{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,3,28]],"date-time":"2025-03-28T08:11:38Z","timestamp":1743149498976,"version":"3.40.3"},"publisher-location":"Cham","reference-count":21,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783319035833"},{"type":"electronic","value":"9783319035840"}],"license":[{"start":{"date-parts":[[2013,1,1]],"date-time":"2013-01-01T00:00:00Z","timestamp":1356998400000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2013]]},"DOI":"10.1007\/978-3-319-03584-0_10","type":"book-chapter","created":{"date-parts":[[2013,11,7]],"date-time":"2013-11-07T10:17:57Z","timestamp":1383819477000},"page":"117-131","source":"Crossref","is-referenced-by-count":6,"title":["Detection of Covert Botnet Command and Control Channels by Causal Analysis of Traffic Flows"],"prefix":"10.1007","author":[{"given":"Pieter","family":"Burghouwt","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Marcel","family":"Spruit","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Henk","family":"Sips","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","reference":[{"key":"10_CR1","unstructured":"Alexa.com: Alexa, the web information company (visited March 2, 2013), http:\/\/www.alexa.com\/topsites"},{"key":"10_CR2","unstructured":"Asai, H., Fukuda, K., Esaki, H.: Traffic causality graphs: profiling network applications through temporal and spatial causality of flows. In: Proc. of the 23rd International Teletraffic Congress, ITCP, pp. 95\u2013102 (2011)"},{"key":"10_CR3","doi-asserted-by":"publisher","first-page":"69","DOI":"10.1145\/505202.505211","volume-title":"Proc. of the 1st ACM SIGCOMM Workshop on Internet Measurement, IMW 2001","author":"P. Barford","year":"2001","unstructured":"Barford, P., Plonka, D.: Characteristics of network traffic flow anomalies. In: Proc. of the 1st ACM SIGCOMM Workshop on Internet Measurement, IMW 2001, pp. 69\u201373. ACM, New York (2001)"},{"key":"10_CR4","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"131","DOI":"10.1007\/978-3-642-25560-1_9","volume-title":"Information Systems Security","author":"P. Burghouwt","year":"2011","unstructured":"Burghouwt, P., Spruit, M., Sips, H.: Towards detection of botnet communication through social media by monitoring user activity. In: Jajodia, S., Mazumdar, C. (eds.) ICISS 2011. LNCS, vol.\u00a07093, pp. 131\u2013143. Springer, Heidelberg (2011)"},{"key":"10_CR5","unstructured":"Contagio: Skynet tor botnet \/ trojan.tbot samples (visited January 2013), http:\/\/contagiodump.blogspot.nl\/2012\/12\/dec-2012-skynet-tor-botnet-trojantbot.html"},{"key":"10_CR6","unstructured":"Cui, W., Katz, R.H., Tan, W.T.: Design and implementation of an extrusion-based break-in detector for personal computers. In: 21st Annual Computer Security Applications Conference, p. 10. IEEE (2005)"},{"key":"10_CR7","unstructured":"DeependResearch: Trojan nap aka kelihos\/hlux (visited February 2013), http:\/\/www.deependresearch.org\/2013\/02\/trojan-nap-aka-kelihoshlux-feb-2013.html"},{"key":"10_CR8","doi-asserted-by":"crossref","unstructured":"Dietrich, C.J., Rossow, C.: Empirical research of ip blacklists. In: ISSE 2008 Securing Electronic Business Processes, pp. 163\u2013171. Springer (2009)","DOI":"10.1007\/978-3-8348-9283-6_17"},{"key":"10_CR9","unstructured":"Fawcett, T.: Roc graphs: Notes and practical considerations for data mining researchers. Tech. rep., HP Laboratories, Palo Alto CA (2004)"},{"key":"10_CR10","unstructured":"Google.com: Top 1000 sites - doubleclick ad planner (visited March 2, 2013), http:\/\/www.google.com\/adplanner\/static\/top1000\/"},{"key":"10_CR11","unstructured":"Gu, G., Perdisci, R., Zhang, J., Lee, W.: