Skip to main content
SpringerLink
Log in

Botnet detection techniques: review, future trends, and issues

  • Review
  • Published:
Journal of Zhejiang University SCIENCE C Aims and scope Submit manuscript

Abstract

In recent years, the Internet has enabled access to widespread remote services in the distributed computing environment; however, integrity of data transmission in the distributed computing platform is hindered by a number of security issues. For instance, the botnet phenomenon is a prominent threat to Internet security, including the threat of malicious codes. The botnet phenomenon supports a wide range of criminal activities, including distributed denial of service (DDoS) attacks, click fraud, phishing, malware distribution, spam emails, and building machines for illegitimate exchange of information/materials. Therefore, it is imperative to design and develop a robust mechanism for improving the botnet detection, analysis, and removal process. Currently, botnet detection techniques have been reviewed in different ways; however, such studies are limited in scope and lack discussions on the latest botnet detection techniques. This paper presents a comprehensive review of the latest state-of-the-art techniques for botnet detection and figures out the trends of previous and current research. It provides a thematic taxonomy for the classification of botnet detection techniques and highlights the implications and critical aspects by qualitatively analyzing such techniques. Related to our comprehensive review, we highlight future directions for improving the schemes that broadly span the entire botnet detection research field and identify the persistent and prominent research challenges that remain open.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Similar content being viewed by others

References

  • Abu Rajab, M., Zarfoss, J., Monrose, F., et al., 2006. Amultifaceted approach to understanding the botnet phenomenon. Proc. 6th ACM SIGCOMM Conf. on Internet Measurement, p.41–52.

    Google Scholar 

  • Ahmed, R., Dharaskar, R.V., Thakare, V.M., 2013. Efficient generalized forensics framework for extraction and documentation of evidence from mobile devices. Int. J. Enhanced Res. Manag. Comput. Appl., 2(1):1–7.

    Google Scholar 

  • Aviv, A.J., Haeberlen, A., 2011. Challenges in experimenting with botnet detection systems. USENIX 4th CSET Workshop, p.1–8.

    Google Scholar 

  • Bailey, M., Cooke, E., Jahanian, F., et al., 2009. A survey of botnet technology and defenses. IEEE Cybersecurity Applications & Technology Conf. for Homeland Security, p.299–304. [doi:10.1109/CATCH.2009.40]

    Google Scholar 

  • Barford, P., Yegneswaran, V., 2007. An inside look at botnets. In: Malware Detection. Springer, p.171–191. [doi:10.1007/978-0-387-44599-1_8]

    Google Scholar 

  • Barsamian, A.V., 2009. Network Characterization for Botnet Detection Using Statistical-Behavioral Methods. Master Thesis, Dartmouth College.

    Google Scholar 

  • Bauer, J., van Eeten, M., Chattopadhyay, T., 2008. ITU Study on the Financial Aspects of Network Security: Malware and Spam. Final Report, ICT Applications and Cybersecurity Division, International Telecommunication Union.

    Google Scholar 

  • BBC, 2008. Technology Spam on Rise after Brief Reprieve. BBC News. Available from http://news.bbc.co.uk/2/hi/technology/7749835.stm [Accessed on Dec. 3, 2013].

    Google Scholar 

  • Bethencourt, J., Franklin, J., Vernon, M., 2005. Mapping Internet sensors with probe response attacks. Proc. 14th USENIX Security Symp., p.193–208.

    Google Scholar 

  • Bhuyan, M., Bhattacharyya, D., Kalita, J., 2013. Network anomaly detection: methods, systems and tools. IEEE Commun. Surv. Tutor., 16(1):1–24.

    Google Scholar 

  • Binkley, J.R., Singh, S., 2006. An algorithm for anomaly-based botnet detection. Proc. USENIX Steps to Reducing Unwanted Traffic on the Internet Workshop, p.43–48.

    Google Scholar 

  • Bu, Z., Bueno, P., Kashyap, R., et al., 2010. The New Era of Botnets. Available from http://www.mcafee.com/in/resources/white-papers/wp-new-era-of-botnets.pdf [Accessed on Sept. 9, 2013].

    Google Scholar 

  • Cai, T., Zou, F., 2012. Detecting http botnet with clustering network traffic. IEEE 8th Int. Conf. on Wireless Communications, Networking and Mobile Computing, p.1–7.

    Google Scholar 

  • Ceron, J.M., Granville, L.Z., Tarouco, L.M., 2008. Uma arquitetura baseada em assinaturas para mitiga cao de botnets. In: X Simposio Brasileiro em Seguran ca da Informa cao e de Sistemas Computacionais (SBSeg), p.105–118 (in Portuguese).

    Google Scholar 

  • Chandola, V., Banerjee, A., Kumar, V., 2009. Anomaly detection: a survey. ACM Comput. Surv., 41(3):1–58.

    Google Scholar 

  • Chang, S., Daniels, T.E., 2009. P2P botnet detection using behavior clustering & statistical tests. Proc. 2nd ACM Workshop on Security and Artificial Intelligence, p.23–30. [doi:10.1145/1654988.1654996]

    Google Scholar 

  • Chen, C.M., Huang, M.Z., Ou, Y.H., 2013. Detecting web-based botnets with fast-flux domains. Advances in Intelligent Systems and Applications, Volume 2. Springer, p.79–89. [doi:10.1007/978-3-642-35473-1_9]

    Google Scholar 

  • Chen, F., Ranjan, S., Tan, P., 2011. Detecting bots via incremental LS-SVM learning with dynamic feature adaptation. Proc. 17th ACM SIGKDD Int. Conf. on Knowledge Discovery and Data Mining, p.386–394.

    Google Scholar 

  • Choi, H., Lee, H., Lee, H., et al., 2007. Botnet detection by monitoring group activities in DNS traffic. 7th IEEE Int. Conf. on Computer and Information Technology, p.715–720. [doi:10.1109/CIT.2007.90]

    Google Scholar 

  • Choi, H., Lee, H., Kim, H., 2009. BotGAD: detecting botnets by capturing group activities in network traffic. Proc. 4th Int. ICST Conf. on Communication System Software and Middleware, p.1–8. [doi:10.1145/1621890.1621893]

    Google Scholar 

  • Choi, Y.H., Li, L., Liu, P., et al., 2010. Worm virulence estimation for the containment of local worm outbreak. Comput. & Secur., 29(1):104–123. [doi:10.1016/j.cose.2009.07.002]

    Google Scholar 

  • Comazzetto, A., 2011. Botnets: the Dark Side of Cloud Computing. Technical Report, Bostan, USA.

