{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2022,4,3]],"date-time":"2022-04-03T04:27:38Z","timestamp":1648960058530},"reference-count":39,"publisher":"Institute of Electronics, Information and Communications Engineers (IEICE)","issue":"8","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEICE Trans. Inf. & Syst."],"published-print":{"date-parts":[[2017]]},"DOI":"10.1587\/transinf.2016icp0019","type":"journal-article","created":{"date-parts":[[2017,7,31]],"date-time":"2017-07-31T22:19:43Z","timestamp":1501539583000},"page":"1691-1702","source":"Crossref","is-referenced-by-count":0,"title":["Finding New Varieties of Malware with the Classification of Network Behavior"],"prefix":"10.1587","volume":"E100.D","author":[{"given":"Mitsuhiro","family":"HATADA","sequence":"first","affiliation":[{"name":"Waseda University"},{"name":"NTT Communications Corporation"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tatsuya","family":"MORI","sequence":"additional","affiliation":[{"name":"Waseda University"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"532","reference":[{"key":"1","unstructured":"[1] \u201cMalware Statistics & Trends Report | AVTest Institute.\u201d https:\/\/www.av-test.org\/en\/statistics\/malware\/."},{"key":"2","unstructured":"[2] \u201cThreat intelligence report-Unwanted software.\u201d https:\/\/www.microsoft.com\/security\/portal\/enterprise\/threatreports_october_2015.aspx."},{"key":"3","unstructured":"[3] P. Kotzias, L. Bilge, and J. Caballero, \u201cMeasuring pup prevalence and pup distribution through pay-per-install services,\u201d Proc. 25th USENIX Security Symposium, USENIX Security '16, pp.739-756, Aug. 2016."},{"key":"4","doi-asserted-by":"publisher","unstructured":"[4] M. Bailey, J. Oberheide, J. Andersen, Z.M. Mao, F. Jahanian, and J. Nazario, \u201cAutomated classification and analysis of internet malware,\u201d Proc. 10th International Conference on Recent Advances in Intrusion Detection, RAID '07, pp.178-197, Sept. 2007. 10.1007\/978-3-540-74320-0_10","DOI":"10.1007\/978-3-540-74320-0_10"},{"key":"5","unstructured":"[5] \u201cCuckoo sandbox.\u201d http:\/\/www.cuckoosandbox.org\/."},{"key":"6","unstructured":"[6] \u201cMalwr.\u201d https:\/\/malwr.com\/."},{"key":"7","doi-asserted-by":"crossref","unstructured":"[7] S. Nari and A.A. Ghorbani, \u201cAutomated Malware Classification based on Network Behavior,\u201d Proc. International Conference on Computing, Networking and Communications 2013, ICNC '13, pp.642-647, Jan. 2013. 10.1109\/iccnc.2013.6504162","DOI":"10.1109\/ICCNC.2013.6504162"},{"key":"8","doi-asserted-by":"crossref","unstructured":"[8] F. Tegeler, X. Fu, G. Vigna, and C. Kruegel, \u201cBotFinder: Finding bots in network traffic without deep packet inspection,\u201d Proc. 8th International Conference on Emerging Networking Experiments and Technologies, CoNEXT '12, pp.349-360, Dec. 2012. 10.1145\/2413176.2413217","DOI":"10.1145\/2413176.2413217"},{"key":"9","doi-asserted-by":"crossref","unstructured":"[9] L. Invernizzi, S. Miskovic, R. Torres, S. Saha, S.J. Lee, C. Kruegel, and G. Vigna, \u201cNazca: Detecting malware distribution in large-scale networks,\u201d Proc. ISOC Network and Distributed System Security Symposium, NDSS '14, pp.1-16, Feb. 2014. 10.14722\/ndss.2014.23269","DOI":"10.14722\/ndss.2014.23269"},{"key":"10","doi-asserted-by":"crossref","unstructured":"[10] H. Zhang, D.D. Yao, and N. Ramakrishnan, \u201cDetection of stealthy malware activities with traffic causality and scalable triggering relation discovery,\u201d Proc. 9th ACM Symposium on Information, Computer and Communications Security, ASIACCS '14, pp.39-50, Jun. 2014. 10.1145\/2590296.2590309","DOI":"10.1145\/2590296.2590309"},{"key":"11","doi-asserted-by":"crossref","unstructured":"[11] H. Mekky, A. Mohaisen, and Z.-L. Zhang, \u201cPOSTER: Blind Separation of Benign and Malicious Events to Enable Accurate Malware Family Classification,\u201d Proc. 2014 ACM Conference on Computer and Communications Security, CCS '14, pp.1478-1480, Nov. 2014. 