Malicious bots typically operate within networks through peer-to-peer (P2P) communication structures, leading to the emergence of graph neural networks (GNNs) as a promising bot detection method. However, communications graphs representing bot-infected networks often exhibit an inherent imbalance, coupled with a high degree of heterophily. Graph oversampling techniques, employed to address class imbalance on graphs, are burdened with downsides, such as the creation of complex and noisy topological structures or further amplification of heterophily in a graph. Out-of-distribution detection (ODD) is considered as an alternative solution to address data imbalance issues, but when applied to graphs, this belief is built on an assumption that the underlying graph structure does not interfere with the learning of data distributions. In this paper, we propose a new ODD model HistNet which implements Heterophily-aware isotropic out-of-distribution detection to explore how to leverage ODD for malicious bot detection in a Network. HistNet proceeds with heterophily-aware node embedding that facilitates enhanced isotropic distance calculation and homophily-augmented distance-based belief propagation, which is further regularized by implicit clustering. These technical designs enable HistNet to overcome performance issues caused by imbalance and heterophily in graphs and improve isotropic ODD for bot detection. We validate our claims through extensive experiments on 10 computer networks derived from TON IoT datasets, which comprise real captured bot data. The experimental results demonstrate that HistNet achieves state-of-the-art performance in malicious bot detection on graphs with high graph heterophily and extreme class imbalance.

Smart buildings remain heterogeneous across sensing infrastructure, metadata quality, legacy protocols, and analytics requirements, hindering reusable human–building natural language interfaces. We present OntoSage, a modular framework for ontologically grounded question answering (QA) and fulfillment of analytic intents over smart building data. The framework (i) leverages Brick Schema-based RDF model with reasoning capabilities, (ii) translates natural language (NL) questions into executable SPARQL via a fine-tuned seq2seq model (T5-Base), and (iii) orchestrates portable analytics microservices that operate on time-series sensor data referenced through ontology-linked UUIDs. A summarization component (open-weights Mistral-7B, zero-shot) converts structured SPARQL/SQL/analytic outputs into concise stakeholder-aware responses without requiring task-specific fine-tuning. We categorize QA complexity into four reasoning classes and report component-level execution metrics supporting these categories. To address portability, we formalize a lightweight adaptation workflow (ontology ingestion $$\rightarrow $$ entity enrichment for NLU $$\rightarrow $$ NL2SPARQL validity checks $$\rightarrow $$ analytics binding) designed to minimize per-building retraining. Reproducibility is enabled through public source code, synthetic and ontology-derived datasets, Docker/Compose service descriptors, and documented supporting scripts “( https://github.com/suhasdevmane/OntoBot )”. The developers’ documentation is publicly accessible “( https://ontosage-docs.github.io )”.