{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,10]],"date-time":"2026-08-10T15:31:58Z","timestamp":1786375918559,"version":"build-2736575974"},"reference-count":50,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-017"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-012"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,9,1]],"date-time":"2026-09-01T00:00:00Z","timestamp":1788220800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-004"}],"funder":[{"DOI":"10.13039\/100012542","name":"Sichuan Province Science and Technology Support Program","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100012542","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computer Networks"],"published-print":{"date-parts":[[2026,9]]},"DOI":"10.1016\/j.comnet.2026.112521","type":"journal-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T16:42:39Z","timestamp":1782924159000},"page":"112521","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["Uncovering malicious sybil structures in Tor: A hybrid approach of constraint clustering and dynamic scoring"],"prefix":"10.1016","volume":"287","author":[{"ORCID":"https:\/\/orcid.org\/0009-0004-4839-5571","authenticated-orcid":false,"given":"Nannan","family":"Wang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5871-946X","authenticated-orcid":false,"given":"Cheng","family":"Huang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Beining","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chang","family":"You","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Junyi","family":"Liu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jinqiao","family":"Shi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.comnet.2026.112521_b1","series-title":"Proceedings of the 13th USENIX Security Symposium, August 9-13, 2004, San Diego, CA, USA","first-page":"303","article-title":"Tor: The second-generation onion router","author":"Dingledine","year":"2004"},{"key":"10.1016\/j.comnet.2026.112521_b2","first-page":"1","article-title":"A verifiable privacy-preserving cross-chain protocol for trusted vehicle edge computing","author":"Tang","year":"2025","journal-title":"IEEE Trans. Veh. Technol."},{"key":"10.1016\/j.comnet.2026.112521_b3","series-title":"ICT Systems Security and Privacy Protection - 40th IFIP International Conference, SEC 2025, Maribor, Slovenia, May 21-23, 2025, Proceedings, Part II","first-page":"189","article-title":"Impact analysis of Sybil attacks in the tor network","volume":"vol. 746","author":"Sendner","year":"2025"},{"issue":"6","key":"10.1016\/j.comnet.2026.112521_b4","doi-asserted-by":"crossref","first-page":"2574","DOI":"10.1109\/TNET.2022.3174003","article-title":"An anonymity vulnerability in tor","volume":"30","author":"Tan","year":"2022","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"10.1016\/j.comnet.2026.112521_b5","series-title":"2020 IEEE International Conference on Power, Intelligent Computing and Systems","first-page":"328","article-title":"Detection of Sybil attack on tor resource distribution","author":"Ge","year":"2020"},{"key":"10.1016\/j.comnet.2026.112521_b6","series-title":"Proceedings of the ACM on Web Conference 2025, WWW 2025, Sydney, NSW, Australia, 28 April 2025- 2 May 2025","first-page":"2959","article-title":"Do not trust what they tell: Exposing malicious accomplices in tor via anomalous circuit detection","author":"Yao","year":"2025"},{"key":"10.1016\/j.comnet.2026.112521_b7","series-title":"2024 IEEE 2nd International Conference on Control, Electronics and Computer Technology","first-page":"292","article-title":"Refining node similarity analysis: An optimized nearest-neighbor ranking algorithm","author":"Sui","year":"2024"},{"key":"10.1016\/j.comnet.2026.112521_b8","series-title":"25th USENIX Security Symposium, USENIX Security 16, Austin, TX, USA, August 10-12, 2016","first-page":"1169","article-title":"Identifying and characterizing sybils in the tor network","author":"Winter","year":"2016"},{"key":"10.1016\/j.comnet.2026.112521_b9","series-title":"ICCNS 2021: The 11th International Conference on Communication and Network Security, Weihai, China, December 3 - 5, 2021","first-page":"21","article-title":"TNRAS: Tor nodes reliability analysis scheme","author":"Zhang","year":"2021"},{"key":"10.1016\/j.comnet.2026.112521_b10","unstructured":"M. Perry, TorFlow: Tor network analysis, in: Proc. 2nd HotPETs, 2009, pp. 1\u201314."