{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,1,11]],"date-time":"2024-01-11T00:08:32Z","timestamp":1704931712883},"reference-count":30,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"5","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEICE Trans. Commun."],"published-print":{"date-parts":[[2016]]},"DOI":"10.1587\/transcom.2015amp0001","type":"journal-article","created":{"date-parts":[[2016,6,22]],"date-time":"2016-06-22T22:05:46Z","timestamp":1466633146000},"page":"1012-1023","source":"Crossref","is-referenced-by-count":2,"title":["BotProfiler: Detecting Malware-Infected Hosts by Profiling Variability of Malicious Infrastructure"],"prefix":"10.23919","volume":"E99.B","author":[{"given":"Daiki","family":"CHIBA","sequence":"first","affiliation":[{"name":"NTT Secure Platform Laboratories, NTT Corporation"},{"name":"Waseda University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Takeshi","family":"YAGI","sequence":"additional","affiliation":[{"name":"NTT Secure Platform Laboratories, NTT Corporation"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mitsuaki","family":"AKIYAMA","sequence":"additional","affiliation":[{"name":"NTT Secure Platform Laboratories, NTT Corporation"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kazufumi","family":"AOKI","sequence":"additional","affiliation":[{"name":"NTT Secure Platform Laboratories, NTT Corporation"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Takeo","family":"HARIU","sequence":"additional","affiliation":[{"name":"NTT Secure Platform Laboratories, NTT Corporation"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shigeki","family":"GOTO","sequence":"additional","affiliation":[{"name":"Waseda University"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"1","doi-asserted-by":"crossref","unstructured":"[1] D. Chiba, T. Yagi, M. Akiyama, K. Aoki, T. Hariu, and S. Goto, \u201cBotProfiler: Profiling variability of substrings in HTTP requests to detect malware-infected hosts,\u201d Proc. 2015 IEEE 14th International Conf. on Trust, Security and Privacy in Computing and Communications (TrustCom), Helsinki, Finland, pp.758-765, Aug. 2015. DOI: 10.1109\/Trustcom.2015.444.","DOI":"10.1109\/Trustcom.2015.444"},{"key":"2","doi-asserted-by":"publisher","unstructured":"[2] R.A. Rodr\u00edguez-G\u00f3mez, G. Maci\u00e1-Fern\u00e1ndez, and P. Garc\u00eda-Teodoro, \u201cSurvey and taxonomy of botnet research through life-cycle,\u201d ACM Comput. Surv., vol.45, no.4, pp.1-33, Aug. 2013. DOI:10.1145\/2501654.2501659.","DOI":"10.1145\/2501654.2501659"},{"key":"3","unstructured":"[3] McAfee Labs, \u201cPeriodic connections to control server offer new way to detect botnets,\u201d Oct. 2013. http:\/\/blogs.mcafee.com\/mcafee-labs\/periodic-links-to-control-server-offer-new-way-to-detect-botnets, accessed July 27. 2015."},{"key":"4","unstructured":"[4] Microsoft, \u201cMicrosoft and financial services industry leaders target cybercriminal operations from zeus botnets,\u201d March 2012. http:\/\/blogs.microsoft.com\/blog\/2012\/03\/25\/microsoft-and-financial-services-industry-leaders-target-cybercriminal-operations-from-zeus-botnets\/, accessed July 27. 2015."},{"key":"5","unstructured":"[5] Microsoft, \u201cMicrosoft works with financial services industry leaders, law enforcement and others to disrupt massive financial cybercrime ring,\u201d June 2013. http:\/\/blogs.microsoft.com\/blog\/2013\/06\/05\/microsoft-works-with-financial-services-industry-leaders-law-enforcement-and-others-to-disrupt-massive-financial-cybercrime-ring\/, accessed July 27. 2015."},{"key":"6","unstructured":"[6] Microsoft, \u201cMicrosoft helps FBI in GameOver Zeus botnet cleanup,\u201d June 2014. http:\/\/blogs.microsoft.com\/blog\/2014\/06\/02\/microsoft-helps-fbi-in-gameover-zeus-botnet-cleanup\/, accessed July 27. 2015."