{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,21]],"date-time":"2026-02-21T18:39:00Z","timestamp":1771699140823,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":30,"publisher":"ACM","license":[{"start":{"date-parts":[[2009,3,8]],"date-time":"2009-03-08T00:00:00Z","timestamp":1236470400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2009,3,8]]},"DOI":"10.1145\/1529282.1529734","type":"proceedings-article","created":{"date-parts":[[2009,4,15]],"date-time":"2009-04-15T13:37:11Z","timestamp":1239802631000},"page":"2035-2041","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":40,"title":["Bayesian bot detection based on DNS traffic similarity"],"prefix":"10.1145","author":[{"given":"Ricardo","family":"Villamar\u00edn-Salom\u00f3n","sequence":"first","affiliation":[{"name":"University of Pittsburgh, Pittsburgh, PA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jos\u00e9 Carlos","family":"Brustoloni","sequence":"additional","affiliation":[{"name":"University of Pittsburgh, Pittsburgh, PA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2009,3,8]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/1080173.1080175"},{"key":"e_1_3_2_1_2_1","unstructured":"J. Stewart. \"Truman - The Reusable Unknown Malware Analysis Net.\" {Online} http:\/\/www.secureworks.com\/research\/tools\/truma.html  J. Stewart. \"Truman - The Reusable Unknown Malware Analysis Net.\" {Online} http:\/\/www.secureworks.com\/research\/tools\/truma.html"},{"key":"e_1_3_2_1_3_1","volume-title":"Pang-Ning Tan, Michael Steinbach, Vipin Kumar, \"Introduction to Data Mining\"","unstructured":"Pang-Ning Tan, Michael Steinbach, Vipin Kumar, \"Introduction to Data Mining\" ( 1 st ed.) Pang-Ning Tan, Michael Steinbach, Vipin Kumar, \"Introduction to Data Mining\" (1st ed.)","edition":"1"},{"key":"e_1_3_2_1_4_1","unstructured":"McAfee \u00a9 SiteAdvisor \"Report for cpaclicks.com \" {Online} http:\/\/www.siteadvisor.com\/sites\/cpaclicks.com  McAfee \u00a9 SiteAdvisor \"Report for cpaclicks.com \" {Online} http:\/\/www.siteadvisor.com\/sites\/cpaclicks.com"},{"key":"e_1_3_2_1_5_1","unstructured":"The Honeynet Project \"Know your Enemy: Tracking Botnets -- Bot-Commands\" {Online} http:\/\/honeynet.org\/papers\/bots\/botnet-commands.html  The Honeynet Project \"Know your Enemy: Tracking Botnets -- Bot-Commands\" {Online} http:\/\/honeynet.org\/papers\/bots\/botnet-commands.html"},{"key":"e_1_3_2_1_6_1","unstructured":"Kaspersky Lab's VirusList.com \"Backdoor.SdBot.gen\" http:\/\/viruslist.com\/en\/viruses\/encyclopedia?virusid=24976  Kaspersky Lab's VirusList.com \"Backdoor.SdBot.gen\" http:\/\/viruslist.com\/en\/viruses\/encyclopedia?virusid=24976"},{"key":"e_1_3_2_1_7_1","unstructured":"Kaspersky Lab's VirusList.com \"Net-Worm.Win32.Bobic.k\" {Online} http:\/\/viruslist.com\/en\/viruses\/encyclopedia?virusid=90085  Kaspersky Lab's VirusList.com \"Net-Worm.Win32.Bobic.k\" {Online} http:\/\/viruslist.com\/en\/viruses\/encyclopedia?virusid=90085"},{"key":"e_1_3_2_1_8_1","unstructured":"Shawn Collins' Affiliate Marketing Blog \"Florida Attorney General Investigates Affiliate Marketers \" {Online} http:\/\/blog.affiliatetip.com\/archives\/florida-attorney-general-investigates-affiliate-marketers\/  Shawn Collins' Affiliate Marketing Blog \"Florida Attorney General Investigates Affiliate Marketers \" {Online} http:\/\/blog.affiliatetip.com\/archives\/florida-attorney-general-investigates-affiliate-marketers\/"},{"key":"e_1_3_2_1_9_1","volume-title":"Proc. 17th Annual FIRST Conf.","author":"Weimer F.","year":"2005","unstructured":"F. Weimer . \" Passive DNS Replication ,\" in Proc. 17th Annual FIRST Conf. , July 2005 . {Online} http:\/\/www.first.org\/conference\/2005\/papers\/florian-weimer-paper-1.pdf F. Weimer. \"Passive DNS Replication,\" in Proc. 17th Annual FIRST Conf., July 2005. {Online} http:\/\/www.first.org\/conference\/2005\/papers\/florian-weimer-paper-1.pdf"},{"key":"e_1_3_2_1_10_1","unstructured":"Kaspersky Lab's VirusList.com \"Email-Worm.Win32.NetSky.ae \" {Online} http:\/\/viruslist.com\/en\/viruses\/encyclopedia?virusid=50431  Kaspersky Lab's VirusList.com \"Email-Worm.Win32.NetSky.ae \" {Online} http:\/\/viruslist.com\/en\/viruses\/encyclopedia?virusid=50431"},{"key":"e_1_3_2_1_11_1","unstructured":"MWCollect. \"Malware Dedicated Whitehats.