    Google Scholar 

  • Constantin, L., 2013. Microsoft: Almost 90 Percent of Citadel Botnets in the World Disrupted in June. Available from http://www.pcworld.com/article/2045282/microsoft-almost-90-percent-of-citadel-botnets-in-the-world-disrupted-injune.html [Accessed on July 6, 2013].

    Google Scholar 

  • Constantinou, F., Mavrommatis, P., 2006. Identifying known and unknown peer-to-peer traffic. 5th IEEE Int. Symp. on Network Computing and Applications, p.93–102. [doi:10.1109/NCA.2006.34]

    Google Scholar 

  • Cooke, E., Jahanian, F., McPherson, D., 2005. The zombie roundup: understanding, detecting, and disrupting botnets. Proc. USENIX SRUTI Workshop, p.44.

    Google Scholar 

  • Coskun, B., Dietrich, S., Memon, N., 2010. Friends of an enemy: identifying local members of peer-to-peer botnets using mutual contacts. Proc. 26th Annual Computer Security Applications Conf., p.131–140. [doi:10.1145/1920261.1920283]

    Google Scholar 

  • Cranor, C.D., Gansner, E., Krishnamurthy, B., et al., 2001. Characterizing large DNS traces using graphs. Proc. 1st ACM SIGCOMM Workshop on Internet Measurement, p.55–67. [doi:10.1145/505202.505210]

    Google Scholar 

  • Creech, G., Hu, J., 2013. A semantic approach to host-based intrusion detection systems using contiguous and discontiguous system call patterns. IEEE Trans. Comput., 1(1):1–23.

    Google Scholar 

  • Cremonini, M., Riccardi, M., 2009. The Dorothy project: an open botnet analysis framework for automatic tracking and activity visualization. IEEE European Conf. on Computer Network Defense, p.52–54.

    Google Scholar 

  • Crowfoot, S., 2012. Trojan.Bredolab Spreading in PDF Download. Available from http://www.iceni.com/blog/trojan-bredolab-spreading-in-pdf-download/ [Accessed on Oct. 4, 2014].

    Google Scholar 

  • Cui, X., Fang, B., Yin, L., Xiang, C., et al., 2011. Andbot: towards advanced mobile botnets. Proc. 4th USENIX Conf. on Large-Scale Exploits and Emergent Threats, p.11.

    Google Scholar 

  • Dagon, D., Zou, C.C., Lee, W., 2006. Modeling botnet propagation using time zones. NDSS, 6:2–13.

    Google Scholar 

  • Dagon, D., Gu, G., Lee, C.P., et al., 2007. A taxonomy of botnet structures. IEEE 23rd Annual Computer Security Applications Conf., p.325–339.

    Google Scholar 

  • Danchev, D., 2009. Research: Small DIY Botnets Prevalent in Enterprise Networks. Available from http://www.zdnet.com/blog/security/research-small-diy-botnets-prevalentin-enterprise-networks/4485 [Accessed on Oct. 13, 2014].

    Google Scholar 

  • Davis, C.R., Fernandez, J.M., Neville, S., et al., 2008. Sybil attacks as a mitigation strategy against the Storm botnet. IEEE 3rd Int. Conf. on Malicious and Unwanted Software, p.32–40.

    Google Scholar 

  • di Pietro, R., Mancini, L.V., 2008. Intrusion Detection Systems. Springer.

    Google Scholar 

  • Douceur, J.R., 2002. The sybil attack. In: Peer-to-Peer Systems. Springer Berlin Heidelberg, p.251–260. [doi:10.1007/3-540-45748-8_24]

    Google Scholar 

  • Emre, Y., 2011. A literature survey about recent botnet trends, p.1–14.

    Google Scholar 

  • Erman, J., Mahanti, A., Arlitt, M., et al., 2007. Identifying and discriminating between web and peer-to-peer traffic in the network core. Proc. 16th Int. Conf. on World Wide Web, p.883–892. [doi:10.1145/1242572.1242692]

    Google Scholar 

  • Falliere, N., 2011. Sality: Story of a Peer-to-Peer Viral Network. Symantic Security Response, Technical Report.

    Google Scholar 

  • Falliere, N., Murchu, L.O., Chien, E., 2011. W32.Stuxnet Dossier, Version 1.4. White Paper, Symantec Security Response.

    Google Scholar 

  • FBI, 2012. FBI, International Law Enforcement Disrupt International Organized Cyber Crime Ring Related to Butterfly Botnet.

    Google Scholar 

  • Feily, M., Shahrestani, A., Ramadass, S., 2009. A survey of botnet and botnet detection. IEEE 3rd Int. Conf. on Emerging Security Information, Systems and Technologies, p.268–273.

    Google Scholar 

  • Fogarty, K., 2011. Just What We Need: Malware to Slave Your Android to a Botnet. IT World. Available from http://www.itworld.com/article/2732959/mobile/just-whatwe-need—malware-to-slave-your-android-to-a-botnet.html [Accessed on June 20, 2014].

    Google Scholar 

  • Forristal, J., 2013. Uncovering Android Master Key That Makes 99% of Devices Vulnerable. Available from https://bluebox.com/technical/uncovering-android-masterkey-that-makes-99-of-devices-vulnerable/ [Accessed on Oct. 4, 2014].

    Google Scholar 

  • Fossi, M., Egan, G., Haley, K., et al., 2011. Symantec Internet Security Threat Report Trends for 2010. Symantec Internet Security Threat Report, Volume 16, p.1–20.

    Google Scholar 

  • Francia, R., 2007. Storm Worm Network Shrinks to About One-Tenth of Its Former Size. Tech. Blorge. Com., p.10–21.

    Google Scholar 

  • François, J., Wang, S., Engel, T., 2011. BotTrack: tracking botnets using NetFlow and PageRank. NETWORKING, p.1–14.

    Google Scholar 

  • Freiling, F.C., Holz, T., Wicherski, G., 2005. Botnet tracking: exploring a root-cause methodology to prevent distributed denial-of-service attacks. Springer Berlin Heidelberg, p.319–335.

    Google Scholar 

  • Ge, L., Liu, H., Zhang, D., et al., 2012. On effective sampling techniques for host-based intrusion detection in MANET. IEEE Military Communications Conf., p.1–6.

    Google Scholar 

  • Gilbertson, S., 2013. Massive WordPress Attack Targets Weak Admin Passwords. Available from http://www.webmonkey.com/2013/04/massive-wordpress-attack-targets-weak-admin-passwords [Accessed on Sept. 8, 2013].

