{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,19]],"date-time":"2026-02-19T08:24:02Z","timestamp":1771489442293,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":83,"publisher":"ACM","license":[{"start":{"date-parts":[[2016,12,7]],"date-time":"2016-12-07T00:00:00Z","timestamp":1481068800000},"content-version":"vor","delay-in-days":366,"URL":"http:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS 1444500"],"award-info":[{"award-number":["CNS 1444500"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000185","name":"Defense Advanced Research Projects Agency","doi-asserted-by":"publisher","award":["P-1070-113237"],"award-info":[{"award-number":["P-1070-113237"]}],"id":[{"id":"10.13039\/100000185","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000015","name":"U.S. Department of Energy","doi-asserted-by":"publisher","award":["DE-AC0205CH11231"],"award-info":[{"award-number":["DE-AC0205CH11231"]}],"id":[{"id":"10.13039\/100000015","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2015,12,7]]},"DOI":"10.1145\/2818000.2818010","type":"proceedings-article","created":{"date-parts":[[2015,12,11]],"date-time":"2015-12-11T12:06:08Z","timestamp":1449835568000},"page":"391-400","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":7,"title":["Analyzing and Modeling Longitudinal Security Data"],"prefix":"10.1145","author":[{"given":"Benjamin","family":"Edwards","sequence":"first","affiliation":[{"name":"University of New Mexico"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Steven","family":"Hofmeyr","sequence":"additional","affiliation":[{"name":"Lawrence Berkeley National Laboratory"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Stephanie","family":"Forrest","sequence":"additional","affiliation":[{"name":"University of New Mexico, Santa Fe Institute"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Michel","family":"van Eeten","sequence":"additional","affiliation":[{"name":"Delft University of Technology"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2015,12,7]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"WEIS","author":"Anderson R.","year":"2012","unstructured":"R. Anderson et al. Measuring the cost of cybercrime. In WEIS, 2012."},{"key":"e_1_3_2_1_2_1","volume-title":"Applied Econometrics: a modern approach using eviews and microfit","author":"Asteriou D.","year":"2007","unstructured":"D. Asteriou and S. G. Hall. Applied Econometrics: a modern approach using eviews and microfit. Palgrave Macmillan New York, 2007."},{"key":"e_1_3_2_1_3_1","unstructured":"W. Bank. World bank data. http:\/\/data.worldbank.org\/ Mar. 2015."},{"key":"e_1_3_2_1_4_1","volume-title":"May","year":"2014","unstructured":"BotFrei. botfrei.de: The anti-botnet advisory centre. https:\/\/www.botfrei.de\/, May 2014."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.5555\/1251086.1251098"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2008.299"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866355"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/1298306.1298319"},{"key":"e_1_3_2_1_9_1","volume-title":"Panda Labs","author":"Corrons L.","year":"2010","unstructured":"L. Corrons. Mariposa botnet. Panda Labs, Mar. 2010."},{"key":"e_1_3_2_1_10_1","volume-title":"NDSS","author":"Dagon D.","year":"2006","unstructured":"D. Dagon et al. Modeling botnet propagation using time zones. In NDSS, 2006."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/1452520.1452543"},{"key":"e_1_3_2_1_12_1","volume-title":"Mar.","author":"Donohue B.","year":"2012","unstructured":"B. Donohue. Kapersky knocks down kelihos botnet again, but expects return. Threatpost.com, Mar. 2012."},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/2413296.2413302"},{"key":"e_1_3_2_1_14_1","volume-title":"Internet topology over time. arXiv preprint arXiv:1202.3993","author":"Edwards B.","year":"2012","unstructured":"B. Edwards et al. Internet topology over time. arXiv preprint arXiv:1202.3993, 2012."