{"id":"https://openalex.org/W2793377324","doi":"https://doi.org/10.1142/s0218194018400016","title":"Detecting Domain-Flux Malware Using DNS Failure Traffic","display_name":"Detecting Domain-Flux Malware Using DNS Failure Traffic","publication_year":2018,"publication_date":"2018-02-01","ids":{"openalex":"https://openalex.org/W2793377324","doi":"https://doi.org/10.1142/s0218194018400016","mag":"2793377324"},"language":"en","primary_location":{"id":"doi:10.1142/s0218194018400016","is_oa":false,"landing_page_url":"https://doi.org/10.1142/s0218194018400016","pdf_url":null,"source":{"id":"https://openalex.org/S131442419","display_name":"International Journal of Software Engineering and Knowledge Engineering","issn_l":"0218-1940","issn":["0218-1940","1793-6403"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319815","host_organization_name":"World Scientific","host_organization_lineage":["https://openalex.org/P4310319815"],"host_organization_lineage_names":["World Scientific"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Software Engineering and Knowledge Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5066205926","display_name":"Futai Zou","orcid":null},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Futai Zou","raw_affiliation_strings":["School of Cyberspace Security, Shanghai Jiao Tong University, Shanghai 200240, P. R. China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Shanghai Jiao Tong University, Shanghai 200240, P. R. China","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5053874757","display_name":"Linsen Li","orcid":"https://orcid.org/0000-0002-1105-9070"},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Linsen Li","raw_affiliation_strings":["School of Cyberspace Security, Shanghai Jiao Tong University, Shanghai 200240, P. R. China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Shanghai Jiao Tong University, Shanghai 200240, P. R. China","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101902978","display_name":"Yue Wu","orcid":"https://orcid.org/0000-0002-2920-8505"},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yue Wu","raw_affiliation_strings":["School of Cyberspace Security, Shanghai Jiao Tong University, Shanghai 200240, P. R. China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Shanghai Jiao Tong University, Shanghai 200240, P. R. China","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100391361","display_name":"Jianhua Li","orcid":"https://orcid.org/0000-0002-6831-3973"},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jianhua Li","raw_affiliation_strings":["School of Cyberspace Security, Shanghai Jiao Tong University, Shanghai 200240, P. R. China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Cyberspace Security, Shanghai Jiao Tong University, Shanghai 200240, P. R. China","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5105517529","display_name":"Siyu Zhang","orcid":"https://orcid.org/0000-0002-0502-8227"},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Siyu Zhang","raw_affiliation_strings":["Network and Information Center, Shanghai Jiao Tong University, Shanghai 200240, P. R. China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Network and Information Center, Shanghai Jiao Tong University, Shanghai 200240, P. R. China","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5022789859","display_name":"Kaida Jiang","orcid":"https://orcid.org/0000-0003-0065-519X"},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kaida Jiang","raw_affiliation_strings":["Network and Information Center, Shanghai Jiao Tong University, Shanghai 200240, P. R. China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Network and Information Center, Shanghai Jiao Tong University, Shanghai 200240, P. R. China","institution_ids":["https://openalex.org/I183067930"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I183067930"],"apc_list":null,"apc_paid":null,"fwci":0.328,"has_fulltext":false,"cited_by_count":3,"citation_normalized_percentile":{"value":0.5338255,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":94},"biblio":{"volume":"28","issue":"02","first_page":"151","last_page":"173"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.9062020182609558},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.7271316051483154},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6500579714775085},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.6326771974563599},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.6211094260215759},{"id":"https://openalex.org/keywords/command-and-control","display_name":"Command