{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,30]],"date-time":"2026-03-30T15:07:40Z","timestamp":1774883260641,"version":"3.50.1"},"reference-count":62,"publisher":"Springer Science and Business Media LLC","issue":"2","license":[{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,3,3]],"date-time":"2026-03-03T00:00:00Z","timestamp":1772496000000},"content-version":"vor","delay-in-days":2,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"National Science Foundation","award":["CNS-2245968"],"award-info":[{"award-number":["CNS-2245968"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["World Wide Web"],"published-print":{"date-parts":[[2026,3]]},"DOI":"10.1007\/s11280-026-01406-x","type":"journal-article","created":{"date-parts":[[2026,3,3]],"date-time":"2026-03-03T04:10:39Z","timestamp":1772511039000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Learning to detect malicious bots in computer networks via heterophily-aware isotropic out-of-distribution detection"],"prefix":"10.1007","volume":"29","author":[{"given":"Bradley","family":"Ashmore","sequence":"first","affiliation":[]},{"given":"Lingwei","family":"Chen","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2026,3,3]]},"reference":[{"key":"1406_CR1","doi-asserted-by":"publisher","DOI":"10.1016\/j.iot.2020.100240","volume":"11","author":"S Rizvi","year":"2020","unstructured":"Rizvi, S., Pipetti, R., McIntyre, N., Todd, J.: Threat model for securing internet of things (iot) network at device-level. Internet of Things. 11, 100240 (2020). https:\/\/doi.org\/10.1016\/j.iot.2020.100240","journal-title":"Internet of Things."},{"key":"1406_CR2","doi-asserted-by":"crossref","unstructured":"Chatterjee, M., Namin, A.S., Datta, P.: Evidence fusion for malicious bot detection in iot. In: BigData), pp. 4545\u20134548 (2018). IEEE","DOI":"10.1109\/BigData.2018.8621895"},{"key":"1406_CR3","doi-asserted-by":"publisher","first-page":"159756","DOI":"10.1109\/ACCESS.2020.3020507","volume":"8","author":"BM Rahal","year":"2020","unstructured":"Rahal, B.M., Santos, A., Nogueira, M.: A distributed architecture for ddos prediction and bot detection. IEEE Access. 8, 159756\u2013159772 (2020)","journal-title":"IEEE Access."},{"issue":"6","key":"1406_CR4","doi-asserted-by":"publisher","first-page":"25","DOI":"10.1109\/MSP.2017.4251116","volume":"15","author":"P Bazyd\u0142o","year":"2017","unstructured":"Bazyd\u0142o, P., Lasota, K., Kozakiewicz, A.: Botnet fingerprinting: anomaly detection in smtp conversations. IEEE Secur. Privacy. 15(6), 25\u201332 (2017)","journal-title":"IEEE Secur. Privacy."},{"issue":"3","key":"1406_CR5","doi-asserted-by":"publisher","first-page":"1701","DOI":"10.1109\/TNSM.2020.2996502","volume":"17","author":"A Blaise","year":"2020","unstructured":"Blaise, A., Bouet, M., Conan, V., Secci, S.: Botnet fingerprinting: A frequency distributions scheme for lightweight bot detection. IEEE Trans. Netw. Serv. Manage. 17(3), 1701\u20131714 (2020)","journal-title":"IEEE Trans. Netw. Serv. Manage."},{"key":"1406_CR6","doi-asserted-by":"crossref","unstructured":"Jonker, H., Krumnow, B., Vlot, G.: Fingerprint surface-based detection of web bot detectors. In: ESORICS, pp. 586\u2013605 (2019). Springer","DOI":"10.1007\/978-3-030-29962-0_28"},{"key":"1406_CR7","doi-asserted-by":"publisher","first-page":"2","DOI":"10.1016\/j.cose.2013.04.007","volume":"39","author":"D Zhao","year":"2013","unstructured":"Zhao, D., Traore, I., Sayed, B., Lu, W., Saad, S., Ghorbani, A., Garant, D.: Botnet detection based on traffic behavior analysis and flow intervals. Comput. Secur. 39, 2\u201316 (2013)","journal-title":"Comput. Secur."