{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,12]],"date-time":"2026-05-12T01:45:14Z","timestamp":1778550314855,"version":"3.51.4"},"reference-count":43,"publisher":"SAGE Publications","issue":"3","license":[{"start":{"date-parts":[[2022,3,1]],"date-time":"2022-03-01T00:00:00Z","timestamp":1646092800000},"content-version":"unspecified","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61902021"],"award-info":[{"award-number":["61902021"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100004826","name":"Natural Science Foundation of Beijing Municipality","doi-asserted-by":"publisher","award":["4212008"],"award-info":[{"award-number":["4212008"]}],"id":[{"id":"10.13039\/501100004826","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Project of Civil aviation safety capacity","award":["PESA2019074"],"award-info":[{"award-number":["PESA2019074"]}]},{"DOI":"10.13039\/501100012226","name":"fundamental research funds for the central universities","doi-asserted-by":"publisher","award":["3122018C036"],"award-info":[{"award-number":["3122018C036"]}],"id":[{"id":"10.13039\/501100012226","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Open Foundation of State key Laboratory of Networking and Switching Technology","award":["SKLNST-2019-2-08"],"award-info":[{"award-number":["SKLNST-2019-2-08"]}]}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["International Journal of Distributed Sensor Networks"],"published-print":{"date-parts":[[2022,3]]},"abstract":"<jats:p> In smart systems, attackers can use botnets to launch different cyber attack activities against the Internet of Things. The traditional methods of detecting botnets commonly used machine learning algorithms, and it is difficult to detect and control botnets in a network because of unbalanced traffic data. In this article, we present a novel and highly efficient botnet detection method based on an autoencoder neural network in cooperation with decision trees on a given network. The deep flow inspection method and statistical analysis are first applied as a feature selection technique to select relevant features, which are used to characterize the communication-related behavior between network nodes. Then, the autoencoder neural network for feature selection is used to improve the efficiency of model construction. Finally, Tomek-Recursion Borderline Synthetic Minority Oversampling Technique generates additional minority samples to achieve class balance, and an improved gradient boosting decision tree algorithm is used to train and establish an abnormal traffic detection model to improve the detection of unbalanced botnet data. The results of experiments on the ISCX-botnet traffic dataset show that the proposed method achieved better botnet detection performance with 99.10% recall, 99.20% accuracy, 99.1% F1 score, and 99.0% area under the curve. <\/jats:p>","DOI":"10.1177\/15501477211049910","type":"journal-article","created":{"date-parts":[[2022,3,15]],"date-time":"2022-03-15T10:57:26Z","timestamp":1647341846000},"page":"155014772110499","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":24,"title":["A novel and highly efficient botnet detection algorithm based on network traffic analysis of smart systems"],"prefix":"10.1177","volume":"18","author":[{"given":"Li","family":"Duan","sequence":"first","affiliation":[{"name":"Beijing Key Laboratory of Security and Privacy in Intelligent Transportation, Beijing Jiaotong University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jingxian","family":"Zhou","sequence":"additional","affiliation":[{"name":"Information Security Evaluation Center, Civil Aviation University of China, Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"You","family":"Wu","sequence":"additional","affiliation":[{"name":"Sino-European Institute of Aviation Engineering, Civil Aviation University of China, Tianjin, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wenyao","family":"Xu","sequence":"additional","affiliation":[{"name":"Beijing Key Laboratory of Security and Privacy in Intelligent Transportation, Beijing Jiaotong University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2022,3,15]]},"reference":[{"key":"bibr1-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1007\/s40747-021-00281-5."},{"key":"bibr2-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2960412"},{"key":"bibr3-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1007\/s11235-019-00599-z"},{"key":"bibr4-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2012.05.013"},{"key":"bibr5-15501477211049910","unstructured":"FireHOL. All cybercrime IP feeds, http:\/\/iplists.firehol.org (accessed 15 December 2020)."},{"key":"bibr6-15501477211049910","unstructured":"Proofpoint. Emerging threats open snort ruleset, http:\/\/www.emergingthreats.net\/ (accessed 15 December 2020)."