{"id":"https://openalex.org/W2822659226","doi":"https://doi.org/10.1109/noms.2018.8406222","title":"Melting the snow: Using active DNS measurements to detect snowshoe spam domains","display_name":"Melting the snow: Using active DNS measurements to detect snowshoe spam domains","publication_year":2018,"publication_date":"2018-04-01","ids":{"openalex":"https://openalex.org/W2822659226","doi":"https://doi.org/10.1109/noms.2018.8406222","mag":"2822659226"},"language":"en","primary_location":{"id":"doi:10.1109/noms.2018.8406222","is_oa":false,"landing_page_url":"https://doi.org/10.1109/noms.2018.8406222","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5076772757","display_name":"Olivier van der Toorn","orcid":"https://orcid.org/0000-0002-1610-7086"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":true,"raw_author_name":"Olivier van der Toorn","raw_affiliation_strings":["University of Twente"],"affiliations":[{"raw_affiliation_string":"University of Twente","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5091643049","display_name":"Roland van Rijswijk-Deij","orcid":"https://orcid.org/0000-0002-0249-8776"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Roland van Rijswijk-Deij","raw_affiliation_strings":["University of Twente"],"affiliations":[{"raw_affiliation_string":"University of Twente","institution_ids":["https://openalex.org/I94624287"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063615849","display_name":"Bart Geesink","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Bart Geesink","raw_affiliation_strings":["SURFnet"],"affiliations":[{"raw_affiliation_string":"SURFnet","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5025537461","display_name":"Anna Sperotto","orcid":"https://orcid.org/0000-0002-9481-5846"},"institutions":[{"id":"https://openalex.org/I94624287","display_name":"University of Twente","ror":"https://ror.org/006hf6230","country_code":"NL","type":"education","lineage":["https://openalex.org/I94624287"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Anna Sperotto","raw_affiliation_strings":["University of Twente"],"affiliations":[{"raw_affiliation_string":"University of Twente","institution_ids":["https://openalex.org/I94624287"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5076772757"],"corresponding_institution_ids":["https://openalex.org/I94624287"],"apc_list":null,"apc_paid":null,"fwci":2.4607,"has_fulltext":false,"cited_by_count":16,"citation_normalized_percentile":{"value":0.91710274,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":90,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"9"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/namespace","display_name":"Namespace","score":0.8080429434776306},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6598939895629883},{"id":"https://openalex.org/keywords/spambot","display_name":"Spambot","score":0.6555386781692505},{"id":"https://openalex.org/keywords/forum-spam","display_name":"Forum spam","score":0.5536051988601685},{"id":"https://openalex.org/keywords/domain-name-system","display_name":"Domain Name System","score":0.5430150032043457},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.48342621326446533},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.44748058915138245},{"id":"https://openalex.org/keywords/spamming","display_name":"Spamming","score":0.3992767333984375},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.3277342915534973},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.19395774602890015},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.1859646737575531}],"concepts":[{"id":"https://openalex.org/C2778383056","wikidata":"https://www.wikidata.org/wiki/Q873636","display_name":"Namespace","level":2,"score":0.8080429434776306},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6598939895629883},{"id":"https://openalex.org/C127735637","wikidata":"https://www.wikidata.org/wiki/Q2306702","display_name":"Spambot","level":4,"score":0.6555386781692505},{"id":"https://openalex.org/C157310412","wikidata":"https://www.wikidata.org/wiki/Q3140915","display_name":"Forum spam","level":5,"score":0.5536051988601685},{"id":"https://openalex.org/C35026560","wikidata":"https://www.wikidata.org/wiki/Q8767","display_name":"Domain Name System","level":3,"score":0.5430150032043457},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.48342621326446533},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.44748058915138245},{"id":"https://openalex.org/C158955206","wikidata":"https://www.wikidata.org/wiki/Q83058","display_name":"Spamming","level":3,"score":0.3992767333984375},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3277342915534973},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.19395774602890015},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.1859646737575531}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/noms.2018.8406222","is_oa":false,"landing_page_url":"https://doi.org/10.1109/noms.2018.8406222","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium","raw_type":"proceedings-article"},{"id":"pmh:oai:ris.utwente.nl:openaire_cris_publications/4f31683d-a1ae-460f-9350-0e126224c937","is_oa":false,"landing_page_url":"https://research.utwente.nl/en/publications/4f31683d-a1ae-460f-9350-0e126224c937","pdf_url":null,"source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"van der Toorn, O I, van Rijswijk, R M, Geesink, B & Sperotto, A 2018, Melting the Snow : Using Active DNS Measurements to Detect Snowshoe Spam Domains. in IEEE/IFIP Network Operations and Management Symposium : Cognitive