{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,16]],"date-time":"2026-03-16T14:08:37Z","timestamp":1773670117322,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":24,"publisher":"ACM","license":[{"start":{"date-parts":[[2008,8,17]],"date-time":"2008-08-17T00:00:00Z","timestamp":1218931200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2008,8,17]]},"DOI":"10.1145\/1402958.1402979","type":"proceedings-article","created":{"date-parts":[[2008,8,19]],"date-time":"2008-08-19T08:38:39Z","timestamp":1219135119000},"page":"171-182","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":122,"title":["Spamming botnets"],"prefix":"10.1145","author":[{"given":"Yinglian","family":"Xie","sequence":"first","affiliation":[{"name":"Microsoft Research, Silicon Valley, Mountain View, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Fang","family":"Yu","sequence":"additional","affiliation":[{"name":"Microsoft Research, Silicon Valley, Mountain View, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kannan","family":"Achan","sequence":"additional","affiliation":[{"name":"Microsoft Research, Silicon Valley, Mountain View, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Rina","family":"Panigrahy","sequence":"additional","affiliation":[{"name":"Microsoft Research, Silicon Valley, Mountain View, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Geoff","family":"Hulten","sequence":"additional","affiliation":[{"name":"Microsoft Corporation, Redmond, WA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ivan","family":"Osipkov","sequence":"additional","affiliation":[{"name":"Microsoft Corporation, Redmond, WA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2008,8,17]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1570-8667(03)00065-0"},{"key":"e_1_3_2_1_2_1","volume-title":"14th conference on USENIX Security Symposium","author":"Anderson D. S.","year":"2007","unstructured":"D. S. Anderson , C. Fleizach , S. Savage , and G. M. Voelker . Spamscatter: Characterizing Internet scam hosting infrastructure . In 14th conference on USENIX Security Symposium , 2007 . D. S. Anderson, C. Fleizach, S. Savage, and G. M. Voelker. Spamscatter: Characterizing Internet scam hosting infrastructure. In 14th conference on USENIX Security Symposium, 2007."},{"key":"e_1_3_2_1_3_1","first-page":"2396","author":"Berners-Lee T.","year":"1998","unstructured":"T. Berners-Lee , R. Fielding , and L. Masinter . Uniform resource identifiers (URI): Generic syntax. RFC 2396 , 1998 . T. Berners-Lee, R. Fielding, and L. Masinter. Uniform resource identifiers (URI): Generic syntax. RFC 2396, 1998.","journal-title":"Uniform resource identifiers (URI): Generic syntax. RFC"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.5555\/1323128.1323138"},{"key":"e_1_3_2_1_5_1","volume-title":"Proc. of the 13th Annual Network and Distributed System Security Symposium (NDSS)","author":"Dagon D.","year":"2006","unstructured":"D. Dagon , C. Zou , and W. Lee . Modeling botnet propagation using time zones . In Proc. of the 13th Annual Network and Distributed System Security Symposium (NDSS) , 2006 . D. Dagon, C. Zou, and W. Lee. Modeling botnet propagation using time zones. In Proc. of the 13th Annual Network and Distributed System Security Symposium (NDSS), 2006."},{"key":"e_1_3_2_1_6_1","volume-title":"The First Workshop in Understanding Botnets","author":"Daswani N.","year":"2007","unstructured":"N. Daswani , M. Stoppelman, and the Google click quality and security teams. The anatomy of Clickbot.A . In The First Workshop in Understanding Botnets , 2007 . N. Daswani, M. Stoppelman, and the Google click quality and security teams. The anatomy of Clickbot.A. In The First Workshop in Understanding Botnets, 2007."},{"key":"e_1_3_2_1_7_1","unstructured":"Dshield: Cooperative network security community. Dynablock dynamic IP list. http:\/\/www.njabl.org\/ recently aquired by spamhaus http:\/\/www.spamhaus.org\/pbl\/index.lasso 2007.  Dshield: Cooperative network security community. Dynablock dynamic IP list. http:\/\/www.njabl.org\/ recently aquired by spamhaus http:\/\/www.spamhaus.org\/pbl\/index.lasso 2007."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1002\/spe.577"},{"key":"e_1_3_2_1_9_1","volume-title":"LEET 08: First USENIX Workshop on Large-Scale Exploits and Emergent Threats","author":"Holz T.","year":"2008","unstructured":"T. Holz , M. Steiner , F. Dahl , E. Biersack , and F. Freiling . Measurements and mitigation of peer-to-peer-based botnets: A case study on storm worm . In LEET 08: First USENIX Workshop on Large-Scale Exploits and Emergent Threats , 2008 . T. Holz, M. Steiner, F. Dahl, E. Biersack, and F. Freiling. Measurements and mitigation of peer-to-peer-based botnets: A case study on storm worm. In LEET 08: First USENIX Workshop on Large-Scale Exploits and Emergent Threats, 2008."