{"id":"https://openalex.org/W4311135933","doi":"https://doi.org/10.1145/3565009.3569523","title":"AI-based detection of DNS misuse for network security","display_name":"AI-based detection of DNS misuse for network security","publication_year":2022,"publication_date":"2022-12-01","ids":{"openalex":"https://openalex.org/W4311135933","doi":"https://doi.org/10.1145/3565009.3569523"},"language":"en","primary_location":{"id":"doi:10.1145/3565009.3569523","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3565009.3569523","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 1st International Workshop on Native Network Intelligence","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5070733813","display_name":"Irina Chiscop","orcid":"https://orcid.org/0000-0002-1249-8518"},"institutions":[{"id":"https://openalex.org/I148297040","display_name":"Netherlands Organisation for Applied Scientific Research","ror":"https://ror.org/01bnjb948","country_code":"NL","type":"nonprofit","lineage":["https://openalex.org/I148297040"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Irina Chiscop","raw_affiliation_strings":["Netherlands Organisation for Applied Scientific Research, The Hague, The Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Netherlands Organisation for Applied Scientific Research, The Hague, The Netherlands","institution_ids":["https://openalex.org/I148297040"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075022804","display_name":"Francesca Soro","orcid":"https://orcid.org/0000-0001-6738-8634"},"institutions":[{"id":"https://openalex.org/I132118926","display_name":"Austrian Institute of Technology","ror":"https://ror.org/04knbh022","country_code":"AT","type":"facility","lineage":["https://openalex.org/I132118926"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Francesca Soro","raw_affiliation_strings":["AIT Austrian Institute of Technology, Vienna, Austria"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"AIT Austrian Institute of Technology, Vienna, Austria","institution_ids":["https://openalex.org/I132118926"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5058192226","display_name":"Paul Smith","orcid":"https://orcid.org/0000-0002-3676-5318"},"institutions":[{"id":"https://openalex.org/I132118926","display_name":"Austrian Institute of Technology","ror":"https://ror.org/04knbh022","country_code":"AT","type":"facility","lineage":["https://openalex.org/I132118926"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Paul Smith","raw_affiliation_strings":["AIT Austrian Institute of Technology, Vienna, Austria"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"AIT Austrian Institute of Technology, Vienna, Austria","institution_ids":["https://openalex.org/I132118926"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.0784,"has_fulltext":false,"cited_by_count":4,"citation_normalized_percentile":{"value":0.74599694,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":96},"biblio":{"volume":null,"issue":null,"first_page":"27","last_page":"32"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9965999722480774,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8957387208938599},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8440688848495483},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.6681572794914246},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.6397362947463989},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5180501937866211},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5147340297698975},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.5107619762420654},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5035380721092224},{"id":"https://openalex.org/keywords/security-domain","display_name":"Security domain","score":0.4762980043888092},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.45630592107772827},{"id":"https://openalex.org/keywords/binary-classification","display_name":"Binary classification","score":0.444672167301178},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.4240439534187317},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.42040205001831055},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.38734787702560425},{"id":"https://openalex.org/keywords/support-vector-machine","display_name":"Support vector machine","score":0.1863844394683838},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.12312242388725281},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.08635976910591125}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8957387208938599},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8440688848495483},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.6681572794914246},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.6397362947463989},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5180501937866211},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5147340297698975},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.5107619762420654},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5035380721092224},{"id":"https://openalex.org/C2780264999","wikidata":"https://www.wikidata.org/wiki/Q7445032","display_name":"Security