Botnets: A survey

The Sybil Attack

Douceur, J. R. (2002) · Lecture Notes in Computer Science · doi:10.1007/3-540-45748-8_24 · Cited by 4,419

Kademlia: A Peer-to-Peer Information System Based on the XOR Metric

Maymounkov, P., & Mazières, D. (2002) · Lecture Notes in Computer Science · doi:10.1007/3-540-45748-8_5 · Cited by 3,004

Hypertext Transfer Protocol (HTTP)

(2003) · The Hacker's Handbook · doi:10.1201/9780203490044-20 · Cited by 2,824

Bro: a system for detecting network intruders in real-time

Paxson, V. (1999) · Computer Networks · doi:10.1016/s1389-1286(99)00112-7 · Cited by 2,636

Proceedings of the 11th USENIX Security Symposium

Boneh, D. (2002) · Cited by 2,528

Domain names - concepts and facilities

Mockapetris, P. V. (1987) · doi:10.17487/rfc1034 · Cited by 1,467

Hypertext Transfer Protocol -- HTTP/1.1

Fielding, R., Gettys, J., Mogul, J., Frystyk, H., Masinter, L., Leach, P., & Berners-Lee, T. (1999) · doi:10.17487/rfc2616 · Cited by 1,218

How to Own the Internet in Your Spare Time

Staniford, S., Paxson, V., & Weaver, N. C. (2002) · Cited by 1,092

BotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection

Gu, G., Roberto Perdisci, A., Zhang, J., & Lee, W. (2008) · Journal of Bioresource Management · Cited by 1,033

Transport layer identification of P2P traffic

Karagiannis, T., Broido, A., Faloutsos, M., & claffy, K. (2004) · Proceedings of the 4th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1028788.1028804 · Cited by 708

BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic

Gu, G., Zhang, J., & Lee, W. (2008) · CORE Scholar (Wright State University) · Cited by 702

BotHunter: detecting malware infection through IDS-driven dialog correlation

Gu, G., Porras, P. A., Yegneswaran, V., Fong, M. W., & Lee, W. (2007) · Cited by 696

A virtual honeypot framework

Provos, N. (2004) · Deep Blue (University of Michigan) · Cited by 629

A multifaceted approach to understanding the botnet phenomenon

Abu Rajab, M., Zarfoss, J., Monrose, F., & Terzis, A. (2006) · Proceedings of the 6th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1177080.1177086 · Cited by 595

Your botnet is my botnet: analysis of a botnet takeover

Stone-Gross, B., Cova, M., Cavallaro, L., Gilbert, B., Szydlowski, M., Kemmerer, R., Kruegel, C., & Vigna, G. (2009) · Proceedings of the 16th ACM conference on Computer and communications security · doi:10.1145/1653662.1653738 · Cited by 577

Proceedings of the 26th International Conference on World Wide Web - WWW '17

(2017) · doi:10.1145/3038912 · Cited by 555

Proceedings of the 17th ACM conference on Computer and communications security

(2010) · doi:10.1145/1866307 · Cited by 532

Understanding the network-level behavior of spammers

Ramachandran, A., & Feamster, N. (2006) · ACM SIGCOMM Computer Communication Review · doi:10.1145/1151659.1159947 · Cited by 510

Internet quarantine: requirements for containing self-propagating code

Moore, D., Shannon, C., Voelker, G. M., & Savage, S. (2004) · IEEE INFOCOM 2003. Twenty-second Annual Joint Conference of the IEEE Computer and Communications Societies (IEEE Cat. No.03CH37428) · doi:10.1109/infcom.2003.1209212 · Cited by 494

The Zombie roundup: understanding, detecting, and disrupting botnets

Cooke, E. M., Jahanian, F., & McPherson, D. (2005) · Cited by 489

The socialbot network: when bots socialize for fame and money

Boshmaf, Y., Muslukhov, I., Beznosov, K., & Ripeanu, M. (2011) · Proceedings of the 27th Annual Computer Security Applications Conference · doi:10.1145/2076732.2076746 · Cited by 436

Measurements and mitigation of peer-to-peer-based botnets: a case study on storm worm

Holz, T., Steiner, M., Dahl, F., Biersack, E. W., & Freiling, F. (2008) · Cited by 383

A Survey of Botnet and Botnet Detection

Feily, M., Shahrestani, A., & Ramadass, S. (2009) · 2009 Third International Conference on Emerging Security Information, Systems and Technologies · doi:10.1109/securware.2009.48 · Cited by 383

Peer-to-peer botnets: overview and case study

Grizzard, J. B., Sharma, V., Nunnery, C., Kang, B. B., & Dagon, D. (2007) · Cited by 353

Modeling Botnet Propagation Using Time Zones.