Management in a Cyber World, NOMS 2018. IEEE, pp. 1-9, 16th IEEE/IFIP Network Operations and Management Symposium 2018, Taipei, Taiwan, 23/04/18. https://doi.org/10.1109/NOMS.2018.8406222","raw_type":"info:eu-repo/semantics/publishedVersion"},{"id":"pmh:oai:ris.utwente.nl:publications/4f31683d-a1ae-460f-9350-0e126224c937","is_oa":false,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922991","display_name":"University of Twente Research Information","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":""}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.75,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":38,"referenced_works":["https://openalex.org/W155384935","https://openalex.org/W178883471","https://openalex.org/W1479710165","https://openalex.org/W1484485089","https://openalex.org/W1680392829","https://openalex.org/W1925668703","https://openalex.org/W1954903228","https://openalex.org/W1985637793","https://openalex.org/W1989284546","https://openalex.org/W1990497396","https://openalex.org/W2025899538","https://openalex.org/W2101234009","https://openalex.org/W2101737524","https://openalex.org/W2106766484","https://openalex.org/W2107425660","https://openalex.org/W2169384781","https://openalex.org/W2171622762","https://openalex.org/W2344804892","https://openalex.org/W2401054255","https://openalex.org/W2416956265","https://openalex.org/W2513658109","https://openalex.org/W2533677686","https://openalex.org/W2577243451","https://openalex.org/W2777314978","https://openalex.org/W2901987353","https://openalex.org/W2952524191","https://openalex.org/W4285719527","https://openalex.org/W4298643854","https://openalex.org/W6606342502","https://openalex.org/W6607397046","https://openalex.org/W6637386731","https://openalex.org/W6640663528","https://openalex.org/W6675354045","https://openalex.org/W6676211022","https://openalex.org/W6676236601","https://openalex.org/W6684907601","https://openalex.org/W6713023146","https://openalex.org/W6716942405"],"related_works":["https://openalex.org/W2018000323","https://openalex.org/W2095720311","https://openalex.org/W2403960249","https://openalex.org/W2898345088","https://openalex.org/W2080521416","https://openalex.org/W1937320931","https://openalex.org/W2075252441","https://openalex.org/W1502194589","https://openalex.org/W1965586806","https://openalex.org/W4293384513"],"abstract_inverted_index":{"Snowshoe":[0],"spam":[1,6,19,35,45,170],"is":[2,8],"a":[3,128,173,185,207,234,244],"type":[4],"of":[5,18,34,134,142,175,188,221],"that":[7,16,109,163,254],"notoriously":[9],"hard":[10],"to":[11,41,54,77,92,107,152,167,183,193,217,226,265],"detect.":[12],"Anti-abuse":[13],"vendors":[14],"estimate":[15],"15%":[17],"can":[20,204],"be":[21,50],"classified":[22],"as":[23,56,58,68],"snowshoe":[24,30,158,169],"spam.":[25,94,159,214],"Differently":[26],"from":[27],"regular":[28],"spam,":[29],"spammers":[31,52,76],"distribute":[32],"sending":[33],"over":[36,176,233],"many":[37],"hosts,":[38],"in":[39,147,210,224,237,258,269],"order":[40],"evade":[42],"detection":[43,106],"by":[44,62],"reputation":[46],"systems":[47],"(blacklists).":[48],"To":[49,122],"successful":[51],"need":[53],"appear":[55],"legitimate":[57,81],"possible,":[59],"for":[60,157],"example,":[61],"adopting":[63],"email":[64],"best":[65],"practices,":[66],"such":[67],"the":[69,143,189,211,219,260,273],"Sender":[70],"Policy":[71],"Framework":[72],"(SPF).":[73],"This":[74,104],"requires":[75],"register":[78],"and":[79,114],"configure":[80],"DNS":[82,90,102,120,136,145],"domains.":[83],"Many":[84],"previous":[85],"studies":[86],"have":[87,110,115],"relied":[88],"on":[89,100,118,272],"data":[91],"detect":[93,168,184],"However,":[95],"this":[96,124,252],"often":[97],"happens":[98],"based":[99,271],"passive":[101,119],"data.":[103],"limits":[105],"domains":[108,155,171,191],"actually":[111,263],"been":[112,116],"used":[113],"observed":[117],"sensors.":[121],"overcome":[123],"limitation,":[125],"we":[126,164,180,229],"take":[127],"different":[129],"approach.":[130],"We":[131],"make":[132],"use":[133],"active":[135],"measurements,":[137],"covering":[138],"more":[139],"than":[140,197],"60%":[141],"global":[144],"namespace,":[146],"combination":[148],"with":[149,172],"machine":[150],"learning":[151],"identify":[153],"malicious":[154,190],"crafted":[156],"Our":[160],"results":[161,274],"show":[162],"are":[165,181],"able":[166,182],"precision":[174],"93%.":[177],"More":[178],"importantly,":[179],"significant":[186],"fraction":[187],"up":[192],"100":[194],"days":[195],"earlier":[196],"existing":[198,227],"blacklists,":[199,228],"which":[200],"suggests":[201],"our":[202,222,231,255,267],"method":[203,268],"give":[205],"us":[206],"time":[208],"advantage":[209],"fight":[212],"against":[213],"In":[215],"addition":[216],"testing":[218],"efficacy":[220],"approach":[223,232,256],"comparison":[225],"validated":[230],"3-month":[235],"period":[236],"an":[238],"actual":[239],"mail":[240],"filter":[241],"system":[242],"at":[243],"major":[245],"Dutch":[246],"network":[247],"operator.":[248],"Not":[249],"only":[250],"did":[251],"demonstrate":[253],"works":[257],"practice,":[259],"operator":[261],"has":[262],"decided":[264],"deploy":[266],"production,":[270],"obtained.":[275]},"counts_by_year":[{"year":2025,"cited_by_count":2},{"year":2023,"cited_by_count":4},{"year":2022,"cited_by_count":4},{"year":2021,"cited_by_count":2},{"year":2020,"cited_by_count":2},{"year":2019,"cited_by_count":1},{"year":2018,"cited_by_count":1}],"updated_date":"2026-03-12T08:34:05.389933","created_date":"2025-10-10T00:00:00"}