Abstract
Translating behavioral information learned from analysis of a botnet’s software in controlled environments, to a model of how the botnet behaves in the wild is complicated by the fact that controlled environments do not account for a wide variety of user behavior, and that machines are not associated one-to-one with IP addresses. This paper presents a case study using published reports and pertinent visualizations to develop and evaluate a single-machine model of scanning behavior of the Conficker-C botnet, with a goal of understanding the global population of infected machines in light of user activity and IP address allocation.
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callMore From: IEEE Transactions on Information Forensics and Security
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
