{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,12]],"date-time":"2026-03-12T13:48:04Z","timestamp":1773323284461,"version":"3.50.1"},"reference-count":217,"publisher":"Zhejiang University Press","issue":"11","license":[{"start":{"date-parts":[[2014,11,1]],"date-time":"2014-11-01T00:00:00Z","timestamp":1414800000000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J. Zhejiang Univ. - Sci. C"],"published-print":{"date-parts":[[2014,11]]},"DOI":"10.1631\/jzus.c1300242","type":"journal-article","created":{"date-parts":[[2014,11,14]],"date-time":"2014-11-14T09:12:07Z","timestamp":1415956327000},"page":"943-983","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":105,"title":["Botnet detection techniques: review, future trends, and issues"],"prefix":"10.1631","volume":"15","author":[{"given":"Ahmad","family":"Karim","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Rosli Bin","family":"Salleh","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Muhammad","family":"Shiraz","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Syed Adeel Ali","family":"Shah","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Irfan","family":"Awan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Nor Badrul","family":"Anuar","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"635","published-online":{"date-parts":[[2014,11,11]]},"reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/1177080.1177086"},{"issue":"1","key":"ref2","first-page":"1","article-title":"Efficient generalized forensics framework for extraction and documentation of evidence from mobile devices","volume":"2","author":"Ahmed","year":"2013","journal-title":"Int. J. Enhanced Res. Manag. Comput. Appl."},{"key":"ref3","first-page":"1","article-title":"Challenges in experimenting with botnet detection systems","author":"Aviv","year":"2011","journal-title":"USENIX 4th CSET Workshop"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1109\/catch.2009.40"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-44599-1_8"},{"key":"ref6","article-title":"Network Characterization for Botnet Detection Using Statistical-Behavioral Methods","author":"Barsamian","year":"2009","journal-title":"Master Thesis, Dartmouth College"},{"key":"ref7","article-title":"ITU Study on the Financial Aspects of Network Security: Malware and Spam","author":"Bauer","year":"2008","journal-title":"Final Report, ICT Applications and Cyber-security Division, International Telecommunication Union"},{"key":"ref8","article-title":"Technology | Spam on Rise after Brief Reprieve","volume-title":"BBC News.","year":"2008"},{"key":"ref9","first-page":"193","article-title":"Mapping Internet sensors with probe response attacks","volume-title":"Proc. 14th USENIX Security Symp.","author":"Bethencourt","year":"2005"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.052213.00046"},{"key":"ref11","first-page":"43","article-title":"An algorithm for anomaly-based botnet detection","volume-title":"Proc. USENIX Steps to Reducing Unwanted Traffic on the Internet Workshop","author":"Binkley","year":"2006"},{"key":"ref12","volume-title":"The New Era of Botnets.","author":"Bu","year":"2010"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/WiCOM.2012.6478491"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.5753\/sbseg.2010.20581"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/1541880.1541882"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/1654988.1654996"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-35473-1_9"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/2020408.2020471"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/cit.2007.90"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/1621890.1621893"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2009.07.002"},{"key":"ref22","article-title":"Botnets: the Dark Side of Cloud Computing","volume-title":"Technical Report","author":"Comazzetto","year":"2011"},{"key":"ref23","volume-title":"Microsoft: Almost 90 Percent of Citadel Botnets in the World Disrupted in June.","author":"Constantin","year":"2013"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/nca.2006.34"},{"key":"ref25","first-page":"44","article-title":"The zombie roundup: understanding, detecting, and disrupting botnets","volume-title":"Proc. USENIX SRUTI Workshop","author":"Cooke","year":"2005"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/1920261.1920283"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/505202.505210"},{"issue":"1","key":"ref28","first-page":"1","article-title":"A semantic approach to host-based intrusion detection systems using contiguous and discontiguous system call patterns","volume-title":"IEEE Trans. Comput.","volume":"1","author":"Creech","year":"2013"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/EC2ND.2009.15"},{"key":"ref30","volume-title":"Trojan.Bredolab Spreading in PDF Download.","author":"Crowfoot","year":"2012"},{"key":"ref31","first-page":"11","article-title":"Andbot: towards advanced mobile botnets","volume-title":"Proc. 4th USENIX Conf. on Large-Scale Exploits and Emergent Threats","author":"Cui","year":"2011"},{"key":"ref32","first-page":"2","article-title":"Modeling botnet propagation using time zones","volume":"6","author":"Dagon","year":"2006","journal-title":"NDSS"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2007.44"},{"key":"ref34","volume-title":"Research: Small DIY Botnets Prevalent in Enterprise Networks.","author":"Danchev","year":"2009"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2008.4690855"},{"key":"ref36","article-title":"Intrusion Detection Systems","author":"Di Pietro","year":"2008","journal-title":"Springer"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-45748-8_24"},{"key":"ref38","first-page":"1","author":"Emre","year":"2011","journal-title":"A literature survey about recent botnet trends"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/1242572.1242692"},{"key":"ref40","article-title":"Sality: Story of a Peer-to-Peer Viral Network","author":"Falliere","year":"2011","journal-title":"Symantic Security Response, Technical Report"},{"key":"ref41","article-title":"W32.Stuxnet Dossier, Version 1.4","author":"Falliere","year":"2011","journal-title":"White Paper, Symantec Security Response"},{"key":"ref42","article-title":"FBI","year":"2012","journal-title":"International Law Enforcement Disrupt International Organized Cyber Crime Ring Related to Butterfly Botnet"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/SECURWARE.2009.48"},{"key":"ref44","article-title":"Just What We Need: Malware to Slave Your Android to a Botnet","volume-title":"IT World.","author":"Fogarty","year":"2011"},{"key":"ref45","volume-title":"Uncovering Android Master Key That Makes 99 of Devices Vulnerable.","author":"Forristal","year":"2013"},{"key":"ref46","first-page":"1","article-title":"Symantec Internet Security Threat Report Trends for 2010","volume":"16","author":"Fossi","year":"2011","journal-title":"Symantec Internet Security Threat Report"},{"key":"ref47","first-page":"10","article-title":"Storm Worm Network Shrinks to About One-Tenth of Its Former Size","author":"Francia","year":"2007","journal-title":"Tech. Blorge. Com."},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-20757-0_1"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1007\/11555827_19"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/MILCOM.2012.6415605"},{"key":"ref51","volume-title":"Massive WordPress Attack Targets Weak Admin Passwords.","author":"Gilbertson","year":"2013"},{"key":"ref52","first-page":"1","article-title":"Rishi: identify bot contaminated hosts by irc nickname evaluation","volume-title":"Proc. 1st Conf. on 1st Workshop on Hot Topics in Understanding Botnets","author":"Goebel","year":"2007"},{"key":"ref53","volume-title":"Botnet Sics Zombie Soldiers on Gimpy Websites.","author":"Goodin","year":"2008"},{"key":"ref54","volume-title":"Waledac Botnet Decimated by MS Takedown.","author":"Goodin","year":"2010"},{"key":"ref55","first-page":"1","article-title":"Peer-to-peer botnets: overview and case study","volume-title":"Proc. 1st USENIX Workshop on Hot Topics in Understanding Botnets","author":"Grizzard","year":"2007"},{"key":"ref56","first-page":"167","article-title":"Bothunter: detecting malware infection through IDS-driven dialog correlation","volume-title":"Proc. 16th USENIX Security Symp.","author":"Gu","year":"2007"},{"key":"ref57","first-page":"2","article-title":"BotSniffer: detecting botnet command and control channels in network traffic","volume-title":"Proc. 15th Annual Network and Distributed System Security Symp.","author":"Gu","year":"2008a"},{"key":"ref58","first-page":"139","article-title":"BotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection","author":"Gu","year":"2008b","journal-title":"USENIX Security Symp."