{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,31]],"date-time":"2026-07-31T15:43:14Z","timestamp":1785512594979,"version":"3.56.0"},"publisher-location":"Cham","reference-count":36,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783319457185","type":"print"},{"value":"9783319457192","type":"electronic"}],"license":[{"start":{"date-parts":[[2016,1,1]],"date-time":"2016-01-01T00:00:00Z","timestamp":1451606400000},"content-version":"unspecified","delay-in-days":0,"URL":"http:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2016]]},"DOI":"10.1007\/978-3-319-45719-2_9","type":"book-chapter","created":{"date-parts":[[2016,9,6]],"date-time":"2016-09-06T02:11:24Z","timestamp":1473127884000},"page":"188-208","source":"Crossref","is-referenced-by-count":47,"title":["Enabling Network Security Through Active DNS Datasets"],"prefix":"10.1007","author":[{"given":"Athanasios","family":"Kountouras","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Panagiotis","family":"Kintis","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chaz","family":"Lever","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yizheng","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yacin","family":"Nadji","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"David","family":"Dagon","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Manos","family":"Antonakakis","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Rodney","family":"Joffe","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2016,9,7]]},"reference":[{"key":"9_CR1","unstructured":"I.T. Mate List (2016). http:\/\/vurldissect.co.uk\/daily.asp\/"},{"key":"9_CR2","unstructured":"Abuse.ch domain blacklist (2016). http:\/\/www.abuse.ch\/"},{"key":"9_CR3","unstructured":"Actionable analytics (2016). https:\/\/www.alexa.com"},{"key":"9_CR4","unstructured":"Common Crawl (2016). https:\/\/commoncrawl.org\/"},{"key":"9_CR5","unstructured":"Domain Graveyard (2016). http:\/\/domaingraveyard.com\/"},{"key":"9_CR6","unstructured":"Hphosts feed (2016). http:\/\/hosts-file.net\/?s=Download"},{"key":"9_CR7","unstructured":"LinuxContainers.org (2016). http:\/\/hosts-file.net\/?s=Download"},{"key":"9_CR8","unstructured":"Malc0de Database (2016). http:\/\/malc0de.com\/bl\/BOOT"},{"key":"9_CR9","unstructured":"Malware Domain List (2016). https:\/\/www.malwaredomainlist.com\/"},{"key":"9_CR10","unstructured":"Sagadc.org list (2016). http:\/\/dns-bh.sagadc.org\/"},{"key":"9_CR11","unstructured":"SANS ISC Feeds (2016). https:\/\/isc.sans.edu\/feeds\/"},{"key":"9_CR12","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1007\/978-3-642-15512-3_2","volume-title":"Recent Advances in Intrusion Detection","author":"M Antonakakis","year":"2010","unstructured":"Antonakakis, M., Dagon, D., Luo, X., Perdisci, R., Lee, W., Bellmor, J.: A centralized monitoring infrastructure for improving DNS security. In: Jha, S., Sommer, R., Kreibich, C. (eds.) RAID 2010. LNCS, vol. 6307, pp. 18\u201337. Springer, Heidelberg (2010)"},{"key":"9_CR13","unstructured":"Antonakakis, M., Perdisci, R., Lee, W., Vasiloglou, N., Dagon, D.: Detecting malware domains in the upper DNS hierarchy. In: Proceedings of the 20th USENIX Conference on Security (USENIX Security), August 2011"},{"key":"9_CR14","unstructured":"Antonakakis, M., Perdisci, R., Nadji, Y., Vasiloglou, N., Abu-Nimeh, S., Lee, W., Dagon, D.: From throw-away traffic to bots: detecting the rise of DGA-based malware. In: Proceedings of the 21st USENIX Conference on Security Symposium, Security 2012, Berkeley, CA, USA, pp. 24\u201324. USENIX Association (2012)"},{"key":"9_CR15","unstructured":"Bilge, L., Kirda, E., Kruegel, C., Balduzzi, M.: EXPOSURE: finding malicious domains using passive DNS analysis. In: Proceedings of NDSS (2011)"},{"key":"9_CR16","doi-asserted-by":"crossref","unstructured":"Chen, Y., Antonakakis, M., Perdisci, R., Nadji, Y., Dagon, D., Lee, W.: DNS noise: measuring the pervasiveness of disposable domains in modern DNS traffic. In: 2014 44th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN), pp. 598\u2013609, June 2014","DOI":"10.1109\/DSN.2014.61"},{"key":"9_CR17","unstructured":"Coat, B.: Snake in the grass: Python-based malware used for targeted attacks (2014). https:\/\/www2.bluecoat.com\/security-blog\/2014-06-10\/snake-grass-python-based-malware-used-targeted-attacks"},{"key":"9_CR18","doi-asserted-by":"crossref","unstructured":"Cotton, M., Vegoda, L.: Special Use IPv4 Addresses. RFC 5735 (Best Current Practice), Obsoleted by RFC 6890, updated by RFC 6598, January 2010","DOI":"10.17487\/rfc5735"},{"key":"9_CR19","doi-asserted-by":"crossref","unstructured":"Daigle, L.: WHOIS Protocol Specification. RFC 3912 (Draft Standard), September 2004","DOI":"10.17487\/rfc3912"},{"key":"9_CR20","doi-asserted-by":"crossref","unstructured":"Durumeric, Z., Adrian, D., Mirian, A., Bailey, M., Halderman, J.A.: A search engine backed by Internet-wide scanning. In: Proceedings of the 22nd ACM Conference on Computer and Communications Security, October 2015","DOI":"10.1145\/2810103.2813703"},{"key":"9_CR21","unstructured":"Felegyhazi, M., Kreibich, C., Paxson, V.: On the potential of proactive domain blacklisting. In: Proceedings of the 3rd USENIX Conference on Large-Scale Exploits, Emergent Threats (2011). Observation of strains. Infect Dis Ther. 3(1), 35\u201343: Botnets, Spyware, Worms, and More (LEET), April 2010"},{"key":"9_CR22","unstructured":"Holz, T., Gorecki, C., Rieck, K., Freiling, F.C.: Measuring and detecting fast-flux service networks. In: NDSS (2008)"},{"issue":"3","key":"9_CR23","first-page":"794","volume":"95","author":"K Ishibashi","year":"2012","unstructured":"Ishibashi, K., Toyono, T., Hasegawa, H., Yoshino, H.: Extending black domain name list by using co-occurrence relation between DNS queries. IEICE Trans. Commun. 