Botnet detection techniques: review, future trends, and issues

Journal of Zhejiang University: Science C

Volumn 15, Issue 11, 2014, Pages 943-983

  Karim, Ahmad ^a   Salleh, Rosli Bin ^a   Shiraz, Muhammad ^a   Shah, Syed Adeel Ali ^a   Awan, Irfan ^b   Anuar, Nor Badrul ^a  

^a UNIVERSITY OF MALAYA   (Malaysia)

^b UNIVERSITY OF BRADFORD   (United Kingdom)

Author keywords

Anomaly detection; Attack; Botnet detection; Defense; Network security; Taxonomy

Indexed keywords

COMPUTER CRIME; CRIME; DENIAL-OF-SERVICE ATTACK; DISTRIBUTED COMPUTER SYSTEMS; INTERNET; NETWORK SECURITY; SECURITY OF DATA; TAXONOMIES;

ANOMALY DETECTION; ATTACK; BOTNET DETECTIONS; DEFENSE; DISTRIBUTED COMPUTING ENVIRONMENT; DISTRIBUTED COMPUTING PLATFORM; DISTRIBUTED DENIAL OF SERVICE ATTACK; STATE-OF-THE-ART TECHNIQUES;

MALWARE;

EID: 84920872753     PISSN: 18691951     EISSN: 1869196X     Source Type: Journal    
DOI: 10.1631/jzus.C1300242     Document Type: Review

References (217)

1. Abu Rajab, M., Zarfoss, J., Monrose, F., et al., 2006. Amultifaceted approach to understanding the botnet phenomenon. Proc. 6th ACM SIGCOMM Conf. on Internet Measurement, p.41–52.
2. Ahmed, R., Dharaskar, R.V., Thakare, V.M., 2013. Efficient generalized forensics framework for extraction and documentation of evidence from mobile devices. Int. J. Enhanced Res. Manag. Comput. Appl., 2(1):1–7.
3. Aviv, A.J., Haeberlen, A., 2011. Challenges in experimenting with botnet detection systems. USENIX 4th CSET Workshop, p.1–8.
4. Bailey, M., Cooke, E., Jahanian, F., et al., 2009. A survey of botnet technology and defenses. IEEE Cybersecurity Applications & Technology Conf. for Homeland Security, p.299–304. [doi:10.1109/CATCH.2009.40]
5. Barford, P., Yegneswaran, V., 2007. An inside look at botnets. In: Malware Detection. Springer, p.171–191. [doi:10.1007/978-0-387-44599-1_8]
6. Barsamian, A.V., 2009. Network Characterization for Botnet Detection Using Statistical-Behavioral Methods. Master Thesis, Dartmouth College.
7. Bauer, J., van Eeten, M., Chattopadhyay, T., 2008. ITU Study on the Financial Aspects of Network Security: Malware and Spam. Final Report, ICT Applications and Cybersecurity Division, International Telecommunication Union.
8. BBC, 2008. Technology Spam on Rise after Brief Reprieve. BBC News. Available from ://news.bbc.co.uk/2/hi/technology/7749835.stm [Accessed on Dec. 3, 2013].
9. Bethencourt, J., Franklin, J., Vernon, M., 2005. Mapping Internet sensors with probe response attacks. Proc. 14th USENIX Security Symp., p.193–208.
10. Bhuyan, M., Bhattacharyya, D., Kalita, J., 2013. Network anomaly detection: methods, systems and tools. IEEE Commun. Surv. Tutor., 16(1):1–24.
11. Binkley, J.R., Singh, S., 2006. An algorithm for anomaly-based botnet detection. Proc. USENIX Steps to Reducing Unwanted Traffic on the Internet Workshop, p.43–48.
12. Bu, Z., Bueno, P., Kashyap, R., et al., 2010. The New Era of Botnets. Available from ://.mcafee.com/in/resources/white-papers/wp-new-era-of-botnets.pdf [Accessed on Sept. 9, 2013].
13. Cai, T., Zou, F., 2012. Detecting botnet with clustering network traffic. IEEE 8th Int. Conf. on Wireless Communications, Networking and Mobile Computing, p.1–7.
14. Ceron, J.M., Granville, L.Z., Tarouco, L.M., 2008. Uma arquitetura baseada em assinaturas para mitiga cao de botnets. In: X Simposio Brasileiro em Seguran ca da Informa cao e de Sistemas Computacionais (SBSeg), p.105–118 (in Portuguese).
15. Chandola, V., Banerjee, A., Kumar, V., 2009. Anomaly detection: a survey. ACM Comput. Surv., 41(3):1–58.
16. Chang, S., Daniels, T.E., 2009. P2P botnet detection using behavior clustering & statistical tests. Proc. 2nd ACM Workshop on Security and Artificial Intelligence, p.23–30. [doi:10.1145/1654988.1654996]
17. Chen, C.M., Huang, M.Z., Ou, Y.H., 2013. Detecting web-based botnets with fast-flux domains. Advances in Intelligent Systems and Applications, Volume 2. Springer, p.79–89. [doi:10.1007/978-3-642-35473-1_9]
18. Chen, F., Ranjan, S., Tan, P., 2011. Detecting bots via incremental LS-SVM learning with dynamic feature adaptation. Proc. 17th ACM SIGKDD Int. Conf. on Knowledge Discovery and Data Mining, p.386–394.
