{"id":"https://openalex.org/W2121008990","doi":"https://doi.org/10.1145/2554850.2554896","title":"Extracting probable command and control signatures for detecting botnets","display_name":"Extracting probable command and control signatures for detecting botnets","publication_year":2014,"publication_date":"2014-03-24","ids":{"openalex":"https://openalex.org/W2121008990","doi":"https://doi.org/10.1145/2554850.2554896","mag":"2121008990"},"language":"en","primary_location":{"id":"doi:10.1145/2554850.2554896","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2554850.2554896","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 29th Annual ACM Symposium on Applied Computing","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5004384498","display_name":"Ali Zand","orcid":"https://orcid.org/0000-0002-9095-0493"},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ali Zand","raw_affiliation_strings":["University of California, Santa Barbara","University of California,Santa Barbara,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Santa Barbara","institution_ids":["https://openalex.org/I154570441"]},{"raw_affiliation_string":"University of California,Santa Barbara,","institution_ids":["https://openalex.org/I154570441"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075685499","display_name":"Giovanni Vigna","orcid":"https://orcid.org/0000-0002-3422-5369"},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Giovanni Vigna","raw_affiliation_strings":["University of California, Santa Barbara","University of California,Santa Barbara,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Santa Barbara","institution_ids":["https://openalex.org/I154570441"]},{"raw_affiliation_string":"University of California,Santa Barbara,","institution_ids":["https://openalex.org/I154570441"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047709762","display_name":"Xifeng Yan","orcid":"https://orcid.org/0009-0000-6508-4792"},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xifeng Yan","raw_affiliation_strings":["University of California, Santa Barbara","University of California,Santa Barbara,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Santa Barbara","institution_ids":["https://openalex.org/I154570441"]},{"raw_affiliation_string":"University of California,Santa Barbara,","institution_ids":["https://openalex.org/I154570441"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5022177364","display_name":"Christopher Kruegel","orcid":"https://orcid.org/0000-0001-5140-3414"},"institutions":[{"id":"https://openalex.org/I154570441","display_name":"University of California, Santa Barbara","ror":"https://ror.org/02t274463","country_code":"US","type":"education","lineage":["https://openalex.org/I154570441"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Christopher Kruegel","raw_affiliation_strings":["University of California, Santa Barbara","University of California,Santa Barbara,"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Santa Barbara","institution_ids":["https://openalex.org/I154570441"]},{"raw_affiliation_string":"University of California,Santa Barbara,","institution_ids":["https://openalex.org/I154570441"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I154570441"],"apc_list":null,"apc_paid":null,"fwci":4.4151,"has_fulltext":false,"cited_by_count":30,"citation_normalized_percentile":{"value":0.95988348,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"1657","last_page":"1662"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9988999962806702,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.9861099720001221},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.7434540390968323},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7223260402679443},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.7164902687072754},{"id":"https://openalex.org/keywords/command-and-control","display_name":"Command and control","score":0.7033051252365112},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.5607575178146362},{"id":"https://openalex.org/keywords/block","display_name":"Block (permutation group theory)","score":0.5460110902786255},{"id":"https://openalex.org/keywords/blocking","display_name":"Blocking (statistics)","score":0.5073294043540955},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.4964953064918518},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.43641772866249084},{"id":"https://openalex.org/keywords/file-server","display_name":"File server","score":0.41742756962776184},{"id":"https://openalex.org/keywords/ransomware","display_name":"Ransomware","score":0.41171061992645264},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.23382660746574402},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.2050122320652008}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.9861099720001221},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.7434540390968323},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7223260402679443},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7164902687072754},{"id":"https://openalex.org/C506615639","wikidata":"https://www.wikidata.org/wiki/Q21662260","display_name":"Command and