References

  1. SANS Institute Info Sec Reading Room provided a
  2. description on “Bot & Botnet: An overview,” research on
  3. topics in information security, 2003.
  4. H. Rouhani Zeidanloo, A. Bt Manaf, P. Vahdani, F.
  5. Tabatabaei, and M. Zamani, “Botnet Detection Based on
  6. Traffic Monitoring,” IEEE transaction, 2010.
  7. C. Li, W. Jiang, and X. Zou, “Botnet: Survey and Case
  8. Study,” 4th International Conference on Innovative
  9. Computing, Information and Control, 2009.
  10. Botnet s cams are exploding.
  11. http://www.contentagenda.com/articleXml/LN760999245.ht
  12. ml?industryid=45177.
  13. B. AsSadhan, J. Moura, D. Lapsley, C. Jones, and W.
  14. Strayer, “Detecting botnets using command and control
  15. traffic,” in: Eighth IEEE International Symposium on
  16. Network Computing and Applications, pp. 156–162, 2009.
  17. P. Bacher, T. Holz, M. Kotter, and G. Wicherski, “Know
  18. Your Enemy: Tracking Botnets (using honeynets to learn
  19. more about bots),” Technical Report, The Honeynet Project,
  20. T. M. S. Labs, “M86 Security, Spam Statistics,” 2011.
  21. .
  22. Z. Zhu, G. Lu, Y. Chen, Z. J. Fu, P. Roberts, and K. Han,
  23. “Botnet research survey, in: 32nd Annual IEEE,
  24. International Computer Software and Applications,”
  25. COMPSAC’08, pp. 967–972, 2008.
  26. M. Feily, A. Shahrestani, and S. Ramadass, “A survey of
  27. botnet and botnet detection,” in: Emerging Security
  28. Information, Systems and Technologies, SECURWARE ’09,
  29. Third International Conference on, pp. 268–273, 2009.
  30. Y. Shin and E. Im, “A survey of botnet: consequences,”
  31. defenses and challenges basic knowledge of botnet,
  32. Challenges, 2009.
  33. Symantec, “Spybot worm,” 2003.
  34. J. Liu, Y. Xiao, K. Ghaboosi, H. Deng, and J. Zhang,
  35. “Botnet: classification, attacks, detection, tracing, and
  36. preventive measures,” EURASIP Journal of Wireless
  37. Communication Networks, pp. 91–911, 2009.
  38. D. Plohmann, E. Gerhards-Padilla, and F. Leder, “Botnets:
  39. Detection, Measurement, Disinfection & Defence, Technical
  40. Report,” The European Network and Information Security
  41. Agency (ENISA), 2011.
  42. B. AsSadhan, J. Moura, D. Lapsley, C. Jones, and W.
  43. Strayer, “Detecting botnets using command and control
  44. traffic, in: Eighth IEEE International Symposium on
  45. Network Computing and Applications,” NCA, pp. 156–162,
  46. S. S. Garasia, D. P. Rana, and R. G. Mehta, “Http Botnet
  47. Detection Using Frequent Patterset Mining,” IJESAT, vol. 2,
  48. Issue-3, pp. 619 – 624, May – Jun 2012.
  49. M. M. Masud, J. Gao, L. Khan, J. Han, and B.
  50. Thuraisingham, “Mining Concept-Drifting Data Stream to
  51. Detect Peer to Peer Botnet Traffic,” ACM, 2012.
  52. S. S. C. Silva, R. M. P. Silva, R. C. G. Pinto, and R. M.
  53. Salles, “A Survey computer networks,” Elsevier, 2012.
  54. EggHeads, “EggHeads.org-eggdrop development,” 1993.
  55. .
  56. T. Micro, “Worm AgoBot,” 2004.
  57. trendmicro.com/ArchiveMalware.aspx?language=us
  58. &name=WORMAGOBOT.XE>.
  59. T. Micro, “Worm SDBot,” 2003.
  60. trendmicro.