19. Choi, H., Lee, H., Lee, H., et al., 2007. Botnet detection by monitoring group activities in DNS traffic. 7th IEEE Int. Conf. on Computer and Information Technology, p.715–720. [doi:10.1109/CIT.2007.90]
20. Choi, H., Lee, H., Kim, H., 2009. BotGAD: detecting botnets by capturing group activities in network traffic. Proc. 4th Int. ICST Conf. on Communication System Software and Middleware, p.1–8. [doi:10.1145/1621890.1621893]
21. Choi, Y.H., Li, L., Liu, P., et al., 2010. Worm virulence estimation for the containment of local worm outbreak. Comput. & Secur., 29(1):104–123. [doi:10.1016/j.cose.2009.07.002]
22. Comazzetto, A., 2011. Botnets: the Dark Side of Cloud Computing. Technical Report, Bostan, USA.
23. Constantin, L., 2013. Microsoft: Almost 90 Percent of Citadel Botnets in the World Disrupted in June. Available from ://.pcworld.com/article/2045282/microsoft-almost-90-percent-of-citadel-botnets-in-the-world-disrupted-injune.html [Accessed on July 6, 2013].
24. Constantinou, F., Mavrommatis, P., 2006. Identifying known and unknown peer-to-peer traffic. 5th IEEE Int. Symp. on Network Computing and Applications, p.93–102. [doi:10.1109/NCA.2006.34]
25. Cooke, E., Jahanian, F., McPherson, D., 2005. The zombie roundup: understanding, detecting, and disrupting botnets. Proc. USENIX SRUTI Workshop, p.44.
26. Coskun, B., Dietrich, S., Memon, N., 2010. Friends of an enemy: identifying local members of peer-to-peer botnets using mutual contacts. Proc. 26th Annual Computer Security Applications Conf., p.131–140. [doi:10.1145/1920261.1920283]
27. Cranor, C.D., Gansner, E., Krishnamurthy, B., et al., 2001. Characterizing large DNS traces using graphs. Proc. 1st ACM SIGCOMM Workshop on Internet Measurement, p.55–67. [doi:10.1145/505202.505210]
28. Creech, G., Hu, J., 2013. A semantic approach to host-based intrusion detection systems using contiguous and discontiguous system call patterns. IEEE Trans. Comput., 1(1):1–23.
29. Cremonini, M., Riccardi, M., 2009. The Dorothy project: an open botnet analysis framework for automatic tracking and activity visualization. IEEE European Conf. on Computer Network Defense, p.52–54.
30. Crowfoot, S., 2012. Trojan.Bredolab Spreading in PDF Download. Available from ://.iceni.com/blog/trojan-bredolab-spreading-in-pdf-download/ [Accessed on Oct. 4, 2014].
31. Cui, X., Fang, B., Yin, L., Xiang, C., et al., 2011. Andbot: towards advanced mobile botnets. Proc. 4th USENIX Conf. on Large-Scale Exploits and Emergent Threats, p.11.
32. Dagon, D., Zou, C.C., Lee, W., 2006. Modeling botnet propagation using time zones. NDSS, 6:2–13.
33. Dagon, D., Gu, G., Lee, C.P., et al., 2007. A taxonomy of botnet structures. IEEE 23rd Annual Computer Security Applications Conf., p.325–339.
34. Danchev, D., 2009. Research: Small DIY Botnets Prevalent in Enterprise Networks. Available from ://.zdnet.com/blog/security/research-small-diy-botnets-prevalentin-enterprise-networks/4485 [Accessed on Oct. 13, 2014].
35. Davis, C.R., Fernandez, J.M., Neville, S., et al., 2008. Sybil attacks as a mitigation strategy against the Storm botnet. IEEE 3rd Int. Conf. on Malicious and Unwanted Software, p.32–40.
36. di Pietro, R., Mancini, L.V., 2008. Intrusion Detection Systems. Springer.
37. Douceur, J.R., 2002. The sybil attack. In: Peer-to-Peer Systems. Springer Berlin Heidelberg, p.251–260. [doi:10.1007/3-540-45748-8_24]
38. Emre, Y., 2011. A literature survey about recent botnet trends, p.1–14.
39. Erman, J., Mahanti, A., Arlitt, M., et al., 2007. Identifying and discriminating between web and peer-to-peer traffic in the network core. Proc. 16th Int. Conf. on World Wide Web, p.883–892. [doi:10.1145/1242572.1242692]
40. Falliere, N., 2011. Sality: Story of a Peer-to-Peer Viral Network. Symantic Security Response, Technical Report.
41. Falliere, N., Murchu, L.O., Chien, E., 2011. W32.Stuxnet Dossier, Version 1.4. White Paper, Symantec Security Response.
42. FBI, 2012. FBI, International Law Enforcement Disrupt International Organized Cyber Crime Ring Related to Butterfly Botnet.
43. Feily, M., Shahrestani, A., Ramadass, S., 2009. A survey of botnet and botnet detection. IEEE 3rd Int. Conf. on Emerging Security Information, Systems and Technologies, p.268–273.
44. Fogarty, K., 2011. Just What We Need: Malware to Slave Your Android to a Botnet. IT World. Available from ://.itworld.com/article/2732959/mobile/just-whatwe-need—malware-to-slave-your-android-to-a-botnet.html [Accessed on June 20, 2014].
45. Forristal, J., 2013. Uncovering Android Master Key That Makes 99% of Devices Vulnerable. Available from s://bluebox.com/technical/uncovering-android-masterkey-that-makes-99-of-devices-vulnerable/ [Accessed on Oct. 4, 2014].
46. Fossi, M., Egan, G., Haley, K., et al., 2011. Symantec Internet Security Threat Report Trends for 2010. Symantec Internet Security Threat Report, Volume 16, p.1–20.
47. Francia, R., 2007. Storm Worm Network Shrinks to About One-Tenth of Its Former Size. Tech. Blorge. Com., p.10–21.
48. François, J., Wang, S., Engel, T., 2011. BotTrack: tracking botnets using NetFlow and PageRank. NETWORKING, p.1–14.
49. Freiling, F.C., Holz, T., Wicherski, G., 2005. Botnet tracking: exploring a root-cause methodology to prevent distributed denial-of-service attacks. Springer Berlin Heidelberg, p.319–335.
