{"id":"https://openalex.org/W4413822824","doi":"https://doi.org/10.1109/icccn65249.2025.11133891","title":"A DGA Detection Method Based on Spatiotemporal Features of DNS and NetFlow Traffic","display_name":"A DGA Detection Method Based on Spatiotemporal Features of DNS and NetFlow Traffic","publication_year":2025,"publication_date":"2025-08-04","ids":{"openalex":"https://openalex.org/W4413822824","doi":"https://doi.org/10.1109/icccn65249.2025.11133891"},"language":"en","primary_location":{"id":"doi:10.1109/icccn65249.2025.11133891","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icccn65249.2025.11133891","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 34th International Conference on Computer Communications and Networks (ICCCN)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5077690787","display_name":"Feng Yuan","orcid":"https://orcid.org/0000-0003-3578-950X"},"institutions":[{"id":"https://openalex.org/I76569877","display_name":"Southeast University","ror":"https://ror.org/04ct4d772","country_code":"CN","type":"education","lineage":["https://openalex.org/I76569877"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuan Feng","raw_affiliation_strings":["Southeast University,School of Cyber Science and Engineering,Nanjing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Southeast University,School of Cyber Science and Engineering,Nanjing,China","institution_ids":["https://openalex.org/I76569877"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101829011","display_name":"Jun Tao","orcid":"https://orcid.org/0000-0003-4247-3490"},"institutions":[{"id":"https://openalex.org/I76569877","display_name":"Southeast University","ror":"https://ror.org/04ct4d772","country_code":"CN","type":"education","lineage":["https://openalex.org/I76569877"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jun Tao","raw_affiliation_strings":["Southeast University,School of Cyber Science and Engineering,Nanjing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Southeast University,School of Cyber Science and Engineering,Nanjing,China","institution_ids":["https://openalex.org/I76569877"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100626728","display_name":"Yifan Xu","orcid":"https://orcid.org/0000-0002-5408-8971"},"institutions":[{"id":"https://openalex.org/I76569877","display_name":"Southeast University","ror":"https://ror.org/04ct4d772","country_code":"CN","type":"education","lineage":["https://openalex.org/I76569877"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yifan Xu","raw_affiliation_strings":["Southeast University,School of Cyber Science and Engineering,Nanjing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Southeast University,School of Cyber Science and Engineering,Nanjing,China","institution_ids":["https://openalex.org/I76569877"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100682896","display_name":"Jiangtao Wang","orcid":"https://orcid.org/0000-0002-8704-502X"},"institutions":[{"id":"https://openalex.org/I76569877","display_name":"Southeast University","ror":"https://ror.org/04ct4d772","country_code":"CN","type":"education","lineage":["https://openalex.org/I76569877"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiangtao Wang","raw_affiliation_strings":["Southeast University,National Mobile Communications Research Laboratory,Nanjing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Southeast University,National Mobile Communications Research Laboratory,Nanjing,China","institution_ids":["https://openalex.org/I76569877"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101537215","display_name":"Jiaqi Wei","orcid":"https://orcid.org/0009-0001-7203-0538"},"institutions":[{"id":"https://openalex.org/I4210136246","display_name":"China Telecom (China)","ror":"https://ror.org/03jgnzt20","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210136246"]},{"id":"https://openalex.org/I4387153335","display_name":"China Telecom","ror":"https://ror.org/05p67dv18","country_code":null,"type":"company","lineage":["https://openalex.org/I4387153335"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiaqi Wei","raw_affiliation_strings":["China Telecom Corporation Limited,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"China Telecom Corporation Limited,Beijing,China","institution_ids":["https://openalex.org/I4210136246","https://openalex.org/I4387153335"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100728882","display_name":"Fang Yu","orcid":"https://orcid.org/0000-0001-9670-0826"},"institutions":[{"id":"https://openalex.org/I4210136246","display_name":"China Telecom (China)","ror":"https://ror.org/03jgnzt20","country_code":"CN","type":"company","lineage":["https://openalex.org/I4210136246"]},{"id":"https://openalex.org/I4387153335","display_name":"China Telecom","ror":"https://ror.org/05p67dv18","country_code":null,"type":"company","lineage":["https://openalex.org/I4387153335"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yu Fang","raw_affiliation_strings":["China Telecom Corporation Limited,Beijing,China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"China Telecom Corporation