},{"key":"e_1_3_2_1_15_1","volume-title":"WEIS","author":"Edwards B.","year":"2015","unstructured":"B. Edwards et al. Hype and heavy tails: A closer look at data breaches. In WEIS, 2015."},{"key":"e_1_3_2_1_16_1","volume-title":"ZDNet","author":"Espiner T.","year":"2010","unstructured":"T. Espiner. Dutch police take down bredolab botnet. ZDNet, Oct. 2010."},{"key":"e_1_3_2_1_17_1","volume-title":"Aug.","author":"Geer D.","year":"2014","unstructured":"D. Geer. Cybersecurity as realpolitik. http:\/\/geer.tinho.net\/geer.blackhat.6viii14.txt, Aug. 2014."},{"key":"e_1_3_2_1_18_1","volume-title":"TPRC42","author":"Goldberg S.","year":"2014","unstructured":"S. Goldberg and S. Forrest. Implications of security enhancements and interventions for core internet infrastructure. In TPRC42, 2014."},{"key":"e_1_3_2_1_19_1","volume-title":"The Register","author":"Goodin D.","year":"2010","unstructured":"D. Goodin. Waledac botnet 'decimated' by ms takedown. The Register, Mar. 2010."},{"key":"e_1_3_2_1_20_1","volume-title":"Feb.","author":"Goodin D.","year":"2012","unstructured":"D. Goodin. \"slain\" kelihos botnet still spams from beyond the grave. arstechnica, Feb. 2012."},{"key":"e_1_3_2_1_21_1","volume-title":"Google Official Blog","year":"2013","unstructured":"Google. An update on our war against account hijackers. Google Official Blog, Feb. 2013."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.2307\/1912791"},{"key":"e_1_3_2_1_23_1","volume-title":"Kaspersky security bulletin: Spam evolution","author":"Gudkova D.","year":"2013","unstructured":"D. Gudkova. Kaspersky security bulletin: Spam evolution 2013, Jan. 2013."},{"key":"e_1_3_2_1_24_1","volume-title":"Proc. of AUUG","author":"Hird S.","year":"2002","unstructured":"S. Hird. Technical solutions for controlling spam. Proc. of AUUG, 2002."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4614-1981-5_7"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-32946-3_8"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCN.2009.5235325"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455774"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.5555\/2028067.2028082"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.5555\/1323128.1323135"},{"key":"e_1_3_2_1_31_1","volume-title":"Computer World","author":"Keizer G.","year":"2011","unstructured":"G. Keizer. Rustock take-down proves botnets can be crippled, says microsoft. Computer World, July 2011."},{"key":"e_1_3_2_1_32_1","volume-title":"Rank correlation methods. Rank correlation methods","author":"Kendall M.","year":"1948","unstructured":"M. Kendall et al. Rank correlation methods. Rank correlation methods., 1948."},{"key":"e_1_3_2_1_33_1","volume-title":"Proc. of CEAS","author":"Kokkodis M.","year":"2009","unstructured":"M. Kokkodis and M. Faloutsos. Spamming botnets: Are we losing the war. Proc. of CEAS, 2009."},{"key":"e_1_3_2_1_34_1","volume-title":"Conf. on Cyber Conflict","author":"Kotenko I.","year":"2010","unstructured":"I. Kotenko et al. Agent-based modeling and simulation of botnets and botnet defense. In Conf. on Cyber Conflict, 2010."},{"key":"e_1_3_2_1_35_1","volume-title":"The Washington Post","author":"Krebs B.","year":"2008","unstructured":"B. Krebs. Host of internet spam groups is cut off. The Washington Post, Nov. 2008."},{"key":"e_1_3_2_1_36_1","volume-title":"The Washington Post","author":"Krebs B.","year":"2009","unstructured":"B. Krebs. Organized crime behind a majority of data breaches. The Washington Post, Apr. 2009."},{"key":"e_1_3_2_1_37_1","volume-title":"The Washington Post","author":"Krebs B.","year":"2009","unstructured":"B. Krebs. The scrap value of a hacked pc. The Washington Post, May 2009."},{"key":"e_1_3_2_1_38_1","volume-title":"Krebs on Security","author":"Krebs B.","year":"2010","unstructured":"B. Krebs. Microsoft ambushes waledac botnet, shutters whistleblower site. Krebs on Security, Feb. 2010."