The Zombie Roundup: Understanding, Detecting, and Disrupting Botnets

By Evan Cooke, Farnam Jahanian. Workshop on Steps to Reducing Unwanted Traffic on the Internet, 2005

621 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/e9ec77966d4fe3fe25a12574ff4c1f776b6b9f2b

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

BotGrep: Finding P2P Bots with Structured Graph Analysis (2010, unknown): “Cooke et al. [17] conducted several studies of botnet propagation and dynamics using Hon-eypots; Barford and Yegneswaran [8] collected bot samples and carried out a detailed study on the source code of several families; ﬁnally, Freiling et al. [24] and Rajab et al. [59] carried out measurement…”
All Your iFRAMEs Point to Us (2008, methodology): “Using a specialized machine-learning framework [ 7 ], we translate these features into a likelihood score.”
BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection (2008, background): “Cooke et al. [10] conducted several basic studies of botnet dynamics.”
Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm (2008, background): “We were able to infiltrate and analyze in-depth the botnet, which allows us to estimate the total number of compromised machines.”
A Taxonomy of Botnet Structures (2007, background): “An interesting early contribution in this area is [13], which listed three topologies (centralized, peer-to-peer, and random) for botnets , and roughly evaluated performance metrics in terms of high, medium and low performance.”
Peer-to-Peer Botnets: Overview and Case Study (2007, background): “This work highlights the underlying difficulties in monitoring the channel that may lead back to the bot controller [13].”
BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, background): “…are effectively a collection of slave computing and data assets to be sold or traded for a variety of illicit activities, including information and computing resource theft, SPAM production , hosting phishing attacks, or for mounting distributed denial-of-service (DDoS) attacks [12] [34] [20].”
Differential privacy for collaborative security (2010, background): “INTRODUCTION The constant evolution of the Internet has given rise to new distributed software systems supporting antisocial and criminal behaviors.”
An Inside Look at Botnets (2007, background): “discuss the potential of correlating data from multiple sources as a means for detecting the botnet command and co ntrol traffic in [12].”
A Survey of Botnet and Botnet Detection (2009, background): “Bot infection methods are similar to other classes of malware that recruit vulnerable systems by exploiting software vulnerabilities, trojan insertion, as well as social engineering techniques leading to download malicious bot code [4,6,7].”
Wide-Scale Botnet Detection and Characterization (2007, background): “In [7], it is suggested that the use of secondary bot behavior such as propagation and attacks should be used instead of trying to detect control traffic directly.”
BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic (2008, background): “Cooke et al. [ 9 ] studied several basic dynamics of botnets.”
An Algorithm for Anomaly-based Botnet Detection (2006, background): “Botnets [6] [5] are a current scourge of the Internet.”
EVILCOHORT: Detecting Communities of Malicious Accounts on Online Services (2015, background): “A large fraction of the malicious activity that occurs on online services is driven by bot-nets , networks of compromised computers acting under the control of the same cybercriminal [9].”
An Advanced Hybrid Peer-to-Peer Botnet (2007, background): “, through honeypot joining the botnet [3], [6]), and then either shut it down or monitor the sensor host.”
Disclosure: detecting botnet command and control servers through large-scale NetFlow analysis (2012, background): “This is significant because as botnets decrease in size [11], it becomes more difficult to protect small networks, and a botmaster can deliberately split infected machines within the same network range into different botnets.”
A multifaceted approach to understanding the botnet phenomenon (2006, methodology): “Cooke et al. presented an initial look at the prevalence of botnets by measuring the elapsed time before an un-patched system was infected by a botnet [ 5 ].”
Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks (2013, background): “Other works focus on tracking and measuring botnets [4, 14, 17, 22, 34].”