Advertisement

Honeynet-based Botnet Scan Traffic Analysis

  • Zhichun Li
  • Anup Goyal
  • Yan Chen
Part of the Advances in Information Security book series (ADIS, volume 36)

Keywords

Interarrival Time Event Extraction Noise Strength Covert Channel Botnet Detection 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    M. Bailey et al. The Internet motion sensor: A distributed blackhole monitoring system. In Proc. of NDSS, 2005.Google Scholar
  2. 2.
    James Binkley and Suresh Singh. An algorithm for anomaly-based botnet detection. In Proceedings of Steps to Reducing Unwanted Traffic on the Internet Workshop (SRUTI ’06), 2006.Google Scholar
  3. 3.
    E. Cooke, F. Jahanian, and D. McPherson. The zombie roundup: Understanding, detecting, and disrupting botnets. In Proceedings of USENIX Workshop on Steps to Reducing Unwanted Traffic on the Internet, July 2005.Google Scholar
  4. 4.
    W. Cui et al. GQ: Realizing a system to catch worms in a quarter million places. Technical Report TR-06-004, ICSI, 2006.Google Scholar
  5. 5.
    D. Dagon, C. Zou, and W. Lee. Modeling botnet propagation using time zones. In Proceedings of the 13th Network and Distributed System Security Symposium (NDSS’06), 2006.Google Scholar
  6. 6.
    Neil Daswani, Michael Stoppelman, the Google Click Quality, and Inc Security Teams, Google. The anatomy of Clickbot.A. In USENIX First Workshop on Hot Topics in Understanding Botnets (HotBots), 2007.Google Scholar
  7. 7.
    Julian Grizzard, Vikram Sharma, Chris Nunnery, Brent ByungHoon Kang, and David Dagon. Peer-to-peer botnets: Overview and case study. In USENIX First Workshop on Hot Topics in Understanding Botnets (HotBots), 2007.Google Scholar
  8. 8.
    Christopher W. Hanna. Using snort to detect rogue irc bot programs, Oct 2004. http://www.giac.org/certified_professionals/practicals/gsec/4095.php.Google Scholar
  9. 9.
    J. Kannan et al. Semi-automated discovery of application session structure. In Proc. of ACM IMC, 2006.Google Scholar
  10. 10.
    R. Pang et al. Characteristics of Internet background radiation. In Proc. of ACM IMC, 2004.Google Scholar
  11. 11.
    V. Paxson. Bro: A system for detecting network intruders in real-time. Computer Networks, 31, 1999.Google Scholar
  12. 12.
    The Honeynet Project and Research Alliance. Know your enemy: Tracking botnets. http://honeynet.org/papers/bots, March 2005.Google Scholar
  13. 13.
    N. Provos. A virtual honeypot framework. In Proc. of USENIX Security, 2004.Google Scholar
  14. 14.
    Niels Provos, Dean McNamee, Panayiotis Mavrommatis, Ke Wang, and Nagendra Modadugu. The ghost in the browser: Analysis of web-based malware. In USENIX First Workshop on Hot Topics in Understanding Botnets (HotBots), 2007.Google Scholar
  15. 15.
    Moheeb A. Rajab, Jay Zarfoss, Fabian Monrose, and Andreas Terzis. A multifaceted approach to understanding the botnet phenomenon. In Proc. of ACM/USENIX IMC, 2006.Google Scholar
  16. 16.
    Anirudh Ramachandran and Nick Feamster. Understanding the network-level behavior of spammers. In Proceedings of ACM SIGCOMM ’06, September 2006.Google Scholar
  17. 17.
    Anirudh Ramachandran, Nick Feamster, and David Dagon. Revealing botnet membership using DNSBL counter-intelligence. In Proceedings of Steps to Reducing Unwanted Traffic on the Internet Workshop (SRUTI ’06), 2006.Google Scholar
  18. 18.
    M. Vrable et al. Scalability, fidelity, and containment in the potemkin virtual honeyfarm. In Proc. of SOSP, 2005.Google Scholar
  19. 19.
    V. Yegneswaran, Paul Barford, and Vern Paxson. Using honeynets for Internet situational awareness. In In Proc. of ACM Hotnets IV, 2005.Google Scholar
  20. 20.
    V. Yegneswaran et al. On the design and use of Internet sinks for network abuse monitoring. In Proc. of RAID, 2004.Google Scholar
  21. 21.
    Michal Zalewski. the new p0f. http://lcamtuf.coredump.cx/p0f.shtml.Google Scholar
  22. 22.
    Cliff C. Zou et al. Monitoring and early warning for Internet worms. In Prof. of ACM CCS, 2003.Google Scholar

Copyright information

© Springer Science+Business Media, LLC 2008

Authors and Affiliations

  • Zhichun Li
    • 1
  • Anup Goyal
    • 1
  • Yan Chen
    • 1
  1. 1.Northwestern UniversityEvanston

Personalised recommendations