    Google Scholar 

  • Goebel, J., Holz, T., 2007. Rishi: identify bot contaminated hosts by irc nickname evaluation. Proc. 1st Conf. on 1st Workshop on Hot Topics in Understanding Botnets, p.1–12.

    Google Scholar 

  • Goodin, D., 2008. Botnet Sics Zombie Soldiers on Gimpy Websites. Available from http://www.theregister.co.uk/2008/05/14/asprox_attacks_websites/ [Accessed on June 6, 2013].

    Google Scholar 

  • Goodin, D., 2010. Waledac Botnet ‘Decimated’ by MS Takedown. Available from http://www.theregister.co.uk/2010/03/16/waledac_takedown_success/ [Accessed on June 8, 2013].

    Google Scholar 

  • Grizzard, J., Sharma, V., Nunnery, C., 2007. Peer-to-peer botnets: overview and case study. Proc. 1st USENIX Workshop on Hot Topics in Understanding Botnets, p.1.

    Google Scholar 

  • Gu, G., Porras, P., Yegneswaran, V., et al., 2007. Bothunter: detecting malware infection through IDS-driven dialog correlation. Proc. 16th USENIX Security Symp., p.167–182.

    Google Scholar 

  • Gu, G., Zhang, J., Lee, W., 2008a. BotSniffer: detecting botnet command and control channels in network traffic. Proc. 15th Annual Network and Distributed System Security Symp., p.2–19.

    Google Scholar 

  • Gu, G., Perdisci, R., Zhang, J., et al., 2008b. BotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection. USENIX Security Symp., p.139–154.

    Google Scholar 

  • Gu, G., Yegneswaran, V., Porras, P., et al., 2009. Active botnet probing to identify obscure command and control channels. IEEE Annual Computer Security Applications Conf., p.241–253.

    Google Scholar 

  • Ha, D.T., Yan, G., Eidenbenz, S., et al., 2009. On the effectiveness of structural detection and defense against P2P-based botnets. IEEE/IFIP Int. Conf. on Dependable Systems & Networks, p.297–306.

    Google Scholar 

  • Holz, T., Steiner, M., Dahl, F., et al., 2008. Measurements and mitigation of peer-to-peer-based botnets: a case study on Storm worm. LEET, 8(1):1–9.

    Google Scholar 

  • Huang, S.Y., Mao, C.H., Lee, H.M., 2010. Fast-flux service network detection based on spatial snapshot mechanism for delay-free detection. Proc. 5th ACM Symp. on Information, Computer and Communications Security, p.101–111.

    Google Scholar 

  • Husna, H., Phithakkitnukoon, S., Palla, S., et al., 2008. Behavior analysis of spam botnets. IEEE 3rd Int. Conf. on Communication Systems Software and Middleware and Workshops, p.246–253.

    Google Scholar 

  • Ianelli, N., Hackworth, A., 2005. Botnets as a vehicle for online crime. CERT Coordination Center, 1(1):28.

    Google Scholar 

  • Iliofotou, M., Pappu, P., Faloutsos, M., et al., 2007. Network monitoring using traffic dispersion graphs (TDGS). Proc. 7th ACM SIGCOMM Conf. on Internet Measurement, p.315–320. [doi:10.1145/1298306.1298349]

    Google Scholar 

  • Jackson, K., 2008. New Massive Botnet Twice the Size of Storm. Available from http://www.darkreading.com/security/news/211201307 [Accessed on May 5, 2014].

    Google Scholar 

  • Janssen, C., 2011. Global Threat Bot (GTbot). Available from http://www.techopedia.com/definition/59/global-threat-bot-gtbot [Accessed on May 6, 2014].

    Google Scholar 

  • Jelasity, M., Bilicki, V., Kasza, M., 2011. Modeling network-level impacts of P2P flows. 19th IEEE Euromicro Int. Conf. on Parallel, Distributed and Network-Based Processing, p.590–594.

    Google Scholar 

  • Jian, G., Zheng, K., Yang, Y., et al., 2012. An evaluation model of botnet based on peer to peer. IEEE 4th Int. Conf. on Computational Intelligence and Communication Networks, p.925–929.

    Google Scholar 

  • Jiang, N., Cao, J., Jin, Y., et al., 2010. Identifying suspicious activities through DNS failure graph analysis. 18th IEEE Int. Conf. on Network Protocols, p.144–153. [doi:10.1109/ICNP.2010.5762763]

    Google Scholar 

  • Jing, L., Yang, X., Kaveh, G., et al., 2009. Botnet: classification, attacks, detection, tracing, and preventive measures. EURASIP J. Wirel. Commun. Network., 2009: 1–11.

    Google Scholar 

  • John, J.P., Moshchuk, A., Gribble, S.D., et al., 2009. Studying spamming botnets using Botlab. NSDI, p.291–306.

    Google Scholar 

  • Kaemarungsi, K., Yoskamtorn, N., Jirawannakool, K., et al., 2009. Botnet statistical analysis tool for limited resource computer emergency response team. IEEE 5th Int. Conf. on IT Security Incident Management and IT Forensics, p.27–40. [doi:10.1109/IMF.2009.13]

    Google Scholar 

  • Kalt, C., 2000. Internet Relay Chat: Architecture. Available from http://tools.ietf.org/html/rfc2810 [Accessed on Oct. 20, 2013].

    Google Scholar 

  • Kang, B.B., Chan-Tin, E., Lee, C.P., et al., 2009. Towards complete node enumeration in a peer-to-peer botnet. Proc. 4th Int. Symp. on Information, Computer, and Communications Security, p.23–34. [doi:10.1145/1533057.1533064]

    Google Scholar 

  • Kang, J., Zhang, J.Y., 2009. Application entropy theory to detect new peer-to-peer botnet with multi-chart CUSUM. IEEE 2nd Int. Symp. on Electronic Commerce and Security, p.470–474.

    Google Scholar 

  • Karagiannis, T., Broido, A., Brownlee, N., et al., 2003. File-sharing in the Internet: a characterization of P2P traffic in the backbone. Technical Report, University of California, Riverside, USA.