50. Ge, L., Liu, H., Zhang, D., et al., 2012. On effective sampling techniques for host-based intrusion detection in MANET. IEEE Military Communications Conf., p.1–6.
51. Gilbertson, S., 2013. Massive WordPress Attack Targets Weak Admin Passwords. Available from ://.webmonkey.com/2013/04/massive-wordpress-attack-targets-weak-admin-passwords [Accessed on Sept. 8, 2013].
52. Goebel, J., Holz, T., 2007. Rishi: identify bot contaminated hosts by irc nickname evaluation. Proc. 1st Conf. on 1st Workshop on Hot Topics in Understanding Botnets, p.1–12.
53. Goodin, D., 2008. Botnet Sics Zombie Soldiers on Gimpy Websites. Available from ://.theregister.co.uk/2008/05/14/asprox_attacks_websites/ [Accessed on June 6, 2013].
54. Goodin, D., 2010. Waledac Botnet ‘Decimated’ by MS Takedown. Available from ://.theregister.co.uk/2010/03/16/waledac_takedown_success/ [Accessed on June 8, 2013].
55. Grizzard, J., Sharma, V., Nunnery, C., 2007. Peer-to-peer botnets: overview and case study. Proc. 1st USENIX Workshop on Hot Topics in Understanding Botnets, p.1.
56. Gu, G., Porras, P., Yegneswaran, V., et al., 2007. Bothunter: detecting malware infection through IDS-driven dialog correlation. Proc. 16th USENIX Security Symp., p.167–182.
57. Gu, G., Zhang, J., Lee, W., 2008a. BotSniffer: detecting botnet command and control channels in network traffic. Proc. 15th Annual Network and Distributed System Security Symp., p.2–19.
58. Gu, G., Perdisci, R., Zhang, J., et al., 2008b. BotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection. USENIX Security Symp., p.139–154.
59. Gu, G., Yegneswaran, V., Porras, P., et al., 2009. Active botnet probing to identify obscure command and control channels. IEEE Annual Computer Security Applications Conf., p.241–253.
60. Ha, D.T., Yan, G., Eidenbenz, S., et al., 2009. On the effectiveness of structural detection and defense against P2P-based botnets. IEEE/IFIP Int. Conf. on Dependable Systems & Networks, p.297–306.
61. Holz, T., Steiner, M., Dahl, F., et al., 2008. Measurements and mitigation of peer-to-peer-based botnets: a case study on Storm worm. LEET, 8(1):1–9.
62. Huang, S.Y., Mao, C.H., Lee, H.M., 2010. Fast-flux service network detection based on spatial snapshot mechanism for delay-free detection. Proc. 5th ACM Symp. on Information, Computer and Communications Security, p.101–111.
63. Husna, H., Phithakkitnukoon, S., Palla, S., et al., 2008. Behavior analysis of spam botnets. IEEE 3rd Int. Conf. on Communication Systems Software and Middleware and Workshops, p.246–253.
64. Ianelli, N., Hackworth, A., 2005. Botnets as a vehicle for online crime. CERT Coordination Center, 1(1):28.
65. Iliofotou, M., Pappu, P., Faloutsos, M., et al., 2007. Network monitoring using traffic dispersion graphs (TDGS). Proc. 7th ACM SIGCOMM Conf. on Internet Measurement, p.315–320. [doi:10.1145/1298306.1298349]
66. Jackson, K., 2008. New Massive Botnet Twice the Size of Storm. Available from ://.darkreading.com/security/news/211201307 [Accessed on May 5, 2014].
67. Janssen, C., 2011. Global Threat Bot (GTbot). Available from ://.techopedia.com/definition/59/global-threat-bot-gtbot [Accessed on May 6, 2014].
68. Jelasity, M., Bilicki, V., Kasza, M., 2011. Modeling network-level impacts of P2P flows. 19th IEEE Euromicro Int. Conf. on Parallel, Distributed and Network-Based Processing, p.590–594.
69. Jian, G., Zheng, K., Yang, Y., et al., 2012. An evaluation model of botnet based on peer to peer. IEEE 4th Int. Conf. on Computational Intelligence and Communication Networks, p.925–929.
70. Jiang, N., Cao, J., Jin, Y., et al., 2010. Identifying suspicious activities through DNS failure graph analysis. 18th IEEE Int. Conf. on Network Protocols, p.144–153. [doi:10.1109/ICNP.2010.5762763]
71. Jing, L., Yang, X., Kaveh, G., et al., 2009. Botnet: classification, attacks, detection, tracing, and preventive measures. EURASIP J. Wirel. Commun. Network., 2009: 1–11.
72. John, J.P., Moshchuk, A., Gribble, S.D., et al., 2009. Studying spamming botnets using Botlab. NSDI, p.291–306.
73. Kaemarungsi, K., Yoskamtorn, N., Jirawannakool, K., et al., 2009. Botnet statistical analysis tool for limited resource computer emergency response team. IEEE 5th Int. Conf. on IT Security Incident Management and IT Forensics, p.27–40. [doi:10.1109/IMF.2009.13]
74. Kalt, C., 2000. Internet Relay Chat: Architecture. Available from ://tools.ietf.org/html/rfc2810 [Accessed on Oct. 20, 2013].
75. Kang, B.B., Chan-Tin, E., Lee, C.P., et al., 2009. Towards complete node enumeration in a peer-to-peer botnet. Proc. 4th Int. Symp. on Information, Computer, and Communications Security, p.23–34. [doi:10.1145/1533057.1533064]
76. Kang, J., Zhang, J.Y., 2009. Application entropy theory to detect new peer-to-peer botnet with multi-chart CUSUM. IEEE 2nd Int. Symp. on Electronic Commerce and Security, p.470–474.
