{"id":"https://openalex.org/W1594972289","doi":null,"title":"BotGrep: finding P2P bots with structured graph analysis","display_name":"BotGrep: finding P2P bots with structured graph analysis","publication_year":2010,"publication_date":"2010-08-11","ids":{"openalex":"https://openalex.org/W1594972289","mag":"1594972289"},"language":"en","primary_location":{"id":"pmh:oai:CiteSeerX.psu:10.1.1.172.8756","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.172.8756","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.usenix.org/events/sec10/tech/full_papers/Nagaraja.pdf","raw_type":"text"},"volume":null,"type":"article","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5089038143","display_name":"Shishir Nagaraja","orcid":"https://orcid.org/0000-0001-7272-0611","observed_orcids":["https://orcid.org/0000-0001-7272-0611"]},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Shishir Nagaraja","raw_affiliation_strings":["University of Illinois at Urbana Champaign"],"raw_orcid":"https://orcid.org/0000-0001-7272-0611","affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015619835","display_name":"Prateek Mittal","orcid":"https://orcid.org/0000-0002-4057-0118","observed_orcids":["https://orcid.org/0000-0002-4057-0118"]},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Prateek Mittal","raw_affiliation_strings":["University of Illinois at Urbana Champaign"],"raw_orcid":"https://orcid.org/0000-0002-4057-0118","affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102307938","display_name":"Chi-Yao Hong","orcid":"https://orcid.org/0009-0001-5571-2545","observed_orcids":["https://orcid.org/0009-0001-5571-2545"]},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Chi-Yao Hong","raw_affiliation_strings":["University of Illinois at Urbana Champaign"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038897777","display_name":"Matthew Caesar","orcid":"https://orcid.org/0000-0001-5955-9229","observed_orcids":["https://orcid.org/0000-0001-5955-9229"]},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Matthew Caesar","raw_affiliation_strings":["University of Illinois at Urbana Champaign"],"raw_orcid":"https://orcid.org/0000-0001-5955-9229","affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana Champaign","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5024942018","display_name":"Nikita Borisov","orcid":"https://orcid.org/0000-0002-7769-4931","observed_orcids":["https://orcid.org/0000-0002-7769-4931"]},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nikita Borisov","raw_affiliation_strings":["University of Illinois at Urbana Champaign"],"raw_orcid":"https://orcid.org/0000-0002-7769-4931","affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana Champaign","institution_ids":["https://openalex.org/I157725225"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I157725225"],"apc_list":null,"apc_paid":null,"fwci":30.1397,"has_fulltext":false,"cited_by_count":229,"citation_normalized_percentile":{"value":0.99719322,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"7","last_page":"7"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8417999744415283,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8417999744415283,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.07029999792575836,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.05550000071525574,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet-detection","display_name":"botnet detection","score":0.8100000023841858},{"id":"https://openalex.org/keywords/peer-to-peer-botnets","display_name":"peer-to-peer botnets","score":0.9269999861717224},{"id":"https://openalex.org/keywords/command-and-control","display_name":"command and control","score":0.6690000295639038},{"id":"https://openalex.org/keywords/graph-analysis","display_name":"graph analysis","score":0.7720000147819519},{"id":"https://openalex.org/keywords/network-traffic-traces","display_name":"network traces","score":0.5519999861717224},{"id":"https://openalex.org/keywords/measurement-error","display_name":"measurement error","score":0.37700000405311584}],"concepts":[{"id":"https://openalex.org/C199845137","wikidata":"https://www.wikidata.org/wiki/Q145490","display_name":"Network topology","level":2,"score":0.8805853724479675},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.7969975471496582},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7898486852645874},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.6714383363723755},{"id":"https://openalex.org/C169851745","wikidata":"https://www.wikidata.org/wiki/Q1331985","display_name":"Overlay network","level":3,"score":0.6418780088424683},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.6262338161468506},{"id":"https://openalex.org/C136085584","wikidata":"https://www.wikidata.org/wiki/Q910289","display_name":"Overlay","level":2,"score":0.565165638923645},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.5028387904167175},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.49256592988967896},{"id":"https://openalex.org/C99237066","wikidata":"https://www.wikidata.org/wiki/Q17092610","display_name":"Internet topology","level":3,"score":0.4611497223377228},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.4162350594997406},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.31393715739250183},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.15415191650390625},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"pmh:oai:CiteSeerX.psu:10.1.1.172.8756","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.172.8756","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.usenix.org/events/sec10/tech/full_papers/Nagaraja.pdf","raw_type":"text"},{"id":"pmh:oai:pure.atira.dk:openaire_cris_publications/bba88529-72fc-48b8-b8c0-a63832bb3bf9","doi":null,"is_oa":false,"landing_page_url":"https://research.birmingham.ac.uk/en/publications/bba88529-72fc-48b8-b8c0-a63832bb3bf9","pdf_url":null,"source":{"id":"https://openalex.org/S4306402634","display_name":"University