},{"key":"7","doi-asserted-by":"crossref","unstructured":"[7] Y. Xie, F. Yu, K. Achan, R. Panigrahy, G. Hulten, and I. Osipkov, \u201cSpamming botnets: signatures and characteristics,\u201d Proc. ACM SIGCOMM 2008 Conf. on Data Communication, pp.171-182, Aug. 2008. DOI:10.1145\/1402958.1402979.","DOI":"10.1145\/1402958.1402979"},{"key":"8","unstructured":"[8] R. Perdisci, W. Lee, and N. Feamster, \u201cBehavioral clustering of HTTP-based malware and signature generation using malicious network traces,\u201d Proc. 7th USENIX Symp. on Networked Systems Design and Implementation (NSDI), pp.391-404, San Jose, CA, USA, April 2010."},{"key":"9","unstructured":"[9] T. Nelms, R. Perdisci, and M. Ahamad, \u201cExecScent: Mining for new c&c domains in live networks with adaptive control protocol templates,\u201d Proc. 22th USENIX Security Symp., pp.589-604, Washington, DC, USA, Aug. 2013."},{"key":"10","unstructured":"[10] Ponemon Institute, \u201cThe cost of malware containment,\u201d Jan. 2015. http:\/\/www.ponemon.org\/library\/the-cost-of-malware-containment, accessed July 27. 2015."},{"key":"11","doi-asserted-by":"crossref","unstructured":"[11] K. Aoki, T. Yagi, M. Iwamura, and M. Itoh, \u201cControlling malware HTTP communications in dynamic analysis system using search engine,\u201d Proc. 3rd IEEE International Workshop on Cyberspace Safety and Security (CSS), pp.1-6, Milan, Italy, Sept. 2011. DOI:10.1109\/CSS.2011.6058563.","DOI":"10.1109\/CSS.2011.6058563"},{"key":"12","doi-asserted-by":"publisher","unstructured":"[12] M. Akiyama, M. Iwamura, Y. Kawakoya, K. Aoki, and M. Itoh, \u201cDesign and implementation of high interaction client honeypot for drive-by-download attacks,\u201d IEICE Trans. Commun., vol.E93-B, no.5, pp.1131-1139, May. 2010. DOI:10.1587\/transcom.E93.B.1131.","DOI":"10.1587\/transcom.E93.B.1131"},{"key":"13","doi-asserted-by":"publisher","unstructured":"[13] M. Akiyama, T. Yagi, Y. Kadobayashi, T. Hariu, and S. Yamaguchi, \u201cClient honeypot multiplication with high performance and precise detection,\u201d IEICE Trans. Inf.& Syst., vol.E98-D, no.4, pp.775-787, April 2015. DOI:10.1587\/transinf.2014ICP0002.","DOI":"10.1587\/transinf.2014ICP0002"},{"key":"14","doi-asserted-by":"publisher","unstructured":"[14] A.K. Jain, M.N. Murty, and P.J. Flynn, \u201cData clustering: A review,\u201d ACM Comput. Surv., vol.31, no.3, pp.264-323, Sept. 1999. DOI:10.1145\/331499.331504.","DOI":"10.1145\/331499.331504"},{"key":"15","unstructured":"[15] \u201cMalware domain list.\u201d http:\/\/www.malwaredomainlist.com\/, accessed July 27. 2015."},{"key":"16","unstructured":"[16] Malwarebytes, \u201chpHosts.\u201d http:\/\/www.hosts-file.net\/, accessed July 27. 2015."},{"key":"17","unstructured":"[17] \u201cVirusTotal.\u201d https:\/\/www.virustotal.com\/, accessed July 27. 2015."},{"key":"18","unstructured":"[18] Kaspersky Lab, \u201cRules for naming.\u201d http:\/\/securelist.com\/threats\/rules-for-naming\/, accessed July 27. 2015."},{"key":"19","unstructured":"[19] G. Jacob, R. Hund, C. Kruegel, and T. Holz, \u201cJACKSTRAWS: Picking command and control connections from bot traffic,\u201d Proc. 20th USENIX Security Symp., San Francisco, CA, USA, Aug. 2011."},{"key":"20","unstructured":"[20] D. Kirat, G. Vigna, and C. Kruegel, \u201cBareCloud: Bare-metal analysis-based evasive malware detection,\u201d Proc. 23rd USENIX Security Symp., pp.287-301, San Diego, CA, USA, Aug. 2014."