},{"key":"1406_CR8","doi-asserted-by":"publisher","first-page":"312","DOI":"10.1016\/j.ins.2018.08.019","volume":"467","author":"S Kudugunta","year":"2018","unstructured":"Kudugunta, S., Ferrara, E.: Deep neural networks for bot detection. Inf. Sci. 467, 312\u2013322 (2018)","journal-title":"Inf. Sci."},{"key":"1406_CR9","doi-asserted-by":"crossref","unstructured":"Bilge, L., Balzarotti, D., Robertson, W., Kirda, E., Kruegel, C.: Disclosure: detecting botnet command and control servers through large-scale netflow analysis. In: ACSAC, pp. 129\u2013138 (2012)","DOI":"10.1145\/2420950.2420969"},{"key":"1406_CR10","doi-asserted-by":"crossref","unstructured":"McDermott, C.D., Majdani, F., Petrovski, A.V.: Botnet detection in the internet of things using deep learning approaches. In: IJCNN, pp. 1\u20138 (2018)","DOI":"10.1109\/IJCNN.2018.8489489"},{"key":"1406_CR11","doi-asserted-by":"publisher","first-page":"100747","DOI":"10.1016\/j.iot.2023.100747","volume":"22","author":"WW Lo","year":"2023","unstructured":"Lo, W.W., Kulatilleke, G., Sarhan, M., Layeghy, S., Portmann, M.: Xg-bot: An explainable deep graph neural network for botnet detection and forensics. Internet Things. 22, 100747 (2023)","journal-title":"Internet Things."},{"issue":"4","key":"1406_CR12","doi-asserted-by":"publisher","first-page":"1011","DOI":"10.1109\/SURV.2011.092311.00082","volume":"14","author":"T-H Cheng","year":"2011","unstructured":"Cheng, T.-H., Lin, Y.-D., Lai, Y.-C., Lin, P.-C.: Evasion techniques: Sneaking through your intrusion detection\/prevention systems. IEEE Commun. Surv. Tutor. 14(4), 1011\u20131020 (2011)","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"1406_CR13","doi-asserted-by":"crossref","unstructured":"Zhang, J., Perdisci, R., Lee, W., Luo, X., Sarfraz, U.: Building a scalable system for stealthy p2p-botnet detection. TIFS. (2013)","DOI":"10.1109\/TIFS.2013.2290197"},{"key":"1406_CR14","doi-asserted-by":"crossref","unstructured":"Ali Alhosseini, S., Bin Tareaf, R., Najafi, P., Meinel, C.: Detect me if you can: Spam bot detection using inductive representation learning. In: WWW, pp. 148\u2013153 (2019)","DOI":"10.1145\/3308560.3316504"},{"key":"1406_CR15","unstructured":"Zhou, J., Xu, Z., Rush, A.M., Yu, M.: Automating botnet detection with graph neural networks. arXiv:2003.06344. (2020)"},{"key":"1406_CR16","doi-asserted-by":"crossref","unstructured":"Zhang, B., Li, J., Chen, C., Lee, K., Lee, I.: A practical botnet traffic detection system using gnn. In: CSS, pp. 66\u201378 (2022)","DOI":"10.1007\/978-3-030-94029-4_5"},{"key":"1406_CR17","doi-asserted-by":"crossref","unstructured":"Chen, L., Li, X., Wu, D.: Enhancing robustness of graph convolutional networks via dropping graph connections. In: ECML PKDD, pp. 412\u2013428 (2021). Springer","DOI":"10.1007\/978-3-030-67664-3_25"},{"key":"1406_CR18","unstructured":"Li, Z., Liu, F., Yang, W., Peng, S., Zhou, J.: A survey of convolutional neural networks: analysis, applications, and prospects. TNNLS. (2021)"},{"key":"1406_CR19","doi-asserted-by":"publisher","first-page":"165130","DOI":"10.1109\/ACCESS.2020.3022862","volume":"8","author":"A Alsaedi","year":"2020","unstructured":"Alsaedi, A., Moustafa, N., Tari, Z., Mahmood, A., Anwar, A.: Ton_iot telemetry dataset: A new generation dataset of iot and iiot for data-driven intrusion detection systems. IEEE Access. 8, 165130\u2013165150 (2020)","journal-title":"IEEE Access."