  61. com/ArchiveMalware.aspx?language=us&name=WORMSD
  62. BOT. AZ>.
  63. J. B. Grizzard, V. Sharma, C. Nunnery, B. B Kang, and D.
  64. Dagon, “Peer-to-peer botnets: overview and case study, in:
  65. Proceedings of the First Conference on First Workshop on
  66. Hot Topics in Understanding Botnets,” USENIX
  67. Association, Berkeley, CA, USA, p. 1, 2007.
  68. S. S. C. Silva, R. M. P. Silva, R. C. G. Pinto, R. M. Salles,
  69. “A Survey computer networks,” Elsevier, 2012.
  70. M. Fossi, G. Y. Egan, K. Haley, E. Johnson, T. Mack, T.
  71. Adams, J. Blackbird, M. K. Low, D. Mazurek, D.
  72. McKinney, and P. Wood, “Symantec Internet Security
  73. Threat Report – Trends for 2010,” Technical Report Volume
  74. , Symantec, 2011.
  75. Freiling, C. Felix, T. Holz, and G. Wicherski, “Botnet
  76. tracking: Exploring a root-cause methodology to prevent
  77. distributed denial-of-service attacks,” European Symposium
  78. on Research in Computer Security, Springer Berlin
  79. Heidelberg, 2005.
  80. H. Choi, H. Lee, and H. Kim, “BotGAD: detecting botnets
  81. by capturing group activities in network traffic,” In:
  82. Proceedings of the Fourth International ICST Conference on
  83. communication System software and middleware,
  84. COMSWARE ’09, ACM, NewYork, NY, USA, pp. 21–28,
  85. M. A. Rajab, J. Zarfoss, F. Monrose, and A. Terzis, “A
  86. multifaceted approach to understanding the botnet
  87. phenomenon,” In: Proceedings of the 6th ACM SIGCOMM
  88. Conference on Internet Measurement, IMC’06, ACM, New
  89. York, NY, USA, pp. 41–52, 2006.
  90. R. Puri, Bots & Botnet: An Overview, SANS Institute
  91. InfoSec Reading Room, 2003.
  92. C. Schiller and J. Binkley, “Botnets: The Killer Web
  93. Applications,” Syngress Publishing, 2007.
  94. L. Liu, S. Chen, G. Yan, and Z. Zhang, “BotTracer:
  95. Execution-Based Bot- Like Malware Detection,” In: T. Wu,
  96. C. Lei, V. Rijmen, D. Lee (Eds.), Information Security,
  97. Lecture Notes in Computer Science, vol. 5222, Springer,
  98. Berlin/Heidelberg, pp. 97–113, 2008.
  99. T. Micro, “Taxonomy of Botnet Threats,” Technical Report,
  100. Trend Micro White Paper, 2006.
  101. E. Cooke, F. Jahanian, and D. McPherson, “The zombie
  102. roundup: understanding, detecting, and disrupting botnets,”
  103. In: Proceedings of the Steps to Reducing Unwanted Traffic
  104. on the Internet on Steps to Reducing Unwanted Traffic on
  105. the Internet Workshop, USENIX Association, Berkeley, CA,
  106. USA, p. 6, 2005.
  107. M. Jelasity and V. Bilicki, “Towards automated detection of
  108. peer-to-peer botnets: on the limits of local approaches,” In:
  109. USENIX Workshop on Large-Scale Exploits and Emergent
  110. Threats (LEET’09), USENIX Association, Boston, MA,
  111. P. Maymounkov and D. Mazi‘eres, “Kademlia: a peer-topeer
  112. information system based on the xor metric,” In:
  113. Revised Papers from the First International Workshop on
  114. Peer-to-Peer Systems, IPTPS’01, Springer-Verlag, London,
  115. UK, pp. 53–65, 2002.
  116. P. Wang, L. Wu, B. Aslam, C. Zou, “A systematic study on
  117. Peer-to-Peer botnets,” In: Proceedings of 18th International
  118. Conference on Computer Communications and Networks,
  119. ICCCN 2009, pp. 1–8, 2009.
  120. P. Wang, S. Sparks, and C. Zou, “An advanced hybrid peerto-
  121. peer botnet,” In First Workshop on Hot Topics in
  122. Understanding Botnets, 2007.
  123. J. B Grizzard, V. Sharma, C. Nunnery, B. B Kang, and D.
  124. Dagon, “Peer-to-peer botnets: overview and case study,” In:
  125. Proceedings of the First Conference on First Workshop on
  126. Hot Topics in Understanding Botnets, USENIX Association,
  127. Berkeley, CA, USA, p. 1, 2007.
  128. E. W. Middelesch, “Anonymous and hidden communication
  129. channels: a perspective on future developments,” 2015.
