{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,30]],"date-time":"2026-05-30T02:12:02Z","timestamp":1780107122028,"version":"3.54.0"},"reference-count":78,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2023YFB3106800"],"award-info":[{"award-number":["2023YFB3106800"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100010428","name":"Innovation and Technology Fund, Hong Kong, SAR","doi-asserted-by":"publisher","award":["GHP\/141\/22SZ"],"award-info":[{"award-number":["GHP\/141\/22SZ"]}],"id":[{"id":"10.13039\/501100010428","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172405"],"award-info":[{"award-number":["62172405"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Shenzhen Science and Technology Program","award":["SGDX20230116091244004"],"award-info":[{"award-number":["SGDX20230116091244004"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Netw."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/ton.2025.3602877","type":"journal-article","created":{"date-parts":[[2025,9,17]],"date-time":"2025-09-17T17:30:25Z","timestamp":1758130225000},"page":"562-577","source":"Crossref","is-referenced-by-count":1,"title":["TNT: A Large-Scale P2P Botnet Detection Framework via Communication Topology and Network Traffic"],"prefix":"10.1109","volume":"34","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1455-4330","authenticated-orcid":false,"given":"Ziming","family":"Zhao","sequence":"first","affiliation":[{"name":"School of Software Technology, Zhejiang University, Ningbxo, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2195-0799","authenticated-orcid":false,"given":"Zhaoxuan","family":"Li","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6589-3706","authenticated-orcid":false,"given":"Tingting","family":"Li","sequence":"additional","affiliation":[{"name":"School of Software Technology, Zhejiang University, Ningbxo, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhijian","family":"Xu","sequence":"additional","affiliation":[{"name":"The Chinese University of Hong Kong, Hong Kong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yu","family":"Li","sequence":"additional","affiliation":[{"name":"College of Integrated Circuits, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6747-126X","authenticated-orcid":false,"given":"Qiang","family":"Xu","sequence":"additional","affiliation":[{"name":"The Chinese University of Hong Kong, Hong Kong, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6087-8243","authenticated-orcid":false,"given":"Fan","family":"Zhang","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484581"},{"key":"ref2","first-page":"1","article-title":"Juice: A longitudinal study of an SEO Botnet","volume-title":"Proc. NDSS","author":"Wang"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.5555\/3277203.3277206"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/SECON64284.2024.10934888"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2881657"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM52122.2024.10621290"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2018.2874896"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103663"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2015.2496176"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3082290"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3672202.3673720"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3690624.3709315"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2024.3413789"},{"key":"ref14","first-page":"12","article-title":"BotHunter: Detecting malware infection through IDS-driven dialog correlation","volume-title":"Proc. USENIX Secur. Symp.","author":"Gu"},{"key":"ref15","first-page":"139","article-title":"BotMiner: Clustering analysis of network traffic for protocol{-} and structure-independent botnet detection","volume-title":"Proc. USENIX Secur. Symp.","author":"Gu"},{"key":"ref16","first-page":"1","article-title":"BotSniffer: Detecting botnet command and control channels in network traffic","volume-title":"Proc. NDSS","author":"Gu"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.5555\/3241189.3241275"},{"key":"ref18","first-page":"7","article-title":"BotGrep: Finding P2P bots with structured graph analysis","volume-title":"Proc. USENIX Secur. Symp.","author":"Nagaraja"},{"key":"ref19","article-title":"Automating botnet detection with graph neural networks","author":"Zhou","year":"2020","journal-title":"arXiv:2003.06344"},{"key":"ref20","first-page":"1","article-title":"Army of botnets","volume-title":"Proc. NDSS","author":"Vogt"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.17"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45748-8_5"},{"key":"ref23","first-page":"3505","article-title":"The circle of life: A large-scale study of the IoT malware lifecycle","volume-title":"Proc. USENIX Secur. Symp.","author":"Alrawi"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23488"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/JSAC.2025.3560045"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/GLOBECOM38437.2019.9013971"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/DESEC.2017.8073832"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1016\/j.iot.2023.100747"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1145\/1920261.1920283"},{"key":"ref30","first-page":"1","article-title":"Measurements and mitigation of peer-to-peer-based botnets: A case study on storm worm","volume-title":"Proc. LEET","author":"Holz"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/1177080.1177105"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2013.2290197"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2023.3245411"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3349180"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2015.7218396"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2771228"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645407"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24161"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2660362"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/2660267.2662369"},{"key":"ref41","first-page":"155","article-title":"Measurement and classification of humans and bots in internet chat","volume-title":"Proc. USENIX Secur. Symp.","author":"Gianvecchio"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3140549.3140552"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653737"},{"key":"ref44","first-page":"351","article-title":"Effective and efficient malware detection at the end host","volume-title":"Proc. USENIX Secur. Symp.","author":"Kolbitsch"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866355"},{"key":"ref46","first-page":"1","article-title":"Modeling botnet propagation using time Zones","volume-title":"Proc. NDSS","author":"Dagon"},{"key":"ref47","first-page":"1","article-title":"Semi-supervised classification with graph convolutional networks","volume-title":"Proc. ICLR","author":"Kipf"},{"key":"ref48","first-page":"1057","article-title":"Policy gradient methods for reinforcement learning with function approximation","volume-title":"Proc. NIPS","volume":"12","author":"Sutton"},{"key":"ref49","first-page":"1531","article-title":"A natural policy gradient","volume-title":"Proc. NIPS","volume":"14","author":"Kakade"},{"key":"ref50","first-page":"2132","article-title":"Attention-based deep multiple instance learning","volume-title":"Proc. ICML","author":"Ilse"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/P2P.2009.5284505"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/383059.383071"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2009.5199070"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2003.1208963"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/PTP.2004.1334944"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-45172-3_9"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/863955.864000"},{"key":"ref58","first-page":"3","article-title":"Towards automated detection of peer-to-peer botnets: On the limits of local approaches","volume-title":"Proc. LEET","author":"Jelasity"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.05.011"},{"key":"ref60","volume-title":"The Caida Ucsd Anonymized Internet Traces","year":"2018"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363281"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45748-8_8"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2007.900406"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/1071690.1064275"},{"key":"ref65","volume-title":"Botnet Dataset","year":"2014"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23204"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484585"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2022.3216603"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2023.3242134"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2023.3311012"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2019.8737507"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1145\/3485447.3512217"},{"key":"ref73","first-page":"3319","article-title":"Axiomatic attribution for deep networks","volume-title":"Proc. ICML","author":"Sundararajan"},{"key":"ref74","volume-title":"Model Interpretability for Pytorch","year":"2022"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1088\/1742-5468\/2008\/10\/P10008"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOM.2018.8647234"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3226572"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1155\/2022\/9900396"}],"container-title":["IEEE Transactions on Networking"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10723154\/11317935\/11168124.pdf?arnumber=11168124","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,12,31]],"date-time":"2025-12-31T18:43:04Z","timestamp":1767206584000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11168124\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":78,"URL":"https:\/\/doi.org\/10.1109\/ton.2025.3602877","relation":{},"ISSN":["2998-4157"],"issn-type":[{"value":"2998-4157","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}