{"id":"https://openalex.org/W2809104090","doi":"https://doi.org/10.1109/comst.2018.2849614","title":"Detecting Internet Abuse by Analyzing Passive DNS Traffic: A Survey of Implemented Systems","display_name":"Detecting Internet Abuse by Analyzing Passive DNS Traffic: A Survey of Implemented Systems","publication_year":2018,"publication_date":"2018-01-01","ids":{"openalex":"https://openalex.org/W2809104090","doi":"https://doi.org/10.1109/comst.2018.2849614","mag":"2809104090"},"language":"en","primary_location":{"id":"doi:10.1109/comst.2018.2849614","is_oa":false,"landing_page_url":"https://doi.org/10.1109/comst.2018.2849614","pdf_url":null,"source":{"id":"https://openalex.org/S23688054","display_name":"IEEE Communications Surveys & Tutorials","issn_l":"1553-877X","issn":["1553-877X","2373-745X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Communications Surveys & Tutorials","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5048698954","display_name":"Sadegh Torabi","orcid":"https://orcid.org/0000-0003-2811-3536"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Sadegh Torabi","raw_affiliation_strings":["Concordia Institute for Information Systems Engineering, Montreal, QC, Canada"],"raw_orcid":"https://orcid.org/0000-0003-2811-3536","affiliations":[{"raw_affiliation_string":"Concordia Institute for Information Systems Engineering, Montreal, QC, Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5019385842","display_name":"Amine Boukhtouta","orcid":"https://orcid.org/0000-0002-0261-815X"},"institutions":[{"id":"https://openalex.org/I4210094041","display_name":"Ericsson (Canada)","ror":"https://ror.org/00nas2c56","country_code":"CA","type":"company","lineage":["https://openalex.org/I1306339040","https://openalex.org/I4210094041"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Amine Boukhtouta","raw_affiliation_strings":["Ericsson Security Research, Montreal, QC, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Ericsson Security Research, Montreal, QC, Canada","institution_ids":["https://openalex.org/I4210094041"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072393948","display_name":"Chadi Assi","orcid":"https://orcid.org/0000-0002-3161-1846"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Chadi Assi","raw_affiliation_strings":["Concordia Institute for Information Systems Engineering, Montreal, QC, Canada"],"raw_orcid":"https://orcid.org/0000-0002-3161-1846","affiliations":[{"raw_affiliation_string":"Concordia Institute for Information Systems Engineering, Montreal, QC, Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5028605138","display_name":"Mourad Debbabi","orcid":"https://orcid.org/0000-0003-3015-3043"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Mourad Debbabi","raw_affiliation_strings":["Concordia Institute for Information Systems Engineering, Montreal, QC, Canada"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Concordia Institute for Information Systems Engineering, Montreal, QC, Canada","institution_ids":["https://openalex.org/I60158472"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":4.7387,"has_fulltext":false,"cited_by_count":57,"citation_normalized_percentile":{"value":0.95302953,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":99},"biblio":{"volume":"20","issue":"4","first_page":"3389","last_page":"3415"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9986000061035156,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8549716472625732},{"id":"https://openalex.org/keywords/domain-name-system","display_name":"Domain Name System","score":0.826781153678894},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.7096673846244812},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.48988765478134155},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.4536426067352295},{"id":"https://openalex.org/keywords/analytics","display_name":"Analytics","score":0.435047447681427},{"id":"https://openalex.org/keywords/internet-traffic","display_name":"Internet