  130. H. R. Zeidanloo, M. J. Shooshtari, P. V. Amoli, M. Safari,
  131. and M. Zamani, “A taxonomy of botnet detection
  132. techniques, 3rd IEEE International Conference on Computer
  133. Science and Information Technology (ICCSIT),” vol. 2, pp.
  134. –162, 2010.
  135. F. C. Freiling, T. Holz, and G. Wicherski, “Botnet tracking:
  136. exploring a rootcause methodology to prevent distributed
  137. denial-of-service attacks,” Lecture Notes in Computer
  138. Science, vol. 3679, Springer, Berlin/Heidelberg, pp. 319–
  139. , 2005.
  140. P. Wurzinger, L. Bilge, T. Holz, J. Goebel, C. Kruegel, and
  141. E. Kirda, “Automatically generating models for botnet
  142. detection,” Lecture Notes in Computer Science, vol. 5789,
  143. Springer, Berlin/Heidelberg, pp. 232–249, 2009.
  144. J. Goebel and T. Holz, “Rishi: identify bot contaminated
  145. hosts by IRC nickname evaluation,” Proceedings of the first
  146. conference on First Workshop on Hot Topics in
  147. Understanding Botnets, USENIX Association, Berkeley,
  148. CA, USA, p. 8, 2007.
  149. Y. Kugisaki, Y. Kasahara, Y. Hori, and K. Sakurai, “Bot
  150. detection based ontraffic analysis,” The 2007 International
  151. Conference on Intelligent Pervasive Computing, IPC, pp.
  152. –306, 2007.
  153. J. R. Binkley and S. Singh, “An algorithm for anomalybased
  154. botnet detection,” Proceedings of the 2nd Conference
  155. on Steps to Reducing Unwanted Traffic on the Internet, vol.
  156. , USENIX Association, Berkeley, CA, USA, p. 7, 2006.
  157. G. Gu, V. Yegneswaran, P. Porras, J. Stoll, and W. Lee,
  158. “Active botnet probing to identify obscure command and
  159. control channels,” In: Computer Security Applications
  160. Conference, ACSAC’09, Annual, pp. 241–253, 2009.
  161. G. Gu, R. Perdisci, J. Zhang, and W. Lee, “BotMiner:
  162. clustering analysis of network traffic for protocol-and
  163. structure-independent botnet detection,” Proceedings of the
  164. th Conference on Security Symposium, USENIX
  165. Association, Berkeley, CA, USA, pp. 139– 154, 2008.
  166. A. Nappa, A. Fattori, M. Balduzzi, M. Dell’Amico, and L.
  167. Cavallaro, “Take a deep breath: a stealthy, resilient and costeffective
  168. botnet using skype,” Proceedings of the 7th
  169. International Conference on Detection of Intrusions and
  170. Malware, and Vulnerability Assessment, DIMVA’10,
  171. Springer-Verlag, Berlin, Heidelberg, pp. 81–100, 2010.
  172. H. Choi, H. Lee, and H. Kim, “BotGAD: detecting botnets
  173. by capturing group activities in network traffic,” Proceedings
  174. of the Fourth International ICST Conference on
  175. COMmunication System software and middlewaRE,
  176. COMSWARE ’09, ACM, New York, NY, USA, pp. 21–28,
  177. D. Dagon, C. Changchun Zou, and W. Lee. “Modeling
  178. Botnet Propagation Using Time Zones,” NDSS. vol. 6, 2006.
  179. A. Madhukar and C. Williamson, “A longitudinal study of
  180. p2p traffic classification,” 14th IEEE International
  181. Symposium on Modeling Analysis and Simulation, pp. 179-
  182. , 2006.