77. Karagiannis, T., Broido, A., Brownlee, N., et al., 2003. File-sharing in the Internet: a characterization of P2P traffic in the backbone. Technical Report, University of California, Riverside, USA.
78. Karagiannis, T., Broido, A., Faloutsos, M., 2004. Transport layer identification of P2P traffic. Proc. 4th ACM SIGCOMM Conf. on Internet Measurement, p.121–134. [doi:10.1145/1028788.1028804]
79. Karagiannis, T., Papagiannaki, K., Faloutsos, M., 2005. BLINC: multilevel traffic classification in the dark. ACM SIGCOMM Comput. Commun. Rev., 35(4):229–240. [doi:10.1145/1090191.1080119]
80. Karasaridis, A., Rexroad, B., Hoeflin, D., 2007. Wide-scale botnet detection and characterization. Proc. first Conf. on 1st Workshop on Hot Topics in Understanding Botnets, p.1–8.
81. Kassner, M., 2003. The Top 10 Spam Botnets: New and Improved. Available from ://.techrepublic.com/blog/10-things/the-top-10-spam-botnets-new-and-improved/ [Accessed on June 6, 2013].
82. Keizer, G., 2008. Top Botnets Control 1M Hijacked Computers. Available from ://.computerworld.com/article/2536378/security0/top-botnets-control-1mhijacked-computers.html [Accessed on Sept. 8, 2013].
83. Kespersky, 2011. How to Detect and Remove the Rootkit TDL4. Available from ://infoaleph.wordpress.com/2011/07/03/como-detectar-y-borrar-el-rootkit-tdl4-tdssalureon/ [Accessed on June 20, 2013].
84. Kugisaki, Y., Kasahara, Y., Hori, Y., et al., 2007. Bot detection based on traffic analysis. IEEE Int. Conf. on Intelligent Pervasive Computing, p.303–306.
85. Lee, C.P., 2009. Framework for Botnet Emulation and Analysis. PhD Thesis, Georgia Institute of Technology.
86. Leonard, J., Xu, S., Sandhu, R., 2009. A first step towards characterizing stealthy botnets. IEEE Int. Conf. on Availability, Reliability and Security, p.106–113.
87. Li, C., Jiang, W., Zou, X., 2009. Botnet: survey and case study. IEEE 4th Int. Conf. on Innovative Computing, Information and Control, p.1184–1187.
88. Li, Z., Goyal, A., Chen, Y., et al., 2009. Automating analysis of large-scale botnet probing events. Proc. 4th Int. Symp. on Information, Computer, and Communications Security, p.11–22.
89. Liao, W.H., Chang, C.C., 2010. Peer to peer botnet detection using data mining scheme. IEEE Int. Conf. on Internet Technology and Applications, p.1–4.
90. Liu, D., Li, Y., Hu, Y., et al., 2010. A P2P-botnet detection model and algorithms based on network streams analysis. IEEE Int. Conf. on Future Information Technology and Management Engineering, p.55–58.
91. Liu, F., Li, Z., Nie, Q., 2009. A new method of P2P traffic identification based on support vector machine at the host level. IEEE Int. Conf. on Information Technology and Computer Science, p.579–582.
92. Liu, L., Chen, S., Yan, G., et al., 2008. BotTracer: execution-based bot-like malware detection. In: Information Security. Springer Berlin Heidelberg, p.97–113. [doi:10.1007/978-3-540-85886-7_7]
93. Livadas, C., Walsh, R., Lapsley, D., et al., 2006. Using machine learning technliques to identify botnet traffic. Proc. 31st IEEE Conf. on Local Computer Networks, p.967–974.
94. Lu, W., Ghorbani, A.A., 2008. Botnets detection based on IRC-community. IEEE Global Telecommunications Conf., p.1–5.
95. Lu, W., Tavallaee, M., Ghorbani, A., 2009a. Automatic discovery of botnet communities on large-scale communication networks. Proc. 4th Int. Symp. on Information, Computer, and Communications Security, p.1–10.
96. Lu, W., Tavallaee, M., Rammidi, G., et al., 2009b. BotCop: an online botnet traffic classifier. 7th IEEE Annual Communication Networks and Services Research Conf., p.70–77.
97. Madhukar, A., Williamson, C., 2006. A longitudinal study of P2P traffic classification. 14th IEEE Int. Symp. on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, p.179–188. [doi:10.1109/MASCOTS.2006.6]
98. Mador, Z., 2012. M86 Security Threat Report for the Second Half of 2011 is Now Available. Available from ://labs.m86security.com/2012/02/m86-security-threat-report-for-the-second-half-of-2011-is-now-available/ [Accessed on June 20, 2013].
99. Mansmann, F., Fischer, F., Keim, D.A., et al., 2009. Visual support for analyzing network traffic and intrusion detection events using TreeMap and graph representations. Proc. Symp. on Computer Human Interaction for the Management of Information Technology, p.3.
100. Marko, P., Vilhan, P., 2012. Efficient detection of malicious nodes based on DNS and statistical methods. IEEE 10th Int. Symp. on Applied Machine Intelligence and Informatics, p.227–230.
101. Marry, W., 2010. Pushdo Botnet. Available from ://msmvps.com/blogs/harrywaldron/archive/2010/02/02/pushdo-botnet-new-ddos-attacks-on-major-web-sites.aspx.
102. Marupally, P.R., Paruchuri, V., 2011. Comparative Analysis and Evaluation of Botnet Command and Control Models. 24th IEEE Int. Conf. on Advanced Information Networking and Applications, p.82–89.
103. Masud, M.M., Al-Khateeb, T., Khan, L., et al., 2008. Flow-based identification of botnet traffic by mining multiple log files. IEEE 1st Int. Conf. on Distributed Framework and Applications, p.200–206.
