{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,3]],"date-time":"2026-03-03T14:21:06Z","timestamp":1772547666929,"version":"3.50.1"},"reference-count":32,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"1","license":[{"start":{"date-parts":[[2014,1,1]],"date-time":"2014-01-01T00:00:00Z","timestamp":1388534400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2014,1]]},"DOI":"10.1109\/tifs.2013.2290197","type":"journal-article","created":{"date-parts":[[2013,11,19]],"date-time":"2013-11-19T18:52:19Z","timestamp":1384887139000},"page":"27-38","source":"Crossref","is-referenced-by-count":73,"title":["Building a Scalable System for Stealthy P2P-Botnet Detection"],"prefix":"10.1109","volume":"9","author":[{"given":"Junjie","family":"Zhang","sequence":"first","affiliation":[]},{"given":"Roberto","family":"Perdisci","sequence":"additional","affiliation":[]},{"given":"Wenke","family":"Lee","sequence":"additional","affiliation":[]},{"given":"Xiapu","family":"Luo","sequence":"additional","affiliation":[]},{"given":"Unum","family":"Sarfraz","sequence":"additional","affiliation":[]}],"member":"263","reference":[{"key":"ref32","year":"2010","journal-title":"Resilient Botnet Command and Control with Tor"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2007.44"},{"key":"ref30","first-page":"127","article-title":"Handling churn in a DHT","author":"rhea","year":"2004","journal-title":"Proc Annu Conf USENIX Annu Tech Conf"},{"key":"ref10","first-page":"124","article-title":"Boosting the scalability of botnet detection using adaptive traffic sampling","author":"zhang","year":"2011","journal-title":"Proc 6th ACM Symp Inf Comput Commun Security"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2011.5958212"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/PST.2011.5971980"},{"key":"ref13","first-page":"55","article-title":"A P2P-botnet detection model and algorithms based on network streams analysis","author":"liu","year":"2010","journal-title":"Proc IEEE FITME"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/ITAPP.2010.5566407"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/1090191.1080119"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/988672.988742"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028804"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/1071690.1064220"},{"key":"ref19","first-page":"1","article-title":"Finding peer-to-peer file sharing using coarse network behaviors","author":"collins","year":"2006","journal-title":"Proc ESORICS '11"},{"key":"ref28","year":"2011","journal-title":"Zeus Gets More Sophisticated Using p2p Techniques"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2009.5403015"},{"key":"ref27","year":"2011","journal-title":"Autoit Script"},{"key":"ref3","author":"porras","year":"2009","journal-title":"Conficker C Analysis"},{"key":"ref6","first-page":"1","article-title":"Botgraph: Large scale spamming botnet detection","author":"zhao","year":"2009","journal-title":"Proc USENIX NSDI"},{"key":"ref29","first-page":"884","article-title":"On the stability of chordbased P2P systems","volume":"2","author":"binzenhofer","year":"2005","journal-title":"Proc IEEE Global Telecommun Conf"},{"key":"ref5","author":"lemos","year":"2006","journal-title":"Bot Software Looks to Improve Peerage"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2010.76"},{"key":"ref7","first-page":"139","article-title":"Botminer: Clustering analysis of network traffic for protocol-and structure-independent botnet detection","author":"gu","year":"2008","journal-title":"Proc Usenix Security"},{"key":"ref2","author":"porras","year":"2007","journal-title":"A multi-perspective analysis of the storm (peacomm) worm"},{"key":"ref9","first-page":"1","article-title":"BotGrep: Finding P2P bots with structured graph analysis","author":"nagaraja","year":"2010","journal-title":"Proc Usenix Security"},{"key":"ref1","first-page":"18","article-title":"Analysis of the storm and nugache trojans: P2P is here","volume":"32","author":"stover","year":"2007","journal-title":"Proc USENIX"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/1177080.1177105"},{"key":"ref22","author":"bartlett","year":"2007","journal-title":"Estimating P2P traffic volume at USC"},{"key":"ref21","first-page":"1","article-title":"Measurements and mitigation of peer-to-peer-based botnets: A case study on storm worm","author":"holz","year":"2008","journal-title":"Proc USENIX LEET"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1023\/A:1012801612483"},{"key":"ref23","doi-asserted-by":"crossref","first-page":"103","DOI":"10.1145\/235968.233324","article-title":"BIRCH: An efficient data clustering method for very large databases","author":"zhang","year":"1996","journal-title":"Proc ACM SIGMOD"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2010.5461939"},{"key":"ref25","year":"2011","journal-title":"Argus - Auditing Network Activity"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10206\/6684617\/06661360.pdf?arnumber=6661360","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,11,29]],"date-time":"2021-11-29T20:45:14Z","timestamp":1638218714000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/6661360\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014,1]]},"references-count":32,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.1109\/tifs.2013.2290197","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2014,1]]}}}