BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection

By Guofei Gu, Roberto Perdisci, Junjie Zhang, Wenke Lee. 2008

1,251 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Understanding the Mirai Botnet (2017, background): “focused on analyzing network traffic to aid in detection and mitigation [32,33].”
An Overview of IP Flow-Based Intrusion Detection (2010, unknown): “[78] anomaly passive real-time centralized centralized”
Machine Learning for Encrypted Malware Traffic Classification: Accounting for Noisy Labels and Non-Stationarity (2017, background): “While not applied directly to detecting threats in encrypted tra c, this basic formula of machine learning and network metadata has been well-researched [6, 24, 31].”
Detecting algorithmically generated malicious domain names (2010, methodology): “With regards to botnet detection, [14, 15] perform correlation of network activity in time and space at campus network edges, and Xie et al in [33] focus on detecting spamming botnets by developing regular expression based signatures from a dataset of spam URLs .”
BotGrep: Finding P2P Bots with Structured Graph Analysis (2010, methodology): “However, growing size of botnets, as well as the development of mechanisms that detect centralized command-and-control servers [10, 44, 27, 31, 72, 9, 49, 30, 29, 76], has motivated the design of decentralized peer-to-peer botnets.”
Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data (2014, background): “, BotMiner[16], BotSniffer[18] and TAMD [42]) typically detect clusters of multiple synchronized hosts infected by the same malware.”
DDoS Attack Detection and Mitigation Using SDN: Methods, Practices, and Solutions (2017, methodology): “For instance, BotMiner is an application which is built upon the FRESCO framework [62].”
Differential privacy for collaborative security (2010, background): “Intrusion detection systems (IDS) use extensive logging and data collection to identify anomalous behavior and to verify it as botnet activity [2, 7, 12, 13 , 14, 15, 20, 22, 29].”
Detecting and Preventing Cyber Insider Threats: A Survey (2018, background): “it can still work properly even if some of the nodes have been taken down [36], [37].”
Your botnet is my botnet: analysis of a botnet takeover (2009, background): “Given the importance of the problem, significant research effort has been invested to gain a better understanding of the botnet phenomenon [8,29], to study the modus operandi of cyber criminals [19,22], and to develop effective mitigation techniques [ 10 , 11].”
Effective and Efficient Malware Detection at the End Host (2009, background): “For example, there are systems [ 19 , 38] that detect bots based on similar connections.”