},{"key":"10.1016\/j.comnet.2026.112521_b11","doi-asserted-by":"crossref","first-page":"4839","DOI":"10.1109\/TCCN.2025.3641512","article-title":"An adaptive consistency-based detection scheme for label-flipping attacks in low-altitude economic networks","volume":"12","author":"Wang","year":"2026","journal-title":"IEEE Trans. Cogn. Commun. Netw."},{"key":"10.1016\/j.comnet.2026.112521_b12","series-title":"Peer-to-Peer Systems, First International Workshop, IPTPS 2002, Cambridge, MA, USA, March 7-8, 2002, Revised Papers","first-page":"251","article-title":"The Sybil attack","volume":"vol. 2429","author":"Douceur","year":"2002"},{"issue":"6","key":"10.1016\/j.comnet.2026.112521_b13","doi-asserted-by":"crossref","first-page":"1344","DOI":"10.1007\/s11390-015-1602-6","article-title":"Understanding Sybil groups in the wild","volume":"30","author":"Jiang","year":"2015","journal-title":"J. Comput. Sci. Tech."},{"issue":"6","key":"10.1016\/j.comnet.2026.112521_b14","doi-asserted-by":"crossref","first-page":"976","DOI":"10.1109\/TIFS.2014.2316975","article-title":"SybilBelief: A semi-supervised learning approach for structure-based Sybil detection","volume":"9","author":"Gong","year":"2014","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"10.1016\/j.comnet.2026.112521_b15","series-title":"2017 IEEE Conference on Computer Communications, INFOCOM 2017, Atlanta, GA, USA, May 1-4, 2017","first-page":"1","article-title":"SybilSCAR: Sybil detection in online social networks via local rule based propagation","author":"Wang","year":"2017"},{"issue":"2","key":"10.1016\/j.comnet.2026.112521_b16","doi-asserted-by":"crossref","first-page":"1213","DOI":"10.1109\/TDSC.2022.3151701","article-title":"Enhancing Sybil detection via social-activity networks: A random walk approach","volume":"20","author":"Zhang","year":"2023","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"10.1016\/j.comnet.2026.112521_b17","doi-asserted-by":"crossref","first-page":"295","DOI":"10.1016\/j.neucom.2021.07.106","article-title":"SybilHunter: Hybrid graph-based sybil detection by aggregating user behaviors","volume":"500","author":"Mao","year":"2022","journal-title":"Neurocomputing"},{"key":"10.1016\/j.comnet.2026.112521_b18","series-title":"Privacy Enhancing Technologies - 14th International Symposium, PETS 2014, Amsterdam, the Netherlands, July 16-18, 2014. Proceedings","first-page":"304","article-title":"Spoiled onions: Exposing malicious tor exit relays","volume":"vol. 8555","author":"Winter","year":"2014"},{"key":"10.1016\/j.comnet.2026.112521_b19","series-title":"2016 IEEE Conference on Communications and Network Security, CNS 2016, Philadelphia, PA, USA, October 17-19, 2016","first-page":"127","article-title":"Honey onions: A framework for characterizing and identifying misbehaving tor HSDirs","author":"Sanatinia","year":"2016"},{"key":"10.1016\/j.comnet.2026.112521_b20","series-title":"9th ACM Symposium on Information, Computer and Communications Security, ASIA CCS \u201914, Kyoto, Japan - June 03 - 06, 2014","first-page":"63","article-title":"Re3: relay reliability reputation for anonymity systems","author":"Das","year":"2014"},{"key":"10.1016\/j.comnet.2026.112521_b21","series-title":"Proceedings of the Twelfth International World Wide Web Conference, WWW 2003, Budapest, Hungary, May 20-24, 2003","first-page":"640","article-title":"The Eigentrust algorithm for reputation management in P2P networks","author":"Kamvar","year":"2003"},{"key":"10.1016\/j.comnet.2026.112521_b22","first-page":"1","article-title":"Reasoning techniques meet GraphRAG: Advancing LLM for wireless network cyber defense","author":"Tian","year":"2026","journal-title":"IEEE Wirel. Commun."