{"id":"https://openalex.org/W2904963910","doi":"https://doi.org/10.1002/spy2.51","title":"DeBot: A novel network\u2010based mechanism to detect exfiltration by architectural stealthy botnets","display_name":"DeBot: A novel network\u2010based mechanism to detect exfiltration by architectural stealthy botnets","publication_year":2018,"publication_date":"2018-11-01","ids":{"openalex":"https://openalex.org/W2904963910","doi":"https://doi.org/10.1002/spy2.51","mag":"2904963910"},"language":"en","primary_location":{"is_oa":true,"landing_page_url":"https://doi.org/10.1002/spy2.51","pdf_url":"https://rss.onlinelibrary.wiley.com/doi/am-pdf/10.1002/spy2.51","source":{"id":"https://openalex.org/S4210233143","display_name":"Security and Privacy","issn_l":"2475-6725","issn":["2475-6725"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320595","host_organization_name":"Wiley","host_organization_lineage":["https://openalex.org/P4310320595"],"host_organization_lineage_names":["Wiley"],"type":"journal"},"license":"publisher-specific-oa","license_id":"https://openalex.org/licenses/publisher-specific-oa","version":"acceptedVersion","is_accepted":true,"is_published":false},"type":"article","type_crossref":"journal-article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://rss.onlinelibrary.wiley.com/doi/am-pdf/10.1002/spy2.51","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5109412228","display_name":"Sridhar Venkatesan","orcid":null},"institutions":[],"countries":["US"],"is_corresponding":false,"raw_author_name":"Sridhar Venkatesan","raw_affiliation_strings":["Perspecta Labs, Basking Ridge, New Jersey"],"affiliations":[{"raw_affiliation_string":"Perspecta Labs, Basking Ridge, New Jersey","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5066709657","display_name":"Massimiliano Albanese","orcid":"https://orcid.org/0000-0002-2675-5810"},"institutions":[{"id":"https://openalex.org/I162714631","display_name":"George Mason University","ror":"https://ror.org/02jqj7156","country_code":"US","type":"education","lineage":["https://openalex.org/I162714631"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Massimiliano Albanese","raw_affiliation_strings":["Center for Secure Information Systems, George Mason University, Fairfax, Virginia"],"affiliations":[{"raw_affiliation_string":"Center for Secure Information Systems, George Mason University, Fairfax, Virginia","institution_ids":["https://openalex.org/I162714631"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110132499","display_name":"Cho\u2010Yu Jason Chiang","orcid":null},"institutions":[],"countries":["US"],"is_corresponding":false,"raw_author_name":"Cho\u2010Yu Jason Chiang","raw_affiliation_strings":["Perspecta Labs, Basking Ridge, New Jersey"],"affiliations":[{"raw_affiliation_string":"Perspecta Labs, Basking Ridge, New Jersey","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007964772","display_name":"Angelo Sapello","orcid":null},"institutions":[],"countries":["US"],"is_corresponding":false,"raw_author_name":"Angelo Sapello","raw_affiliation_strings":["Perspecta Labs, Basking Ridge, New Jersey"],"affiliations":[{"raw_affiliation_string":"Perspecta Labs, Basking Ridge, New Jersey","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5103911831","display_name":"Ritu Chadha","orcid":null},"institutions":[],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ritu Chadha","raw_affiliation_strings":["Perspecta Labs, Basking Ridge, New Jersey"],"affiliations":[{"raw_affiliation_string":"Perspecta Labs, Basking Ridge, New Jersey","institution_ids":[]}]}],"institution_assertions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5066709657"],"corresponding_institution_ids":["https://openalex.org/I162714631"],"apc_list":{"value":3140,"currency":"USD","value_usd":3140,"provenance":"doaj"},"apc_paid":null,"fwci":0.16,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.525688,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":62,"max":70},"biblio":{"volume":"1","issue":"6","first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9999,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9986,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.9787601},{"id":"https://openalex.org/keywords/testbed","display_name":"Testbed","score":0.7797624},{"id":"https://openalex.org/keywords/resilience","display_name":"Resilience","score":0.5116594},{"id":"https://openalex.org/keywords/identification","display_name":"Identification","score":0.4966212},{"id":"https://openalex.org/keywords/command-and-control","display_name":"Command and Control","score":0.42837024}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.9787601},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.7797624},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.690113},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.68200934},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.52155924},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.5116594},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.4966212},{"id":"https://openalex.org/C114809511","wikidata":"https://www.wikidata.org/wiki/Q1412924","display_name":"Flow network","level":2,"score":0.45857292},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.44338742},{"id":"https://openalex.org/C506615639","wikidata":"https://www.wikidata.org/wiki/Q21662260","display_name":"Command and control","level":2,"score":0.42837024},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.12723446},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.09414083},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.08085841},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C126255220","wikidata":"https://www.wikidata.org/wiki/Q141495","display_name":"Mathematical