{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,21]],"date-time":"2026-02-21T18:51:09Z","timestamp":1771699869570,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":28,"publisher":"ACM","license":[{"start":{"date-parts":[[2009,3,10]],"date-time":"2009-03-10T00:00:00Z","timestamp":1236643200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000015","name":"U.S. Department of Energy","doi-asserted-by":"publisher","award":["DE-FG02-05ER25692\/\/A001"],"award-info":[{"award-number":["DE-FG02-05ER25692\/\/A001"]}],"id":[{"id":"10.13039\/100000015","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000144","name":"Division of Computer and Network Systems","doi-asserted-by":"publisher","award":["NSF-0433702CNS-0627320"],"award-info":[{"award-number":["NSF-0433702CNS-0627320"]}],"id":[{"id":"10.13039\/100000144","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000181","name":"Air Force Office of Scientific Research","doi-asserted-by":"publisher","award":["FA9550-07-1-0074"],"award-info":[{"award-number":["FA9550-07-1-0074"]}],"id":[{"id":"10.13039\/100000181","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["NSF-0433702CNS-0627320"],"award-info":[{"award-number":["NSF-0433702CNS-0627320"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2009,3,10]]},"DOI":"10.1145\/1533057.1533063","type":"proceedings-article","created":{"date-parts":[[2009,4,28]],"date-time":"2009-04-28T14:57:19Z","timestamp":1240930639000},"page":"11-22","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":31,"title":["Automating analysis of large-scale botnet probing events"],"prefix":"10.1145","author":[{"given":"Zhichun","family":"Li","sequence":"first","affiliation":[{"name":"Northwestern University, Evanston, IL"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Anup","family":"Goyal","sequence":"additional","affiliation":[{"name":"Northwestern University, Evanston, IL"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yan","family":"Chen","sequence":"additional","affiliation":[{"name":"Northwestern University, Evanston, IL"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Vern","family":"Paxson","sequence":"additional","affiliation":[{"name":"UC Berkeley & ICSI, Berkeley, CA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2009,3,10]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"AP Market Sharing. http:\/\/news.com.com\/Microsofts+Wi-Fi+ups+and+downs\/2100--1039_3--994518.  AP Market Sharing. http:\/\/news.com.com\/Microsofts+Wi-Fi+ups+and+downs\/2100--1039_3--994518."},{"key":"e_1_3_2_1_2_1","unstructured":"HoneyBow Sensor. http:\/\/honeybow.mwcollect.org.  HoneyBow Sensor. http:\/\/honeybow.mwcollect.org."},{"key":"e_1_3_2_1_3_1","unstructured":"Honeysnap. http:\/\/www.honeynet.org\/tools\/honeysnap\/index.html.  Honeysnap. http:\/\/www.honeynet.org\/tools\/honeysnap\/index.html."},{"key":"e_1_3_2_1_4_1","unstructured":"Net-Worm.Win32.Allaple.a. http:\/\/www.viruslist.com\/en\/viruses\/encyclopedia?virusid=145521.  Net-Worm.Win32.Allaple.a. http:\/\/www.viruslist.com\/en\/viruses\/encyclopedia?virusid=145521."},{"key":"e_1_3_2_1_5_1","unstructured":"OS Platform Statistics by W3school. http:\/\/www.w3schools.com\/browsers\/browsers_stats.asp.  OS Platform Statistics by W3school. http:\/\/www.w3schools.com\/browsers\/browsers_stats.asp."},{"key":"e_1_3_2_1_6_1","unstructured":"Bacher P. Holz T. Kotter M. and Wicherski G. Know your Enemy: Tracking Botnets. http:\/\/www.honeynet.org\/papers\/bots.  Bacher P. Holz T. Kotter M. and Wicherski G. Know your Enemy: Tracking Botnets. http:\/\/www.honeynet.org\/papers\/bots."},{"key":"e_1_3_2_1_7_1","series-title":"In Series: Advances in Information Security","volume-title":"An inside look at botnets","author":"Barford P.","year":"2006","unstructured":"Barford , P. , An inside look at botnets . In Series: Advances in Information Security . Springer , 2006 . Barford, P., et al. An inside look at botnets. In Series: Advances in Information Security. Springer, 2006."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/637201.637243"},{"key":"e_1_3_2_1_9_1","volume-title":"Proc. of the USENIX Security","author":"Bethencourt J.","year":"2005","unstructured":"Bethencourt , J. , Mapping internet sensors with probe response attacks . In Proc. of the USENIX Security ( 2005 ). Bethencourt, J., et al. Mapping internet sensors with probe response attacks. In Proc. of the USENIX Security (2005)."},{"key":"e_1_3_2_1_11_1","volume-title":"Proc. of USENIX HotBots","author":"Chiang K.","year":"2007","unstructured":"Chiang , K. , and Lloyd , L . A case study of the rustock rootkit and spam bot . In Proc. of USENIX HotBots ( 2007 ). Chiang, K., and Lloyd, L. A case study of the rustock rootkit and spam bot. In Proc. of USENIX HotBots (2007)."