{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,28]],"date-time":"2026-09-28T17:01:50Z","timestamp":1790614910283,"version":"4.1.0"},"reference-count":34,"publisher":"MDPI AG","issue":"19","license":[{"start":{"date-parts":[[2026,9,28]],"date-time":"2026-09-28T00:00:00Z","timestamp":1790553600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"Langfang City Science and Technology Support Plan Project","award":["2024011016"],"award-info":[{"award-number":["2024011016"]}]},{"name":"Langfang City Science and Technology Support Plan Project","award":["2024011059"],"award-info":[{"award-number":["2024011059"]}]},{"name":"Science and Technology Innovation Program for Postgraduate students in IDP subsidized by Fundamental Research Funds for the Central Universities","award":["ZY20250301"],"award-info":[{"award-number":["ZY20250301"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Large-scale botnet detection using graph neural networks (GNNs) often requires subgraph sampling to reduce computational and memory costs. However, conventional sampling strategies may fail to simultaneously preserve the global topology and local community structure of the original graph, resulting in structural information loss. To address this issue, this paper proposes RI Graph Sampling (RIGS), a hybrid graph sampling method that probabilistically combines Rank Degree (RD) sampling with Improved Forest Fire Sampling based on PageRank (IFFST-PR). By exploiting the complementary structural preferences of these two strategies, RIGS preserves structurally important nodes and local community information while controlling computational overhead. RIGS is further integrated into the GraphSAINT training framework, where sampling normalization is employed to reduce the estimation bias introduced by stochastic subgraph sampling. When combined with a Graph Convolutional Network (GCN), the proposed framework alleviates the neighbor explosion problem and improves training efficiency while maintaining competitive detection performance. Experiments on the CTU-13 and NCC-2 datasets demonstrate that the proposed framework reduces training time and memory consumption while achieving competitive botnet detection performance. Structural preservation analysis further shows that RIGS provides a favorable balance between global topology and local community structure. Overall, the proposed framework achieves a favorable trade-off among detection performance, computational efficiency, and structural preservation, supporting its applicability to large-scale botnet detection.<\/jats:p>","DOI":"10.3390\/s26196154","type":"journal-article","created":{"date-parts":[[2026,9,28]],"date-time":"2026-09-28T15:57:57Z","timestamp":1790611077000},"page":"6154","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["RI Graph Sampling: A Hybrid Graph Sampling Method for Large-Scale Botnet Detection"],"prefix":"10.3390","volume":"26","author":[{"given":"Jia","family":"Chai","sequence":"first","affiliation":[{"name":"School of Computer and Information Security, University of Emergency Management, Sanhe 065201, China"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"methodology","vocabulary":"credit"},{"role":"software","vocabulary":"credit"},{"role":"formal-analysis","vocabulary":"credit"},{"role":"writing-original-draft","vocabulary":"credit"},{"role":"visualization","vocabulary":"credit"},{"role":"validation","vocabulary":"credit"}]},{"given":"Yanping","family":"Shen","sequence":"additional","affiliation":[{"name":"School of Computer and Information Security, University of Emergency Management, Sanhe 065201, China"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"methodology","vocabulary":"credit"},{"role":"validation","vocabulary":"credit"},{"role":"formal-analysis","vocabulary":"credit"},{"role":"writing-original-draft","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"},{"role":"visualization","vocabulary":"credit"},{"role":"funding-acquisition","vocabulary":"credit"},{"role":"conceptualization","vocabulary":"credit"}]},{"given":"Wuxin","family":"Tian","sequence":"additional","affiliation":[{"name":"School of Computer and Information Security, University of Emergency Management, Sanhe 065201, China"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"methodology","vocabulary":"credit"},{"role":"software","vocabulary":"credit"},{"role":"formal-analysis","vocabulary":"credit"}]},{"given":"Xiaoling","family":"Sun","sequence":"additional","affiliation":[{"name":"School of Computer and Information Security, University of Emergency Management, Sanhe 065201, China"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"validation","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"}]},{"given":"Liqin","family":"Tian","sequence":"additional","affiliation":[{"name":"School of Computer and Information Security, University of Emergency Management, Sanhe 065201, China"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"writing-review-editing","vocabulary":"credit"}]}],"member":"1968","published-online":{"date-parts":[[2026,9,28]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"9","DOI":"10.1186\/s42400-024-00307-8","article-title":"A Privacy-Enhanced Framework with Deep Learning for Botnet Detection","volume":"8","author":"Wu","year":"2025","journal-title":"Cybersecurity"},{"key":"ref_2","unstructured":"Zhou, J., Xu, Z., Rush, A.M., and Yu, M. (2020, January 2\u20134). Automating Botnet Detection with Graph Neural Networks 2020. Proceedings of the AutoML for Networking and Systems Workshop of MLSys 2020 Conference, Austin, TX, USA."