{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,6]],"date-time":"2026-04-06T18:05:01Z","timestamp":1775498701185,"version":"3.50.1"},"reference-count":50,"publisher":"Springer Science and Business Media LLC","issue":"5","license":[{"start":{"date-parts":[[2015,9,19]],"date-time":"2015-09-19T00:00:00Z","timestamp":1442620800000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Soft Comput"],"published-print":{"date-parts":[[2017,3]]},"DOI":"10.1007\/s00500-015-1863-6","type":"journal-article","created":{"date-parts":[[2015,9,19]],"date-time":"2015-09-19T02:48:08Z","timestamp":1442630888000},"page":"1315-1326","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":18,"title":["P2P and P2P botnet traffic classification in two stages"],"prefix":"10.1007","volume":"21","author":[{"given":"Wujian","family":"Ye","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kyungsan","family":"Cho","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2015,9,19]]},"reference":[{"key":"1863_CR1","doi-asserted-by":"crossref","unstructured":"Barthakur P, Dahal M, Ghose MK (2012) A framework for p2p botnet detection using svm. In: 2012 International conference on cyber-enabled distributed computing and knowledge discovery (CyberC), IEEE, pp 195\u2013200","DOI":"10.1109\/CyberC.2012.40"},{"key":"1863_CR2","doi-asserted-by":"crossref","unstructured":"Bernaille L, Teixeira R, Salamatian K (2006) Early application identification. In: Proceedings of the 2006 ACM CoNEXT conference, ACM, p 6","DOI":"10.1145\/1368436.1368445"},{"key":"1863_CR3","doi-asserted-by":"crossref","first-page":"22","DOI":"10.1016\/j.jnca.2013.05.002","volume":"38","author":"A Castiglione","year":"2014","unstructured":"Castiglione A, De Prisco R, De Santis A, Fiore U, Palmieri F (2014) A botnet-based command and control approach relying on swarm intelligence. J Netw Comput Appl 38:22\u201333","journal-title":"J Netw Comput Appl"},{"issue":"2","key":"1863_CR4","doi-asserted-by":"crossref","first-page":"685","DOI":"10.1016\/j.asoc.2008.09.010","volume":"9","author":"Z Chen","year":"2009","unstructured":"Chen Z, Yang B, Chen Y, Abraham A, Grosan C, Peng L (2009) Online hybrid traffic classifier for peer-to-peer systems based on network processors. Appl Soft Comput 9(2):685\u2013694","journal-title":"Appl Soft Comput"},{"issue":"9","key":"1863_CR5","doi-asserted-by":"crossref","first-page":"1757","DOI":"10.1007\/s00500-013-1218-0","volume":"18","author":"TW Chiou","year":"2014","unstructured":"Chiou TW, Tsai SC, Lin YB (2014) Network security management with traffic pattern clustering. Soft Comput 18(9):1757\u20131770","journal-title":"Soft Comput"},{"key":"1863_CR6","doi-asserted-by":"crossref","unstructured":"Dittrich D, Dietrich S (2008) P2p as botnet command and control: a deeper insight. In: 3rd International conference on malicious and unwanted software, 2008. MALWARE 2008. IEEE, pp 41\u201348","DOI":"10.1109\/MALWARE.2008.4690856"},{"issue":"1","key":"1863_CR7","doi-asserted-by":"crossref","first-page":"169","DOI":"10.3844\/jcssp.2014.169.177","volume":"10","author":"MJ Elhalabi","year":"2013","unstructured":"Elhalabi MJ, Manickam S, Melhim LB, Anbar M, Alhalabi H (2013) A review of peer-to-peer botnet detection techniques. J Comput Sci 10(1):169","journal-title":"J Comput Sci"},{"issue":"9","key":"1863_CR8","doi-asserted-by":"crossref","first-page":"1194","DOI":"10.1016\/j.peva.2007.06.014","volume":"64","author":"J