104. McCarty, B., 2003. Botnets: big and bigger. IEEE Secur. Priv., 1(4):87–90. [doi:10.1109/MSECP.2003.1219079]
105. McMillan, R., 2009. Experts Bicker over Conficker Numbers. Available from ://news.techworld.com/security/114307/experts-bicker-over-conficker-numbers/ [Accessed on Oct. 14, 2013].
106. McMillan, R., 2010. Spanish Police Take Down Massive Mariposa Botnet. Available from ://.pcworld.com/article/190634/article.html [Accessed on June 20, 2013].
107. Messmer, E., 2009. America’s 10 Most Wanted Botnets. Available from ://.networkworld.com/news/2009/072209-botnets.html [Accessed on June 20, 2013].
108. Miller, C., 2008. The Rustock Botnet Spams Again. SC Magazine, July 25.
109. Miller, C., 2009. Researchers Hijack Control of Torpig Botnet. Available from ://.scmagazine.com/researchers-hijack-control-of-torpig-botnet/article/136207/ [Accessed on June 2, 2013].
110. Mills, E., 2009. Experts: Gumblar Attack Is Alive, Worse than Conficker. Available from ://news.cnet.com/8301-1009_3-10251779-83.html [Accessed on Oct. 2, 2013].
111. Mockapetris, P., 1987. Domain Names-Concepts and Facilities. Available from ://tools.ietf.org/html/rfc1034 [Accessed on Dec. 5, 2013].
112. Morrison, T., 2012. Spam Botnets: the Fall of Grum and the Rise of Festi. Available from ://.spamhaus.org/news/article/685/ [Accessed on Dec. 12, 2013].
113. Moscaritolo, A., 2010. Kraken Botnet Re-emerges 318,000 Nodes Strong. Available from ://.scmagazineus.com [Accessed on Dec. 14, 2013].
114. Mukosaka, S., Koike, H., 2007. Integrated visualization system for monitoring security in large-scale local area network. IEEE 6th Int. Asia-Pacific Symp. on Visualization, p.41–44.
115. Mulliner, C., Seifert, J.P., 2010. Rise of the iBots: owning a telco network. IEEE 5th Int. Conf. on Malicious and Unwanted Software, p.71–80.
116. Murugan, S., Kuppusamy, K., 2011. System and methodology for unknown malware attack. IET Int. Conf. on Sustainable Energy and Intelligent Systems, p.803–804.
117. Musil, S., 2012. More than 600,000 Macs Infected with Flashback Botnet. Available from ://.cnet.com/news/more-than-600000-macs-infected-with-flashback-botnet/ [Accessed on Oct. 5, 2014].
118. Nagaraja, S., Mittal, P., Hong, C., et al., 2010. BotGrep: finding P2P bots with structured graph analysis. USENIX Security Symp., p.95–110.
119. Nazario, J., 2009. Politically motivated denial of service attacks. The Virtual Battlefield: Perspectives on Cyber Warfare, p.163–181.
120. Oberheide, J., Karir, M., Mao, Z., 2007. Characterizing dark DNS behavior. In: Detection of Intrusions and Malware, and Vulnerability Assessment. Springer, p.140–156. [doi:10.1007/978-3-540-73614-1_9]
121. Panda Security, 2013. Firewall: Prevent Unknown Connections Between the Network and the Internet. Available from ://.pandasecurity.com/enterprise/solutions/security-appliances/firewall [Accessed on Sept. 9, 2013].
122. Paranoid, 2004. The Dangers of S. Available from ://.wilderssecurity.com/threads/the-dangers-ofs.31087/ [Accessed on Oct. 5, 2013].
123. Paxton, N., Ahn, G.J., Chu, B., et al., 2007. Towards practical framework for collecting and analyzing network-centric attacks. IEEE Int. Conf. on Information Reuse and Integration, p.73–78. [doi:10.1109/IRI.2007.4296600]
124. Perdisci, R., Corona, I., Dagon, D., et al., 2009. Detecting malicious flux service networks through passive analysis of recursive dns traces. IEEE Annual Computer Security Applications Conf., p.311–320.
125. Pham, V.H., Dacier, M., 2011. Honeypot trace forensics: the observation viewpoint matters. Fut. Gener. Comput. Syst., 27(5):539–546. [doi:10.1016/j.future.2010.06.004]
126. Plohmann, D., Gerhards-Padilla, E., Leder, F., 2011. Botnets: Detection, Measurement, Disinfection & Defence. The European Network and Information Security Agency (ENISA).
127. Plohmann, D., Gerhards-Padilla, E., Leder, F., 2011. Botnets: 10 Tough Questions. Available from s://.enisa.europa.eu/activities/Resilience-and-CIIP/critical-applications/botnets/botnets-10-tough-questions [Accessed on Dec. 20, 2013].
128. Podrezov, A., 2013. F-Secure, Threat Description: Backdoor: W32/Agobot. Available from ://.f-secure.com/v-descs/agobot.shtml [Accessed on June 20, 2014].
129. Press, W., 2013. Wordpress website targeted by hackers.
130. Proffitt, B., 2012. BotClouds: How Botnets Now Offer Crime-as-a-Service. Available from ://readwrite.com/2012/11/15/botclouds-how-botnets-now-offer-crime-as-a-service#awesm=~opWmkZjKTKOJBu [Accessed on Dec. 4, 2013].
131. Provos, N., 2004. A virtual honeypot framework. USENIX Security Symp.
132. Puri, R., 2003. Bots & Botnet: an Overview. SANS Institute.
133. Qiao, Y., Yang, Y., He, J., et al., 2012. Detecting parasite P2P botnet in eMule-like networks through quasi-periodicity recognition. Information Security and Cryptology-ICISC, p.127–139.
