{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,6]],"date-time":"2026-07-06T12:08:00Z","timestamp":1783339680177,"version":"3.54.6"},"publisher-location":"Cham","reference-count":49,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783030307189","type":"print"},{"value":"9783030307196","type":"electronic"}],"license":[{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019]]},"DOI":"10.1007\/978-3-030-30719-6_8","type":"book-chapter","created":{"date-parts":[[2019,8,31]],"date-time":"2019-08-31T02:27:36Z","timestamp":1567218456000},"page":"156-205","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["Adaptive Cyber Defenses for Botnet Detection and Mitigation"],"prefix":"10.1007","author":[{"given":"Massimiliano","family":"Albanese","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sushil","family":"Jajodia","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sridhar","family":"Venkatesan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"George","family":"Cybenko","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Thanh","family":"Nguyen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2019,8,31]]},"reference":[{"key":"8_CR1","unstructured":"APT1: Exposing one of China\u2019s cyber espionage units. Technical report, Mandiant, February 2013"},{"key":"8_CR2","unstructured":"Lateral movement: how do threat actors move deeper into your network? Technical report, Trend Micro (2013)"},{"key":"8_CR3","unstructured":"Alpcan, T., Ba\u015far, T.: An intrusion detection game with limited observations. In: Proceedings of the 12th International Symposium on Dynamic Games and Applications (ISDG 2006), Sophia-Antipolis, France, July 2006"},{"key":"8_CR4","doi-asserted-by":"crossref","unstructured":"Ankerst, M., Breunig, M.M., Kriegel, H.P., Sander, J.: OPTICS: ordering points to identify the clustering structure. In: Proceedings of the 1999 ACM SIGMOD International Conference on Management of Data (SIGMOD 1999), pp. 49\u201360. ACM, Philadelphia, May 1999","DOI":"10.1145\/304181.304187"},{"key":"8_CR5","unstructured":"Beigi, E.B., Jazi, H.H., Stakhanova, N., Ghorbani, A.A.: Towards effective feature selection in machine learning-based botnet detection approaches. In: Proceedings of the IEEE Conference on Communications and Network Security (IEEE CNS 2014), pp. 247\u2013255. IEEE, San Francisco, October 2014"},{"key":"8_CR6","volume-title":"Dynamic Programming","author":"RE Bellman","year":"1957","unstructured":"Bellman, R.E.: Dynamic Programming. Princeton University Press, Princeton (1957)"},{"key":"8_CR7","doi-asserted-by":"crossref","unstructured":"Chadha, R., et al.: CyberVAN: a cyber security virtual assured network testbed. In: Proceedings of the 2016 IEEE Military Communications Conference (MILCOM 2016), pp. 1125\u20131130. IEEE, Baltimore, November 2016","DOI":"10.1109\/MILCOM.2016.7795481"},{"key":"8_CR8","doi-asserted-by":"crossref","unstructured":"Collins, M.P., Shimeall, T.J., Faber, S., Janies, J., Weaver, R., Shon, M.D., Kadane, J.B.: Using uncleanliness to predict future botnet addresses. In: Proceedings of the 7th ACM SIGCOMM Internet Measurement Conference (IMC 2007), pp. 93\u2013104. ACM, San Diego, October 2007","DOI":"10.1145\/1298306.1298319"},{"issue":"4","key":"8_CR9","doi-asserted-by":"publisher","first-page":"251","DOI":"10.1145\/316194.316229","volume":"29","author":"M Faloutsos","year":"1999","unstructured":"Faloutsos, M., Faloutsos, P., Faloutsos, C.: On power-law relationships of the Internet topology. ACM SIGCOMM Comput. Commun. Rev. 29(4), 251\u2013262 (1999)","journal-title":"ACM SIGCOMM Comput. Commun. Rev."