    Google Scholar 

  • Karagiannis, T., Broido, A., Faloutsos, M., 2004. Transport layer identification of P2P traffic. Proc. 4th ACM SIGCOMM Conf. on Internet Measurement, p.121–134. [doi:10.1145/1028788.1028804]

    Google Scholar 

  • Karagiannis, T., Papagiannaki, K., Faloutsos, M., 2005. BLINC: multilevel traffic classification in the dark. ACM SIGCOMM Comput. Commun. Rev., 35(4):229–240. [doi:10.1145/1090191.1080119]

    Google Scholar 

  • Karasaridis, A., Rexroad, B., Hoeflin, D., 2007. Wide-scale botnet detection and characterization. Proc. first Conf. on 1st Workshop on Hot Topics in Understanding Botnets, p.1–8.

    Google Scholar 

  • Kassner, M., 2003. The Top 10 Spam Botnets: New and Improved. Available from http://www.techrepublic.com/blog/10-things/the-top-10-spam-botnets-new-and-improved/ [Accessed on June 6, 2013].

    Google Scholar 

  • Keizer, G., 2008. Top Botnets Control 1M Hijacked Computers. Available from http://www.computerworld.com/article/2536378/security0/top-botnets-control-1mhijacked-computers.html [Accessed on Sept. 8, 2013].

    Google Scholar 

  • Kespersky, 2011. How to Detect and Remove the Rootkit TDL4. Available from http://infoaleph.wordpress.com/2011/07/03/como-detectar-y-borrar-el-rootkit-tdl4-tdssalureon/ [Accessed on June 20, 2013].

    Google Scholar 

  • Kugisaki, Y., Kasahara, Y., Hori, Y., et al., 2007. Bot detection based on traffic analysis. IEEE Int. Conf. on Intelligent Pervasive Computing, p.303–306.

    Google Scholar 

  • Lee, C.P., 2009. Framework for Botnet Emulation and Analysis. PhD Thesis, Georgia Institute of Technology.

    Google Scholar 

  • Leonard, J., Xu, S., Sandhu, R., 2009. A first step towards characterizing stealthy botnets. IEEE Int. Conf. on Availability, Reliability and Security, p.106–113.

    Google Scholar 

  • Li, C., Jiang, W., Zou, X., 2009. Botnet: survey and case study. IEEE 4th Int. Conf. on Innovative Computing, Information and Control, p.1184–1187.

    Google Scholar 

  • Li, Z., Goyal, A., Chen, Y., et al., 2009. Automating analysis of large-scale botnet probing events. Proc. 4th Int. Symp. on Information, Computer, and Communications Security, p.11–22.

    Google Scholar 

  • Liao, W.H., Chang, C.C., 2010. Peer to peer botnet detection using data mining scheme. IEEE Int. Conf. on Internet Technology and Applications, p.1–4.

    Google Scholar 

  • Liu, D., Li, Y., Hu, Y., et al., 2010. A P2P-botnet detection model and algorithms based on network streams analysis. IEEE Int. Conf. on Future Information Technology and Management Engineering, p.55–58.

    Google Scholar 

  • Liu, F., Li, Z., Nie, Q., 2009. A new method of P2P traffic identification based on support vector machine at the host level. IEEE Int. Conf. on Information Technology and Computer Science, p.579–582.

    Google Scholar 

  • Liu, L., Chen, S., Yan, G., et al., 2008. BotTracer: execution-based bot-like malware detection. In: Information Security. Springer Berlin Heidelberg, p.97–113. [doi:10.1007/978-3-540-85886-7_7]

    Google Scholar 

  • Livadas, C., Walsh, R., Lapsley, D., et al., 2006. Using machine learning technliques to identify botnet traffic. Proc. 31st IEEE Conf. on Local Computer Networks, p.967–974.

    Google Scholar 

  • Lu, W., Ghorbani, A.A., 2008. Botnets detection based on IRC-community. IEEE Global Telecommunications Conf., p.1–5.

    Google Scholar 

  • Lu, W., Tavallaee, M., Ghorbani, A., 2009a. Automatic discovery of botnet communities on large-scale communication networks. Proc. 4th Int. Symp. on Information, Computer, and Communications Security, p.1–10.

    Google Scholar 

  • Lu, W., Tavallaee, M., Rammidi, G., et al., 2009b. BotCop: an online botnet traffic classifier. 7th IEEE Annual Communication Networks and Services Research Conf., p.70–77.

    Google Scholar 

  • Madhukar, A., Williamson, C., 2006. A longitudinal study of P2P traffic classification. 14th IEEE Int. Symp. on Modeling, Analysis, and Simulation of Computer and Telecommunication Systems, p.179–188. [doi:10.1109/MASCOTS.2006.6]

    Google Scholar 

  • Mador, Z., 2012. M86 Security Threat Report for the Second Half of 2011 is Now Available. Available from http://labs.m86security.com/2012/02/m86-security-threat-report-for-the-second-half-of-2011-is-now-available/ [Accessed on June 20, 2013].

    Google Scholar 

  • Mansmann, F., Fischer, F., Keim, D.A., et al., 2009. Visual support for analyzing network traffic and intrusion detection events using TreeMap and graph representations. Proc. Symp. on Computer Human Interaction for the Management of Information Technology, p.3.

    Google Scholar 

  • Marko, P., Vilhan, P., 2012. Efficient detection of malicious nodes based on DNS and statistical methods. IEEE 10th Int. Symp. on Applied Machine Intelligence and Informatics, p.227–230.

    Google Scholar 

  • Marry, W., 2010. Pushdo Botnet. Available from http://msmvps.com/blogs/harrywaldron/archive/2010/02/02/pushdo-botnet-new-ddos-attacks-on-major-web-sites.aspx.

    Google Scholar 

  • Marupally, P.R., Paruchuri, V., 2011. Comparative Analysis and Evaluation of Botnet Command and Control Models. 24th IEEE Int. Conf. on Advanced Information Networking and Applications, p.82–89.

    Google Scholar 

  • Masud, M.M., Al-Khateeb, T., Khan, L., et al., 2008. Flow-based identification of botnet traffic by mining multiple log files. IEEE 1st Int. Conf. on Distributed Framework and Applications, p.200–206.

    Google Scholar 

  • McCarty, B., 2003. Botnets: big and bigger. IEEE Secur. Priv., 1(4):87–90. [doi:10.1109/MSECP.2003.1219079]

    Google Scholar 

  • McMillan, R., 2009. Experts Bicker over Conficker Numbers. Available from http://news.techworld.com/security/114307/experts-bicker-over-conficker-numbers/ [Accessed on Oct. 14, 2013].

    Google Scholar 

  • McMillan, R., 2010. Spanish Police Take Down Massive Mariposa Botnet. Available from http://www.pcworld.com/article/190634/article.html [Accessed on June 20, 2013].

