{"id":"https://openalex.org/W1997984797","doi":"https://doi.org/10.1109/jsac.2014.2358814","title":"Detect Fast-Flux Domains Through Response Time Differences","display_name":"Detect Fast-Flux Domains Through Response Time Differences","publication_year":2014,"publication_date":"2014-09-19","ids":{"openalex":"https://openalex.org/W1997984797","doi":"https://doi.org/10.1109/jsac.2014.2358814","mag":"1997984797"},"language":"en","primary_location":{"id":"doi:10.1109/jsac.2014.2358814","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jsac.2014.2358814","pdf_url":null,"source":{"id":"https://openalex.org/S90422530","display_name":"IEEE Journal on Selected Areas in Communications","issn_l":"0733-8716","issn":["0733-8716","1558-0008"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Journal on Selected Areas in Communications","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5024320548","display_name":"Fu\u2010Hau Hsu","orcid":"https://orcid.org/0000-0002-2586-5874"},"institutions":[{"id":"https://openalex.org/I22265921","display_name":"National Central University","ror":"https://ror.org/00944ve71","country_code":"TW","type":"education","lineage":["https://openalex.org/I22265921"]}],"countries":["TW"],"is_corresponding":true,"raw_author_name":"Fu-Hau Hsu","raw_affiliation_strings":["National Central University, Jhongli, Taiwan","National Central University , Jhongli, Taiwan"],"affiliations":[{"raw_affiliation_string":"National Central University, Jhongli, Taiwan","institution_ids":["https://openalex.org/I22265921"]},{"raw_affiliation_string":"National Central University , Jhongli, Taiwan","institution_ids":["https://openalex.org/I22265921"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111610435","display_name":"Chuan-Sheng Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I22265921","display_name":"National Central University","ror":"https://ror.org/00944ve71","country_code":"TW","type":"education","lineage":["https://openalex.org/I22265921"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Chuan-Sheng Wang","raw_affiliation_strings":["Department of Computer Science and Information Engineering, National Central University, Jhongli, Taiwan","[Department of Computer Science and information Engineering, National Central University, Jhongli, Taiwan]"],"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Information Engineering, National Central University, Jhongli, Taiwan","institution_ids":["https://openalex.org/I22265921"]},{"raw_affiliation_string":"[Department of Computer Science and information Engineering, National Central University, Jhongli, Taiwan]","institution_ids":["https://openalex.org/I22265921"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5070556000","display_name":"Chi\u2010Hsien Hsu","orcid":null},"institutions":[{"id":"https://openalex.org/I22265921","display_name":"National Central University","ror":"https://ror.org/00944ve71","country_code":"TW","type":"education","lineage":["https://openalex.org/I22265921"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Chi-Hsien Hsu","raw_affiliation_strings":["National Central University, Jhongli, Taiwan","National Central University , Jhongli, Taiwan"],"affiliations":[{"raw_affiliation_string":"National Central University, Jhongli, Taiwan","institution_ids":["https://openalex.org/I22265921"]},{"raw_affiliation_string":"National Central University , Jhongli, Taiwan","institution_ids":["https://openalex.org/I22265921"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008868930","display_name":"Chang\u2010Kuo Tso","orcid":null},"institutions":[{"id":"https://openalex.org/I22265921","display_name":"National Central University","ror":"https://ror.org/00944ve71","country_code":"TW","type":"education","lineage":["https://openalex.org/I22265921"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Chang-Kuo Tso","raw_affiliation_strings":["National Central University, Jhongli, Taiwan","National Central University , Jhongli, Taiwan"],"affiliations":[{"raw_affiliation_string":"National Central University, Jhongli, Taiwan","institution_ids":["https://openalex.org/I22265921"]},{"raw_affiliation_string":"National Central University , Jhongli, Taiwan","institution_ids":["https://openalex.org/I22265921"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101561804","display_name":"Lihan Chen","orcid":"https://orcid.org/0000-0003-0807-9684"},"institutions":[{"id":"https://openalex.org/I22265921","display_name":"National Central University","ror":"https://ror.org/00944ve71","country_code":"TW","type":"education","lineage":["https://openalex.org/I22265921"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Li-Han Chen","raw_affiliation_strings":["National Central University, Jhongli, Taiwan","National Central University , Jhongli, Taiwan"],"affiliations":[{"raw_affiliation_string":"National Central University, Jhongli, Taiwan","institution_ids":["https://openalex.org/I22265921"]},{"raw_affiliation_string":"National Central University , Jhongli, Taiwan","institution_ids":["https://openalex.org/I22265921"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5025396592","display_name":"Song-Hui Lin","orcid":null},"institutions":[{"id":"https://openalex.org/I22265921","display_name":"National Central University","ror":"https://ror.org/00944ve71","country_code":"TW","type":"education","lineage":["https://openalex.org/I22265921"]}],"countries":["TW"],"is_corresponding":false,"raw_author_name":"Song-Hui Lin","raw_affiliation_strings":["National Central University, Jhongli, Taiwan","National Central University , Jhongli, Taiwan"],"affiliations":[{"raw_affiliation_string":"National Central University, Jhongli, Taiwan","institution_ids":["https://openalex.org/I22265921"]},{"raw_affiliation_string":"National Central University , Jhongli, Taiwan","institution_ids":["https://openalex.org/I22265921"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":6,"corresponding_author_ids":["https://openalex.org/A5024320548"],"corresponding_institution_ids":["https://openalex.org/I22265921"],"apc_list":null,"apc_paid":null,"fwci":1.0344,"has_fulltext":false,"cited_by_count":15,"citation_normalized_percentile":{"value":0.78894646,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":97},"biblio":{"volume":"32","issue":"10","first_page":"1947","last_page":"1956"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9991999864578247,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8213490843772888},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.5944949388504028},{"id":"https://openalex.org/keywords/metric","display_name":"Metric (unit)","score":0.5592799186706543},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.5487962961196899},{"id":"https://openalex.org/keywords/flux","display_name":"Flux (metallurgy)","score":0.47557416558265686},{"id":"https://openalex.org/keywords/time-domain","display_name":"Time domain","score":0.4356400966644287},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.4199764132499695},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.3693162202835083},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.35245490074157715},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.3297714591026306},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.13751843571662903},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.11214342713356018}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8213490843772888},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.5944949388504028},{"id":"https://openalex.org/C176217482","wikidata":"https://www.wikidata.org/wiki/Q860554","display_name":"Metric (unit)","level":2,"score":0.5592799186706543},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.5487962961196899},{"id":"https://openalex.org/C68709404","wikidata":"https://www.wikidata.org/wiki/Q1134475","display_name":"Flux (metallurgy)","level":2,"score":0.47557416558265686},{"id":"https://openalex.org/C103824480","wikidata":"https://www.wikidata.org/wiki/Q185889","display_name":"Time domain","level":2,"score":0.4356400966644287},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.4199764132499695},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3693162202835083},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.35245490074157715},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3297714591026306},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.13751843571662903},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.11214342713356018},{"id":"https://openalex.org/C21547014","wikidata":"https://www.wikidata.org/wiki/Q1423657","display_name":"Operations management","level":1,"score":0.0},{"id":"https://openalex.org/C31972630","wikidata":"https://www.wikidata.org/wiki/Q844240","display_name":"Computer vision","level":1,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C192562407","wikidata":"https://www.wikidata.org/wiki/Q228736","display_name":"Materials science","level":0,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.0},{"id":"https://openalex.org/C191897082","wikidata":"https://www.wikidata.org/wiki/Q11467","display_name":"Metallurgy","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/jsac.2014.2358814","is_oa":false,"landing_page_url":"https://doi.org/10.1109/jsac.2014.2358814","pdf_url":null,"source":{"id":"https://openalex.org/S90422530","display_name":"IEEE Journal on Selected Areas in Communications","issn_l":"0733-8716","issn":["0733-8716","1558-0008"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Journal on Selected Areas in Communications","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2225360599","display_name":null,"funder_award_id":"NSC 