},{"issue":"3","key":"8_CR10","doi-asserted-by":"publisher","first-page":"596","DOI":"10.1145\/28869.28874","volume":"34","author":"ML Fredman","year":"1987","unstructured":"Fredman, M.L., Tarjan, R.E.: Fibonacci heaps and their uses in improved network optimization algorithms. J. ACM (JACM) 34(3), 596\u2013615 (1987)","journal-title":"J. ACM (JACM)"},{"key":"8_CR11","unstructured":"Frescura, F.A.M., Engelbrecht, C.A., Frank, B.S.: Significance tests for periodogram peaks, June 2007. \n                    https:\/\/arxiv.org\/abs\/0706.2225"},{"issue":"1","key":"8_CR12","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/2882969","volume":"8","author":"Rajesh Ganesan","year":"2016","unstructured":"Ganesan, R., Jajodia, S., Shah, A., Cam, H.: Dynamic scheduling of cybersecurity analysts for minimizing risk using reinforcement learning. ACM Trans. Intell. Syst. Technol. 8(1) (2016)","journal-title":"ACM Transactions on Intelligent Systems and Technology"},{"key":"8_CR13","doi-asserted-by":"publisher","first-page":"100","DOI":"10.1016\/j.cose.2014.05.011","volume":"45","author":"S Garc\u00eda","year":"2014","unstructured":"Garc\u00eda, S., Grill, M., Stiborek, J., Zunino, A.: An empirical comparison of botnet detection methods. Comput. Secur. 45, 100\u2013123 (2014)","journal-title":"Comput. Secur."},{"key":"8_CR14","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4757-3766-0","volume-title":"Simulation-Based Optimization: Parametric Optimization Techniques and Reinforcement Learning, Operations Research\/Computer Science Interfaces","author":"A Gosavi","year":"2003","unstructured":"Gosavi, A.: Simulation-Based Optimization: Parametric Optimization Techniques and Reinforcement Learning, Operations Research\/Computer Science Interfaces, vol. 55, 2nd edn. Springer, New York (2003)","edition":"2"},{"key":"8_CR15","unstructured":"Gu, G., Perdisci, R., Zhang, J., Lee, W.: BotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection. In: Proceedings of the 17th USENIX Security Symposium (USENIX Security 2008), pp. 139\u2013154. USENIX Association, San Jose, July 2008"},{"key":"8_CR16","unstructured":"Gu, G., Porras, P., Yegneswaran, V., Fong, M., Lee, W.: BotHunter: detecting malware infection through IDS-driven dialog correlation. In: Proceedings of the 16th USENIX Security Symposium (USENIX Security 2007), pp. 167\u2013182. USENIX Association, August 2007"},{"key":"8_CR17","unstructured":"Jain, M., Korzhyk, D., Van\u011bk, O., Conitzer, V., P\u011bchou\u010dek, M., Tambe, M.: A double oracle algorithm for zero-sum security games on graphs. In: Proceedings of the 10th International Conference on Autonomous Agents and MultiAgent Systems (AAMAS 2011), pp. 327\u2013334. IFAAMAS, Taipei, May 2011"},{"key":"8_CR18","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4614-0977-9","volume-title":"Moving Target Defense: Creating Asymmetric Uncertainty for Cyber Threats, Advances in Information Security","year":"2011","unstructured":"Jajodia, S., Ghosh, A.K., Swarup, V., Wang, C., Wang, X.S. (eds.): Moving Target Defense: Creating Asymmetric Uncertainty for Cyber Threats, Advances in Information Security, vol. 54. Springer, New York (2011). \n                    https:\/\/doi.org\/10.1007\/978-1-4614-0977-9"},{"key":"8_CR19","unstructured":"Kaspersky Labs: Kaspersky lab and ITU research reveals new advanced cyber threat, May 2012. \n                    http:\/\/usa.kaspersky.com\/about-us\/press-center\/press-releases\/kaspersky-lab-and-itu-research-reveals-new-advanced-cyber-threat"},{"key":"8_CR20","doi-asserted-by":"crossref","unstructured":"Khalil, K., Qian, Z., Yu, P., Krishnamurthy, S., Swam, A.: Optimal monitor placement for detection of persistent threats. In: Proceedings of the IEEE Global Communications Conference (IEEE GLOBECOM 2016). IEEE, Washington, DC, December 2016","DOI":"10.1109\/GLOCOM.2016.7842088"},{"key":"8_CR21","unstructured":"Kiekintveld, C., Jain, M., Tsai, J., Pita, J., Ord\u00f3\u00f1ez, F., Tambe, M.: Computing optimal randomized resource allocations for massive security games. In: Proceedings of the 8th International Conference on Autonomous Agents and Multi-Agent Systems, pp. 689\u2013696. IFAAMAS, Budapest, May 2009"},{"issue":"2","key":"8_CR22","doi-asserted-by":"publisher","first-page":"297","DOI":"10.1613\/jair.3269","volume":"41","author":"D Korzhyk","year":"2011","unstructured":"Korzhyk, D., Yin, Z., Kiekintveld, C., Conitzer, V., Tambe, M.: Stackelberg vs. Nash in security games: an extended investigation of interchangeability, equivalence, and uniqueness. J. Artif. Intell. Res. 41(2), 297\u2013327 (2011)","journal-title":"J. Artif. Intell. Res."},{"issue":"3","key":"8_CR23","doi-asserted-by":"publisher","first-page":"371","DOI":"10.1109\/TSE.2010.60","volume":"37","author":"PK Manadhata","year":"2011","unstructured":"Manadhata, P.K., Wing, J.M.: An attack surface metric. IEEE Trans. Softw. Eng. 37(3), 371\u2013386 (2011)","journal-title":"IEEE Trans. Softw. Eng."},{"key":"8_CR24","unstructured":"Marschalek, M., Kimayong, P., Gong, F.: POS malware revisited - look what we found inside your cashdesk. Cyphort labs special report, Cyphort, Inc. (2014)"},{"key":"8_CR25","unstructured":"McMahan, H.B., Gordon, G.J., Blum, A.: Planning in the presence of cost functions controlled by an adversary. In: Proceedings of the 20th International Conference on Machine Learning (ICML 2003), pp. 536\u2013543. AAAI Press, Washington DC, August 2003"},{"key":"8_CR26","unstructured":"Medina, A., Lakhina, A., Matta, I., Byers, J.: BRITE: an approach to universal topology generation. In: Proceedings of the 9th International Symposium on Modeling, Analysis and Simulation of Computer and Telecommunication Systems, pp. 346\u2013353. IEEE, Cincinnati, August 2001"},{"key":"8_CR27","unstructured":"Merritt, E.: New POS malware emerges - Punkey, April 2015. \n                    https:\/\/www.trustwave.com\/Resources\/SpiderLabs-Blog\/New-POS-Malware-Emerges--Punkey\/"},{"key":"8_CR28","unstructured":"Moreira Moura, G.C.: Internet Bad Neighborhoods. Ph.D. thesis, University of Twente, The Netherlands, March 2013"},{"issue":"1","key":"8_CR29","doi-asserted-by":"publisher","first-page":"210","DOI":"10.1287\/moor.1080.0360","volume":"34","author":"JM Nascimento","year":"2009","unstructured":"Nascimento, J.M., Powell, W.B.: An optimal approximate dynamic programming algorithm for the lagged asset acquisition problem. Math. Oper. Res. 34(1), 210\u2013237 (2009)","journal-title":"Math. Oper. Res."},{"key":"8_CR30","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"151","DOI":"10.1007\/978-3-319-68711-7_9","volume-title":"Decision and Game Theory for Security","author":"TH Nguyen","year":"2017","unstructured":"Nguyen, T.H., Wellman, M.P., Singh, S.: A stackelberg game model for botnet data exfiltration. In: Rass, S., An, B., Kiekintveld, C., Fang, F., Schauer, S. (eds.) GameSec 2017. LNCS, vol. 10575, pp. 151\u2013170. Springer, Vienna (2017). \n                    https:\/\/doi.org\/10.1007\/978-3-319-68711-7_9"},{"key":"8_CR31","doi-asserted-by":"publisher","DOI":"10.1002\/9781118029176","volume-title":"Approximate