    Google Scholar 

  • Messmer, E., 2009. America’s 10 Most Wanted Botnets. Available from http://www.networkworld.com/news/2009/072209-botnets.html [Accessed on June 20, 2013].

    Google Scholar 

  • Miller, C., 2008. The Rustock Botnet Spams Again. SC Magazine, July 25.

    Google Scholar 

  • Miller, C., 2009. Researchers Hijack Control of Torpig Botnet. Available from http://www.scmagazine.com/researchers-hijack-control-of-torpig-botnet/article/136207/ [Accessed on June 2, 2013].

    Google Scholar 

  • Mills, E., 2009. Experts: Gumblar Attack Is Alive, Worse than Conficker. Available from http://news.cnet.com/8301-1009_3-10251779-83.html [Accessed on Oct. 2, 2013].

    Google Scholar 

  • Mockapetris, P., 1987. Domain Names-Concepts and Facilities. Available from http://tools.ietf.org/html/rfc1034 [Accessed on Dec. 5, 2013].

    Google Scholar 

  • Morrison, T., 2012. Spam Botnets: the Fall of Grum and the Rise of Festi. Available from http://www.spamhaus.org/news/article/685/ [Accessed on Dec. 12, 2013].

    Google Scholar 

  • Moscaritolo, A., 2010. Kraken Botnet Re-emerges 318,000 Nodes Strong. Available from http://www.scmagazineus.com [Accessed on Dec. 14, 2013].

    Google Scholar 

  • Mukosaka, S., Koike, H., 2007. Integrated visualization system for monitoring security in large-scale local area network. IEEE 6th Int. Asia-Pacific Symp. on Visualization, p.41–44.

    Google Scholar 

  • Mulliner, C., Seifert, J.P., 2010. Rise of the iBots: owning a telco network. IEEE 5th Int. Conf. on Malicious and Unwanted Software, p.71–80.

    Google Scholar 

  • Murugan, S., Kuppusamy, K., 2011. System and methodology for unknown malware attack. IET Int. Conf. on Sustainable Energy and Intelligent Systems, p.803–804.

    Google Scholar 

  • Musil, S., 2012. More than 600,000 Macs Infected with Flashback Botnet. Available from http://www.cnet.com/news/more-than-600000-macs-infected-with-flashback-botnet/ [Accessed on Oct. 5, 2014].

    Google Scholar 

  • Nagaraja, S., Mittal, P., Hong, C., et al., 2010. BotGrep: finding P2P bots with structured graph analysis. USENIX Security Symp., p.95–110.

    Google Scholar 

  • Nazario, J., 2009. Politically motivated denial of service attacks. The Virtual Battlefield: Perspectives on Cyber Warfare, p.163–181.

    Google Scholar 

  • Oberheide, J., Karir, M., Mao, Z., 2007. Characterizing dark DNS behavior. In: Detection of Intrusions and Malware, and Vulnerability Assessment. Springer, p.140–156. [doi:10.1007/978-3-540-73614-1_9]

    Google Scholar 

  • Panda Security, 2013. Firewall: Prevent Unknown Connections Between the Network and the Internet. Available from http://www.pandasecurity.com/enterprise/solutions/security-appliances/firewall [Accessed on Sept. 9, 2013].

    Google Scholar 

  • Paranoid, 2004. The Dangers of httpS. Available from http://www.wilderssecurity.com/threads/the-dangers-ofhttps.31087/ [Accessed on Oct. 5, 2013].

    Google Scholar 

  • Paxton, N., Ahn, G.J., Chu, B., et al., 2007. Towards practical framework for collecting and analyzing network-centric attacks. IEEE Int. Conf. on Information Reuse and Integration, p.73–78. [doi:10.1109/IRI.2007.4296600]

    Google Scholar 

  • Perdisci, R., Corona, I., Dagon, D., et al., 2009. Detecting malicious flux service networks through passive analysis of recursive dns traces. IEEE Annual Computer Security Applications Conf., p.311–320.

    Google Scholar 

  • Pham, V.H., Dacier, M., 2011. Honeypot trace forensics: the observation viewpoint matters. Fut. Gener. Comput. Syst., 27(5):539–546. [doi:10.1016/j.future.2010.06.004]

    Google Scholar 

  • Plohmann, D., Gerhards-Padilla, E., Leder, F., 2011. Botnets: Detection, Measurement, Disinfection & Defence. The European Network and Information Security Agency (ENISA).

    Google Scholar 

  • Plohmann, D., Gerhards-Padilla, E., Leder, F., 2011. Botnets: 10 Tough Questions. Available from https://www.enisa.europa.eu/activities/Resilience-and-CIIP/critical-applications/botnets/botnets-10-tough-questions [Accessed on Dec. 20, 2013].

    Google Scholar 

  • Podrezov, A., 2013. F-Secure, Threat Description: Backdoor: W32/Agobot. Available from http://www.f-secure.com/v-descs/agobot.shtml [Accessed on June 20, 2014].

    Google Scholar 

  • Press, W., 2013. Wordpress website targeted by hackers.

    Google Scholar 

  • Proffitt, B., 2012. BotClouds: How Botnets Now Offer Crime-as-a-Service. Available from http://readwrite.com/2012/11/15/botclouds-how-botnets-now-offer-crime-as-a-service#awesm=~opWmkZjKTKOJBu [Accessed on Dec. 4, 2013].

    Google Scholar 

  • Provos, N., 2004. A virtual honeypot framework. USENIX Security Symp.

    Google Scholar 

  • Puri, R., 2003. Bots & Botnet: an Overview. SANS Institute.

    Google Scholar 

  • Qiao, Y., Yang, Y., He, J., et al., 2012. Detecting parasite P2P botnet in eMule-like networks through quasi-periodicity recognition. Information Security and Cryptology-ICISC, p.127–139.

    Google Scholar 

  • Raff, A., 2012. Ramnit Goes Social. Available from http://www.seculert.com/blog/2012/01/ramnit-goes-social.html [Accessed on Dec. 5, 2013].

    Google Scholar 

  • Raghava, N.S., Sahgal, D., Chandna, S., 2012. Classification of botnet detection based on botnet architechture. IEEE Int. Conf. on Communication Systems and Network Technologies, p.569–572.

    Google Scholar 

  • Ramachandran, A., Feamster, N., 2006. Understanding the network-level behavior of spammers. ACM SIGCOMM Comput. Commun. Rev., 36(4):291–302. [doi:10.1145/1151659.1159947]

    Google Scholar 

  • Ramachandran, A., Feamster, N., Dagon, D., et al., 2006. Revealing botnet membership using DNSBL counter-intelligence. Proc. 2nd USENIX Steps to Reducing Unwanted Traffic on the Internet, p.49–54.

