{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,3]],"date-time":"2026-06-03T22:09:35Z","timestamp":1780524575613,"version":"3.54.1"},"reference-count":79,"publisher":"MDPI AG","issue":"1","license":[{"start":{"date-parts":[[2026,1,5]],"date-time":"2026-01-05T00:00:00Z","timestamp":1767571200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Science Committee of the Ministry of Science and Higher Education of the Republic of Kazakhstan","award":["AP26104787"],"award-info":[{"award-number":["AP26104787"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>Detecting botnets in IoT environments is difficult because most intrusion detection systems treat network events as independent observations. In practice, infections spread through device relationships and evolve through distinct temporal phases. A system that ignores either aspect will miss important patterns. This paper explores a hybrid architecture combining Graph Neural Networks with Long Short-Term Memory networks to capture both structural and temporal dynamics. The GNN component models behavioral similarity between traffic flows in feature space, while the LSTM tracks how patterns change as attacks progress. The two components are trained jointly so that relational context is preserved during temporal learning. We evaluated the approach on two datasets with different characteristics. N-BaIoT contains traffic from nine devices infected with Mirai and BASHLITE, while CICIoT2023 covers 105 devices across 33 attack types. On N-BaIoT, the model achieved 99.88% accuracy with F1 of 0.9988 and Brier score of 0.0015. Cross-validation on CICIoT2023 yielded 99.73% accuracy with Brier score of 0.0030. The low Brier scores suggest that probability outputs are reasonably well calibrated for risk-based decision making. Consistent performance across both datasets provides some evidence that the architecture generalizes beyond a single benchmark setting.<\/jats:p>","DOI":"10.3390\/computers15010026","type":"journal-article","created":{"date-parts":[[2026,1,5]],"date-time":"2026-01-05T13:35:47Z","timestamp":1767620147000},"page":"26","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["Hybrid GNN\u2013LSTM Architecture for Probabilistic IoT Botnet Detection with Calibrated Risk Assessment"],"prefix":"10.3390","volume":"15","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-1184-9483","authenticated-orcid":false,"given":"Tetiana","family":"Babenko","sequence":"first","affiliation":[{"name":"Department of Cybersecurity, International Information Technologies University, Almaty 050040, Kazakhstan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9160-5982","authenticated-orcid":false,"given":"Kateryna","family":"Kolesnikova","sequence":"additional","affiliation":[{"name":"Department of Information Systems, International Information Technologies University, Almaty 050040, Kazakhstan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8735-7683","authenticated-orcid":false,"given":"Yelena","family":"Bakhtiyarova","sequence":"additional","affiliation":[{"name":"Department of Radio Engineering, Electronics and Telecommunications, International Information Technologies University, Almaty 050040, Kazakhstan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Damelya","family":"Yeskendirova","sequence":"additional","affiliation":[{"name":"Department of Cybersecurity, International Information Technologies University, Almaty 050040, Kazakhstan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3333-5830","authenticated-orcid":false,"given":"Kanibek","family":"Sansyzbay","sequence":"additional","affiliation":[{"name":"Department of Radio Engineering, Electronics and Telecommunications, International Information Technologies University, Almaty 050040, Kazakhstan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Askar","family":"Sysoyev","sequence":"additional","affiliation":[{"name":"Department