},{"key":"ref_3","unstructured":"Zeng, H., Zhou, H., Srivastava, A., Kannan, R., and Prasanna, V. (2020, January 26\u201330). GraphSAINT: Graph Sampling Based Inductive Learning Method 2020. Proceedings of the 8th International Conference on Learning Representations (ICLR 2020), Addis Ababa, Ethiopia."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"205","DOI":"10.1109\/JAS.2021.1004311","article-title":"Sampling Methods for Efficient Training of Graph Convolutional Networks: A Survey","volume":"9","author":"Liu","year":"2022","journal-title":"IEEE\/CAA J. Autom. Sin."},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Voudigari, E., Salamanos, N., Papageorgiou, T., and Yannakoudakis, E.J. (2016). Rank Degree: An Efficient Algorithm for Graph Sampling. Proceedings of the 2016 IEEE\/ACM International Conference on Advances in Social Networks Analysis and Mining (ASONAM), San Francisco, CA, USA, 18\u201321 August 2016, IEEE.","DOI":"10.1109\/ASONAM.2016.7752223"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"55","DOI":"10.1016\/j.jnca.2015.05.021","article-title":"A Novel Green Algorithm for Sampling Complex Networks","volume":"59","author":"Tong","year":"2016","journal-title":"J. Netw. Comput. Appl."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Xu, X., Lee, C.-H., and Eun, D.Y. (2014). A General Framework of Hybrid Graph Sampling for Complex Network Analysis. Proceedings of the IEEE INFOCOM 2014\u2014IEEE Conference on Computer Communications, Toronto, ON, Canada, 27 April\u2013May 2014, IEEE.","DOI":"10.1109\/INFOCOM.2014.6848229"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"100","DOI":"10.1016\/j.cose.2014.05.011","article-title":"An Empirical Comparison of Botnet Detection Methods","volume":"45","author":"Grill","year":"2014","journal-title":"Comput. Secur."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"100441","DOI":"10.1016\/j.simpa.2022.100441","article-title":"Simultaneous Botnet Dataset Generator: A Simulation Tool for Generating a Botnet Dataset with Simultaneous Attack Characteristic","volume":"14","author":"Putra","year":"2022","journal-title":"Softw. Impacts"},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Udiyono, A., Lim, C. (2020). Botnet Detection Using DNS and HTTP Traffic Analysis. Proceedings of the International Conference on Engineering and Information Technology for Sustainable Industry, Tangerang, Indonesia, 28\u201329 September 2020, ACM.","DOI":"10.1145\/3429789.3429818"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"99166","DOI":"10.1109\/ACCESS.2021.3094183","article-title":"Botnet Detection Approach Using Graph-Based Machine Learning","volume":"9","author":"Alharbi","year":"2021","journal-title":"IEEE Access"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"108084","DOI":"10.1016\/j.comcom.2025.108084","article-title":"Deeply Fused Flow and Topology Features for Botnet Detection Based on a Pretrained GCN","volume":"233","author":"Meng","year":"2025","journal-title":"Comput. Commun."},{"key":"ref_13","unstructured":"Zou, D., Hu, Z., Wang, Y., Jiang, S., Sun, Y., and Gu, Q. (2019, January 8\u201314). Layer-Dependent Importance Sampling for Training Deep and Large Graph Convolutional Networks. Proceedings of the 33rd Conference on Neural Information Processing Systems (NeurIPS 2019), Vancouver, BC, Canada."},{"key":"ref_14","unstructured":"Hamilton, W., Ying, Z., and Leskovec, J. (2017, January 4\u20139). Inductive Representation Learning on Large Graphs. Proceedings of the 31st Conference on Neural Information Processing Systems (NIPS 2017), Long Beach, CA, USA."},{"key":"ref_15","unstructured":"Chen, J., Zhu, J., and Song, L. (2018, January 10\u201315). Stochastic Training of Graph Convolutional Networks with Variance Reduction 2018. Proceedings of the 35th International Conference on Machine Learning (ICML 2018), Stockholm, Sweden."},{"key":"ref_16","unstructured":"Chen, J., Ma, T., and Xiao, C. (May, January 30). FastGCN: Fast Learning with Graph Convolutional Networks via Importance Sampling 2018. Proceedings of the 6th International Conference on Learning Representations (ICLR 2018), Vancouver, BC, Canada."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Zeng, H., Zhou, H., Srivastava, A., Kannan, R., and Prasanna, V. (2019, January 20\u201324). Accurate, Efficient and Scalable Graph Embedding. Proceedings of the 2019 IEEE International Parallel and Distributed Processing Symposium (IPDPS), Rio de Janeiro, Brazil.","DOI":"10.1109\/IPDPS.2019.00056"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Chiang, W.-L., Liu, X., Si, S., Li, Y., Bengio, S., and Hsieh, C.-J. (2019). Cluster-GCN: An Efficient Algorithm for Training Deep and Large Graph Convolutional Networks. Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, Anchorage, AK, USA, 4\u20138 August 2019, ACM.","DOI":"10.1145\/3292500.3330925"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"3715","DOI":"10.1109\/TNNLS.2026.3654995","article-title":"PromptGCN: Bridging Subgraph Gaps in Lightweight GCNs 2024","volume":"37","author":"Ji","year":"2024","journal-title":"IEEE Trans. Neural Netw. Learn. Syst."},{"key":"ref_20","unstructured":"Shi, Z., Liang, X., and Wang, J. (2025). LMC: Fast Training of GNNs via Subgraph Sampling with Provable Convergence 2025. arXiv."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Yin, L., Chen, W., Luo, X., and Yang, H. (2024). Efficient Large-Scale IoT Botnet Detection through GraphSAINT-Based Subgraph Sampling and Graph Isomorphism Network. Mathematics, 12.","DOI":"10.3390\/math12091315"},{"key":"ref_22","unstructured":"Balaji, V., Kozyrakis, C., Chechik, G., and Maron, H. (2025). Efficient GNN Training Through Structure-Aware Randomized Mini-Batching 2025. arXiv."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Bhatia, V., and Rani, R. (2017). An Efficient Algorithm for Sampling of a Single Large Graph. Proceedings of the 2017 Tenth International Conference on Contemporary Computing (IC3), Noida, India, 10\u201312 August 2017, IEEE.","DOI":"10.1109\/IC3.2017.8284290"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Ahmed, N.K., Neville, J., and Kompella, R. (2012). Space-Efficient Sampling from Social Activity Streams. Proceedings of the 1st International Workshop on Big Data, Streams and Heterogeneous Source Mining: Algorithms, Systems, Programming Models and Applications, Beijing, China, 12 August 2012, ACM.","DOI":"10.1145\/2351316.2351324"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Maiya, A.S., and Berger-Wolf, T.Y. (2010). Sampling Community Structure. Proceedings of the 19th International Conference on World Wide Web, Raleigh, NC, USA, 26\u201330 April 2010, ACM.","DOI":"10.1145\/1772690.1772762"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Gao, R., Hu, P., and Lau, W.C. (2015, January 6\u201310). Graph Property Preservation under Community-Based Sampling. Proceedings of the 2015 IEEE Global Communications Conference (GLOBECOM 2015), San Diego, CA, USA.","DOI":"10.1109\/GLOCOM.2015.7417471"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"127581","DOI":"10.1016\/j.neucom.2024.127581","article-title":"Weighted Jump in Random Walk Graph Sampling","volume":"586","author":"Qi","year":"2024","journal-title":"Neurocomputing"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Yang, Y., and Wang, L. (2021). LGANet: Local Graph Attention Network for Peer-to-Peer Botnet Detection. Proceedings of the 2021 3rd International Conference on Advances in Computer Technology, Information Science and Communication (CTISC), Shanghai, China, 23\u201325 April 2021, IEEE.","DOI":"10.1109\/CTISC52352.2021.00013"},{"key":"ref_29","unstructured":"Zeng, H., Zhang, M., Xia, Y., Srivastava, A., Malevich, A., Kannan, R., and Prasanna, V. (2021, January 6\u201314). Decoupling the Depth and Scope of Graph Neural Networks. Proceedings of the 35th Conference on Neural Information Processing Systems (NeurIPS 2021), Virtual."},{"key":"ref_30","unstructured":"Kipf, T.N., and Welling, M. (2017, January 24\u201326). Semi-Supervised Classification with Graph Convolutional Networks. Proceedings of the 5th International Conference on Learning Representations (ICLR 2017), Toulon, France."},{"key":"ref_31","unstructured":"Veli\u010dkovi\u0107, P., Cucurull, G., Casanova, A., Romero, A., Li\u00f2, P., and Bengio, Y. (May, January 30). Graph Attention Networks 2018. Proceedings of the 6th International Conference on Learning Representations (ICLR 2018), Vancouver, BC, Canada."},{"key":"ref_32","unstructured":"Xu, K., Li, C., Tian, Y., Sonobe, T., Kawarabayashi, K., and Jegelka, S. (2018, January 10\u201315). Representation Learning on Graphs with Jumping Knowledge Networks. Proceedings of the 35th International Conference on Machine Learning (ICML 2018), Stockholm, Sweden."},{"key":"ref_33","first-page":"197","article-title":"Enhancing Stratified Graph Sampling Algorithms Based on Approximate Degree Distribution","volume":"Volume 764","author":"Silhavy","year":"2019","journal-title":"Artificial Intelligence and Algorithms in Intelligent Systems"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"173","DOI":"10.1145\/3808699","article-title":"Cryptanalysis and Improvement of a Video Cryptosystem via Chaos and S-Box","volume":"22","author":"Lin","year":"2026","journal-title":"ACM Trans. Multimed. Comput. Commun. Appl."}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/19\/6154\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,28]],"date-time":"2026-09-28T16:08:14Z","timestamp":1790611694000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/19\/6154"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,28]]},"references-count":34,"journal-issue":{"issue":"19","published-online":{"date-parts":[[2026,10]]}},"alternative-id":["s26196154"],"URL":"https:\/\/doi.org\/10.3390\/s26196154","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,28]]}}}