},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2009.30"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2009.5270322"},{"issue":"1","key":"ref61","first-page":"1","article-title":"Measurements and mitigation of peer-to-peer-based botnets: a case study on Storm worm","volume":"8","author":"Holz","year":"2008","journal-title":"LEET"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/1755688.1755702"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/COMSWA.2008.4554418"},{"issue":"1","key":"ref64","first-page":"28","article-title":"Botnets as a vehicle for online crime","volume":"1","author":"Ianelli","year":"2005","journal-title":"CERT Coordination Center"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/1298306.1298349"},{"key":"ref66","volume-title":"New Massive Botnet Twice the Size of Storm.","author":"Jackson","year":"2008"},{"key":"ref67","volume-title":"Global Threat Bot (GTbot).","author":"Janssen","year":"2011"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/PDP.2011.9"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/CICN.2012.46"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/icnp.2010.5762763"},{"key":"ref71","first-page":"1","article-title":"Botnet: classification, attacks, detection, tracing, and preventive measures","author":"Jing","year":"2009","journal-title":"EURASIP J Wirel. Commun. Network., 2009"},{"key":"ref72","first-page":"291","article-title":"Studying spamming botnets using Botlab","author":"John","year":"2009","journal-title":"NSDI"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/imf.2009.13"},{"key":"ref74","volume-title":"Internet Relay Chat: Architecture.","author":"Kalt","year":"2000"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1145\/1533057.1533064"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/ISECS.2009.61"},{"key":"ref77","article-title":"File-sharing in the Internet: a characterization of P2P traffic in the backbone","volume-title":"Technical Report, University of California","author":"Karagiannis","year":"2003"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028804"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1145\/1090191.1080119"},{"key":"ref80","first-page":"1","article-title":"Wide-scale botnet detection and characterization","volume-title":"Proc. first Conf. on 1st Workshop on Hot Topics in Understanding Botnets","author":"Karasaridis","year":"2007"},{"key":"ref81","volume-title":"The Top 10 Spam Botnets: New and Improved.","author":"Kassner","year":"2003"},{"key":"ref82","volume-title":"Top Botnets Control 1M Hijacked Computers.","author":"Keizer","year":"2008"},{"key":"ref83","volume-title":"How to Detect and Remove the Rootkit TDL4.","year":"2011"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1109\/IPC.2007.91"},{"key":"ref85","article-title":"Framework for Botnet Emulation and Analysis","author":"Lee","year":"2009","journal-title":"PhD Thesis, Georgia Institute of Technology"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2009.63"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/ICICIC.2009.127"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1145\/1533057.1533063"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1109\/ITAPP.2010.5566407"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/FITME.2010.5655788"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/ITCS.2009.257"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-85886-7_7"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/lcn.2006.322210"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOM.2008.ECP.398"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1145\/1533057.1533062"},{"key":"ref96","doi-asserted-by":"publisher","DOI":"10.1109\/CNSR.2009.21"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1109\/mascots.2006.6"},{"key":"ref98","volume-title":"M86 Security Threat