{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,20]],"date-time":"2026-04-20T15:40:43Z","timestamp":1776699643816,"version":"3.51.2"},"reference-count":44,"publisher":"Springer Science and Business Media LLC","issue":"19","license":[{"start":{"date-parts":[[2022,2,10]],"date-time":"2022-02-10T00:00:00Z","timestamp":1644451200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2022,2,10]],"date-time":"2022-02-10T00:00:00Z","timestamp":1644451200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key R&D Program of China","doi-asserted-by":"crossref","award":["2018YFB2004200"],"award-info":[{"award-number":["2018YFB2004200"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100001809","name":"National Science Foundation of China","doi-asserted-by":"crossref","award":["61872100"],"award-info":[{"award-number":["61872100"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"State Grid Corporation of China Co., Ltd technology project","award":["5700-202155185A-00-00"],"award-info":[{"award-number":["5700-202155185A-00-00"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Neural Comput & Applic"],"published-print":{"date-parts":[[2023,7]]},"DOI":"10.1007\/s00521-022-06934-x","type":"journal-article","created":{"date-parts":[[2022,2,10]],"date-time":"2022-02-10T18:02:44Z","timestamp":1644516164000},"page":"13725-13737","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["A privacy-preserving botnet detection approach in largescale cooperative IoT environment"],"prefix":"10.1007","volume":"35","author":[{"given":"Yixin","family":"Li","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Muyijie","family":"Zhu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xi","family":"Luo","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lihua","family":"Yin","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ye","family":"Fu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2022,2,10]]},"reference":[{"key":"6934_CR1","doi-asserted-by":"crossref","unstructured":"Luo C, Tan Z, Min G, Gan J, Shi W, Tian Z (2020) A novel web attack detection system for internet of things via ensemble classification. IEEE Trans  Ind Inf**.","DOI":"10.1109\/TII.2020.3038761"},{"issue":"5","key":"6934_CR2","doi-asserted-by":"publisher","first-page":"3431","DOI":"10.1109\/TII.2020.3003133","volume":"17","author":"J Zhou","year":"2021","unstructured":"Zhou J, Dai HN, Wang H, Wang T (2021) Wide-attention and deepcomposite model for traffic flow prediction in transportation cyberphysical systems. IEEE Trans Industr Inf 17(5):3431\u20133440","journal-title":"IEEE Trans Industr Inf"},{"key":"6934_CR3","doi-asserted-by":"crossref","unstructured":"Tyagi S, Agarwal A, Maheshwari P (2016) A conceptual framework for iot-based healthcare system using cloud computing. In: 6th International Conference-Cloud System and Big Data Engineering (Confluence). IEEE, pp 503\u2013507","DOI":"10.1109\/CONFLUENCE.2016.7508172"},{"key":"6934_CR4","unstructured":"Sun Y, Tian Z, Li M, Su S, Du X, Guizani M (2020) Honeypot identification in softwarized industrial cyber-physical systems. IEEE Trans Ind  Infor, pp. 1\u20131."},{"issue":"3","key":"6934_CR5","doi-asserted-by":"publisher","first-page":"2054","DOI":"10.1109\/TII.2019.2930286","volume":"16","author":"T Wang","year":"2020","unstructured":"Wang T, Luo H, Jia W, Liu A, Xie M (2020) Mtes: an intelligent trust evaluation scheme in sensor-cloud-enabled industrial internet of things. IEEE Trans Industr Inf 16(3):2054\u20132062","journal-title":"IEEE Trans Industr Inf"},{"issue":"2","key":"6934_CR6","doi-asserted-by":"publisher","first-page":"76","DOI":"10.1109\/MC.2017.62","volume":"50","author":"E Bertino","year":"2017","unstructured":"Bertino E, Islam N (2017) Botnets and internet of things security. Computer 50(2):76\u201379","journal-title":"Computer"},{"key":"6934_CR7","doi-asserted-by":"crossref","unstructured":"\u201cNokia threat intelligence report.