10.1145\/2660267.2662365","DOI":"10.1145\/2660267.2662365"},{"key":"12","doi-asserted-by":"crossref","unstructured":"[12] J.M. Beaver, C.T. Symons, and R.E. Gillen, \u201cA learning system for discriminating variants of malicious network traffic,\u201d Proc. Eighth Annual Cyber Security and Information Intelligence Research Workshop, CSIIRW '13, pp.23:1-23:4, Jan. 2013. 10.1145\/2459976.2460003","DOI":"10.1145\/2459976.2460003"},{"key":"13","doi-asserted-by":"crossref","unstructured":"[13] V. Eliseev and Y. Shabalin, \u201cDynamic response recognition by neural network to detect network host anomaly activity,\u201d Proc. 8th International Conference on Security of Information and Networks, SIN '15, pp.246-249, Sept. 2015. 10.1145\/2799979.2799991","DOI":"10.1145\/2799979.2799991"},{"key":"14","doi-asserted-by":"crossref","unstructured":"[14] B. Cappers and J.J. van Wijk, \u201cSNAPS: Semantic network traffic analysis through projection and selection,\u201d Proc. 2015 IEEE Symposium on Visualization for Cyber Security, VizSec '15, pp.1-8, Oct. 2015. 10.1109\/vizsec.2015.7312768","DOI":"10.1109\/VIZSEC.2015.7312768"},{"key":"15","unstructured":"[15] R. Perdisci, W. Lee, and N. Feamster, \u201cBehavioral clustering ofhttp-based malware and signature generation using malicious network traces,\u201d Proc. 7th USENIX Conference on Networked Systems Design and Implementation, NSDI '10, pp.1-14, April 2010."},{"key":"16","doi-asserted-by":"publisher","unstructured":"[16] M.Z. Rafique and J. Caballero, \u201cFIRMA: Malware Clustering and Network Signature Generation with Mixed Network Behaviors,\u201d Proc. 16th International Symposium on Research in Attacks, Intrusions and Defenses, RAID '13, pp.144-163, Oct. 2013. 10.1007\/978-3-642-41284-4_8","DOI":"10.1007\/978-3-642-41284-4_8"},{"key":"17","unstructured":"[17] \u201cTshark.\u201d https:\/\/www.wireshark.org\/docs\/man-pages\/tshark.html."},{"key":"18","doi-asserted-by":"crossref","unstructured":"[18] M.Z. Rafique, P. Chen, C. Huygens, and W. Joosen, \u201cEvolutionary algorithms for classification of malware families through different network behaviors,\u201d Proc. 2014 Annual Conference on Genetic and Evolutionary Computation, GECCO '14, pp.1167-1174, July 2014. 10.1145\/2576768.2598238","DOI":"10.1145\/2576768.2598238"},{"key":"19","unstructured":"[19] G. Gu, J. Zhang, and W. Lee, \u201cBotsniffer: Detecting botnet command and control channels in network traffic,\u201d NDSS '08, pp.1-18, Feb. 2008."},{"key":"20","unstructured":"[20] G. Gu, R. Perdisci, J. Zhang, and W. Lee, \u201cBotminer: Clustering analysis of network traffic for protocol- and structure-independent botnet detection,\u201d Proc. 17th Conference on Security Symposium, SS '08, pp.139-154, July 2008."},{"key":"21","doi-asserted-by":"crossref","unstructured":"[21] S. Shin and G. Gu, \u201cConficker and beyond: A large-scale empirical study,\u201d Proc. 26th Annual Computer Security Applications Conference, ACSAC '10, pp.151-160, Dec. 2010. 10.1145\/1920261.1920285","DOI":"10.1145\/1920261.1920285"},{"key":"22","doi-asserted-by":"crossref","unstructured":"[22] J.A. Morales, A. Al-Bataineh, S. Xu, and R. Sandhu, \u201cAnalyzing and exploiting network behaviors of malware,\u201d in Security and Privacy in Communication Networks, Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol.50, pp.20-34, 2010. 10.1007\/978-3-642-16161-2_2","DOI":"10.1007\/978-3-642-16161-2_2"},{"key":"23","unstructured":"[23] \u201cAlexa Top Sites.\u201d http:\/\/www.alexa.com\/topsites."},{"key":"24","unstructured":"[24] \u201cWhatIsMyIP.com.\u201d https:\/\/www.whatismyip.com\/."},{"key":"25","unstructured":"[25] \u201cPay-Per-Install: The New Malware Distribution Network.\u201d https:\/\/www.symantec.com\/content\/en\/us\/enterprise\/media\/security_response\/whitepapers\/pay_per_install.pdf."},{"key":"26","unstructured":"[26] \u201cabuse.ch.\u201d https:\/\/www.abuse.ch\/."},{"key":"27","unstructured":"[27] \u201cDomain feed of known DGA domains.