{"id":"https://openalex.org/W2020372509","doi":"https://doi.org/10.1109/ntms.2014.6814008","title":"Characterization of Covert Channels in DNS","display_name":"Characterization of Covert Channels in DNS","publication_year":2014,"publication_date":"2014-03-01","ids":{"openalex":"https://openalex.org/W2020372509","doi":"https://doi.org/10.1109/ntms.2014.6814008","mag":"2020372509"},"language":"en","primary_location":{"id":"doi:10.1109/ntms.2014.6814008","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ntms.2014.6814008","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2014 6th International Conference on New Technologies, Mobility and Security (NTMS)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5059687788","display_name":"Hamad Binsalleeh","orcid":"https://orcid.org/0000-0002-0886-6314"},"institutions":[{"id":"https://openalex.org/I4387154007","display_name":"Digital Research Alliance of Canada","ror":"https://ror.org/010r6td27","country_code":null,"type":"funder","lineage":["https://openalex.org/I4387154007"]},{"id":"https://openalex.org/I4210154246","display_name":"Canadian Arthritis Patient Alliance","ror":"https://ror.org/04hfnps81","country_code":"CA","type":"nonprofit","lineage":["https://openalex.org/I4210154246"]}],"countries":["CA"],"is_corresponding":true,"raw_author_name":"Hamad Binsalleeh","raw_affiliation_strings":["Nat. Cyber Forensics & Training Alliance Canada, Montreal, QC, Canada"],"affiliations":[{"raw_affiliation_string":"Nat. Cyber Forensics & Training Alliance Canada, Montreal, QC, Canada","institution_ids":["https://openalex.org/I4210154246","https://openalex.org/I4387154007"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5078013591","display_name":"A. Mert Kara","orcid":null},"institutions":[{"id":"https://openalex.org/I4387154007","display_name":"Digital Research Alliance of Canada","ror":"https://ror.org/010r6td27","country_code":null,"type":"funder","lineage":["https://openalex.org/I4387154007"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"A. Mert Kara","raw_affiliation_strings":["National Cyber Forensics and Training Alliance, Canada"],"affiliations":[{"raw_affiliation_string":"National Cyber Forensics and Training Alliance, Canada","institution_ids":["https://openalex.org/I4387154007"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085765243","display_name":"Amr Youssef","orcid":"https://orcid.org/0000-0002-4284-8646"},"institutions":[{"id":"https://openalex.org/I4210148195","display_name":"Concordia University","ror":"https://ror.org/04dwckp88","country_code":"US","type":"education","lineage":["https://openalex.org/I4210148195"]},{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA","US"],"is_corresponding":false,"raw_author_name":"Amr Youssef","raw_affiliation_strings":["Concordia University, Montreal, QC, CA"],"affiliations":[{"raw_affiliation_string":"Concordia University, Montreal, QC, CA","institution_ids":["https://openalex.org/I60158472","https://openalex.org/I4210148195"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5028605138","display_name":"Mourad Debbabi","orcid":"https://orcid.org/0000-0003-3015-3043"},"institutions":[{"id":"https://openalex.org/I4210154246","display_name":"Canadian Arthritis Patient Alliance","ror":"https://ror.org/04hfnps81","country_code":"CA","type":"nonprofit","lineage":["https://openalex.org/I4210154246"]},{"id":"https://openalex.org/I4387154007","display_name":"Digital Research Alliance of Canada","ror":"https://ror.org/010r6td27","country_code":null,"type":"funder","lineage":["https://openalex.org/I4387154007"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Mourad Debbabi","raw_affiliation_strings":["Nat. Cyber Forensics & Training Alliance Canada, Montreal, QC, Canada"],"affiliations":[{"raw_affiliation_string":"Nat. Cyber Forensics & Training Alliance Canada, Montreal, QC, Canada","institution_ids":["https://openalex.org/I4210154246","https://openalex.org/I4387154007"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5059687788"],"corresponding_institution_ids":["https://openalex.org/I4210154246","https://openalex.org/I4387154007"],"apc_list":null,"apc_paid":null,"fwci":1.636,"has_fulltext":false,"cited_by_count":11,"citation_normalized_percentile":{"value":0.8699988,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":96},"biblio":{"volume":"17","issue":null,"first_page":"1","last_page":"5"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.996999979019165,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/domain-name-system","display_name":"Domain Name System","score":0.8960349559783936},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7922537326812744},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.7024527192115784},{"id":"https://openalex.org/keywords/payload","display_name":"Payload (computing)","score":0.6043726801872253},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.6036115288734436},{"id":"https://openalex.org/keywords/protocol","display_name":"Protocol (science)","score":0.4500444829463959},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.36227092146873474},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.27408885955810547},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.1056073009967804}],"concepts":[{"id":"https://openalex.org/C35026560","wikidata":"https://www.wikidata.org/wiki/Q8767","display_name":"Domain Name System","level":3,"score":0.8960349559783936},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7922537326812744},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.7024527192115784},{"id":"https://openalex.org/C134066672","wikidata":"https://www.wikidata.org/wiki/Q1424639","display_name":"Payload (computing)","level":3,"score":0.6043726801872253},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6036115288734436},{"id":"https://openalex.org/C2780385302","wikidata":"https://www.wikidata.org/wiki/Q367158","display_name":"Protocol (science)","level":3,"score":0.4500444829463959},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.36227092146873474},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.27408885955810547},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.1056073009967804},{"id":"https://openalex.org/C204787440","wikidata":"https://www.wikidata.org/wiki/Q188504","display_name":"Alternative medicine","level":2,"score":0.0},{"id":"https://openalex.org/C142724271","wikidata":"https://www.wikidata.org/wiki/Q7208","display_name":"Pathology","level":1,"score":0.0},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.0},{"id":"https://openalex.org/C71924100","wikidata":"https://www.wikidata.org/wiki/Q11190","display_name":"Medicine","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/ntms.2014.6814008","is_oa":false,"landing_page_url":"https://doi.org/10.1109/ntms.2014.6814008","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2014 6th International Conference on New Technologies, Mobility and Security (NTMS)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.41999998688697815,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":20,"referenced_works":["https://openalex.org/W74326408","https://openalex.org/W85558978","https://openalex.org/W162535436","https://openalex.org/W1487185763","https://openalex.org/W1499648394","https://openalex.org/W1561314694","https://openalex.org/W1561983441","https://openalex.org/W1572744584","https://openalex.org/W1581184532","https://openalex.org/W1962340579","https://openalex.org/W1970499440","https://openalex.org/W1977415353","https://openalex.org/W1989598342","https://openalex.org/W2033378068","https://openalex.org/W2097981871","https://openalex.org/W6630065162","https://openalex.org/W6633578641","https://openalex.org/W6633853188","https://openalex.org/W6634965539","https://openalex.org/W6641353988"],"related_works":["https://openalex.org/W2183899684","https://openalex.org/W1535080110","https://openalex.org/W2097492617","https://openalex.org/W306312984","https://openalex.org/W857189463","https://openalex.org/W3004039032","https://openalex.org/W4288094128","https://openalex.org/W2979675132","https://openalex.org/W2790520092","https://openalex.org/W2004078625"],"abstract_inverted_index":{"Malware":[0],"families":[1],"utilize":[2,19],"different":[3,119],"protocols":[4,20],"to":[5,25,43,59],"establish":[6,60],"their":[7],"covert":[8,61],"communication":[9],"networks.":[10],"It":[11],"is":[12,41,66],"also":[13],"the":[14,38,77,92,122],"case":[15],"that":[16,113],"sometimes":[17],"they":[18],"which":[21,65],"are":[22],"least":[23],"expected":[24],"be":[26,44],"used":[27],"for":[28,107],"transferring":[29],"data,":[30],"e.g.,":[31],"Domain":[32],"Name":[33],"System":[34],"(DNS).":[35],"Even":[36],"though":[37],"DNS":[39,70,93,123],"protocol":[40],"designed":[42],"a":[45],"translation":[46],"service":[47],"between":[48],"domain":[49],"names":[50],"and":[51,95],"IP":[52],"addresses,":[53],"it":[54],"leaves":[55],"some":[56],"open":[57],"doors":[58],"channels":[62,81,89],"in":[63,82],"DNS,":[64],"widely":[67],"known":[68],"as":[69],"tunneling.":[71],"In":[72],"this":[73],"paper,":[74],"we":[75],"characterize":[76],"malicious":[78],"payload":[79],"distribution":[80],"DNS.":[83],"Our":[84,110],"proposed":[85],"solution":[86],"characterizes":[87],"these":[88],"based":[90],"on":[91],"query":[94],"response":[96],"messages":[97],"patterns.":[98],"We":[99],"performed":[100],"an":[101],"extensive":[102],"analysis":[103],"of":[104,121,125],"malware":[105,126],"datasets":[106],"one":[108],"year.":[109],"experiments":[111],"indicate":[112],"our":[114],"system":[115],"can":[116],"successfully":[117],"determine":[118],"patterns":[120],"traffic":[124],"families.":[127]},"counts_by_year":[{"year":2023,"cited_by_count":1},{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":2},{"year":2019,"cited_by_count":1},{"year":2017,"cited_by_count":2},{"year":2016,"cited_by_count":1},{"year":2015,"cited_by_count":1}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}