<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-01518229</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-20T23:04:03+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Peer to Peer Botnet Detection Based on Flow Intervals</title>
            <author role="aut">
              <persName>
                <forename type="first">David</forename>
                <surname>Zhao</surname>
              </persName>
              <email type="md5">e36a749022744ed5727e0917e93056ae</email>
              <email type="domain">ieee.org</email>
              <idno type="idhal" notation="numeric">1007475</idno>
              <idno type="halauthorid" notation="string">1167119-1007475</idno>
              <affiliation ref="#struct-494229"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Issa</forename>
                <surname>Traore</surname>
              </persName>
              <email type="md5">56abfa0dd61c154396c29f6e314ed1bd</email>
              <email type="domain">ece.uvic.ca</email>
              <idno type="idhal" notation="numeric">1007476</idno>
              <idno type="halauthorid" notation="string">516072-1007476</idno>
              <affiliation ref="#struct-494229"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Ali</forename>
                <surname>Ghorbani</surname>
              </persName>
              <email type="md5">85757e079e02a705f84634b7d42e1985</email>
              <email type="domain">unb.ca</email>
              <idno type="idhal" notation="numeric">1007477</idno>
              <idno type="halauthorid" notation="string">990547-1007477</idno>
              <affiliation ref="#struct-110334"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Bassam</forename>
                <surname>Sayed</surname>
              </persName>
              <email type="md5">2c2559fdb8d79242f043368c773506ab</email>
              <email type="domain">ece.uvic.ca</email>
              <idno type="idhal" notation="numeric">1007478</idno>
              <idno type="halauthorid" notation="string">1167120-1007478</idno>
              <affiliation ref="#struct-494229"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Sherif</forename>
                <surname>Saad</surname>
              </persName>
              <email type="md5">f943be7e91e7a8a0fd7bad7e710f49f5</email>
              <email type="domain">ece.uvic.ca</email>
              <idno type="idhal" notation="numeric">1007479</idno>
              <idno type="halauthorid" notation="string">1167121-1007479</idno>
              <affiliation ref="#struct-494229"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Wei</forename>
                <surname>Lu</surname>
              </persName>
              <email type="md5">80567f92558fcf26fd0ea206715666a2</email>
              <email type="domain">keene.edu</email>
              <idno type="idhal" notation="numeric">1007480</idno>
              <idno type="halauthorid" notation="string">220017-1007480</idno>
              <affiliation ref="#struct-10668"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2017-05-04 13:45:25</date>
              <date type="whenModified">2021-10-19 11:51:00</date>
              <date type="whenReleased">2017-05-04 14:53:54</date>
              <date type="whenProduced">2012-06-12</date>
              <date type="whenEndEmbargoed">2015-01-01</date>
              <ref type="file" target="https://inria.hal.science/hal-01518229v1/document">
                <date notBefore="2015-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://inria.hal.science/hal-01518229v1/file/978-3-642-30436-1_8_Chapter.pdf" id="file-1518229-1579109">
                <date notBefore="2015-01-01"/>
              </ref>
              <ref type="externalLink" target="https://link.springer.com/content/pdf/10.1007%2F978-3-642-30436-1_8.pdf"/>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-01518229</idno>
            <idno type="halUri">https://inria.hal.science/hal-01518229</idno>
            <idno type="halBibtex">zhao:hal-01518229</idno>
            <idno type="halRefHtml">&lt;i&gt;27th Information Security and Privacy Conference (SEC)&lt;/i&gt;, Jun 2012, Heraklion, Crete, Greece. pp.87-102, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-642-30436-1_8"&gt;&amp;#x27E8;10.1007/978-3-642-30436-1_8&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">27th Information Security and Privacy Conference (SEC), Jun 2012, Heraklion, Crete, Greece. pp.87-102, &amp;#x27E8;10.1007/978-3-642-30436-1_8&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-1518229-1579109"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-AICT" corresp="IFIP">IFIP Advances in Information and Communication Technology</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-TC11" corresp="IFIP-TC">IFIP TC11: Security and Privacy Protection in Information Processing Systems</idno>
            <idno type="stamp" n="IFIP-SEC" corresp="IFIP"> International Information Security Conference</idno>
            <idno type="stamp" n="IFIP-AICT-376" corresp="IFIP-AICT">Information Security and Privacy Research</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 2: Security Architectures</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Peer to Peer Botnet Detection Based on Flow Intervals</title>
                <author role="aut">
                  <persName>
                    <forename type="first">David</forename>
                    <surname>Zhao</surname>
                  </persName>
                  <email type="md5">e36a749022744ed5727e0917e93056ae</email>
                  <email type="domain">ieee.org</email>
                  <idno type="idhal" notation="numeric">1007475</idno>
                  <idno type="halauthorid" notation="string">1167119-1007475</idno>
                  <affiliation ref="#struct-494229"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Issa</forename>
                    <surname>Traore</surname>
                  </persName>
                  <email type="md5">56abfa0dd61c154396c29f6e314ed1bd</email>
                  <email type="domain">ece.uvic.ca</email>
                  <idno type="idhal" notation="numeric">1007476</idno>
                  <idno type="halauthorid" notation="string">516072-1007476</idno>
                  <affiliation ref="#struct-494229"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Ali</forename>
                    <surname>Ghorbani</surname>
                  </persName>
                  <email type="md5">85757e079e02a705f84634b7d42e1985</email>
                  <email type="domain">unb.ca</email>
                  <idno type="idhal" notation="numeric">1007477</idno>
