{"id":"https://openalex.org/W7138907209","doi":"https://doi.org/10.1109/tifs.2026.3675876","title":"HINHJ: Hierarchical Attention-Based Heterogeneous Graph Neural Network for DNS Hijacking Detection","display_name":"HINHJ: Hierarchical Attention-Based Heterogeneous Graph Neural Network for DNS Hijacking Detection","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7138907209","doi":"https://doi.org/10.1109/tifs.2026.3675876"},"language":null,"primary_location":{"id":"doi:10.1109/tifs.2026.3675876","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3675876","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5047053420","display_name":"Haoran Jiao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Haoran Jiao","raw_affiliation_strings":["Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0005-8512-5922","affiliations":[{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5104507925","display_name":"Cong Dong","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cong Dong","raw_affiliation_strings":["Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-7581-7160","affiliations":[{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129981270","display_name":"Chenglong Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chenglong Li","raw_affiliation_strings":["Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-4300-678X","affiliations":[{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129756265","display_name":"Jiahai Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jiahai Yang","raw_affiliation_strings":["Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-6109-6737","affiliations":[{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5040157011","display_name":"Leyao Nie","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Leyao Nie","raw_affiliation_strings":["Zhongguancun Laboratory, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129767236","display_name":"Yuling Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuling Liu","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-2740-9362","affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130081160","display_name":"Jing Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I25254941","display_name":"Beijing Normal University","ror":"https://ror.org/022k4wk35","country_code":"CN","type":"education","lineage":["https://openalex.org/I25254941"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jing Wang","raw_affiliation_strings":["College of Artificial Intelligence, Beijing Normal University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"College of Artificial Intelligence, Beijing Normal University, Beijing, China","institution_ids":["https://openalex.org/I25254941"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101212549","display_name":"Changzhi Zhao","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]},{"id":"https://openalex.org/I4210156404","display_name":"Institute of Information Engineering","ror":"https://ror.org/04r53se39","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Changzhi Zhao","raw_affiliation_strings":["Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0004-0122-9322","affiliations":[{"raw_affiliation_string":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China","institution_ids":["https://openalex.org/I4210156404","https://openalex.org/I19820366"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5130081030","display_name":"Xia Yin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xia Yin","raw_affiliation_strings":["Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0000-0037-2777","affiliations":[{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.29181582,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"21","issue":null,"first_page":"3240","last_page":"3253"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.558899998664856,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.558899998664856,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10651","display_name":"IPv6, Mobility, Handover, Networks, Security","score":0.15189999341964722,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.13339999318122864,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adaptability","display_name":"Adaptability","score":0.4966999888420105},{"id":"https://openalex.org/keywords/weighting","display_name":"Weighting","score":0.48170000314712524},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.4754999876022339},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.4223000109195709},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.4101000130176544},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.38920000195503235},{"id":"https://openalex.org/keywords/heterogeneous-network","display_name":"Heterogeneous network","score":0.3797999918460846},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.3765000104904175}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8860999941825867},{"id":"https://openalex.org/C177606310","wikidata":"https://www.wikidata.org/wiki/Q5674297","display_name":"Adaptability","level":2,"score":0.4966999888420105},{"id":"https://openalex.org/C183115368","wikidata":"https://www.wikidata.org/wiki/Q856577","display_name":"Weighting","level":2,"score":0.48170000314712524},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.4754999876022339},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4311000108718872},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.4223000109195709},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.4101000130176544},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.38920000195503235},{"id":"https://openalex.org/C158207573","wikidata":"https://www.wikidata.org/wiki/Q5747224","display_name":"Heterogeneous