{"id":"https://openalex.org/W2102283838","doi":"https://doi.org/10.1109/icnp.2010.5762763","title":"Identifying suspicious activities through DNS failure graph analysis","display_name":"Identifying suspicious activities through DNS failure graph analysis","publication_year":2010,"publication_date":"2010-10-01","ids":{"openalex":"https://openalex.org/W2102283838","doi":"https://doi.org/10.1109/icnp.2010.5762763","mag":"2102283838"},"language":"en","primary_location":{"id":"doi:10.1109/icnp.2010.5762763","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icnp.2010.5762763","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The 18th IEEE International Conference on Network Protocols","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101708323","display_name":"Nan Jiang","orcid":"https://orcid.org/0000-0002-5497-7007"},"institutions":[{"id":"https://openalex.org/I130238516","display_name":"University of Minnesota","ror":"https://ror.org/017zqws13","country_code":"US","type":"education","lineage":["https://openalex.org/I130238516"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nan Jiang","raw_affiliation_strings":["Computer Science Department, University of Minnesota, USA","Computer Science Dept., University of Minnesota, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Computer Science Department, University of Minnesota, USA","institution_ids":["https://openalex.org/I130238516"]},{"raw_affiliation_string":"Computer Science Dept., University of Minnesota, USA","institution_ids":["https://openalex.org/I130238516"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5048855340","display_name":"Jin Cao","orcid":"https://orcid.org/0000-0002-1247-4129"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jin Cao","raw_affiliation_strings":["Bell Laboratories, Alcatel-Lucent, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Bell Laboratories, Alcatel-Lucent, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101683942","display_name":"Yu Jin","orcid":"https://orcid.org/0009-0005-1248-0798"},"institutions":[{"id":"https://openalex.org/I130238516","display_name":"University of Minnesota","ror":"https://ror.org/017zqws13","country_code":"US","type":"education","lineage":["https://openalex.org/I130238516"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yu Jin","raw_affiliation_strings":["Computer Science Department, University of Minnesota, USA","Computer Science Dept., University of Minnesota, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Computer Science Department, University of Minnesota, USA","institution_ids":["https://openalex.org/I130238516"]},{"raw_affiliation_string":"Computer Science Dept., University of Minnesota, USA","institution_ids":["https://openalex.org/I130238516"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053710007","display_name":"Li Erran Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li Erran Li","raw_affiliation_strings":["Bell Laboratories, Alcatel-Lucent, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Bell Laboratories, Alcatel-Lucent, USA","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100622097","display_name":"Zhi-Li Zhang","orcid":"https://orcid.org/0000-0001-8584-2319"},"institutions":[{"id":"https://openalex.org/I130238516","display_name":"University of Minnesota","ror":"https://ror.org/017zqws13","country_code":"US","type":"education","lineage":["https://openalex.org/I130238516"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Zhi-Li Zhang","raw_affiliation_strings":["Computer Science Department, University of Minnesota, USA","Computer Science Dept., University of Minnesota, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Computer Science Department, University of Minnesota, USA","institution_ids":["https://openalex.org/I130238516"]},{"raw_affiliation_string":"Computer Science Dept., University of Minnesota, USA","institution_ids":["https://openalex.org/I130238516"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.1609,"has_fulltext":false,"cited_by_count":89,"citation_normalized_percentile":{"value":0.97582418,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"144","last_page":"153"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7128033638000488},{"id":"https://openalex.org/keywords/spamming","display_name":"Spamming","score":0.6447307467460632},{"id":"https://openalex.org/keywords/matrix-decomposition","display_name":"Matrix decomposition","score":0.5566081404685974},{"id":"https://openalex.org/keywords/domain-name-system","display_name":"Domain Name System","score":0.5285771489143372},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.46602535247802734},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4425739347934723},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.42329156398773193},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.3890681266784668},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.15014302730560303},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.09681132435798645}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7128033638000488},{"id":"https://openalex.org/C158955206","wikidata":"https://www.wikidata.org/wiki/Q83058","display_name":"Spamming","level":3,"score":0.6447307467460632},{"id":"https://openalex.org/C42355184","wikidata":"https://www.wikidata.org/wiki/Q1361088","display_name":"Matrix decomposition","level":3,"score":0.5566081404685974},{"id":"https://openalex.org/C35026560","wikidata":"https://www.wikidata.org/wiki/Q8767","display_name":"Domain