    Google Scholar 

  • Rieck, K., Schwenk, G., Limmer, T., et al., 2010. Botzilla: detecting the phoning home of malicious software. Proc. ACM Symp. on Applied Computing, p. 1978–1984.

    Google Scholar 

  • Rodríguez-Gómez, R.A., Maciá-Fernández, G., García-Teodoro, P., 2013. Survey and taxonomy of botnet research through life-cycle. ACM Comput. Surv., 45(4): 1–33.

    Google Scholar 

  • Rrushi, J., Mokhtari, E., Ghorbani, A.A., 2011. A statistical approach to botnet virulence estimation. Proc. 6th ACM Symp. on Information, Computer and Communications Security, p.508–512.

    Google Scholar 

  • Ruiter, J., Warnier, M., 2011. Privacy regulations for cloud computing: compliance and implementation in theory and practice. In: Computers, Privacy and Data Protection: an Element of Choice. Springer, p.361–376. [doi:10.1007/978-94-007-0641-5_17]

    Google Scholar 

  • Saha, B., Gairola, A., 2005. Botnet: an overview. CERT-In, White Paper, CIWP-2005-05, 240.

    Google Scholar 

  • Sanchez, F., Duan, Z., Dong, Y., 2012. Blocking spam by separating end-user machines from legitimate mail server machines. Secur. Commun. Networks, p.1–9.

    Google Scholar 

  • Schiller, C., Binkley, J., 2007. Spybot.

    Google Scholar 

  • Schiller, C., Binkley, J., Harley, D., et al., 2011. Botnets-the Killer Web APP. Syngress, Rockland.

    Google Scholar 

  • Schmudlach, M., 2009. Calculating the Size of the Downadup Outbreak. Available from http://forums.cnet.com/7723-6132_102-325455/virus-spyware-alerts-january-16-2009/ [Accessed on Aug. 7, 2013].

    Google Scholar 

  • Schwartz, M.J., 2012. Zeus Botnet Eurograbber Steals $47 Million. Available from http://www.informationweek.com/attacks/zeus-botnet-eurograbber-steals-$47-million/d/d-id/1107673 [Accessed on Nov. 6, 2013].

    Google Scholar 

  • Schwartz, M.J., 2013. Microsoft, FBI Trumpet Citadel Botnet Takedowns. Available from http://www.informationweek.com/attacks/microsoft-fbi-trumpet-citadel-botnet-takedowns/d/d-id/1110261 [Accessed on Nov. 8, 2013].

    Google Scholar 

  • Sevcenco, S., 2012. SdBot. Available from http://www.symantec.com/security_response/writeup.jspdocid=2002-051312-3628-99 [Accessed on Dec. 14, 2013].

    Google Scholar 

  • Shahrestani, A., Feily, M., Ahmad, R., et al., 2009. Architecture for applying data mining and visualization on network flow for botnet traffic detection. IEEE Int. Conf. on Computer Technology and Development, p.33–37.

    Google Scholar 

  • Shin, Y.H., Im, E.G., 2009. A survey of botnet: consequences, defenses and challenges. Joint Workshop on Internet Security, p.1–11.

    Google Scholar 

  • Silva, S.S., Silva, R.M., Pinto, R.C.G., et al., 2013. Botnets: a survey. Comput. Networks, 57(2):378–403. [doi:10.1016/j.comnet.2012.07.021]

    Google Scholar 

  • Sousa, R., Rodrigues, N., Salvador, P., et al., 2012. Analyzing the behavior of top spam botnets. IEEE Int. Conf. on Communications, p.6540–6544.

    Google Scholar 

  • Spider, I.O., 2013. Discovered: Botnet Costing Display Advertisers over Six Million Dollars per Month. Available from http://www.spider.io/blog/2013/03/chameleon-botnet/ [Accessed on Dec. 14, 2013].

    Google Scholar 

  • Stalmans, E., Irwin, B., 2011. A framework for DNS based detection and mitigation of malware infections on a network. IEEE Information Security South Africa, p.1–8.

    Google Scholar 

  • Stefan, 2013. Sinkholing the Hlux/Kelihos Botnet-What Happened? Available from http://www.securelist.com/en/blog/208214147/Sinkholing_the_Hlux_Kelihos_botnet_what_happened [Accessed on Dec. 16, 2013].

    Google Scholar 

  • Stephens, K., 2010. Malware Command and Control Overview. Technical Report. Available from http://www.nsci-va.org/whitepapers.htm [Accessed on Dec. 1, 2013].

    Google Scholar 

  • Stewart, J., 2007. Pushdo - Analysis of a Modern Malware Distribution System. Available from http://www.secure works.com [Accessed on Aug. 7, 2013].

    Google Scholar 

  • Stewart, J., 2009. Spam Botnets to Watch in 2009. Dell SecureWorks. Available from http://www.secureworks.com/cyber-threat-intelligence/threats/botnets2009/ [Accessed on Nov. 5, 2013].

    Google Scholar 

  • Stinson, E., Mitchell, J.C., 2007. Characterizing bots’ remote control behavior. In: Detection of Intrusions and Malware, and Vulnerability Assessment. Springer, p.89–108. [doi:10.1007/978-3-540-73614-1_6]

    Google Scholar 

  • Stinson, E., Mitchell, J.C., 2008. Characterizing bots’ remote control behavior. In: Botnet Detection. Springer, p.45–64. [doi:10.1007/978-0-387-68768-1_3]

    Google Scholar 

  • Strayer, W.T., Walsh, R., Livadas, C., et al., 2006. Detecting botnets with tight command and control. Proc. 31st IEEE Conf. on Local Computer Networks, p.195–202.

    Google Scholar 

  • Strayer, W.T., Lapsely, D., Walsh, R., et al., 2008. Botnet detection based on network behavior. In: Botnet Detection. Springer, p.1–24. [doi:10.1007/978-0-387-68768-1_1]

    Google Scholar 

  • Stringhini, G., Holz, T., Stone-Gross, B., et al., 2011. BOTMAGNIFIER: Locating Spambots on the Internet. USENIX Security Symp.

    Google Scholar 

  • Symantic, 2010. Bagle. Available from http://www.messagelabs.com/mlireport/MLI_2010_04_Apr_FINAL_EN.pdf [Accessed on Apr. 7, 2014].

