{"id":"https://openalex.org/W2116227232","doi":"https://doi.org/10.1145/2398776.2398778","title":"Analysis of a \"/0\" stealth scan from a botnet","display_name":"Analysis of a \"/0\" stealth scan from a botnet","publication_year":2012,"publication_date":"2012-11-14","ids":{"openalex":"https://openalex.org/W2116227232","doi":"https://doi.org/10.1145/2398776.2398778","mag":"2116227232"},"language":"en","primary_location":{"id":"doi:10.1145/2398776.2398778","is_oa":true,"landing_page_url":"https://doi.org/10.1145/2398776.2398778","pdf_url":"https://dl.acm.org/action/downloadSupplement?doi=10.1145%2F2398776.2398778&file=213.pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2012 Internet Measurement Conference","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/action/downloadSupplement?doi=10.1145%2F2398776.2398778&file=213.pdf","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5040042401","display_name":"Alberto Dainotti","orcid":"https://orcid.org/0000-0001-6444-5656"},"institutions":[{"id":"https://openalex.org/I36258959","display_name":"University of California, San Diego","ror":"https://ror.org/0168r3w48","country_code":"US","type":"education","lineage":["https://openalex.org/I36258959"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Alberto Dainotti","raw_affiliation_strings":["CAIDA, UCSD, La Jolla, California, USA","CAIDA, UCSD, La Jolla, California, USA#TAB#"],"affiliations":[{"raw_affiliation_string":"CAIDA, UCSD, La Jolla, California, USA","institution_ids":["https://openalex.org/I36258959"]},{"raw_affiliation_string":"CAIDA, UCSD, La Jolla, California, USA#TAB#","institution_ids":["https://openalex.org/I36258959"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075670573","display_name":"Alistair King","orcid":null},"institutions":[{"id":"https://openalex.org/I36258959","display_name":"University of California, San Diego","ror":"https://ror.org/0168r3w48","country_code":"US","type":"education","lineage":["https://openalex.org/I36258959"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Alistair King","raw_affiliation_strings":["CAIDA, UCSD, La Jolla, California, USA","CAIDA, UCSD, La Jolla, California, USA#TAB#"],"affiliations":[{"raw_affiliation_string":"CAIDA, UCSD, La Jolla, California, USA","institution_ids":["https://openalex.org/I36258959"]},{"raw_affiliation_string":"CAIDA, UCSD, La Jolla, California, USA#TAB#","institution_ids":["https://openalex.org/I36258959"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072282499","display_name":"kc claffy","orcid":"https://orcid.org/0000-0003-4824-3493"},"institutions":[{"id":"https://openalex.org/I36258959","display_name":"University of California, San Diego","ror":"https://ror.org/0168r3w48","country_code":"US","type":"education","lineage":["https://openalex.org/I36258959"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"kc Claffy","raw_affiliation_strings":["CAIDA, UCSD, La Jolla, California, USA","CAIDA, UCSD, La Jolla, California, USA#TAB#"],"affiliations":[{"raw_affiliation_string":"CAIDA, UCSD, La Jolla, California, USA","institution_ids":["https://openalex.org/I36258959"]},{"raw_affiliation_string":"CAIDA, UCSD, La Jolla, California, USA#TAB#","institution_ids":["https://openalex.org/I36258959"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5069450578","display_name":"Ferdinando Papale","orcid":null},"institutions":[{"id":"https://openalex.org/I71267560","display_name":"University of Naples Federico II","ror":"https://ror.org/05290cv24","country_code":"IT","type":"education","lineage":["https://openalex.org/I71267560"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Ferdinando Papale","raw_affiliation_strings":["University of Napoli Federico II, Naples, Italy"],"affiliations":[{"raw_affiliation_string":"University of Napoli Federico II, Naples, Italy","institution_ids":["https://openalex.org/I71267560"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5064292700","display_name":"Antonio Pescap\u00e8","orcid":"https://orcid.org/0000-0002-0221-7444"},"institutions":[{"id":"https://openalex.org/I71267560","display_name":"University of Naples Federico II","ror":"https://ror.org/05290cv24","country_code":"IT","type":"education","lineage":["https://openalex.org/I71267560"]}],"countries":["IT"],"is_corresponding":false,"raw_author_name":"Antonio