{"id":"https://openalex.org/W2926623002","doi":"https://doi.org/10.29007/c4wj","title":"A Multi-Stage Detection Technique for DNS-Tunneled Botnets","display_name":"A Multi-Stage Detection Technique for DNS-Tunneled Botnets","publication_year":2019,"publication_date":"2019-03-13","ids":{"openalex":"https://openalex.org/W2926623002","doi":"https://doi.org/10.29007/c4wj","mag":"2926623002"},"language":"en","primary_location":{"id":"doi:10.29007/c4wj","is_oa":true,"landing_page_url":"https://doi.org/10.29007/c4wj","pdf_url":"https://easychair.org/publications/open/qnp1","source":{"id":"https://openalex.org/S4220651395","display_name":"EPiC series in computing","issn_l":"2398-7340","issn":["2398-7340"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"EPiC Series in Computing","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://easychair.org/publications/open/qnp1","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5081138500","display_name":"Tirthankar Ghosh","orcid":"https://orcid.org/0000-0003-1914-711X"},"institutions":[{"id":"https://openalex.org/I83683471","display_name":"University of West Florida","ror":"https://ror.org/002w4zy91","country_code":"US","type":"education","lineage":["https://openalex.org/I83683471"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Tirthankar Ghosh","raw_affiliation_strings":["University of West Florida, Pensacola, FL, U.S.A"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of West Florida, Pensacola, FL, U.S.A","institution_ids":["https://openalex.org/I83683471"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5109335795","display_name":"Eman El-Sheikh","orcid":null},"institutions":[{"id":"https://openalex.org/I83683471","display_name":"University of West Florida","ror":"https://ror.org/002w4zy91","country_code":"US","type":"education","lineage":["https://openalex.org/I83683471"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Eman El-Sheikh","raw_affiliation_strings":["University of West Florida, Pensacola, FL, U.S.A"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of West Florida, Pensacola, FL, U.S.A","institution_ids":["https://openalex.org/I83683471"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5012511173","display_name":"Wasseem Jammal","orcid":null},"institutions":[{"id":"https://openalex.org/I173963315","display_name":"St. Cloud State University","ror":"https://ror.org/016czhx14","country_code":"US","type":"education","lineage":["https://openalex.org/I173963315","https://openalex.org/I91221267"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Wasseem Jammal","raw_affiliation_strings":["St. Cloud State University, St Cloud, MN, U.S.A"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"St. Cloud State University, St Cloud, MN, U.S.A","institution_ids":["https://openalex.org/I173963315"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.4807,"has_fulltext":true,"cited_by_count":6,"citation_normalized_percentile":{"value":0.50072126,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":96},"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.9711976051330566},{"id":"https://openalex.org/keywords/domain-name-system","display_name":"Domain Name System","score":0.8850729465484619},{"id":"https://openalex.org/keywords/server","display_name":"Server","score":0.8199979066848755},{"id":"https://openalex.org/keywords/handshake","display_name":"Handshake","score":0.7474035620689392},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.713518500328064},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6957118511199951},{"id":"https://openalex.org/keywords/encryption","display_name":"Encryption","score":0.5067241787910461},{"id":"https://openalex.org/keywords/command-and-control","display_name":"Command and control","score":0.4878811836242676},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.44789817929267883},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.19299659132957458},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.11515006422996521},{"id":"https://openalex.org/keywords/telecommunications","display_name":"Telecommunications","score":0.09501737356185913}],"concepts":[{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.9711976051330566},{"id":"https://openalex.org/C35026560","wikidata":"https://www.wikidata.org/wiki/Q8767","display_name":"Domain Name