134. Raff, A., 2012. Ramnit Goes Social. Available from ://.seculert.com/blog/2012/01/ramnit-goes-social.html [Accessed on Dec. 5, 2013].
135. Raghava, N.S., Sahgal, D., Chandna, S., 2012. Classification of botnet detection based on botnet architechture. IEEE Int. Conf. on Communication Systems and Network Technologies, p.569–572.
136. Ramachandran, A., Feamster, N., 2006. Understanding the network-level behavior of spammers. ACM SIGCOMM Comput. Commun. Rev., 36(4):291–302. [doi:10.1145/1151659.1159947]
137. Ramachandran, A., Feamster, N., Dagon, D., et al., 2006. Revealing botnet membership using DNSBL counter-intelligence. Proc. 2nd USENIX Steps to Reducing Unwanted Traffic on the Internet, p.49–54.
138. Rieck, K., Schwenk, G., Limmer, T., et al., 2010. Botzilla: detecting the phoning home of malicious software. Proc. ACM Symp. on Applied Computing, p. 1978–1984.
139. Rodríguez-Gómez, R.A., Maciá-Fernández, G., García-Teodoro, P., 2013. Survey and taxonomy of botnet research through life-cycle. ACM Comput. Surv., 45(4): 1–33.
140. Rrushi, J., Mokhtari, E., Ghorbani, A.A., 2011. A statistical approach to botnet virulence estimation. Proc. 6th ACM Symp. on Information, Computer and Communications Security, p.508–512.
141. Ruiter, J., Warnier, M., 2011. Privacy regulations for cloud computing: compliance and implementation in theory and practice. In: Computers, Privacy and Data Protection: an Element of Choice. Springer, p.361–376. [doi:10.1007/978-94-007-0641-5_17]
142. Saha, B., Gairola, A., 2005. Botnet: an overview. CERT-In, White Paper, CIWP-2005-05, 240.
143. Sanchez, F., Duan, Z., Dong, Y., 2012. Blocking spam by separating end-user machines from legitimate mail server machines. Secur. Commun. Networks, p.1–9.
144. Schiller, C., Binkley, J., 2007. Spybot.
145. Schiller, C., Binkley, J., Harley, D., et al., 2011. Botnets-the Killer Web APP. Syngress, Rockland.
146. Schmudlach, M., 2009. Calculating the Size of the Downadup Outbreak. Available from ://forums.cnet.com/7723-6132_102-325455/virus-spyware-alerts-january-16-2009/ [Accessed on Aug. 7, 2013].
147. Schwartz, M.J., 2012. Zeus Botnet Eurograbber Steals $47 Million. Available from ://.informationweek.com/attacks/zeus-botnet-eurograbber-steals-$47-million/d/d-id/1107673 [Accessed on Nov. 6, 2013].
148. Schwartz, M.J., 2013. Microsoft, FBI Trumpet Citadel Botnet Takedowns. Available from ://.informationweek.com/attacks/microsoft-fbi-trumpet-citadel-botnet-takedowns/d/d-id/1110261 [Accessed on Nov. 8, 2013].
149. Sevcenco, S., 2012. SdBot. Available from ://.symantec.com/security_response/writeup.jspdocid=2002-051312-3628-99 [Accessed on Dec. 14, 2013].
150. Shahrestani, A., Feily, M., Ahmad, R., et al., 2009. Architecture for applying data mining and visualization on network flow for botnet traffic detection. IEEE Int. Conf. on Computer Technology and Development, p.33–37.
151. Shin, Y.H., Im, E.G., 2009. A survey of botnet: consequences, defenses and challenges. Joint Workshop on Internet Security, p.1–11.
152. Silva, S.S., Silva, R.M., Pinto, R.C.G., et al., 2013. Botnets: a survey. Comput. Networks, 57(2):378–403. [doi:10.1016/j.comnet.2012.07.021]
153. Sousa, R., Rodrigues, N., Salvador, P., et al., 2012. Analyzing the behavior of top spam botnets. IEEE Int. Conf. on Communications, p.6540–6544.
154. Spider, I.O., 2013. Discovered: Botnet Costing Display Advertisers over Six Million Dollars per Month. Available from ://.spider.io/blog/2013/03/chameleon-botnet/ [Accessed on Dec. 14, 2013].
155. Stalmans, E., Irwin, B., 2011. A framework for DNS based detection and mitigation of malware infections on a network. IEEE Information Security South Africa, p.1–8.
156. Stefan, 2013. Sinkholing the Hlux/Kelihos Botnet-What Happened? Available from ://.securelist.com/en/blog/208214147/Sinkholing_the_Hlux_Kelihos_botnet_what_happened [Accessed on Dec. 16, 2013].
157. Stephens, K., 2010. Malware Command and Control Overview. Technical Report. Available from ://.nsci-va.org/whitepapers.htm [Accessed on Dec. 1, 2013].
158. Stewart, J., 2007. Pushdo - Analysis of a Modern Malware Distribution System. Available from ://.secure works.com [Accessed on Aug. 7, 2013].
159. Stewart, J., 2009. Spam Botnets to Watch in 2009. Dell SecureWorks. Available from ://.secureworks.com/cyber-threat-intelligence/threats/botnets2009/ [Accessed on Nov. 5, 2013].
160. Stinson, E., Mitchell, J.C., 2007. Characterizing bots’ remote control behavior. In: Detection of Intrusions and Malware, and Vulnerability Assessment. Springer, p.89–108. [doi:10.1007/978-3-540-73614-1_6]
161. Stinson, E., Mitchell, J.C., 2008. Characterizing bots’ remote control behavior. In: Botnet Detection. Springer, p.45–64. [doi:10.1007/978-0-387-68768-1_3]
162. Strayer, W.T., Walsh, R., Livadas, C., et al., 2006. Detecting botnets with tight command and control. Proc. 31st IEEE Conf. on Local Computer Networks, p.195–202.