domain","level":2,"score":0.4762980043888092},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.45630592107772827},{"id":"https://openalex.org/C66905080","wikidata":"https://www.wikidata.org/wiki/Q17005494","display_name":"Binary classification","level":3,"score":0.444672167301178},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.4240439534187317},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.42040205001831055},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.38734787702560425},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.1863844394683838},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.12312242388725281},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.08635976910591125},{"id":"https://openalex.org/C201995342","wikidata":"https://www.wikidata.org/wiki/Q682496","display_name":"Systems engineering","level":1,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/3565009.3569523","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3565009.3569523","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 1st International Workshop on Native Network Intelligence","raw_type":"proceedings-article"},{"id":"pmh:oai:eprints.lancs.ac.uk:219115","is_oa":false,"landing_page_url":"https://eprints.lancs.ac.uk/id/eprint/219115/","pdf_url":null,"source":{"id":"https://openalex.org/S4306401916","display_name":"Lancaster EPrints (Lancaster University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I67415387","host_organization_name":"Lancaster University","host_organization_lineage":["https://openalex.org/I67415387"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Contribution in Book/Report/Proceedings"},{"id":"pmh:oai:oai-pmh.tno.nl:55448","is_oa":false,"landing_page_url":"https://resolver.tno.nl/uuid:c904b8c0-b936-455c-952f-326f1327318b","pdf_url":null,"source":{"id":"https://openalex.org/S7407055233","display_name":"TNO Repository","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"info:eu-repo/semantics/conferenceObject"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":19,"referenced_works":["https://openalex.org/W2470894770","https://openalex.org/W2546910111","https://openalex.org/W2601243251","https://openalex.org/W2738011505","https://openalex.org/W2786906486","https://openalex.org/W2912464539","https://openalex.org/W2912755644","https://openalex.org/W2913059114","https://openalex.org/W2913195718","https://openalex.org/W2914448461","https://openalex.org/W3011866104","https://openalex.org/W3014732532","https://openalex.org/W3114681532","https://openalex.org/W3172400541","https://openalex.org/W3178436634","https://openalex.org/W4225070666","https://openalex.org/W4281698253","https://openalex.org/W4283205862","https://openalex.org/W4299301436"],"related_works":["https://openalex.org/W2770234245","https://openalex.org/W2097492617","https://openalex.org/W96612179","https://openalex.org/W4229499248","https://openalex.org/W2566006169","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W1567818861","https://openalex.org/W2987774938"],"abstract_inverted_index":{"Threat":[0],"hunting":[1],"and":[2,11,64,76,125],"malware":[3,24,42,111,182],"prediction":[4],"are":[5,16,94],"critical":[6],"activities":[7],"to":[8,19,46,87,96,107],"ensure":[9],"network":[10],"system":[12,139],"security.":[13],"These":[14],"tasks":[15],"difficult":[17],"due":[18],"increasing":[20],"numbers":[21],"of":[22,40,49,105,109,137,154,159],"sophisticated":[23],"families.":[25],"Automatically":[26],"detecting":[27],"anomalous":[28],"Domain":[29,59],"Name":[30],"System":[31],"(DNS)":[32],"queries":[33],"in":[34,89,99,140,156,167,169,174],"operational":[35,100],"traffic":[36],"facilitates":[37],"the":[38,47,117,120,123,135,152,157,170,176,181],"detection":[39,63],"new":[41,110],"infections,":[43],"significantly":[44],"contributing":[45],"work":[48],"security":[50],"practitioners.":[51],"In":[52],"this":[53,90,138],"paper,":[54],"we":[55],"present":[56],"two":[57],"AI-based":[58],"Generation":[60],"Algorithm":[61],"(DGA)":[62],"classification":[65,121,172],"techniques":[66,93,148],"-":[67,84],"a":[68,77,164],"feature-based":[69],"one,":[70,79],"leveraging":[71],"classic":[72],"Machine":[73],"Learning":[74,83],"algorithms":[75],"featureless":[78],"based":[80],"on":[81,180],"Deep":[82],"specifically":[85],"intended":[86],"aid":[88],"task.":[91],"Both":[92],"designed":[95],"be":[97],"integrated":[98],"environments,":[101],"dealing":[102],"with":[103,163],"hundreds":[104],"thousands":[106],"millions":[108],"samples":[112],"per":[113],"day.":[114],"We":[115,144],"report":[116],"implementation":[118],"details,":[119],"performance,":[122],"advantages":[124],"shortcomings":[126],"for":[127],"both":[128,147],"techniques,":[129],"as":[130,132],"well":[131],"experiences":[133],"from":[134],"deployment":[136],"an":[141],"industrial":[142],"environment.":[143],"show":[145],"that":[146],"reach":[149],"more":[150],"than":[151],"90%":[153],"accuracy":[155],"case":[158],"binary":[160],"DGA":[161],"detection,":[162],"slight":[165],"degradation":[166],"performance":[168],"multi-class":[171],"case,":[173],"which":[175],"results":[177],"strongly":[178],"depend":[179],"type.":[183]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}