Report for the Second Half of 2011 is Now Available.","author":"Mador","year":"2012"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1145\/1641587.1641590"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/SAMI.2012.6208963"},{"key":"ref101","volume-title":"Pushdo Botnet.","author":"Marry","year":"2010"},{"key":"ref102","doi-asserted-by":"publisher","DOI":"10.1109\/AINA.2010.171"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/ICDFMA.2008.4784437"},{"key":"ref104","doi-asserted-by":"publisher","DOI":"10.1109\/msecp.2003.1219079"},{"key":"ref105","volume-title":"Experts Bicker over Conficker Numbers.","author":"McMillan","year":"2009"},{"key":"ref106","volume-title":"Spanish Police Take Down Massive Mariposa Botnet.","author":"McMillan","year":"2010"},{"key":"ref107","volume-title":"America\u2019s 10 Most Wanted Botnets.","author":"Messmer","year":"2009"},{"key":"ref108","article-title":"The Rustock Botnet Spams Again","author":"Miller","year":"2008","journal-title":"SC Magazine"},{"key":"ref109","volume-title":"Researchers Hijack Control of Torpig Botnet.","author":"Miller","year":"2009"},{"key":"ref110","volume-title":"Experts: Gumblar Attack Is Alive, Worse than Conficker.","author":"Mills","year":"2009"},{"key":"ref111","doi-asserted-by":"crossref","DOI":"10.17487\/rfc1034","volume-title":"Domain Names-Concepts and Facilities.","author":"Mockapetris","year":"1987"},{"key":"ref112","volume-title":"Spam Botnets: the Fall of Grum and the Rise of Festi.","author":"Morrison","year":"2012"},{"key":"ref113","volume-title":"Kraken Botnet Re-emerges 318,000 Nodes Strong.","author":"Moscaritolo","year":"2010"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/APVIS.2007.329273"},{"key":"ref115","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2010.5665790"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1049\/cp.2011.0475"},{"key":"ref117","volume-title":"More than 600,000 Macs Infected with Flashback Botnet.","author":"Musil","year":"2012"},{"key":"ref118","first-page":"95","article-title":"BotGrep: finding P2P bots with structured graph analysis","author":"Nagaraja","year":"2010","journal-title":"USENIX Security Symp."},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.3233\/978-1-60750-060-5-163"},{"key":"ref120","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-73614-1_9"},{"key":"ref121","article-title":"Panda Security","volume-title":"Firewall: Prevent Unknown Connections Between the Network and the Internet.","year":"2013"},{"key":"ref122","volume-title":"The Dangers of HTTPS.","year":"2004"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.1109\/iri.2007.4296600"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2009.36"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2010.06.004"},{"key":"ref126","article-title":"Botnets: Detection, Measurement, Disinfection & Defence","author":"Plohmann","year":"2011","journal-title":"The European Network and Information Security Agency (ENISA)"},{"key":"ref127","volume-title":"Botnets: 10 Tough Questions.","author":"Plohmann","year":"2011"},{"key":"ref128","volume-title":"F-Secure, Threat Description: Backdoor: W32\/ Agobot.","author":"Podrezov","year":"2013"},{"key":"ref129","author":"Press","year":"2013","journal-title":"Wordpress website targeted by hackers"},{"key":"ref130","volume-title":"BotClouds: How Botnets Now Offer Crime-as-a-Service.","author":"Proffitt","year":"2012"},{"key":"ref131","article-title":"A virtual honeypot framework","author":"Provos","year":"2004","journal-title":"USENIX Security Symp"},{"key":"ref132","article-title":"Bots & Botnet: an Overview","author":"Puri","year":"2003","journal-title":"SANS Institute"},{"key":"ref133","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-31912-9_9"},{"key":"ref134","volume-title":"Ramnit Goes Social.","author":"Raff","year":"2012"},{"key":"ref135","doi-asserted-by":"publisher","DOI":"10.1109\/CSNT.2012.128"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1145\/1151659.1159947"},{"key":"ref137","first-page":"49","article-title":"Revealing botnet membership using DNSBL counter-intelligence","volume-title":"Proc. 2nd USENIX Steps to Reducing Unwanted Traffic on the