Dagon, D., Zou, C. C., & Lee, W. (2006) · Cited by 335

An Advanced Hybrid Peer-to-Peer Botnet

Wang, P., Sparks, S., & Zou, C. C. (2010) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2008.35 · Cited by 333

Wide-scale botnet detection and characterization

Karasaridis, A., Rexroad, B., & Hoeflin, D. (2007) · Conference on Workshop on Hot Topics in Understanding Botnets · Cited by 320

Usilng Machine Learning Technliques to Identify Botnet Traffic

Livadas, C., Walsh, R., Lapsley, D., & Strayer, W. T. (2006) · Proceedings. 2006 31st IEEE Conference on Local Computer Networks · doi:10.1109/lcn.2006.322210 · Cited by 300

Rishi: identify bot contaminated hosts by IRC nickname evaluation

Goebel, J., & Holz, T. (2007) · Cited by 298

An algorithm for anomaly-based botnet detection

Binkley, J. R., & Singh, S. (2006) · Cited by 289

An Inside Look at Botnets

Barford, P., & Yegneswaran, V. (2007) · Springer eBooks · doi:10.1007/978-0-387-44599-1_8 · Cited by 287

A Taxonomy of Botnet Structures

Dagon, D., Gu, G., Lee, C. P., & Lee, W. (2007) · Twenty-Third Annual Computer Security Applications Conference (ACSAC 2007) · doi:10.1109/acsac.2007.44 · Cited by 255

A Longitudinal Study of P2P Traffic Classification

Madhukar, A., & Williamson, C. (2006) · 14th IEEE International Symposium on Modeling, Analysis, and Simulation · doi:10.1109/mascots.2006.6 · Cited by 247

Botnet Detection by Monitoring Group Activities in DNS Traffic

Choi, H.-S., Lee, H., Lee, H., & Kim, H. (2007) · IEEE International Conference on Computer and Information Technology (CIT) · doi:10.1109/cit.2007.90 · Cited by 245

Proceedings of the 1998 ACM symposium on Applied Computing - SAC '98

(1998) · doi:10.1145/330560 · Cited by 240

BotGrep: finding P2P bots with structured graph analysis

Nagaraja, S., Mittal, P., Hong, C.-Y., Caesar, M., & Borisov, N. (2010) · Cited by 228

A Survey of Botnet Technology and Defenses

Bailey, M., Cooke, E., Jahanian, F., Xu, Y., & Karir, M. (2009) · doi:10.1109/catch.2009.40 · Cited by 226

Learning More about the Underground Economy: A Case-Study of Keyloggers and Dropzones

Holz, T., Engelberth, M., & Freiling, F. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04444-1_1 · Cited by 221

My botnet is bigger than yours (maybe, better than yours): why size estimates remain challenging

Rajab, M. A., Zarfoss, J., Monrose, F., & Terzis, A. (2007) · Conference on Workshop on Hot Topics in Understanding Botnets · Cited by 220

Facebook immune system

Stein, T., Chen, E., & Mangla, K. (2011) · Proceedings of the 4th Workshop on Social Network Systems · doi:10.1145/1989656.1989664 · Cited by 219

On cellular botnets: measuring the impact of malicious devices on a cellular network core

Traynor, P., Lin, M., Ongtang, M., Rao, V., Jaeger, T., McDaniel, P., & La Porta, T. (2009) · Proceedings of the 16th ACM conference on Computer and communications security · doi:10.1145/1653662.1653690 · Cited by 215

Identifying and discriminating between web and peer-to-peer traffic in the network core

Erman, J., Mahanti, A., Arlitt, M., & Williamson, C. (2007) · Proceedings of the 16th international conference on World Wide Web · doi:10.1145/1242572.1242692 · Cited by 213

Botnet Detection Based on Network Behavior

Strayer, W. T., Lapsely, D., Walsh, R., & Livadas, C. (2007) · Advances in Information Security · doi:10.1007/978-0-387-68768-1_1 · Cited by 207