traffic","score":0.4192691743373871},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.34245598316192627},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.2813786268234253}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8549716472625732},{"id":"https://openalex.org/C35026560","wikidata":"https://www.wikidata.org/wiki/Q8767","display_name":"Domain Name System","level":3,"score":0.826781153678894},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.7096673846244812},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.48988765478134155},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.4536426067352295},{"id":"https://openalex.org/C79158427","wikidata":"https://www.wikidata.org/wiki/Q485396","display_name":"Analytics","level":2,"score":0.435047447681427},{"id":"https://openalex.org/C63969886","wikidata":"https://www.wikidata.org/wiki/Q3536440","display_name":"Internet traffic","level":3,"score":0.4192691743373871},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.34245598316192627},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.2813786268234253}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/comst.2018.2849614","is_oa":false,"landing_page_url":"https://doi.org/10.1109/comst.2018.2849614","pdf_url":null,"source":{"id":"https://openalex.org/S23688054","display_name":"IEEE Communications Surveys & Tutorials","issn_l":"1553-877X","issn":["1553-877X","2373-745X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Communications Surveys & Tutorials","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.7099999785423279,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[{"id":"https://openalex.org/F4320321588","display_name":"Concordia University","ror":"https://ror.org/0420zvk78"},{"id":"https://openalex.org/F4320334593","display_name":"Natural Sciences and Engineering Research Council of Canada","ror":"https://ror.org/01h531d29"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":88,"referenced_works":["https://openalex.org/W20263668","https://openalex.org/W70584117","https://openalex.org/W74326408","https://openalex.org/W80155331","https://openalex.org/W85558978","https://openalex.org/W155384935","https://openalex.org/W196740607","https://openalex.org/W203347454","https://openalex.org/W284347760","https://openalex.org/W1479710165","https://openalex.org/W1496571753","https://openalex.org/W1498756827","https://openalex.org/W1561983441","https://openalex.org/W1637101047","https://openalex.org/W1667466877","https://openalex.org/W1675263286","https://openalex.org/W1828150029","https://openalex.org/W1916464331","https://openalex.org/W1954903228","https://openalex.org/W1981049515","https://openalex.org/W1981294881","https://openalex.org/W1984816986","https://openalex.org/W1989454965","https://openalex.org/W2004078625","https://openalex.org/W2018992824","https://openalex.org/W2028060714","https://openalex.org/W2028110717","https://openalex.org/W2029256027","https://openalex.org/W2033226746","https://openalex.org/W2050326248","https://openalex.org/W2057364987","https://openalex.org/W2065323196","https://openalex.org/W2074096182","https://openalex.org/W2082550445","https://openalex.org/W2089027784","https://openalex.org/W2099205108","https://openalex.org/W2101737524","https://openalex.org/W2111427271","https://openalex.org/W2116696275","https://openalex.org/W2122941797","https://openalex.org/W2131975293","https://openalex.org/W2136495567","https://openalex.org/W2164686665","https://openalex.org/W2189465200","https://openalex.org/W2200915860","https://openalex.org/W2209064213","https://openalex.org/W2230023062","https://openalex.org/W2233222076","https://openalex.org/W2288791011","https://openalex.org/W2295598076","https://openalex.org/W2326113404","https://openalex.org/W2342408547","https://openalex.org/W2401054255","https://openalex.org/W2464432954","https://openalex.org/W2477506845","https://openalex.org/W2500064200","https://openalex.org/W2509891819","https://openalex.org/W2510523362","https://openalex.org/W2551436658","https://openalex.org/W2597982026","https://openalex.org/W2617931713","https://openalex.org/W2731092512