\u201d https:\/\/www.nokia.com\/networks\/portfolio\/cybersecurity\/threat-intelligence-report-2020\/.","DOI":"10.1016\/S1361-3723(20)30115-9"},{"key":"6934_CR8","unstructured":"Asghari H, Ciere M, van Eeten MJG (2015) Post-mortem of a zombie: Conficker cleanup after six years. In: 24th USENIX Security Symposium, USENIX Security 15, Washington, D.C., USA, August 12\u201314, 2015, pp. 1\u201316. [Online]. Available: https:\/\/www.usenix.org\/conference\/usenixsecurity15\/technical-sessions\/presentation\/asghari"},{"key":"6934_CR9","doi-asserted-by":"publisher","unstructured":"Andriesse D, Rossow C, Stone-Gross B, Plohmann D, Bos H (2013) Highly resilient peer-to-peer botnets are here: an analysis of gameover zeus. In: 8th International Conference on Malicious and Unwanted Software: \"The Americas\", MALWARE 2013, Fajardo, PR, USA, October 22\u201324, 2013, pp. 116\u2013123. https:\/\/doi.org\/10.1109\/MALWARE.2013.6703693","DOI":"10.1109\/MALWARE.2013.6703693"},{"key":"6934_CR10","unstructured":"Antonakakis M, April T, Bailey M, Bernhard M, Bursztein E, Cochran J, Durumeric Z, Halderman JA, Invernizzi L,  Kallitsis M, Kumar D, Lever C, Ma Z, Mason J, Menscher D, Seaman C, Sullivan N, Thomas K, Zhou Y (2017) Understanding the mirai botnet.In: 26th USENIX Security Symposium, USENIX Security 2017, Vancouver, BC, Canada, August 16\u201318, 2017., 2017, pp. 1093\u20131110. [Online]. Available: https:\/\/www.usenix.org\/conference\/usenixsecurity17\/technical-sessions\/presentation\/antonakakis"},{"key":"6934_CR11","doi-asserted-by":"crossref","unstructured":"Herwig S, Harvey K, Hughey G, Roberts R, Levin D (2019) Measurement and analysis of hajime, a peer-to-peer iot botnet. In: 26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, February 24\u201327, 2019. [Online]. Available: https:\/\/www.ndss-symposium.org\/ndss-paper\/measurement-and-analysis-of-hajime-a-peer-to-peer-iot-botnet\/","DOI":"10.14722\/ndss.2019.23488"},{"key":"6934_CR12","doi-asserted-by":"publisher","unstructured":"Yadav S, Reddy ALN (2011) Winning with DNS failures: Strategies for faster botnet detection. In: Security and Privacy in Communication Networks\u20147th International ICST Conference, SecureComm (2011) London, UK, September 7\u20139, 2011. Revised Selected Papers 2011:446\u2013459. https:\/\/doi.org\/10.1007\/978-3-642-31909-9_26","DOI":"10.1007\/978-3-642-31909-9_26"},{"key":"6934_CR13","unstructured":"Gu G, Zhang J, LeeW (2008) Botsniffer: Detecting botnet command and control channels in network traffic. In: Proceedings of the Network and Distributed System Security Symposium, NDSS 2008, San Diego, California, USA, 10th February\u201313th February 2008, 2008. [Online]. Available: http:\/\/www.isoc.org\/isoc\/conferences\/ndss\/08\/papers\/17_botsniffer_detecting_botnet.pdf"},{"key":"6934_CR14","doi-asserted-by":"publisher","unstructured":"LuoX, Wang L, Xu Z, An W (2018) Lagprober: Detecting dga-based malware by using query time lag of non-existent domains. In: Information and Communications Security - 20th International Conference, ICICS 2018, Lille, France, October 2931, 2018, Proceedings, 2018, pp. 41\u201356. https:\/\/doi.org\/10.1007\/978-3-030-01950-1\\_3","DOI":"10.1007\/978-3-030-01950-1\\_3"},{"key":"6934_CR15","unstructured":"Antonakakis M, Perdisci R, Nadji Y, Vasiloglou II N, Abu-Nimeh S, Lee W, Dagon D (2012) From throw-away traffic to bots: Detecting the rise of dga-based malware. In: USENIX Security Symposium, 2012, pp. 491\u2013506."