100-2218-E-008-013-MY3","funder_id":"https://openalex.org/F4320321040","funder_display_name":"National Science Council"},{"id":"https://openalex.org/G3005035253","display_name":null,"funder_award_id":"NSC 101-2221-E-008-028-MY2","funder_id":"https://openalex.org/F4320321040","funder_display_name":"National Science Council"},{"id":"https://openalex.org/G6303146630","display_name":null,"funder_award_id":"NSC 103-2623-E-008-003-D","funder_id":"https://openalex.org/F4320321040","funder_display_name":"National Science Council"}],"funders":[{"id":"https://openalex.org/F4320321040","display_name":"National Science Council","ror":"https://ror.org/02kv4zf79"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W80155331","https://openalex.org/W155384935","https://openalex.org/W1523098686","https://openalex.org/W1954903228","https://openalex.org/W2011491417","https://openalex.org/W2101737524","https://openalex.org/W2121253192","https://openalex.org/W2122941797","https://openalex.org/W2149701633","https://openalex.org/W2159636195","https://openalex.org/W6603260413","https://openalex.org/W6606342502","https://openalex.org/W6631155460","https://openalex.org/W6640663528","https://openalex.org/W6683728023"],"related_works":["https://openalex.org/W2294483539","https://openalex.org/W2378449000","https://openalex.org/W3187581118","https://openalex.org/W3143747655","https://openalex.org/W2002178493","https://openalex.org/W2901835651","https://openalex.org/W2883616266","https://openalex.org/W186576250","https://openalex.org/W2372254325","https://openalex.org/W2388837172"],"abstract_inverted_index":{"A":[0,173],"fast-flux":[1,14,155,199],"service":[2],"network":[3,28,96,264],"(FFSN)":[4],"uses":[5,23],"dynamic":[6,11,100,111],"DNS":[7,101,112],"to":[8,18,26,31,35,50,61,74,84,91,102,113,126,148,234],"map":[9],"a":[10,81,86,118,142,162,176,215,221,237,247],"domain,":[12],"called":[13,154],"domain":[15,129,156,238],"(FF":[16],"domain),":[17],"various":[19,52],"IP":[20],"addresses":[21],"and":[22,220],"flux":[24,42],"bots":[25],"redirect":[27],"traffic.":[29],"Due":[30],"its":[32],"powerful":[33],"capability":[34],"conceal":[36],"the":[37,41,67,104,120,135],"hosts":[38],"hidden":[39],"behind":[40],"bots,":[43],"FFSNs":[44,109],"are":[45,195],"widely":[46],"adopted":[47],"by":[48],"attackers":[49],"cover":[51],"scams.":[53],"Although":[54],"diverse":[55],"promising":[56],"solutions":[57],"have":[58],"been":[59],"proposed":[60],"detect":[62,149,210],"FF":[63,128,150,211,241],"domains,":[64],"they":[65,194],"face":[66],"same":[68],"problem-different":[69],"countermeasures":[70],"could":[71,165],"be":[72,166,183],"used":[73,160],"bypass":[75],"their":[76,107],"detection.":[77],"Hence,":[78],"it":[79,252],"becomes":[80,130],"critical":[82],"issue":[83],"develop":[85],"new":[87,143],"detection":[88],"solution.":[89],"According":[90],"our":[92],"survey,":[93],"unlike":[94],"normal":[95],"services":[97],"that":[98,164,206],"use":[99],"balance":[103],"workloads":[105],"of":[106,123,178],"hosts,":[108],"utilize":[110],"hide":[114],"important":[115],"bots.":[116],"As":[117],"result,":[119],"response":[121,136],"time":[122,137],"subsequent":[124],"requests":[125],"an":[127,167,171,240,259],"more":[131],"fluctuating.":[132],"Based":[133],"on":[134,161],"differences,":[138],"this":[139],"paper":[140],"develops":[141],"metric,":[144],"Fast-Flux":[145],"Score":[146],"(FF-Score),":[147],"domains.":[151],"Our":[152],"system,":[153],"detector":[157],"(FFDD),":[158],"is":[159,239,246],"computer":[163],"end":[168],"host":[169],"or":[170,187,198,261],"IDS.":[172],"user":[174],"with":[175,213],"set":[177],"unknown":[179],"URLs,":[180],"which":[181],"may":[182],"obtained":[184],"from":[185,258],"spam":[186],"social":[188],"networks,":[189],"can":[190,208],"simply":[191],"determine":[192,235],"whether":[193,236],"benign":[196],"domains":[197,212],"ones":[200],"using":[201],"FFDD.":[202],"Experimental":[203],"results":[204],"show":[205],"FFDD":[207,233,245],"accurately":[209],"only":[214],"0.3%":[216],"false":[217,223],"positive":[218],"rate":[219],"2%":[222],"negative":[224],"rate.":[225],"It":[226],"takes":[227],"less":[228],"than":[229],"20":[230],"min":[231],"for":[232],"domain.":[242],"In":[243],"addition,":[244],"lightweight":[248],"stand-alone":[249],"system;":[250],"hence,":[251],"does":[253],"not":[254],"require":[255],"special":[256],"support":[257],"ISP":[260],"any":[262],"other":[263],"service.":[265]},"counts_by_year":[{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":1},{"year":2020,"cited_by_count":3},{"year":2019,"cited_by_count":1},{"year":2018,"cited_by_count":3},{"year":2017,"cited_by_count":1},{"year":2015,"cited_by_count":2}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}