and control","score":0.45086437463760376},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.37626516819000244},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.2284945845603943},{"id":"https://openalex.org/keywords/mathematics","display_name":"Mathematics","score":0.1229504942893982}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.9062020182609558},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.7271316051483154},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6500579714775085},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.6326771974563599},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.6211094260215759},{"id":"https://openalex.org/C506615639","wikidata":"https://www.wikidata.org/wiki/Q21662260","display_name":"Command and control","level":2,"score":0.45086437463760376},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.37626516819000244},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2284945845603943},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.1229504942893982},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1142/s0218194018400016","is_oa":false,"landing_page_url":"https://doi.org/10.1142/s0218194018400016","pdf_url":null,"source":{"id":"https://openalex.org/S131442419","display_name":"International Journal of Software Engineering and Knowledge Engineering","issn_l":"0218-1940","issn":["0218-1940","1793-6403"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319815","host_organization_name":"World Scientific","host_organization_lineage":["https://openalex.org/P4310319815"],"host_organization_lineage_names":["World Scientific"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Software Engineering and Knowledge Engineering","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":6,"referenced_works":["https://openalex.org/W208128215","https://openalex.org/W1981294881","https://openalex.org/W2132040456","https://openalex.org/W2623293810","https://openalex.org/W4213009331","https://openalex.org/W4234559128"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W3152891574","https://openalex.org/W4284893819","https://openalex.org/W4316881845","https://openalex.org/W4232632923","https://openalex.org/W2775776836","https://openalex.org/W2783300127","https://openalex.org/W2098522106"],"abstract_inverted_index":{"Domain-Flux":[0,33,140,154,179],"malware":[1,34,141],"is":[2],"hard":[3],"to":[4,52],"detect":[5],"because":[6],"of":[7,22,48,96,102,117,139,177],"the":[8,20,46,59,85,105,108,147,169,178],"variable":[9],"C&C":[10],"(Command":[11],"and":[12,56,66,71,81,119,151,167],"Control)":[13],"domains":[14,61,124,166],"which":[15],"were":[16],"randomly":[17],"generated":[18,171],"by":[19,62,125],"technique":[21],"domain":[23],"generation":[24],"algorithm":[25,65],"(DGA).":[26],"In":[27],"this":[28],"paper,":[29],"we":[30],"propose":[31],"a":[32,63,92,113,174],"detection":[35],"approach":[36,43,89,109],"based":[37],"on":[38,143],"DNS":[39,49,127],"failure":[40,50],"traffic.":[41],"The":[42],"fully":[44],"leverages":[45],"behavior":[47],"traffic":[51,128],"recognize":[53],"nine":[54],"features,":[55],"then":[57],"mines":[58],"DGA-generated":[60],"clustering":[64],"determinable":[67],"rules.":[68],"Theoretical":[69],"analysis":[70],"experimental":[72],"results":[73],"verify":[74],"its":[75],"efficiency":[76],"with":[77],"both":[78],"test":[79,86],"dataset":[80],"real-world":[82,106],"dataset.":[83],"On":[84,104],"dataset,":[87,107],"our":[88],"can":[90,110],"achieve":[91,112],"true":[93],"positive":[94,100],"rate":[95,101],"99.82%":[97],"at":[98],"false":[99],"0.39%.":[103],"also":[111],"relatively":[114],"high":[115],"precision":[116],"98.3%":[118],"find":[120],"out":[121],"197,026":[122,164],"DGA":[123,165],"analyzing":[126],"in":[129],"campus":[130,144],"network":[131],"for":[132,173],"seven":[133],"days.":[134],"We":[135,162],"found":[136],"1213":[137],"hosts":[138],"existing":[142],"network,":[145],"including":[146],"known":[148],"Conficker,":[149],"Fosniw":[150],"several":[152],"new":[153],"malwares":[155],"that":[156],"have":[157],"never":[158],"been":[159],"reported":[160],"before.":[161],"classified":[163],"gave":[168],"representative":[170],"patterns":[172],"better":[175],"understanding":[176],"mechanism.":[180]},"counts_by_year":[{"year":2023,"cited_by_count":1},{"year":2020,"cited_by_count":1},{"year":2019,"cited_by_count":1}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}