},{"key":"1406_CR20","doi-asserted-by":"crossref","unstructured":"Moustafa, N.: A new distributed architecture for evaluating ai-based security systems at the edge: Network ton_iot datasets. Sustainable Cities and Society. (2021)","DOI":"10.1016\/j.scs.2021.102994"},{"key":"1406_CR21","doi-asserted-by":"crossref","unstructured":"Ashmore, B., Chen, L.: Hover: Homophilic oversampling via edge removal for class-imbalanced bot detection on graphs. In: CIKM, pp. 3728\u20133732 (2023)","DOI":"10.1145\/3583780.3615264"},{"key":"1406_CR22","doi-asserted-by":"crossref","unstructured":"Li, Q., Chen, L., Cai, Y., Wu, D.: Hierarchical graph neural network for patient treatment preference prediction with external knowledge. In: PAKDD, pp. 204\u2013215 (2023)","DOI":"10.1007\/978-3-031-33380-4_16"},{"key":"1406_CR23","doi-asserted-by":"crossref","unstructured":"Duan, Y., Liu, X., et al.: Anonymity can help minority: A novel synthetic data over-sampling strategy on multi-label graphs. In: ECML PKDD, pp. 20\u201336 (2022)","DOI":"10.1007\/978-3-031-26390-3_2"},{"key":"1406_CR24","doi-asserted-by":"crossref","unstructured":"Zhao, T., Zhang, X., Wang, S.: Graphsmote: Imbalanced node classification on graphs with graph neural networks. In: WSDM, pp. 833\u2013841 (2021)","DOI":"10.1145\/3437963.3441720"},{"issue":"21","key":"1406_CR25","doi-asserted-by":"publisher","first-page":"3500","DOI":"10.3390\/electronics11213500","volume":"11","author":"P Cui","year":"2022","unstructured":"Cui, P., Wang, J.: Out-of-distribution (ood) detection based on deep learning: A review. Electronics 11(21), 3500 (2022)","journal-title":"Electronics"},{"key":"1406_CR26","unstructured":"Liang, S., Li, Y., Srikant, R.: Enhancing the reliability of out-of-distribution image detection in neural networks. ICLR. (2018)"},{"key":"1406_CR27","doi-asserted-by":"crossref","unstructured":"Cen, J., Yun, P., Cai, J., Wang, M.Y., Liu, M.: Deep metric learning for open world semantic segmentation. In: ICCV, pp. 15333\u201315342 (2021)","DOI":"10.1109\/ICCV48922.2021.01505"},{"key":"1406_CR28","doi-asserted-by":"crossref","unstructured":"Berend, D., Xie, X., Ma, L., Zhou, L., et al.: Cats are not fish: Deep learning testing calls for out-of-distribution awareness. In: ASE, pp. 1041\u20131052 (2020)","DOI":"10.1145\/3324884.3416609"},{"key":"1406_CR29","unstructured":"Bitterwolf, J., Meinke, A., Augustin, M., Hein, M.: Breaking down out-of-distribution detection. In: ICML, pp. 2041\u20132074 (2022)"},{"key":"1406_CR30","first-page":"144","volume":"34","author":"Y Sun","year":"2021","unstructured":"Sun, Y., Guo, C., Li, Y.: React: Out-of-distribution detection with rectified activations. Adv. Neural. Inf. Process. Syst. 34, 144\u2013157 (2021)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"1406_CR31","doi-asserted-by":"crossref","unstructured":"Hsu, Y.-C., Shen, Y., et al.: Generalized odin: Detecting out-of-distribution image without learning from out-of-distribution data. In: CVPR, pp. 10951\u201310960 (2020)","DOI":"10.1109\/CVPR42600.2020.01096"},{"key":"1406_CR32","doi-asserted-by":"crossref","unstructured":"Li, H., Wang, X., Zhang, Z., Zhu, W.: Ood-gnn: Out-of-distribution generalized graph neural network. IEEE Trans. Knowl. Data Eng. (2022)","DOI":"10.1109\/TKDE.2022.3193725"},{"key":"1406_CR33","first-page":"1048","volume":"34","author":"J Ma","year":"2021","unstructured":"Ma, J., Deng, J., Mei, Q.: Subgroup generalization and fairness of graph neural networks. NeurIPS. 34, 1048\u20131061 (2021)","journal-title":"NeurIPS."},{"key":"1406_CR34","unstructured":"Wu, Q., Chen, Y., Yang, C., Yan, J.: Energy-based out-of-distribution detection for graph neural networks. arXiv:2302.02914. (2023)"},{"key":"1406_CR35","unstructured":"Yang, N., Zeng, K., Wu, Q., Jia, X., Yan, J.: Learning substructure invariance for out-of-distribution molecular representations. NeurIPS. 35 (2022)"},{"key":"1406_CR36","unstructured":"Li, H., Wang, X., Zhang, Z., Zhu, W.: Out-of-distribution generalization on graphs: A survey. arXiv:2202.07987. (2022)"},{"key":"1406_CR37","first-page":"18033","volume":"34","author":"M Stadler","year":"2021","unstructured":"Stadler, M., Charpentier, B., et al.: Graph posterior network: Bayesian predictive uncertainty for node classification. NeurIPS. 