Erman","year":"2007","unstructured":"Erman J, Mahanti A, Arlitt M, Cohen I, Williamson C (2007a) Offline\/realtime traffic classification using semi-supervised learning. Perform Eval 64(9):1194\u20131213","journal-title":"Perform Eval"},{"key":"1863_CR9","doi-asserted-by":"crossref","unstructured":"Erman J, Mahanti A, Arlitt M, Williamson C (2007b) Identifying and discriminating between web and peer-to-peer traffic in the network core. In: Proceedings of the 16th international conference on World Wide Web, ACM, pp 883\u2013892","DOI":"10.1145\/1242572.1242692"},{"issue":"3","key":"1863_CR10","doi-asserted-by":"crossref","first-page":"13","DOI":"10.1145\/1568613.1568616","volume":"39","author":"A Este","year":"2009","unstructured":"Este A, Gringoli F, Salgarelli L (2009) On the stability of the information carried by traffic flow features at the packet level. ACM SIGCOMM Comput Commun Rev 39(3):13\u201318","journal-title":"ACM SIGCOMM Comput Commun Rev"},{"key":"1863_CR11","doi-asserted-by":"crossref","unstructured":"Garg S, Singh AK, Sarje AK, Peddoju SK (2013) Behaviour analysis of machine learning algorithms for detecting p2p botnets. In: 2013 15th International conference on advanced computing technologies (ICACT), IEEE, pp 1\u20134","DOI":"10.1109\/ICACT.2013.6710523"},{"issue":"5","key":"1863_CR12","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1145\/1629607.1629610","volume":"39","author":"F Gringoli","year":"2009","unstructured":"Gringoli F, Salgarelli L, Dusi M, Cascarano N, Risso F et al (2009) Gt: picking up the truth from the ground for internet traffic. ACM SIGCOMM Comput Commun Rev 39(5):12\u201318","journal-title":"ACM SIGCOMM Comput Commun Rev"},{"key":"1863_CR13","unstructured":"Guntuku SC, Narang P, Hota C (2013) Real-time peer-to-peer botnet detection framework based on bayesian regularized neural network. arXiv preprint arXiv:13077464"},{"key":"1863_CR14","doi-asserted-by":"crossref","unstructured":"He H, Che C, Ma F, Luo X, Wang J (2008) Improve flow accuracy and byte accuracy in network traffic classification. In: Advanced intelligent computing theories and applications. With aspects of artificial intelligence, 4th ICIC-2008, vol 5227. Springer, Heidelberg, pp 449\u2013458","DOI":"10.1007\/978-3-540-85984-0_54"},{"key":"1863_CR15","doi-asserted-by":"crossref","unstructured":"He J, Yang Y, Wang X, Zeng Y, Tang C (2014) Peersorter: classifying generic p2p traffic in real-time. In: 2014 IEEE 17th International conference on computational science and engineering (CSE), IEEE, pp 605\u2013613","DOI":"10.1109\/CSE.2014.134"},{"issue":"4","key":"1863_CR16","doi-asserted-by":"crossref","first-page":"320","DOI":"10.1007\/s12083-012-0150-x","volume":"7","author":"H Jiang","year":"2012","unstructured":"Jiang H, Shao X (2012) Detecting p2p botnets by discovering flow dependency in C&C traffic. Peer-to-Peer Netw Appl 7(4):320\u2013331","journal-title":"Peer-to-Peer Netw Appl"},{"key":"1863_CR17","unstructured":"Jpcap (2007) Jpcap introduction. https:\/\/github.com\/jpcap\/jpcap"},{"key":"1863_CR18","doi-asserted-by":"crossref","unstructured":"Jun L, Shunyi Z, Shidong L, Ye X (2007) P2p traffic identification technique. In: 2007 International conference on computational intelligence and security, IEEE, pp 37\u201341","DOI":"10.1109\/CIS.2007.81"},{"key":"1863_CR19","doi-asserted-by":"crossref","unstructured":"Karagiannis T, Broido