},{"key":"e_1_3_2_1_12_1","volume-title":"Proc. of USENIX Security","author":"Gu G.","year":"2007","unstructured":"Gu , G. , Porras , P. , Yegneswaran , V. , Fong , M. , and Lee , W . Bothunter: Detecting malware infection through ids-driven dialog correlation . In Proc. of USENIX Security ( 2007 ). Gu, G., Porras, P., Yegneswaran, V., Fong, M., and Lee, W. Bothunter: Detecting malware infection through ids-driven dialog correlation. In Proc. of USENIX Security (2007)."},{"key":"e_1_3_2_1_13_1","volume-title":"Proc. of NDSS","author":"Gu G.","year":"2008","unstructured":"Gu , G. , Zhang , J. , and Lee , W . Botsniffer: Detecting botnet command and control channels in network traffic . In Proc. of NDSS ( 2008 ). Gu, G., Zhang, J., and Lee, W. Botsniffer: Detecting botnet command and control channels in network traffic. In Proc. of NDSS (2008)."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1145\/1177080.1177096"},{"key":"e_1_3_2_1_15_1","volume-title":"Griffin.","author":"Kendall M. G.","year":"1976","unstructured":"Kendall , M. G. Rank Correlation Methods . Griffin. , 1976 . Kendall, M. G. Rank Correlation Methods. Griffin., 1976."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.5555\/1251086.1251119"},{"key":"e_1_3_2_1_19_1","volume-title":"Exact modeling of propagation for permutation-scanning worms","author":"Manna P.","year":"2008","unstructured":"Manna , P. , Chen , S. , and Ranka , S . Exact modeling of propagation for permutation-scanning worms . In IEEE INFOCOM ( 2008 ). Manna, P., Chen, S., and Ranka, S. Exact modeling of propagation for permutation-scanning worms. In IEEE INFOCOM (2008)."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSECP.2003.1219056"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028794"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1389-1286(99)00112-7"},{"key":"e_1_3_2_1_23_1","volume-title":"Proc. of USENIX Security","author":"Provos N.","year":"2004","unstructured":"Provos , N. A virtual honeypot framework . In Proc. of USENIX Security ( 2004 ). Provos, N. A virtual honeypot framework. In Proc. of USENIX Security (2004)."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/1177080.1177086"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/1159913.1159947"},{"key":"e_1_3_2_1_26_1","volume-title":"Mathematical Statistics and Data Analysis","author":"Rice J. A.","year":"1994","unstructured":"Rice , J. A. Mathematical Statistics and Data Analysis . Duxbury Press , 1994 . Rice, J. A. Mathematical Statistics and Data Analysis. Duxbury Press, 1994."},{"key":"e_1_3_2_1_27_1","unstructured":"SANS Institute. Dshield. org: Distributed intrusion detection system. http:\/\/www.dshield.org\/.  SANS Institute. Dshield. org: Distributed intrusion detection system. http:\/\/www.dshield.org\/."},{"key":"e_1_3_2_1_28_1","volume-title":"Proc. of USENIX Security","author":"Staniford S.","year":"2002","unstructured":"Staniford , S. , Paxson , V. , and Weaver , N . How to 0wn the Internet in your spare time . In Proc. of USENIX Security ( 2002 ). Staniford, S., Paxson, V., and Weaver, N. How to 0wn the Internet in your spare time. In Proc. of USENIX Security (2002)."},{"key":"e_1_3_2_1_29_1","unstructured":"Weisstein W. E. Stirling Number of the Second Kind. http:\/\/mathworld.wolfram.com\/StirlingNumberoftheSecondKind.html.  Weisstein W. E. Stirling Number of the Second Kind. http:\/\/mathworld.wolfram.com\/StirlingNumberoftheSecondKind.html."},{"key":"e_1_3_2_1_30_1","volume-title":"In Proc. of ACM Hotnets IV","author":"Yegneswaran V.","year":"2005","unstructured":"Yegneswaran , V. , Barford , P. , and Paxson , V . Using honeynets for internet situational awareness . In In Proc. of ACM Hotnets IV ( 2005 ). Yegneswaran, V., Barford, P., and Paxson, V. Using honeynets for internet situational awareness. In In Proc. of ACM Hotnets IV (2005)."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/948109.948136"}],"event":{"name":"Asia CCS 09: Asia CCS 2009 ACM Symposium on Information, Computer and Communications Security","location":"Sydney Australia","acronym":"Asia CCS 09","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 4th International Symposium on Information, Computer, and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1533057.1533063","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1533057.1533063","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T13:29:44Z","timestamp":1750253384000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1533057.1533063"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009,3,10]]},"references-count":28,"alternative-id":["10.1145\/1533057.1533063","10.1145\/1533057"],"URL":"https:\/\/doi.org\/10.1145\/1533057.1533063","relation":{},"subject":[],"published":{"date-parts":[[2009,3,10]]},"assertion":[{"value":"2009-03-10","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}