34, 18033\u201318048 (2021)","journal-title":"NeurIPS."},{"key":"1406_CR38","first-page":"12827","volume":"33","author":"X Zhao","year":"2020","unstructured":"Zhao, X., Chen, F., Hu, S., Cho, J.-H.: Uncertainty aware semi-supervised learning on graph data. Adv. Neural. Inf. Process. Syst. 33, 12827\u201312836 (2020)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"1406_CR39","doi-asserted-by":"crossref","unstructured":"Nitsch, J., Itkina, M., Senanayake, R., Nieto, J., Schmidt, M., Siegwart, R., Kochenderfer, M.J., Cadena, C.: Out-of-distribution detection for automotive perception. In: 2021 IEEE International Intelligent Transportation Systems Conference (ITSC), pp. 2938\u20132943 (2021). IEEE","DOI":"10.1109\/ITSC48978.2021.9564545"},{"key":"1406_CR40","unstructured":"Hendrycks, D., Gimpel, K.: A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networks (2018)"},{"key":"1406_CR41","first-page":"21464","volume":"33","author":"W Liu","year":"2020","unstructured":"Liu, W., Wang, X., Owens, J., Li, Y.: Energy-based out-of-distribution detection. Adv. Neural. Inf. Process. Syst. 33, 21464\u201321475 (2020)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"1406_CR42","unstructured":"Denouden, T., Salay, R., Czarnecki, K., Abdelzad, V., Phan, B., Vernekar, S.: Improving reconstruction autoencoder out-of-distribution detection with mahalanobis distance. arXiv:1812.02765. (2018)"},{"key":"1406_CR43","unstructured":"Lee, K., Lee, K., Lee, H., Shin, J.: A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Adv. Neural Inf. Process. Syst. 31 (2018)"},{"key":"1406_CR44","doi-asserted-by":"crossref","unstructured":"Mac\u00eado, D., Ren, T.I., Zanchettin, C., Oliveira, A.L., Ludermir, T.: Entropic out-of-distribution detection. In: 2021 International Joint Conference on Neural Networks (IJCNN), pp. 1\u20138 (2021). IEEE","DOI":"10.1109\/IJCNN52387.2021.9533899"},{"key":"1406_CR45","unstructured":"Mac\u00eado, D., Ludermir, T.: Enhanced isotropy maximization loss: Seamless and high-performance out-of-distribution detection simply replacing the softmax loss. arXiv:2105.14399. (2021)"},{"key":"1406_CR46","doi-asserted-by":"publisher","first-page":"30277","DOI":"10.52202\/068431-2195","volume":"35","author":"Z Li","year":"2022","unstructured":"Li, Z., Wu, Q., Nie, F., Yan, J.: Graphde: A generative framework for debiased learning and out-of-distribution detection on graphs. Adv. Neural. Inf. Process. Syst. 35, 30277\u201330290 (2022)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"1406_CR47","doi-asserted-by":"crossref","unstructured":"Zhu, J., Rossi, R.A., Rao, A., Mai, T., Lipka, N., Ahmed, N.K., Koutra, D.: Graph neural networks with heterophily. In: AAAI, pp. 11168\u201311176 (2021)","DOI":"10.1609\/aaai.v35i12.17332"},{"key":"1406_CR48","doi-asserted-by":"crossref","unstructured":"Liu, Y., Zheng, Y., Zhang, D., Lee, V., Pan, S.: Beyond smoothing: Unsupervised graph representation learning with edge heterophily discriminating. arXiv:2211.14065. (2022)","DOI":"10.1609\/aaai.v37i4.25573"},{"key":"1406_CR49","doi-asserted-by":"crossref","unstructured":"Du, L., Shi, X., Fu, Q., Ma, X., et al.: Gbk-gnn: Gated bi-kernel graph neural networks for modeling both homophily and heterophily. In: WWW, pp. 1550\u20131558 (2022)","DOI":"10.1145\/3485447.3512201"},{"key":"1406_CR50","unstructured":"Luan, S., Hua, C., Lu, Q., Zhu, J., Zhao, M., et al.: Revisiting heterophily for graph neural networks. arXiv:2210.07606. (2022)"},{"key":"1406_CR51","first-page":"20887","volume":"34","author":"D Lim","year":"2021","unstructured":"Lim, D., Hohne, F., Li, X., Huang, S.L., et al.: Large scale learning on non-homophilous graphs: New benchmarks and strong simple methods. NeurIPS. 34, 20887\u201320902 (2021)","journal-title":"NeurIPS."