\" {Online} http:\/\/www.mwcollect.org\/  MWCollect. \"Malware Dedicated Whitehats.\" {Online} http:\/\/www.mwcollect.org\/"},{"key":"e_1_3_2_1_12_1","unstructured":"VirusTotal. \"Free Online Virus and Malware Scan.\" {Online} http:\/\/www.virustotal.com\/  VirusTotal. \"Free Online Virus and Malware Scan.\" {Online} http:\/\/www.virustotal.com\/"},{"key":"e_1_3_2_1_13_1","volume":"107","author":"Robinson Gary","year":"2003","unstructured":"Gary Robinson . \" A statistical approach to the spam problem\". In Linux Journal 107 , March 2003 , {Online} http:\/\/www.linuxjournal.com\/article.php?sid=6467 Gary Robinson. \"A statistical approach to the spam problem\". In Linux Journal 107, March 2003, {Online} http:\/\/www.linuxjournal.com\/article.php?sid=6467","journal-title":"Linux Journal"},{"key":"e_1_3_2_1_14_1","unstructured":"Gary Robinson \"Spam Detection\" {Online} http:\/\/radio.weblogs.com\/0101454\/stories\/2002\/09\/16\/spamDetection.html  Gary Robinson \"Spam Detection\" {Online} http:\/\/radio.weblogs.com\/0101454\/stories\/2002\/09\/16\/spamDetection.html"},{"key":"e_1_3_2_1_15_1","unstructured":"Greg Louis \"Bogofilter Calculations: Comparing Geometric Mean with Fisher's Method for Combining Probabilities \" {Online} http:\/\/www.bgl.nu\/bogofilter\/fisher.html  Greg Louis \"Bogofilter Calculations: Comparing Geometric Mean with Fisher's Method for Combining Probabilities \" {Online} http:\/\/www.bgl.nu\/bogofilter\/fisher.html"},{"key":"e_1_3_2_1_16_1","volume-title":"Botnets as a Vehicle for Online Crime","author":"Ianelli N.","year":"2005","unstructured":"N. Ianelli and A. Hackworth . Botnets as a Vehicle for Online Crime . CERT Coordination Center , 2005 . N. Ianelli and A. Hackworth. Botnets as a Vehicle for Online Crime. CERT Coordination Center, 2005."},{"key":"e_1_3_2_1_17_1","volume-title":"Steps to Reducing Unwanted Traffic on the Internet Workshop","author":"Cooke Evan","year":"2005","unstructured":"Evan Cooke and Farnam Jahanian . The zombie roundup: Understanding, detecting, and disrupting botnets . In Steps to Reducing Unwanted Traffic on the Internet Workshop , 2005 . Evan Cooke and Farnam Jahanian. The zombie roundup: Understanding, detecting, and disrupting botnets. In Steps to Reducing Unwanted Traffic on the Internet Workshop, 2005."},{"key":"e_1_3_2_1_18_1","unstructured":"Shadowserver Foundation. {Online} http:\/\/shadowserver.org\/wiki\/pmwiki.php?n=Shadowserver.Shadowserver  Shadowserver Foundation. {Online} http:\/\/shadowserver.org\/wiki\/pmwiki.php?n=Shadowserver.Shadowserver"},{"key":"e_1_3_2_1_19_1","unstructured":"Honeynet Project. \"Know Your Enemy: Fast-Flux Service Networks.\" {Online} http:\/\/www.honeynet.org\/papers\/ff\/fast-flux.pdf  Honeynet Project. \"Know Your Enemy: Fast-Flux Service Networks.\" {Online} http:\/\/www.honeynet.org\/papers\/ff\/fast-flux.pdf"},{"key":"e_1_3_2_1_20_1","unstructured":"Paul Graham \"A Plan for Spam \" {Online} http:\/\/www.paulgraham.com\/spam.html.  Paul Graham \"A Plan for Spam \" {Online} http:\/\/www.paulgraham.com\/spam.html."},{"key":"e_1_3_2_1_21_1","volume-title":"No Starch Press","author":"Zdziarski Jonathan","year":"2005","unstructured":"Jonathan Zdziarski , \" Ending Spam : Bayesian Content Filtering and the Art of Statistical Language Classification \". No Starch Press , 2005 . Jonathan Zdziarski, \"Ending Spam: Bayesian Content Filtering and the Art of Statistical Language Classification\". No Starch Press, 2005."},{"key":"e_1_3_2_1_22_1","unstructured":"Paul Albitzand and Cricket Liu \"DNS and BIND\". O'Reilly and Associates 2001.   Paul Albitzand and Cricket Liu \"DNS and BIND\". O'Reilly and Associates 2001."