System","level":3,"score":0.8850729465484619},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.8199979066848755},{"id":"https://openalex.org/C2778000800","wikidata":"https://www.wikidata.org/wiki/Q830043","display_name":"Handshake","level":3,"score":0.7474035620689392},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.713518500328064},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6957118511199951},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.5067241787910461},{"id":"https://openalex.org/C506615639","wikidata":"https://www.wikidata.org/wiki/Q21662260","display_name":"Command and control","level":2,"score":0.4878811836242676},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.44789817929267883},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.19299659132957458},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.11515006422996521},{"id":"https://openalex.org/C76155785","wikidata":"https://www.wikidata.org/wiki/Q418","display_name":"Telecommunications","level":1,"score":0.09501737356185913},{"id":"https://openalex.org/C151319957","wikidata":"https://www.wikidata.org/wiki/Q752739","display_name":"Asynchronous communication","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.29007/c4wj","is_oa":true,"landing_page_url":"https://doi.org/10.29007/c4wj","pdf_url":"https://easychair.org/publications/open/qnp1","source":{"id":"https://openalex.org/S4220651395","display_name":"EPiC series in computing","issn_l":"2398-7340","issn":["2398-7340"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"EPiC Series in Computing","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.29007/c4wj","is_oa":true,"landing_page_url":"https://doi.org/10.29007/c4wj","pdf_url":"https://easychair.org/publications/open/qnp1","source":{"id":"https://openalex.org/S4220651395","display_name":"EPiC series in computing","issn_l":"2398-7340","issn":["2398-7340"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"EPiC Series in Computing","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2926623002.pdf","grobid_xml":"https://content.openalex.org/works/W2926623002.grobid-xml"},"referenced_works_count":15,"referenced_works":["https://openalex.org/W85558978","https://openalex.org/W196740607","https://openalex.org/W1561983441","https://openalex.org/W1954903228","https://openalex.org/W2117002131","https://openalex.org/W2122941797","https://openalex.org/W2135185964","https://openalex.org/W2143201208","https://openalex.org/W2149701633","https://openalex.org/W2184039922","https://openalex.org/W2242094442","https://openalex.org/W2487301225","https://openalex.org/W2987823657","https://openalex.org/W4238093955","https://openalex.org/W4381304672"],"related_works":["https://openalex.org/W1642214788","https://openalex.org/W2733931179","https://openalex.org/W2054545906","https://openalex.org/W2543487408","https://openalex.org/W2065991182","https://openalex.org/W2016713855","https://openalex.org/W4307020412","https://openalex.org/W2965181964","https://openalex.org/W2898126008","https://openalex.org/W2760320879"],"abstract_inverted_index":{"Botnet":[0],"communications":[1,35,43,98],"are":[2,44],"obfuscated":[3],"within":[4,36],"legitimate":[5],"network":[6],"protocols":[7],"to":[8,22,94,104,114],"avoid":[9],"detection":[10,52,65],"and":[11,39,80,108,121],"remediation.":[12],"Domain":[13,68],"Name":[14],"Service":[15,77],"(DNS)":[16],"is":[17,92],"a":[18,63],"protocol":[19],"of":[20,57],"choice":[21],"hide":[23],"communication":[24],"with":[25],"Command":[26],"&":[27],"Control":[28],"(C&C)":[29],"servers,":[30,107],"where":[31],"botmasters":[32,49],"tunnel":[33],"these":[34,58],"DNS":[37,82],"request":[38],"response.":[40],"Since":[41],"botnet":[42,97],"characterized":[45],"by":[46,54,99],"different":[47,101],"features,":[48],"may":[50],"evade":[51],"methods":[53],"modifying":[55],"some":[56],"features.":[59],"This":[60,90],"paper":[61],"proposes":[62],"multi-staged":[64],"approach":[66,91],"for":[67],"Generation":[69],"Algorithm":[70],"(DGA)":[71],"using":[72,85,110],"domain":[73],"fluxing,":[74],"Fast":[75],"Flux":[76],"Network":[78,87],"(FFSN),":[79],"encrypted":[81],"tunneled-based":[83],"botnets":[84],"BRO":[86],"Security":[88],"Monitor.":[89],"able":[93],"detect":[95,115],"DNS-tunneled":[96,116],"analyzing":[100],"techniques":[102],"used":[103],"find":[105],"C&C":[106,122],"also":[109],"signature":[111],"matching":[112],"technique":[113],"SSH":[117],"handshake":[118],"between":[119],"bots":[120],"servers.":[123]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":2},{"year":2023,"cited_by_count":1},{"year":2021,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}