{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,3]],"date-time":"2026-09-03T15:34:33Z","timestamp":1788449673307,"version":"build-2803163510"},"reference-count":50,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"1","license":[{"start":{"date-parts":[[2020,3,1]],"date-time":"2020-03-01T00:00:00Z","timestamp":1583020800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2020,3,1]],"date-time":"2020-03-01T00:00:00Z","timestamp":1583020800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2020,3,1]],"date-time":"2020-03-01T00:00:00Z","timestamp":1583020800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100012395","name":"Royal Bank of Canada","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100012395","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002790","name":"Canadian Network for Research and Innovation in Machining Technology, Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"publisher","award":["530335"],"award-info":[{"award-number":["530335"]}],"id":[{"id":"10.13039\/501100002790","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Netw. Serv. Manage."],"published-print":{"date-parts":[[2020,3]]},"DOI":"10.1109\/tnsm.2020.2972405","type":"journal-article","created":{"date-parts":[[2020,2,7]],"date-time":"2020-02-07T15:58:25Z","timestamp":1581091105000},"page":"15-29","source":"Crossref","is-referenced-by-count":68,"title":["BotChase: Graph-Based Bot Detection Using Machine Learning"],"prefix":"10.1109","volume":"17","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4994-8559","authenticated-orcid":false,"given":"Abbas Abou","family":"Daya","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5431-3278","authenticated-orcid":false,"given":"Mohammad A.","family":"Salahuddin","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7759-3751","authenticated-orcid":false,"given":"Noura","family":"Limam","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7936-6862","authenticated-orcid":false,"given":"Raouf","family":"Boutaba","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1186\/s40537-017-0074-7"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/DESEC.2017.8073832"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/2339530.2339723"},{"key":"ref32","first-page":"1","article-title":"Entelecheia: Detecting P2P botnets in their waiting stage","author":"hang","year":"2013","journal-title":"Proc IEEE\/IFIP Netw"},{"key":"ref31","first-page":"1","article-title":"BotCloud: Detecting botnets using MapReduce","author":"fran\u00e7ois","year":"2011","journal-title":"Proc IEEE Int Workshop Inf Forensics Security"},{"key":"ref30","first-page":"95","article-title":"BotGrep: Finding P2P bots with structured graph analysis","volume":"10","author":"nagaraja","year":"2010","journal-title":"Proc Usenix Security"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/SSCI.2016.7850078"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1002\/sec.500"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-20757-0_1"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/2339530.2339670"},{"key":"ref28","first-page":"1093","article-title":"Understanding the mirai botnet","author":"antonakakis","year":"2017","journal-title":"Proc Usenix Security"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.04.007"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-74320-0_15"},{"key":"ref2","first-page":"80","article-title":"Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains","volume":"1","author":"hutchins","year":"2011","journal-title":"Inf Warfare Security Res"},{"key":"ref1","first-page":"13","article-title":"Measuring pay-per-install: The commoditization of malware distribution","author":"caballero","year":"2011","journal-title":"Proc Usenix Security"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/ccnc08.2007.112"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/ICNIT.2010.5508552"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/CNSR.2009.21"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2011.5958212"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/PST.2011.5971980"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2011.07.018"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2010.04.007"},{"key":"ref50","first-page":"1601","article-title":"MOA: Massive online analysis","volume":"11","author":"bifet","year":"2010","journal-title":"J Mach Learn Res"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-03915-7_22"},{"key":"ref11","first-page":"144","article-title":"A graph-based machine learning approach for bot detection","author":"daya","year":"2019","journal-title":"Proc IFIP\/IEEE Symp Integr Netw Manage (IM)"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2881657"},{"key":"ref12","first-page":"8","article-title":"Rishi: Identify bot contaminated hosts by IRC nickname evaluation","volume":"7","author":"goebel","year":"2007","journal-title":"Proc of HotBots"},{"key":"ref13","first-page":"49","article-title":"Revealing botnet membership using DNSBL counter-intelligence","volume":"6","author":"ramachandran","year":"2006","journal-title":"Proceedings of the Steps to Reducing Unwanted Traffic on the Internet Workshop"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/PST.2018.8514165"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.091213.00134"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(98)00017-6"},{"key":"ref17","first-page":"7","article-title":"An algorithm for anomaly-based botnet detection","volume":"6","author":"binkley","year":"2006","journal-title":"Proceedings of the Steps to Reducing Unwanted Traffic on the Internet Workshop"},{"key":"ref18","first-page":"7","article-title":"Wide-scale botnet detection and characterization","volume":"7","author":"karasaridis","year":"2007","journal-title":"Proc of HotBots"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-68768-1_1"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2013.13"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1186\/s13174-018-0087-2"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/2133360.2133364"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/s11416-015-0250-2"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.05.011"},{"key":"ref7","first-page":"139","article-title":"BotMiner: Clustering analysis of network traffic for protocol-and structure-independent botnet detection","author":"gu","year":"2008","journal-title":"Proc Usenix Security"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1007\/BF00116251"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/CSNET.2017.8241990"},{"key":"ref46","author":"li","year":"2016","journal-title":"Statistical Machine Intelligence and Learning Engine"},{"key":"ref45","author":"naveh","year":"2013","journal-title":"JGraph"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/MCOM.2018.1700560"},{"key":"ref47","author":"heaton","year":"2013","journal-title":"Encog Machine Learning Framework"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3229607.3229612"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1016\/j.swevo.2017.09.008"},{"key":"ref44","author":"dockter","year":"2007","journal-title":"Gradle Build Tool"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1080\/0022250X.2001.9990249"}],"container-title":["IEEE Transactions on Network and Service Management"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/4275028\/9032249\/08986547.pdf?arnumber=8986547","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,4,27]],"date-time":"2022-04-27T13:05:01Z","timestamp":1651064701000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/8986547\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,3]]},"references-count":50,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.1109\/tnsm.2020.2972405","relation":{},"ISSN":["1932-4537","2373-7379"],"issn-type":[{"value":"1932-4537","type":"electronic"},{"value":"2373-7379","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,3]]}}}