\u201d http:\/\/osint.bambenekconsulting.com\/feeds\/dga-feed.txt."},{"key":"28","unstructured":"[28] \u201cAdblock plus.\u201d https:\/\/easylist-downloads.adblockplus.org\/easylist.txt."},{"key":"29","unstructured":"[29] M. Ester, H. peter Kriegel, J.S., and X. Xu, \u201cA density-based algorithm for discovering clusters in large spatial databases with noise,\u201d Proc. 2nd International Conference on Knowledge Discovery and Data Mining, KDD '96, pp.226-231, Aug. 1996."},{"key":"30","unstructured":"[30] \u201cscikit-learn.\u201d http:\/\/scikit-learn.org\/."},{"key":"31","unstructured":"[31] K. Aoki, Y. Kawakoya, M. Akiyama, M. Iwamura, T. Hariu, and M. Ito, \u201cInvestigation and Understanding Active\/Passive Attacks,\u201d IPSJ Journal, vol.50, no.9, pp.2147-2162, Sept. 2009. (in Japanese)."},{"key":"32","doi-asserted-by":"publisher","unstructured":"[32] M. Akiyama, K. Aoki, Y. Kawakoya, M. Iwamura, and M. Ito, \u201cDesign and Implementation of High Interaction Client Honeypot for Drive-by-download Attacks,\u201d IEICE Trans. on Commun., vol.E93-B, no.5, pp.1131-1139, May 2010. 10.1587\/transcom.e93.b.1131","DOI":"10.1587\/transcom.E93.B.1131"},{"key":"33","unstructured":"[33] Y. Kishimoto, A. Sakamoto, and T. Kobayashi, \u201cExtracting of Derived Relations among Software Products Using Both Source Cord and Specification Document,\u201d IPSJ Journal, vol.53, no.3, pp.1137-1149, March 2012. (in Japanese)."},{"key":"34","doi-asserted-by":"crossref","unstructured":"[34] E. Amig\u00f3, J. Gonzalo, J. Artiles, and F. Verdejo, \u201cA comparison of extrinsic clustering evaluation metrics based on formal constraints,\u201d Inform. Retrieval, vol.12, no.4, pp.461-486, 2009.","DOI":"10.1007\/s10791-008-9066-8"},{"key":"35","unstructured":"[35] \u201cDarkSeoul: SophosLabs identifies malware used in South Korean internet attack.\u201d https:\/\/nakedsecurity.sophos.com\/2013\/03\/20\/south-korea-cyber-attack\/."},{"key":"36","unstructured":"[36] D. Kirat, G. Vigna, and C. Kruegel, \u201cBarecloud: Bare-metal analysis-based evasive malware detection,\u201d Proc. 23rd USENIX Conference on Security Symposium, USENIX Security '14, pp.287-301, Aug. 2014. 10.1145\/2076732.2076790"},{"key":"37","doi-asserted-by":"crossref","unstructured":"[37] H. Zhang, C. Papadopoulos, and D. Massey, \u201cDetecting encrypted botnet traffic,\u201d Proc. 2013 IEEE Conference on Computer Communications Workshops, INFOCOM WKSHPS '13, pp.163-168, April 2013. 10.1109\/infcomw.2013.6562912","DOI":"10.1109\/INFCOM.2013.6567180"},{"key":"38","unstructured":"[38] K. Bartos, M. Sofka, and V. Franc, \u201cOptimized invariant representation of network traffic for detecting unseen malware variants,\u201d Proc. 25th USENIX Security Symposium, USENIX Security '16, pp.807-822, Aug. 2016."},{"key":"39","doi-asserted-by":"publisher","unstructured":"[39] E. Bocchi, L. Grimaudo, M. Mellia, E. Baralis, S. Saha, S. Miskovic, G. Modelo-Howard, and S.-J. Lee, \u201cMAGMA: Network Behavior Classifier for Malware Traffic,\u201d Computer Networks \u201cSpecial issue on Traffic and Performance in the Big Data Era,\u201d vol.109, pp.142-156, April 2016. 10.1016\/j.comnet.2016.03.021","DOI":"10.1016\/j.comnet.2016.03.021"}],"container-title":["IEICE Transactions on Information and Systems"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.jstage.jst.go.jp\/article\/transinf\/E100.D\/8\/E100.D_2016ICP0019\/_pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,10,1]],"date-time":"2019-10-01T21:37:15Z","timestamp":1569965835000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.jstage.jst.go.jp\/article\/transinf\/E100.D\/8\/E100.D_2016ICP0019\/_article"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017]]},"references-count":39,"journal-issue":{"issue":"8","published-print":{"date-parts":[[2017]]}},"URL":"https:\/\/doi.org\/10.1587\/transinf.2016icp0019","relation":{},"ISSN":["0916-8532","1745-1361"],"issn-type":[{"value":"0916-8532","type":"print"},{"value":"1745-1361","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017]]}}}