of Cybersecurity, International Information Technologies University, Almaty 050040, Kazakhstan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Oleksandr","family":"Kruchinin","sequence":"additional","affiliation":[{"name":"Department of Information Security and Telecommunications, Dnipro University of Technology, 49005 Dnipro, Ukraine"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2026,1,5]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"23","DOI":"10.1016\/j.clsr.2009.11.008","article-title":"Internet of Things\u2014New Security and Privacy Challenges","volume":"26","author":"Weber","year":"2010","journal-title":"Comput. Law Secur. Rev."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"10","DOI":"10.1016\/j.jnca.2017.04.002","article-title":"Internet of Things security: A survey","volume":"88","author":"Alaba","year":"2017","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"76","DOI":"10.1109\/MC.2017.62","article-title":"Botnets and Internet of Things Security","volume":"50","author":"Bertino","year":"2017","journal-title":"Computer"},{"key":"ref_4","unstructured":"Antonakakis, M., April, T., Bailey, M., Bernhard, M., Burber, E., Cochran, J., Durumeric, Z., Halderman, J.A., Invernizzi, L., and Kallitsis, M. (2017, January 16\u201318). Understanding the Mirai Botnet. Proceedings of the 26th USENIX Security Symposium, Vancouver, BC, Canada. Available online: https:\/\/www.semanticscholar.org\/paper\/220a7eed5c859f596a0d9dbc194034d170a6af51."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"80","DOI":"10.1109\/MC.2017.201","article-title":"DDoS in the IoT: Mirai and Other Botnets","volume":"50","author":"Kolias","year":"2017","journal-title":"Computer"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Miettinen, M., Marchal, S., Hafeez, I., Asokan, N., Sadeghi, A.R., and Tarkoma, S. (2017, January 5\u20138). IoT SENTINEL: Automated Device-Type Identification for Security Enforcement in IoT. Proceedings of the IEEE 37th International Conference on Distributed Computing Systems (ICDCS), Atlanta, GA, USA.","DOI":"10.1109\/ICDCS.2017.283"},{"key":"ref_7","unstructured":"Roesch, M. (1999, January 7\u201312). Snort: Lightweight Intrusion Detection for Networks. Proceedings of the 13th USENIX Conference on System Administration (LISA), Seattle, WA, USA."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/1541880.1541882","article-title":"Anomaly Detection: A Survey","volume":"41","author":"Chandola","year":"2009","journal-title":"ACM Comput. Surv."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"1153","DOI":"10.1109\/COMST.2015.2494502","article-title":"A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection","volume":"18","author":"Buczak","year":"2016","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"20","DOI":"10.1186\/s42400-019-0038-7","article-title":"Survey of Intrusion Detection Systems: Techniques, Datasets and Challenges","volume":"2","author":"Khraisat","year":"2019","journal-title":"Cybersecurity"},{"key":"ref_11","unstructured":"Kipf, T.N., and Welling, M. (2017, January 24\u201326). Semi-Supervised Classification with Graph Convolutional Networks. Proceedings of the 5th International Conference on Learning Representations (ICLR), Toulon, France. Available online: https:\/\/arxiv.org\/abs\/1609.02907."},{"key":"ref_12","unstructured":"Hamilton, W.L., Ying, R., and Leskovec, J. (2017, January 4\u20139). Inductive Representation Learning on Large Graphs. Proceedings of the 31st International Conference on Neural Information Processing Systems (NeurIPS), Long Beach, CA, USA. Available online: https:\/\/papers.nips.cc\/paper\/6703-inductive-representation-learning-on-large-graphs."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"9796912","DOI":"10.1155\/2023\/9796912","article-title":"Deep Graph Embedding for IoT Botnet Traffic Detection","volume":"2023","author":"Zhang","year":"2023","journal-title":"Secur. Commun. Netw."