Name System","level":3,"score":0.5285771489143372},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.46602535247802734},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4425739347934723},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.42329156398773193},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3890681266784668},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.15014302730560303},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.09681132435798645},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C158693339","wikidata":"https://www.wikidata.org/wiki/Q190524","display_name":"Eigenvalues and eigenvectors","level":2,"score":0.0},{"id":"https://openalex.org/C62520636","wikidata":"https://www.wikidata.org/wiki/Q944","display_name":"Quantum mechanics","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/icnp.2010.5762763","is_oa":false,"landing_page_url":"https://doi.org/10.1109/icnp.2010.5762763","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"The 18th IEEE International Conference on Network Protocols","raw_type":"proceedings-article"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.212.423","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.212.423","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.cs.umn.edu/~zhzhang/Papers/Jiang-leet10-paper29.pdf","raw_type":"text"},{"id":"pmh:oai:CiteSeerX.psu:10.1.1.366.4779","is_oa":false,"landing_page_url":"http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.366.4779","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"http://www.bell-labs.com/user/erranlli/publications/ICNP10.pdf","raw_type":"text"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":26,"referenced_works":["https://openalex.org/W80155331","https://openalex.org/W1481472066","https://openalex.org/W1816173724","https://openalex.org/W1922851884","https://openalex.org/W1962340579","https://openalex.org/W1987822783","https://openalex.org/W2030382024","https://openalex.org/W2043545458","https://openalex.org/W2096273775","https://openalex.org/W2100307718","https://openalex.org/W2112063328","https://openalex.org/W2122941797","https://openalex.org/W2136695760","https://openalex.org/W2147767253","https://openalex.org/W2155620999","https://openalex.org/W2158060559","https://openalex.org/W2159839388","https://openalex.org/W2167777553","https://openalex.org/W2296396094","https://openalex.org/W2396434032","https://openalex.org/W4237690029","https://openalex.org/W4244728148","https://openalex.org/W6603260413","https://openalex.org/W6628600657","https://openalex.org/W6640487242","https://openalex.org/W6641353988"],"related_works":["https://openalex.org/W1987732684","https://openalex.org/W2286465138","https://openalex.org/W637393809","https://openalex.org/W2808742736","https://openalex.org/W1526983901","https://openalex.org/W3126526144","https://openalex.org/W3021299372","https://openalex.org/W2184211279","https://openalex.org/W2346278349","https://openalex.org/W3139094847"],"abstract_inverted_index":{"As":[0],"a":[1,43,59,81,114,120,129],"key":[2],"approach":[3,47],"to":[4,92,167],"securing":[5],"large":[6,121],"networks,":[7],"existing":[8],"anomaly":[9,45],"detection":[10,46],"techniques":[11],"focus":[12],"primarily":[13],"on":[14,49,86],"network":[15],"traffic":[16],"data.":[17],"However,":[18],"the":[19,33,54,71,87,105,108,150,154],"sheer":[20],"volume":[21],"of":[22,35,131,153],"such":[23],"data":[24],"often":[25,143],"renders":[26],"detailed":[27],"analysis":[28],"very":[29],"expensive":[30],"and":[31,75],"reduces":[32],"effectiveness":[34],"these":[36,126,141],"tools.":[37],"In":[38,139],"this":[39],"paper,":[40],"we":[41,124,156],"propose":[42],"light-weight":[44],"based":[48,85],"unproductive":[50],"DNS":[51,56,63,67,100,110,116],"traffic,":[52],"namely,":[53],"failed":[55,76],"queries,":[57],"with":[58],"novel":[60],"tool":[61],"-":[62],"failure":[64,68,101,111],"graphs.":[65,102],"A":[66],"graph":[69,82],"captures":[70],"interactions":[72],"between":[73],"hosts":[74],"domain":[77],"names.":[78],"We":[79],"apply":[80],"decomposition":[83],"algorithm":[84],"tri-nonnegative":[88],"matrix":[89],"factorization":[90],"technique":[91],"iteratively":[93],"extract":[94],"coherent":[95],"co-clusters":[96,106,127],"(dense":[97],"subgraphs)":[98],"from":[99,113],"By":[103,148],"analyzing":[104],"in":[107],"daily":[109],"graphs":[112],"3-month":[115],"trace":[117],"captured":[118],"at":[119],"campus":[122],"network,":[123],"find":[125],"represent":[128],"variety":[130],"anomalous":[132],"activities,":[133],"e.g.,":[134],"spamming,":[135],"trojans,":[136],"bots,":[137],"etc..":[138],"addition,":[140],"activities":[142],"exhibit":[144],"distinguishable":[145],"subgraph":[146],"structures.":[147],"exploring":[149],"temporal":[151],"properties":[152],"co-clusters,":[155],"show":[157],"our":[158],"method":[159],"can":[160],"identify":[161],"new":[162],"anomalies":[163],"that":[164],"likely":[165],"correspond":[166],"unreported":[168],"domain-flux":[169],"bots.":[170]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":4},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":8},{"year":2019,"cited_by_count":7},{"year":2018,"cited_by_count":14},{"year":2017,"cited_by_count":7},{"year":2016,"cited_by_count":6},{"year":2015,"cited_by_count":5},{"year":2014,"cited_by_count":9},{"year":2013,"cited_by_count":11},{"year":2012,"cited_by_count":7}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}