{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,25]],"date-time":"2025-10-25T14:15:26Z","timestamp":1761401726209,"version":"3.40.3"},"publisher-location":"Cham","reference-count":21,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783319079943"},{"type":"electronic","value":"9783319079950"}],"license":[{"start":{"date-parts":[[2014,1,1]],"date-time":"2014-01-01T00:00:00Z","timestamp":1388534400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2014,1,1]],"date-time":"2014-01-01T00:00:00Z","timestamp":1388534400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2014]]},"DOI":"10.1007\/978-3-319-07995-0_46","type":"book-chapter","created":{"date-parts":[[2014,6,10]],"date-time":"2014-06-10T23:24:31Z","timestamp":1402442671000},"page":"463-472","source":"Crossref","is-referenced-by-count":9,"title":["Supervised Learning Approaches with Majority Voting for DNS Tunneling Detection"],"prefix":"10.1007","author":[{"given":"Maurizio","family":"Aiello","sequence":"first","affiliation":[]},{"given":"Maurizio","family":"Mongelli","sequence":"additional","affiliation":[]},{"given":"Gianluca","family":"Papaleo","sequence":"additional","affiliation":[]}],"member":"297","reference":[{"issue":"1","key":"46_CR1","doi-asserted-by":"publisher","first-page":"81","DOI":"10.1016\/j.comnet.2008.09.010","volume":"53","author":"M. Dusi","year":"2009","unstructured":"Dusi, M., Crotti, M., Gringoli, F., Salgarelli, L.: Tunnel hunter: Detecting application-layer tunnels with statistical fingerprinting. Computer Networks\u00a053(1), 81\u201397 (2009)","journal-title":"Computer Networks"},{"key":"46_CR2","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"84","DOI":"10.1007\/978-3-642-21323-6_11","volume-title":"Computational Intelligence in Security for Information Systems","author":"A. Merlo","year":"2011","unstructured":"Merlo, A., Papaleo, G., Veneziano, S., Aiello, M.: A comparative performance evaluation of dns tunneling tools. In: Herrero, \u00c1., Corchado, E. (eds.) CISIS 2011. LNCS, vol.\u00a06694, pp. 84\u201391. Springer, Heidelberg (2011)"},{"key":"46_CR3","doi-asserted-by":"crossref","unstructured":"Li, W., Canini, M., Moore, A.W., Bolla, R.: Efficient application identification and the temporal and spatial stability of classification schema. Elsevier Computer Network, 790\u2013809 (2009)","DOI":"10.1016\/j.comnet.2008.11.016"},{"issue":"5","key":"46_CR4","doi-asserted-by":"publisher","first-page":"5","DOI":"10.1145\/1163593.1163596","volume":"36","author":"N. Williams","year":"2006","unstructured":"Williams, N., Zander, S., Armitage, G.: A preliminary performance comparison of five machine learning algorithms for practical ip traffic flow classification. SIGCOMM Comput. Commun. Rev.\u00a036(5), 5\u201316 (2006)","journal-title":"SIGCOMM Comput. Commun. Rev."},{"issue":"1","key":"46_CR5","doi-asserted-by":"publisher","first-page":"50","DOI":"10.1145\/1071690.1064220","volume":"33","author":"A.W. Moore","year":"2005","unstructured":"Moore, A.W., Zuev, D.: Internet traffic classification using bayesian analysis techniques. SIGMETRICS Perform. Eval. Rev.\u00a033(1), 50\u201360 (2005)","journal-title":"SIGMETRICS Perform. Eval. Rev."},{"key":"46_CR6","doi-asserted-by":"crossref","unstructured":"Herrero, A., Navarro, M., Corchado, E., Julin, V.: Rt-movicab-ids: Addressing real-time intrusion detection. Future Generation Computer Systems\u00a029(1), 250\u2013261 (2013), Including Special section: AIRCC-NetCoM 2009 and Special section: Clouds and Service-Oriented Architectures","DOI":"10.1016\/j.future.2010.12.017"},{"key":"46_CR7","doi-asserted-by":"crossref","unstructured":"Aiello, M., Mongelli, M., Papaleo, G.: Basic classifiers for dns tunneling detection. In: 2013 IEEE Symposium on Computers and Communications (ISCC), pp. 000880\u2013000885 (July 2013)","DOI":"10.1109\/ISCC.2013.6755060"},{"issue":"11","key":"46_CR8","doi-asserted-by":"publisher","first-page":"656","DOI":"10.1049\/el.2011.0399","volume":"47","author":"H. Kim","year":"2011","unstructured":"Kim, H., Huh, J.: Detecting dns-poisoning-based phishing attacks from their network