On the detection and identification of botnets

Computers and Security

Volumn 29, Issue 1, 2010, Pages 45-58

  Seewald, Alexander K ^a   Gansterer, Wilfried N ^b  

^a Seewald Solutions   (Austria)

^b UNIVERSITY OF VIENNA   (Austria)

Author keywords

Botnet; E mail spam; IT security; Machine learning; Traffic analysis

Indexed keywords

ACCESS PATTERNS; BOTNETS; DARKNET; E-MAIL SPAM; HUMAN EXPERTISE; IT SECURITY; MACHINE-LEARNING; NETWORK TRAFFIC; ON-MACHINES; PASSIVE SYSTEMS; PROTOCOL LEVEL; REAL LIFE DATA; SELF-ADAPTIVE SYSTEM; TRAFFIC ANALYSIS; TRAFFIC DATA;

ADAPTIVE SYSTEMS; INTERNET PROTOCOLS; LEARNING ALGORITHMS; NETWORK PROTOCOLS; NETWORK SECURITY; ROBOT LEARNING; SECURITY SYSTEMS; SPAMMING;

INTERNET;

EID: 71649087916     PISSN: 01674048     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.cose.2009.07.007     Document Type: Article

References (27)

1. Bailey M, Cooke E, Jahanian F, Nazario J, Watson D. The internet motion sensor: a distributed blackhole monitoring system. In: Proceedings of the 12th annual symposium on network and distributed system security (NDSS 2005), San Diego, California.
2. Borg I., and Groenen P. Modern multidimensional scaling (1997), Springer-Verlag, New York
3. Collins M.P., Shimeall T.J., Faber S., Janies J., Weaver R., De Shon M., et al. Using uncleanliness to predict future botnet addresses. IMC '07. Proceedings of the 7th ACM SIGCOMM conference on internet measurement. October 24-26, 2007, San Diego, California, USA (2007), ACM, New York, NY 93-104. http://doi.acm.org/10.1145/1298306.1298319
4. Cormack G.V. Email spam filtering: a systematic review. Foundations and Trends in Information Retrieval 1 4 (2006) 335-355
5. Dagon D, Zou C, Lee W. Modeling botnet propagation using time zones. In 13th annual symposium on network and distributed system security (NDSS 2006), San Diego, California, USA; 2006.
6. Dagon D, Gu G, Zou C, Grizzard J, Dwivedi S, Lee W, et al. A taxonomy of botnets. Unpublished report; 2005. http://www.math.tulane.edu/∼tcsem/botnets/ndss_botax.pdf.
7. Daley D.J., and Gani J. Epidemic modeling: an introduction (1999), Cambridge University Press
8. Dhamankar R, King R. Protocol identification via statistical analysis (PISA). Black Hat, Las Vegas, USA; 2007.
9. Gansterer WN, Pölz D. E-mail classification for phishing defense. In Proceedings of the 31st European conference on information retrieval (5478); 2009. p. 449-60.
10. Gansterer W.N., Janecek A.G.K., and Lechner P. A reliable component-based architecture for e-mail filtering. Proceedings of the ARES international conference on availability, reliability and security 2007 (2007), IEEE Computer Society, Washington, D.C. 43-52
11. Gauthronet S, Drouard E. Unsolicited commercial communications and data protection. Technical report, Commission of the European Communities; 2001.
12. Janecek A.G.K., Gansterer W.N., and Kumar K.A. Multi-level reputation-based greylisting. Proceedings of the ARES international conference on availability, reliability and security (2008), IEEE Computer Society, Washington, D.C. 10-17
13. Karasaridis A, Rexroad B, Hoeflin D. Wide-scale botnet detection and characterization. In First workshop on hot topics in understanding botnets (HotBots '07), Cambridge, MA, USA; 2007.
14. Levenshtein V.I. Binary codes capable of correcting deletions, insertions, and reversals. Soviet Physics - Doklady 10 (1966) 707-710
15. National Infrastructure Security Co-ordination Centre (NISCC). Botnets - the threat to the critical national infrastructure. NISCC Monthly Bulletin, London, October 17, 2005.
16. Rajab MA, Zarfoss J, Monrose F, Terzis A. A multifaceted approach to understanding the botnet phenomenon. In Proceedings of the 6th ACM SIGCOMM conference on internet measurement (IMC 2006), Rio De Janeiro, Brazil; 2006. p. 41-52.
17. Ramachandran A, Feamster N, Dagon D. Revealing botnet membership using DNSBL counter-intelligence. In Proceedings of the 2nd workshop on steps to reducing unwanted traffic on the internet (SRUTI 2006), San Jose, California, USA; 2006.
18. Register of Known Spam Operations (ROKSO) Database. Operated by the Spamhaus Project. http://www.spamhaus.org/rokso/index.lasso [accessed 10.03.09]
19. Sammon J.W. A nonlinear mapping for data structure analysis. IEEE Transactions on Computers C-18 (1969) 401-409
20. Seewald A.K., and Kleedorfer F. An approximation of the string subsequence kernel for practical SVM classification and redundancy clustering. Advances in Data Analysis and Classification 1 3 (December 2007) 221-239 10.1007/s11634-007-0012-1
21. Seewald A.K. An evaluation of Naive Bayes variants in content-based learning for spam filtering. Intelligent Data Analysis 11 5 (2007) 497-524
22. Seewald AK. Towards automating malware classification and characterization. In Konferenzband der 4. Jahrestagung des Fachbereichs Sicherheit der Gesellschaft für Informatik [German-language proceedings], Saabrücken; April 2008. p. 291-302.
23. Stampfel G., Gansterer W.N., and Ilger M. Data retention - the EU Directive 2006/24/EC from a technological perspective (2008), Medien und Recht. 978-3-900741-53-2
24. Stampfel G, Gansterer WN, Ilger M. Implications of the EU Data Retention Directive 2006/24/EC. In Proceedings of Sicherheit P-128. Springer lecture notes in informatics; 2008b. p. 45-58.
25. Stark K., Stampfel G., and Gansterer W.N. A distributed data warehouse for e-mail data retention. Proceedings of the 4th international conference on e-government (ICEG08) (2008), Academic Publishing Limited 413-422 ISBN 978-1-906638-20-7
26. US-CERT Vulnerability Note VU#800113. http://www.kb.cert.org/vuls/id/800113 [accessed 10.03.09]
27. Xie Y, Yu F, Achan K, Gillum E, Goldszmidt M, Wobber T. How dynamic are IP addresses. In Proceedings of SIGCOMM '07, August 27-31, 2007, Kyoto, Japan.