},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Bibi, I., \u00d6z\u00e7elebi, T., and Meratnia, N. (2023). An IoT Attack Detection Framework Leveraging Graph Neural Networks. Intelligence of Things: Technologies and Applications, Springer.","DOI":"10.1007\/978-3-031-46749-3_22"},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Saad, A.M.S.E. (2024). Leveraging Graph Neural Networks for Botnet Detection. Advanced Engineering, Technology and Applications, Springer.","DOI":"10.1007\/978-3-031-50920-9_11"},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Zhou, J., Xu, Z., Rush, A.M., and Yu, M. (2024). Efficient Large-Scale IoT Botnet Detection through GraphSAINT-Based Subgraph Sampling and Graph Isomorphism Network. Mathematics, 12.","DOI":"10.3390\/math12091315"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long Short-Term Memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Kim, J., Kim, J., Thu, H.L.T., and Kim, H. (2016, January 15\u201317). Long Short Term Memory Recurrent Neural Network Classifier for Intrusion Detection. Proceedings of the International Conference on Platform Technology and Service (PlatCon), Jeju, Republic of Korea.","DOI":"10.1109\/PlatCon.2016.7456805"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"5579851","DOI":"10.1155\/2021\/5579851","article-title":"An Intrusion Detection System to Advance Internet of Things Infrastructure Based on Deep Learning Algorithms","volume":"2021","author":"Alkahtani","year":"2021","journal-title":"Complexity"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"9684","DOI":"10.1038\/s41598-025-94500-5","article-title":"A High Performance Hybrid LSTM-CNN Secure Architecture for IoT Environments Using Deep Learning","volume":"15","author":"Sinha","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Sayegh, H.R., Dong, W., and Al-madani, A.M. (2024). Enhanced Intrusion Detection with LSTM-Based Model, Feature Selection, and SMOTE for Imbalanced Data. Appl. Sci., 14.","DOI":"10.3390\/app14020479"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"8468","DOI":"10.1109\/JIOT.2023.3298663","article-title":"A GNN-Based Adversarial Internet of Things Malware Detection Framework for Critical Infrastructure: Studying Gafgyt, Mirai and Tsunami Campaigns","volume":"11","author":"Esmaeili","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"699","DOI":"10.1109\/TIFS.2022.3228493","article-title":"Application of a Dynamic Line Graph Neural Network for Intrusion Detection with Semi-Supervised Learning","volume":"18","author":"Duan","year":"2023","journal-title":"IEEE Trans. Inf. Forensics Secur."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Vitulyova, Y., Babenko, T., Kolesnikova, K., Kiktev, N., and Abramkina, O. (2025). A Hybrid Approach Using Graph Neural Networks and LSTM for Attack Vector Reconstruction. Computers, 14.","DOI":"10.3390\/computers14080301"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Friji, H., Mavromatis, I., Sanchez-Mompo, A., Carnelli, P., Olivereau, A., and Khan, A. (2023, January 1\u20133). Multi-Stage Attack Detection and Prediction Using Graph Neural Networks: An IoT Feasibility Study. Proceedings of the IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), Exeter, UK.","DOI":"10.1109\/TrustCom60117.2023.00095"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1109\/MPRV.2018.03367731","article-title":"N-BaIoT: Network-Based Detection of IoT Botnet Attacks Using Deep Autoencoders","volume":"17","author":"Meidan","year":"2018","journal-title":"IEEE Pervasive Comput."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"1683","DOI":"10.5267\/j.ijdns.2023.7.021","article-title":"Botnet attacks detection in IoT environment using machine learning techniques","volume":"7","author":"Alshunaybir","year":"2023","journal-title":"Int. J. Data Netw. Sci."