A, Faloutsos M, et\u00a0al (2004) Transport layer identification of p2p traffic. In: Proceedings of the 4th ACM SIGCOMM conference on Internet measurement, ACM, pp 121\u2013134","DOI":"10.1145\/1028788.1028804"},{"issue":"7","key":"1863_CR20","doi-asserted-by":"crossref","first-page":"1055","DOI":"10.1016\/j.comnet.2009.10.009","volume":"54","author":"R Keralapura","year":"2010","unstructured":"Keralapura R, Nucci A, Chuah CN (2010) A novel self-learning architecture for p2p traffic classification in high speed networks. Comput Netw 54(7):1055\u20131068","journal-title":"Comput Netw"},{"key":"1863_CR21","doi-asserted-by":"crossref","unstructured":"Kheir N, Wolley C (2013) Botsuer: suing stealthy p2p bots in network traffic through netflow analysis. In: Cryptology and network security, vol 8257, Springer, pp 162\u2013178","DOI":"10.1007\/978-3-319-02937-5_9"},{"key":"1863_CR22","doi-asserted-by":"crossref","unstructured":"Li H, Hu G, Yuan J, Lai H (2012) P2p botnet detection based on irregular phased similarity. In: Proceedings of the 2012 second international conference on instrumentation. Computer, communication and control, IEEE Computer Society, Measurement, pp 79\u201382","DOI":"10.1109\/IMCCC.2012.25"},{"issue":"1","key":"1863_CR23","doi-asserted-by":"crossref","first-page":"101","DOI":"10.1007\/s11767-007-0110-4","volume":"26","author":"J Li","year":"2009","unstructured":"Li J, Zhang S, Lu Y, Yan J (2009) Hybrid internet traffic classification technique. J Electron (China) 26(1):101\u2013112","journal-title":"J Electron (China)"},{"issue":"1","key":"1863_CR24","doi-asserted-by":"crossref","first-page":"260","DOI":"10.1016\/j.comnet.2011.09.007","volume":"56","author":"CN Lu","year":"2012","unstructured":"Lu CN, Huang CY, Lin YD, Lai YC (2012) Session level flow classification by packet size distribution and session grouping. Comput Netw 56(1):260\u2013272","journal-title":"Comput Netw"},{"key":"1863_CR25","unstructured":"Maly RJ, Mischke J, Kurtansky P, Stiller B (2003) Comparison of centralized (client\u2013server) and decentralized (peer-to-peer) networking. Semester thesis, ETH Zurich, Zurich, Switzerland, pp 1\u201312"},{"key":"1863_CR26","doi-asserted-by":"publisher","unstructured":"Narudin FA, Feizollah A, Anuar NB, Gani A (2014) Evaluation of machine learning classifiers for mobile malware detection. Soft Comput 1\u201315. doi: 10.1007\/s00500-014-1511-6","DOI":"10.1007\/s00500-014-1511-6"},{"issue":"6","key":"1863_CR27","doi-asserted-by":"crossref","first-page":"761","DOI":"10.1016\/j.comnet.2008.12.015","volume":"53","author":"F Palmieri","year":"2009","unstructured":"Palmieri F, Fiore U (2009) A nonlinear, recurrence-based approach to traffic classification. Comput Netw 53(6):761\u2013773","journal-title":"Comput Netw"},{"issue":"1","key":"1863_CR28","first-page":"37","volume":"2","author":"DM Powers","year":"2011","unstructured":"Powers DM (2011) Evaluation: from precision, recall and f-measure to roc, informedness, markedness and correlation. J Mach Learn Technol 2(1):37\u201363","journal-title":"J Mach Learn Technol"},{"key":"1863_CR29","doi-asserted-by":"crossref","unstructured":"Saad S, Traore I, Ghorbani A, Sayed B, Zhao D, Lu W, Felix J, Hakimian P (2011a) Detecting p2p botnets through network behavior analysis and machine learning. In: 2011 Ninth annual international conference on privacy, security and trust (PST), IEEE, pp 