{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T16:40:09Z","timestamp":1775061609846,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":24,"publisher":"ACM","license":[{"start":{"date-parts":[[2006,10,25]],"date-time":"2006-10-25T00:00:00Z","timestamp":1161734400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2006,10,25]]},"DOI":"10.1145\/1177080.1177086","type":"proceedings-article","created":{"date-parts":[[2007,1,17]],"date-time":"2007-01-17T01:15:56Z","timestamp":1168996556000},"page":"41-52","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":292,"title":["A multifaceted approach to understanding the botnet phenomenon"],"prefix":"10.1145","author":[{"given":"Moheeb","family":"Abu Rajab","sequence":"first","affiliation":[{"name":"Johns Hopkins University, Baltimore, Maryland, USA"}]},{"given":"Jay","family":"Zarfoss","sequence":"additional","affiliation":[{"name":"Johns Hopkins University, Baltimore, Maryland, USA"}]},{"given":"Fabian","family":"Monrose","sequence":"additional","affiliation":[{"name":"Johns Hopkins University, Baltimore, Maryland, USA"}]},{"given":"Andreas","family":"Terzis","sequence":"additional","affiliation":[{"name":"Johns Hopkins University, Baltimore, Maryland, USA"}]}],"member":"320","published-online":{"date-parts":[[2006,10,25]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Paul Baecher Thorsten Holz Markus K\u00f6tter and Georg Wicherski. The Malware Collection Tool (mwcollect). Available at http:\/\/www.mwcollect.org\/.  Paul Baecher Thorsten Holz Markus K\u00f6tter and Georg Wicherski. The Malware Collection Tool (mwcollect). Available at http:\/\/www.mwcollect.org\/."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1007\/11856214_9"},{"key":"e_1_3_2_1_3_1","volume-title":"An Inside Look at Botnets. To appear in Series: Advances in Information Security","author":"Barford Paul","year":"2006","unstructured":"Paul Barford and Vinod Yagneswaran . An Inside Look at Botnets. To appear in Series: Advances in Information Security , Springer , 2006 . Paul Barford and Vinod Yagneswaran. An Inside Look at Botnets. To appear in Series: Advances in Information Security, Springer, 2006."},{"key":"e_1_3_2_1_4_1","unstructured":"Clam AntiVirus. Available at http:\/\/www.clamav.net\/.  Clam AntiVirus. Available at http:\/\/www.clamav.net\/."},{"key":"e_1_3_2_1_5_1","first-page":"39","volume-title":"Proceedings of the first Workshop on Steps to Reducing Unwanted Traffic on the Internet (STRUTI)","author":"Cooke Evan","year":"2005","unstructured":"Evan Cooke , Farnam Jahanian , and Danny McPherson . The Zombie Roundup: Understanding, Detecting, and Disturbing Botnets . In Proceedings of the first Workshop on Steps to Reducing Unwanted Traffic on the Internet (STRUTI) , pages 39 -- 44 , July 2005 . Evan Cooke, Farnam Jahanian, and Danny McPherson. The Zombie Roundup: Understanding, Detecting, and Disturbing Botnets. In Proceedings of the first Workshop on Steps to Reducing Unwanted Traffic on the Internet (STRUTI), pages 39--44, July 2005."},{"key":"e_1_3_2_1_6_1","volume-title":"Wenke Lee. Modeling Botnet Propagation Using Time Zones. In Proceedings of the 13th Network and Distributed System Security Symposium NDSS","author":"Dagon David","year":"2006","unstructured":"David Dagon , Cliff Zou , and Wenke Lee. Modeling Botnet Propagation Using Time Zones. In Proceedings of the 13th Network and Distributed System Security Symposium NDSS , February 2006 . David Dagon, Cliff Zou, and Wenke Lee. Modeling Botnet Propagation Using Time Zones. In Proceedings of the 13th Network and Distributed System Security Symposium NDSS, February 2006."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/352600.352606"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1007\/11555827_19"},{"key":"e_1_3_2_1_9_1","unstructured":"Luis\n      Grangeia\n    .\n  DNS Cache Snooping or Snooping the Cache for Fun and Profit Available at http:www.\/\/sysvalue.com\/papers\/DNS-Cache-Snooping\/files\/DNS_Cache_Snooping_1.1.pdf 2004\n  .  Luis Grangeia. DNS Cache Snooping or Snooping the Cache for Fun and Profit Available at http:www.\/\/sysvalue.com\/papers\/DNS-Cache-Snooping\/files\/DNS_Cache_Snooping_1.1.pdf 2004."},{"key":"e_1_3_2_1_10_1","unstructured":"Honeyd Virtual Honeypot Framework http:\/\/www.honeyd.org\/.  Honeyd Virtual Honeypot Framework http:\/\/www.honeyd.org\/."},{"key":"e_1_3_2_1_11_1","unstructured":"IP2LOCATION Bringing Geography to the Internet. Available at http:\/\/www.ip2location.com\/.  