Botgraph: Large scale spamming botnet detection

Proceedings of the 6th USENIX Symposium on Networked Systems Design and Implementation, NSDI 2009

Volumn , Issue , 2009, Pages 321-334

  Zhao, Yao ^a   Xie, Yinglian ^b   Yu, Fang ^b   Ke, Qifa ^b   Yu, Yuan ^b   Chen, Yan ^a   Gillum, Eliot ^c  

^a NORTHWESTERN UNIVERSITY   (United States)

^b MICROSOFT RESEARCH   (United States)

^c MICROSOFT   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

GRAPHIC METHODS; LARGE DATASET; NETWORK SECURITY; SPAMMING; SYSTEMS ANALYSIS;

ABNORMAL PATTERNS; COMPUTER CLUSTERS; CONNECTED SUBGRAPH; DESIGN AND IMPLEMENTS; DISTRIBUTED APPLICATIONS; FALSE POSITIVE RATES; PERFORMANCE OPTIMIZATIONS; SECURITY APPLICATION;

BOTNET;

EID: 79954733367     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (29)

1. D. S. Anderson, C. Fleizach, S. Savage, and G. M. Voelker. Spamscatter: Characterizing internet scam hosting infrastructure. In USENIX Security Symposium, 2007.
2. Apache. Hadoop. http://lucene.apache.org/hadoop/.
3. http://blogs.zdnet.com/security/?p= 1835.
4. K. Chiang and L. Lloyd. A case study of the rustock rootkit and spam bot. In First workshop on hot topics in understanding botnets, 2007.
5. N. Daswani, M. Stoppelman, the Google Click Quality, and S. Teams. The anatomy of Clickbot.A. In First workshop on hot topics in understanding botnets, 2007.
6. J. Dean and S. Ghemawat. MapReduce: Simplified data processing on large clusters. In OSDI, 2004.
7. R. Durrett. Random graph dynamics. Cambridge University Press, 2006.
8. G. Gu, J. Zhang, and W. Lee. Botsniffer: Detecting botnet command and control channels in network traffic. In NDSS, 2008.
9. T. Holz, M. Steiner, F. Dahl, E. W. Biersack, and F. Freiling. Measurements and mitigation of peer-to-peer-based botnets: A case study on storm worm. In LEET, 2008.
10. M. Isard, M. Budiu, Y. Yu, A. Birrell, and D. Fetterly. Dryad: Distributed data-parallel programs from sequential building blocks. In EuroSys, 2007.
11. C. Kanich, C. Kreibich, K. Levchenko, B. Enright, G. Voelker, V. Paxson, and S. Savage. Spamalytics: An empirical analysis of spam marketing conversion. In ACM CCS, 2008.
12. B. Krishnamurthy, S. Sen, Y. Zhang, and Y. Chen. Sketch-based change detection: Methods, evaluation, and applications. In ACM SIGCOMM IMC, 2003.
13. Moving average. http://en.wikipedia.org/wiki/Moving average.
14. Message passing interface. http://www-unix.mcs.anl.gov/mpi/.
15. Massive parallel processing. http://en.wikipedia.org/wiki/Massive parallelism.
16. C. Olston, B. Reed, U. Srivastava, R. Kumar, and A. Tomkins. Pig latin: A not-so-foreign language for data processing. In ACM SIGMOD, 2008.
17. M. T. Ozsu and P. Valduriez. Principles of Distributed Database Systems (2nd edition). Prentice-Hall, 1999.
18. R. Pike, S. Dorward, R. Griesemer, and S. Quinla. Interpreting the data: Parallel analysis with sawzall. Scientific Programming Journal, 13(4), 2005.
19. P. Porras, H. Saidi, and V. Yegneswaran. A multiperspective analysis of the storm (peacomm) worm. Technical report, SRI Computer Science Laboratory, 2007.
20. H. Project and R. Alliance. Know your enemy: Tracking botnets. http://www.honeynet.org/papers/bots/, 2005.
21. Parallel virtual machine. http://www.csm.ornl.gov/pvm/.
22. M. A. Rajab, J. Zarfoss, F. Monrose, and A. Terzis. A multifaceted approach to understanding the botnet phenomenon. In IMC, 2006.
23. A. Ramachandran and N. Feamster. Understanding the network-level behavior of spammers. In ACM SIGCOMM, 2006.
24. A. Ramachandran, N. Feamster, and S. Vempala. Filtering spam with behavioral blacklisting. In ACM CCS, 2007.
25. http://news.bitdefender.com/NW544-en-\ --Trojan-Now-Uses-Hotmail-Gmail-as\ -Spam-Hosts.html.
26. Y. Xie, F. Yu, K. Achan, E. Gillum, M. Goldszmidt, and T. Wobber. How dynamic are ip addresses? In ACM SIGCOMM, 2007.
27. Y. Xie, F. Yu, K. Achan, R. Panigrahy, G. Hulten, and I. Osipkov. Spamming botnets: Signatures and characteristics. In SIGCOMM, 2008.
28. H.-C. Yang, A. Dasdan, R.-L. Hsiao, and D. S. Parker. Map-Reduce-Merge: Simplified relational data processing on large clusters. In ACM SIGMOD, 2007.
29. Y. Yu, M. Isard, D. Fetterly, M. Budiu, U. Erlingsson, P. K. Gunda, and J. Currey. DryadLINQ: A system for general-purpose distributed data-parallel computing using a high-level language. In OSDI, 2008.