},{"key":"bibr7-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-016-2564-5"},{"key":"bibr8-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.2016.1500116NM"},{"key":"bibr9-15501477211049910","first-page":"1","volume-title":"International conference on computer, information and telecommunication systems (CITS)","author":"Kudo T"},{"key":"bibr10-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2019.10.018"},{"key":"bibr11-15501477211049910","first-page":"300","volume-title":"Proceedings of the ninth annual international conference on privacy, security and trust","author":"Saad S"},{"key":"bibr12-15501477211049910","first-page":"5010","volume-title":"International conference on multimedia technology","author":"Yin C"},{"key":"bibr13-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2008.239"},{"key":"bibr14-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1007\/s13369-018-3319-7"},{"key":"bibr15-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-018-3595-x"},{"key":"bibr16-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1002\/nem.1977"},{"key":"bibr17-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1002\/nem.1867"},{"key":"bibr18-15501477211049910","first-page":"797","volume-title":"International conference on computing, networking and communications (ICNC)","author":"Stevanovic M"},{"key":"bibr19-15501477211049910","first-page":"1","volume":"1","author":"Chen R","year":"2017","journal-title":"Math Probl Eng"},{"key":"bibr20-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1016\/j.compeleceng.2016.01.012"},{"key":"bibr21-15501477211049910","first-page":"57","volume-title":"Proceedings of the fifth international conference on digital telecommunications (ICDT)","author":"Nogueira A"},{"key":"bibr22-15501477211049910","first-page":"14","volume-title":"Proceedings of the fourth international conference on internet monitoring and protection (ICIMP)","author":"Salvador P"},{"key":"bibr23-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-012-1263-0"},{"key":"bibr24-15501477211049910","first-page":"967","volume-title":"2006 31st IEEE conference on local computer networks","author":"Livadas C"},{"key":"bibr25-15501477211049910","first-page":"31","volume-title":"Proceedings of the 2019 3rd international conference on compute and data analysis","author":"McKay R"},{"key":"bibr26-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-30577-2_36"},{"issue":"12","key":"bibr27-15501477211049910","first-page":"3371","volume":"11","author":"Vincent P","year":"2010","journal-title":"J Mach Learn Res"},{"key":"bibr28-15501477211049910","first-page":"1135","volume-title":"Proceedings of international conference on computational intelligence and security (CIS)","author":"Ding L"},{"key":"bibr29-15501477211049910","first-page":"1589","volume-title":"IEEE international conference on computer vision (ICCV\u201905) volume 1","author":"Tu Z"},{"key":"bibr30-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1016\/j.measurement.2020.108013"},{"key":"bibr31-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2019.01.010"},{"key":"bibr32-15501477211049910","first-page":"50","volume-title":"Proceedings of the 2005 ACM SIGMETRICS international conference on Measurement and modeling of computer systems","author":"Moore AW"},{"key":"bibr33-15501477211049910","first-page":"1","volume":"4","author":"Zhou C","year":"2018","journal-title":"Inform Techn"},{"key":"bibr34-15501477211049910","first-page":"8595","volume-title":"IEEE international conference on acoustics, speech and signal processing","author":"Le QV"},{"key":"bibr35-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-75197-7"},{"key":"bibr36-15501477211049910","volume-title":"Machine learning: a probabilistic perspective","author":"Murphy KP","year":"2012"},{"key":"bibr37-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.05.011"},{"key":"bibr38-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1007\/0-387-25465-X_40"},{"key":"bibr39-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2020.01.055"},{"issue":"1","key":"bibr40-15501477211049910","first-page":"1063","volume":"13","author":"Biau G","year":"2012","journal-title":"J Mach Learn Res"},{"key":"bibr41-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1007\/s10845-019-01504-w"},{"key":"bibr42-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1016\/j.ijforecast.2017.02.003"},{"key":"bibr43-15501477211049910","doi-asserted-by":"publisher","DOI":"10.1007\/s11063-018-9940-3"}],"container-title":["International Journal of Distributed Sensor Networks"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/15501477211049910","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/journals.sagepub.com\/doi\/full-xml\/10.1177\/15501477211049910","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/15501477211049910","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,3,15]],"date-time":"2022-03-15T10:58:04Z","timestamp":1647341884000},"score":1,"resource":{"primary":{"URL":"http:\/\/journals.sagepub.com\/doi\/10.1177\/15501477211049910"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,3]]},"references-count":43,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2022,3]]}},"alternative-id":["10.1177\/15501477211049910"],"URL":"https:\/\/doi.org\/10.1177\/15501477211049910","relation":{},"ISSN":["1550-1329","1550-1477"],"issn-type":[{"value":"1550-1329","type":"print"},{"value":"1550-1477","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,3]]}}}