{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,10]],"date-time":"2026-03-10T13:43:53Z","timestamp":1773150233156,"version":"3.50.1"},"publisher-location":"Berlin, Heidelberg","reference-count":22,"publisher":"Springer Berlin Heidelberg","isbn-type":[{"value":"9783540289630","type":"print"},{"value":"9783540319818","type":"electronic"}],"license":[{"start":{"date-parts":[[2005,1,1]],"date-time":"2005-01-01T00:00:00Z","timestamp":1104537600000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2005]]},"DOI":"10.1007\/11555827_19","type":"book-chapter","created":{"date-parts":[[2005,9,27]],"date-time":"2005-09-27T10:10:29Z","timestamp":1127815829000},"page":"319-335","source":"Crossref","is-referenced-by-count":102,"title":["Botnet Tracking: Exploring a Root-Cause Methodology to Prevent Distributed Denial-of-Service Attacks"],"prefix":"10.1007","author":[{"given":"Felix C.","family":"Freiling","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Thorsten","family":"Holz","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Georg","family":"Wicherski","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","reference":[{"key":"19_CR1","unstructured":"FBI report on Operation Cyberslam (February 2004), Internet: \n                  \n                    http:\/\/www.reverse.net\/operationcyberslam.pdf\n                  \n                  \n                 (Accessed March 2005)"},{"key":"19_CR2","unstructured":"Hacker threats to bookies probed (February 2004), Internet: \n                  \n                    http:\/\/news.bbc.co.uk\/1\/hi\/technology\/3513849.stm\n                  \n                  \n                 (Accessed March 2005)"},{"key":"19_CR3","unstructured":"Bellovin, S.M.: ICMP traceback messages, Internet Draft (March 2001)"},{"key":"19_CR4","unstructured":"Computer Emergency Response Team. CERT advisory CA-1996-21 TCP SYN Flooding Attacks (1996). Internet: \n                  \n                    http:\/\/www.cert.org\/advisories\/CA-1996-21.html"},{"key":"19_CR5","unstructured":"Dittrich, D.: Distributed Denial of Service (DDoS) attacks\/tools resource page (2000). Internet: \n                  \n                    http:\/\/staff.washington.edu\/dittrich\/misc\/ddos\/"},{"issue":"27","key":"19_CR6","doi-asserted-by":"publisher","first-page":"195","DOI":"10.1515\/PIKO.2004.195","volume":"4","author":"M. Dornseif","year":"2004","unstructured":"Dornseif, M., G\u00e4rtner, F.C., Holz, T.: Vulnerability assessment using honepots. Praxis der Informationsverarbeitung und Kommunikation (PIK)\u00a04(27), 195\u2013201 (2004)","journal-title":"Praxis der Informationsverarbeitung und Kommunikation (PIK)"},{"key":"19_CR7","doi-asserted-by":"crossref","unstructured":"Ferguson, P.: Network ingress filtering: Defeating denial of service attacks which employ IP source address spoofing, Request for Comments: RFC 2827 (May 2000)","DOI":"10.17487\/rfc2827"},{"key":"19_CR8","unstructured":"Fischer, T.: Botnetze. In: Proceedings of 12th DFN-CERT Workshop (March 2005)"},{"issue":"4","key":"19_CR9","doi-asserted-by":"publisher","first-page":"12","DOI":"10.1109\/MC.2000.839316","volume":"33","author":"L. Garber","year":"2000","unstructured":"Garber, L.: Denial-of-service attacks rip the Internet. Computer\u00a033(4), 12\u201317 (2000)","journal-title":"Computer"},{"key":"19_CR10","unstructured":"Johns, M.S.: Identification protocol, Request for Comments: RFC 1413 (February 1993)"},{"issue":"4","key":"19_CR11","doi-asserted-by":"publisher","first-page":"87","DOI":"10.1109\/MSECP.2003.1219079","volume":"1","author":"B. McCarty","year":"2003","unstructured":"McCarty, B.: Botnets: Big and bigger. IEEE Security & Privacy\u00a01(4), 87\u201390 (2003)","journal-title":"IEEE Security & Privacy"},{"key":"19_CR12","first-page":"4","volume-title":"Proceedings of the 1999 IEEE Computer Security Foundations Workshop","author":"C. Meadows","year":"1998","unstructured":"Meadows, C.: A formal framework and evaluation method for network denial of service. In: Proceedings of the 1999 IEEE Computer Security Foundations Workshop, pp. 4\u201313. IEEE Computer Society Press, Los Alamitos (1998)"},{"key":"19_CR13","volume-title":"Internet Denial of Service: Attack and Defense Mechanisms","author":"J. Mirkovic","year":"2004","unstructured":"Mirkovic, J., Dietrich, S., Dittrich, D., Reiher, P.: Internet Denial of Service: Attack and Defense Mechanisms. Prentice Hall PTR, Englewood Cliffs (2004)"},{"issue":"2","key":"19_CR14","doi-asserted-by":"publisher","first-page":"39","DOI":"10.1145\/997150.997156","volume":"34","author":"J. Mirkovic","year":"2004","unstructured":"Mirkovic, J., Reiher, P.: A taxonomy of DDoS attacks and defense mechanisms. ACM SIGCOMM Computer Communications Review\u00a034(2), 39\u201354 (2004)","journal-title":"ACM SIGCOMM Computer Communications Review"},{"key":"19_CR15","doi-asserted-by":"crossref","unstructured":"Mirkovic, J., Robinson, M., Reiher, P., Kuenning, G.: Alliance formation for DDoS defense. In: Proceedings of the New Security Paradigms Workshop 2003. ACM SIGSAC(August 2003)","DOI":"10.1145\/986655.986658"},{"key":"19_CR16","unstructured":"Provos, N.: A virtual honeypot framework. In: Proceedings of 13th USENIX Security Symposium (2004)"},{"key":"19_CR17","doi-asserted-by":"crossref","unstructured":"Savage, S., Wetherall, D., Karlin, A.R., Anderson, T.: Practical network support for IP traceback. In: Proceedings of the 2000 ACM SIGCOMM Conference, pp. 295\u2013306 (August 2000)","DOI":"10.1145\/347057.347560"},{"issue":"12","key":"19_CR18","doi-asserted-by":"publisher","first-page":"168","DOI":"10.1145\/355112.355131","volume":"43","author":"B. Schneier","year":"2000","unstructured":"Schneier, B.: Inside risks: semantic network attacks. Communications of the ACM\u00a043(12), 168\u2013168 (2000)","journal-title":"Communications of the ACM"},{"key":"19_CR19","first-page":"208","volume-title":"Proceedings of the 1997 IEEE Symposium on Security and Privacy","author":"C.L. Schuba","year":"1997","unstructured":"Schuba, C.L., Krsul, I.V., Kuhn, M.G., Spafford, E.H., Sundaram, A., Zamboni, D.: Analysis of a denial of service attack on TCP. In: Proceedings of the 1997 IEEE Symposium on Security and Privacy, May 1997, pp. 208\u2013223. IEEE Computer Society Press, Los Alamitos (1997)"},{"key":"19_CR20","unstructured":"Song, D.X., Perrig, A.: Advanced and authenticated marking schemes for IP traceback. In: Proceedings of IEEE Infocom 2001 (April 2001)"},{"key":"19_CR21","unstructured":"The Honeynet Project. Know Your Enemy: GenII Honeynets (November 2003), \n                  \n                    http:\/\/www.honeynet.org\/papers\/gen2\/"},{"key":"19_CR22","unstructured":"The Honeynet Project. Know your Enemy: Tracking Botnets (March 2005), \n                  \n                    http:\/\/www.honeynet.org\/papers\/bots"}],"container-title":["Lecture Notes in Computer Science","Computer Security \u2013 ESORICS 2005"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/11555827_19","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,6,2]],"date-time":"2019-06-02T20:24:23Z","timestamp":1559507063000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/11555827_19"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2005]]},"ISBN":["9783540289630","9783540319818"],"references-count":22,"URL":"https:\/\/doi.org\/10.1007\/11555827_19","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2005]]}}}