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Nour, M., Atya, A.O., Ghali, N.I., and El-Gazar, S.M. (2020). Intelligent Detection of IoT Botnets Using Machine Learning and Deep Learning. Appl. Sci., 10.","DOI":"10.3390\/app10197009"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"2809","DOI":"10.1007\/s12652-019-01387-y","article-title":"Unsupervised Intelligent System Based on One Class Support Vector Machine and Grey Wolf Optimization for IoT Botnet Detection","volume":"11","author":"Faris","year":"2020","journal-title":"J. Ambient Intell. Humaniz. Comput."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"105","DOI":"10.1186\/s40537-020-00379-6","article-title":"Performance Analysis of Intrusion Detection Systems Using a Feature Selection Method on the UNSW-NB15 Dataset","volume":"7","author":"Kasongo","year":"2020","journal-title":"J. Big Data"},{"key":"ref_31","unstructured":"Guo, C., Pleiss, G., Sun, Y., and Weinberger, K.Q. (2017, January 6\u201311). On Calibration of Modern Neural Networks. Proceedings of the 34th International Conference on Machine Learning (ICML), Sydney, Australia. Available online: https:\/\/dl.acm.org\/doi\/10.5555\/3305381.3305518."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1175\/1520-0493(1950)078<0001:VOFEIT>2.0.CO;2","article-title":"Verification of Forecasts Expressed in Terms of Probability","volume":"78","author":"Brier","year":"1950","journal-title":"Mon. Weather Rev."},{"key":"ref_33","doi-asserted-by":"crossref","unstructured":"Babenko, T., Kolesnikova, K., Abramkina, O., and Vitulyova, Y. (2025). Automated OSINT Techniques for Digital Asset Discovery and Cyber Risk Assessment. Computers, 14.","DOI":"10.3390\/computers14100430"},{"key":"ref_34","first-page":"1","article-title":"Environmental impact assessment procedure as the implementation of the value approach in environmental projects","volume":"Volume 2870","author":"Olekh","year":"2021","journal-title":"CEUR Workshop Proceedings"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Neto, E.C.P., Dadkhah, S., Ferber, R., Zohourian, A., Lu, R., and Ghorbani, A.A. (2023). CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment. Sensors, 23.","DOI":"10.20944\/preprints202305.0443.v1"},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Dadkhah, S., Mahdikhani, H., Danber, P.K., and Ghorbani, A.A. (2022, January 22\u201324). Towards the Development of a Realistic Multidimensional IoT Profiling Dataset. Proceedings of the 19th International Conference on Privacy, Security and Trust (PST), Fredericton, NB, Canada.","DOI":"10.1109\/PST55820.2022.9851966"},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Babenko, T., Toliupa, S., and Kovalova, Y. (2018, January 20\u201324). LVQ models of DDOS attacks identification. Proceedings of the 14th International Conference on Advanced Trends in Radioelectronics, Telecommunications and Computer Engineering (TCSET), Lviv-Slavske, Ukraine.","DOI":"10.1109\/TCSET.2018.8336253"},{"key":"ref_38","unstructured":"Hnatiienko, H., Hnatiienko, V., Zulunov, R., Babenko, T., and Myrutenko, L. (2024). Method for determining the level of criticality elements when ensuring the functional stability of the system based on role analysis of elements. CEUR Workshop Proceedings, CEUR-WS.org. Available online: https:\/\/ceur-ws.org\/."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Grechko, V., Babenko, T., and Myrutenko, L. (2019, January 8\u201311). Secure software developing recommendations. Proceedings of the 2019 IEEE International Scientific-Practical Conference: Problems of Infocommunications Science and Technology (PIC S&T), Kyiv, Ukraine.","DOI":"10.1109\/PICST47496.2019.9061529"},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Babenko, T., Kolesnikova, K., Panchenko, M., Meish, Y., and Mazurchuk, P. (2025). Risk assessment of cryptojacking attacks on endpoint systems: Threats to sustainable digital agriculture. Sustainability, 17.","DOI":"10.3390\/su17125426"},{"key":"ref_41","unstructured":"Paszke, A., Gross, S., Massa, F., Lerer, A., Bradbury, J., Chanan, G., Killeen, T., Lin, Z., Gimelshein, N., and Antiga, L. (2019, January 8\u201314). PyTorch: An Imperative Style, High-Performance Deep Learning Library. Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), Vancouver, BC, Canada. Available online: https:\/\/papers.neurips.cc\/paper\/9015-pytorch-an-imperative-style-high-performance-deep-learning-library.pdf."},{"key":"ref_42","unstructured":"Kingma, D.P., and Ba, J. (2015, January 7\u20139). Adam: A Method for Stochastic Optimization. Proceedings of the 3rd International Conference on Learning Representations (ICLR), San Diego, CA, USA. Available online: https:\/\/arxiv.org\/pdf\/1412.6980.pdf."},{"key":"ref_43","unstructured":"Raschka, S. (2018). Model Evaluation, Model Selection, and Algorithm Selection in Machine Learning. arXiv."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"4","DOI":"10.1109\/TNNLS.2020.2978386","article-title":"A Comprehensive Survey on Graph Neural Networks","volume":"32","author":"Wu","year":"2021","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_45","doi-asserted-by":"crossref","first-page":"186","DOI":"10.1145\/357830.357849","article-title":"The Base-Rate Fallacy and the Difficulty of Intrusion Detection","volume":"3","author":"Axelsson","year":"2000","journal-title":"ACM Trans. Inf. Syst. Secur."},{"key":"ref_46","doi-asserted-by":"crossref","first-page":"27","DOI":"10.1186\/s40537-019-0192-5","article-title":"Survey on Deep Learning with Class Imbalance","volume":"6","author":"Johnson","year":"2019","journal-title":"J. Big Data"},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Sommer, R., and Paxson, V. (2010, January 16\u201319). Outside the Closed World: On Using Machine Learning for Network Intrusion Detection. Proceedings of the IEEE Symposium on Security and Privacy (S&P), Oakland, CA, USA.","DOI":"10.1109\/SP.2010.25"},{"key":"ref_48","doi-asserted-by":"crossref","first-page":"29","DOI":"10.1148\/radiology.143.1.7063747","article-title":"The Meaning and Use of the Area under a Receiver Operating Characteristic (ROC) Curve","volume":"143","author":"Hanley","year":"1982","journal-title":"Radiology"},{"key":"ref_49","doi-asserted-by":"crossref","unstructured":"Zhang, L., Wang, Y., Wu, M., Wang, Y., and Zheng, Y. (2023, January 22\u201324). Network Intrusion Detection Based on Graph Neural Network and Ensemble Learning. Proceedings of the 2023 CAA Symposium on Fault Detection, Supervision and Safety for Technical Processes (SAFEPROCESS), Yibin, China.","DOI":"10.1109\/SAFEPROCESS58597.2023.10295926"},{"key":"ref_50","doi-asserted-by":"crossref","unstructured":"Davis, J., and Goadrich, M. (2006, January 25\u201329). The Relationship between Precision-Recall and ROC Curves. Proceedings of the 23rd International Conference on Machine Learning (ICML), Pittsburgh, PA, USA.","DOI":"10.1145\/1143844.1143874"},{"key":"ref_51","doi-asserted-by":"crossref","unstructured":"Qui\u00f1onero-Candela, J., Sugiyama, M., Schwaighofer, A., and Lawrence, N.D. (2009). Dataset Shift in Machine Learning, MIT Press.","DOI":"10.7551\/mitpress\/9780262170055.001.0001"},{"key":"ref_52","doi-asserted-by":"crossref","unstructured":"Gates, C., and Taylor, C. (2006, January 19\u201322). Challenging the Anomaly Detection Paradigm: A Provocative Discussion. Proceedings of the 15th New Security Paradigms Workshop (NSPW), Schloss Dagstuhl, Germany.","DOI":"10.1145\/1278940.1278945"},{"key":"ref_53","unstructured":"Xu, K., Hu, W., Leskovec, J., and Jegelka, S. (2019, January 6\u20139). How Powerful Are Graph Neural Networks?. Proceedings of the 7th International Conference on Learning Representations (ICLR), New Orleans, LA, USA. Available online: https:\/\/cs.stanford.edu\/people\/jure\/pubs\/gin-iclr19.pdf."