Detecting mass-mailing worm infected hosts by mining DNS traffic data. - Keisuke Ishibashi; Tsuyoshi Toyono; Katsuyasu Toyama; Masahiro Ishino; Haruhiko Ohshima; Ichiro Mizukoshi (MineNet, 2005)