@conference {19505,
	title = {The Provenance of WINE},
	booktitle = {Dependable Computing Conference (EDCC), 2012 Ninth European},
	year = {2012},
	month = {2012///},
	pages = {126 - 131},
	abstract = {The results of cyber security experiments are often impossible to reproduce, owing to the lack of adequate descriptions of the data collection and experimental processes. Such provenance information is difficult to record consistently when collecting data from distributed sensors and when sharing raw data among research groups with variable standards for documenting the steps that produce the final experimental result. In the WINE benchmark, which provides field data for cyber security experiments, we aim to make the experimental process self-documenting. The data collected includes provenance information {\textendash} such as when, where and how an attack was first observed or detected {\textendash} and allows researchers to gauge information quality. Experiments are conducted on a common test bed, which provides tools for recording each procedural step. The ability to understand the provenance of research results enables rigorous cyber security experiments, conducted at scale.},
	keywords = {Benchmark testing, CYBER SECURITY, cyber security experiments, data attacks, data collection, dependability benchmarking, distributed databases, distributed sensors, experimental research, field data, information quality, MALWARE, Pipelines, provenance, provenance information, raw data sharing, research groups, security of data, self-documenting experimental process, sensor fusion, software, variable standards, WINE, WINE benchmark},
	author = {Tudor Dumitras and Efstathopoulos, P.}
}
@article {18558,
	title = {Countering Botnets: Anomaly-Based Detection, Comprehensive Analysis, and Efficient Mitigation},
	year = {2011},
	month = {2011/05//},
	institution = {GEORGIA TECH RESEARCH CORP ATLANTA},
	abstract = {We cover five general areas: (1) botnet detection, (2) botnet analysis, (3) botnet mitigation, (4) add-on tasks to the original contract, including the Conficker Working Group Lessons Learned, Layer-8 Exploration of Botnet Organization, and DREN research, and (5) commercialization in this paper. We have successfully developed new botnet detection and analysis capabilities in this project. These algorithms have been evaluated using real-world data, and have been put into actual, deployed systems. The most significant technical developments include a new dynamic reputation systems for DNS domains, a scalable anomaly detection system for botnet detection in very large network, and a transparent malware analysis system. In addition, on several occasions we have used our botnet data and analysis to help law enforcement agencies arrest botmasters. We also have had great success transitioning technologies to commercial products that are now used by government agencies, ISPs, and major corporations.},
	keywords = {*ELECTRONIC SECURITY, *INFORMATION SECURITY, *INTERNET, *INTRUSION DETECTION(COMPUTERS), algorithms, BGP ROUTE INJECTION, BGP(BORDER GATEWAY PROTOCOLS), BOTNET DETECTION, BOTNET TRACEBACK AND ATTRIBUTION, BOTNETS(MALWARE), CLIENT SERVER SYSTEMS, COMMUNICATIONS PROTOCOLS, COMPUTER PROGRAMMING AND SOFTWARE, COMPUTER SYSTEMS MANAGEMENT AND STANDARDS, CYBER ATTACKS, CYBER SECURITY, CYBERNETICS, CYBERTERRORISM, CYBERWARFARE, DATA PROCESSING SECURITY, DNS BASED MONITORING, DNS BASED REDIRECTION, DNS(DOMAIN NAME SYSTEMS), INFORMATION SCIENCE, INTERNET BROWSERS, ISP(INTERNET SERVICE PROVIDERS), MALWARE, MALWARE ANALYSIS, Online Systems, WUAFRLDHS1BOTN},
	url = {http://stinet.dtic.mil/oai/oai?\&verb=getRecord\&metadataPrefix=html\&identifier=ADA543919},
	author = {Lee,Wenke and Dagon,David and Giffin,Jon and Feamster, Nick and Ollman,Gunter and Westby,Jody and Wesson,Rick and Vixie,Paul}
}