Dynamic Programming: Solving the Curses of Dimensionality","author":"WB Powell","year":"2011","unstructured":"Powell, W.B.: Approximate Dynamic Programming: Solving the Curses of Dimensionality, 2nd edn. Wiley, Hoboken (2011)","edition":"2"},{"key":"8_CR32","doi-asserted-by":"crossref","unstructured":"Rossow, C., Andriesse, D., Werner, T., Stone-Gross, B., Plohmann, D., Dietrich, C.J., Bos, H.: SoK: P2PWNED - modeling and evaluating the resilience of peer-to-peer botnets. In: Proceedings of the 2013 IEEE Symposium on Security and Privacy (S&P 2013), pp. 97\u2013111. IEEE, Berkeley (2013)","DOI":"10.1109\/SP.2013.17"},{"key":"8_CR33","doi-asserted-by":"publisher","first-page":"835","DOI":"10.1086\/160554","volume":"263","author":"JD Scargle","year":"1982","unstructured":"Scargle, J.D.: Studies in astronomical time series analysis. ii-statistical aspects of spectral analysis of unevenly spaced data. Astrophys. J. 263, 835\u2013853 (1982)","journal-title":"Astrophys. J."},{"key":"8_CR34","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"311","DOI":"10.1007\/978-3-540-89173-4_26","volume-title":"Critical Information Infrastructures Security","author":"S Schmidt","year":"2008","unstructured":"Schmidt, S., Alpcan, T., Albayrak, \u015e., Ba\u015far, T., Mueller, A.: A malware detector placement game for intrusion detection. In: Lopez, J., H\u00e4mmerli, B.M. (eds.) CRITIS 2007. LNCS, vol. 5141, pp. 311\u2013326. Springer, Heidelberg (2008). \n                    https:\/\/doi.org\/10.1007\/978-3-540-89173-4_26"},{"key":"8_CR35","unstructured":"Shinoda, Y., Ikai, K., Itoh, M.: Vulnerabilities of passive internet threat monitors. In: Proceedings of the 14th USENIX Security Symposium (USENIX Security 2005), pp. 209\u2013224. USENIX Association, Baltimore, August 2005"},{"key":"8_CR36","doi-asserted-by":"crossref","unstructured":"Shmatikov, V., Wang, M.H.: Security against probe-response attacks in collaborative intrusion detection. In: Proceedings of the 2007 Workshop on Large Scale Attack Defense, pp. 129\u2013136. ACM, Kyoto, August 2007","DOI":"10.1145\/1352664.1352673"},{"issue":"1","key":"8_CR37","doi-asserted-by":"publisher","first-page":"2","DOI":"10.1109\/TNET.2003.822655","volume":"12","author":"N Spring","year":"2004","unstructured":"Spring, N., Mahajan, R., Wetherall, D., Anderson, T.: Measuring ISP topologies with Rocketfuel. IEEE\/ACM Trans. Netw. 12(1), 2\u201316 (2004)","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"8_CR38","unstructured":"Stinson, E., Mitchell, J.C.: Towards systematic evaluation of the evadability of bot\/botnet detection methods. In: Proceedings of the 2nd USENIX Workshop on Offensive Technologies. USENIX Association, San Jose, July 2008"},{"key":"8_CR39","volume-title":"Introduction to Spectral Analysis","author":"P Stoica","year":"1997","unstructured":"Stoica, P., Moses, R.L.: Introduction to Spectral Analysis, 1st edn. Prentice Hall, Upper Saddle River (1997)","edition":"1"},{"key":"8_CR40","unstructured":"Sweeney, P.J.: Designing effective and stealthy botnets for cyber espionage and interdiction: finding the cyber high ground. Ph.D. thesis, Thayer School of Engineering, Darthmouth College, August 2014"},{"key":"8_CR41","doi-asserted-by":"crossref","unstructured":"Venkatesan, S., Albanese, M., Cybenko, G., Jajodia, S.: A moving target defense approach to disrupting stealthy botnets. In: Proceedings of the 3rd ACM Workshop on Moving Target Defense (MTD 2016), pp. 37\u201346. ACM, Vienna, October 