Your botnet is my botnet: analysis of a botnet takeover

By Brett Stone-Gross, Marco Cova, Lorenzo Cavallaro, Bob Gilbert, M. Szydlowski, Richard A. Kemmerer, Christopher Krügel, Giovanni Vigna. Conference on Computer and Communications Security, 2009

724 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/6e559e3b099e37951a5ddf4565b6f603e7ac3223

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Detecting algorithmically generated malicious domain names (2010, methodology): “patch all his bots with a repurposed executable with a different domain generation algorithm [30].”
Understanding fraudulent activities in online ad exchanges (2011, background): “Recent work has examined botnets and researchers have infiltrated or seized control of parts of the botnet infrastructure to gain more insight into their inner-workings [15, 22, 24, 25].”
Managing Employee Compliance with Information Security Policies: The Critical Role of Top Management and Organizational Culture (2012, methodology): “…shopping site using a work computer could easily have malware installed on the computer and open the door for attacks by the proprietor of a botnet (Stone-Gross et al., 2009; Markoff, 2010); and inserting an infected USB drive into a corporate computer could install malicious software that…”
EVILCOHORT: Detecting Communities of Malicious Accounts on Online Services (2015, methodology): “On the other hand, E VIL C OHORT can detect an account (or an IP address) as malicious even if the account does not post any content on the online service.”
Reliable Client Accounting for Hybrid Content-Distribution Networks (2012, background): “Even botnets, a potential source of compromised clients, are often biased towards particular regions [32].”
Detecting Malware Domains at the Upper DNS Hierarchy (2011, methodology): “For example, botnets [1,21,27] and other types of malicious software make use of domain names to locate their command and control (C&C) servers and communicate with attackers, e.g., to ex-ﬁltrate stolen private information, wait for commands to perform attacks on other victim machines, etc.”
Click Trajectories: End-to-End Analysis of the Spam Value Chain (2011, background): “seen on IRC chatrooms [10], forums [59], malware “dropzones” [16], or directly by intercepting communications to botnet C&C servers [50].”
Prophiler: a fast filter for the large-scale detection of malicious web pages (2011, positive): “As a recent study has shown [29], a botnet can contain hundreds of thousands of compromised hosts, and it can generate significant income for the botmaster who controls it.”
Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks (2013, background): “Other works focus on tracking and measuring botnets [4, 14, 17, 22, 34].”
Detecting Automation of Twitter Accounts: Are You a Human, Bot, or Cyborg? (2012, background): “Like existing bots in other web applications (i.e., Internet chat [9], blogs [10] and online games [11]), bots have been common on Twitter.”
Testing metrics for password creation policies by attacking large sets of revealed passwords (2010, background): “Perhaps the largest previous study on password security was done by Stone-Gross et al when his team temporarily took over the torpig botnet [23].”
The Plight of the Targeted Attacker in a World of Scale (2010, background): “Stone et al. [11] also managed to take over a botnet for a period of weeks.”
Large-Scale Automatic Classification of Phishing Pages (2010, neutral): “, hosts this phishing campaign [31].”
Understanding the Mirai Botnet (2017, background): “This work follows in a long line studies that have analyzed the structure, behavior, and evolution of the botnet ecosystem [12,37,76,84,85,91,96].”
EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis (2011, background): “We also used the list of domains that are generated by the DGAs of the Conﬁcker [32] and Mebroot [34] (i.e., Torpig) botnets.”