of Birmingham Research Portal (University of Birmingham)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I79619799","host_organization_name":"University of Birmingham","host_organization_lineage":["https://openalex.org/I79619799"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Nagaraja, S, Mital, P, Hong, C-Y, Caesar, M & N, B 2010, BotGrep: Finding P2P Bots with Structured Graph Analysis. in Proceedings of the 19th USENIX Security Symposium 2010. USENIX , pp. 95-110. < http://static.usenix.org/events/sec10/tech/full_papers/Nagaraja.pdf >","raw_type":"contributionToPeriodical"},{"id":"mag:1594972289","doi":null,"is_oa":false,"landing_page_url":"http://ants.iis.sinica.edu.tw/3BkMJ9lTeWXTSrrvNoKNFDxRm3zFwRR/27/2010_UsenixSec_Nagaraja.pdf","pdf_url":null,"source":{"id":"https://openalex.org/S4306421123","display_name":"USENIX Security Symposium","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":"USENIX Security Symposium","raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":70,"referenced_works":["https://openalex.org/W1655456","https://openalex.org/W16833051","https://openalex.org/W47988595","https://openalex.org/W187875600","https://openalex.org/W191098608","https://openalex.org/W202500387","https://openalex.org/W1462349742","https://openalex.org/W1481472066","https://openalex.org/W1499648394","https://openalex.org/W1523214132","https://openalex.org/W1526879126","https://openalex.org/W1544327602","https://openalex.org/W1550514379","https://openalex.org/W1551705282","https://openalex.org/W1551760018","https://openalex.org/W1583098994","https://openalex.org/W1585610988","https://openalex.org/W1630225947","https://openalex.org/W1756608328","https://openalex.org/W1775772884","https://openalex.org/W1809063480","https://openalex.org/W1854483861","https://openalex.org/W1909494783","https://openalex.org/W1922851884","https://openalex.org/W1965555277","https://openalex.org/W1971421925","https://openalex.org/W1980793860","https://openalex.org/W2006052322","https://openalex.org/W2009751443","https://openalex.org/W2015953751","https://openalex.org/W2016551721","https://openalex.org/W2026601878","https://openalex.org/W2033281046","https://openalex.org/W2034331023","https://openalex.org/W2047940964","https://openalex.org/W2069620139","https://openalex.org/W2075816541","https://openalex.org/W2077439570","https://openalex.org/W2085092855","https://openalex.org/W2087811006","https://openalex.org/W2091692346","https://openalex.org/W2095293504","https://openalex.org/W2096706512","https://openalex.org/W2102671922","https://openalex.org/W2104209065","https://openalex.org/W2105140491","https://openalex.org/W2106895011","https://openalex.org/W2107082801","https://openalex.org/W2117420615","https://openalex.org/W2119245106","https://openalex.org/W2121320294","https://openalex.org/W2124365372","https://openalex.org/W2126206464","https://openalex.org/W2130550456","https://openalex.org/W2132172731","https://openalex.org/W2132280055","https://openalex.org/W2138309709","https://openalex.org/W2147767253","https://openalex.org/W2150593711","https://openalex.org/W2152118092","https://openalex.org/W2158049821","https://openalex.org/W2162709050","https://openalex.org/W2163598416","https://openalex.org/W2171957559","https://openalex.org/W2186002226","https://openalex.org/W2241311940","https://openalex.org/W2280775762","https://openalex.org/W2296396094","https://openalex.org/W2489701140","https://openalex.org/W6884707639"],"related_works":["https://openalex.org/W2122682880","https://openalex.org/W52120761","https://openalex.org/W7096681566","https://openalex.org/W239671278","https://openalex.org/W16833051","https://openalex.org/W2044285442","https://openalex.org/W1925187733","https://openalex.org/W4408898043","https://openalex.org/W4414270816","https://openalex.org/W1588208147"],"abstract_inverted_index":{"A":[0],"key":[1],"feature":[2],"that":[3,84],"distinguishes":[4],"modern":[5],"botnets":[6],"from":[7,59,78,107,116],"earlier":[8],"counterparts":[9],"is":[10],"their":[11,60],"increasing":[12],"use":[13],"of":[14,40,92,110,118],"structured":[15],"overlay":[16,61],"topologies.":[17],"This":[18],"lets":[19],"them":[20],"carry":[21],"out":[22],"sophisticated":[23],"coordinated":[24],"activities":[25],"while":[26],"being":[27],"resilient":[28,102],"to":[29,48,103],"churn,":[30],"but":[31],"it":[32],"can":[33,88],"also":[34],"be":[35],"used":[36,63],"as":[37],"a":[38],"point":[39],"detection.":[41],"In":[42],"this":[43],"work,":[44],"we":[45],"devise":[46],"techniques":[47,86],"localize":[49,89],"botnet":[50],"members":[51],"based":[52],"on":[53,70],"the":[54,90],"unique":[55],"communication":[56],"patterns":[57],"arising":[58,106],"topologies":[62,72],"for":[64],"command":[65],"and":[66,99,113],"control.":[67],"Experimental":[68],"results":[69],"synthetic":[71],"embedded":[73],"within":[74],"Internet":[75],"traffic":[76],"traces":[77],"an":[79],"ISP\u2019s":[80],"backbone":[81],"network":[82],"indicate":[83],"our":[85],"(i)":[87],"majority":[91],"bots":[93],"with":[94],"low":[95],"false":[96],"positive":[97],"rate,":[98],"(ii)":[100],"are":[101],"incomplete":[104],"visibility":[105],"partial":[108],"deployment":[109],"monitoring":[111],"systems":[112],"measurement":[114],"inaccuracies":[115],"dynamics":[117],"background":[119],"traffic.":[120],"1":[121]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":6},{"year":2023,"cited_by_count":4},{"year":2022,"cited_by_count":5},{"year":2021,"cited_by_count":8},{"year":2020,"cited_by_count":22},{"year":2019,"cited_by_count":12},{"year":2018,"cited_by_count":20},{"year":2017,"cited_by_count":12},{"year":2016,"cited_by_count":15},{"year":2015,"cited_by_count":17},{"year":2014,"cited_by_count":33},{"year":2013,"cited_by_count":30},{"year":2012,"cited_by_count":23}],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2016-06-24T00:00:00"}