},{"key":"e_1_3_2_1_39_1","volume-title":"McAfee Security Journal","author":"Krebs B.","year":"2010","unstructured":"B. Krebs. Takedowns: The shuns and stuns that take the fight to the enemy. McAfee Security Journal, 2010."},{"key":"e_1_3_2_1_40_1","volume-title":"Krebs on Security","author":"Krebs B.","year":"2011","unstructured":"B. Krebs. U.s. government takes down coreflood botnet. Krebs on Security, 2011."},{"key":"e_1_3_2_1_41_1","volume-title":"Krebs On Security","author":"Krebs B.","year":"2012","unstructured":"B. Krebs. Rogue pharma, fake av vendors feel credit card crunch. Krebs On Security, Oct. 2012."},{"key":"e_1_3_2_1_42_1","volume-title":"Krebs On Security","author":"Krebs B.","year":"2013","unstructured":"B. Krebs. Polish takedown targets 'virut' botnet. Krebs On Security, Jan. 2013."},{"key":"e_1_3_2_1_43_1","volume-title":"Apr.","author":"Leydon J.","year":"2010","unstructured":"J. Leydon. Google: Botnet takedowns fail to stem spam tide, Apr. 2010."},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-09762-6_12"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1145\/1402958.1402981"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/2713579.2713582"},{"key":"e_1_3_2_1_47_1","volume-title":"Maxmind geoip","author":"M.","year":"2008","unstructured":"M. LLC. Maxmind geoip, 2008."},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/633025.633027"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382285"},{"key":"e_1_3_2_1_50_1","volume-title":"Aug.","year":"2011","unstructured":"Microsoft. Microsoft security intelligence report, Aug. 2011."},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/eCrime.2012.6489515"},{"key":"e_1_3_2_1_52_1","volume-title":"SpamHaus Blog","author":"Morrison T.","year":"2012","unstructured":"T. Morrison. Spam botnets: The fall of grum and the rise of festi. SpamHaus Blog, Aug. 2012."},{"key":"e_1_3_2_1_53_1","volume-title":"Giovane Cesar Moreira Moura","author":"Moura G. C.","year":"2013","unstructured":"G. C. Moura. Internet bad neighborhoods. Number 12 in University of Twente Dissertation. Giovane Cesar Moreira Moura, 2013."},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516749"},{"key":"e_1_3_2_1_55_1","volume-title":"Kapersky Lab","author":"Namestnikov Y.","year":"2009","unstructured":"Y. Namestnikov. The economics of botnets. Analysis on Viruslist.com, Kapersky Lab, 2009."},{"key":"e_1_3_2_1_56_1","unstructured":"U. Nations. Un geographic division. http:\/\/millenniumindicators.un.org\/unsd\/methods\/m49\/m49regin.htm Oct. 2013."},{"key":"e_1_3_2_1_57_1","volume-title":"SpamFighter","author":"News S. F.","year":"2012","unstructured":"S. F. News. A young botnet suspect arrested by russian authorities. SpamFighter, July 2012."},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2009.2020798"},{"key":"e_1_3_2_1_59_1","unstructured":"R. Path. The global email deliverability benchmark report 2h 2011 Mar. 2012."},{"key":"e_1_3_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315288"},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/1159913.1159947"},{"key":"e_1_3_2_1_62_1","volume-title":"Aug.","author":"Rashid F. Y.","year":"2012","unstructured":"F. Y. Rashid. Grum botnet: Down one month, no impact on spam, Aug. 2012."},{"key":"e_1_3_2_1_63_1","volume-title":"Monotone regrouping, regression, and simpson's paradox. The American Statistician, (2)","author":"Rinott Y.","year":"2003","unstructured":"Y. Rinott and M. Tam. Monotone regrouping, regression, and simpson's paradox. The American Statistician, (2), 2003."},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1145\/1096536.1096551"},{"key":"e_1_3_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.1145\/2016904.2016910"},{"key":"e_1_3_2_1_66_1","unstructured":"SpamHaus. Spamhaus composite blocking list. http:\/\/cbl.abuseat.org\/totalflow.html May 2015."