IP2LOCATION Bringing Geography to the Internet. Available at http:\/\/www.ip2location.com\/."},{"key":"e_1_3_2_1_12_1","volume-title":"January","author":"Johns M. St.","year":"1993","unstructured":"M. St. Johns . RFC 1413: Identification protocol , January 1993 . M. St. Johns. RFC 1413: Identification protocol, January 1993."},{"key":"e_1_3_2_1_13_1","volume-title":"April","author":"Kalt C.","year":"2000","unstructured":"C. Kalt . Internet Relay Chat: Client Protocol. RFC 2812 (Informational) , April 2000 . C. Kalt. Internet Relay Chat: Client Protocol. RFC 2812 (Informational), April 2000."},{"key":"e_1_3_2_1_14_1","unstructured":"Dan Kaminsky. Welcome to Planet Sony http:\/\/www.doxpara.com\/.  Dan Kaminsky. Welcome to Planet Sony http:\/\/www.doxpara.com\/."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/354871.354874"},{"key":"e_1_3_2_1_16_1","unstructured":"Willaim Metcalf. Snort In-line. Available at http:\/\/snort-inline.sourceforge.net\/.  Willaim Metcalf. Snort In-line. Available at http:\/\/snort-inline.sourceforge.net\/."},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/988672.988674"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/774763.774772"},{"key":"e_1_3_2_1_19_1","volume-title":"March","author":"Project Honeynet","year":"2005","unstructured":"Honeynet Project and Research Alliance . Know your enemy: Tracking Botnets , March 2005 . See http:\/\/www.honeynet.org\/papers\/bots\/. Honeynet Project and Research Alliance. Know your enemy: Tracking Botnets, March 2005. See http:\/\/www.honeynet.org\/papers\/bots\/."},{"key":"e_1_3_2_1_20_1","first-page":"1","volume-title":"Proceedings of the USENIX Security Symposium","author":"Provos Niels","year":"2004","unstructured":"Niels Provos . A virtual honeypot framework . In Proceedings of the USENIX Security Symposium , pages 1 -- 14 , August 2004 . Niels Provos. A virtual honeypot framework. In Proceedings of the USENIX Security Symposium, pages 1--14, August 2004."},{"key":"e_1_3_2_1_21_1","volume-title":"USENIX Annual Technical Conference","author":"Sugerman Jeremy","year":"2001","unstructured":"Jeremy Sugerman , Ganesh Venkitachalam , and Beng-Hong Lim . Virtualizing IO Devices on VMware Workstation's Hosted Virtual Machine Monitor . In USENIX Annual Technical Conference , 2001 . Available at http:\/\/www.vmware.com\/. Jeremy Sugerman, Ganesh Venkitachalam, and Beng-Hong Lim. Virtualizing IO Devices on VMware Workstation's Hosted Virtual Machine Monitor. In USENIX Annual Technical Conference, 2001. Available at http:\/\/www.vmware.com\/."},{"key":"e_1_3_2_1_22_1","unstructured":"The UnrealIRC Team. Unrealircd. See http:\/\/www.unrealircd.com\/.  The UnrealIRC Team. Unrealircd. See http:\/\/www.unrealircd.com\/."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/1095809.1095825"},{"key":"e_1_3_2_1_24_1","volume-title":"Vern Paxson and Randy H. Katz. Protocol-Independent Adaptive Replay of Application Dialog. In Proceedings of the 13th Annual Network and Distributed System Security Symposium (NDSS)","author":"Weidong Cui Nick Weaver","year":"2006","unstructured":"Nick Weaver Weidong Cui , Vern Paxson and Randy H. Katz. Protocol-Independent Adaptive Replay of Application Dialog. In Proceedings of the 13th Annual Network and Distributed System Security Symposium (NDSS) , San Diego, CA , Feb 2006 . Nick Weaver Weidong Cui, Vern Paxson and Randy H. Katz. Protocol-Independent Adaptive Replay of Application Dialog. In Proceedings of the 13th Annual Network and Distributed System Security Symposium (NDSS), San Diego, CA, Feb 2006."}],"event":{"name":"IMC06: Internet Measurement Conference","location":"Rio de Janeriro Brazil","acronym":"IMC06","sponsor":["SIGCOMM ACM Special Interest Group on Data Communication","ACM Association for Computing Machinery"]},"container-title":["Proceedings of the 6th ACM SIGCOMM conference on Internet measurement"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1177080.1177086","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1177080.1177086","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T14:51:38Z","timestamp":1750258298000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1177080.1177086"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2006,10,25]]},"references-count":24,"alternative-id":["10.1145\/1177080.1177086","10.1145\/1177080"],"URL":"https:\/\/doi.org\/10.1145\/1177080.1177086","relation":{},"subject":[],"published":{"date-parts":[[2006,10,25]]},"assertion":[{"value":"2006-10-25","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}