Pescap\u00e8","raw_affiliation_strings":["University of Napoli Federico II, Naples, Italy"],"affiliations":[{"raw_affiliation_string":"University of Napoli Federico II, Naples, Italy","institution_ids":["https://openalex.org/I71267560"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5040042401"],"corresponding_institution_ids":["https://openalex.org/I36258959"],"apc_list":null,"apc_paid":null,"fwci":14.8636,"has_fulltext":true,"cited_by_count":82,"citation_normalized_percentile":{"value":0.99184367,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"14"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.980034351348877},{"id":"https://openalex.org/keywords/honeypot","display_name":"Honeypot","score":0.7370601892471313},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6963069438934326},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.674971342086792},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.666178286075592},{"id":"https://openalex.org/keywords/spamming","display_name":"Spamming","score":0.6045963764190674},{"id":"https://openalex.org/keywords/denial-of-service-attack","display_name":"Denial-of-service attack","score":0.5734152793884277},{"id":"https://openalex.org/keywords/phishing","display_name":"Phishing","score":0.4981658458709717},{"id":"https://openalex.org/keywords/ipv4","display_name":"IPv4","score":0.4506511688232422},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.41986003518104553},{"id":"https://openalex.org/keywords/ipv6","display_name":"IPv6","score":0.3073292374610901},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.16574403643608093}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.980034351348877},{"id":"https://openalex.org/C191267431","wikidata":"https://www.wikidata.org/wiki/Q911932","display_name":"Honeypot","level":2,"score":0.7370601892471313},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6963069438934326},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.674971342086792},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.666178286075592},{"id":"https://openalex.org/C158955206","wikidata":"https://www.wikidata.org/wiki/Q83058","display_name":"Spamming","level":3,"score":0.6045963764190674},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.5734152793884277},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.4981658458709717},{"id":"https://openalex.org/C2779233093","wikidata":"https://www.wikidata.org/wiki/Q11103","display_name":"IPv4","level":4,"score":0.4506511688232422},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.41986003518104553},{"id":"https://openalex.org/C84555802","wikidata":"https://www.wikidata.org/wiki/Q2551624","display_name":"IPv6","level":3,"score":0.3073292374610901},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.16574403643608093}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/2398776.2398778","is_oa":true,"landing_page_url":"https://doi.org/10.1145/2398776.2398778","pdf_url":"https://dl.acm.org/action/downloadSupplement?doi=10.1145%2F2398776.2398778&file=213.pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2012 Internet Measurement Conference","raw_type":"proceedings-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.269.5543","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.269.5543","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.caida.org/outreach/papers/2012/analysis_slash_zero/analysis_slash_zero.pdf","raw_type":"text"}],"best_oa_location":{"id":"doi:10.1145/2398776.2398778","is_oa":true,"landing_page_url":"https://doi.org/10.1145/2398776.2398778","pdf_url":"https://dl.acm.org/action/downloadSupplement?doi=10.1145%2F2398776.2398778&file=213.pdf","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2012 Internet Measurement