Botminer: Clustering analysis of network traffic for protocol- and structure-independent botnet detection. In: Proc. of the 17th USENIX Security Symposium SECURITY 2008. USENIX Association, Berkeley (2008)"},{"key":"10_CR12","unstructured":"Gu, G., Porras, P., Yegneswaran, V., Fong, M., Lee, W.: Bothunter: Detecting malware infection through ids-driven dialog correlation. In: Proc. of 16th USENIX Security Symposium, p. 12. USENIX Association (2007)"},{"key":"10_CR13","unstructured":"Gummadi, R., Balakrishnan, H., Maniatis, P., Ratnasamy, S.: Not-a-bot: Improving service availability in the face of botnet attacks. In: Proc. of the 6th USENIX Symposium on Networked Systems Design and Implementation NSDI 2009. USENIX Association, Berkeley (2009)"},{"key":"10_CR14","doi-asserted-by":"crossref","unstructured":"Iliofotou, M., Pappu, P., Faloutsos, M., Mitzenmacher, M., Singh, S., Varghese, G.: Network monitoring using traffic dispersion graphs (tdgs). In: Proc. of the 7th ACM SIGCOMM Conference on Internet Measurement, pp. 315\u2013320. ACM (2007)","DOI":"10.1145\/1298306.1298349"},{"key":"10_CR15","doi-asserted-by":"crossref","unstructured":"Karagiannis, T., Papagiannaki, K., Faloutsos, M.: Blinc: multilevel traffic classification in the dark. In: ACM SIGCOMM Computer Communication Review, pp. 229\u2013240. ACM (2005)","DOI":"10.1145\/1090191.1080119"},{"key":"10_CR16","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"299","DOI":"10.1007\/978-3-642-24178-9_21","volume-title":"Information Hiding","author":"S. Nagaraja","year":"2011","unstructured":"Nagaraja, S., Houmansadr, A., Piyawongwisal, P., Singh, V., Agarwal, P., Borisov, N.: Stegobot: a covert social network botnet. In: Filler, T., Pevn\u00fd, T., Craver, S., Ker, A. (eds.) IH 2011. LNCS, vol.\u00a06958, pp. 299\u2013313. Springer, Heidelberg (2011)"},{"key":"10_CR17","unstructured":"Nazario, J.: Twitter-based botnet command channel (visited October 2010), http:\/\/asert.arbornetworks.com\/2009\/08\/twitter-based-botnet-command-channel\/"},{"key":"10_CR18","unstructured":"Roesch, M., et al.: Snort-lightweight intrusion detection for networks. In: Proc. of the 13th USENIX Conference on System Administration, Seattle, Washington, pp. 229\u2013238 (1999)"},{"key":"10_CR19","unstructured":"Satten, C.: Lossless gigabit remote packet capture with linux. Tech. rep., University of Washington (2008), http:\/\/staff.washington.edu\/corey\/gulp\/"},{"key":"10_CR20","doi-asserted-by":"crossref","unstructured":"Trammell, B.H., Boschi, E.: Rfc5103: Bidirectional flow export using ip flow information export (ipfix). IETF (2008)","DOI":"10.17487\/rfc5103"},{"key":"10_CR21","doi-asserted-by":"crossref","unstructured":"Zhang, H., Banick, W., Yao, D., Ramakrishnan, N.: User intention-based traffic dependence analysis for anomaly detection. In: 2012 IEEE Symposium on Security and Privacy Workshops (SPW), pp. 104\u2013112. IEEE (2012)","DOI":"10.1109\/SPW.2012.15"}],"container-title":["Lecture Notes in Computer Science","Cyberspace Safety and Security"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-03584-0_10","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,12,12]],"date-time":"2019-12-12T20:08:20Z","timestamp":1576181300000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-319-03584-0_10"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2013]]},"ISBN":["9783319035833","9783319035840"],"references-count":21,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-03584-0_10","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2013]]}}}