{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,16]],"date-time":"2026-01-16T03:35:33Z","timestamp":1768534533014,"version":"3.49.0"},"reference-count":69,"publisher":"Wiley","issue":"10","license":[{"start":{"date-parts":[[2022,3,8]],"date-time":"2022-03-08T00:00:00Z","timestamp":1646697600000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/onlinelibrary.wiley.com\/termsAndConditions#vor"},{"start":{"date-parts":[[2022,3,8]],"date-time":"2022-03-08T00:00:00Z","timestamp":1646697600000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/doi.wiley.com\/10.1002\/tdm_license_1.1"}],"content-domain":{"domain":["onlinelibrary.wiley.com"],"crossmark-restriction":true},"short-container-title":["Int J of Intelligent Sys"],"published-print":{"date-parts":[[2022,10]]},"DOI":"10.1002\/int.22866","type":"journal-article","created":{"date-parts":[[2022,3,9]],"date-time":"2022-03-09T06:23:44Z","timestamp":1646807024000},"page":"6877-6908","update-policy":"https:\/\/doi.org\/10.1002\/crossmark_policy","source":"Crossref","is-referenced-by-count":23,"title":["A comprehensive study of Mozi botnet"],"prefix":"10.1155","volume":"37","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5683-5347","authenticated-orcid":false,"given":"Teng\u2010Fei","family":"Tu","sequence":"first","affiliation":[{"name":"State Key Laboratory of Networking and Switching Technology Beijing University of Posts and Telecommunications  Beijing China"}]},{"given":"Jia\u2010Wei","family":"Qin","sequence":"additional","affiliation":[{"name":"Cyber Security Department National Computer Network Emergency Response Technical Team\/Coordination Center of China  Beijing China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0532-9783","authenticated-orcid":false,"given":"Hua","family":"Zhang","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Networking and Switching Technology Beijing University of Posts and Telecommunications  Beijing China"}]},{"given":"Miao","family":"Chen","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Networking and Switching Technology Beijing University of Posts and Telecommunications  Beijing China"}]},{"given":"Tong","family":"Xu","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Networking and Switching Technology Beijing University of Posts and Telecommunications  Beijing China"}]},{"given":"Yue","family":"Huang","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Networking and Switching Technology Beijing University of Posts and Telecommunications  Beijing China"}]}],"member":"311","published-online":{"date-parts":[[2022,3,8]]},"reference":[{"key":"e_1_2_10_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIA.2020.2971952"},{"key":"e_1_2_10_3_1","doi-asserted-by":"publisher","DOI":"10.1007\/s12065-019-00310-w"},{"key":"e_1_2_10_4_1","doi-asserted-by":"crossref","unstructured":"HuangZ LinZ GongZ ChenY TangY.A two\u2010phase knowledge distillation model for graph convolutional network\u2010based recommendation.Int J Intell Syst.2022;1\u201022.doi:10.1002\/int.22819","DOI":"10.1002\/int.22819"},{"key":"e_1_2_10_5_1","doi-asserted-by":"crossref","unstructured":"ShiZ ChangC ChenH DuX ZhangH.PR\u2010NET: progressively\u2010refined neural network for image manipulation localization.Int J Intell Syst.2022;1\u201023.doi:10.1002\/int.22822","DOI":"10.1002\/int.22822"},{"key":"e_1_2_10_6_1","doi-asserted-by":"crossref","unstructured":"WangW YangX LiX TangJ.Convolutional\u2010capsule network for gastrointestinal endoscopy image classification.Int J Intell