Conference","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.6000000238418579,"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2116227232.pdf","grobid_xml":"https://content.openalex.org/works/W2116227232.grobid-xml"},"referenced_works_count":36,"referenced_works":["https://openalex.org/W63790640","https://openalex.org/W202500387","https://openalex.org/W1498585374","https://openalex.org/W1499648394","https://openalex.org/W1513323201","https://openalex.org/W1583098994","https://openalex.org/W1962340579","https://openalex.org/W1980003963","https://openalex.org/W1994340575","https://openalex.org/W2002537105","https://openalex.org/W2005813008","https://openalex.org/W2012575532","https://openalex.org/W2040393847","https://openalex.org/W2042839074","https://openalex.org/W2067117154","https://openalex.org/W2069620139","https://openalex.org/W2097725665","https://openalex.org/W2100307718","https://openalex.org/W2102671922","https://openalex.org/W2109129913","https://openalex.org/W2112063328","https://openalex.org/W2113344319","https://openalex.org/W2134733568","https://openalex.org/W2144489971","https://openalex.org/W2145802904","https://openalex.org/W2152955531","https://openalex.org/W2152969395","https://openalex.org/W2155372789","https://openalex.org/W2167994609","https://openalex.org/W2294919332","https://openalex.org/W2548720381","https://openalex.org/W2769954494","https://openalex.org/W4233802931","https://openalex.org/W4237690029","https://openalex.org/W4242138061","https://openalex.org/W4285719527"],"related_works":["https://openalex.org/W2124355208","https://openalex.org/W2958063430","https://openalex.org/W2969653794","https://openalex.org/W4307740390","https://openalex.org/W177515589","https://openalex.org/W2130329553","https://openalex.org/W2492910442","https://openalex.org/W2255926860","https://openalex.org/W2922891864","https://openalex.org/W4205869786"],"abstract_inverted_index":{"Botnets":[0,27],"are":[1,10],"the":[2,45,56,65,72,116,150,163,168,193,208],"most":[3],"common":[4],"vehicle":[5],"of":[6,16,60,64,77,127,140,149,165,170,178,192],"cyber-criminal":[7],"activity.":[8],"They":[9],"used":[11,92],"for":[12,32,37,49],"spamming,":[13],"phishing,":[14],"denial":[15],"service":[17],"attacks,":[18],"brute-force":[19],"cracking,":[20],"stealing":[21],"private":[22],"information,":[23],"and":[24,42,58,91,96,105,130,203],"cyber":[25],"warfare.":[26],"carry":[28],"out":[29],"network":[30],"scans":[31],"several":[33],"reasons,":[34],"including":[35,197],"searching":[36],"vulnerable":[38],"machines":[39],"to":[40,101,103,142,200],"infect":[41],"recruit":[43],"into":[44],"botnet,":[46],"probing":[47],"networks":[48],"enumeration":[50],"or":[51],"penetration,":[52],"etc.":[53],"We":[54,111],"present":[55],"measurement":[57],"analysis":[59],"a":[61,93,120,189],"horizontal":[62],"scan":[63,82],"entire":[66],"IPv4":[67],"address":[68],"space":[69],"conducted":[70],"by":[71,155,176],"Sality":[73,146],"botnet":[74,205],"in":[75,162],"February":[76],"last":[78],"year.":[79],"This":[80,186],"12-day":[81],"originated":[83],"from":[84],"approximately":[85],"3":[86],"million":[87],"distinct":[88],"IP":[89],"addresses,":[90],"heavily":[94],"coordinated":[95,179],"unusually":[97],"covert":[98],"scanning":[99,174,195],"strategy":[100],"try":[102],"discover":[104],"compromise":[106],"VoIP-related":[107],"(SIP":[108],"server)":[109],"infrastructure.":[110,185],"observed":[112],"this":[113,133],"event":[114],"through":[115],"UCSD":[117],"Network":[118],"Telescope,":[119],"/8":[121],"darknet":[122],"continuously":[123],"receiving":[124],"large":[125],"amounts":[126],"unsolicited":[128],"traffic,":[129],"we":[131],"correlate":[132],"traffic":[134],"data":[135,141],"with":[136],"other":[137],"public":[138],"sources":[139],"validate":[143],"our":[144],"inferences.":[145],"is":[147],"one":[148],"largest":[151],"botnets":[152],"ever":[153],"identified":[154],"researchers,":[156],"its":[157],"behavior":[158,206],"represents":[159],"ominous":[160],"advances":[161],"evolution":[164],"modern":[166],"malware:":[167],"use":[169],"more":[171],"sophisticated":[172],"stealth":[173],"strategies":[175],"millions":[177],"bots,":[180],"targeting":[181],"critical":[182],"voice":[183],"communications":[184],"work":[187],"offers":[188],"detailed":[190],"dissection":[191],"botnet's":[194],"behavior,":[196],"general":[198],"methods":[199],"correlate,":[201],"visualize,":[202],"extrapolate":[204],"across":[207],"global":[209],"Internet.":[210]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":5},{"year":2019,"cited_by_count":4},{"year":2018,"cited_by_count":4},{"year":2017,"cited_by_count":6},{"year":2016,"cited_by_count":12},{"year":2015,"cited_by_count":10},{"year":2014,"cited_by_count":13},{"year":2013,"cited_by_count":16},{"year":2012,"cited_by_count":1}],"updated_date":"2026-04-04T16:13:02.066488","created_date":"2025-10-10T00:00:00"}