Identifying botnet IP address clusters using natural language processing techniques on honeypot command logs

Built on

Some methods for classification and analysis of multivariate observations
James MacQueen · 1967
Earlier work this paper cites.
Latent Dirichlet allocation
David M. Blei, Andrew Y. Ng, Michael I. Jordan, and John Lafferty · 2003
Earlier work this paper cites.
Variational inference for Dirichlet process mixtures
David M. Blei and Michael I. Jordan · 2005
Earlier work this paper cites.
The Secure Shell (SSH) Protocol Assigned Numbers
S. Lehtinen and C. Lonvick · 2006
Earlier work this paper cites.
A taxonomy of botnet structures
D. Dagon, G. Gu, C. Lee, and W. Lee · 2007
Earlier work this paper cites.

Virtual Honeypots: From Botnet Tracking to Intrusion Detection
N. Provos and T. Holz · 2007
Cited alongside, same era.
Your botnet is my botnet: analysis of a botnet takeover
Brett Stone-Gross, Marco Cova, Lorenzo Cavallaro, Bob Gilbert, Martin Szydlowski, Richard Allen Kemmerer, Christopher Kruegel, and Giovanni Vigna · 2009
Cited alongside, same era.
Neural word embedding as implicit matrix factorization
Omer Levy and Yoav Goldberg · 2014
Cited alongside, same era.
Unsupervised deep embedding for clustering analysis
Junyuan Xie, Ross Girshick, and Ali Farhadi · 2016
Cited alongside, same era.

Temporal patterns in bot activities
Nikan Chavoshi, Hossein Hamooni, and Abdullah Mueen · 2017
Later among the works it cites.
Deep clustering with convolutional autoencoders
Xifeng Guo, Xinwang Liu, En Zhu, and Jianping Yin · 2017
Later among the works it cites.
Deep temporal clustering: Fully unsupervised learning of time-domain features
Original
Naveen Sai Madiraju, Seid M. Sadat, Dimitry Fisher, and Homa Karimabadi · 2018
Later among the works it cites.
Learning invariant representations of social media users
Original
Nicholas Andrews and Marcus Bishop · 2019
Later among the works it cites.