Syst.2022;1\u201020.doi:10.1002\/int.22815","DOI":"10.1002\/int.22815"},{"key":"e_1_2_10_7_1","doi-asserted-by":"crossref","unstructured":"ChenX ZhangF ZhouF BonsangueM.Multi\u2010scale graph capsule with influence attention for information cascades prediction.Int J Intell Syst.2022;37(3):2584\u20102611.doi:10.1002\/int.22786","DOI":"10.1002\/int.22786"},{"key":"e_1_2_10_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2020.3043768"},{"key":"e_1_2_10_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2021.3052223"},{"key":"e_1_2_10_10_1","doi-asserted-by":"crossref","unstructured":"TuT LiuX SongL ZhangY.Understanding real\u2010world concurrency bugs in Go. In: Iris B Maurice H Emmett W Alvin RL eds.Proceedings of the Twenty\u2010Fourth International Conference on Architectural Support for Programming Languages and Operating Systems. ACM;2019:865\u2010878.","DOI":"10.1145\/3297858.3304069"},{"key":"e_1_2_10_11_1","doi-asserted-by":"crossref","unstructured":"YanY TuT ZhaoL ZhouY WangW.Understanding the performance of webassembly applications. In: Dave L Alan M Johanna A Matthew L eds.Proceedings of the 21st ACM Internet Measurement Conference. ACM;2021:533\u2010549.","DOI":"10.1145\/3487552.3487827"},{"key":"e_1_2_10_12_1","doi-asserted-by":"crossref","unstructured":"XiaoY CongL MingwenZ et al.A multitarget backdooring attack on deep neural networks with random location trigger.Int J Intell Syst.2022;37(3):2567\u20102583.doi:10.1002\/int.22785","DOI":"10.1002\/int.22785"},{"key":"e_1_2_10_13_1","first-page":"e4088","article-title":"Ensemble adaboost classifier for accurate and fast detection of botnet attacks in connected vehicles","author":"RehmanJaved A","year":"2020","journal-title":"Trans Emerging Telecommun Technol"},{"key":"e_1_2_10_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/3379542"},{"key":"e_1_2_10_15_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2018.11.025"},{"key":"e_1_2_10_16_1","doi-asserted-by":"crossref","unstructured":"ZhuZ LuG ChenY FuZJ RobertsP HanK.Botnet research survey. In:2008 32nd Annual IEEE International Computer Software and Applications Conference. IEEE Computer Society;2008:967\u2010972.","DOI":"10.1109\/COMPSAC.2008.205"},{"key":"e_1_2_10_17_1","doi-asserted-by":"crossref","unstructured":"FeilyM ShahrestaniA RamadassS.A survey of botnet and botnet detection. In:2009 Third International Conference on Emerging Security Information Systems and Technologies. IEEE Computer Society;2009:268\u2010273.","DOI":"10.1109\/SECURWARE.2009.48"},{"key":"e_1_2_10_18_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2014.05.011"},{"key":"e_1_2_10_19_1","first-page":"1093","volume-title":"Proceedings of the 26th USENIX Conference on Security Symposium","author":"Antonakakis M","year":"2017"},{"key":"e_1_2_10_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.3034156"},{"key":"e_1_2_10_21_1","doi-asserted-by":"publisher","DOI":"10.1002\/sec.800"},{"issue":"7","key":"e_1_2_10_22_1","first-page":"589","article-title":"A survey of botnet","volume":"3","author":"Lijuan C","year":"2017","journal-title":"J Inf Secur Res"},{"key":"e_1_2_10_23_1","unstructured":"Mozi.Another botnet using DHT.\u00a0Accessed September\u00a023 2021.\u00a0https:\/\/blog.netlab.360.com\/mozi-another-botnet-using-dht\/"},{"key":"e_1_2_10_24_1","unstructured":"DHT protocol.\u00a0Accessed September 23 2021.