2016","DOI":"10.1145\/2995272.2995280"},{"key":"8_CR42","doi-asserted-by":"crossref","unstructured":"Venkatesan, S., Albanese, M., Jajodia, S.: Disrupting stealthy botnets through strategic placement of detectors. In: Proceedings of the 3rd IEEE Conference on Communications and Network Security (IEEE CNS 2015), pp. 55\u201363. IEEE, Florence, September 2015. Best Paper Runner-up Award","DOI":"10.1109\/CNS.2015.7346816"},{"key":"8_CR43","doi-asserted-by":"crossref","unstructured":"Venkatesan, S., Albanese, M., Shah, A., Ganesan, R., Jajodia, S.: Detecting stealthy botnets in a resource-constrained environment using reinforcement learning. In: Proceedings of the 4th ACM Workshop on Moving Target Defense (MTD 2017), pp. 75\u201385. ACM, Dallas, October 2017","DOI":"10.1145\/3140549.3140552"},{"key":"8_CR44","doi-asserted-by":"crossref","unstructured":"Vlachos, M., Yu, P., Castelli, V.: On periodicity detection and structural periodic similarity. In: Proceedings of the 5th SIAM International Conference on Data Mining (SDM 2005), pp. 449\u2013460. SIAM, Newport Beach, April 2005","DOI":"10.1137\/1.9781611972757.40"},{"issue":"2","key":"8_CR45","doi-asserted-by":"publisher","first-page":"942","DOI":"10.1109\/SURV.2013.100913.00195","volume":"16","author":"Y Wang","year":"2014","unstructured":"Wang, Y., Wen, S., Xiang, Y., Zhou, W.: Modeling the propagation of worms in networks: a survey. IEEE Commun. Surv. Tutorials 16(2), 942\u2013960 (2014)","journal-title":"IEEE Commun. Surv. Tutorials"},{"key":"8_CR46","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"43","DOI":"10.1007\/978-3-319-12601-2_3","volume-title":"Decision and Game Theory for Security","author":"MP Wellman","year":"2014","unstructured":"Wellman, M.P., Prakash, A.: Empirical game-theoretic analysis of an adaptive cyber-defense scenario (preliminary report). In: Poovendran, R., Saad, W. (eds.) GameSec 2014. LNCS, vol. 8840, pp. 43\u201358. Springer, Cham (2014). \n                    https:\/\/doi.org\/10.1007\/978-3-319-12601-2_3"},{"key":"8_CR47","doi-asserted-by":"crossref","unstructured":"West, M.: Preventing system intrusions. In: Network and System Security, pp. 29\u201356, , 2nd edn. Syngress (2014)","DOI":"10.1016\/B978-0-12-416689-9.00002-2"},{"key":"8_CR48","unstructured":"Zeng, Y., Hu, X., Shin, K.G.: Detection of botnets using combined host- and network-level information. In: Proceedings of the IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN 2010), pp. 291\u2013300. IEEE, Chicago, June 2010"},{"issue":"1","key":"8_CR49","doi-asserted-by":"publisher","first-page":"27","DOI":"10.1109\/TIFS.2013.2290197","volume":"9","author":"J Zhang","year":"2014","unstructured":"Zhang, J., Perdisci, R., Lee, W., Luo, X., Sarfraz, U.: Building a scalable system for stealthy P2P-botnet detection. IEEE Trans. Inf. Forensics Secur. 9(1), 27\u201338 (2014)","journal-title":"IEEE Trans. Inf. Forensics Secur."}],"container-title":["Lecture Notes in Computer Science","Adversarial and Uncertain Reasoning for Adaptive Cyber Defense"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-30719-6_8","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,8,31]],"date-time":"2019-08-31T05:34:00Z","timestamp":1567229640000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-030-30719-6_8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019]]},"ISBN":["9783030307189","9783030307196"],"references-count":49,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-30719-6_8","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019]]},"assertion":[{"value":"31 August 2019","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}}]}}