Revealing botnet membership using DNSBL counter-intelligence

Ramachandran, A., Feamster, N., & Dagon, D. (2006) · Cited by 204

Studying spamming botnets using Botlab

John, J. P., Moshchuk, A., Gribble, S. D., & Krishnamurthy, A. (2009) · Cited by 185

Network monitoring using traffic dispersion graphs (tdgs)

Iliofotou, M., Pappu, P., Faloutsos, M., Mitzenmacher, M., Singh, S., & Varghese, G. (2007) · Proceedings of the 7th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1298306.1298349 · Cited by 185

Traffic Aggregation for Malware Detection

Yen, T.-F., & Reiter, M. K. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-70542-0_11 · Cited by 179

Botnet Research Survey

Zhu, Z., Lu, G., Chen, Y., Fu, Z. J., Roberts, P., & Han, K. (2008) · 2008 32nd Annual IEEE International Computer Software and Applications Conference · doi:10.1109/compsac.2008.205 · Cited by 178

Proceedings 16th Annual Computer Security Applications Conference (ACSAC'00)

(2000) · doi:10.1109/acsac.2000 · Cited by 174

Detecting Botnets with Tight Command and Control

Strayer, W., Walsh, R., Livadas, C., & Lapsley, D. (2006) · Proceedings. 2006 31st IEEE Conference on Local Computer Networks · doi:10.1109/lcn.2006.322100 · Cited by 170

BotGraph: large scale spamming botnet detection

Zhao, Y., Xie, Y., Yu, F., Ke, Q., Yu, Y., Chen, Y., & Gillum, E. (2009) · Cited by 169

Automatically Generating Models for Botnet Detection

Wurzinger, P., Bilge, L., Holz, T., Goebel, J., Kruegel, C., & Kirda, E. (2009) · Lecture Notes in Computer Science · doi:10.1007/978-3-642-04444-1_15 · Cited by 164

As the net churns: Fast-flux botnet observations

Nazario, J., & Holz, T. (2008) · International Conference on Malicious and Unwanted Software · doi:10.1109/malware.2008.4690854 · Cited by 156

The underground economy of spam: a botmaster's perspective of coordinating large-scale spam campaigns

Stone-Gross, B., Holz, T., Stringhini, G., & Vigna, G. (2011) · Cited by 152

Proceedings of the 5th ACM SIGCOMM conference on Internet measurement - IMC '05

(2005) · doi:10.1145/1330107 · Cited by 151

Characterizing botnets from email spam records

Li, Z., Dunagan, J., Simón, D., et al. (2008) · Cited by 143

Identifying Known and Unknown Peer-to-Peer Traffic

Constantinou, F. (2006) · IEEE International Symposium on Network Computing and Applications (NCA) · doi:10.1109/nca.2006.34 · Cited by 135

Detecting Malicious Flux Service Networks through Passive Analysis of Recursive DNS Traces

Perdisci, R., Corona, I., Dagon, D., & Lee, W. (2009) · Annual Computer Security Applications Conference · doi:10.1109/acsac.2009.36 · Cited by 133

Mapping internet sensors with probe response attacks

Bethencourt, J., Franklin, J., & Vernon, M. K. (2005) · Cited by 131

BotTrack: Tracking Botnets Using NetFlow and PageRank

François, J., Wang, S., State, R., & Engel, T. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-20757-0_1 · Cited by 124

Botnet: Classification, Attacks, Detection, Tracing, and Preventive Measures

Liu, J., Xiao, Y., Ghaboosi, K., et al. (2009) · EURASIP Journal on Wireless Communications and Networking · doi:10.1155/2009/692654 · Cited by 123

Detecting stealthy P2P botnets using statistical traffic fingerprints

Zhang, J., Roberto Perdisci, A., Lee, W., Sarfraz, U., & Luo, X. (2011) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2011.5958212 · Cited by 107

Andbot: towards advanced mobile botnets

Cui, X., Binxing, F., Yin, L., Liu, X., & Zang, T. (2011) · Cited by 99

Botnet: Survey and Case Study

Li, C., Jiang, W., & Zou, X. (2009) · International Conference on Innovative Computing, Information and Control · doi:10.1109/icicic.2009.127 · Cited by 99

Army of Botnets

Vogt, R., Aycock, J., & Jacobson, M. J. (2007) · Cited by 97

Botnet: Classification, Attacks, Detection, Tracing, and Preventive Measures

Kaveh, G., Hongmei, D., Jing, L., et al. (2009) · DOAJ (DOAJ: Directory of Open Access Journals) · Cited by 96