},{"key":"ref_54","unstructured":"Flach, P. (February, January 27). Performance Evaluation in Machine Learning: The Good, the Bad, the Ugly, and the Way Forward. Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), Honolulu, HI, USA."},{"key":"ref_55","doi-asserted-by":"crossref","unstructured":"Niculescu-Mizil, A., and Caruana, R. (2005, January 7\u201311). Predicting Good Probabilities with Supervised Learning. Proceedings of the 22nd International Conference on Machine Learning (ICML), Bonn, Germany.","DOI":"10.1145\/1102351.1102430"},{"key":"ref_56","unstructured":"Bishop, C.M. (2006). Pattern Recognition and Machine Learning, Springer."},{"key":"ref_57","doi-asserted-by":"crossref","unstructured":"Pearl, J. (1988). Probabilistic Reasoning in Intelligent Systems: Networks of Plausible Inference, Morgan Kaufmann.","DOI":"10.1016\/B978-0-08-051489-5.50008-4"},{"key":"ref_58","doi-asserted-by":"crossref","first-page":"576","DOI":"10.1177\/154193128603000616","article-title":"Rapid Decision Making on the Fire Ground","volume":"30","author":"Klein","year":"1986","journal-title":"Proc. Hum. Factors Soc. Annu. Meet."},{"key":"ref_59","unstructured":"Hutchins, E.M., Cloppert, M.J., and Amin, R.M. (2011, January 17\u201318). Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. Proceedings of the 6th International Conference on Information Warfare and Security (ICIW), Washington, DC, USA. Available online: https:\/\/www.lockheedmartin.com\/content\/dam\/lockheed-martin\/rms\/documents\/cyber\/LM-White-Paper-Intel-Driven-Defense.pdf."},{"key":"ref_60","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep Learning","volume":"521","author":"LeCun","year":"2015","journal-title":"Nature"},{"key":"ref_61","unstructured":"Staniford, S., Paxson, V., and Weaver, N. (2002, January 5\u20139). How to Own the Internet in Your Spare Time. Proceedings of the 11th USENIX Security Symposium, San Francisco, CA, USA. Available online: https:\/\/www.usenix.org\/conference\/11th-usenix-security-symposium\/how-own-internet-your-spare-time."},{"key":"ref_62","unstructured":"Plohmann, D., Yakdan, K., Klatt, M., Bader, J., and Gerhards-Padilla, E. (2016, January 10\u201312). A Comprehensive Measurement Study of Domain Generating Malware. Proceedings of the 25th USENIX Security Symposium, Austin, TX, USA. Available online: https:\/\/www.usenix.org\/conference\/usenixsecurity16\/technical-sessions\/presentation\/plohmann."},{"key":"ref_63","doi-asserted-by":"crossref","unstructured":"Chen, T., and Guestrin, C. (2016, January 13\u201317). XGBoost: A Scalable Tree Boosting System. Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), San Francisco, CA, USA.","DOI":"10.1145\/2939672.2939785"},{"key":"ref_64","unstructured":"Masters, D., and Luschi, C. (2018). Revisiting Small Batch Training for Deep Neural Networks. arXiv."},{"key":"ref_65","unstructured":"Gal, Y., and Ghahramani, Z. (2016, January 19\u201324). Dropout as a Bayesian Approximation: Representing Model Uncertainty in Deep Learning. Proceedings of the 33rd International Conference on Machine Learning (ICML), New York, NY, USA. Available online: https:\/\/proceedings.mlr.press\/v48\/gal16.html."},{"key":"ref_66","unstructured":"Bottou, L., and Bousquet, O. (2007, January 3\u20136). The Tradeoffs of Large Scale Learning. Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), Vancouver, BC, Canada. Available online: https:\/\/proceedings.neurips.cc\/paper\/2007\/hash\/0d3180d672e08b4c5312dcdafdf6ef36-Abstract.html."},{"key":"ref_67","doi-asserted-by":"crossref","first-page":"438","DOI":"10.1145\/581271.581274","article-title":"The Economics of Information Security Investment","volume":"5","author":"Gordon","year":"2002","journal-title":"ACM Trans. Inf. Syst. Secur."},{"key":"ref_68","unstructured":"Anderson, R. (2001, January 10\u201314). Why Information Security Is Hard: An Economic Perspective. Proceedings of the 17th Annual Computer Security Applications Conference (ACSAC), New Orleans, LA, USA."