BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic

By Guofei Gu, Junjie Zhang, Wenke Lee. 2008

944 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Poisoning behavioral malware clustering (2014, positive): “correlate spatial-temporal relations in botnet communication using clustering [14].”
From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware (2012, background): “Half of them are variants of known (botnet) DGAs, and the other half are brand new DGAs that have never been reported before.”
A Survey of Botnet and Botnet Detection (2009, methodology): “Botminer is an improvement of Botsniffer [26].”
Deep Neural Networks for Bot Detection (2018, unknown): “s for Bot Detection WWW’18, April 2018, Lyon, France behind the scenes in a command-and-control fashion, in analogy to traditional botnets used to deploy cyber attacks and other cybersecurity threats [25], as demonstrated on Twitter as well [1, 16]. Much work on bot detection assumes extensive acces”
Attacks against process control systems: risk assessment, detection, and response (2011, methodology): “SPRT has been widely used in various problems in information security such as detecting portscans [55], worms [56], proxies used by spammers [57], and botnets [58].”
Detecting and Preventing Cyber Insider Threats: A Survey (2018, background): “[101] propose a scheme that aims at IRC and HTTP-based botnets at the same time.”
Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data (2014, background): “, BotMiner[16], BotSniffer[18] and TAMD [42]) typically detect clusters of multiple synchronized hosts infected by the same malware.”
NICE: Network Intrusion Detection and Countermeasure Selection in Virtual Network Systems (2013, background): “BotSniffer [8] exploits uniform spatial-temporal behavior characteristics of compromised machines to detect zombies by grouping flows according to server connections and searching for similar behavior in the flow.”
Detecting algorithmically generated malicious domain names (2010, methodology): “With regards to botnet detection, [14, 15] perform correlation of network activity in time and space at campus network edges, and Xie et al in [33] focus on detecting spamming botnets by developing regular expression based signatures from a dataset of spam URLs .”
Understanding the Mirai Botnet (2017, background): “focused on analyzing network traffic to aid in detection and mitigation [32,33].”
BotGrep: Finding P2P Bots with Structured Graph Analysis (2010, background): “However, growing size of botnets, as well as the development of mechanisms that detect centralized command-and-control servers [10, 44, 27, 31, 72, 9, 49, 30, 29, 76], has motivated the design of decentralized peer-to-peer botnets.”