},{"key":"6934_CR16","doi-asserted-by":"crossref","unstructured":"Velasco-Mata J, Gonz\u00e1lez-Castro V, Fern\u00e1ndez EF, Alegre E (2021) Efficient detection of botnet traffic by features selection and decision trees. IEEE Access 9:120567\u2013120579.","DOI":"10.1109\/ACCESS.2021.3108222"},{"key":"6934_CR17","doi-asserted-by":"crossref","unstructured":"Alharbi A,  Alsubhi K (2021) Botnet detection approach using graph-based machine learning.  IEEE Access 9:99166\u201399180.","DOI":"10.1109\/ACCESS.2021.3094183"},{"issue":"4","key":"6934_CR18","doi-asserted-by":"publisher","first-page":"357","DOI":"10.1504\/IJAIP.2020.106030","volume":"15","author":"AM Manasrah","year":"2020","unstructured":"Manasrah AM, Domi WB, Suppiah NN (2020) Botnet detection based on dns traffic similarity. Int J Adv Intell Paradigms 15(4):357\u2013387","journal-title":"Int J Adv Intell Paradigms"},{"key":"6934_CR19","doi-asserted-by":"crossref","unstructured":"Pour MS, Mangino A, Friday K, Rathbun M, Bou-Harb E, Iqbal F, Samtani S, Crichigno J, Ghani N (2020) On data-driven curation, learning, and analysis for inferring evolving internet-of-things (iot) botnets in the wild. Comput  Security 91:101707.","DOI":"10.1016\/j.cose.2019.101707"},{"key":"6934_CR20","doi-asserted-by":"crossref","unstructured":"PopoolaSI, Adebisi B, Hammoudeh M, Gacanin H, Gui G (2021)Stacked recurrent neural network for botnet detection in smart homes. Computers Electrical Eng 92:107039.","DOI":"10.1016\/j.compeleceng.2021.107039"},{"issue":"6","key":"6934_CR21","doi-asserted-by":"publisher","first-page":"4682","DOI":"10.1109\/JIOT.2020.2969326","volume":"7","author":"J Qiu","year":"2020","unstructured":"Qiu J, Tian Z, Du C, Zuo Q, Su S, Fang B (2020) A survey on access control in the age of internet of things. IEEE Internet Things J 7(6):4682\u20134696","journal-title":"IEEE Internet Things J"},{"key":"6934_CR22","unstructured":"Kumar S, Hu Y, Andersen MP, Popa RA, Culler DE (2019) JEDI: many-to-many end-to-end encryption and key delegation for iot. In: 28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14\u201316, 2019, pp. 1519\u20131536. [Online]. Available: https:\/\/www.usenix.org\/conference\/usenixsecurity19\/presentation\/kumar-sam"},{"key":"6934_CR23","unstructured":"Gu G, Zhang J, Lee W (2008) Botsniffer: Detecting botnet command and control channels in network traffic. In: Proceedings of the Network and Distributed System Security Symposium, NDSS 2008, San Diego, California, USA, 10th February\u201313th February 2008."},{"key":"6934_CR24","doi-asserted-by":"publisher","unstructured":"Li F, Wang H, Niu B, He Y, Hua J, Li H (2016) A practical group matching scheme for privacy-aware users in mobile social networks. In: IEEE Wireless Communications and Networking Conference, WCNC, (2016) Doha, Qatar, April 3\u20136, 2016. IEEE, pp 1\u20136. https:\/\/doi.org\/10.1109\/WCNC.2016.7564968","DOI":"10.1109\/WCNC.2016.7564968"},{"key":"6934_CR25","doi-asserted-by":"publisher","unstructured":"Choi H, Lee H, Kim H (2009) Botgad: detecting botnets by capturing group activities in network traffic. In: Bosch J, Clarke S (eds) Proceedings of the 4th International Conference on COMmunication System softWAre and MiddlewaRE (COMSWARE 2009), June 15\u201319, 2009, Dublin, Ireland. ACM, 2009, p. 2. https:\/\/doi.org\/10.1145\/1621890.1621893","DOI":"10.1145\/1621890.1621893"},{"key":"6934_CR26","doi-asserted-by":"publisher","unstructured":"Choi H, Lee H (2012) Identifying botnets by capturing group activities in DNS traffic. Comput Netw 56(1):20\u201333, 2012. https:\/\/doi.org\/10.1016\/j.comnet.2011.07.018","DOI":"10.1016\/j.comnet.2011.07.018"},{"key":"6934_CR27","unstructured":"Gu G, Perdisci R, Zhang J, Lee W (2008) Botminer: Clustering analysis of network