A multifaceted approach to understanding the botnet phenomenon

By Moheeb Abu Rajab, Jay Zarfoss, Fabian Monrose, Andreas F. Terzis. ACM/SIGCOMM Internet Measurement Conference, 2006

702 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/da094c4a916b3ca6d4607a0110084464edefba8a

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

Your botnet is my botnet: analysis of a botnet takeover (2009, background): “These approaches are modeled after the characteristics of the botnet under study and vary along different axes, depending on whether they have access to direct traces of infected machines [6] or have to resort to indirect measurements [11, 34, 35, 37], whether they have a complete or partial view of”
Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm (2008, background): “We were able to infiltrate and analyze in-depth the botnet, which allows us to estimate the total number of compromised machines.”
Detecting Malware Domains at the Upper DNS Hierarchy (2011, background): “For example, botnets [1,21,27] and other types of malicious software make use of domain names to locate their command and control (C&C) servers and communicate with attackers, e.g., to ex-ﬁltrate stolen private information, wait for commands to perform attacks on other victim machines, etc.”
BotGrep: Finding P2P Bots with Structured Graph Analysis (2010, methodology): “…several studies of botnet propagation and dynamics using Hon-eypots; Barford and Yegneswaran [8] collected bot samples and carried out a detailed study on the source code of several families; ﬁnally, Freiling et al. [24] and Rajab et al. [59] carried out measurement studies using Honey-pots.”
Understanding the Mirai Botnet (2017, background): “, implicating botnet activity in 27% of all network telescope traffic, inspire our approach [2].”
Wide-Scale Botnet Detection and Characterization (2007, background): “Other detection approaches involve the setup of honeypots and the analysis of the captured malware to identify controllers [3,9].”
A Survey of Botnet and Botnet Detection (2009, background): “Differences in time zones, languages, and laws make it difficult to track malicious botnet activities across international boundaries [2, 5].”
Disclosure: detecting botnet command and control servers through large-scale NetFlow analysis (2012, background): “Botnet-related research can be divided to two groups: work that focuses on the measuring botnets [11,15,20,27] and work that focuses on detecting them [6,16–19,21,29,32].”
A Taxonomy of Botnet Structures (2007, methodology): “In [17, 46], the authors used honeynets to track existing IRC-based botnets and report a few simple statistics about botnets.”
Effective and Efficient Malware Detection at the End Host (2009, background): “There is a large number of previous work that studies the behavior [34, 37, 42] or the prevalence [31, 35] of different types of malware.”
BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection (2008, methodology): “To collect and analyze bots, researchers widely utilize honeypot techniques [4, 16, 32].”
All Your iFRAMEs Point to Us (2008, result): “As a number of earlier studies have already shown (e.g., [6, 19, 8, 21 , 22, 12]), the IRC connection attempts are most likely for unwillingly (to the owner) adding the compromised machine to an IRC botnet, confirming the earlier conjecture by Provos et al. [20] regarding the connection between web”
Peer-to-Peer Botnets: Overview and Case Study (2007, methodology): “presented a measurement methodology that can be used to study botnets [10].”
Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks (2013, background): “Other works focus on tracking and measuring botnets [4, 14, 17, 22, 34].”