  183. J. Erman, A. Mahanti, M. Arlitt, and C. Williamson,
  184. “Identifying and discriminating between web and peer-topeer
  185. traffic in the network core,” Proceedings of the 16th
  186. International Conference on World Wide Web, WWW’07,
  187. ACM, New York, NY, USA, pp. 883–892, 2007.
  188. C. Livadas, R. Walsh, D. Lapsley, and W. Strayer, “Using
  189. Machine Learning Techniques to Identify Botnet Traffic,” In
  190. Proceedings of the 31st Annual IEEE Conference on Local
  191. Computer Networks, FL, USA, November 2006.
  192. J. Goebel and T. Holz, “Rishi: Identify Bot Contaminated
  193. Hosts by IRC Nickname Evaluation,” In Proceedings of the
  194. st Workshop on Hot Topics in Understanding Botnets,
  195. Cambridge, MA, USA, April 2007.
  196. W. Wang, B. Fang, Z. Zhang, and C. Li, “A novel approach
  197. to detect irc-based botnets,” In Proceedings of the
  198. International Conference on Networks Security, Wireless
  199. Communications and Trusted Computing, Wuhan, Hubei,
  200. China, April 2009.
  201. G. Gu, P. Porras, V. Yegneswaran, M. Fong, and W. Lee,
  202. “BotHunter: detecting malware infection through IDS-driven
  203. dialog correlation,” In: Proceedings of 16th USENIX
  204. Security Symposium on USENIX Security Symposium,
  205. USENIX Association, Berkeley, CA, USA, pp. 12:1–12:16,
  206. G. Gu, J. Zhang, and W. Lee, “BotSniffer – detecting botnet
  207. command and control channels in network traffic,” In: 15th
  208. Annual Network & Distributed System Security Symposium,
  209. The Internet Society (ISOC), San Diego, 2008.
  210. P. Wurzinger, L. Bilge, T. Holz, J. Goebel, C. Kruegel, and
  211. E. Kirda, “Automatically generating models for botnet
  212. detection”, in Proceedings of the 14th European Symposium
  213. on Research in Computer Security, Saint Malo, France,
  214. September 2009.
  215. I. Castle and E. Buckley, “The automatic Discovery,
  216. Identification and Measurement of Botnets,” In Proceedings
  217. of the 2nd International Conference on Emerging Security
  218. Information, Systems and Technologies, Cap Esterel, France,
  219. August 2008.
  220. Y. Zhao, Y. Xie, F. Yu, Q. Ke, Y. Yu, Y. Chen, and E.
  221. Gillum, “BotGraph: Large Scale Spamming Botnet
  222. Detection”, in Proceedings of the 6th USENIX Symposium
  223. on Networked Systems Design and Implementation, Boston,
  224. MA, USA, April 2009.
  225. S. Nagaraja, P. Mittal, C.-Y. Hong, M. Caesar, and N.
  226. Borisov, “Botgrep: finding p2p bots with structured graph
  227. analysis,” In: Proceedings of the 19th USENIX Conference
  228. on Security, USENIX Security’10, USENIX Association,
  229. Berkeley, CA.USA, p. 7, 2010.
  230. B. Shirley and C. D. Mano, “A Model for Covert Botnet
  231. Communication in a Private Subnet,” Networking 2008, pp.
  232. -632, 2008.
  233. A. Nappa, A. Fattori, M. Balduzzi, M. Dell’Amico, and L.
  234. Cavallaro, “Take a deep breath: a stealthy, resilient and costeffective
  235. botnet using skype,” In: Proceedings of the 7th
  236. International Conference on Detection of Intrusions and
  237. Malware, and Vulnerability Assessment, DIMVA’10,
  238. Springer-Verlag, Berlin, Heidelberg, pp. 81–100, 2010.
  239. T. Micro, “Taxonomy of Botnet Threats,” Technical Report,
  240. Trend Micro White Paper, 2006.
  241. E. Stinson and J. C. Mitchell, “Towards systematic
  242. evaluation of the evadability of bot/botnet detection
  243. methods, In: Proceedings of the 2nd Conference on USENIX
  244. Workshop on Offensive Technologies, USENIX
  245. Association, Berkeley, CA, USA, pp. 5:1–5:9, 2008.
  246. D. Zhang, C. Zheng, H. Zhang, and H. Yu, “Identification
  247. and analysis of skype peer-to-peer traffic,” In: Fifth
  248. International Conference on Internet and Web Applications
  249. and Services (ICIW), pp. 200– 206, 2010.