Exploiting Temporal Persistence to Detect Covert Botnet Channels

Giroire, F., Chandrashekar, J., Taft, N., Schooler, E. M., & Papagiannaki, D. (2009) · Lecture notes in computer science · doi:10.1007/978-3-642-04342-0_17 · Cited by 93

Measurement and classification of humans and bots in internet chat

Gianvecchio, S., Xie, M., Wu, Z., & Wang, H. (2008) · Cited by 89

Social Network-Based Botnet Command-and-Control: Emerging Threats and Countermeasures

Kartaltepe, E. J., Morales, J. A., Xu, S., & Sandhu, R. S. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-13708-2_30 · Cited by 89

Active Botnet Probing to Identify Obscure Command and Control Channels

Gu, G., Yegneswaran, V., Porras, P. A., Stoll, J. A., & Lee, W. (2009) · Annual Computer Security Applications Conference · doi:10.1109/acsac.2009.30 · Cited by 78

A Systematic Study on Peer-to-Peer Botnets

Wang, P., Wu, L., Aslam, B., & Zou, C. C. (2009) · International Conference on Computer Communications and Networks (ICCCN) · doi:10.1109/icccn.2009.5235360 · Cited by 72

Automatic discovery of botnet communities on large-scale communication networks

Lu, W., Tavallaee, M., & Ghorbani, A. A. (2009) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/1533057.1533062 · Cited by 71

Proceedings of the 17th conference on Security symposium

van Oorschot, P. C. (2008) · Cited by 70

Sybil attacks as a mitigation strategy against the Storm botnet

Davis, C. R., Fernandez, J. M., Neville, S. W., & McHugh, J. (2008) · International Conference on Malicious and Unwanted Software · doi:10.1109/malware.2008.4690855 · Cited by 64

Botzilla: detecting the "phoning home" of malicious software

Rieck, K., Schwenk, G., Limmer, T., Holz, T., & Laskov, P. (2010) · ACM Symposium on Applied Computing · doi:10.1145/1774088.1774506 · Cited by 62

Towards complete node enumeration in a peer-to-peer botnet

Kang, B. B., Chan‐Tin, E., Lee, C. P., Tyra, J., Kang, H. J., Nunnery, C., Wadler, Z., Sinclair, G., Hopper, N., Dagon, D., et al. (2009) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/1533057.1533064 · Cited by 58

Challenges in experimenting with botnet detection systems

Aviv, A. J., & Haeberlen, A. (2011) · ScholarlyCommons (University of Pennsylvania) · Cited by 58

Modeling Peer-to-Peer Botnets

Ruitenbeek, E. V., & Sanders, W. H. (2008) · International Conference on Quantitative Evaluation of Systems (QEST) · doi:10.1109/qest.2008.43 · Cited by 56

Automating analysis of large-scale botnet probing events

Li, Z., Goyal, A., Chen, Y., & Paxson, V. (2009) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/1533057.1533063 · Cited by 54

An Analysis of BitTorrent’s Two Kademlia-Based DHTs

Crosby, S. A., & Wallach, D. S. (2007) · Cited by 54

Your Botnet is My Botnet: Analysis of a Botnet Takeover

Stone-Gross, B., Cova, M., Cavallaro, A. L., Gilbert, B., Szydlowski, M., Kemmerer, R. A., Kruegel, C., Vigna, G., & Cavallaro, L. (2009) · Cited by 53

BotCop: An Online Botnet Traffic Classifier

Lu, W., Tavallaee, M., Rammidi, G., & Ghorbani, A. A. (2009) · Annual Communication Networks and Services Research Conference (CNSR) · doi:10.1109/cnsr.2009.21 · Cited by 48

Bot Detection Based on Traffic Analysis

Kugisaki, Y., Kasahara, Y., Hori, Y., & Sakurai, K. (2007) · International Conference on Intelligent Pervasive Computing · doi:10.1109/ipc.2007.91 · Cited by 46

Internet Relay Chat: Architecture

Kalt, C. (2000) · doi:10.17487/rfc2810 · Cited by 43

On the effectiveness of structural detection and defense against P2P-based botnets

Ha, D. T., Yan, G., Eidenbenz, S., & Ngo, H. Q. (2009) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn.2009.5270322 · Cited by 39

