{"id":"https://openalex.org/W2975453956","doi":"https://doi.org/10.1109/access.2019.2944203","title":"A Cause-Based Classification Approach for Malicious DNS Queries Detected Through Blacklists","display_name":"A Cause-Based Classification Approach for Malicious DNS Queries Detected Through Blacklists","publication_year":2019,"publication_date":"2019-01-01","ids":{"openalex":"https://openalex.org/W2975453956","doi":"https://doi.org/10.1109/access.2019.2944203","mag":"2975453956"},"language":"en","primary_location":{"id":"doi:10.1109/access.2019.2944203","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2019.2944203","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8600701/08851066.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/8600701/08851066.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5091256957","display_name":"Akihiro Satoh","orcid":"https://orcid.org/0000-0003-3178-1041"},"institutions":[{"id":"https://openalex.org/I207014233","display_name":"Kyushu Institute of Technology","ror":"https://ror.org/02278tr80","country_code":"JP","type":"education","lineage":["https://openalex.org/I207014233"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Akihiro Satoh","raw_affiliation_strings":["Kyushu Institute of Technology, Kitakyushu, Japan"],"raw_orcid":"https://orcid.org/0000-0003-3178-1041","affiliations":[{"raw_affiliation_string":"Kyushu Institute of Technology, Kitakyushu, Japan","institution_ids":["https://openalex.org/I207014233"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101476276","display_name":"Yutaka Nakamura","orcid":"https://orcid.org/0000-0003-1832-5412"},"institutions":[{"id":"https://openalex.org/I207014233","display_name":"Kyushu Institute of Technology","ror":"https://ror.org/02278tr80","country_code":"JP","type":"education","lineage":["https://openalex.org/I207014233"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Yutaka Nakamura","raw_affiliation_strings":["Kyushu Institute of Technology, Kitakyushu, Japan"],"raw_orcid":"https://orcid.org/0000-0003-1832-5412","affiliations":[{"raw_affiliation_string":"Kyushu Institute of Technology, Kitakyushu, Japan","institution_ids":["https://openalex.org/I207014233"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089365212","display_name":"Yutaka Fukuda","orcid":"https://orcid.org/0000-0003-0430-0871"},"institutions":[{"id":"https://openalex.org/I207014233","display_name":"Kyushu Institute of Technology","ror":"https://ror.org/02278tr80","country_code":"JP","type":"education","lineage":["https://openalex.org/I207014233"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Yutaka Fukuda","raw_affiliation_strings":["Kyushu Institute of Technology, Kitakyushu, Japan"],"raw_orcid":"https://orcid.org/0000-0003-0430-0871","affiliations":[{"raw_affiliation_string":"Kyushu Institute of Technology, Kitakyushu, Japan","institution_ids":["https://openalex.org/I207014233"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5040051366","display_name":"Kazuto Sasai","orcid":"https://orcid.org/0000-0002-8920-5875"},"institutions":[{"id":"https://openalex.org/I6178835","display_name":"Ibaraki University","ror":"https://ror.org/00sjd5653","country_code":"JP","type":"education","lineage":["https://openalex.org/I6178835"]},{"id":"https://openalex.org/I65143321","display_name":"Hitachi (Japan)","ror":"https://ror.org/02exqgm79","country_code":"JP","type":"company","lineage":["https://openalex.org/I65143321"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Kazuto Sasai","raw_affiliation_strings":["Graduate School of Science and Engineering, Ibaraki University, Hitachi, Japan"],"raw_orcid":"https://orcid.org/0000-0002-8920-5875","affiliations":[{"raw_affiliation_string":"Graduate School of Science and Engineering, Ibaraki University, Hitachi, Japan","institution_ids":["https://openalex.org/I6178835","https://openalex.org/I65143321"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5113796636","display_name":"Gen Kitagata","orcid":null},"institutions":[{"id":"https://openalex.org/I201537933","display_name":"Tohoku University","ror":"https://ror.org/01dq60k83","country_code":"JP","type":"education","lineage":["https://openalex.org/I201537933"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Gen Kitagata","raw_affiliation_strings":["Research Institute of Electrical Communication, Tohoku University, Sendai, Japan"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Research Institute of Electrical Communication, Tohoku University, Sendai, Japan","institution_ids":["https://openalex.org/I201537933"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":1.9548,"has_fulltext":true,"cited_by_count":15,"citation_normalized_percentile":{"value":0.87765529,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":98},"biblio":{"volume":"7","issue":null,"first_page":"142991","last_page":"143001"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/blacklist","display_name":"Blacklist","score":0.984154999256134},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8615860939025879},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.7778191566467285},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6367456316947937},{"id":"https://openalex.org/keywords/scope","display_name":"Scope (computer science)","score":0.4655419588088989},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.40182143449783325},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.35351234674453735}],"concepts":[{"id":"https://openalex.org/C2781345505","wikidata":"https://www.wikidata.org/wiki/Q2535979","display_name":"Blacklist","level":2,"score":0.984154999256134},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8615860939025879},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.7778191566467285},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6367456316947937},{"id":"https://openalex.org/C2778012447","wikidata":"https://www.wikidata.org/wiki/Q1034415","display_name":"Scope (computer science)","level":2,"score":0.4655419588088989},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.40182143449783325},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.35351234674453735},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/access.2019.2944203","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2019.2944203","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8600701/08851066.