95(3), 794\u2013802 (2012)","journal-title":"IEICE Trans. Commun."},{"key":"9_CR24","doi-asserted-by":"crossref","unstructured":"Krishnan, S., Monrose, F.: An empirical study of the performance, security and privacy implications of domain name prefetching. In: 2011 IEEE\/IFIP 41st International Conference on Dependable Systems Networks (DSN), pp. 61\u201372, June 2011","DOI":"10.1109\/DSN.2011.5958207"},{"key":"9_CR25","doi-asserted-by":"crossref","unstructured":"Lever, C., Walls, R., Nadji, Y., Dagon, D., McDaniel, P., Antonakakis, M.: Domain-Z: 28 registrations later measuring the exploitation of residual trust in domains. In: 37th IEEE International Symposium on Security and Privacy, May 2016","DOI":"10.1109\/SP.2016.47"},{"key":"9_CR26","doi-asserted-by":"crossref","unstructured":"Ma, J., Saul, L.K., Savage, S., Voelker, G.M.: Beyond blacklists: learning to detect malicious web sites from suspicious URLs. In: Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), June 2009","DOI":"10.1145\/1557019.1557153"},{"key":"9_CR27","unstructured":"Mandiant. APT1. Technical report (2013). http:\/\/intelreport.mandiant.com\/Mandiant_APT1_Report.pdf"},{"key":"9_CR28","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"crossref","first-page":"390","DOI":"10.1007\/978-3-642-41284-4_20","volume-title":"Research in Attacks, Intrusions, and Defenses","author":"Y Nadji","year":"2013","unstructured":"Nadji, Y., Antonakakis, M., Perdisci, R., Lee, W.: Connected colors: unveiling the structure of criminal networks. In: Stolfo, S.J., Stavrou, A., Wright, C.V. (eds.) RAID 2013. LNCS, vol. 8145, pp. 390\u2013410. Springer, Heidelberg (2013)"},{"key":"9_CR29","doi-asserted-by":"crossref","unstructured":"Plonka, D., Barford, P.: Context-aware clustering of DNS query traffic. In: Proceedings of the 8th ACM SIGCOMM Conference on Internet Measurement, IMC 2008, pp. 217\u2013230. ACM, New York (2008)","DOI":"10.1145\/1452520.1452547"},{"key":"9_CR30","doi-asserted-by":"crossref","unstructured":"Prakash, P., Kumar, M., Kompella, R.R., Gupta, M.: Phishnet: predictive blacklisting to detect phishing attacks. In: Proceedings of IEEE INFOCOM, 2010, pp. 1\u20135. IEEE (2010)","DOI":"10.1109\/INFCOM.2010.5462216"},{"key":"9_CR31","doi-asserted-by":"crossref","unstructured":"Rahbarinia, B., Perdisci, R., Antonakakis, M.: Segugio: efficient behavior-based tracking of malware-control domains in large ISP networks. In: 2015 45th Annual IEEE\/IFIP International Conference on Dependable Systems and Networks (DSN), pp. 403\u2013414, June 2015","DOI":"10.1109\/DSN.2015.35"},{"key":"9_CR32","doi-asserted-by":"crossref","unstructured":"Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G.J., Lear, E.: Address Allocation for Private Internets. RFC 1918 (Best Current Practice), Updated by RFC 6761, February 1996","DOI":"10.17487\/rfc1918"},{"key":"9_CR33","unstructured":"Minerva Labs & ClearSky Cyber Security: CopyKittens Attack Group (2015). https:\/\/eforensicsmag.com\/copykittens\/"},{"key":"9_CR34","doi-asserted-by":"crossref","unstructured":"Weil, J., Kuarsingh, V., Donley, C., Liljenstolpe, C., Azinger, M.: IANA-Reserved IPv4 Prefix for Shared Address Space. RFC 6598 (Best Current Practice), April 2012","DOI":"10.17487\/rfc6598"},{"key":"9_CR35","unstructured":"Weimer, F.: Passive DNS replication. In: Proceedings of the 17th First Conference on Computer Security Incident Handling, June 2005"},{"key":"9_CR36","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"crossref","first-page":"129","DOI":"10.1007\/978-3-540-73614-1_8","volume-title":"Detection of Intrusions and Malware, and Vulnerability Assessment","author":"B Zdrnja","year":"2007","unstructured":"Zdrnja, B., Brownlee, N., Wessels, D.: Passive monitoring of DNS anomalies. In: H\u00e4mmerli, B.M., Sommer, R. (eds.) DIMVA 2007. LNCS, vol. 4579, pp. 129\u2013139. Springer, Heidelberg (2007)"}],"container-title":["Lecture Notes in Computer Science","Research in Attacks, Intrusions, and Defenses"],"original-title":[],"link":[{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-45719-2_9","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,9,13]],"date-time":"2019-09-13T06:25:06Z","timestamp":1568355906000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/978-3-319-45719-2_9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016]]},"ISBN":["9783319457185","9783319457192"],"references-count":36,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-45719-2_9","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016]]}}}