},{"key":"10.1016\/j.comnet.2026.112521_b23","series-title":"Proceedings of the Eighteenth International Conference on Machine Learning (ICML 2001), Williams College, Williamstown, MA, USA, June 28 - July 1, 2001","first-page":"577","article-title":"Constrained K-means clustering with background knowledge","author":"Wagstaff","year":"2001"},{"key":"10.1016\/j.comnet.2026.112521_b24","series-title":"Proceedings of the Tenth ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Seattle, Washington, USA, August 22-25, 2004","first-page":"59","article-title":"A probabilistic framework for semi-supervised clustering","author":"Basu","year":"2004"},{"issue":"2","key":"10.1016\/j.comnet.2026.112521_b25","doi-asserted-by":"crossref","first-page":"257","DOI":"10.1007\/s10618-008-0103-4","article-title":"Using instance-level constraints in agglomerative hierarchical clustering: theoretical and empirical results","volume":"18","author":"Davidson","year":"2009","journal-title":"Data Min. Knowl. Discov."},{"key":"10.1016\/j.comnet.2026.112521_b26","series-title":"Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS 2018, Toronto, on, Canada, October 15-19, 2018","first-page":"1962","article-title":"DeepCorr: Strong flow correlation attacks on tor using deep learning","author":"Nasr","year":"2018"},{"key":"10.1016\/j.comnet.2026.112521_b27","series-title":"Proceedings of the Network and Distributed System Security Symposium, NDSS 2011, San Diego, California, USA, 6th February - 9th February 2011","article-title":"SWIRL: A scalable watermark to detect correlated network flows","author":"Houmansadr","year":"2011"},{"key":"10.1016\/j.comnet.2026.112521_b28","series-title":"28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019","first-page":"1823","article-title":"Point break: A study of bandwidth denial-of-service attacks against tor","author":"Jansen","year":"2019"},{"key":"10.1016\/j.comnet.2026.112521_b29","series-title":"TorMult: Introducing a novel tor bandwidth inflation attack","author":"Sendner","year":"2023"},{"key":"10.1016\/j.comnet.2026.112521_b30","series-title":"31st Annual Network and Distributed System Security Symposium, NDSS 2024, San Diego, California, USA, February 26 - March 1, 2024","article-title":"MirageFlow: A new bandwidth inflation attack on tor","author":"Sendner","year":"2024"},{"key":"10.1016\/j.comnet.2026.112521_b31","series-title":"Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS 2018, Toronto, on, Canada, October 15-19, 2018","first-page":"1977","article-title":"Measuring information leakage in website fingerprinting attacks and defenses","author":"Li","year":"2018"},{"key":"10.1016\/j.comnet.2026.112521_b32","series-title":"25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018","article-title":"Inside job: Applying traffic analysis to measure tor from within","author":"Jansen","year":"2018"},{"issue":"4","key":"10.1016\/j.comnet.2026.112521_b33","first-page":"276","article-title":"Data-plane defenses against routing attacks on tor","volume":"2016","author":"Tan","year":"2016","journal-title":"Proc. Priv. Enhancing Technol."},{"key":"10.1016\/j.comnet.2026.112521_b34","series-title":"21st Annual Network and Distributed System Security Symposium, NDSS 2014, San Diego, California, USA, February 23-26, 2014","article-title":"The sniper attack: Anonymously deanonymizing and disabling the tor network","author":"Jansen","year":"2014"},{"issue":"4","key":"10.1016\/j.comnet.2026.112521_b35","first-page":"272","article-title":"Guard placement attacks on path selection algorithms for tor","volume":"2019","author":"Wan","year":"2019","journal-title":"Proc. Priv. Enhancing Technol."},{"key":"10.1016\/j.comnet.2026.112521_b36","series-title":"2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017","first-page":"977","article-title":"Counter-RAPTOR: Safeguarding tor against active routing attacks","author":"Sun","year":"2017"},{"issue":"3","key":"10.1016\/j.comnet.2026.112521_b37","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1145\/956993.956995","article-title":"PlanetLab: an overlay testbed for broad-coverage services","volume":"33","author":"Chun","year":"2003","journal-title":"Comput. Commun. Rev."},{"issue":"3","key":"10.1016\/j.comnet.2026.112521_b38","doi-asserted-by":"crossref","first-page":"53","DOI":"10.1145\/1823844.1823853","article-title":"Measurement lab: overview and an invitation to the research community","volume":"40","author":"Dovrolis","year":"2010","journal-title":"Comput. Commun. Rev."