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:d901b14497d0433c86aa35ac620cb5b5","is_oa":true,"landing_page_url":"https://doaj.org/article/d901b14497d0433c86aa35ac620cb5b5","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 7, Pp 142991-143001 (2019)","raw_type":"article"},{"id":"pmh:oai:kyutech.repo.nii.ac.jp:00006421","is_oa":true,"landing_page_url":"http://hdl.handle.net/10228/00007631","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"VoR"}],"best_oa_location":{"id":"doi:10.1109/access.2019.2944203","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2019.2944203","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/8600701/08851066.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.75,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2975453956.pdf","grobid_xml":"https://content.openalex.org/works/W2975453956.grobid-xml"},"referenced_works_count":47,"referenced_works":["https://openalex.org/W14064520","https://openalex.org/W22566950","https://openalex.org/W85558978","https://openalex.org/W130645499","https://openalex.org/W185582443","https://openalex.org/W1936523258","https://openalex.org/W2019084676","https://openalex.org/W2030382024","https://openalex.org/W2072240081","https://openalex.org/W2082550445","https://openalex.org/W2116422340","https://openalex.org/W2131744502","https://openalex.org/W2146577751","https://openalex.org/W2149252451","https://openalex.org/W2276488401","https://openalex.org/W2321446074","https://openalex.org/W2509891819","https://openalex.org/W2518248186","https://openalex.org/W2519132385","https://openalex.org/W2528500008","https://openalex.org/W2562608433","https://openalex.org/W2580641941","https://openalex.org/W2623347760","https://openalex.org/W2730672749","https://openalex.org/W2753333424","https://openalex.org/W2764206252","https://openalex.org/W2792817739","https://openalex.org/W2793931959","https://openalex.org/W2800381687","https://openalex.org/W2809104090","https://openalex.org/W2912755644","https://openalex.org/W2919984289","https://openalex.org/W2922513734","https://openalex.org/W2947167098","https://openalex.org/W2947227181","https://openalex.org/W2949647805","https://openalex.org/W2955934446","https://openalex.org/W2962763344","https://openalex.org/W4294170691","https://openalex.org/W4301880089","https://openalex.org/W6607598264","https://openalex.org/W6679775712","https://openalex.org/W6682691769","https://openalex.org/W6732691979","https://openalex.org/W6744137356","https://openalex.org/W6749794497","https://openalex.org/W6760551934"],"related_works":["https://openalex.org/W3172840274","https://openalex.org/W50122730","https://openalex.org/W2245533262","https://openalex.org/W3129811130","https://openalex.org/W3185731761","https://openalex.org/W2265547225","https://openalex.org/W4379616178","https://openalex.org/W4292158217","https://openalex.org/W2017968904","https://openalex.org/W2005813008"],"abstract_inverted_index":{"Some":[0],"of":[1,75,135,162,173,211,233,242],"the":[2,21,50,71,76,97,123,141,160,163,171,180,190,226,240,246],"most":[3],"serious":[4],"security":[5],"threats":[6],"facing":[7],"computer":[8],"networks":[9],"involve":[10],"malware.":[11],"To":[12],"prevent":[13],"this":[14,47,101],"threat,":[15],"administrators":[16,68,89,221],"need":[17],"to":[18,30,66,69,140,176,185],"swiftly":[19,238],"remove":[20],"infected":[22,32,243],"machines":[23,33,244],"from":[24],"their":[25,92,116],"networks.":[26],"One":[27],"common":[28,215],"way":[29],"detect":[31],"in":[34,158,189,245],"a":[35,126,151,214],"network":[36],"is":[37,56,86,120,129,183],"by":[38,95,115,122,228],"monitoring":[39],"communications":[40,82,98],"based":[41],"on":[42],"blacklists.":[43],"However,":[44],"detection":[45,77,93],"using":[46],"method":[48],"has":[49],"following":[51,124],"two":[52],"problems:":[53],"no":[54],"blacklist":[55,84],"completely":[57],"reliable,":[58],"and":[59,73,88,149,236],"blacklists":[60,114,156],"do":[61],"not":[62],"provide":[63],"sufficient":[64],"evidence":[65],"allow":[67],"determine":[70],"validity":[72],"accuracy":[74],"results.":[78,192],"Therefore,":[79],"simply":[80],"matching":[81],"with":[83,213],"entries":[85],"insufficient,":[87],"should":[90],"pursue":[91,224],"causes":[94,227],"investigating":[96,229],"themselves.":[99],"In":[100,193],"paper,":[102],"we":[103,195],"propose":[104],"an":[105],"approach":[106,119,200],"for":[107],"classifying":[108],"malicious":[109,152,164,174,204],"DNS":[110],"queries":[111,138,145,175,188,205,212,232],"detected":[112,154],"through":[113,155],"causes.":[117],"This":[118],"motivated":[121],"observation:":[125],"malware":[127],"communication":[128],"divided":[130],"into":[131,206],"several":[132],"transactions,":[133],"each":[134,209,234],"which":[136],"generates":[137],"related":[139],"malware;":[142],"thus,":[143],"surrounding":[144],"that":[146,198,220],"occur":[147],"before":[148],"after":[150],"query":[153],"help":[157],"estimating":[159],"cause":[161],"query.":[165],"Our":[166],"cause-based":[167],"classification":[168,191],"drastically":[169],"reduces":[170],"number":[172],"be":[177],"investigated":[178],"because":[179],"investigation":[181],"scope":[182],"limited":[184],"only":[186,230],"representative":[187,231],"experiments,":[194],"have":[196],"confirmed":[197],"our":[199],"could":[201],"group":[202],"388":[203],"3":[207],"clusters,":[208],"consisting":[210],"cause.":[216],"These":[217],"results":[218],"indicate":[219],"can":[222],"briefly":[223],"all":[225],"cluster,":[235],"thereby":[237],"address":[239],"problem":[241],"network.":[247]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2024,"cited_by_count":3},{"year":2022,"cited_by_count":3},{"year":2021,"cited_by_count":6},{"year":2020,"cited_by_count":2}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}