An Algorithm for Anomaly-based Botnet Detection
By J. Binkley, Suresh Singh. Workshop on Steps to Reducing Unwanted Traffic on the Internet, 2006
351 citations recorded by the source corpus.
View Paper: https://www.semanticscholar.org/paper/fc7f268d9a4033d071d3fe3d422a49a03aa0f7b1
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
- Guofei Gu
- Roberto Perdisci
- Shishir Nagaraja
- Wenke Lee
- M. Feily
- Battista Biggio
- Engin Kirda
- Alina Oprea
Citations in the corpus
- Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks (2013, background): “For instance, several systems [10, 27, 35] use classification and correlation techniques to identify C&C traffic from IRC botnets.”
- Disclosure: detecting botnet command and control servers through large-scale NetFlow analysis (2012, background): “A number of systems focus on specific protocols such as IRC [6, 16, 32].”
- BotGrep: Finding P2P Bots with Structured Graph Analysis (2010, methodology): “However, growing size of botnets, as well as the development of mechanisms that detect centralized command-and-control servers [10, 44, 27, 31, 72, 9, 49, 30, 29, 76], has motivated the design of decentralized peer-to-peer botnets.”
- BotMiner: Clustering Analysis of Network Traffic for Protocol- and Structure-Independent Botnet Detection (2008, methodology): “Binkley and Singh [7] proposed combining IRC statistics and TCP work weight for the detection of IRC-based botnets.”
- A Survey of Botnet and Botnet Detection (2009, methodology): “This algorithm can also reveal bot servers [25].”
- An Advanced Hybrid Peer-to-Peer Botnet (2007, background): “Binkley and Singh [7] attempted to detect them through abnormal IRC channels.”
- BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation (2007, methodology): “Binkley and Singh [9] proposed an anomaly based system that combines IRC statistics and TCP work weight for detecting IRC-based botnets.”
- Rishi: Identify Bot Contaminated Hosts by IRC Nickname Evaluation (2007, methodology): “Another example is an expression like ˆ\[[0-9]{1, 2}\|[A-Z]{2,3}\|[0-9]{4,}\]$ which matches common bot nicknames like [00|DEU|597660], [03|USA|147700], or [0|KOR|43724] As all regular expressions are kept in a separate configuration file, existing ones can be easily adjusted or new ones can be adde”