{"id":"https://openalex.org/W4323020881","doi":"https://doi.org/10.1109/access.2023.3250106","title":"Detecting Network Scanning Through Monitoring and Manipulation of DNS Traffic","display_name":"Detecting Network Scanning Through Monitoring and Manipulation of DNS Traffic","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4323020881","doi":"https://doi.org/10.1109/access.2023.3250106"},"language":"en","primary_location":{"id":"doi:10.1109/access.2023.3250106","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3250106","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10054395.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10054395.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5023197641","display_name":"Jafar Haadi Jafarian","orcid":"https://orcid.org/0000-0001-8115-085X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jafar Haadi Jafarian","raw_affiliation_strings":["Department of Computer Science and Engineering, University of Colorado (CU) Denver, Denver, CO, USA"],"raw_orcid":"https://orcid.org/0000-0001-8115-085X","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, University of Colorado (CU) Denver, Denver, CO, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5066259015","display_name":"Masoumeh Abolfathi","orcid":"https://orcid.org/0000-0002-1669-7426"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Masoumeh Abolfathi","raw_affiliation_strings":["Department of Computer Science and Engineering, University of Colorado (CU) Denver, Denver, CO, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, University of Colorado (CU) Denver, Denver, CO, USA","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5020569071","display_name":"Mahsa Rahimian","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Mahsa Rahimian","raw_affiliation_strings":["Department of Computer Science and Engineering, University of Colorado (CU) Denver, Denver, CO, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Engineering, University of Colorado (CU) Denver, Denver, CO, USA","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2075,"currency":"USD","value_usd":2075},"apc_paid":{"value":2075,"currency":"USD","value_usd":2075},"fwci":2.6901,"has_fulltext":true,"cited_by_count":20,"citation_normalized_percentile":{"value":0.89732315,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":97,"max":99},"biblio":{"volume":"11","issue":null,"first_page":"20267","last_page":"20283"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9973999857902527,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8435176610946655},{"id":"https://openalex.org/keywords/subnet","display_name":"Subnet","score":0.5835760831832886},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.5538109540939331},{"id":"https://openalex.org/keywords/domain-name-system","display_name":"Domain Name System","score":0.5041402578353882},{"id":"https://openalex.org/keywords/cache","display_name":"Cache","score":0.4961632192134857},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.4791673719882965},{"id":"https://openalex.org/keywords/resilience","display_name":"Resilience (materials science)","score":0.4518647789955139},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.42363056540489197},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.25577259063720703},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.2122950255870819},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.1428397297859192}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8435176610946655},{"id":"https://openalex.org/C21099817","wikidata":"https://www.wikidata.org/wiki/Q7631721","display_name":"Subnet","level":2,"score":0.5835760831832886},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5538109540939331},{"id":"https://openalex.org/C35026560","wikidata":"https://www.wikidata.org/wiki/Q8767","display_name":"Domain Name System","level":3,"score":0.5041402578353882},{"id":"https://openalex.org/C115537543","wikidata":"https://www.wikidata.org/wiki/Q165596","display_name":"Cache","level":2,"score":0.4961632192134857},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.4791673719882965},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.4518647789955139},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.42363056540489197},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.25577259063720703},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.2122950255870819},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.1428397297859192},{"id":"https://openalex.org/C97355855","wikidata":"https://www.wikidata.org/wiki/Q11473","display_name":"Thermodynamics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2023.3250106","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3250106","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10054395.