{"id":"https://openalex.org/W2144768538","doi":"https://doi.org/10.1145/1718487.1718540","title":"SBotMiner","display_name":"SBotMiner","publication_year":2010,"publication_date":"2010-02-04","ids":{"openalex":"https://openalex.org/W2144768538","doi":"https://doi.org/10.1145/1718487.1718540","mag":"2144768538"},"language":"en","primary_location":{"id":"doi:10.1145/1718487.1718540","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1718487.1718540","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the third ACM international conference on Web search and data mining","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100728882","display_name":"Fang Yu","orcid":"https://orcid.org/0000-0001-9670-0826"},"institutions":[{"id":"https://openalex.org/I1290206253","display_name":"Microsoft (United States)","ror":"https://ror.org/00d0nc645","country_code":"US","type":"company","lineage":["https://openalex.org/I1290206253"]},{"id":"https://openalex.org/I4210086253","display_name":"Silicon Valley Community Foundation","ror":"https://ror.org/001ader08","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I4210086253"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Fang Yu","raw_affiliation_strings":["Microsoft Research Silicon Valley, Mountain View, CA, USA","Microsoft Research Silicon Valley, Mountain view, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Microsoft Research Silicon Valley, Mountain View, CA, USA","institution_ids":["https://openalex.org/I4210086253","https://openalex.org/I1290206253"]},{"raw_affiliation_string":"Microsoft Research Silicon Valley, Mountain view, CA, USA","institution_ids":["https://openalex.org/I4210086253","https://openalex.org/I1290206253"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103462744","display_name":"Yinglian Xie","orcid":null},"institutions":[{"id":"https://openalex.org/I1290206253","display_name":"Microsoft (United States)","ror":"https://ror.org/00d0nc645","country_code":"US","type":"company","lineage":["https://openalex.org/I1290206253"]},{"id":"https://openalex.org/I4210086253","display_name":"Silicon Valley Community Foundation","ror":"https://ror.org/001ader08","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I4210086253"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yinglian Xie","raw_affiliation_strings":["Microsoft Research Silicon Valley, Mountain View, CA, USA","Microsoft Research Silicon Valley, Mountain view, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Microsoft Research Silicon Valley, Mountain View, CA, USA","institution_ids":["https://openalex.org/I4210086253","https://openalex.org/I1290206253"]},{"raw_affiliation_string":"Microsoft Research Silicon Valley, Mountain view, CA, USA","institution_ids":["https://openalex.org/I4210086253","https://openalex.org/I1290206253"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5111827722","display_name":"Qifa Ke","orcid":null},"institutions":[{"id":"https://openalex.org/I1290206253","display_name":"Microsoft (United States)","ror":"https://ror.org/00d0nc645","country_code":"US","type":"company","lineage":["https://openalex.org/I1290206253"]},{"id":"https://openalex.org/I4210086253","display_name":"Silicon Valley Community Foundation","ror":"https://ror.org/001ader08","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I4210086253"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Qifa Ke","raw_affiliation_strings":["Microsoft Research Silicon Valley, Mountain View, CA, USA","Microsoft Research Silicon Valley, Mountain view, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Microsoft Research Silicon Valley, Mountain View, CA, USA","institution_ids":["https://openalex.org/I4210086253","https://openalex.org/I1290206253"]},{"raw_affiliation_string":"Microsoft Research Silicon Valley, Mountain view, CA, USA","institution_ids":["https://openalex.org/I4210086253","https://openalex.org/I1290206253"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":58,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"421","last_page":"430"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11478","display_name":"Caching and Content Delivery","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7606837749481201},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6990598440170288},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6130320429801941},{"id":"https://openalex.org/keywords/phishing","display_name":"Phishing","score":0.6059290766716003},{"id":"https://openalex.org/keywords/search-engine","display_name":"Search engine","score":0.5418953895568848},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.42457789182662964},{"id":"https://openalex.org/keywords/web-search-query","display_name":"Web search query","score":0.4177170395851135},{"id":"https://openalex.org/keywords/information-retrieval","display_name":"Information