{"id":"https://openalex.org/W3170557823","doi":"https://doi.org/10.1109/access.2021.3085500","title":"Application Behavior Identification in DNS Tunnels Based on Spatial-Temporal Information","display_name":"Application Behavior Identification in DNS Tunnels Based on Spatial-Temporal Information","publication_year":2021,"publication_date":"2021-01-01","ids":{"openalex":"https://openalex.org/W3170557823","doi":"https://doi.org/10.1109/access.2021.3085500","mag":"3170557823"},"language":"en","primary_location":{"id":"doi:10.1109/access.2021.3085500","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2021.3085500","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/9312710/09445115.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/9312710/09445115.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5048188687","display_name":"Huiwen Bai","orcid":"https://orcid.org/0000-0002-8985-6977"},"institutions":[{"id":"https://openalex.org/I36399199","display_name":"Nanjing University of Science and Technology","ror":"https://ror.org/00xp9wg62","country_code":"CN","type":"education","lineage":["https://openalex.org/I36399199"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Huiwen Bai","raw_affiliation_strings":["School of Automation, Nanjing University of Science and Technology, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0002-8985-6977","affiliations":[{"raw_affiliation_string":"School of Automation, Nanjing University of Science and Technology, Nanjing, China","institution_ids":["https://openalex.org/I36399199"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100359503","display_name":"Weiwei Liu","orcid":"https://orcid.org/0000-0001-7353-9136"},"institutions":[{"id":"https://openalex.org/I36399199","display_name":"Nanjing University of Science and Technology","ror":"https://ror.org/00xp9wg62","country_code":"CN","type":"education","lineage":["https://openalex.org/I36399199"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weiwei Liu","raw_affiliation_strings":["School of Automation, Nanjing University of Science and Technology, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0001-7353-9136","affiliations":[{"raw_affiliation_string":"School of Automation, Nanjing University of Science and Technology, Nanjing, China","institution_ids":["https://openalex.org/I36399199"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062243742","display_name":"Guangjie Liu","orcid":"https://orcid.org/0000-0003-4729-7406"},"institutions":[{"id":"https://openalex.org/I200845125","display_name":"Nanjing University of Information Science and Technology","ror":"https://ror.org/02y0rxk19","country_code":"CN","type":"education","lineage":["https://openalex.org/I200845125"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guangjie Liu","raw_affiliation_strings":["School of Electrics and Information Engineering, Nanjing University of Information Science and Technology, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0003-4729-7406","affiliations":[{"raw_affiliation_string":"School of Electrics and Information Engineering, Nanjing University of Information Science and Technology, Nanjing, China","institution_ids":["https://openalex.org/I200845125"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5080275149","display_name":"Yuewei Dai","orcid":"https://orcid.org/0000-0003-1522-9257"},"institutions":[{"id":"https://openalex.org/I200845125","display_name":"Nanjing University of Information Science and Technology","ror":"https://ror.org/02y0rxk19","country_code":"CN","type":"education","lineage":["https://openalex.org/I200845125"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuewei Dai","raw_affiliation_strings":["School of Electrics and Information Engineering, Nanjing University of Information Science and Technology, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0003-1522-9257","affiliations":[{"raw_affiliation_string":"School of Electrics and Information Engineering, Nanjing University of Information Science and Technology, Nanjing, China","institution_ids":["https://openalex.org/I200845125"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5009451103","display_name":"Shuhua Huang","orcid":"https://orcid.org/0000-0003-3569-7891"},"institutions":[{"id":"https://openalex.org/I36399199","display_name":"Nanjing University of Science and Technology","ror":"https://ror.org/00xp9wg62","country_code":"CN","type":"education","lineage":["https://openalex.org/I36399199"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shuhua Huang","raw_affiliation_strings":["School