174\u2013180","DOI":"10.1109\/PST.2011.5971980"},{"key":"1863_CR30","doi-asserted-by":"crossref","unstructured":"Saad S, Traore I, Ghorbani A, Sayed B, Zhao D, Lu W, Felix J, Hakimian P (2011b) Detecting p2p botnets through network behavior analysis and machine learning. In: 2011 Ninth annual international conference on privacy, security and trust (PST), IEEE, pp 174\u2013180","DOI":"10.1109\/PST.2011.5971980"},{"issue":"2","key":"1863_CR31","doi-asserted-by":"crossref","first-page":"378","DOI":"10.1016\/j.comnet.2012.07.021","volume":"57","author":"SS Silva","year":"2013","unstructured":"Silva SS, Silva RM, Pinto RC, Salles RM (2013) Botnets:a survey. Comput Netw 57(2):378\u2013403","journal-title":"Comput Netw"},{"key":"1863_CR32","doi-asserted-by":"crossref","first-page":"488","DOI":"10.1016\/j.ins.2014.03.066","volume":"278","author":"K Singh","year":"2014","unstructured":"Singh K, Guntuku SC, Thakur A, Hota C (2014) Big data analytics framework for peer-to-peer botnet detection using random forests. Inf Sci 278:488\u2013497","journal-title":"Inf Sci"},{"issue":"6","key":"1863_CR33","doi-asserted-by":"crossref","first-page":"451","DOI":"10.1016\/j.peva.2010.01.001","volume":"67","author":"M Soysal","year":"2010","unstructured":"Soysal M, Schmidt EG (2010) Machine learning algorithms for accurate flow-based network traffic classification: evaluation and comparison. Perform Eval 67(6):451\u2013467","journal-title":"Perform Eval"},{"key":"1863_CR34","doi-asserted-by":"crossref","unstructured":"Szab\u00f3 G, Orincsay D, Malomsoky S, Szab\u00f3 I (2008) On the validation of traffic classification algorithms. In: Passive and active network measurement, vol 4979, Springer, pp 72\u201381","DOI":"10.1007\/978-3-540-79232-1_8"},{"key":"1863_CR35","unstructured":"Tran H, Hitchens M, Varadharajan V, Watters P (2005) A trust based access control framework for p2p file-sharing systems. In: HICSS\u201905. Proceedings of the 38th Annual Hawaii international conference on system sciences, 2005. IEEE, 302c pp"},{"issue":"9","key":"1863_CR36","first-page":"9","volume":"34","author":"AK Tyagi","year":"2011","unstructured":"Tyagi AK, Aghila G (2011) A wide scale survey on botnet. Int J Comput Appl 34(9):9\u201322","journal-title":"Int J Comput Appl"},{"key":"1863_CR37","doi-asserted-by":"publisher","unstructured":"Vald\u00e9s L, Montesinos S, Ariza A, Allende SM, Joya G (2015) Peer selection in p2p wireless mesh networks: comparison of different strategies. Soft Comput. doi: 10.1007\/s00500-014-1572-6","DOI":"10.1007\/s00500-014-1572-6"},{"issue":"1","key":"1863_CR38","first-page":"23","volume":"4","author":"J Vania","year":"2013","unstructured":"Vania J, Meniya A, Jethva H (2013) A review on botnet and detection technique. Int J Comput Trends Technol 4(1):23\u201329","journal-title":"Int J Comput Trends Technol"},{"key":"1863_CR39","doi-asserted-by":"crossref","unstructured":"Wang B, Li Z, Tu H, Ma J (2009) Measuring peer-to-peer botnets using control flow stability. In: International conference on availability, reliability and security, 2009. ARES\u201909. IEEE, pp 663\u2013669","DOI":"10.1109\/ARES.2009.59"},{"key":"1863_CR40","unstructured":"Wang R, Tang K (2012) Minimax classifier for uncertain costs. arXiv:1205.0406"},{"key":"1863_CR41","unstructured":"Weka (2012) Weka introduction. http:\/\/www.cs.waikato.ac.nz\/ml\/weka\/"},{"key":"1863_CR42","doi-asserted-by":"crossref","unstructured":"Xusheng