\u00a0http:\/\/www.bittorrent.org\/beps\/bep_0005.html"},{"key":"e_1_2_10_25_1","volume-title":"Proceedings of the 1st Usenix Workshop on Large\u2010Scale Exploits and Emergent Threats","author":"Holz T","year":"2008"},{"key":"e_1_2_10_26_1","first-page":"1093","volume-title":"Proceedings of the 26th USENIX Conference on Security Symposium","author":"Antonakakis M","year":"2017"},{"key":"e_1_2_10_27_1","doi-asserted-by":"crossref","unstructured":"SuJ VasconcellosDV PrasadS SgandurraD FengY SakuraiK.Lightweight classification of IoT malware based on image recognition. In:2018 IEEE 42Nd Annual Computer Software and Applications Conference (COMPSAC). IEEE;2018:664\u2010669.","DOI":"10.1109\/COMPSAC.2018.10315"},{"key":"e_1_2_10_28_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.indcrop.2014.09.010"},{"key":"e_1_2_10_29_1","doi-asserted-by":"crossref","unstructured":"FadlallahY SbeitiM HammoudM NehmeM FadlallahA.On the cyber security of lebanon: a large scale empirical study of critical vulnerabilities. In:2020 8th International Symposium on Digital Forensics and Security (ISDFS). IEEE;2020:1\u20106.","DOI":"10.1109\/ISDFS49300.2020.9116446"},{"key":"e_1_2_10_30_1","unstructured":"The mostly dead Mozi and its' lingering bots.\u00a0Accessed August 30 2021.\u00a0https:\/\/blog.netlab.360.com\/the-mostly-dead-mozi-and-its-lingering-bots\/"},{"key":"e_1_2_10_31_1","unstructured":"Mirai evolving: new attack reveals use of Port 7547.\u00a0Accessed September 1 2021.\u00a0https:\/\/securityintelligence.com\/mirai-evolving-new-attack-reveals-use-of-port-7547\/"},{"key":"e_1_2_10_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2017.201"},{"key":"e_1_2_10_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2974293"},{"key":"e_1_2_10_34_1","doi-asserted-by":"crossref","unstructured":"VasquesAT GondimJJ.Amplified reflection DDoS attacks over IoT mirrors: a saturation analysis. In:2019 Workshop on Communication Networks and Power Systems (WCNPS). ACM;2019:1\u20106.","DOI":"10.1109\/WCNPS.2019.8896290"},{"key":"e_1_2_10_35_1","doi-asserted-by":"crossref","unstructured":"LyuM SherrattD SivanathanA GharakheiliHH RadfordA SivaramanV.Quantifying the reflective DDoS attack capability of household IoT devices. In:Proceedings of the 10th ACM Conference on Security and Privacy in Wireless and Mobile Networks. IEEE;2017:46\u201051.","DOI":"10.1145\/3098243.3098264"},{"key":"e_1_2_10_36_1","unstructured":"Devil's Ivy: flaw in widely used third\u2010party code impacts millions.\u00a0Accessed July 18 2021.\u00a0https:\/\/blog.senr.io\/blog\/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions"},{"key":"e_1_2_10_37_1","doi-asserted-by":"crossref","unstructured":"KayasG HossainM PaytonJ IslamSR.An overview of UPnP\u2010based IoT security: threats vulnerabilities and prospective solutions. In:2020 11th IEEE Annual Information Technology Electronics and Mobile Communication Conference (IEMCON). IEEE;2020:0452\u20100460.","DOI":"10.1109\/IEMCON51383.2020.9284885"},{"key":"e_1_2_10_38_1","doi-asserted-by":"crossref","unstructured":"HakimMA AksuH UluagacAS AkkayaK.U\u2010pot: a honeypot framework for upnp\u2010based iot devices. In:2018 IEEE 37th International Performance Computing and Communications Conference (IPCCC). IEEE;2018:1\u20108.","DOI":"10.1109\/PCCC.2018.8711321"},{"key":"e_1_2_10_39_1","doi-asserted-by":"crossref","unstructured":"LavrenovsA ViskyG.Investigating HTTP response headers for the classification of devices on the Internet. In:2019 IEEE 7th IEEE Workshop on Advances in Information Electronic and Electrical Engineering (AIEEE). IEEE;2019:1\u20106.","DOI":"10.1109\/AIEEE48629.2019.8977115"},{"key":"e_1_2_10_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSUSC.2018.2809665"},{"key":"e_1_2_10_41_1","doi-asserted-by":"crossref","unstructured":"HanKS KangB ImEG.Malware classification