{"id":"https://openalex.org/W4414229293","doi":"https://doi.org/10.1109/ojcoms.2025.3610784","title":"STING: A Stealthy Backdoor Attack on GNN-Based Malicious Domain Detection via DNS Perturbations","display_name":"STING: A Stealthy Backdoor Attack on GNN-Based Malicious Domain Detection via DNS Perturbations","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4414229293","doi":"https://doi.org/10.1109/ojcoms.2025.3610784"},"language":"en","primary_location":{"id":"doi:10.1109/ojcoms.2025.3610784","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcoms.2025.3610784","pdf_url":null,"source":{"id":"https://openalex.org/S4210202420","display_name":"IEEE Open Journal of the Communications Society","issn_l":"2644-125X","issn":["2644-125X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310316002","host_organization_name":"IEEE Communications Society","host_organization_lineage":["https://openalex.org/P4310316002","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Communications Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Communications Society","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/ojcoms.2025.3610784","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5083182384","display_name":"Muhammad Anan","orcid":"https://orcid.org/0000-0002-9479-4985"},"institutions":[{"id":"https://openalex.org/I134359838","display_name":"Alfaisal University","ror":"https://ror.org/00cdrtq48","country_code":"SA","type":"education","lineage":["https://openalex.org/I134359838"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Muhammad Anan","raw_affiliation_strings":["College of Engineering and Advaced Computing, Alfaisal University, Riyadh, Saudi Arabia","College of Engineering and Advaced Computing Alfaisal University, Riyadh, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0002-9479-4985","affiliations":[{"raw_affiliation_string":"College of Engineering and Advaced Computing, Alfaisal University, Riyadh, Saudi Arabia","institution_ids":["https://openalex.org/I134359838"]},{"raw_affiliation_string":"College of Engineering and Advaced Computing Alfaisal University, Riyadh, Saudi Arabia","institution_ids":["https://openalex.org/I134359838"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5066904836","display_name":"Mahmoud Nazzal","orcid":"https://orcid.org/0000-0003-3375-0310"},"institutions":[{"id":"https://openalex.org/I81365321","display_name":"Old Dominion University","ror":"https://ror.org/04zjtrb98","country_code":"US","type":"education","lineage":["https://openalex.org/I81365321"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mahmoud Nazzal","raw_affiliation_strings":["Computer Science Department, Old Dominion University, Norfolk, VA, USA","Old Dominion University, Norfolk, VA, USA"],"raw_orcid":"https://orcid.org/0000-0003-3375-0310","affiliations":[{"raw_affiliation_string":"Computer Science Department, Old Dominion University, Norfolk, VA, USA","institution_ids":["https://openalex.org/I81365321"]},{"raw_affiliation_string":"Old Dominion University, Norfolk, VA, USA","institution_ids":["https://openalex.org/I81365321"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062119199","display_name":"Abdallah Khreishah","orcid":"https://orcid.org/0000-0003-1583-713X"},"institutions":[{"id":"https://openalex.org/I118118575","display_name":"New Jersey Institute of Technology","ror":"https://ror.org/05e74xb87","country_code":"US","type":"education","lineage":["https://openalex.org/I118118575"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Abdallah Khreishah","raw_affiliation_strings":["Newark College of Engineering, New Jersey Institute of Technology, Newark, NJ, USA","New Jersey Institute of Technology, Newark, NJ, USA"],"raw_orcid":"https://orcid.org/0000-0003-1583-713X","affiliations":[{"raw_affiliation_string":"Newark College of Engineering, New Jersey Institute of Technology, Newark, NJ, USA","institution_ids":["https://openalex.org/I118118575"]},{"raw_affiliation_string":"New Jersey Institute of Technology, Newark, NJ, USA","institution_ids":["https://openalex.org/I118118575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5008374141","display_name":"Issa Khalil","orcid":"https://orcid.org/0000-0002-7660-9512"},"institutions":[{"id":"https://openalex.org/I4210144839","display_name":"Hamad bin Khalifa University","ror":"https://ror.org/03eyq4y97","country_code":"QA","type":"education","lineage":["https://openalex.org/I4210144839"]}],"countries":["QA"],"is_corresponding":false,"raw_author_name":"Issa Khalil","raw_affiliation_strings":["Qatar Computing Research Institute, Hamad Bin Khalifa University, Doha, Qatar"],"raw_orcid":"https://orcid.org/0000-0002-7660-9512","affiliations":[{"raw_affiliation_string":"Qatar Computing Research Institute, Hamad Bin Khalifa University, Doha, Qatar","institution_ids":["https://openalex.org/I4210144839"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060481572","display_name":"NhatHai