network","level":4,"score":0.3797999918460846},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3767000138759613},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.3765000104904175},{"id":"https://openalex.org/C106937863","wikidata":"https://www.wikidata.org/wiki/Q7236518","display_name":"Power graph analysis","level":3,"score":0.3693000078201294},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3352999985218048},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.3264000117778778},{"id":"https://openalex.org/C117045392","wikidata":"https://www.wikidata.org/wiki/Q4899215","display_name":"Betweenness centrality","level":3,"score":0.31209999322891235},{"id":"https://openalex.org/C133474645","wikidata":"https://www.wikidata.org/wiki/Q17104660","display_name":"Network mapping","level":3,"score":0.3012999892234802},{"id":"https://openalex.org/C5111613","wikidata":"https://www.wikidata.org/wiki/Q3799443","display_name":"Inter-domain","level":4,"score":0.2824000120162964},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.27570000290870667},{"id":"https://openalex.org/C88796919","wikidata":"https://www.wikidata.org/wiki/Q1142907","display_name":"Backbone network","level":2,"score":0.27459999918937683},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.272599995136261},{"id":"https://openalex.org/C88230418","wikidata":"https://www.wikidata.org/wiki/Q131476","display_name":"Graph theory","level":2,"score":0.27230000495910645},{"id":"https://openalex.org/C3018725008","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber threats","level":2,"score":0.27140000462532043},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.2540000081062317},{"id":"https://openalex.org/C35026560","wikidata":"https://www.wikidata.org/wiki/Q8767","display_name":"Domain Name System","level":3,"score":0.251800000667572}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2026.3675876","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3675876","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/9","score":0.6020028591156006,"display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0],"Domain":[1],"Name":[2],"System":[3],"(DNS)":[4],"is":[5,21,63],"a":[6,99,123,136],"critical":[7],"internet":[8],"infrastructure":[9],"that":[10,142],"translates":[11],"human-readable":[12],"domain":[13,172],"names":[14],"into":[15],"machine-routable":[16],"IP":[17],"addresses.":[18],"However,":[19,47],"DNS":[20,109,161],"inherently":[22],"vulnerable":[23],"to":[24,79,82,126,159,200,218],"manipulation,":[25],"with":[26],"hijacking":[27,237],"attacks":[28],"growing":[29],"in":[30,56,234,239],"both":[31],"frequency":[32],"and":[33,53,118,121,130,171,198,223],"sophistication.":[34],"Existing":[35],"detection":[36,75,103],"methods":[37],"primarily":[38],"rely":[39],"on":[40,106,168,196,212],"traffic":[41],"analysis":[42],"at":[43],"specific":[44],"network":[45,140,156],"points.":[46],"they":[48,71],"suffer":[49,73],"from":[50,74,111],"limited":[51],"coverage":[52],"low":[54,203],"accuracy":[55],"complex":[57,86],"environments,":[58],"such":[59],"as":[60],"when":[61],"CDN":[62],"employed.":[64],"While":[65],"recent":[66,153],"approaches":[67],"employ":[68],"graph-based":[69,102],"techniques,":[70],"still":[72],"inaccuracy":[76],"issues":[77],"due":[78],"their":[80],"failure":[81],"account":[83],"for":[84],"the":[85,107,177,191,231],"interdependencies":[87],"among":[88],"multiple":[89],"types":[90],"of":[91,179,188],"nodes.":[92],"To":[93],"address":[94],"these":[95],"limitations,":[96],"we":[97,165,207],"propose":[98],"novel":[100],"heterogeneous":[101,124],"framework.":[104],"Based":[105],"collected":[108],"records":[110],"distributed":[112],"scanners,":[113],"our":[114,180],"method":[115,183],"extracts":[116],"activity":[117],"security":[119],"features":[120],"constructs":[122],"graph":[125,138],"capture":[127],"resolution":[128],"patterns":[129],"cross-entity":[131],"relationships.":[132],"We":[133],"further":[134],"design":[135],"time-decay":[137],"neural":[139],"TNHAN":[141],"enhances":[143],"traditional":[144],"Heterogeneous":[145],"Graph":[146],"Attention":[147],"Networks":[148],"(HAN)":[149],"by":[150,194,225],"dynamically":[151],"weighting":[152],"records.":[154],"This":[155],"improves":[157],"adaptability":[158],"legitimate":[160],"changes.":[162],"For":[163],"evaluation,":[164],"conduct":[166,208],"experiments":[167],"real-world":[169],"resolvers":[170],"datasets.":[173],"Experiment":[174],"results":[175],"demonstrate":[176,230],"effectiveness":[178,233],"method.":[181],"Our":[182],"can":[184],"achieve":[185],"an":[186],"F1-score":[187],"0.96,":[189],"outperforming":[190],"best":[192],"baseline":[193],"0.057":[195],"average,":[197],"up":[199],"0.113":[201],"under":[202],"label":[204],"proportion.":[205],"Moreover,":[206],"several":[209],"case":[210],"studies":[211],"detected":[213],"incidents,":[214],"including":[215],"cases":[216,229],"related":[217],"geopolitical":[219],"conflicts,":[220],"censorship-related":[221],"hijacking,":[222],"manipulation":[224],"malicious":[226],"resolvers.":[227],"These":[228],"method\u2019s":[232],"identifying":[235],"diverse":[236],"behaviors":[238],"practice.":[240]},"counts_by_year":[],"updated_date":"2026-03-31T06:02:25.137627","created_date":"2026-03-20T00:00:00"}