using instruction frequencies. In:Proceedings of the 2011 ACM Symposium on Research in Applied Computation. ACM;2011:298\u2010300.","DOI":"10.1145\/2103380.2103441"},{"issue":"3","key":"e_1_2_10_42_1","first-page":"19","article-title":"Malware detection and mitigation techniques: lessons learned from Mirai DDoS attack","volume":"3","author":"Jaramillo LES","year":"2018","journal-title":"J Inf Syst Eng Manage"},{"key":"e_1_2_10_43_1","doi-asserted-by":"crossref","unstructured":"\u00c7etinO Gan\u00e1nC AltenaL et al.Cleaning up the Internet of evil things: real\u2010world evidence on ISP and consumer efforts to remove Mirai. In:NDSS;2019.","DOI":"10.14722\/ndss.2019.23438"},{"key":"e_1_2_10_44_1","doi-asserted-by":"crossref","unstructured":"DittrichD DietrichS.P2P as botnet command and control: a deeper insight. In:2008 3rd International Conference on Malicious and Unwanted Software (MALWARE). IEEE;2008:41\u201048","DOI":"10.1109\/MALWARE.2008.4690856"},{"key":"e_1_2_10_45_1","first-page":"139","volume-title":"Proceedings of the 17th Conference on Security Symposium","author":"Gu G","year":"2008"},{"key":"e_1_2_10_46_1","doi-asserted-by":"crossref","unstructured":"YamaguchiS.Botnet defense system: concept and basic strategy. In:2020 IEEE International Conference on Consumer Electronics (ICCE). IEEE;2020:1\u20105.","DOI":"10.1109\/ICCE46568.2020.9043058"},{"key":"e_1_2_10_47_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11698-3_10"},{"key":"e_1_2_10_48_1","first-page":"1","article-title":"Hajime: analysis of a decentralized internet worm for IoT devices","volume":"16","author":"Edwards S","year":"2016","journal-title":"Rapidity Networks"},{"key":"e_1_2_10_49_1","doi-asserted-by":"crossref","unstructured":"HerwigS HarveyK HugheyG RobertsR LevinD.Measurement and analysis of Hajime a peer\u2010to\u2010peer IoT botnet. In:Network and Distributed Systems Security (NDSS) Symposium. The Internet Society;2019.","DOI":"10.14722\/ndss.2019.23488"},{"key":"e_1_2_10_50_1","first-page":"6","article-title":"The Zombie roundup: understanding, detecting, and disrupting botnets","volume":"5","author":"Cooke E","year":"2005","journal-title":"SRUTI"},{"key":"e_1_2_10_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2013.2290197"},{"key":"e_1_2_10_52_1","doi-asserted-by":"crossref","unstructured":"KambourakisG KoliasC StavrouA.The mirai botnet and the iot zombie armies. In:2017 IEEE Military Communications Conference (MILCOM 2017). IEEE;2017:267\u2010272.","DOI":"10.1109\/MILCOM.2017.8170867"},{"key":"e_1_2_10_53_1","doi-asserted-by":"crossref","unstructured":"HerwigS HarveyK HugheyG RobertsR LevinD.Measurement and analysis of Hajime a peer\u2010to\u2010peer IoT botnet. In:26th Annual Network and Distributed System Security Symposium\u00a0(NDSS 2019) San Diego California USA February 24\u201027 2019. The Internet Society;2019.","DOI":"10.14722\/ndss.2019.23488"},{"key":"e_1_2_10_54_1","first-page":"15","volume-title":"27th {USENIX} Security Symposium ({USENIX} Security","author":"Soltan S","year":"2018"},{"key":"e_1_2_10_55_1","doi-asserted-by":"crossref","unstructured":"Bah\u015fiH N\u00f5mmS LaTorreFB.Dimensionality reduction for machine learning based iot botnet detection. In:2018 15th International Conference on Control Automation Robotics and Vision (ICARCV). IEEE;2018:1857\u20101862.","DOI":"10.1109\/ICARCV.2018.8581205"},{"key":"e_1_2_10_56_1","first-page":"7","article-title":"An algorithm for anomaly\u2010based botnet detection","volume":"6","author":"Binkley JR","year":"2006","journal-title":"SRUTI"},{"key":"e_1_2_10_57_1","first-page":"321","volume-title":"NSDI'09","author":"Zhao Y","year":"2009"},{"key":"e_1_2_10_58_1","unstructured":"DagonD ZouCC LeeW.Modeling botnet propagation using time zones. In:NDSS. The Internet Society;2006:2\u201013."