},{"key":"10.1016\/j.comnet.2026.112521_b39","series-title":"2nd USENIX Workshop on Free and Open Communications on the Internet, FOCI \u201912, Bellevue, WA, USA, August 6, 2012","article-title":"OONI: open observatory of network interference","author":"Filast\u00f2","year":"2012"},{"key":"10.1016\/j.comnet.2026.112521_b40","series-title":"2013 IEEE Symposium on Security and Privacy, SP 2013, Berkeley, CA, USA, May 19-22, 2013","first-page":"80","article-title":"Trawling for tor hidden services: Detection, measurement, deanonymization","author":"Biryukov","year":"2013"},{"issue":"Supplement","key":"10.1016\/j.comnet.2026.112521_b41","article-title":"Monitoring an anonymity network: Toward the deanonymization of hidden services","volume":"38","author":"Simioni","year":"2021","journal-title":"Digit. Investig."},{"key":"10.1016\/j.comnet.2026.112521_b42","series-title":"Proceedings of the Internet Measurement Conference 2018, IMC 2018, Boston, MA, USA, October 31 - November 02, 2018","first-page":"478","article-title":"A long way to the top: Significance, structure, and stability of internet top lists","author":"Scheitle","year":"2018"},{"issue":"1","key":"10.1016\/j.comnet.2026.112521_b43","first-page":"42","article-title":"Topics of controversy: An empirical analysis of web censorship lists","volume":"2017","author":"Weinberg","year":"2017","journal-title":"Proc. Priv. Enhancing Technol."},{"issue":"1","key":"10.1016\/j.comnet.2026.112521_b44","doi-asserted-by":"crossref","first-page":"155","DOI":"10.1017\/S1351324916000334","article-title":"Word2Vec","volume":"23","author":"Church","year":"2017","journal-title":"Nat. Lang. Eng."},{"key":"10.1016\/j.comnet.2026.112521_b45","series-title":"Rejected fingerprints found in attacks","author":"Koppen","year":"2025"},{"key":"10.1016\/j.comnet.2026.112521_b46","series-title":"Criteria for rejecting bad relays","author":"Dingledine","year":"2024"},{"key":"10.1016\/j.comnet.2026.112521_b47","doi-asserted-by":"crossref","DOI":"10.1016\/j.jnca.2022.103510","article-title":"RVC: A reputation and voting based blockchain consensus mechanism for edge computing-enabled IoT systems","volume":"209","author":"Liao","year":"2023","journal-title":"J. Netw. Comput. Appl."},{"key":"10.1016\/j.comnet.2026.112521_b48","doi-asserted-by":"crossref","DOI":"10.1016\/j.engappai.2022.105670","article-title":"RepuTE: A soft voting ensemble learning framework for reputation-based attack detection in fog-IoT milieu","volume":"118","author":"Verma","year":"2023","journal-title":"Eng. Appl. Artif. Intell."},{"issue":"1\u20134","key":"10.1016\/j.comnet.2026.112521_b49","first-page":"6:1","article-title":"A simulation software for the evaluation of vulnerabilities in reputation management systems","volume":"37","author":"Agate","year":"2019","journal-title":"ACM Trans. Comput. Syst."},{"issue":"1","key":"10.1016\/j.comnet.2026.112521_b50","doi-asserted-by":"crossref","first-page":"727","DOI":"10.1007\/s11831-022-09815-7","article-title":"A review on Kalman filter models","volume":"30","author":"Khodarahmi","year":"2023","journal-title":"Arch. Comput. Methods Eng."}],"container-title":["Computer Networks"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128626005335?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S1389128626005335?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,8,10]],"date-time":"2026-08-10T15:24:33Z","timestamp":1786375473000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S1389128626005335"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9]]},"references-count":50,"alternative-id":["S1389128626005335"],"URL":"https:\/\/doi.org\/10.1016\/j.comnet.2026.112521","relation":{},"ISSN":["1389-1286"],"issn-type":[{"value":"1389-1286","type":"print"}],"subject":[],"published":{"date-parts":[[2026,9]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"Uncovering malicious sybil structures in Tor: A hybrid approach of constraint clustering and dynamic scoring","name":"articletitle","label":"Article Title"},{"value":"Computer Networks","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.comnet.2026.112521","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 Elsevier B.V. All rights are reserved, including those for text and data mining, AI training, and similar technologies.","name":"copyright","label":"Copyright"}],"article-number":"112521"}}