{"id":"https://openalex.org/W2110983102","doi":"https://doi.org/10.1155/2015/102687","title":"Detecting Malware Based on DNS Graph Mining","display_name":"Detecting Malware Based on DNS Graph Mining","publication_year":2015,"publication_date":"2015-01-01","ids":{"openalex":"https://openalex.org/W2110983102","doi":"https://doi.org/10.1155/2015/102687","mag":"2110983102"},"language":"en","primary_location":{"id":"doi:10.1155/2015/102687","is_oa":true,"landing_page_url":"https://doi.org/10.1155/2015/102687","pdf_url":null,"source":{"id":"https://openalex.org/S64417657","display_name":"International Journal of Distributed Sensor Networks","issn_l":"1550-1329","issn":["1550-1329","1550-1477"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319869","host_organization_name":"Hindawi Publishing Corporation","host_organization_lineage":["https://openalex.org/P4310319869"],"host_organization_lineage_names":["Hindawi Publishing Corporation"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Distributed Sensor Networks","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1155/2015/102687","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5066205926","display_name":"Futai Zou","orcid":null},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Futai Zou","raw_affiliation_strings":["[School of Information Security Engineering Shanghai Jiao Tong University, Shanghai, China]"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"[School of Information Security Engineering Shanghai Jiao Tong University, Shanghai, China]","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5105517529","display_name":"Siyu Zhang","orcid":"https://orcid.org/0000-0002-0502-8227"},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Siyu Zhang","raw_affiliation_strings":["Network and Information Center, Shanghai Jiao Tong University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0002-0502-8227","affiliations":[{"raw_affiliation_string":"Network and Information Center, Shanghai Jiao Tong University, Shanghai, China","institution_ids":["https://openalex.org/I183067930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016210851","display_name":"Weixiong Rao","orcid":"https://orcid.org/0000-0001-6644-0349"},"institutions":[{"id":"https://openalex.org/I116953780","display_name":"Tongji University","ror":"https://ror.org/03rc6as71","country_code":"CN","type":"education","lineage":["https://openalex.org/I116953780"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Weixiong Rao","raw_affiliation_strings":["Sch. of Software Eng., Tongji University, Shanghai, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Sch. of Software Eng., Tongji University, Shanghai, China","institution_ids":["https://openalex.org/I116953780"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100709379","display_name":"Ping Yi","orcid":"https://orcid.org/0000-0003-4530-5118"},"institutions":[{"id":"https://openalex.org/I183067930","display_name":"Shanghai Jiao Tong University","ror":"https://ror.org/0220qvk04","country_code":"CN","type":"education","lineage":["https://openalex.org/I183067930"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ping Yi","raw_affiliation_strings":["[School of Information Security Engineering Shanghai Jiao Tong University, Shanghai, China]"],"raw_orcid":"https://orcid.org/0000-0003-4530-5118","affiliations":[{"raw_affiliation_string":"[School of Information Security Engineering Shanghai Jiao Tong University, Shanghai, China]","institution_ids":["https://openalex.org/I183067930"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":2200,"currency":"USD","value_usd":2200},"apc_paid":{"value":2200,"currency":"USD","value_usd":2200},"fwci":2.3695,"has_fulltext":false,"cited_by_count":26,"citation_normalized_percentile":{"value":0.89945996,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"2015","issue":null,"first_page":"1","last_page":"12"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.8591369390487671},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8157745599746704},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.5798363089561462},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.5295931696891785},{"id":"https://openalex.org/keywords/false-positive-rate","display_name":"False positive rate","score":0.5026223659515381},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.4688868224620819},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.39601364731788635},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.327784925699234},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.3160649240016937},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.2241484820842743},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.22042995691299438},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.1379917860031128}],"concepts":[{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.8591369390487671},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8157745599746704},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.5798363089561462},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.5295931696891785},{"id":"https://openalex.org/C95922358","wikidata":"https://www.wikidata.org/wiki/Q5432725","display_name":"False positive rate","level":2,"score":0.5026223659515381},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.4688868224620819},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.39601364731788635},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.327784925699234},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3160649240016937},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2241484820842743},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.22042995691299438},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.1379917860031128}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1155/2015/102687","is_oa":true,"landing_page_url":"https://doi.org/10.1155/2015/102687","pdf_url":null,"source":{"id":"https://openalex.org/S64417657","display_name":"International Journal of Distributed Sensor Networks","issn_l":"1550-1329","issn":["1550-1329","1550-1477"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319869","host_organization_name":"Hindawi Publishing Corporation","host_organization_lineage":["https://openalex.org/P4310319869"],"host_organization_lineage_names":["Hindawi Publishing Corporation"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Distributed Sensor