},{"key":"e_1_3_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2009.29"},{"key":"e_1_3_2_1_68_1","volume-title":"Apr.","year":"2013","unstructured":"Symantec. 2012 internet security threat report, Apr. 2013."},{"key":"e_1_3_2_1_69_1","volume-title":"Apr.","year":"2015","unstructured":"Symantec. 2014 internet security threat report, Apr. 2015."},{"key":"e_1_3_2_1_70_1","volume-title":"Proc. of ICIS","author":"Tang Q.","year":"2012","unstructured":"Q. Tang et al. Reputation as public policy for internet security: A field study. In Proc. of ICIS, 2012."},{"key":"e_1_3_2_1_71_1","volume-title":"CEAS","author":"Taylor B.","year":"2006","unstructured":"B. Taylor. Sender reputation in a large webmail service. In CEAS, 2006."},{"key":"e_1_3_2_1_72_1","volume-title":"Technical report","author":"Union I. T.","year":"2014","unstructured":"I. T. Union. Ict facts and figures. Technical report, International Telecommunications Union, May 2014."},{"key":"e_1_3_2_1_73_1","volume-title":"The role of internet service providers in botnet mitigation: An empirical analysis based on spam data. Technical report","author":"van Eeten M.","year":"2010","unstructured":"M. van Eeten et al. The role of internet service providers in botnet mitigation: An empirical analysis based on spam data. Technical report, OECD Publishing, 2010."},{"key":"e_1_3_2_1_74_1","volume-title":"NDSS","author":"Venkataraman S.","year":"2013","unstructured":"S. Venkataraman et al. Automatically inferring the evolution of malicious activity on the internet. In NDSS, 2013."},{"key":"e_1_3_2_1_75_1","unstructured":"B. Violino. Spam levels creep back after rustock botnet takedown Apr. 2011."},{"key":"e_1_3_2_1_76_1","volume-title":"Oct.","year":"2011","unstructured":"Visa. Visa international operating regulations summary of changes, Oct. 2011."},{"key":"e_1_3_2_1_77_1","volume-title":"All Spammed Up","author":"Walsh S.","year":"2010","unstructured":"S. Walsh. Canadian pharmacy spam group reinvents self as \"world pharmacy\". All Spammed Up, Dec. 2010."},{"key":"e_1_3_2_1_78_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOMW.2010.5466660"},{"key":"e_1_3_2_1_79_1","volume-title":"A student t-mixture autoregressive model with applications to heavy-tailed financial data. Biometrika, (3)","author":"Wong C.","year":"2009","unstructured":"C. Wong et al. A student t-mixture autoregressive model with applications to heavy-tailed financial data. Biometrika, (3), 2009."},{"key":"e_1_3_2_1_80_1","doi-asserted-by":"publisher","DOI":"10.5555\/1813084.1813104"},{"key":"e_1_3_2_1_81_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-28641-4_14"},{"key":"e_1_3_2_1_82_1","volume-title":"NDSS","author":"Zhang J.","year":"2013","unstructured":"J. Zhang et al. On the mismanagement and maliciousness of networks. In NDSS, 2013."},{"key":"e_1_3_2_1_83_1","doi-asserted-by":"publisher","DOI":"10.5555\/1387709.1387711"}],"event":{"name":"ACSAC 2015: 2015 Annual Computer Security Applications Conference","location":"Los Angeles CA USA","acronym":"ACSAC 2015","sponsor":["ACSA Applied Computing Security Assoc"]},"container-title":["Proceedings of the 31st Annual Computer Security Applications Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2818000.2818010","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2818000.2818010","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2818000.2818010","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,11,18]],"date-time":"2025-11-18T09:42:26Z","timestamp":1763458946000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2818000.2818010"}},"subtitle":["Promise and Pitfalls"],"short-title":[],"issued":{"date-parts":[[2015,12,7]]},"references-count":83,"alternative-id":["10.1145\/2818000.2818010","10.1145\/2818000"],"URL":"https:\/\/doi.org\/10.1145\/2818000.2818010","relation":{},"subject":[],"published":{"date-parts":[[2015,12,7]]},"assertion":[{"value":"2015-12-07","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}