traffic for protocol- and structure-independent botnet detection. In: Proceedings of the 17th USENIX Security Symposium, July 28-August 1, 2008, San Jose, CA, USA, P. C. van Oorschot, Ed USENIX Association, 2008, pp. 139\u2013154. [Online]. Available: http:\/\/www.usenix.org\/events\/sec08\/tech\/full_papers\/gu\/gu.pdf"},{"key":"6934_CR28","doi-asserted-by":"publisher","unstructured":"Kwon J, Lee J, Lee H, PerrigA (2016) Psybog: A scalable botnet detection method for large-scale DNS traffic. Comput Netw 97:48\u201373. https:\/\/doi.org\/10.1016\/j.comnet.2015.12.008","DOI":"10.1016\/j.comnet.2015.12.008"},{"key":"6934_CR29","doi-asserted-by":"publisher","unstructured":"Homayoun S, Ahmadzadeh M, Hashemi S, Dehghantanha A, Khayami R (2018) BoTShark: a deep learning approach for Botnet traffic detection. Springer International Publishing, Cham, pp. 137\u2013153. https:\/\/doi.org\/10.1007\/978-3-319-73951-9_7","DOI":"10.1007\/978-3-319-73951-9_7"},{"key":"6934_CR30","doi-asserted-by":"publisher","first-page":"175","DOI":"10.1016\/j.comnet.2018.08.014","volume":"145","author":"C Wang","year":"2018","unstructured":"Wang C, Ou C, Zhang Y, Cho F, Chen P, Chang J, Shieh C (2018) Botcluster: a session-based P2P botnet clustering system on netflow. Comput Netw 145:175\u2013189. https:\/\/doi.org\/10.1016\/j.comnet.2018.08.014","journal-title":"Comput Netw"},{"key":"6934_CR31","unstructured":"Hang H, Wei X, Faloutsos M, Eliassi-Rad T (2013) Entelecheia: Detecting P2P botnets in their waiting stage. In: IFIP Networking Conference, 2013, Brooklyn, New York, USA, 22\u201324 May, 2013. IEEE Computer Society, 2013, pp. 1\u20139. [Online]. Available: http:\/\/ieeexplore.ieee.org\/document\/6663501\/"},{"key":"6934_CR32","doi-asserted-by":"crossref","unstructured":"Joshi HP, Dutta R (2018) Gadfly: a fast and robust algorithm to detect p2p botnets in communication graphs. In: IEEE Global Communications Conference (GLOBECOM), pp 1\u20136","DOI":"10.1109\/GLOCOM.2018.8647234"},{"key":"6934_CR33","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107488","volume":"182","author":"MJ Dehkordi","year":"2020","unstructured":"Dehkordi MJ, Sadeghiyan B (2020) An effective node-removal method against P2P botnets. Comput Netw 182:107488. https:\/\/doi.org\/10.1016\/j.comnet.2020.107488","journal-title":"Comput Netw"},{"key":"6934_CR34","doi-asserted-by":"crossref","unstructured":"Yadav S, Reddy AKK, Reddy A, Ranjan S (2010) Detecting algorithmically generated malicious domain names. In: Proceedings of the 10th ACM SIGCOMM conference on Internet measurement. ACM, New York, pp. 48\u201361.","DOI":"10.1145\/1879141.1879148"},{"key":"6934_CR35","doi-asserted-by":"crossref","unstructured":"Schiavoni S, Maggi F, Cavallaro L, Zanero S (2014) Phoenix: Dgabased botnet tracking and intelligence. In: International conference on detection of Iintrusions and malware, and vulnerability assessment. Springer, Cham, pp. 192\u2013211.","DOI":"10.1007\/978-3-319-08509-8_11"},{"key":"6934_CR36","unstructured":"Sch\u00fcppen S, Teubert D, Herrmann P, Meyer U (2018) Fanci: Featurebased automated nxdomain classification and intelligence. In: 27th USENIX Security Symposium (USENIX Security 18), pp. 1165\u20131181."