Limited,Beijing,China","institution_ids":["https://openalex.org/I4210136246","https://openalex.org/I4387153335"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"8"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9948999881744385,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9948999881744385,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9014999866485596,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/netflow","display_name":"NetFlow","score":0.9451335668563843},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7015329599380493},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.38338518142700195},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.3477473258972168}],"concepts":[{"id":"https://openalex.org/C188067584","wikidata":"https://www.wikidata.org/wiki/Q219363","display_name":"NetFlow","level":2,"score":0.9451335668563843},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7015329599380493},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.38338518142700195},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3477473258972168}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/icccn65249.2025.11133891","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icccn65249.2025.11133891","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 34th International Conference on Computer Communications and Networks (ICCCN)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":40,"referenced_works":["https://openalex.org/W1595868485","https://openalex.org/W2045880951","https://openalex.org/W2528500008","https://openalex.org/W2773671123","https://openalex.org/W2786906486","https://openalex.org/W2899179066","https://openalex.org/W2942650110","https://openalex.org/W2961635701","https://openalex.org/W2971890500","https://openalex.org/W2986995057","https://openalex.org/W2995774794","https://openalex.org/W2999697944","https://openalex.org/W3011866104","https://openalex.org/W3014018380","https://openalex.org/W3020685193","https://openalex.org/W3093481824","https://openalex.org/W3114681532","https://openalex.org/W3122189786","https://openalex.org/W3131488785","https://openalex.org/W3157122743","https://openalex.org/W3178436634","https://openalex.org/W3197465574","https://openalex.org/W3202776774","https://openalex.org/W3212929491","https://openalex.org/W4210545844","https://openalex.org/W4220740553","https://openalex.org/W4225795409","https://openalex.org/W4229027836","https://openalex.org/W4281698253","https://openalex.org/W4285120399","https://openalex.org/W4294672375","https://openalex.org/W4319017928","https://openalex.org/W4383753505","https://openalex.org/W4385624023","https://openalex.org/W4387870836","https://openalex.org/W4392151049","https://openalex.org/W4400880706","https://openalex.org/W4401502639","https://openalex.org/W4401990445","https://openalex.org/W4404558120"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2134539183","https://openalex.org/W2359209543","https://openalex.org/W2370801098","https://openalex.org/W2380475535","https://openalex.org/W2377112249","https://openalex.org/W4320027669","https://openalex.org/W3199479007"],"abstract_inverted_index":{"Nowadays,":[0],"the":[1,12,29,37,54,81,84,94,97,113,119,125,131,149,152,155,159,165,175,194,209,220],"use":[2,44],"of":[3,14,31,40,48,72,87,115,121,130,133,206],"Domain":[4],"Generation":[5],"Algorithm":[6],"(DGA)":[7],"in":[8,53,103,188,208],"botnets":[9],"has":[10,28,56,222],"made":[11],"detection":[13,66,153,179],"DGA":[15,63,88,145,176,198,214],"domain":[16,64,91,146,177,199,215],"names":[17,147,200],"very":[18],"important.":[19],"Compared":[20],"with":[21,181,201,231],"blacklist":[22],"and":[23,34,50,74,89,105,109,124,174,226,228],"character-based":[24],"detection,":[25],"traffic":[26,41,55,76,85],"analysis":[27,42],"advantages":[30],"small":[32],"datasets":[33],"vocabulary.":[35],"However,":[36],"current":[38],"research":[39],"mainly":[43],"a":[45,62,202],"single":[46],"type":[47],"traffic,":[49,111],"few":[51],"features":[52,71,102,156],"been":[57],"considered.":[58],"In":[59],"this":[60],"paper,":[61],"name":[65,92,178],"method":[67,98],"based":[68],"on":[69,80],"spatiotemporal":[70,140],"DNS":[73,108],"NetFlow":[75,110],"is":[77],"proposed.":[78],"Based":[79],"difference":[82],"between":[83],"performance":[86],"benign":[90],"after":[93],"attack":[95],"behavior,":[96],"selects":[99],"8":[100],"effective":[101],"time":[104],"space":[106],"from":[107,148,158],"including":[112,212],"number":[114],"user":[116,122],"IP":[117,136],"visits,":[118],"suddenness":[120],"access,":[123],"standard":[126],"deviation":[127],"mean":[128],"ratio":[129],"occurrence":[132],"each":[134],"resolved":[135],"address.":[137],"Using":[138],"these":[139],"features,":[141],"we":[142],"can":[143,196],"detect":[144,197],"network.":[150],"During":[151],"process,":[154],"extracted":[157],"training":[160],"set":[161],"were":[162],"put":[163],"into":[164],"C4.5":[166],"supervised":[167],"machine":[168],"learning":[169],"classification":[170,182],"model":[171,195,221],"for":[172],"training,":[173],"system":[180],"ability":[183],"was":[184],"obtained.":[185],"Experimental":[186],"results":[187],"China":[189],"Telecom":[190],"network":[191],"show":[192],"that":[193,219],"high":[203],"accuracy":[204],"rate":[205],"99.14%":[207],"actual":[210],"network,":[211],"anti-detection":[213],"names.":[216],"This":[217],"indicates":[218],"achieved":[223],"long-term":[224],"effectiveness":[225],"stability,":[227],"copes":[229],"well":[230],"adversarial":[232],"attacks.":[233]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}