},{"key":"e_1_3_2_1_10_1","volume-title":"LEET '08: First USENIX Workshop on Large-Scale Exploits and Emergent Threats","author":"Kanich C.","year":"2008","unstructured":"C. Kanich , K. Levchenko , B. Enright , G. M. Voelker , and S. Savage . The Heisenbot uncertainty problem: Challenges in separating bots from chaff . In LEET '08: First USENIX Workshop on Large-Scale Exploits and Emergent Threats , 2008 . C. Kanich, K. Levchenko, B. Enright, G. M. Voelker, and S. Savage. The Heisenbot uncertainty problem: Challenges in separating bots from chaff. In LEET '08: First USENIX Workshop on Large-Scale Exploits and Emergent Threats, 2008."},{"key":"e_1_3_2_1_11_1","volume-title":"the 13th conference on USENIX Security Symposium","author":"Kim H.-A.","year":"2004","unstructured":"H.-A. Kim and B. Karp . Autograph: Toward automated, distributed worm signature detection . In the 13th conference on USENIX Security Symposium , 2004 . H.-A. Kim and B. Karp. Autograph: Toward automated, distributed worm signature detection. In the 13th conference on USENIX Security Symposium, 2004."},{"key":"e_1_3_2_1_12_1","volume-title":"2nd Workshop on Hot Topics in Networks (HotNets-II)","author":"Kreibich C.","year":"2003","unstructured":"C. Kreibich and J. Crowcroft . Honeycomb: Creating intrusion detection signatures using honeypots . In 2nd Workshop on Hot Topics in Networks (HotNets-II) , 2003 . C. Kreibich and J. Crowcroft. Honeycomb: Creating intrusion detection signatures using honeypots. In 2nd Workshop on Hot Topics in Networks (HotNets-II), 2003."},{"key":"e_1_3_2_1_13_1","volume-title":"CEAS 2006: Proceedings of the 3rd conference on email and anti-spam","author":"Li F.","year":"2006","unstructured":"F. Li and M.-H. Hsieh . An empirical study of clustering behavior of spammers and group-based anti-spam strategies . In CEAS 2006: Proceedings of the 3rd conference on email and anti-spam , 2006 . F. Li and M.-H. Hsieh. An empirical study of clustering behavior of spammers and group-based anti-spam strategies. In CEAS 2006: Proceedings of the 3rd conference on email and anti-spam, 2006."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.18"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2005.15"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/1177080.1177086"},{"key":"e_1_3_2_1_17_1","volume-title":"Conference on Email and Anti-Spam","author":"Ramachandran A.","year":"2006","unstructured":"A. Ramachandran , D. Dagon , and N. Feamster . Can DNS based blacklists keep up with bots ? In Conference on Email and Anti-Spam , 2006 . A. Ramachandran, D. Dagon, and N. Feamster. Can DNS based blacklists keep up with bots? In Conference on Email and Anti-Spam, 2006."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1145\/1159913.1159947"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315288"},{"key":"e_1_3_2_1_20_1","volume-title":"OSDI","author":"Singh S.","year":"2004","unstructured":"S. Singh , C. Estan , G. Varghese , and S. Savage . Automated worm fingerprinting . In OSDI , 2004 . S. Singh, C. Estan, G. Varghese, and S. Savage. Automated worm fingerprinting. In OSDI, 2004."},{"key":"e_1_3_2_1_21_1","volume-title":"Jan","year":"2007","unstructured":"Spamhaus policy block list (PBL). http:\/\/www.spamhaus.org\/pbl\/ , Jan 2007 . Spamhaus policy block list (PBL). http:\/\/www.spamhaus.org\/pbl\/, Jan 2007."},{"key":"e_1_3_2_1_22_1","volume-title":"Proceedings of the Third Conference on Email and Anti-Spam (CEAS)","author":"Webb S.","year":"2006","unstructured":"S. Webb , J. Caverlee , and C. Pu . Introducing the web spam corpus: Using email spam to identify web spam automatically . In Proceedings of the Third Conference on Email and Anti-Spam (CEAS) , 2006 . S. Webb, J. Caverlee, and C. Pu. Introducing the web spam corpus: Using email spam to identify web spam automatically. In Proceedings of the Third Conference on Email and Anti-Spam (CEAS), 2006."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/1282380.1282415"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.5555\/1387709.1387711"}],"event":{"name":"SIGCOMM '08: ACM SIGCOMM 2008 Conference","location":"Seattle WA USA","acronym":"SIGCOMM '08","sponsor":["SIGCOMM ACM Special Interest Group on Data Communication","ACM Association for Computing Machinery"]},"container-title":["Proceedings of the ACM SIGCOMM 2008 conference on Data communication"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1402958.1402979","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1402958.1402979","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T10:47:19Z","timestamp":1750243639000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1402958.1402979"}},"subtitle":["signatures and characteristics"],"short-title":[],"issued":{"date-parts":[[2008,8,17]]},"references-count":24,"alternative-id":["10.1145\/1402958.1402979","10.1145\/1402958"],"URL":"https:\/\/doi.org\/10.1145\/1402958.1402979","relation":{"is-identical-to":[{"id-type":"doi","id":"10.1145\/1402946.1402979","asserted-by":"object"}]},"subject":[],"published":{"date-parts":[[2008,8,17]]},"assertion":[{"value":"2008-08-17","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}