                  <idno type="halauthorid" notation="string">990547-1007477</idno>
                  <affiliation ref="#struct-110334"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Bassam</forename>
                    <surname>Sayed</surname>
                  </persName>
                  <email type="md5">2c2559fdb8d79242f043368c773506ab</email>
                  <email type="domain">ece.uvic.ca</email>
                  <idno type="idhal" notation="numeric">1007478</idno>
                  <idno type="halauthorid" notation="string">1167120-1007478</idno>
                  <affiliation ref="#struct-494229"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Sherif</forename>
                    <surname>Saad</surname>
                  </persName>
                  <email type="md5">f943be7e91e7a8a0fd7bad7e710f49f5</email>
                  <email type="domain">ece.uvic.ca</email>
                  <idno type="idhal" notation="numeric">1007479</idno>
                  <idno type="halauthorid" notation="string">1167121-1007479</idno>
                  <affiliation ref="#struct-494229"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Wei</forename>
                    <surname>Lu</surname>
                  </persName>
                  <email type="md5">80567f92558fcf26fd0ea206715666a2</email>
                  <email type="domain">keene.edu</email>
                  <idno type="idhal" notation="numeric">1007480</idno>
                  <idno type="halauthorid" notation="string">220017-1007480</idno>
                  <affiliation ref="#struct-10668"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">IFIP Advances in Information and Communication Technology</title>
                <meeting>
                  <title>27th Information Security and Privacy Conference (SEC)</title>
                  <date type="start">2012-06-12</date>
                  <date type="end">2012-06-06</date>
                  <settlement>Heraklion, Crete</settlement>
                  <country key="GR">Greece</country>
                </meeting>
                <editor>Dimitris Gritzalis</editor>
                <editor>Steven Furnell</editor>
                <editor>Marianthi Theoharidou</editor>
                <imprint>
                  <publisher>Springer</publisher>
                  <biblScope unit="serie">Information Security and Privacy Research</biblScope>
                  <biblScope unit="volume">AICT-376</biblScope>
                  <biblScope unit="pp">87-102</biblScope>
                  <date type="datePub">2012</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-642-30436-1_8</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <keywords scheme="author">
                <term xml:lang="en">Network Flows</term>
                <term xml:lang="en">Traffic Behavior Analysis</term>
                <term xml:lang="en">Network Intrusion Detection</term>
                <term xml:lang="en">Botnet</term>
              </keywords>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Botnets are becoming the predominant threat on the Internet today and is the primary vector for carrying out attacks against organizations and individuals. Botnets have been used in a variety of cybercrime, from click-fraud to DDOS attacks to the generation of spam. In this paper we propose an approach to detect botnet activity by classifying network traffic behavior using machine learning classification techniques. We study the feasibility of detecting botnet activity without having seen a complete network flow by classifying behavior based on time intervals and we examine the performance of two popular classification techniques with respect to this data. Using existing datasets, we show experimentally that it is possible to identify the presence of botnet activity with high accuracy even with very small time windows, though there are some limitations to the approach based on the selection of attributes.</p>
            </abstract>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="department" xml:id="struct-494229" status="VALID">
          <orgName>Electrical and Computer Engineering [University of Victoria]</orgName>
          <date type="start">2017-05-04</date>
          <desc>
            <address>
              <addrLine>Electrical and Computer EngineeringUniversity of VictoriaEngineering Office Wing, Room 4483800 Finnerty RoadVictoria BC  V8P 5C2 Canada</addrLine>
              <country key="CA"/>
            </address>
            <ref type="url">https://www.uvic.ca/engineering/ece/</ref>
          </desc>
          <listRelation>
            <relation active="#struct-15325" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-110334" status="VALID">
          <idno type="ROR">https://ror.org/05nkf0n29</idno>
          <orgName>University of New Brunswick</orgName>
          <orgName type="acronym">UNB</orgName>
          <desc>
            <address>
              <addrLine>UNB Fredericton P.O. Box 4400 Fredericton, New Brunswick, Canada E3B 5A3 -  UNB Saint John 100 Tucker Park Road P.O. Box 5050 Saint John, New Brunswick, Canada E2L 4L5</addrLine>
              <country key="CA"/>
            </address>
            <ref type="url">http://www.unb.ca/</ref>
          </desc>
        </org>
        <org type="laboratory" xml:id="struct-10668" status="INCOMING">
          <orgName>Keene State College</orgName>
          <orgName type="acronym">KEENE STATE COLLEGE</orgName>
          <desc>
            <address>
              <country key="US"/>
            </address>
          </desc>
          <listRelation>
            <relation active="#struct-547136" type="direct"/>
          </listRelation>
        </org>
        <org type="institution" xml:id="struct-15325" status="VALID">
          <orgName>University of Victoria [Canada]</orgName>
          <orgName type="acronym">UVIC</orgName>
          <desc>
            <address>
              <addrLine>University of Victoria3800 Finnerty RoadVictoria BC  V8P 5C2Canada</addrLine>
              <country key="CA"/>
            </address>
            <ref type="url">http://www.uvic.ca</ref>
          </desc>
        </org>
        <org type="institution" xml:id="struct-547136" status="VALID">
          <idno type="ISNI">0000 0000 9053 6271</idno>
          <idno type="ROR">https://ror.org/04c1gbz02</idno>
          <orgName>Keene State College</orgName>
          <desc>
            <address>
              <addrLine>229 Main St, Keene, NH 03435, États-Unis</addrLine>
              <country key="US"/>
            </address>
            <ref type="url">https://www.keene.edu/</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>