of Automation, Nanjing University of Science and Technology, Nanjing, China"],"raw_orcid":"https://orcid.org/0000-0003-3569-7891","affiliations":[{"raw_affiliation_string":"School of Automation, Nanjing University of Science and Technology, Nanjing, China","institution_ids":["https://openalex.org/I36399199"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5048188687"],"corresponding_institution_ids":["https://openalex.org/I36399199"],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":1.4415,"has_fulltext":true,"cited_by_count":10,"citation_normalized_percentile":{"value":0.82632039,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":98},"biblio":{"volume":"9","issue":null,"first_page":"80639","last_page":"80653"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9958999752998352,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8274534940719604},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.691569983959198},{"id":"https://openalex.org/keywords/upload","display_name":"Upload","score":0.6696338653564453},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.632641077041626},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.6055833101272583},{"id":"https://openalex.org/keywords/default-gateway","display_name":"Default gateway","score":0.5164656639099121},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.5041574239730835},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3583013415336609},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.12117865681648254}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8274534940719604},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.691569983959198},{"id":"https://openalex.org/C71901391","wikidata":"https://www.wikidata.org/wiki/Q7126699","display_name":"Upload","level":2,"score":0.6696338653564453},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.632641077041626},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.6055833101272583},{"id":"https://openalex.org/C187713609","wikidata":"https://www.wikidata.org/wiki/Q2465461","display_name":"Default gateway","level":2,"score":0.5164656639099121},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5041574239730835},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3583013415336609},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.12117865681648254},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C59822182","wikidata":"https://www.wikidata.org/wiki/Q441","display_name":"Botany","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2021.3085500","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2021.3085500","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/9312710/09445115.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:561f0102883f44598240a477088588ea","is_oa":true,"landing_page_url":"https://doaj.org/article/561f0102883f44598240a477088588ea","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 9, Pp 80639-80653 (2021)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2021.3085500","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2021.3085500","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/9312710/09445115.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.7799999713897705,"id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G1931098107","display_name":null,"funder_award_id":"30918012204","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3986486420","display_name":null,"funder_award_id":"30918012204","funder_id":"https://openalex.org/F4320335787","funder_display_name":"Fundamental Research Funds for the Central Universities"},{"id":"https://openalex.org/G5515644545","display_name":null,"funder_award_id":"U1836104","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G664343225","display_name":null,"funder_award_id":"61702235","funder_id":"https://openalex.org/F4320335787","funder_display_name":"Fundamental Research Funds for the Central Universities"},{"id":"https://openalex.org/G6732892750","display_name":null,"funder_award_id":"U1836104","funder_id":"https://openalex.org/F4320335787","funder_display_name":"Fundamental Research Funds for the Central Universities"},{"id":"https://openalex.org/G8982426284","display_name":null,"funder_award_id":"61702235","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335787","display_name":"Fundamental Research Funds for the Central