","https://openalex.org/W2748868501","https://openalex.org/W2806616617","https://openalex.org/W2911964244","https://openalex.org/W2987823657","https://openalex.org/W3102059489","https://openalex.org/W3102476541","https://openalex.org/W4205200683","https://openalex.org/W4213362721","https://openalex.org/W4256728966","https://openalex.org/W6602816918","https://openalex.org/W6602999313","https://openalex.org/W6603260413","https://openalex.org/W6606342502","https://openalex.org/W6608030608","https://openalex.org/W6608273010","https://openalex.org/W6610362903","https://openalex.org/W6633578641","https://openalex.org/W6639965902","https://openalex.org/W6640663528","https://openalex.org/W6679815717","https://openalex.org/W6687322159","https://openalex.org/W6687985142","https://openalex.org/W6688098044","https://openalex.org/W6713023146","https://openalex.org/W6719105664","https://openalex.org/W6743493502"],"related_works":["https://openalex.org/W1867585695","https://openalex.org/W2521024223","https://openalex.org/W2771252882","https://openalex.org/W2204155491","https://openalex.org/W2069613467","https://openalex.org/W2144638830","https://openalex.org/W1494299001","https://openalex.org/W2294670126","https://openalex.org/W4247088668","https://openalex.org/W4239582513"],"abstract_inverted_index":{"Despite":[0],"the":[1,11,70,79,86,90,96,104,119,127,167,191],"ubiquitous":[2],"role":[3],"of":[4,13,35,69,81,95,103,126,193],"domain":[5],"name":[6,18],"system":[7,175],"(DNS)":[8],"in":[9,118,124,186,212],"sustaining":[10],"operations":[12],"various":[14],"Internet":[15,36],"services":[16],"(domain":[17],"to":[19,28,44,169,183],"IP":[20],"address":[21],"resolution,":[22],"e-mail,":[23],"Web),":[24],"DNS":[25,49,61,76,210],"was":[26],"abused/misused":[27],"perform":[29],"large-scale":[30],"attacks":[31],"that":[32,73,136,177],"affected":[33],"millions":[34],"users.":[37],"To":[38],"detect":[39,184],"and":[40,51,93,109,130,201],"prevent":[41],"threats":[42,185],"associated":[43],"DNS,":[45],"researchers":[46],"introduced":[47],"passive":[48,75],"replication":[50],"analysis":[52,102],"as":[53],"an":[54,100,114],"effective":[55],"alternative":[56],"approach":[57],"for":[58,78,205],"analyzing":[59,209],"live":[60],"traffic.":[62],"In":[63,150],"this":[64],"paper,":[65],"we":[66,134,165],"survey":[67],"state":[68],"art":[71],"systems":[72,98,121,140,155],"utilized":[74],"traffic":[77,211],"purpose":[80],"detecting":[82,163],"malicious":[83],"behaviors":[84],"on":[85],"Internet.":[87],"We":[88,112,189],"highlight":[89,113],"main":[91],"strengths":[92],"weaknesses":[94],"implemented":[97,141],"through":[99,198],"in-depth":[101],"detection":[105,110,131,196],"approach,":[106],"collected":[107],"data,":[108],"outcomes.":[111],"incremental":[115],"implementation":[116],"pattern":[117],"studied":[120,139],"with":[122],"similarities":[123],"terms":[125],"used":[128],"datasets":[129],"approach.":[132],"Furthermore,":[133],"show":[135],"almost":[137],"all":[138,153],"supervised":[142],"machine":[143],"learning,":[144],"which":[145],"has":[146],"its":[147],"own":[148],"limitations.":[149],"addition,":[151],"while":[152],"surveyed":[154],"required":[156],"several":[157],"hours":[158],"or":[159],"even":[160],"days":[161],"before":[162],"threats,":[164],"illustrate":[166],"ability":[168],"enhance":[170],"performance":[171],"by":[172],"implementing":[173],"a":[174],"prototype":[176,197],"utilizes":[178],"big":[179],"data":[180],"analytics":[181],"frameworks":[182],"near":[187,213],"real-time.":[188,214],"demonstrate":[190],"feasibility":[192],"our":[194],"threat":[195],"real-life":[199],"examples,":[200],"provide":[202],"further":[203],"insights":[204],"future":[206],"work":[207],"toward":[208]},"counts_by_year":[{"year":2026,"cited_by_count":5},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":6},{"year":2023,"cited_by_count":9},{"year":2022,"cited_by_count":8},{"year":2021,"cited_by_count":10},{"year":2020,"cited_by_count":13},{"year":2019,"cited_by_count":2}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}