},{"issue":"3","key":"6934_CR37","doi-asserted-by":"publisher","first-page":"12","DOI":"10.1109\/MPRV.2018.03367731","volume":"17","author":"Y Meidan","year":"2018","unstructured":"Meidan Y, Bohadana M, Mathov Y, Mirsky Y, Shabtai A, Breitenbacher D, Elovici Y (2018) N-baiotnetwork-based detection of iot botnet attacks using deep autoencoders. IEEE Pervasive Comput 17(3):12\u201322","journal-title":"IEEE Pervasive Comput"},{"key":"6934_CR38","doi-asserted-by":"crossref","unstructured":"Nguyen TD, Marchal S, Miettinen M, Fereidooni F, Asokan N, Sadeghi A (2019) D\u00cfot: a federated self-learning anomaly detection system for iot. In: 2019 IEEE 39th International Conference on Distributed Computing Systems (ICDCS), pp. 756\u2013767.","DOI":"10.1109\/ICDCS.2019.00080"},{"issue":"2","key":"6934_CR39","doi-asserted-by":"publisher","first-page":"1373","DOI":"10.1109\/TII.2019.2940742","volume":"16","author":"L Yin","year":"2020","unstructured":"Yin L, Luo X, Zhu C, Wang L, Xu Z, Lu H (2020) Connspoiler: disrupting c&c communication of iot-based botnet through fast detection of anomalous domain queries. IEEE Trans Ind Informatics 16(2):1373\u20131384. https:\/\/doi.org\/10.1109\/TII.2019.2940742","journal-title":"IEEE Trans Ind Informatics"},{"key":"6934_CR40","doi-asserted-by":"crossref","unstructured":"Kumar A, Shridhar M, Swaminathan S, Lim TJ (2020) Ml-based early detection of iot botnets. In: International Conference on Security and Privacy in Communication Systems. Springer, Cham, pp. 254\u2013260.","DOI":"10.1007\/978-3-030-63095-9_15"},{"issue":"5","key":"6934_CR41","doi-asserted-by":"publisher","first-page":"3242","DOI":"10.1109\/JIOT.2020.3002255","volume":"8","author":"M Shafiq","year":"2021","unstructured":"Shafiq M, Tian Z, Bashir AK, Du X, Guizani M (2021) Corrauc: a malicious bot-iot traffic detection method in iot network using machinelearning techniques. IEEE Internet Things J 8(5):3242\u20133254","journal-title":"IEEE Internet Things J"},{"key":"6934_CR42","doi-asserted-by":"crossref","unstructured":"Shafiq M, Tian Z, Bashir AK, Du X, Guizani M (2020) Iot malicious traffic identification using wrapper-based feature selection mechanisms. Comput  Security 94:101863. [Online]. Available: https:\/\/www.sciencedirect.com\/science\/article\/pii\/S0167404820301358","DOI":"10.1016\/j.cose.2020.101863"},{"key":"6934_CR43","doi-asserted-by":"crossref","unstructured":"Garcia S, Grill M, Stiborek J, Zunino A (2014) An empirical comparison of botnet detection methods. Comput Security 45:00\u2013123.","DOI":"10.1016\/j.cose.2014.05.011"},{"key":"6934_CR44","doi-asserted-by":"publisher","first-page":"779","DOI":"10.1016\/j.future.2019.05.041","volume":"100","author":"N Koroniotis","year":"2019","unstructured":"Koroniotis N, Moustafa N, Sitnikova E, Turnbull B (2019) Towards the development of realistic botnet dataset in the internet of things for network forensic analytics: Bot-iot dataset. Futur Gener Comput Syst 100:779\u2013796","journal-title":"Futur Gener Comput Syst"}],"container-title":["Neural Computing and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00521-022-06934-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s00521-022-06934-x\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00521-022-06934-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,5,24]],"date-time":"2023-05-24T18:06:29Z","timestamp":1684951589000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s00521-022-06934-x"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,2,10]]},"references-count":44,"journal-issue":{"issue":"19","published-print":{"date-parts":[[2023,7]]}},"alternative-id":["6934"],"URL":"https:\/\/doi.org\/10.1007\/s00521-022-06934-x","relation":{},"ISSN":["0941-0643","1433-3058"],"issn-type":[{"value":"0941-0643","type":"print"},{"value":"1433-3058","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,2,10]]},"assertion":[{"value":"6 September 2021","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"4 January 2022","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"10 February 2022","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"I declare on behalf of all co-authors that there exists no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}]}}