Hidden and Under Control A Survey and Outlook on Covert Channel-internal Control Protocols
CoCoSpot: Clustering and recognizing botnet command and control channels using traffic analysis