control","level":2,"score":0.7033051252365112},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.5607575178146362},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.5460110902786255},{"id":"https://openalex.org/C144745244","wikidata":"https://www.wikidata.org/wiki/Q4927286","display_name":"Blocking (statistics)","level":2,"score":0.5073294043540955},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.4964953064918518},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.43641772866249084},{"id":"https://openalex.org/C4373008","wikidata":"https://www.wikidata.org/wiki/Q513349","display_name":"File server","level":2,"score":0.41742756962776184},{"id":"https://openalex.org/C2777667771","wikidata":"https://www.wikidata.org/wiki/Q926331","display_name":"Ransomware","level":3,"score":0.41171061992645264},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.23382660746574402},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.2050122320652008},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.0},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/2554850.2554896","is_oa":false,"landing_page_url":"https://doi.org/10.1145/2554850.2554896","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 29th Annual ACM Symposium on Applied Computing","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.7200000286102295,"display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G1773651856","display_name":null,"funder_award_id":"W911NF0910553","funder_id":"https://openalex.org/F4320338281","funder_display_name":"Army Research Office"},{"id":"https://openalex.org/G7146038114","display_name":null,"funder_award_id":"N000140911042","funder_id":"https://openalex.org/F4320337345","funder_display_name":"Office of Naval Research"},{"id":"https://openalex.org/G848288575","display_name":null,"funder_award_id":"CNS-0845559CNS-0905537","funder_id":"https://openalex.org/F4320337388","funder_display_name":"Division of Computer and Network Systems"}],"funders":[{"id":"https://openalex.org/F4320337345","display_name":"Office of Naval Research","ror":"https://ror.org/00rk2pe57"},{"id":"https://openalex.org/F4320337388","display_name":"Division of Computer and Network Systems","ror":"https://ror.org/02rdzmk74"},{"id":"https://openalex.org/F4320338281","display_name":"Army Research Office","ror":"https://ror.org/05epdh915"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":30,"referenced_works":["https://openalex.org/W88694106","https://openalex.org/W191098608","https://openalex.org/W1496462336","https://openalex.org/W1503224444","https://openalex.org/W1546505347","https://openalex.org/W1583098994","https://openalex.org/W1597305440","https://openalex.org/W1670263352","https://openalex.org/W1775772884","https://openalex.org/W1827212170","https://openalex.org/W1916198581","https://openalex.org/W1922851884","https://openalex.org/W1970433198","https://openalex.org/W1988741337","https://openalex.org/W2033811087","https://openalex.org/W2044285442","https://openalex.org/W2054425625","https://openalex.org/W2059513841","https://openalex.org/W2061455058","https://openalex.org/W2097234334","https://openalex.org/W2100307718","https://openalex.org/W2100958137","https://openalex.org/W2102262986","https://openalex.org/W2114996745","https://openalex.org/W2137786570","https://openalex.org/W2145959654","https://openalex.org/W2150045644","https://openalex.org/W4210736171","https://openalex.org/W4243744905","https://openalex.org/W6738852829"],"related_works":["https://openalex.org/W2929621094","https://openalex.org/W1996006176","https://openalex.org/W4285325964","https://openalex.org/W3214090987","https://openalex.org/W2898126008","https://openalex.org/W86804927","https://openalex.org/W1583098994","https://openalex.org/W2386447999","https://openalex.org/W2130216882","https://openalex.org/W2091214382"],"abstract_inverted_index":{"Botnets,":[0],"which":[1],"are":[2,15],"networks":[3],"of":[4,10,67],"compromised":[5],"machines":[6],"under":[7],"the":[8,58,65,95,110],"control":[9,52],"a":[11,16,32,68,87],"single":[12,33],"malicious":[13],"entity,":[14],"serious":[17],"threat":[18],"to":[19,38,78,84,107],"online":[20],"security.":[21],"The":[22],"fact":[23],"that":[24,47,60,82],"botnets,":[25],"by":[26,104],"definition,":[27],"receive":[28],"their":[29],"commands":[30],"from":[31],"entity":[34],"can":[35,48,74,100],"be":[36,102],"leveraged":[37],"fight":[39],"them.":[40],"To":[41],"this":[42,76],"end,":[43],"one":[44,73],"requires":[45],"techniques":[46],"detect":[49,79],"command":[50],"and":[51,89],"(C&C)":[53],"traffic,":[54],"as":[55,57],"well":[56],"servers":[59],"host":[61],"C&C":[62,69,111],"services.":[63],"Given":[64],"knowledge":[66],"server's":[70],"IP":[71],"address,":[72],"use":[75],"information":[77,99],"all":[80],"hosts":[81],"attempt":[83],"contact":[85],"such":[86],"server,":[88],"subsequently":[90],"disinfect,":[91],"disable,":[92],"or":[93],"block":[94],"infected":[96],"machines.":[97],"This":[98],"also":[101],"used":[103],"law":[105],"enforcement":[106],"take":[108],"down":[109],"server.":[112]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":3},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":6},{"year":2018,"cited_by_count":2},{"year":2017,"cited_by_count":7},{"year":2016,"cited_by_count":3},{"year":2015,"cited_by_count":5},{"year":2014,"cited_by_count":1}],"updated_date":"2026-08-01T09:00:35.917206","created_date":"2025-10-10T00:00:00"}