{"id":"https://openalex.org/W612891670","doi":null,"title":"DNS Traffic Analysis for Network-based Malware Detection","display_name":"DNS Traffic Analysis for Network-based Malware Detection","publication_year":2012,"publication_date":"2012-01-01","ids":{"openalex":"https://openalex.org/W612891670","mag":"612891670"},"language":"en","primary_location":{"id":"pmh:oai:CiteSeerX.psu:10.1.1.713.6607","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.713.6607","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://people.kth.se/%7Emaguire/.c/DEGREE-PROJECT-REPORTS/120416-Linh_Vu_Hong-with-color-cover.pdf","raw_type":"text"},"volume":null,"type":"article","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5018834704","display_name":"Linh Vu Hong","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":true,"raw_author_name":"Linh Vu Hong","raw_affiliation_strings":["Royal Inst. of Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Royal Inst. of Technology","institution_ids":["https://openalex.org/I86987016"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5018834704"],"corresponding_institution_ids":["https://openalex.org/I86987016"],"apc_list":null,"apc_paid":null,"fwci":0.4069,"has_fulltext":false,"cited_by_count":10,"citation_normalized_percentile":{"value":0.66208868,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":88,"max":97},"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.6327999830245972,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.6327999830245972,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.26809999346733093,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.03750000149011612,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnets","display_name":"botnets","score":0.9399999976158142},{"id":"https://openalex.org/keywords/malware-detection","display_name":"malware detection","score":0.7680000066757202},{"id":"https://openalex.org/keywords/dns-traffic-analysis","display_name":"DNS traffic analysis","score":0.7789999842643738},{"id":"https://openalex.org/keywords/fast-flux","display_name":"fast flux","score":0.9760000109672546},{"id":"https://openalex.org/keywords/network-intrusion-detection","display_name":"network intrusion detection","score":0.6620000004768372}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.9847514629364014},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7139357328414917},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6674695014953613},{"id":"https://openalex.org/C35026560","wikidata":"https://www.wikidata.org/wiki/Q8767","display_name":"Domain Name System","level":3,"score":0.6165476441383362},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6000931262969971},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.5725880861282349},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5626630187034607},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.5277355909347534},{"id":"https://openalex.org/C2779797433","wikidata":"https://www.wikidata.org/wiki/Q632959","display_name":"Blacklisting","level":2,"score":0.4696843922138214},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.4509255290031433},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.42884624004364014},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.4189678132534027},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.10601422190666199},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C8891405","wikidata":"https://www.wikidata.org/wiki/Q1059","display_name":"Immune system","level":2,"score":0.0},{"id":"https://openalex.org/C203014093","wikidata":"https://www.wikidata.org/wiki/Q101929","display_name":"Immunology","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:CiteSeerX.psu:10.1.1.713.6607","doi":null,"is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.713.6607","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://people.kth.se/%7Emaguire/.c/DEGREE-PROJECT-REPORTS/120416-Linh_Vu_Hong-with-color-cover.pdf","raw_type":"text"},{"id":"mag:612891670","doi":null,"is_oa":false,"landing_page_url":"http://people.kth.se/~maguire/DEGREE-PROJECT-REPORTS/120416-Linh_Vu_Hong-with-color-cover.pdf","pdf_url":null,"source":null,"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":null}],"best_oa_location":null,"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":40,"referenced_works":["https://openalex.org/W80155331","https://openalex.org/W118339654","https://openalex.org/W143162329","https://openalex.org/W155384935","https://openalex.org/W1533403794","https://openalex.org/W1551705282","https://openalex.org/W1565377632","https://openalex.org/W1642070211","https://openalex.org/W1820098372","https://openalex.org/W1828150029","https://openalex.org/W1842847600","https://openalex.org/W1954903228","https://openalex.org/W1962340579","https://openalex.org/W1990497396","https://openalex.org/W2005813008","https://openalex.org/W2015583498","https://openalex.org/W2019564823","https://openalex.org/W2030382024","https://openalex.org/W2043545458","https://openalex.org/W2078021840","https://openalex.org/W2081642714","https://openalex.org/W2091692346","https://openalex.org/W2101737524","https://openalex.org/W2102283838","https://openalex.org/W2111427271","https://openalex.org/W2114092087","https://openalex.org/W2124890708","https://openalex.org/W2131697133","https://openalex.org/W2136495567","https://openalex.org/W2137967437","https://openalex.org/W2141786660","https://openalex.org/W2146729596","https://openalex.org/W2149701633","https://openalex.org/W2152955531","https://openalex.org/W2159636195","https://openalex.org/W2272023646","https://openalex.org/W2401054255","https://openalex.org/W2678934292","https://openalex.org/W2913277331","https://openalex.org/W2913730761"],"related_works":["https://openalex.org/W2760320879","https://openalex.org/W4295539566","https://openalex.org/W2946033004","https://openalex.org/W2191989567","https://openalex.org/W2503874974","https://openalex.org/W2805248751","https://openalex.org/W2767468186","https://openalex.org/W2410828832","https://openalex.org/W2019862794","https://openalex.org/W2977644007"],"abstract_inverted_index":{"(English)":[0],"Botnets":[1,16],"are":[2,38,45,115,143],"generally":[3],"recognized":[4],"as":[5,113],"one":[6],"of":[7,68,71,75,80,105,128],"the":[8,13,56,66,72,78,81,103,123,134,146],"most":[9],"challenging":[10],"threats":[11],"on":[12],"Internet":[14],"today.":[15],"have":[17],"been":[18],"involved":[19],"in":[20,77],"many":[21],"attacks":[22],"targeting":[23],"multi-national":[24],"organizations":[25],"and":[26,35,91,109,125],"even":[27],"nationwide":[28],"internet":[29],"services.":[30],"As":[31],"more":[32],"effective":[33],"detection":[34],"mitigation":[36],"approaches":[37],"proposed":[39],"by":[40,63,131,145],"security":[41],"researchers,":[42],"botnet":[43,106,129],"developers":[44],"employing":[46],"new":[47],"techniques":[48,118],"for":[49,65],"evasion.":[50],"It":[51],"is":[52,61],"not":[53],"surprising":[54],"that":[55,142],"Domain":[57],"Name":[58],"System":[59],"(DNS)":[60],"abused":[62],"botnets":[64,95],"purposes":[67],"evasion,":[69],"because":[70],"important":[73],"role":[74],"DNS":[76,83,154],"operation":[79],"Internet.":[82],"provides":[84],"a":[85],"flexible":[86],"mapping":[87,100],"between":[88],"domain":[89,135],"names":[90,136],"IP":[92,140],"addresses,":[93],"thus":[94],"can":[96],"exploit":[97],"this":[98,149],"dynamic":[99],"to":[101,156],"mask":[102],"location":[104],"controllers.":[107],"Domain-flux":[108],"fast-flux":[110],"(also":[111],"known":[112],"IP-flux)":[114],"two":[116],"emerging":[117],"which":[119],"aim":[120],"at":[121],"exhausting":[122],"tracking":[124],"blacklisting":[126],"effort":[127],"defenders":[130],"rapidly":[132],"changing":[133],"or":[137],"their":[138],"associated":[139],"addresses":[141],"used":[144],"botnet.":[147],"In":[148],"thesis,":[150],"we":[151],"employ":[152],"passive":[153],"analysis":[155],"develop":[157]},"counts_by_year":[{"year":2022,"cited_by_count":1},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":3},{"year":2018,"cited_by_count":4},{"year":2013,"cited_by_count":1}],"updated_date":"2026-09-10T07:47:47.112893","created_date":"2016-06-24T00:00:00"}