{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,16]],"date-time":"2026-07-16T12:37:24Z","timestamp":1784205444938,"version":"3.55.0"},"reference-count":56,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"5","license":[{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U2436208"],"award-info":[{"award-number":["U2436208"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372129"],"award-info":[{"award-number":["62372129"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Guangdong S&T Program","award":["2024B0101010002"],"award-info":[{"award-number":["2024B0101010002"]}]},{"name":"Project of Guangdong Key Laboratory of Industrial Control System Security","award":["2024B1212020010"],"award-info":[{"award-number":["2024B1212020010"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Netw."],"published-print":{"date-parts":[[2025,10]]},"DOI":"10.1109\/ton.2025.3566903","type":"journal-article","created":{"date-parts":[[2025,6,10]],"date-time":"2025-06-10T13:50:25Z","timestamp":1749563425000},"page":"2319-2335","source":"Crossref","is-referenced-by-count":2,"title":["Your Botnet Is His Botnet? A Deep Dive Into the Supply Chain Attack Against Cyber-Arm Industry"],"prefix":"10.1109","volume":"33","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8674-6716","authenticated-orcid":false,"given":"Chaochao","family":"Luo","sequence":"first","affiliation":[{"name":"ADLab of Venustech, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jie","family":"Gan","sequence":"additional","affiliation":[{"name":"ADLab of Venustech, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xinli","family":"Li","sequence":"additional","affiliation":[{"name":"ADLab of Venustech, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhuting","family":"Pan","sequence":"additional","affiliation":[{"name":"ADLab of Venustech, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4418-0114","authenticated-orcid":false,"given":"Jian","family":"Tang","sequence":"additional","affiliation":[{"name":"Midea Group, Shanghai, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9409-5359","authenticated-orcid":false,"given":"Zhihong","family":"Tian","sequence":"additional","affiliation":[{"name":"Cyberspace Institute of Advanced Technology and Huangpu Research School, Guangzhou University, Guangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Epidemic Modeling: An Introduction","author":"Daley","year":"1999"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.7249\/RR610"},{"key":"ref3","first-page":"1009","article-title":"Plug and prey? Measuring the commoditization of cybercrime via online anonymous markets","volume-title":"Proc. 27th USENIX Secur. Symp. (USENIX Secur.)","author":"Van"},{"key":"ref4","first-page":"33","article-title":"Measuring the longitudinal evolution of the online anonymous marketplace ecosystem","volume-title":"Proc. 24th USENIX Secur. Symp. (USENIX Secur.)","author":"Soska"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3199674"},{"key":"ref6","volume-title":"The Attacker Behind \u2019Death\u2019 Botnet","year":"2023"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382283"},{"key":"ref8","first-page":"1","article-title":"Measuring pay-per-install: The commoditization of malware distribution","volume-title":"Proc. 20th USENIX Secur. Symp. (USENIX Secur.)","author":"Caballero"},{"key":"ref9","volume-title":"Whos-Hacking-the-Hackers-no-Honor-Among-Thieves","year":"2023"},{"key":"ref10","first-page":"1","article-title":"The Legitimate vulnerability market: The secretive world of 0-day exploit sales","volume-title":"Proc. WEIS","author":"Miller"},{"key":"ref11","volume-title":"Reveal the Attack Behind \u2019Billgates\u2019 Botnet","year":"2023"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TETC.2015.2397395"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2831667"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.23055"},{"key":"ref15","volume-title":"Postmortem for Malicious Packages","year":"2018"},{"key":"ref16","volume-title":"Malicious Remote Code Execution Backdoor Discovered in the Popular Bootstrap-sass Ruby Gem","author":"Tal","year":"2022"},{"key":"ref17","volume-title":"Malware Found in the Ubuntu Snap Store","year":"2022"},{"key":"ref18","volume-title":"Malware Found in Arch Linux Aur Package Repository","author":"Cimpanu","year":"2022"},{"key":"ref19","first-page":"995","article-title":"Small world with high risks: A study of security threats in the npm ecosystem","volume-title":"Proc. 28th USENIX Secur. Symp.","author":"Zimmermann"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2898817"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/icccn.2004.1401716"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/LCOMM.2016.2637367"},{"key":"ref23","first-page":"2","article-title":"Modeling botnet propagation using time zones","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp. (NDSS)","volume":"6","author":"Dagon"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2007.909678"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2016.2594130"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1103\/PhysRevLett.86.3200"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1103\/PhysRevE.65.035108"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2016.2581305"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/s00285-010-0344-x"},{"key":"ref30","first-page":"1","article-title":"My botnet is bigger than yours (maybe, better than yours): Why size estimates remain challenging","volume-title":"Proc. 1st USENIX Workshop Hot Topics Understanding Botnets","author":"Fabian"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/1402958.1402979"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653738"},{"key":"ref33","first-page":"1","article-title":"The heisenbot uncertainty problem: Challenges in separating bots from chaff","volume":"8","author":"Kanich","year":"2008","journal-title":"J. LEET"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1016\/S1361-3723(13)70053-8"},{"key":"ref35","first-page":"1","article-title":"Darknet and black market activities against the cybersecurity: A survey","volume-title":"Proc. Midwest Instruct. Comput. Symp. (MICS)","author":"Akintaro"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1093\/oxfordjournals.oep.a040951"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1016\/s1568-4997(08)x0004-6"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.7146\/math.scand.a-10436"},{"key":"ref39","article-title":"Economic supply & demand","author":"Whelan","year":"2001"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/CCST.2019.8888409"},{"key":"ref41","volume-title":"Github Mushorg\/Glutton","year":"2022"},{"key":"ref42","volume-title":"GitHub-Cowrie\/Cowrie: Cowrie SSH\/Telnet Honeypot","author":"Michel","year":"2022"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107138"},{"key":"ref44","volume-title":"IDAPro-Multi-processor Disassembler and Debugger","year":"2023"},{"key":"ref45","volume-title":"OllyDbg","year":"2023"},{"key":"ref46","volume-title":"BinDiff","year":"2023"},{"key":"ref47","volume-title":"EDB- Edb-debugger","year":"2023"},{"key":"ref48","volume-title":"PEiD","year":"2023"},{"key":"ref49","volume-title":"ImpREC","year":"2023"},{"key":"ref50","volume-title":"Nouvelles M\u00e9thodes Pour La D\u00e9termination Des Orbites Des Com\u00e9tes; Par AM Legendre","author":"Legendre","year":"1806"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2015.2404803"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2019.2938778"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3374749"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1002\/asmb.2276"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.2307\/3212106"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1287\/mnsc.15.5.215"}],"container-title":["IEEE Transactions on Networking"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10723154\/11205918\/11029499.pdf?arnumber=11029499","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,17]],"date-time":"2025-10-17T04:34:06Z","timestamp":1760675646000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11029499\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10]]},"references-count":56,"journal-issue":{"issue":"5"},"URL":"https:\/\/doi.org\/10.1109\/ton.2025.3566903","relation":{},"ISSN":["2998-4157"],"issn-type":[{"value":"2998-4157","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10]]}}}