Profiling Attacker Behavior Following SSH Compromises. - Daniel Ramsbrock; Robin Berthier; Michel Cukier (DSN, 2007)

A First Step towards Live Botmaster Traceback. - Daniel Ramsbrock; Xinyuan Wang 005; Xuxian Jiang (RAID, 2008)