult":[25],"to":[26,77,172,178],"detect.":[27],"Despite":[28],"availability":[30],"solutions":[32,186],"for":[33,68,183,187],"automated":[34,69],"analysis":[35,51],"samples,":[39,75],"identification":[41,80,158],"variants":[44,84,162],"is":[45,100],"still":[46],"very":[47],"challenging":[48],"because":[49],"results":[52],"must":[53],"manually":[55],"interpreted":[56],"by":[57,114],"malware":[58],"analysts.":[59],"To":[60],"overcome":[61],"this":[62],"challenge,":[63],"we":[64],"propose":[65],"an":[66],"approach":[67,132,154],"behaviour-based":[70],"clustering":[71],"aimed":[76],"enable":[78],"automatic":[79,157],"capabilities.":[88],"In":[89],"proposed":[91,131,153],"approach,":[92],"behaviour":[94,108,118],"samples":[99,139],"captured":[101,140],"using":[102,122,126,135],"a":[103,136],"sandbox":[104],"represented":[106],"as":[107],"profiles":[109,119],"describing":[110],"actions":[112],"performed":[113],"samples.":[116],"vectorised":[121],"TF-IDF":[123],"clustered":[125],"DBSCAN":[128],"algorithm.":[129],"was":[133],"evaluated":[134],"collection":[137],"from":[141],"botnets":[143],"propagating":[144],"on":[145],"Internet.":[147],"evaluation":[149],"shows":[150],"that":[151],"enables":[155],"accurate":[156],"capabilities,":[166,176],"will":[168],"help":[169],"security":[170],"researchers":[171],"investigate":[173],"apply":[179],"investigation":[181],"findings":[182],"improving":[184],"detecting":[188],"preventing":[190],"infections.":[193]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":1}],"updated_date":"2026-08-28T12:50:07.497085","created_date":"2021-12-31T00:00:00"}