},{"key":"1406_CR52","unstructured":"Ma, Y., Liu, X., Shah, N., Tang, J.: Is homophily a necessity for graph neural networks? arXiv:2106.06134. (2021)"},{"key":"1406_CR53","unstructured":"Mac\u00eado, D., Zanchettin, C., Ludermir, T.: Distinction maximization loss: Efficiently improving out-of-distribution detection and uncertainty estimation by replacing the loss and calibrating. arXiv:2205.05874. (2022)"},{"key":"1406_CR54","doi-asserted-by":"crossref","unstructured":"Shiao, W., Saini, U.S., Liu, Y., Zhao, T., Shah, N., Papalexakis, E.E.: Carl-g: Clustering-accelerated representation learning on graphs. In: Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 2036\u20132048 (2023)","DOI":"10.1145\/3580305.3599268"},{"key":"1406_CR55","doi-asserted-by":"crossref","unstructured":"Shahapure, K.R., Nicholas, C.: Cluster quality analysis using silhouette score. In: 2020 IEEE 7th International Conference on Data Science and Advanced Analytics (DSAA), pp. 747\u2013748 (2020). IEEE","DOI":"10.1109\/DSAA49011.2020.00096"},{"key":"1406_CR56","unstructured":"Kipf, T.N., Welling, M.: Semi-supervised classification with graph convolutional networks. arXiv:1609.02907. (2016)"},{"key":"1406_CR57","unstructured":"Veli\u010dkovi\u0107, P., Cucurull, G., et al.: Graph attention networks (2018)"},{"key":"1406_CR58","unstructured":"Hamilton, W., Ying, Z., Leskovec, J.: Inductive representation learning on large graphs. Adv. Neural Inf. Process. Syst. 30 (2017)"},{"key":"1406_CR59","doi-asserted-by":"publisher","first-page":"321","DOI":"10.1613\/jair.953","volume":"16","author":"NV Chawla","year":"2002","unstructured":"Chawla, N.V., Bowyer, K.W., Hall, L.O., Kegelmeyer, W.P.: Smote: synthetic minority over-sampling technique. JAIR. 16, 321\u2013357 (2002)","journal-title":"JAIR."},{"key":"1406_CR60","unstructured":"Hendrycks, D., Mazeika, M., Dietterich, T.: Deep anomaly detection with outlier exposure (2019)"},{"key":"1406_CR61","doi-asserted-by":"crossref","unstructured":"Song, Y., Wang, D.: Learning on graphs with out-of-distribution nodes. In: Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 1635\u20131645 (2022)","DOI":"10.1145\/3534678.3539457"},{"key":"1406_CR62","doi-asserted-by":"crossref","unstructured":"Ashmore, B., Chen, L.: Leveraging homophily-augmented energy propagation for bot detection on graphs. In: DASFAA (2024)","DOI":"10.1007\/978-981-97-5572-1_5"}],"container-title":["World Wide Web"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11280-026-01406-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11280-026-01406-x","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11280-026-01406-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,30]],"date-time":"2026-03-30T14:35:29Z","timestamp":1774881329000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11280-026-01406-x"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3]]},"references-count":62,"journal-issue":{"issue":"2","published-print":{"date-parts":[[2026,3]]}},"alternative-id":["1406"],"URL":"https:\/\/doi.org\/10.1007\/s11280-026-01406-x","relation":{},"ISSN":["1386-145X","1573-1413"],"issn-type":[{"value":"1386-145X","type":"print"},{"value":"1573-1413","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3]]},"assertion":[{"value":"18 July 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"8 December 2025","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"4 February 2026","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"3 March 2026","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}},{"value":"This research does not involve human participants or pose potential harm to individuals. As such, ethical approval was not required.","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethics approval"}}],"article-number":"19"}}