    Google Scholar 

  • Systems, C., 2012. DNS Best Practices. Available from http://www.cisco.com/web/about/security/intelligence/dns-bcp.html [Accessed on Dec. 5, 2013].

    Google Scholar 

  • Szongott, C., Henne, B., Smith, M., 2012. Evaluating the threat of epidemic mobile malware. IEEE 8th Int. Conf. on Wireless and Mobile Computing, Networking and Communications, p.443–450.

    Google Scholar 

  • Szymczyk, M., 2009. Detecting botnets in computer networks using multi-agent technology. IEEE 4th Int. Conf. on Dependability of Computer Systems, p.192–201.

    Google Scholar 

  • Tartakovsky, A.G., Polunchenko, A.S., Sokolov, G., 2013. Efficient computer network anomaly detection by changepoint detection methods. IEEE J. Sel. Topics Signal Process., 7(1):4–11. [doi:10.1109/JSTSP.2013.2241912]

    Google Scholar 

  • The H Security, 2007. New Zealand Teenager Accused of Controlling Botnet of 1.3 Million Computers. Available from http://www.h-online.com/security/news/item/New-Zealand-teenager-accused-of-controlling-botnet-of-1-3-million-computers-734068.html

    Google Scholar 

  • Thonnard, O., Dacier, M., 2011. A strategic analysis of spam botnets operations. Proc. 8th Annual Collaboration, Electronic Messaging, Anti-Abuse and Spam Conf., p.162–171. [doi:10.1145/2030376.2030395]

    Google Scholar 

  • Tokhtabayev, A.G., Skormin, V.A., 2007. Non-stationary Markov models and anomaly propagation analysis in IDS. IEEE 3rd Int. Symp. on Information Assurance and Security, p.203–208. [doi:10.1109/IAS.2007.72]

    Google Scholar 

  • Torre, J.D., 2013. Stealrat: an In-Depth Look at an Emerging Spambot Jessa. White Paper, Available from http://www.trendmicro.co.uk/media/wp/stealrat-whitepaper-en.pdf

    Google Scholar 

  • Traynor, P., Lin, M., Ongtang, M., et al., 2009. On cellular botnets: measuring the impact of malicious devices on a cellular network core. Proc. 16th ACM Conf. on Computer and Communications Security, p.223–234.

    Google Scholar 

  • Trend Micro, 2006. Taxonomy of Botnet Threats. Technical Report.

    Google Scholar 

  • Trend Micro, 2013. Andrameda Botnet. Available from http://blog.trendmicro.com/trendlabs-security-intelligence/andromeda-botnet-gets-an-update/ [Accessed on Nov. 7, 2013].

    Google Scholar 

  • Truhanov, A., 2010. Russian Botnet Wants to Kill the Competitor. Available from http://safe.cnews.ru/news/top/index.shtml2010/02/10/379202 (in Russian).

    Google Scholar 

  • Tung, L., 2011. Android DreamDroid Two: Rise of Laced APPs. Available from http://www.itnews.com.au/News/259147/android-dreamdroid-two-rise-of-laced-apps.aspx [Accessed on May 5, 2013].

    Google Scholar 

  • Vaarandi, R., 2013. Detecting anomalous network traffic in organizational private networks. IEEE Int. Multi-disciplinary Conf. on Cognitive Methods in Situation Awareness and Decision Support, p.2–9.

    Google Scholar 

  • van Ruitenbeek, E., Sanders, W.H., 2008. Modeling peer-to-peer botnets. IEEE 5th Int. Conf. on Quantitative Evaluation of Systems, p.307–316.

    Google Scholar 

  • Villamarín-Salomón, R., Brustoloni, J.C., 2008. Identifying botnets using anomaly detection techniques applied to DNS traffic. 5th IEEE Consumer Communications and Networking Conf., p.476–481.

    Google Scholar 

  • Vishwanath, K.V., Vahdat, A., 2009. Swing: realistic and responsive network traffic generation. IEEE/ACM Trans. Network., 17(3):712–725. [doi:10.1109/TNET.2009.2020830]

    Google Scholar 

  • Wang, B., Li, Z., Li, D., et al., 2010. Modeling connections behavior for web-based bots detection. 2nd IEEE Int. Conf. on e-Business and Information System Security, p.1–4.

    Google Scholar 

  • Wang, C., Li, T., Wang, H., 2009. Botnet detection based on analysis of mail flow. IEEE 2nd Int. Conf. on Biomedical Engineering and Informatics, p.1–4.

    Google Scholar 

  • Wang, P., Sparks, S., Zou, C., 2007. An Advanced Hybrid Peer-to-Peer Botnet. Available from http://static.usenix.org/event/hotbots07/tech/full_papers/wang/wang_html [Accessed on June 6, 2013].

    Google Scholar 

  • Wang, P., Sparks, S., Zou, C., 2010. An advanced hybrid peer-to-peer botnet. IEEE Trans. Depend. Secur. Comput., 7(2):113–127. [doi:10.1109/TDSC.2008.35]

    Google Scholar 

  • Wang, W., Fang, B., Zhang, Z., et al., 2009. A novel approach to detect IRC-based botnets. IEEE Int. Conf. on Networks Security, Wireless Communications and Trusted Computing, p.408–411.

    Google Scholar 

  • Wang, X.R., 2003. Eggdrop. Available from http://www.symantec.com/security_response/writeup.jspdocid=2003-041013-5338-99 [Accessed on July 8, 2013].

    Google Scholar 

  • Wang, Z., Wang, J., Huang, W., et al., 2010. The detection of IRC botnet based on abnormal behavior. 2nd IEEE Int. Conf. on Multimedia and Information Technology, p.146–149.

    Google Scholar 

  • Warner, G., 2010. Oleg Nikolaenko, Mega-D Botmaster to Stand Trial. Available from http://garwarner.blogspot.com/2010/12/oleg-nikolaenko-mega-d-botmaster-to.html

    Google Scholar 

  • Weigle, M.C., Adurthi, P., Hernández-Campos, F., et al., 2006. Tmix: a tool for generating realistic TCP application workloads in ns-2. ACM SIGCOMM Comput. Commun. Rev., 36(3):65–76. [doi:10.1145/1140086.1140094]

    Google Scholar 

  • Welch, M.J., Cho, J., Olston, C., 2011. Search result diversity for informational queries. Proc. 20th Int. Conf. on World Wide Web, p.237–246. [doi:10.1145/1963405.1963441]

    Google Scholar 

  • Wikipedia, 1998. NetBus. Available from http://en.wikipedia.org/wiki/NetBus [Accessed on Aug. 7, 2013].

