使用最小图映射查找僵尸网络
Finding Botnets Using Minimal Graph Clusterings
摘要：
我们研究的问题，确定僵尸网络和IP地址，它们包括，基于观察的一部分，全球电子邮件垃圾邮件流量。观察到的邮件活动构成了联合僵尸网络成员的证据，它们在所有消息的图中由集团表示。没有证据表明节点之间存在关联。我们减少了识别僵尸网络的问题，找到一个最小的集群的消息图的问题。我们直接对给定输入图的聚类分布进行建模;这避免了生成模型的分布假设引起的潜在错误。我们报告的案例研究中，我们评估模型的能力，以预测垃圾邮件活动，一个给定的IP地址将参与。
英文摘要：
We study the problem of identifying botnets and the IP addresses which they comprise, based on the observation of a fraction of the global email spam traffic. Observed mailing campaigns constitute evidence for joint botnet membership, they are represented by cliques in the graph of all messages. No evidence against an association of nodes is ever available. We reduce the problem of identifying botnets to a problem of finding a minimal clustering of the graph of messages. We directly model the distribution of clusterings given the input graph; this avoids potential errors caused by distributional assumptions of a generative model. We report on a case study in which we evaluate the model by its ability to predict the spam campaign that a given IP address is going to participate in.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