Internet","author":"Ramachandran","year":"2006"},{"key":"ref138","doi-asserted-by":"publisher","DOI":"10.1145\/1774088.1774506"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.1145\/2501654.2501659"},{"key":"ref140","doi-asserted-by":"publisher","DOI":"10.1145\/1966913.1966988"},{"key":"ref141","doi-asserted-by":"publisher","DOI":"10.1007\/978-94-007-0641-5_17"},{"key":"ref142","first-page":"240","article-title":"Botnet: an overview","author":"Saha","year":"2005","journal-title":"CERT-In, White Paper, CIWP-2005-05"},{"key":"ref143","doi-asserted-by":"publisher","DOI":"10.1002\/sec.587"},{"key":"ref144","author":"Schiller","year":"2007","journal-title":"Spybot"},{"key":"ref145","volume-title":"Botnets-the Killer Web APP. Syngress","author":"Schiller","year":"2011"},{"key":"ref146","volume-title":"Calculating the Size of the Downadup Outbreak.","author":"Schmudlach","year":"2009"},{"key":"ref147","volume-title":"Zeus Botnet Eurograbber Steals $47 Million.","author":"Schwartz","year":"2012"},{"key":"ref148","volume-title":"Microsoft, FBI Trumpet Citadel Botnet Takedowns.","author":"Schwartz","year":"2013"},{"key":"ref149","volume-title":"SdBot.","author":"Sevcenco","year":"2012"},{"key":"ref150","doi-asserted-by":"publisher","DOI":"10.1109\/ICCTD.2009.82"},{"key":"ref151","first-page":"1","article-title":"A survey of botnet: consequences, defenses and challenges","author":"Shin","year":"2009","journal-title":"Joint Workshop on Internet Security"},{"key":"ref152","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2012.07.021"},{"key":"ref153","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2012.6364709"},{"key":"ref154","volume-title":"Discovered: Botnet Costing Display Advertisers over Six Million Dollars per Month.","author":"Spider","year":"2013"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1109\/ISSA.2011.6027531"},{"key":"ref156","volume-title":"Sinkholing the Hlux\/Kelihos Botnet-What Happened?","author":"Stefan","year":"2013"},{"key":"ref157","article-title":"Malware Command and Control Overview","volume-title":"Technical Report.","author":"Stephens","year":"2010"},{"key":"ref158","volume-title":"Pushdo - Analysis of a Modern Malware Distribution System.","author":"Stewart","year":"2007"},{"key":"ref159","article-title":"Spam Botnets to Watch in 2009","volume-title":"Dell SecureWorks.","author":"Stewart","year":"2009"},{"key":"ref160","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-73614-1_6"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-68768-1_3"},{"key":"ref162","doi-asserted-by":"publisher","DOI":"10.1109\/LCN.2006.322100"},{"key":"ref163","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-68768-1_1"},{"key":"ref164","article-title":"BOTMAGNIFIER: Locating Spambots on the Internet","author":"Stringhini","year":"2011","journal-title":"USENIX Security Symp"},{"key":"ref165","volume-title":"Bagle.","year":"2010"},{"key":"ref166","volume-title":"DNS Best Practices.","year":"2012"},{"key":"ref167","doi-asserted-by":"publisher","DOI":"10.1109\/WiMOB.2012.6379111"},{"key":"ref168","doi-asserted-by":"publisher","DOI":"10.1109\/DepCoS-RELCOMEX.2009.46"},{"key":"ref169","doi-asserted-by":"publisher","DOI":"10.1109\/JSTSP.2012.2233713"},{"key":"ref170","article-title":"The H Security","volume-title":"New Zealand Teenager Accused of Controlling Botnet of 1.3 Million Computers.","year":"2007"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.1145\/2030376.2030395"},{"key":"ref172","doi-asserted-by":"publisher","DOI":"10.1109\/ias.2007.72"},{"key":"ref173","article-title":"Stealrat: an In-Depth Look at an Emerging Spambot Jessa","volume-title":"White Paper","author":"Torre","year":"2013"},{"key":"ref174","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653690"},{"key":"ref175","article-title":"Taxonomy of Botnet Threats","year":"2006","journal-title":"Technical Report"},{"key":"ref176","volume-title":"Andrameda Botnet.","year":"2013"},{"key":"ref177","volume-title":"Russian Botnet Wants to Kill the Competitor.","author":"Truhanov","year":"2010"},{"key":"ref178","volume-title":"Android DreamDroid Two: Rise of Laced