Rishi: Identify Bot Contaminated Hosts by IRC Nickname Evaluation

By Jan Göbel, Thorsten Holz. Conference on Workshop on Hot Topics in Understanding Botnets, 2007

391 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/1fbb46f66bec10b8258015a231e1c5eae8470ec0

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Disclosure: detecting botnet command and control servers through large-scale NetFlow analysis (2012, background): “A number of systems focus on specific protocols such as IRC [6, 16, 32].”
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic (2008, background): “Rishi [13] is a relevant system but it is signature-based (using known knowledge of bot nicknames).”
A Taxonomy of Botnet Structures (2007, methodology): “Rishi [18] uses the similarity of nick name to detect botnet channel.”
BotGrep: Finding P2P Bots with Structured Graph Analysis (2010, methodology): “However, growing size of botnets, as well as the development of mechanisms that detect centralized command-and-control servers [10, 44, 27, 31, 72, 9, 49, 30, 29, 76], has motivated the design of decentralized peer-to-peer botnets.”
A Survey of Botnet and Botnet Detection (2009, methodology): “On the other hand, detection techniques that require access to C&C payloads [24, 25, 31, 32] are less effective as botmasters tend to use encrypted channels for C&C communications.”
BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection (2008, methodology): “Rishi [17] is a signature-based IRC botnet detection system by matching known IRC bot nickname patterns.”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, methodology): “Rishi [21] is an IRC botnet detection system that uses n-gram analysis to identify botnet nickname patterns.”