},{"key":"ref_69","first-page":"107","article-title":"AMAL: High-Fidelity, Behavior-Based Automated Malware Analysis and Classification","volume":"Volume 9503","author":"Rhee","year":"2015","journal-title":"Information Security Applications (WISA 2014)"},{"key":"ref_70","doi-asserted-by":"crossref","first-page":"1345","DOI":"10.1109\/TKDE.2009.191","article-title":"A Survey on Transfer Learning","volume":"22","author":"Pan","year":"2010","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_71","doi-asserted-by":"crossref","first-page":"9","DOI":"10.1186\/s40537-016-0043-6","article-title":"A Survey of Transfer Learning","volume":"3","author":"Weiss","year":"2016","journal-title":"J. Big Data"},{"key":"ref_72","doi-asserted-by":"crossref","unstructured":"Z\u00fcgner, D., Akbarnejad, A., and G\u00fcnnemann, S. (2018, January 19\u201323). Adversarial Attacks on Neural Networks for Graph Data. Proceedings of the 24th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining (KDD), London, UK.","DOI":"10.1145\/3219819.3220078"},{"key":"ref_73","doi-asserted-by":"crossref","unstructured":"Carlini, N., and Wagner, D. (2017, January 22\u201324). Towards Evaluating the Robustness of Neural Networks. Proceedings of the IEEE Symposium on Security and Privacy (S&P), San Jose, CA, USA.","DOI":"10.1109\/SP.2017.49"},{"key":"ref_74","unstructured":"Ying, R., Bourgeois, D., You, J., Zitnik, M., and Leskovec, J. (2019, January 8\u201314). GNNExplainer: Generating Explanations for Graph Neural Networks. Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), Vancouver, BC, Canada. Available online: https:\/\/proceedings.neurips.cc\/paper\/2019\/hash\/d80b7040b773199015de6d3b4293c8ff-Abstract.html."},{"key":"ref_75","unstructured":"Chen, J., Ma, T., and Xiao, C. (May, January 30). FastGCN: Fast Learning with Graph Convolutional Networks via Importance Sampling. Proceedings of the 6th International Conference on Learning Representations (ICLR), Vancouver, BC, Canada. Available online: https:\/\/openreview.net\/forum?id=rytstxWAW."},{"key":"ref_76","doi-asserted-by":"crossref","unstructured":"Kerschbaumer, C., Braun, F., Friedberger, S., and J\u00fcrgens, M. (2025, January 27). The State of HTTPS Adoption on the Web. Proceedings of the 2025 Workshop on Measurements, Attacks, and Defenses for the Web (MADWeb), San Francisco, CA, USA.","DOI":"10.14722\/madweb.2025.23001"},{"key":"ref_77","doi-asserted-by":"crossref","unstructured":"Sherry, J., Lan, C., Popa, R.A., and Ratnasamy, S. (2015, January 17\u201321). BlindBox: Deep Packet Inspection over Encrypted Traffic. Proceedings of the ACM SIGCOMM Conference, London, UK.","DOI":"10.1145\/2785956.2787502"},{"key":"ref_78","doi-asserted-by":"crossref","first-page":"317","DOI":"10.1016\/j.patcog.2018.07.023","article-title":"Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning","volume":"84","author":"Biggio","year":"2018","journal-title":"Pattern Recognit."},{"key":"ref_79","doi-asserted-by":"crossref","first-page":"206","DOI":"10.1038\/s42256-019-0048-x","article-title":"Stop Explaining Black Box Machine Learning Models for High Stakes Decisions and Use Interpretable Models Instead","volume":"1","author":"Rudin","year":"2019","journal-title":"Nat. Mach. Intell."}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-431X\/15\/1\/26\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,5]],"date-time":"2026-01-05T13:48:58Z","timestamp":1767620938000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-431X\/15\/1\/26"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,1,5]]},"references-count":79,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,1]]}},"alternative-id":["computers15010026"],"URL":"https:\/\/doi.org\/10.3390\/computers15010026","relation":{},"ISSN":["2073-431X"],"issn-type":[{"value":"2073-431X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,1,5]]}}}