A number of detection and defense mechanisms have emerged in the last decade to tackle
the botnet phenomenon. It is important to organize this knowledge to better understand the …

Deep packet inspection (DPI) is widely used in content-aware network applications such as
network intrusion detection systems, traffic billing, load balancing, and government …

Networks today rely on middleboxes to provide critical performance, security, and policy
compliance capabilities. Achieving these benefits and ensuring that the traffic is directed …

Deep neural networks (DNNs) are commonly used for various traffic analysis problems, such
as website fingerprinting and flow correlation, as they outperform traditional (eg, statistical) …

Flow correlation is the core technique used in a multitude of deanonymization attacks on
Tor. Despite the importance of flow correlation attacks on Tor, existing flow correlation …

A method and system of detecting a malicious and/or botnet-related domain name,
comprising: reviewing a domain name used in Domain Name System (DNS) traffic in a …

SSH is designed to provide a secure channel between two hosts. Despite the encryption
and authentication mechanisms it uses, SSH has two weakness: First, the transmitted …

Tor is the second generation onion router supporting the anonymous transport of TCP
streams over the Internet. Its low latency makes it very suitable for common tasks, such as …

Many interesting large-scale systems are distributed systems of multiple communicating
components. Such systems can be very hard to debug, especially when they exhibit poor …

A system and method for detecting a first network of compromised computers in a second
network of computers, comprising: collecting Domain Name System (DNS) data for the …