optimization","level":1,"score":0.0},{"id":"https://openalex.org/C59822182","wikidata":"https://www.wikidata.org/wiki/Q441","display_name":"Botany","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C97355855","wikidata":"https://www.wikidata.org/wiki/Q11473","display_name":"Thermodynamics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"is_oa":true,"landing_page_url":"https://doi.org/10.1002/spy2.51","pdf_url":"https://rss.onlinelibrary.wiley.com/doi/am-pdf/10.1002/spy2.51","source":{"id":"https://openalex.org/S4210233143","display_name":"Security and Privacy","issn_l":"2475-6725","issn":["2475-6725"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320595","host_organization_name":"Wiley","host_organization_lineage":["https://openalex.org/P4310320595"],"host_organization_lineage_names":["Wiley"],"type":"journal"},"license":"publisher-specific-oa","license_id":"https://openalex.org/licenses/publisher-specific-oa","version":"acceptedVersion","is_accepted":true,"is_published":false}],"best_oa_location":{"is_oa":true,"landing_page_url":"https://doi.org/10.1002/spy2.51","pdf_url":"https://rss.onlinelibrary.wiley.com/doi/am-pdf/10.1002/spy2.51","source":{"id":"https://openalex.org/S4210233143","display_name":"Security and Privacy","issn_l":"2475-6725","issn":["2475-6725"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320595","host_organization_name":"Wiley","host_organization_lineage":["https://openalex.org/P4310320595"],"host_organization_lineage_names":["Wiley"],"type":"journal"},"license":"publisher-specific-oa","license_id":"https://openalex.org/licenses/publisher-specific-oa","version":"acceptedVersion","is_accepted":true,"is_published":false},"sustainable_development_goals":[],"grants":[{"funder":"https://openalex.org/F4320338281","funder_display_name":"Army Research Office","award_id":"W911NF\u201013\u20101\u20100421"}],"datasets":[],"versions":[],"referenced_works_count":18,"referenced_works":["https://openalex.org/W1583098994","https://openalex.org/W1976866799","https://openalex.org/W1986316936","https://openalex.org/W1991210879","https://openalex.org/W1993861188","https://openalex.org/W2058314598","https://openalex.org/W2077488147","https://openalex.org/W2082456656","https://openalex.org/W2160642098","https://openalex.org/W2164348526","https://openalex.org/W2239778906","https://openalex.org/W2529444969","https://openalex.org/W2535913029","https://openalex.org/W2564269296","https://openalex.org/W2565020460","https://openalex.org/W2755706313","https://openalex.org/W27994497","https://openalex.org/W3139866291"],"related_works":["https://openalex.org/W86804927","https://openalex.org/W4288326138","https://openalex.org/W4230824443","https://openalex.org/W2949824837","https://openalex.org/W2911594695","https://openalex.org/W2898126008","https://openalex.org/W2559738661","https://openalex.org/W2097156747","https://openalex.org/W2038807247","https://openalex.org/W1583098994"],"abstract_inverted_index":{"Malicious":[0],"actors":[1],"use":[2,150],"networks":[3,62],"of":[4,17,21,66,108,137,198],"compromised":[5],"and":[6,40,46,101,110,149,173,196],"remotely":[7],"controlled":[8],"hosts,":[9],"known":[10],"as":[11],"botnets,":[12],"to":[13,43,69,113,125,132,145,153],"execute":[14],"different":[15,98,167],"classes":[16],"cyberattacks,":[18],"including":[19],"exfiltration":[20,90],"sensitive":[22],"data.":[23],"Recently,":[24],"we":[25,75,120,141],"have":[26],"observed":[27],"a":[28,49,77,123,134],"trend":[29],"toward":[30],"more":[31],"resilient":[32],"botnet":[33,190],"architectures,":[34],"departing":[35],"from":[36,97,158],"traditional":[37],"centralized":[38],"architectures":[39],"enabling":[41,193],"botnets":[42,109,168],"evade":[44],"detection":[45,80,179],"persist":[47],"in":[48,104,169,188],"system":[50],"indefinitely.":[51],"Botnets":[52],"can":[53],"achieve":[54],"resilience":[55],"through":[56],"architectural":[57],"stealth,":[58],"by":[59],"establishing":[60],"overlay":[61],"that":[63,129,184],"minimize":[64],"exposure":[65],"malicious":[67,138,155],"traffic":[68,86,96],"detectors.":[70],"To":[71,117],"address":[72],"this":[73,118],"problem,":[74],"propose":[76],"novel":[78],"network\u2010based":[79],"scheme,":[81],"called":[82],"DeBot,":[83],"which":[84],"identifies":[85],"flows":[87,156],"associated":[88],"with":[89],"attempts.":[91],"The":[92,181],"proposed":[93,164],"solution":[94],"intercepts":[95],"monitoring":[99,127],"points":[100,128],"leverages":[102],"differences":[103],"the":[105,163,170,194],"network":[106],"behavior":[107],"benign":[111],"users":[112],"identify":[114,126,146,154],"suspicious":[115,147],"flows.":[116],"aim,":[119],"first":[121],"develop":[122],"mechanism":[124],"are":[130],"likely":[131],"intercept":[133],"significant":[135],"volume":[136],"traffic.":[139],"Then,":[140],"analyze":[142],"flow":[143],"characteristics":[144],"hosts":[148],"periodogram":[151],"analysis":[152],"originating":[157],"those":[159],"hosts.":[160],"We":[161],"evaluate":[162],"approach":[165],"against":[166,177],"CyberVAN":[171],"testbed":[172],"compare":[174],"its":[175],"performance":[176],"state\u2010of\u2010the\u2010art":[178],"techniques.":[180],"results":[182],"indicate":[183],"DeBot":[185],"is":[186],"effective":[187],"detecting":[189],"activity,":[191],"thus":[192],"identification":[195],"removal":[197],"bots.":[199]},"cited_by_api_url":"https://api.openalex.org/works?filter=cites:W2904963910","counts_by_year":[{"year":2021,"cited_by_count":1}],"updated_date":"2024-12-09T06:49:55.709967","created_date":"2018-12-22"}