performance characteristics. Electronics Letters\u00a047(11), 656\u2013658 (2011)","journal-title":"Electronics Letters"},{"key":"46_CR9","unstructured":"Brown, G.: Ensemble learning tutorial, \n                    http:\/\/www.cs.man.ac.uk\/~gbrown\/ensemblebib\/tutorials.php\n                   (accessed in 2014)"},{"key":"46_CR10","doi-asserted-by":"publisher","first-page":"22","DOI":"10.1007\/s10044-002-0173-7","volume":"6","author":"L.I. Kuncheva","year":"2003","unstructured":"Kuncheva, L.I., Whitaker, C.J., Duin, R.P.W.: Limits on the majority vote accuracy in classifier fusion. Pattern Analysis and Applications\u00a06, 22\u201331 (2003)","journal-title":"Pattern Analysis and Applications"},{"key":"46_CR11","unstructured":"Wessels, D., et al.: Squid proxy, \n                    http:\/\/www.squid-cache.org\n                   (accessed in 2014)"},{"key":"46_CR12","unstructured":"Dembour, O., Collignon, N.: Dns2tcp tool, \n                    www.hsc.fr\/ressources\/outils\/dns2tcp\/index.html.en\n                   (accessed in 2014)"},{"key":"46_CR13","unstructured":"Kryo: Iodine tool, \n                    http:\/\/ip-dns.info\n                   (accessed in 2014)"},{"key":"46_CR14","unstructured":"Born, K., Gustafson, D.: Detecting dns tunnels using character frequency analysis. arXiv preprint arXiv:1004.4358 (2010)"},{"key":"46_CR15","unstructured":"Burghouwt, P., Spruit, M., Sips, H.: Detection of botnet collusion by degree distribution of domains. In: ICITST 2010. IEEE Press (November 2010)"},{"key":"46_CR16","doi-asserted-by":"crossref","unstructured":"Karasaridis, A., Meier-Hellstern, K.S., Hoeflin, D.A.: Detection of dns anomalies using flow data analysis. In: GLOBECOM. IEEE (2006)","DOI":"10.1109\/GLOCOM.2006.280"},{"issue":"6","key":"46_CR17","doi-asserted-by":"publisher","first-page":"1326","DOI":"10.1016\/j.comnet.2010.12.002","volume":"55","author":"R. Alshammari","year":"2011","unstructured":"Alshammari, R., Zincir-Heywood, A.N.: Can encrypted traffic be identified without port numbers, ip addresses and payload inspection? Computer Networks\u00a055(6), 1326\u20131350 (2011)","journal-title":"Computer Networks"},{"key":"46_CR18","unstructured":"Hind, J.: Catching dns tunnels with a.i. In: Proceedings of DefCon, vol.\u00a017 (August 2009)"},{"key":"46_CR19","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"140","DOI":"10.1007\/978-3-540-73614-1_9","volume-title":"Detection of Intrusions and Malware, and Vulnerability Assessment","author":"J. Oberheide","year":"2007","unstructured":"Oberheide, J., Karir, M., Mao, Z.M.: Characterizing dark DNS behavior. In: H\u00e4mmerli, B.M., Sommer, R. (eds.) DIMVA 2007. LNCS, vol.\u00a04579, pp. 140\u2013156. Springer, Heidelberg (2007)"},{"issue":"2","key":"46_CR20","doi-asserted-by":"publisher","first-page":"373","DOI":"10.1214\/aos\/1176342377","volume":"1","author":"J. Klotz","year":"1973","unstructured":"Klotz, J., et al.: Statistical inference in bernoulli trials with dependence. The Annals of Statistics\u00a01(2), 373\u2013379 (1973)","journal-title":"The Annals of Statistics"},{"key":"46_CR21","doi-asserted-by":"crossref","unstructured":"Herrero, A., Zurutuza, U., Corchado, E.: A neural-visualization ids for honeynet data. International Journal of Neural Systems\u00a022(2) (2012)","DOI":"10.1142\/S0129065712500050"}],"container-title":["Advances in Intelligent Systems and Computing","International Joint Conference SOCO\u201914-CISIS\u201914-ICEUTE\u201914"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-07995-0_46","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,2,20]],"date-time":"2023-02-20T04:37:28Z","timestamp":1676867848000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-319-07995-0_46"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014]]},"ISBN":["9783319079943","9783319079950"],"references-count":21,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-07995-0_46","relation":{},"ISSN":["2194-5357","2194-5365"],"issn-type":[{"type":"print","value":"2194-5357"},{"type":"electronic","value":"2194-5365"}],"subject":[],"published":{"date-parts":[[2014]]}}}