    Google Scholar 

  • Wikipedia, 2013a. Anomaly Detection. Available from http://en.wikipedia.org/wiki/Anomaly_detection [Accessed on Aug. 7, 2013].

    Google Scholar 

  • Wikipedia, 2013b. Botnets. Available from http://en.wikipedia.org/wiki/Botnet [Accessed on Aug. 7, 2013].

    Google Scholar 

  • Wikipedia, 2013c. Mariposa Botnet. Available from http://en.wikipedia.org/wiki/Mariposa_botnet [Accessed on Aug. 7, 2013].

    Google Scholar 

  • Wills, C.E., Mikhailov, M., Shang, H., 2003. Inferring relative popularity of Internet applications by actively querying DNS caches. Proc. 3rd ACM SIGCOMM Conf. on Internet Measurement, p.78–90.

    Google Scholar 

  • WordPress, 2008. Social VPN. Available from http://socialvpn.wordpress.com/ [Accessed on Dec. 25, 2013].

    Google Scholar 

  • Wurzinger, P., Bilge, L., Holz, T., et al., 2009. Automatically generating models for botnet detection. Computer Security ESORICS, p.232–249.

    Google Scholar 

  • Xu, K., Yao, D., Ma, Q., et al., 2011. Detecting infection onset with behavior-based policies. 5th IEEE Int. Conf. on Network and System Security, p.57–64.

    Google Scholar 

  • Xu, Z., Chen, L., Gu, G., et al., 2012. PeerPress: utilizing enemies’ P2P strength against them. Proc. ACM Conf. on Computer and Communications Security, p.581–592.

    Google Scholar 

  • Yen, T.F., Reiter, M.K., 2010. Are your hosts trading or plotting Telling P2P file-sharing and bots apart. IEEE 30th Int. Conf. on Distributed Computing Systems, p.241–252.

    Google Scholar 

  • Ying, L., Yan, Z., Ou, Y.J., 2010. The design and implementation of host-based intrusion detection system. 3rd IEEE Int. Symp. on Intelligent Information Technology and Security Informatics, p.595–598. [doi:10.1109/IITSI.2010.127]

    Google Scholar 

  • Yu, F., Xie, Y., Ke, Q., 2010. SBotMiner: large scale search bot detection. Proc. 3rd ACM Int. Conf. on Web Search and Data Mining, p.421–430. [doi:10.1145/1718487.1718540]

    Google Scholar 

  • Yu, X., Dong, X., Yu, G., et al., 2009. Online botnet detection by continuous similarity monitoring. IEEE Int. Symp. on Information Engineering and Electronic Commerce, p.145–149.

    Google Scholar 

  • Yu, X., Dong, X., Yu, G., et al., 2010. Online botnet detection based on incremental discrete Fourier transform. J. Networks, 5(5):568–576. [doi:10.4304/jnw.5.5.568-576]

    MathSciNet  Google Scholar 

  • Zeidanloo, H.R., Manaf, A.A., 2009. Botnet command and control mechanisms. 2nd IEEE Int. Conf. on Computer and Electrical Engineering, p.564–568.

    Google Scholar 

  • Zeidanloo, H.R., Shooshtari, M.J.Z., Amoli, P.V., et al., 2010. A taxonomy of botnet detection techniques. 3rd IEEE Int. Conf. on Computer Science and Information Technology, p.158–162.

    Google Scholar 

  • Zeng, Y., Yan, G., Eidenbenz, S., et al., 2011. Measuring the effectiveness of infrastructure-level detection of large-scale botnets. IEEE 19th Int. Workshop on Quality of Service, p.1–9.

    Google Scholar 

  • Zhang, J., Luo, X., Perdisci, R., et al., 2011a. Boosting the scalability of botnet detection using adaptive traffic sampling. Proc. 6th ACM Symp. on Information, Computer and Communications Security, p.124–134.

    Google Scholar 

  • Zhang, J., Perdisci, R., Lee, W., et al., 2011b. Detecting stealthy P2P botnets using statistical traffic fingerprints. IEEE/IFIP 41st Int. Conf. on Dependable Systems & Networks, p.121–132.

    Google Scholar 

  • Zhao, S., Lee, P.P., Lui, J., et al., 2012. Cloud-based push-styled mobile botnets: a case study of exploiting the cloud to device messaging service. Proc. 28th Annual Computer Security Applications Conf., p.119–128.

    Google Scholar 

  • Zhao, Y., Xie, Y., Yu, F., et al., 2009. BotGraph: large scale spamming botnet detection. NSDI, 9:321–334.

    Google Scholar 

  • Zhou, L., Li, Z., Liu, B., 2006. P2P traffic identification by TCP flow analysis. IEEE Int. Workshop on Networking, Architecture, and Storages, p.2.

    Google Scholar 

  • Zhu, Z., Lu, G., Chen, Y., et al., 2008. Botnet research survey. 32nd Annual IEEE Int. Computer Software and Applications, p.967–972.

    Google Scholar 

  • Zhuang, L., Dunagan, J., Simon, D.R., et al., 2008. Characterizing botnets from email spam records. Proc. 1st USENIX Workshop on Large-Scale Exploits and Emergent Threats LEET, Article 2, p.1–9.

    Google Scholar 

  • Zou, C.C., Cunningham, R., 2006. Honeypot-aware advanced botnet construction and maintenance. IEEE Int. Conf. on Dependable Systems and Networks, p.199–208. [doi:10.1109/DSN.2006.38]

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Faculty of Computer Science and Information Technology, University of Malaya, Kuala Lumpur, Malaysia

    Ahmad Karim, Rosli Bin Salleh, Muhammad Shiraz, Syed Adeel Ali Shah & Nor Badrul Anuar

  2. Department of Computer Science, University of Bradford, Bradford, BD7 1DP, UK

    Irfan Awan

Authors
  1. Ahmad Karim
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Rosli Bin Salleh
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Muhammad Shiraz
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Syed Adeel Ali Shah
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Irfan Awan
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Nor Badrul Anuar
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Ahmad Karim.

Additional information

Project supported by University of Malaya, Malaysia (No. FP034-2012A)

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Karim, A., Salleh, R.B., Shiraz, M. et al. Botnet detection techniques: review, future trends, and issues. J. Zhejiang Univ. - Sci. C 15, 943–983 (2014). https://doi.org/10.1631/jzus.C1300242

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1631/jzus.C1300242

Key words

CLC number

Search

Navigation