{"id":"https://openalex.org/W2999681325","doi":"https://doi.org/10.1109/ipccc47392.2019.8958714","title":"A Byte-level CNN Method to Detect DNS Tunnels","display_name":"A Byte-level CNN Method to Detect DNS Tunnels","publication_year":2019,"publication_date":"2019-10-01","ids":{"openalex":"https://openalex.org/W2999681325","doi":"https://doi.org/10.1109/ipccc47392.2019.8958714","mag":"2999681325"},"language":"en","primary_location":{"id":"doi:10.1109/ipccc47392.2019.8958714","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ipccc47392.2019.8958714","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2019 IEEE 38th International Performance Computing and Communications Conference (IPCCC)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5100353359","display_name":"Chang Liu","orcid":"https://orcid.org/0000-0003-3094-8153"},"institutions":[{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chang Liu","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences,Beijing,China","Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences,Beijing,China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I4210165038"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101988313","display_name":"Liang Dai","orcid":"https://orcid.org/0000-0002-5959-6828"},"institutions":[{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Liang Dai","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences,Beijing,China","Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences,Beijing,China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I4210165038"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I4210165038"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023309071","display_name":"Wenjing Cui","orcid":"https://orcid.org/0000-0003-3058-2403"},"institutions":[{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wenjing Cui","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences,Beijing,China","Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences,Beijing,China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I4210165038"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I4210165038"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5101944426","display_name":"Tao Lin","orcid":"https://orcid.org/0000-0003-1170-636X"},"institutions":[{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]},{"id":"https://openalex.org/I4210165038","display_name":"University of Chinese Academy of Sciences","ror":"https://ror.org/05qbk4x57","country_code":"CN","type":"education","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210165038"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tao Lin","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences,Beijing,China","Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences,Beijing,China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I4210165038"]},{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I4210165038"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":36,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"8"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12326","display_name":"Network Packet Processing and Optimization","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/byte","display_name":"Byte","score":0.8772335052490234},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8573137521743774},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.6387276649475098},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.5372943878173828},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.530865490436554},{"id":"https://openalex.org/keywords/convolutional-neural-network","display_name":"Convolutional neural network","score":0.519113302230835},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.5138952732086182},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.4585030674934387},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.4402107298374176},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.42490434646606445},{"id":"https://openalex.org/keywords/deep-packet-inspection","display_name":"Deep packet inspection","score":0.4140050411224365},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.1811242401599884},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.13935905694961548}],"concepts":[{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.8772335052490234},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8573137521743774},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.6387276649475098},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.5372943878173828},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.530865490436554},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.519113302230835},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5138952732086182},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4585030674934387},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4402107298374176},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.42490434646606445},{"id":"https://openalex.org/C204679922","wikidata":"https://www.wikidata.org/wiki/Q734252","display_name":"Deep packet inspection","level":3,"score":0.4140050411224365},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.1811242401599884},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.13935905694961548},{"id":"https://openalex.org/C138885662","wikidata":"https://www.wikidata.org/wiki/Q5891","display_name":"Philosophy","level":0,"score":0.0},{"id":"https://openalex.org/C41895202","wikidata":"https://www.wikidata.org/wiki/Q8162","display_name":"Linguistics","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ipccc47392.2019.8958714","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ipccc47392.2019.8958714","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2019 IEEE 38th International Performance Computing and Communications Conference (IPCCC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":25,"referenced_works":["https://openalex.org/W85558978","https://openalex.org/W2004078625","https://openalex.org/W2036286049","https://openalex.org/W2170240176","https://openalex.org/W2326113404","https://openalex.org/W2460937040","https://openalex.org/W2518011484","https://openalex.org/W2595170736","https://openalex.org/W2631977690","https://openalex.org/W2754468074","https://openalex.org/W2755348785","https://openalex.org/W2783007605","https://openalex.org/W2787538540","https://openalex.org/W2796585196","https://openalex.org/W2963012544","https://openalex.org/W2963379686","https://openalex.org/W2987823657","https://openalex.org/W4295186723","https://openalex.org/W4300511536","https://openalex.org/W6685053522","https://openalex.org/W6719080892","https://openalex.org/W6739656747","https://openalex.org/W6743929116","https://openalex.org/W6748384357","https://openalex.org/W6749792608"],"related_works":["https://openalex.org/W1574986946","https://openalex.org/W1497214516","https://openalex.org/W1971040605","https://openalex.org/W1523103140","https://openalex.org/W4293863310","https://openalex.org/W3160314615","https://openalex.org/W1488288477","https://openalex.org/W4226031521","https://openalex.org/W2381288267","https://openalex.org/W2155469080"],"abstract_inverted_index":{"DNS":[0,23,35,66,108,122,132,166],"tunnel":[1],"is":[2,204],"a":[3,73,112],"technology":[4],"used":[5],"to":[6,48,61,64,78,93,119,130,145],"bypass":[7],"firewalls":[8,19],"for":[9,136],"data":[10,55,144],"exfiltration.":[11],"It":[12],"takes":[13],"advantage":[14],"of":[15,18,27,34,40,51,75,97,107],"the":[16,28,32,38,49,85,95,104,121,137,141,146,164,169,188,198],"characteristic":[17],"that":[20,187],"always":[21],"allow":[22],"traffic":[24,41],"pass.":[25],"Most":[26],"studies":[29],"have":[30],"realized":[31],"detection":[33,70,86,105,189],"tunnels":[36,123],"from":[37],"perspective":[39],"and":[42,54,80,84,102,171,178,191,197],"payload.":[43],"In":[44,91],"recent":[45],"years,":[46],"due":[47],"popularity":[50],"machine":[52,152],"learning":[53,114,153],"mining":[56],"methods,":[57,154],"researchers":[58],"began":[59],"trying":[60],"use":[62],"them":[63],"detect":[65,120],"tunnels.":[67],"However,":[68],"these":[69],"methods":[71],"require":[72],"lot":[74],"professional":[76],"knowledge":[77],"extract":[79],"construct":[81],"feature":[82,99,201],"set,":[83],"results":[87],"are":[88,194],"often":[89],"unsatisfactory.":[90],"order":[92],"solve":[94],"problem":[96],"manual":[98,200],"extraction":[100,202],"limitation":[101],"improve":[103],"accuracy":[106,190],"tunnels,":[109],"we":[110,128],"propose":[111,129],"deep":[113],"method,":[115],"called":[116],"Byte-level":[117],"CNN,":[118],"in":[124,163],"this":[125],"paper.":[126],"Furthermore,":[127],"represent":[131],"packets":[133],"with":[134,150],"bytes":[135],"first":[138],"time,":[139],"as":[140,206],"converted":[142],"computable":[143],"CNN":[147,157],"model.":[148],"Compared":[149],"traditional":[151],"our":[155],"byte-level":[156],"method":[158],"can":[159],"learn":[160],"full":[161],"information":[162],"whole":[165],"packets,":[167],"especially":[168],"sequential":[170],"structural":[172],"information,":[173,177],"besides":[174],"common":[175],"statistical":[176],"therefore":[179],"achieves":[180],"good":[181],"performance":[182],"results.":[183],"The":[184],"simulation":[185],"showed":[186],"recall":[192],"rate":[193],"significantly":[195],"improved,":[196],"complex":[199],"process":[203],"avoided":[205],"well.":[207]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":10},{"year":2022,"cited_by_count":12},{"year":2021,"cited_by_count":5},{"year":2020,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}