An Inside Look at Botnets

By Paul R. Barford, Vinod Yegneswaran. Malware Detection, 2007

375 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/0eac1d94c1aa7c3bd8a91b21d7df1b0e15a27a02

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection (2008, methodology): “In short, V-Spybot and V-Sdbot are generated by executing modified bot code (Spybot and Sdbot [6]) in a fully controlled virtual network.”
Peer-to-Peer Botnets: Overview and Case Study (2007, methodology): “Agobotvariants are possibly one of the most widespread bots due to its well designed and modular code base [2].”
An Algorithm for Anomaly-based Botnet Detection (2006, background): “The paper [ 2 ] presents a good introduction to botnets and analyzes botnet architecture.”
Understanding the Mirai Botnet (2017, background): “This work follows in a long line studies that have analyzed the structure, behavior, and evolution of the botnet ecosystem [12,37,76,84,85,91,96].”
A Survey of Botnet and Botnet Detection (2009, background): “In addition, many papers [2, 6, 7, 13, 19, 20, 21, 22, 23] discussed how to use honeynets for botnet tracking and measurement.”
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic (2008, methodology): “Many existing botnets use IRC, including the most common bot families such as Phatbot, Spybot, Sdbot, Rbot/Rxbot, GTBot [5].”
Automated Classification and Analysis of Internet Malware (2007, background): “Modern Agobot variants have the ability to perform DoS attacks, steal bank passwords and account details, propagate over the network using a diverse set of remote exploits, use polymorphism to evade detection and disassembly, and even patch vulnerabilities and remove competing malware from an infect”
Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm (2008, methodology): “This propagation mechanism is used for example by CodeRed [21], Slammer [20], and all common IRC bots [3].”
An Advanced Hybrid Peer-to-Peer Botnet (2007, background): “[8], [9], [10], [11], [ 15 ] only introduced the attack techniques already implemented in several botnets appearing in the past.”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, background): “examine the structural similarities, defense mechanisms, and command and control capabilities of the major bot families [7] and developed techniques to automatically harvest malware samples directly from the Internet [6].”
All Your iFRAMEs Point to Us (2008, methodology): “, [6, 19, 8, 21, 22, 12]), the IRC connection attempts are most likely for unwillingly (to the owner) adding the compromised machine to an IRC botnet, confirming the earlier conjecture by Provos et al.”
Secure and Flexible Monitoring of Virtual Machines (2007, methodology): “However, this architecture is ﬂawed because malicious software can simply disable the anti-virus software [3].”
A multifaceted approach to understanding the botnet phenomenon (2006, methodology): “This set of commands includes all the IRC commands that we originally observed in our honeynet traces as well as the commands extracted from the publicly available source code of known bots analogous to the analysis in [3].”
A Taxonomy of Botnet Structures (2007, background): “Barford and Yegneswaran [8] codify the capabilities of malware by dissecting four widely-used Internet Relay Chat (IRC) botnet codebases.”