Phan","orcid":"https://orcid.org/0000-0002-1032-8275"},"institutions":[{"id":"https://openalex.org/I118118575","display_name":"New Jersey Institute of Technology","ror":"https://ror.org/05e74xb87","country_code":"US","type":"education","lineage":["https://openalex.org/I118118575"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Nhathai Phan","raw_affiliation_strings":["Newark College of Engineering, New Jersey Institute of Technology, Newark, NJ, USA","New Jersey Institute of Technology, Newark, NJ, USA"],"raw_orcid":"https://orcid.org/0000-0002-1032-8275","affiliations":[{"raw_affiliation_string":"Newark College of Engineering, New Jersey Institute of Technology, Newark, NJ, USA","institution_ids":["https://openalex.org/I118118575"]},{"raw_affiliation_string":"New Jersey Institute of Technology, Newark, NJ, USA","institution_ids":["https://openalex.org/I118118575"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5017180654","display_name":"Ahmad Sawalmeh","orcid":"https://orcid.org/0000-0002-7040-8963"},"institutions":[{"id":"https://openalex.org/I134359838","display_name":"Alfaisal University","ror":"https://ror.org/00cdrtq48","country_code":"SA","type":"education","lineage":["https://openalex.org/I134359838"]}],"countries":["SA"],"is_corresponding":false,"raw_author_name":"Ahmad Sawalmeh","raw_affiliation_strings":["College of Engineering and Advaced Computing, Alfaisal University, Riyadh, Saudi Arabia","College of Engineering and Advaced Computing Alfaisal University, Riyadh, Saudi Arabia"],"raw_orcid":"https://orcid.org/0000-0002-7040-8963","affiliations":[{"raw_affiliation_string":"College of Engineering and Advaced Computing, Alfaisal University, Riyadh, Saudi Arabia","institution_ids":["https://openalex.org/I134359838"]},{"raw_affiliation_string":"College of Engineering and Advaced Computing Alfaisal University, Riyadh, Saudi Arabia","institution_ids":["https://openalex.org/I134359838"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1750,"currency":"USD","value_usd":1750},"apc_paid":{"value":1750,"currency":"USD","value_usd":1750},"fwci":0.9389,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.79951677,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":"6","issue":null,"first_page":"7823","last_page":"7841"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9839000105857849,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9296000003814697,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.9379000067710876},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.5845999717712402},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.5133000016212463},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.47909998893737793},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.38199999928474426},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.3781999945640564},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.33000001311302185},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.30550000071525574}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9379000067710876},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6962000131607056},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6700999736785889},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.5845999717712402},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.5133000016212463},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.47909998893737793},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.38199999928474426},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.3781999945640564},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.35370001196861267},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.33000001311302185},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3188000023365021},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.30550000071525574},{"id":"https://openalex.org/C2780801425","wikidata":"https://www.wikidata.org/wiki/Q5164392","display_name":"Construct (python library)","level":2,"score":0.30480000376701355},{"id":"https://openalex.org/C79337645","wikidata":"https://www.wikidata.org/wiki/Q779824","display_name":"Outlier","level":2,"score":0.28529998660087585},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2816999852657318},{"id":"https://openalex.org/C106937863","wikidata":"https://www.wikidata.org/wiki/Q7236518","display_name":"Power graph analysis","level":3,"score":0.27129998803138733},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.26820001006126404},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.266400009393692},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.263700008392334},{"id":"https://openalex.org/C62611344","wikidata":"https://www.wikidata.org/wiki/Q1062658","display_name":"Node (physics)","level":2,"score":0.2624000012874603},{"id":"https://openalex.org/C55282118","wikidata":"https://www.wikidata.org/wiki/Q252683","display_name":"Snapshot (computer