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:9a5ffa95a5cd4662bb4a22640918d753","is_oa":true,"landing_page_url":"https://doaj.org/article/9a5ffa95a5cd4662bb4a22640918d753","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 11, Pp 20267-20283 (2023)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2023.3250106","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3250106","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10054395.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4323020881.pdf","grobid_xml":"https://content.openalex.org/works/W4323020881.grobid-xml"},"referenced_works_count":27,"referenced_works":["https://openalex.org/W1527422375","https://openalex.org/W1576185228","https://openalex.org/W1674877186","https://openalex.org/W1913575206","https://openalex.org/W1989335795","https://openalex.org/W2012575532","https://openalex.org/W2079569045","https://openalex.org/W2083477206","https://openalex.org/W2105014180","https://openalex.org/W2133580356","https://openalex.org/W2170482397","https://openalex.org/W2181680104","https://openalex.org/W2297307748","https://openalex.org/W2398669126","https://openalex.org/W2476891002","https://openalex.org/W2485766018","https://openalex.org/W2733765803","https://openalex.org/W2768602817","https://openalex.org/W2794055141","https://openalex.org/W3005372859","https://openalex.org/W3138595089","https://openalex.org/W4225713813","https://openalex.org/W6605725336","https://openalex.org/W6610362903","https://openalex.org/W6637096788","https://openalex.org/W6677217071","https://openalex.org/W6701629550"],"related_works":["https://openalex.org/W2356206668","https://openalex.org/W2131631951","https://openalex.org/W2130707537","https://openalex.org/W2105155969","https://openalex.org/W1977409556","https://openalex.org/W2361602549","https://openalex.org/W4362683600","https://openalex.org/W3200778902","https://openalex.org/W2390667963","https://openalex.org/W3098387898"],"abstract_inverted_index":{"In":[0,18],"this":[1,122,167,199,235,243,263],"paper,":[2],"we":[3,64,132,156,183,206],"propose":[4],"an":[5,21,34],"approach":[6,200,239,264],"for":[7],"detecting":[8,106,202],"internal":[9,75,181],"and":[10,30,38,52,74,78,90,98,172,226,249],"external":[11,73,203],"network":[12,36,79,99,110,260],"scanning":[13,40,86,211,261,272],"attacks":[14],"on":[15,43,96,147,257],"enterprise":[16,35],"networks.":[17],"our":[19,67,153,238],"approach,":[20,168],"inline":[22],"scan":[23],"detection":[24,224],"system":[25],"(SDS)":[26],"monitors":[27],"the":[28,44,103,120,125,164,185],"ingress":[29],"egress":[31],"flows":[32,47,111],"of":[33,46,56,85,105,139,166,189],"subnet":[37],"detects":[39],"probes":[41],"based":[42],"correlation":[45],"with":[48,112],"preceding":[49,113],"DNS":[50,57,97,114,142,149,190,219],"query/responses":[51,115],"reducing":[53],"TTL":[54,137,159],"values":[55,138],"Resource":[58],"Records":[59],"(RR).":[60],"Through":[61],"rigorous":[62],"evaluation,":[63],"show":[65,133],"that":[66,134,216,255,273],"method":[68],"is":[69,83,240,265],"effective":[70,241,266],"against":[71,170,180,242,267],"both":[72],"port":[76],"scanners":[77],"worms,":[80,262],"its":[81,91],"effectiveness":[82,165],"independent":[84],"rate":[87],"or":[88],"technique,":[89,212],"deployment":[92],"incurs":[93],"negligible":[94],"overhead":[95],"response":[100],"times.":[101],"While":[102],"idea":[104],"scans":[107],"by":[108,127],"correlating":[109],"has":[116],"been":[117],"proposed":[118],"in":[119,141],"literature,":[121],"work":[123,179,254],"extends":[124],"state-of-the-art":[126],"offering":[128],"four":[129],"contributions:":[130],"1)":[131],"without":[135],"decreasing":[136],"RRs":[140],"responses,":[143],"attackers":[144],"can":[145],"piggyback":[146],"cached":[148],"records":[150],"to":[151,162,197,221,233,252,278],"bypass":[152,222],"detection;":[154],"thus":[155],"incorporate":[157],"a":[158,208],"reduction":[160],"mechanism":[161],"enhance":[163],"especially":[169],"stealthy":[171,271],"adaptive":[173,210],"scanners;":[174,204],"2)":[175],"while":[176,229],"prior":[177,223,230],"works":[178],"scanners,":[182],"use":[184],"relatively":[186],"new":[187],"extension":[188],"protocol,":[191],"ENDS0":[192],"Client":[193],"Subnet":[194],"(ECS)":[195],"option,":[196],"expand":[198],"toward":[201],"3)":[205],"present":[207],"novel":[209],"called":[213],"DNS-cache-based":[214],"scanning,":[215,269],"exploits":[217],"local":[218],"cache":[220],"methods,":[225],"shows":[227],"that,":[228],"approaches":[231],"fail":[232],"defeat":[234],"threat":[236,245],"model,":[237],"evolved":[244],"model":[246],"as":[247],"well;":[248],"4)":[250],"contrary":[251],"existing":[253],"focuses":[256],"defeating":[258],"fast":[259],"any":[268],"including":[270],"uses":[274],"conservative":[275],"timing":[276],"profiles":[277],"evade":[279],"detection.":[280]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":5},{"year":2024,"cited_by_count":7},{"year":2023,"cited_by_count":5}],"updated_date":"2026-08-21T09:56:20.448147","created_date":"2025-10-10T00:00:00"}