Wide-Scale Botnet Detection and Characterization

By Anestis Karasaridis, Brian Rexroad, David A. Hoeflin. Conference on Workshop on Hot Topics in Understanding Botnets, 2007

402 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/5a74be8ec45c7abaf0785cf2bb33a5b80f6edaed

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

BotGrep: Finding P2P Bots with Structured Graph Analysis (2010, methodology): “However, growing size of botnets, as well as the development of mechanisms that detect centralized command-and-control servers [10, 44, 27, 31, 72, 9, 49, 30, 29, 76], has motivated the design of decentralized peer-to-peer botnets.”
Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks (2013, background): “A number of studies monitor crowd communication behaviors of multiple hosts and analyze the spatial-temporal correlations between them to detect botnet infected hosts independent of the protocol used for C&C communication [18, 20, 24, 40], while others specifically focus on DNS traffic similarity [1”
EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis (2011, unknown): “Note that researchers have used DNS before as a way to analyze, measure and estimate the size of existing botnets in the past (e.g., [21, 22, 34]).”
Your botnet is my botnet: analysis of a botnet takeover (2009, background): “Other researchers analyzed network traffic (netflow data) at the tier1 ISP level for cues that are characteristic for certain botnets (such as scanning or long-lived IRC connections) [24].”
Dissecting a Social Botnet: Growth, Content and Influence in Twitter (2015, background): “Abu Rajab et al. [1] used a multifaceted approach to track and capture the behavior of IRC based botnets.”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, methodology): “[25] presented an algorithm for detecting IRC botnet controllers from netflow records.”
A Survey of Botnet and Botnet Detection (2009, methodology): “Furthermore, there are several open-source implementations that enable botmasters to extend them according to their demands [2, 12].”
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic (2008, background): “Karasaridiset al. [ 18 ] studied network flow level detection of IRC botnet controllers for backbone networks.”
A Taxonomy of Botnet Structures (2007, background): “[28], proposed to detect botnet command and control through passive network flow record analysis.”
BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection (2008, methodology): “Researchers have proposed a few approaches [7, 17, 19, 20, 26 , 29, 35, 40] to detect the existence of botnets in monitored networks.”
Differential privacy for collaborative security (2010, background): “logging and data collection to identify anomalous behavior and to verify it as botnet activity [2, 7, 13, 14, 15, 16, 21, 23, 31].”
Disclosure: detecting botnet command and control servers through large-scale NetFlow analysis (2012, background): “(i) vertical correlation, or detecting command and control (C&C) channels used by botmasters to communicate with each infected machine [17,19,21,29]; and (ii) horizontal correlation, where botnet detection is based upon patterns of crowd behavior exhibited by collections of bots in response to botma”
An Overview of IP Flow-Based Intrusion Detection (2010, background): “Karasaridis address two main points.”