Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks

By Felix C. Freiling, Thorsten Holz, Georg Wicherski. European Symposium on Research in Computer Security, 2005

354 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/f413c85134fdef169c912388472e62b3b310d3ae

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Rishi: Identify Bot Contaminated Hosts by IRC Nickname Evaluation (2007, background): “When the analysis is finished, the final number of points for the nickname is stored along with the other information in the connection object.”
EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis (2011, neutral): “Note that researchers have used DNS before as a way to analyze, measure and estimate the size of existing botnets in the past (e.g., [21, 22, 34]).”
A Survey of Botnet and Botnet Detection (2009, background): “In addition, many papers [2, 6, 7, 13, 19, 20, 21, 22, 23] discussed how to use honeynets for botnet tracking and measurement.”
A Taxonomy of Botnet Structures (2007, methodology): “In [17, 46], the authors used honeynets to track existing IRC-based botnets and report a few simple statistics about botnets.”
The Nepenthes Platform: An Efficient Approach to Collect Malware (2006, background): “Step 3 in the whole process can be automated as outlined in [6]: we impersonate as a legal victim and inﬁltrate the network.”
An Advanced Hybrid Peer-to-Peer Botnet (2007, background): “, through honeypot joining the botnet [3], [6]), and then either shut it down or monitor the sensor host.”
Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks (2013, background): “Other works focus on tracking and measuring botnets [4, 14, 17, 22, 34].”
Your botnet is my botnet: analysis of a botnet takeover (2009, background): “These approaches are modeled after the characteristics of the botnet under study and vary along different axes, depending on whether they have access to direct traces of infected machines [6] or have to resort to indirect measurements [11, 34, 35, 37], whether they have a complete or partial view of”
Disclosure: detecting botnet command and control servers through large-scale NetFlow analysis (2012, background): “Botnet-related research can be divided to two groups: work that focuses on the measuring botnets [11,15,20,27] and work that focuses on detecting them [6,16–19,21,29,32].”
Measurements and Mitigation of Peer-to-Peer-based Botnets: A Case Study on Storm Worm (2008, methodology): “Furthermore, we present two different ways to disrupt the communication channel between controller and compromised machines in order to mitigate the botnet and evaluate the effectiveness of these mechanisms.”