},{"key":"e_1_3_2_1_23_1","volume-title":"7th IEEE International Conference on Computer and Information Technology (CIT)","author":"Choi Hyunsang","year":"2007","unstructured":"Hyunsang Choi , Hanwoo Lee , Heejo Lee , Hyogon Kim , \"Botnet Detection by Monitoring Group Activities in DNS Traffic,\" in 7th IEEE International Conference on Computer and Information Technology (CIT) , 2007 . Hyunsang Choi, Hanwoo Lee, Heejo Lee, Hyogon Kim, \"Botnet Detection by Monitoring Group Activities in DNS Traffic,\" in 7th IEEE International Conference on Computer and Information Technology (CIT), 2007."},{"key":"e_1_3_2_1_24_1","volume-title":"Proc. of USENIX Security Symposium","author":"Gu G.","year":"2007","unstructured":"G. Gu , P. Porras , V. Yegneswaran , M. Fong , W. Lee : \" BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation . In Proc. of USENIX Security Symposium , Boston, MA , August 2007 . G. Gu, P. Porras, V. Yegneswaran, M. Fong, W. Lee: \"BotHunter: Detecting Malware Infection Through IDS-Driven Dialog Correlation. In Proc. of USENIX Security Symposium, Boston, MA, August 2007."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/1177080.1177086"},{"key":"e_1_3_2_1_26_1","volume-title":"ISOC","author":"Gu G.","year":"2008","unstructured":"G. Gu , J. Zhang and W. Lee . \" BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic,\" in Proceedings of the 15th Annual Network and Distributed System Security Symposium , ISOC , February 2008 . G. Gu, J. Zhang and W. Lee. \"BotSniffer: Detecting Botnet Command and Control Channels in Network Traffic,\" in Proceedings of the 15th Annual Network and Distributed System Security Symposium, ISOC, February 2008."},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.5555\/308574.308676"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-70542-0_11"},{"key":"e_1_3_2_1_29_1","volume-title":"IEEE International Conference on Communications (ICC)","author":"Yoshioka D.","year":"2008","unstructured":"Inoue, D. Yoshioka , K. Eto , M. Hoshizawa , Y. Nakao , K. \" Malware Behavior Analysis in Isolated Miniature Network for Revealing Malware's Network Activity\". IEEE International Conference on Communications (ICC) 2008 . Inoue, D. Yoshioka, K. Eto, M. Hoshizawa, Y. Nakao, K. \"Malware Behavior Analysis in Isolated Miniature Network for Revealing Malware's Network Activity\". IEEE International Conference on Communications (ICC) 2008."},{"key":"e_1_3_2_1_30_1","volume-title":"5th IEEE Consumer Communications and Networking Conference (CCNC)","author":"Identifying Botnets Using Anomaly J. C.","year":"2008","unstructured":"Villamar\u00edn-Salom\u00f3n, R., Brustoloni, J. C. \" Identifying Botnets Using Anomaly Detection Techniques Applied to DNS Traffic\". 5th IEEE Consumer Communications and Networking Conference (CCNC) , 2008 . Villamar\u00edn-Salom\u00f3n, R., Brustoloni, J. C. \"Identifying Botnets Using Anomaly Detection Techniques Applied to DNS Traffic\". 5th IEEE Consumer Communications and Networking Conference (CCNC), 2008."}],"event":{"name":"SAC09: The 2009 ACM Symposium on Applied Computing","location":"Honolulu Hawaii","acronym":"SAC09","sponsor":["SIGAPP ACM Special Interest Group on Applied Computing"]},"container-title":["Proceedings of the 2009 ACM symposium on Applied Computing"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1529282.1529734","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1529282.1529734","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T13:29:30Z","timestamp":1750253370000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1529282.1529734"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009,3,8]]},"references-count":30,"alternative-id":["10.1145\/1529282.1529734","10.1145\/1529282"],"URL":"https:\/\/doi.org\/10.1145\/1529282.1529734","relation":{},"subject":[],"published":{"date-parts":[[2009,3,8]]},"assertion":[{"value":"2009-03-08","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}