APPs.","author":"Tung","year":"2011"},{"key":"ref179","doi-asserted-by":"publisher","DOI":"10.1109\/CogSIMA.2013.6523859"},{"key":"ref180","doi-asserted-by":"publisher","DOI":"10.1109\/QEST.2008.43"},{"key":"ref181","doi-asserted-by":"publisher","DOI":"10.1109\/ccnc08.2007.112"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.1109\/tnet.2009.2020830"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.1109\/EBISS.2010.5473532"},{"key":"ref184","doi-asserted-by":"publisher","DOI":"10.1109\/BMEI.2009.5305615"},{"key":"ref185","volume-title":"An Advanced Hybrid Peer-to-Peer Botnet.","author":"Wang","year":"2007"},{"key":"ref186","doi-asserted-by":"publisher","DOI":"10.1109\/tdsc.2008.35"},{"key":"ref187","doi-asserted-by":"publisher","DOI":"10.1109\/NSWCTC.2009.72"},{"key":"ref188","volume-title":"Eggdrop.","author":"Wang","year":"2003"},{"key":"ref189","doi-asserted-by":"publisher","DOI":"10.1109\/MMIT.2010.177"},{"key":"ref190","article-title":"Oleg Nikolaenko","volume-title":"Mega-D Botmaster to Stand Trial.","author":"Warner","year":"2010"},{"key":"ref191","doi-asserted-by":"publisher","DOI":"10.1145\/1140086.1140094"},{"key":"ref192","doi-asserted-by":"publisher","DOI":"10.1145\/1963405.1963441"},{"key":"ref193","volume-title":"NetBus.","year":"1998"},{"key":"ref194","volume-title":"Anomaly Detection.","year":"2013a"},{"key":"ref195","volume-title":"Botnets.","year":"2013b"},{"key":"ref196","volume-title":"Mariposa Botnet.","year":"2013c"},{"key":"ref197","doi-asserted-by":"publisher","DOI":"10.1145\/948205.948216"},{"key":"ref198","volume-title":"Social VPN.","year":"2008"},{"key":"ref199","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04444-1_15"},{"key":"ref200","doi-asserted-by":"publisher","DOI":"10.1109\/ICNSS.2011.6059960"},{"key":"ref201","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382257"},{"key":"ref202","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCS.2010.76"},{"key":"ref203","doi-asserted-by":"publisher","DOI":"10.1109\/IITSI.2010.127"},{"key":"ref204","doi-asserted-by":"publisher","DOI":"10.1145\/1718487.1718540"},{"key":"ref205","doi-asserted-by":"publisher","DOI":"10.1109\/IEEC.2009.35"},{"key":"ref206","doi-asserted-by":"publisher","DOI":"10.4304\/jnw.5.5.568-576"},{"key":"ref207","doi-asserted-by":"publisher","DOI":"10.1109\/ICCEE.2009.151"},{"key":"ref208","doi-asserted-by":"publisher","DOI":"10.1109\/ICCSIT.2010.5563555"},{"key":"ref209","doi-asserted-by":"publisher","DOI":"10.1109\/IWQOS.2011.5931312"},{"key":"ref210","doi-asserted-by":"publisher","DOI":"10.1145\/1966913.1966930"},{"key":"ref211","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2011.5958212"},{"key":"ref212","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420968"},{"key":"ref213","first-page":"321","article-title":"BotGraph: large scale spamming botnet detection","volume":"9","author":"Zhao","year":"2009","journal-title":"NSDI"},{"key":"ref214","doi-asserted-by":"publisher","DOI":"10.1109\/IWNAS.2006.36"},{"key":"ref215","first-page":"967","article-title":"Botnet research survey. 32nd Annual IEEE Int","volume-title":"Computer Software and Applications","author":"Zhu","year":"2008"},{"key":"ref216","first-page":"1","article-title":"Characterizing botnets from email spam records","volume-title":"Proc. 1st USENIX Workshop on Large-Scale Exploits and Emergent Threats LEET","author":"Zhuang","year":"2008"},{"key":"ref217","doi-asserted-by":"publisher","DOI":"10.1109\/dsn.2006.38"}],"container-title":["Journal of Zhejiang University SCIENCE C"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1631\/jzus.C1300242.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/article\/10.1631\/jzus.C1300242\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1631\/jzus.C1300242","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,21]],"date-time":"2026-02-21T06:57:20Z","timestamp":1771657040000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1631\/jzus.C1300242"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014,11]]},"references-count":217,"journal-issue":{"issue":"11","published-print":{"date-parts":[[2014,11]]}},"alternative-id":["1542"],"URL":"https:\/\/doi.org\/10.1631\/jzus.c1300242","relation":{},"ISSN":["1869-1951","1869-196X"],"issn-type":[{"value":"1869-1951","type":"print"},{"value":"1869-196X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2014,11]]}}}