Modeling Botnet Propagation Using Time Zones

By David Dagon, Cliff Changchun Zou, Wenke Lee. Network and Distributed System Security Symposium, 2006

425 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/99c511c7b6858aac49c960464c6756ad239587cc

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

A Taxonomy of Botnet Structures (2007, background): “This contrasts with the total population of all infected victims, which may not always be reachable by the botmaster, e.g., because of diurnal variations [16].”
Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm (2008, background): “As seen in the figure, Storm Worm also exhibits strong diurnal patterns like other botnets [6].”
Your botnet is my botnet: analysis of a botnet takeover (2009, background): “Therefore, by collaborating with domain registrars (or other entities such as dynamic DNS providers), it is possible to change the mapping of a botnet domain to point to a machine controlled by the defender [6].”
A Survey of Botnet and Botnet Detection (2009, background): “In addition, many papers [2, 6, 7, 13, 19, 20, 21, 22, 23] discussed how to use honeynets for botnet tracking and measurement.”
The Nepenthes Platform: An Efficient Approach to Collect Malware (2006, background): “Such an unsteadiness could for example be caused by diurnal properties of malware epidemics [5] or bursts in the network traﬃc.”
BotGrep: Finding P2P Bots with Structured Graph Analysis (2010, background): “Dagon et al. [19] studied the propagation rates of malware released at different times by redirecting DNS trafﬁc for bot domain names.”
BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection (2008, methodology): “In [13], Dagon et al. proposed to use DNS sinkholing technique for botnet study and pointed out the global diurnal behavior of botnets.”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, background): “Researchers have also studied the dynamics of botnet C&C protocols [19, 50], including global dynamics such as diurnal behavior [ 14 ].”
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic (2008, methodology): “Dagon et al. [ 10 ] studied the global diurnal behavior of botnets using DNS based detection and sink-holing technique.”
Peer-to-Peer Botnets: Overview and Case Study (2007, background): “Based on this review of historical trends, we believe that peer-to-peer botnets will be one of the most significant threats on the Internet in the near future.”
An Advanced Hybrid Peer-to-Peer Botnet (2007, methodology): “at an optimal release time to maximize its propagation speed [4].”
A multifaceted approach to understanding the botnet phenomenon (2006, background): “[6] reported botnets exhibiting this same behavior with a footprint of up to 350,000 infected machines.”
Detecting Malware Domains at the Upper DNS Hierarchy (2011, background): “Several studies provide deep understanding behind the properties of malware propagation and botnet’s life-time [7, 25, 29].”