  250. J. Nazario and T. Holz, “As the net churns: fast-flux botnet
  251. observations,” In: 3rd International Conference on Malicious
  252. and Unwanted Software, MALWARE 2008, pp. 24–31,
  253. A. Caglayan, M. Toothaker, D. Drapaeau, D. Burke, and G.
  254. Eaton, “Behavioral analysis of fast flux service networks,”
  255. In: Proceedings of the 5th Annual Workshop on Cyber
  256. Security and Information Intelligence Research: Cyber
  257. Security and Information Intelligence Challenges and
  258. Strategies, CSIIRW’09, ACM, New York, NY, USA, pp.
  259. :1-48:4, 2009.
  260. T. M. S. Labs, “Security Labs Report January – June 2011
  261. Recap,” Technical Report, Security Labs, 2011.
  262. T. Barabosch, A. Wichmann, F. Leder, and E. Gerhards-
  263. Padilla, “Automatic Extraction of Domain Name Generation
  264. Algorithms from Current Malware,” In Proceedings of the
  265. NATO Symposium IST-111 on Information Assurance and
  266. Cyber Defense, Koblenz, Germany, September 2012.
  267. S. Yadav, A. K. Krishna Reddy, and A. L. Narasimha
  268. Reddy, “Detecting Algorithmically Generated Domain-flux
  269. Attacks with DNS Traffic Analysis,” IEEE/ACM
  270. Transactions on Networking, vol. 20, no.5, pp. 1663–1677,
  271. October 2012.
  272. B. Stone-Gross, M. Cova, B. Gilbert, L. Cavallaro, C.
  273. Kruegel, G. Vigna, and R. Kemmerer, “Your Botnet is My
  274. Botnet: Analysis of a Botnet Takeover,” In Proceedings of
  275. the 16th ACM Conference on Computer and
  276. Communications Security, pp. 635–647, Chicago, IN, USA,
  277. November 2009.
  278. R. sharifnia and M. Abadi, “A Novel Reputation System to
  279. DetectDGA-Based Botnets,” In proceeding of the 3th
  280. ICCKE, Mashhad 2013.
  281. S. Yadav and A. L. Narasimha Reddy, “Winning with DNS
  282. Failures: Strategies for Faster Botnet Detection,” In
  283. Proceedings of the 7th International ICST Conference on Seurity and Privacy in Communication Networks
  284. (SecureComm 2011), London, UK, 2011.
  285. H. Choi and H. Lee, “Identifying Botnets by Capturing
  286. Group Activities in DNS Traffic,” Computer Networks, vol.
  287. , no. 1, pp. 20–33, January 2012.
  288. C.-Y. Huang, “Effective Bot Host Detection Based on
  289. Network Failure Models,” Computer Networks, vol. 57, no.
  290. , pp. 514–525, February 2013.
  291. E. Kartaltepe, J. Morales, S. Xu, and R. Sandhu, “Social
  292. Network-Based botnet Command-and-Control: emerging
  293. threats and countermeasures,” In: J. Zhou, M. Yung (Eds.),
  294. Applied Cryptography and Network Security, Lecture Notes
  295. in Computer Science, vol. 6123, Springer,
  296. Berlin/Heidelberg, pp. 511–528, 2010.
  297. J. Baltazar, J. Costoya, and R. Flores, “The real face of
  298. koobface,” The largest web 2.0 botnet explained, In: Trend
  299. Micro Research, 2009.
  300. S. Nagaraja, A. Houmansadr, P. Piyawongwisal, V. Singh, P.
  301. Agarwal,and N. Borisov, “Stegobot: a covert social network
  302. botnet,” In: Information Hiding Conf. (IH), 2011.
  303. C. Serdar, C. E. Adviser-Brodley, and E. H. Adviser-
  304. Spafford, “Network covert channels: design, analysis,
  305. detection, and elimination,” 2006.
  306. Z. Sebastian, G. J. Armitage, and P. Branch, “A survey of
  307. covert channels and countermeasures in computer network
  308. protocols,” IEEE Communications Surveys and Tutorials
  309. 1-4, 2007.
Electronic and Cyber Defense
Volume 4, Issue 4 - Serial Number 4
January 2020
Pages 25-46

Files

History

  • Receive Date: 13 May 2013
  • Revise Date:
  • Accept Date: 19 September 2018
  • Publish Date: 19 February 2017

Share

How to cite

Statistics