Universities","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3170557823.pdf","grobid_xml":"https://content.openalex.org/works/W3170557823.grobid-xml"},"referenced_works_count":50,"referenced_works":["https://openalex.org/W4876512","https://openalex.org/W85558978","https://openalex.org/W1481628066","https://openalex.org/W1498369939","https://openalex.org/W1561314694","https://openalex.org/W1907846276","https://openalex.org/W1964234701","https://openalex.org/W1970499440","https://openalex.org/W1989598342","https://openalex.org/W2101284612","https://openalex.org/W2144578696","https://openalex.org/W2150593342","https://openalex.org/W2168901348","https://openalex.org/W2169038408","https://openalex.org/W2293445685","https://openalex.org/W2293600471","https://openalex.org/W2298611638","https://openalex.org/W2326113404","https://openalex.org/W2342408547","https://openalex.org/W2346323428","https://openalex.org/W2631977690","https://openalex.org/W2754468074","https://openalex.org/W2755348785","https://openalex.org/W2783007605","https://openalex.org/W2783412901","https://openalex.org/W2790832484","https://openalex.org/W2911629323","https://openalex.org/W2922103104","https://openalex.org/W2948023660","https://openalex.org/W2987823657","https://openalex.org/W2996378475","https://openalex.org/W2999681325","https://openalex.org/W3010897133","https://openalex.org/W3043450011","https://openalex.org/W3045710056","https://openalex.org/W3080473790","https://openalex.org/W3094378670","https://openalex.org/W3121046636","https://openalex.org/W4289236186","https://openalex.org/W4295186723","https://openalex.org/W4300430800","https://openalex.org/W6629718364","https://openalex.org/W6633853188","https://openalex.org/W6696772012","https://openalex.org/W6705043220","https://openalex.org/W6739656747","https://openalex.org/W6743929116","https://openalex.org/W6763291434","https://openalex.org/W6782863955","https://openalex.org/W6788599253"],"related_works":["https://openalex.org/W2944823289","https://openalex.org/W3037018281","https://openalex.org/W2003209439","https://openalex.org/W4321854979","https://openalex.org/W2358319515","https://openalex.org/W2972592048","https://openalex.org/W4312214821","https://openalex.org/W2070735207","https://openalex.org/W2901378758","https://openalex.org/W4385804851"],"abstract_inverted_index":{"Due":[0],"to":[1,68,89,119],"the":[2,14,21,31,34,41,50,82,86,91,121,147,155,173],"capability":[3],"of":[4,43,133,191],"passing":[5],"through":[6],"heavily":[7],"censored":[8],"networks":[9],"or":[10],"gateway":[11],"equipped":[12],"with":[13,108,115,163,172,197],"traffic-monitoring":[15],"module,":[16],"DNS":[17,44,56,75,96,106,126],"tunnel":[18,45],"has":[19,46],"been":[20,47],"dominant":[22],"covert":[23],"communication":[24],"technique":[25],"for":[26,55,105],"command":[27],"and":[28,33,103,145],"control":[29],"between":[30],"victim":[32],"attacker":[35],"in":[36,74,95,125,136,189],"network":[37],"attack":[38],"events.":[39],"Although":[40],"discovery":[42],"intensively":[48],"studied,":[49],"internal":[51,92,110,122,175],"application":[52,93,111,123,134],"behavior":[53,71],"identification":[54,65,161,177],"tunnels":[57,107],"still":[58],"remains":[59],"a":[60,116,164],"challenging":[61],"problem.":[62],"The":[63,150,179],"fine-gained":[64],"can":[66,158,194],"help":[67],"reveal":[69],"more":[70],"information":[72,84],"wrapped":[73],"tunnels.":[76,97,127],"In":[77],"this":[78],"study,":[79],"we":[80],"investigate":[81],"spatial-temporal":[83],"from":[85],"raw":[87],"packets":[88],"identify":[90,120],"behaviors":[94,112,124,135],"Multi-dimensional":[98],"features":[99],"on":[100],"packet":[101,167],"length":[102],"timing":[104],"different":[109],"are":[113],"incorporated":[114],"machine-learning":[117],"algorithm":[118],"We":[128],"consider":[129],"4":[130],"common":[131],"types":[132],"our":[137,184],"research,":[138],"including":[139],"browsing":[140],"webpages,":[141],"emailing,":[142],"downloading":[143],"data,":[144],"controlling":[146],"remote":[148],"servers.":[149],"experimental":[151],"results":[152,181],"show":[153],"that":[154,183],"proposed":[156,185],"scheme":[157,186],"achieve":[159],"higher":[160],"accuracy":[162],"much":[165],"lower":[166],"consuming":[168],"rate":[169],"when":[170],"compared":[171],"state-of-the-art":[174],"protocol":[176],"scheme.":[178],"experiment":[180],"depict":[182],"is":[187],"better":[188],"terms":[190],"F-score,":[192],"which":[193],"reach":[195],"99%":[196],"only":[198],"100":[199],"packets.":[200]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":5},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":3}],"updated_date":"2026-05-06T08:25:59.206177","created_date":"2025-10-10T00:00:00"}