163. Strayer, W.T., Lapsely, D., Walsh, R., et al., 2008. Botnet detection based on network behavior. In: Botnet Detection. Springer, p.1–24. [doi:10.1007/978-0-387-68768-1_1]
164. Stringhini, G., Holz, T., Stone-Gross, B., et al., 2011. BOTMAGNIFIER: Locating Spambots on the Internet. USENIX Security Symp.
165. Symantic, 2010. Bagle. Available from ://.messagelabs.com/mlireport/MLI_2010_04_Apr_FINAL_EN.pdf [Accessed on Apr. 7, 2014].
166. Systems, C., 2012. DNS Best Practices. Available from ://.cisco.com/web/about/security/intelligence/dns-bcp.html [Accessed on Dec. 5, 2013].
167. Szongott, C., Henne, B., Smith, M., 2012. Evaluating the threat of epidemic mobile malware. IEEE 8th Int. Conf. on Wireless and Mobile Computing, Networking and Communications, p.443–450.
168. Szymczyk, M., 2009. Detecting botnets in computer networks using multi-agent technology. IEEE 4th Int. Conf. on Dependability of Computer Systems, p.192–201.
169. Tartakovsky, A.G., Polunchenko, A.S., Sokolov, G., 2013. Efficient computer network anomaly detection by changepoint detection methods. IEEE J. Sel. Topics Signal Process., 7(1):4–11. [doi:10.1109/JSTSP.2013.2241912]
170. The H Security, 2007. New Zealand Teenager Accused of Controlling Botnet of 1.3 Million Computers. Available from ://.h-online.com/security/news/item/New-Zealand-teenager-accused-of-controlling-botnet-of-1-3-million-computers-734068.html
171. Thonnard, O., Dacier, M., 2011. A strategic analysis of spam botnets operations. Proc. 8th Annual Collaboration, Electronic Messaging, Anti-Abuse and Spam Conf., p.162–171. [doi:10.1145/2030376.2030395]
172. Tokhtabayev, A.G., Skormin, V.A., 2007. Non-stationary Markov models and anomaly propagation analysis in IDS. IEEE 3rd Int. Symp. on Information Assurance and Security, p.203–208. [doi:10.1109/IAS.2007.72]
173. Torre, J.D., 2013. Stealrat: an In-Depth Look at an Emerging Spambot Jessa. White Paper, Available from ://.trendmicro.co.uk/media/wp/stealrat-whitepaper-en.pdf
174. Traynor, P., Lin, M., Ongtang, M., et al., 2009. On cellular botnets: measuring the impact of malicious devices on a cellular network core. Proc. 16th ACM Conf. on Computer and Communications Security, p.223–234.
175. Trend Micro, 2006. Taxonomy of Botnet Threats. Technical Report.
176. Trend Micro, 2013. Andrameda Botnet. Available from ://blog.trendmicro.com/trendlabs-security-intelligence/andromeda-botnet-gets-an-update/ [Accessed on Nov. 7, 2013].
177. Truhanov, A., 2010. Russian Botnet Wants to Kill the Competitor. Available from ://safe.cnews.ru/news/top/index.shtml2010/02/10/379202 (in Russian).
178. Tung, L., 2011. Android DreamDroid Two: Rise of Laced APPs. Available from ://.itnews.com.au/News/259147/android-dreamdroid-two-rise-of-laced-apps.aspx [Accessed on May 5, 2013].
179. Vaarandi, R., 2013. Detecting anomalous network traffic in organizational private networks. IEEE Int. Multi-disciplinary Conf. on Cognitive Methods in Situation Awareness and Decision Support, p.2–9.
180. van Ruitenbeek, E., Sanders, W.H., 2008. Modeling peer-to-peer botnets. IEEE 5th Int. Conf. on Quantitative Evaluation of Systems, p.307–316.
181. Villamarín-Salomón, R., Brustoloni, J.C., 2008. Identifying botnets using anomaly detection techniques applied to DNS traffic. 5th IEEE Consumer Communications and Networking Conf., p.476–481.
182. Vishwanath, K.V., Vahdat, A., 2009. Swing: realistic and responsive network traffic generation. IEEE/ACM Trans. Network., 17(3):712–725. [doi:10.1109/TNET.2009.2020830]
183. Wang, B., Li, Z., Li, D., et al., 2010. Modeling connections behavior for web-based bots detection. 2nd IEEE Int. Conf. on e-Business and Information System Security, p.1–4.
184. Wang, C., Li, T., Wang, H., 2009. Botnet detection based on analysis of mail flow. IEEE 2nd Int. Conf. on Biomedical Engineering and Informatics, p.1–4.
185. Wang, P., Sparks, S., Zou, C., 2007. An Advanced Hybrid Peer-to-Peer Botnet. Available from ://static.usenix.org/event/hotbots07/tech/full_papers/wang/wang_html [Accessed on June 6, 2013].
186. Wang, P., Sparks, S., Zou, C., 2010. An advanced hybrid peer-to-peer botnet. IEEE Trans. Depend. Secur. Comput., 7(2):113–127. [doi:10.1109/TDSC.2008.35]
187. Wang, W., Fang, B., Zhang, Z., et al., 2009. A novel approach to detect IRC-based botnets. IEEE Int. Conf. on Networks Security, Wireless Communications and Trusted Computing, p.408–411.
188. Wang, X.R., 2003. Eggdrop. Available from ://.symantec.com/security_response/writeup.jspdocid=2003-041013-5338-99 [Accessed on July 8, 2013].
189. Wang, Z., Wang, J., Huang, W., et al., 2010. The detection of IRC botnet based on abnormal behavior. 2nd IEEE Int. Conf. on Multimedia and Information Technology, p.146–149.