Networks","raw_type":"journal-article"},{"id":"pmh:oai:RePEc:sae:intdis:v:11:y:2015:i:10:p:102687","is_oa":false,"landing_page_url":"https://journals.sagepub.com/doi/10.1155/2015/102687","pdf_url":null,"source":{"id":"https://openalex.org/S4306401271","display_name":"RePEc: Research Papers in Economics","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I77793887","host_organization_name":"Federal Reserve Bank of St. Louis","host_organization_lineage":["https://openalex.org/I77793887"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},{"id":"pmh:oai:doaj.org/article:0ebfcfe0ac924ebe8dc8f38b5a5531c1","is_oa":true,"landing_page_url":"https://doaj.org/article/0ebfcfe0ac924ebe8dc8f38b5a5531c1","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"International Journal of Distributed Sensor Networks, Vol 11 (2015)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1155/2015/102687","is_oa":true,"landing_page_url":"https://doi.org/10.1155/2015/102687","pdf_url":null,"source":{"id":"https://openalex.org/S64417657","display_name":"International Journal of Distributed Sensor Networks","issn_l":"1550-1329","issn":["1550-1329","1550-1477"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319869","host_organization_name":"Hindawi Publishing Corporation","host_organization_lineage":["https://openalex.org/P4310319869"],"host_organization_lineage_names":["Hindawi Publishing Corporation"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"International Journal of Distributed Sensor Networks","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G2469204493","display_name":null,"funder_award_id":"15ZR1443000","funder_id":"https://openalex.org/F4320321885","funder_display_name":"Science and Technology Commission of Shanghai Municipality"},{"id":"https://openalex.org/G3116948566","display_name":null,"funder_award_id":"61271220","funder_id":"https://openalex.org/F4320321885","funder_display_name":"Science and Technology Commission of Shanghai Municipality"},{"id":"https://openalex.org/G3601058075","display_name":"\u8f66\u8f7d\u79fb\u52a8\u673a\u4f1a\u7f51\u7edc\u5b89\u5168\u4e0e\u4fe1\u4efb\u673a\u5236\u7814\u7a76","funder_award_id":"61271220","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4799204973","display_name":null,"funder_award_id":"15ZR1443000","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G4873789756","display_name":null,"funder_award_id":"2013CB329603","funder_id":"https://openalex.org/F4320321885","funder_display_name":"Science and Technology Commission of Shanghai Municipality"},{"id":"https://openalex.org/G4963487221","display_name":null,"funder_award_id":"2013CB329603","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320321885","display_name":"Science and Technology Commission of Shanghai Municipality","ror":"https://ror.org/03kt66j61"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W80155331","https://openalex.org/W155384935","https://openalex.org/W1490670270","https://openalex.org/W1561983441","https://openalex.org/W1567885833","https://openalex.org/W1896160955","https://openalex.org/W1954903228","https://openalex.org/W1976066853","https://openalex.org/W2019599312","https://openalex.org/W2125910575","https://openalex.org/W2136495567","https://openalex.org/W2138621811","https://openalex.org/W2145594168","https://openalex.org/W2148123869","https://openalex.org/W2149701633","https://openalex.org/W2156094048","https://openalex.org/W2401054255","https://openalex.org/W2482374127","https://openalex.org/W2545374358","https://openalex.org/W2987823657","https://openalex.org/W3023762229"],"related_works":["https://openalex.org/W2097492617","https://openalex.org/W2753240997","https://openalex.org/W1764168690","https://openalex.org/W2537959205","https://openalex.org/W2740895074","https://openalex.org/W2772446090","https://openalex.org/W4284893819","https://openalex.org/W3152891574","https://openalex.org/W2249809453","https://openalex.org/W2388600609"],"abstract_inverted_index":{"Malware":[0],"remains":[1],"a":[2,13,115,130,136,142],"major":[3],"threat":[4],"to":[5,56,153,179,182],"nowadays":[6],"Internet.":[7],"In":[8],"this":[9],"paper,":[10],"we":[11,48,90,113,128],"propose":[12],"DNS":[14,21,26,42,107,116],"graph":[15,22,46,58,63,117],"mining-based":[16],"malware":[17,54,94,161],"detection":[18,55,95],"approach.":[19],"A":[20],"is":[23,103,197],"composed":[24],"of":[25,41,53,61,119,145,169],"nodes,":[27],"which":[28],"represent":[29],"server":[30],"IPs,":[31,33],"client":[32],"and":[34,112,122,199],"queried":[35],"domain":[36],"names":[37],"in":[38,201],"the":[39,45,51,57,68,92,126,147,167],"process":[40],"resolution.":[43],"After":[44],"construction,":[47],"next":[49],"transform":[50],"problem":[52],"mining":[59],"task":[60],"inferring":[62],"nodes\u2019":[64],"reputation":[65,76],"scores":[66,77],"using":[67],"belief":[69],"propagation":[70],"algorithm.":[71],"The":[72,191],"nodes":[73],"with":[74,85,97,135],"lower":[75],"are":[78,177],"inferred":[79],"as":[80],"those":[81],"infected":[82,159],"by":[83,160],"malwares":[84],"higher":[86],"probability.":[87],"For":[88],"demonstration,":[89],"evaluate":[91],"proposed":[93],"approach":[96],"real-world":[98,101],"dataset.":[99],"Our":[100],"dataset":[102],"collected":[104],"from":[105],"campus":[106],"servers":[108],"for":[109,166,186],"three":[110],"months":[111],"built":[114],"consisting":[118],"19,340,820":[120],"vertices":[121],"24,277,564":[123],"edges.":[124],"On":[125],"graph,":[127],"achieve":[129],"true":[131,148],"positive":[132,138,144,149],"rate":[133,139,150],"80.63%":[134],"false":[137,143],"0.023%.":[140],"With":[141],"1.20%,":[146],"was":[151],"improved":[152],"95.66%.":[154],"We":[155],"detected":[156],"88,592":[157],"hosts":[158],"or":[162],"C&C":[163],"servers,":[164],"accounting":[165,185],"percentage":[168],"5.47%":[170],"among":[171,188],"all":[172,189],"hosts.":[173],"Meanwhile,":[174],"117,971":[175],"domains":[176],"considered":[178],"be":[180],"related":[181],"malicious":[183],"activities,":[184],"1.5%":[187],"domains.":[190],"results":[192],"indicate":[193],"that":[194],"our":[195],"method":[196],"efficient":[198],"effective":[200],"detecting":[202],"malwares.":[203]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":4},{"year":2022,"cited_by_count":1},{"year":2021,"cited_by_count":1},{"year":2020,"cited_by_count":7},{"year":2019,"cited_by_count":4},{"year":2018,"cited_by_count":3},{"year":2017,"cited_by_count":3},{"year":2016,"cited_by_count":1}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2025-10-10T00:00:00"}