},{"key":"21","doi-asserted-by":"crossref","unstructured":"[21] A. Zarras, A. Papadogiannakis, R. Gawlik, and T. Holz, \u201cAutomated generation of models for fast and precise detection of HTTP-based malware,\u201d Proc. 12th Annual International Conference on Privacy, Security and Trust (PST), Toronto, ON, Canada, pp.249-256, July 2014. DOI:10.1109\/PST.2014.6890946.","DOI":"10.1109\/PST.2014.6890946"},{"key":"22","doi-asserted-by":"crossref","unstructured":"[22] A. Zand, G. Vigna, X. Yan, and C. Kruegel, \u201cExtracting probable command and control signatures for detecting botnets,\u201d Proc. 29th Annual ACM Symp. on Applied Computing (SAC), Gyeongju, Republic of Korea, pp.1657-1662, April 2014. DOI:10.1145\/2554850.2554896.","DOI":"10.1145\/2554850.2554896"},{"key":"23","unstructured":"[23] G. Gu, J. Zhang, and W. Lee, \u201cBotSniffer: Detecting botnet command and control channels in network traffic,\u201d Proc. Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA, Feb. 2008."},{"key":"24","unstructured":"[24] G. Gu, R. Perdisci, J. Zhang, and W. Lee, \u201cBotMiner: Clustering analysis of network traffic for protocol- and structure-independent botnet detection,\u201d Proc. 17th USENIX Security Symp., pp.139-154, San Jose, CA, USA, July 2008."},{"key":"25","doi-asserted-by":"crossref","unstructured":"[25] C. Rossow, D. Andriesse, T. Werner, B. Stone-Gross, D. Plohmann, C. Dietrich, and H. Bos, \u201cSoK: P2PWNED \u2014 Modeling and evaluating the resilience of peer-to-peer botnets,\u201d Proc. IEEE Symp. on Security and Privacy (S&P), pp.97-111, Berkeley, CA, USA, May 2013. DOI:10.1109\/SP.2013.17.","DOI":"10.1109\/SP.2013.17"},{"key":"26","doi-asserted-by":"publisher","unstructured":"[26] J. Zhang, R. Perdisci, W. Lee, X. Luo, and U. Sarfraz, \u201cBuilding a scalable system for stealthy P2P-botnet detection,\u201d IEEE Trans. Information Forensics and Security, vol.9, no.1, pp.27-38, Jan. 2014. DOI:10.1109\/TIFS.2013.2290197.","DOI":"10.1109\/TIFS.2013.2290197"},{"key":"27","doi-asserted-by":"crossref","unstructured":"[27] J. Caballero, P. Poosankam, C. Kreibich, and D. Song, \u201cDispatcher: enabling active botnet infiltration using automatic protocol reverse-engineering,\u201d Proc. 16th ACM Conf. Computer and Communications Security (CCS), pp.621-634, Chicago, IL, USA, Nov. 2009. DOI:10.1145\/1653662.1653737.","DOI":"10.1145\/1653662.1653737"},{"key":"28","unstructured":"[28] T. Holz, C. Gorecki, K. Rieck, and F.C. Freiling, \u201cMeasuring and detecting fast-flux service networks,\u201d Proc. Network and Distributed System Security Symposium (NDSS), San Diego, CA, USA, Feb. 2008."},{"key":"29","doi-asserted-by":"crossref","unstructured":"[29] E. Passerini, R. Paleari, L. Martignoni, and D. Bruschi, \u201cFluXOR: Detecting and monitoring fast-flux service networks,\u201d in Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), Lecture Notes in Computer Science, vol.5137, pp.186-206, Springer Berlin Heidelberg, July 2008. DOI:10.1007\/978-3-540-70542-0_10.","DOI":"10.1007\/978-3-540-70542-0_10"},{"key":"30","doi-asserted-by":"crossref","unstructured":"[30] S. Schiavoni, F. Maggi, L. Cavallaro, and S. Zanero, \u201cPhoenix: DGA-based botnet tracking and intelligence,\u201d in Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), Lecture Notes in Computer Science, vol.8550, pp.192-211, Springer International Publishing, July 2014. DOI:10.1007\/978-3-319-08509-8_11.","DOI":"10.1007\/978-3-319-08509-8_11"}],"container-title":["IEICE Transactions on Communications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.jstage.jst.go.jp\/article\/transcom\/E99.B\/5\/E99.B_2015AMP0001\/_pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,1,10]],"date-time":"2024-01-10T14:59:39Z","timestamp":1704898779000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.jstage.jst.go.jp\/article\/transcom\/E99.B\/5\/E99.B_2015AMP0001\/_article"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016]]},"references-count":30,"journal-issue":{"issue":"5","published-print":{"date-parts":[[2016]]}},"URL":"https:\/\/doi.org\/10.1587\/transcom.2015amp0001","relation":{},"ISSN":["0916-8516","1745-1345"],"issn-type":[{"value":"0916-8516","type":"print"},{"value":"1745-1345","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016]]}}}