190. Warner, G., 2010. Oleg Nikolaenko, Mega-D Botmaster to Stand Trial. Available from ://garwarner.blogspot.com/2010/12/oleg-nikolaenko-mega-d-botmaster-to.html
191. Weigle, M.C., Adurthi, P., Hernández-Campos, F., et al., 2006. Tmix: a tool for generating realistic TCP application workloads in ns-2. ACM SIGCOMM Comput. Commun. Rev., 36(3):65–76. [doi:10.1145/1140086.1140094]
192. Welch, M.J., Cho, J., Olston, C., 2011. Search result diversity for informational queries. Proc. 20th Int. Conf. on World Wide Web, p.237–246. [doi:10.1145/1963405.1963441]
193. Wikipedia, 1998. NetBus. Available from ://en.wikipedia.org/wiki/NetBus [Accessed on Aug. 7, 2013].
194. Wikipedia, 2013a. Anomaly Detection. Available from ://en.wikipedia.org/wiki/Anomaly_detection [Accessed on Aug. 7, 2013].
195. Wikipedia, 2013b. Botnets. Available from ://en.wikipedia.org/wiki/Botnet [Accessed on Aug. 7, 2013].
196. Wikipedia, 2013c. Mariposa Botnet. Available from ://en.wikipedia.org/wiki/Mariposa_botnet [Accessed on Aug. 7, 2013].
197. Wills, C.E., Mikhailov, M., Shang, H., 2003. Inferring relative popularity of Internet applications by actively querying DNS caches. Proc. 3rd ACM SIGCOMM Conf. on Internet Measurement, p.78–90.
198. WordPress, 2008. Social VPN. Available from ://socialvpn.wordpress.com/ [Accessed on Dec. 25, 2013].
199. Wurzinger, P., Bilge, L., Holz, T., et al., 2009. Automatically generating models for botnet detection. Computer Security ESORICS, p.232–249.
200. Xu, K., Yao, D., Ma, Q., et al., 2011. Detecting infection onset with behavior-based policies. 5th IEEE Int. Conf. on Network and System Security, p.57–64.
201. Xu, Z., Chen, L., Gu, G., et al., 2012. PeerPress: utilizing enemies’ P2P strength against them. Proc. ACM Conf. on Computer and Communications Security, p.581–592.
202. Yen, T.F., Reiter, M.K., 2010. Are your hosts trading or plotting Telling P2P file-sharing and bots apart. IEEE 30th Int. Conf. on Distributed Computing Systems, p.241–252.
203. Ying, L., Yan, Z., Ou, Y.J., 2010. The design and implementation of host-based intrusion detection system. 3rd IEEE Int. Symp. on Intelligent Information Technology and Security Informatics, p.595–598. [doi:10.1109/IITSI.2010.127]
204. Yu, F., Xie, Y., Ke, Q., 2010. SBotMiner: large scale search bot detection. Proc. 3rd ACM Int. Conf. on Web Search and Data Mining, p.421–430. [doi:10.1145/1718487.1718540]
205. Yu, X., Dong, X., Yu, G., et al., 2009. Online botnet detection by continuous similarity monitoring. IEEE Int. Symp. on Information Engineering and Electronic Commerce, p.145–149.
206. Yu, X., Dong, X., Yu, G., et al., 2010. Online botnet detection based on incremental discrete Fourier transform. J. Networks, 5(5):568–576. [doi:10.4304/jnw.5.5.568-576]
207. Zeidanloo, H.R., Manaf, A.A., 2009. Botnet command and control mechanisms. 2nd IEEE Int. Conf. on Computer and Electrical Engineering, p.564–568.
208. Zeidanloo, H.R., Shooshtari, M.J.Z., Amoli, P.V., et al., 2010. A taxonomy of botnet detection techniques. 3rd IEEE Int. Conf. on Computer Science and Information Technology, p.158–162.
209. Zeng, Y., Yan, G., Eidenbenz, S., et al., 2011. Measuring the effectiveness of infrastructure-level detection of large-scale botnets. IEEE 19th Int. Workshop on Quality of Service, p.1–9.
210. Zhang, J., Luo, X., Perdisci, R., et al., 2011a. Boosting the scalability of botnet detection using adaptive traffic sampling. Proc. 6th ACM Symp. on Information, Computer and Communications Security, p.124–134.
211. Zhang, J., Perdisci, R., Lee, W., et al., 2011b. Detecting stealthy P2P botnets using statistical traffic fingerprints. IEEE/IFIP 41st Int. Conf. on Dependable Systems & Networks, p.121–132.
212. Zhao, S., Lee, P.P., Lui, J., et al., 2012. Cloud-based push-styled mobile botnets: a case study of exploiting the cloud to device messaging service. Proc. 28th Annual Computer Security Applications Conf., p.119–128.
213. Zhao, Y., Xie, Y., Yu, F., et al., 2009. BotGraph: large scale spamming botnet detection. NSDI, 9:321–334.
214. Zhou, L., Li, Z., Liu, B., 2006. P2P traffic identification by TCP flow analysis. IEEE Int. Workshop on Networking, Architecture, and Storages, p.2.
215. Zhu, Z., Lu, G., Chen, Y., et al., 2008. Botnet research survey. 32nd Annual IEEE Int. Computer Software and Applications, p.967–972.
216. Zhuang, L., Dunagan, J., Simon, D.R., et al., 2008. Characterizing botnets from email spam records. Proc. 1st USENIX Workshop on Large-Scale Exploits and Emergent Threats LEET, Article 2, p.1–9.
217. Zou, C.C., Cunningham, R., 2006. Honeypot-aware advanced botnet construction and maintenance. IEEE Int. Conf. on Dependable Systems and Networks, p.199–208. [doi:10.1109/DSN.2006.38]