},{"key":"e_1_2_10_59_1","doi-asserted-by":"crossref","unstructured":"AbokhodairN YooD McDonaldDW.Dissecting a social botnet: growth content and influence in Twitter. In:Proceedings of the 18th ACM Conference on Computer Supported Cooperative Work & Social Computing. ACM;2015:839\u2010851.","DOI":"10.1145\/2675133.2675208"},{"key":"e_1_2_10_60_1","doi-asserted-by":"crossref","unstructured":"KaruppayahS VasilomanolakisE HaasS M\u00fchlh\u00e4userM FischerM.BoobyTrap: on autonomously detecting and characterizing crawlers in P2P botnets. In:2016 IEEE International Conference on Communications (ICC). IEEE;2016:1\u20107","DOI":"10.1109\/ICC.2016.7510885"},{"key":"e_1_2_10_61_1","doi-asserted-by":"crossref","unstructured":"B\u00f6ckL VasilomanolakisE M\u00fchlh\u00e4userM KaruppayahS.Next generation P2P botnets: monitoring under adverse conditions. In:International Symposium on Research in Attacks Intrusions and Defenses. Springer;2018:511\u2010531.","DOI":"10.1007\/978-3-030-00470-5_24"},{"key":"e_1_2_10_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2017.2749442"},{"key":"e_1_2_10_63_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2895955"},{"key":"e_1_2_10_64_1","doi-asserted-by":"publisher","DOI":"10.1049\/iet-cps.2017.0047"},{"key":"e_1_2_10_65_1","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2020.2984662"},{"key":"e_1_2_10_66_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2019.09.024"},{"key":"e_1_2_10_67_1","doi-asserted-by":"crossref","unstructured":"McDermottCD MajdaniF PetrovskiAV.Botnet detection in the Internet of Things using deep learning approaches. In:2018 International Joint Conference on Neural Networks (IJCNN). IEEE;2018:1\u20108","DOI":"10.1109\/IJCNN.2018.8489489"},{"key":"e_1_2_10_68_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIA.2020.2971952"},{"key":"e_1_2_10_69_1","doi-asserted-by":"crossref","unstructured":"RossowC AndriesseD WernerT et al.SoK: P2PWNED\u2014modeling and evaluating the resilience of peer\u2010to\u2010peer botnets. In:2013 IEEE Symposium on Security and Privacy Berkeley CA USA 2013. Springer;2013:97\u2010111.","DOI":"10.1109\/SP.2013.17"},{"key":"e_1_2_10_70_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107488"}],"container-title":["International Journal of Intelligent Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1002\/int.22866","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/full-xml\/10.1002\/int.22866","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1002\/int.22866","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,2,9]],"date-time":"2023-02-09T15:38:18Z","timestamp":1675957098000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1002\/int.22866"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,3,8]]},"references-count":69,"journal-issue":{"issue":"10","published-print":{"date-parts":[[2022,10]]}},"alternative-id":["10.1002\/int.22866"],"URL":"https:\/\/doi.org\/10.1002\/int.22866","archive":["Portico"],"relation":{},"ISSN":["0884-8173","1098-111X"],"issn-type":[{"value":"0884-8173","type":"print"},{"value":"1098-111X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,3,8]]},"assertion":[{"value":"2021-11-11","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-02-14","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2022-03-08","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}