storage)","level":2,"score":0.2614000141620636}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/ojcoms.2025.3610784","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcoms.2025.3610784","pdf_url":null,"source":{"id":"https://openalex.org/S4210202420","display_name":"IEEE Open Journal of the Communications Society","issn_l":"2644-125X","issn":["2644-125X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310316002","host_organization_name":"IEEE Communications Society","host_organization_lineage":["https://openalex.org/P4310316002","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Communications Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Communications Society","raw_type":"journal-article"},{"id":"pmh:oai:digitalcommons.odu.edu:computerscience_fac_pubs-1402","is_oa":true,"landing_page_url":"https://digitalcommons.odu.edu/computerscience_fac_pubs/397","pdf_url":null,"source":{"id":"https://openalex.org/S4377196314","display_name":"ODU Digital Commons (Old Dominion University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I81365321","host_organization_name":"Old Dominion University","host_organization_lineage":["https://openalex.org/I81365321"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Computer Science Faculty Publications","raw_type":"article"},{"id":"pmh:oai:doaj.org/article:84997867550b461f90e5582061562dee","is_oa":true,"landing_page_url":"https://doaj.org/article/84997867550b461f90e5582061562dee","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Open Journal of the Communications Society, Vol 6, Pp 7823-7841 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/ojcoms.2025.3610784","is_oa":true,"landing_page_url":"https://doi.org/10.1109/ojcoms.2025.3610784","pdf_url":null,"source":{"id":"https://openalex.org/S4210202420","display_name":"IEEE Open Journal of the Communications Society","issn_l":"2644-125X","issn":["2644-125X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310316002","host_organization_name":"IEEE Communications Society","host_organization_lineage":["https://openalex.org/P4310316002","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Communications Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Open Journal of the Communications Society","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Detecting":[0],"malicious":[1,17],"Internet":[2],"domains":[3,18,167],"is":[4,47,142],"essential":[5],"for":[6,35],"safeguarding":[7],"against":[8],"various":[9],"online":[10],"threats.":[11],"The":[12,91],"current":[13],"approach":[14],"to":[15,31,49,61,105,111,191,219],"detecting":[16],"(MDD)":[19],"employs":[20],"a":[21,63,76,146,158,188,201],"graph":[22,59,85,104,179],"neural":[23],"network":[24],"(GNN)":[25],"method,":[26],"which":[27],"uses":[28],"DNS":[29],"logs":[30],"construct":[32],"heterogeneous":[33],"graphs":[34],"determining":[36],"the":[37,66,72,103,115,120,126,139,162,172,192,205],"maliciousness":[38],"of":[39,99,125,149,194,207],"unknown":[40],"domains.":[41],"Despite":[42],"its":[43,100],"success,":[44],"this":[45],"method":[46],"vulnerable":[48],"data":[50],"poisoning":[51],"attacks":[52,155],"where":[53],"an":[54],"adversary":[55],"can":[56],"manipulate":[57],"specific":[58],"nodes":[60,101],"implant":[62],"backdoor":[64,107,154],"into":[65],"model":[67,121],"during":[68],"training.":[69],"To":[70],"showcase":[71],"vulnerability,":[73],"we":[74],"propose":[75],"stealthy":[77],"trigger":[78,108],"injection":[79],"attack":[80,141,173],"on":[81,132,165],"node":[82],"features":[83,96],"and":[84,97,156,183,203,210,216,224,228],"structure":[86],"in":[87,102,152,161],"MDD,":[88],"dubbed":[89],"(STING).":[90],"attacker":[92],"carefully":[93],"manipulates":[94],"selected":[95],"edges":[98],"create":[106],"patterns":[109],"designed":[110],"evade":[112],"detection":[113],"by":[114,213],"MDD":[116,135,195,222],"system,":[117],"without":[118],"knowing":[119],"or":[122],"other":[123],"parts":[124],"graph.":[127],"Results":[128],"from":[129],"experiments":[130],"conducted":[131],"real-world":[133],"GNN-based":[134,221],"approaches":[136],"show":[137],"that":[138],"proposed":[140],"highly":[143],"effective,":[144],"with":[145],"success":[147],"rate":[148],"over":[150],"88%":[151],"launching":[153],"only":[157],"slight":[159],"decrease":[160],"model\u2019s":[163],"accuracy":[164],"legitimate":[166],"(not":[168],"exceeding":[169],"4%).":[170],"Furthermore,":[171],"bypasses":[174],"established":[175],"defenses":[176],"such":[177],"as":[178,200],"purification,":[180],"adversarial":[181],"training,":[182],"outlier":[184],"detection,":[185],"making":[186],"it":[187],"major":[189],"threat":[190],"security":[193,217],"systems.":[196],"This":[197],"study":[198],"serves":[199],"warning":[202],"stresses":[204],"importance":[206],"continuous":[208],"vigilance":[209],"proactive":[211],"efforts":[212],"both":[214],"researchers":[215],"experts":[218],"secure":[220],"systems":[223],"maintain":[225],"their":[226],"trustworthiness":[227],"stability.":[229]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}