Z (2008) A p2p traffic classification method based on svm. In: International symposium on computer science and computational technology, 2008. ISCSCT\u201908. IEEE, vol\u00a02, pp 53\u201357","DOI":"10.1109\/ISCSCT.2008.368"},{"key":"1863_CR43","unstructured":"Ye W (2012) Two step hybrid p2p traffic classification. Master\u2019s thesis, Dankook University, Korea"},{"key":"1863_CR44","doi-asserted-by":"crossref","unstructured":"Ye W, Cho K (2013) Two-step p2p traffic classification with connection heuristics. In: 2013 Seventh international conference on innovative mobile and internet services in ubiquitous computing (IMIS), IEEE, pp 135\u2013141","DOI":"10.1109\/IMIS.2013.31"},{"issue":"9","key":"1863_CR45","doi-asserted-by":"crossref","first-page":"1815","DOI":"10.1007\/s00500-014-1253-5","volume":"18","author":"W Ye","year":"2014","unstructured":"Ye W, Cho K (2014a) Hybrid p2p traffic classification with heuristic rules and machine learning. Soft Comput 18(9):1815\u20131827","journal-title":"Soft Comput"},{"issue":"3","key":"1863_CR46","doi-asserted-by":"crossref","first-page":"45","DOI":"10.9708\/jksci.2014.19.3.045","volume":"19","author":"W Ye","year":"2014","unstructured":"Ye W, Cho K (2014b) P2p traffic classification using advanced heuristic rules and analysis of decision tree algorithms. J Korea Soc Comput Inf 19(3):45\u201354","journal-title":"J Korea Soc Comput Inf"},{"key":"1863_CR47","unstructured":"Zeng Y, Shin KG (2013) On detection of storm botnets, pp 1\u20137"},{"key":"1863_CR48","doi-asserted-by":"crossref","unstructured":"Zhang H, Lu G, Qassrawi MT, Zhang Y, Yu X (2012) Feature selection for optimizing traffic classification. Comput Commun 35(12):1457\u20131471","DOI":"10.1016\/j.comcom.2012.04.012"},{"issue":"1","key":"1863_CR49","doi-asserted-by":"crossref","first-page":"27","DOI":"10.1109\/TIFS.2013.2290197","volume":"9","author":"J Zhang","year":"2014","unstructured":"Zhang J, Perdisci R, Lee W, Luo X, Sarfraz U (2014) Building a scalable system for stealthy p2p-botnet detection. IEEE Trans Inf Forensics Secur 9(1):27\u201338","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"1863_CR50","doi-asserted-by":"crossref","unstructured":"Zhao D, Traore I, Ghorbani A, Sayed B, Saad S, Lu W (2012) Peer to peer botnet detection based on flow intervals. In: Information security and privacy research, 28th IFIP TC 11 SEC conference-2012, vol 376. Springer, Crete, pp 87\u2013102","DOI":"10.1007\/978-3-642-30436-1_8"}],"container-title":["Soft Computing"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s00500-015-1863-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s00500-015-1863-6\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s00500-015-1863-6","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s00500-015-1863-6.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,8,30]],"date-time":"2019-08-30T15:32:14Z","timestamp":1567179134000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s00500-015-1863-6"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,9,19]]},"references-count":50,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2017,3]]}},"alternative-id":["1863"],"URL":"https:\/\/doi.org\/10.1007\/s00500-015-1863-6","relation":{},"ISSN":["1432-7643","1433-7479"],"issn-type":[{"value":"1432-7643","type":"print"},{"value":"1433-7479","type":"electronic"}],"subject":[],"published":{"date-parts":[[2015,9,19]]}}}