BOTMAGNIFIER: locating spambots on the internet

Stringhini, G., Holz, T., Stone-Gross, B., et al. (2011) · Cited by 35

Detecting infection onset with behavior-based policies

Xu, K., Yao, D. D., Ma, Q., & Crowell, A. (2011) · International Conference on Network and System Security (NSS) · doi:10.1109/icnss.2011.6059960 · Cited by 33

Take a Deep Breath: A Stealthy, Resilient and Cost-Effective Botnet Using Skype

Nappa, A., Fattori, A., Balduzzi, M. `., Dell’Amico, M., & Cavallaro, L. (2010) · Lecture notes in computer science · doi:10.1007/978-3-642-14215-4_5 · Cited by 30

Architecture for Applying Data Mining and Visualization on Network Flow for Botnet Traffic Detection

Shahrestani, A., Feily, M., Ahmad, R. B., & Ramadass, S. (2009) · International Conference on Computer Technology and Development · doi:10.1109/icctd.2009.82 · Cited by 27

Behavioral analysis of fast flux service networks

Çağlayan, A., Toothaker, M., Drapaeau, D., Burke, D., & Eaton, G. (2009) · doi:10.1145/1558607.1558662 · Cited by 23

Comparison of the Mean-Field Approach and Simulation in a Peer-to-Peer Botnet Case Study

Kolesnichenko, A., Remke, A., de Boer, P.-T., et al. (2011) · Lecture notes in computer science · doi:10.1007/978-3-642-24749-1_11 · Cited by 21

Botnets Detection Based on IRC-Community

Lu, W., & Ghorbani, A. A. (2008) · Globecom · doi:10.1109/glocom.2008.ecp.398 · Cited by 19

A New Method of P2P Traffic Identification Based on Support Vector Machine at the Host Level

Liu, F., Li, Z., & Nie, Q. (2009) · doi:10.1109/itcs.2009.257 · Cited by 13

NETWORK CHARACTERIZATION FOR BOTNET DETECTION USING STATISTICAL-BEHAVIORAL METHODS

Barsamian, A. V., & Berk, V. H. (2009) · Cited by 10

Honeypot Traces Forensics: The Observation Viewpoint Matters

Pham, V.-H., & Daciér, M. (2009) · International Conference on Network and System Security (NSS) · doi:10.1109/nss.2009.46 · Cited by 9

Proceedings of the 2nd conference on USENIX Workshop on offensive technologies

Boneh, D., Garfinkel, T., & Song, D. (2008) · Cited by 6

Research on a method of P2P traffic identification based on multi-dimension characteristics

Chunzhi, W., Wei, J., Hong, C., Luo, W., & Fang, H. (2010) · International Conference on Computer Science & Education (ICCSE) · doi:10.1109/iccse.2010.5593400 · Cited by 3

Botnet Statistical Analysis Tool for Limited Resource Computer Emergency Response Team

Kaemarungsi, K., Yoskamtorn, N., Jirawannakool, K., Sanglerdsinlapachai, N., & Luangingkasut, C. (2009) · International Conference on IT Security Incident Management and IT Forensics (IMF) · doi:10.1109/imf.2009.13 · Cited by 2

Towards the development of realistic botnet dataset in the Internet of Things for network forensic analytics: Bot-IoT dataset

Koroniotis, N., Moustafa, N., Sitnikova, E., & Turnbull, B. (2019) · Future Generation Computer Systems · doi:10.1016/j.future.2019.05.041 · Cited by 1,983

DDoS in the IoT: Mirai and Other Botnets

Kolias, C., Kambourakis, G., Stavrou, A., & Voas, J. (2017) · Computer · doi:10.1109/mc.2017.201 · Cited by 1,892

Explainable Artificial Intelligence Applications in Cyber Security: State-of-the-Art in Research

Zhang, Z., Hamadi, H. A., Damiani, E., Yeun, C. Y., & Taher, F. (2022) · IEEE Access · doi:10.1109/access.2022.3204051 · Cited by 450

A Visualized Botnet Detection System Based Deep Learning for the Internet of Things Networks of Smart Cities

Vinayakumar, R., Alazab, M., Srinivasan, S., Pham, Q.-V., Padannayil, S. K., & Simran, K. (2020) · IEEE Transactions on Industry Applications · doi:10.1109/tia.2020.2971952 · Cited by 323

Botnet in DDoS Attacks: Trends and Challenges

Hoque, N., Bhattacharyya, D. K., & Kalita, J. K. (2015) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2015.2457491 · Cited by 299