retrieval","score":0.2889859080314636},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.27796101570129395},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.25482177734375}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7606837749481201},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6990598440170288},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6130320429801941},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.6059290766716003},{"id":"https://openalex.org/C97854310","wikidata":"https://www.wikidata.org/wiki/Q19541","display_name":"Search engine","level":2,"score":0.5418953895568848},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.42457789182662964},{"id":"https://openalex.org/C164120249","wikidata":"https://www.wikidata.org/wiki/Q995982","display_name":"Web search query","level":3,"score":0.4177170395851135},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.2889859080314636},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.27796101570129395},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.25482177734375}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/1718487.1718540","is_oa":false,"landing_page_url":"https://doi.org/10.1145/1718487.1718540","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the third ACM international conference on Web search and data mining","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.6000000238418579,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":31,"referenced_works":["https://openalex.org/W75235505","https://openalex.org/W95608104","https://openalex.org/W123401891","https://openalex.org/W205305182","https://openalex.org/W1483048869","https://openalex.org/W1493893823","https://openalex.org/W1583098994","https://openalex.org/W1593657937","https://openalex.org/W1922851884","https://openalex.org/W1983704604","https://openalex.org/W2008778571","https://openalex.org/W2013531639","https://openalex.org/W2034117506","https://openalex.org/W2096273775","https://openalex.org/W2099194763","https://openalex.org/W2100307718","https://openalex.org/W2100830825","https://openalex.org/W2108124343","https://openalex.org/W2112063328","https://openalex.org/W2113344319","https://openalex.org/W2114092087","https://openalex.org/W2119690237","https://openalex.org/W2132133059","https://openalex.org/W2155841152","https://openalex.org/W2166299449","https://openalex.org/W2296437506","https://openalex.org/W2760608934","https://openalex.org/W3099514962","https://openalex.org/W4233802931","https://openalex.org/W4234562309","https://openalex.org/W4237690029"],"related_works":["https://openalex.org/W2906845177","https://openalex.org/W4200107511","https://openalex.org/W2891427086","https://openalex.org/W1968625315","https://openalex.org/W2533706070","https://openalex.org/W2184474188","https://openalex.org/W3094024929","https://openalex.org/W2066869521","https://openalex.org/W2105258824","https://openalex.org/W3210975432"],"abstract_inverted_index":{"In":[0],"this":[1],"paper,":[2],"we":[3],"study":[4],"search":[5,9,21,35,58,76,130],"bot":[6,59,109,131],"traffic":[7,22,60,110,132],"from":[8,61,81],"engine":[10],"query":[11,62],"logs":[12],"at":[13],"a":[14,28,51,103],"large":[15,29,104],"scale.":[16],"Although":[17],"bots":[18,36],"that":[19,102,128],"generate":[20],"aggressively":[23],"can":[24],"be":[25,112],"easily":[26],"detected,":[27],"number":[30],"of":[31,65,73,95,106],"distributed,":[32,74],"low":[33],"rate":[34],"are":[37,42],"difficult":[38],"to":[39,136],"identify":[40],"and":[41,138],"often":[43],"associated":[44,113],"with":[45,114],"malicious":[46,116],"attacks.":[47],"We":[48],"present":[49],"SBotMiner,":[50],"system":[52],"for":[53,93],"automatically":[54],"identifying":[55],"stealthy,":[56],"low-rate":[57],"logs.":[63],"Instead":[64],"detecting":[66,129],"individual":[67],"bots,":[68],"our":[69],"approach":[70],"captures":[71],"groups":[72],"coordinated":[75],"bots.":[77],"Using":[78],"sampled":[79],"data":[80],"two":[82],"different":[83],"months,":[84],"SBotMiner":[85],"identifies":[86],"over":[87],"123":[88],"million":[89],"bot-related":[90],"pageviews,":[91],"accounting":[92],"3.8%":[94],"total":[96],"traffic.":[97],"Our":[98],"in-depth":[99],"analysis":[100],"shows":[101],"fraction":[105],"the":[107],"identified":[108],"may":[111],"various":[115],"activities":[117],"such":[118],"as":[119],"phishing":[120],"attacks":[121,140],"or":[122],"vulnerability":[123],"exploits.":[124],"This":[125],"finding":[126],"suggests":[127],"holds":[133],"great":[134],"promise":[135],"detect":[137],"stop":[139],"early":[141],"on.":[142]},"counts_by_year":[{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":4},{"year":2019,"cited_by_count":6},{"year":2018,"cited_by_count":6},{"year":2017,"cited_by_count":6},{"year":2016,"cited_by_count":3},{"year":2015,"cited_by_count":4},{"year":2014,"cited_by_count":4},{"year":2013,"cited_by_count":10},{"year":2012,"cited_by_count":5}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2016-06-24T00:00:00"}