{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,9]],"date-time":"2026-01-09T18:58:23Z","timestamp":1767985103346,"version":"3.49.0"},"reference-count":64,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2020,5,15]],"date-time":"2020-05-15T00:00:00Z","timestamp":1589500800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"},{"start":{"date-parts":[[2020,5,15]],"date-time":"2020-05-15T00:00:00Z","timestamp":1589500800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springer.com\/tdm"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Inf. Secur."],"published-print":{"date-parts":[[2021,6]]},"DOI":"10.1007\/s10207-020-00502-x","type":"journal-article","created":{"date-parts":[[2020,5,15]],"date-time":"2020-05-15T03:54:42Z","timestamp":1589514882000},"page":"313-329","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":10,"title":["A wrinkle in time: a case study in DNS poisoning"],"prefix":"10.1007","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6035-5127","authenticated-orcid":false,"given":"Harel","family":"Berger","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Amit Z.","family":"Dvir","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Moti","family":"Geva","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2020,5,15]]},"reference":[{"key":"502_CR1","doi-asserted-by":"crossref","unstructured":"Mockapetris, P.: RFC 1034 Domain Names-Concepts and Facilities (1987). http:\/\/tools.ietf.org\/html\/rfc1034","DOI":"10.17487\/rfc1034"},{"key":"502_CR2","doi-asserted-by":"crossref","unstructured":"Mockapetris, P.: Domain names-implementation and specification. STD\u00a013, RFC Editor (1987). http:\/\/www.rfc-editor.org\/rfc\/rfc1035.txt","DOI":"10.17487\/rfc1035"},{"key":"502_CR3","unstructured":"BT\u00a0global services. DNS Security Survey Report. BT global services (2017). https:\/\/stats.labs.apnic.net\/dnssec\/XA?c=XA&x=1&g=1&r=1&w=7&g=0"},{"key":"502_CR4","doi-asserted-by":"crossref","unstructured":"Kambourakis, G., Moschos, T., Geneiatakis, D., Gritzalis, SD.: Detecting DNS amplification attacks. In: Critical Information Infrastructures Security, pp. 185\u2013196. Springer, Berlin, Heidelberg (2007)","DOI":"10.1007\/978-3-540-89173-4_16"},{"issue":"1","key":"502_CR5","first-page":"2","volume":"3","author":"C Jackson","year":"2009","unstructured":"Jackson, C., Barth, A., Bortz, A., Shao, W., Boneh, D.: Protecting browsers from dns rebinding attacks. ACM Trans. Web (TWEB) 3(1), 2 (2009)","journal-title":"ACM Trans. Web (TWEB)"},{"key":"502_CR6","doi-asserted-by":"crossref","unstructured":"Cheshire, S., Krochmal, M.: DNS-based service discovery. RFC 6763, RFC Editor (2013). http:\/\/www.rfc-editor.org\/rfc\/rfc6763.txt","DOI":"10.17487\/rfc6763"},{"key":"502_CR7","doi-asserted-by":"crossref","unstructured":"Ballani, H., Francis, P.: Mitigating DNS dos attacks. In: Proceedings of the 15th ACM Conference on Computer and Communications Security, pp. 189\u2013198. ACM (2008)","DOI":"10.1145\/1455770.1455796"},{"key":"502_CR8","doi-asserted-by":"crossref","unstructured":"Son, S., Shmatikov, V.: The Hitchhiker\u2019s guide to DNS cache poisoning. In: Security and Privacy in Communication Networks, pp. 466\u2013483. Springer, Berlin, Heidelberg (2010)","DOI":"10.1007\/978-3-642-16161-2_27"},{"issue":"6","key":"502_CR9","first-page":"783","volume":"4","author":"M Nazreen Banu","year":"2013","unstructured":"Nazreen Banu, M., Munawara Banu, S.: A comprehensive study of phishing attacks. Int. J. Comput. Sci. Inf. Technol. 4(6), 783\u2013786 (2013)","journal-title":"Int. J. Comput. Sci. Inf. Technol."},{"key":"502_CR10","unstructured":"Amazon. Alexa top sites. Alexa top sites (2018). https:\/\/www.alexa.com\/topsites"},{"key":"502_CR11","unstructured":"IUCC. Inter-University Computation Center. IUCC website (2018). https:\/\/www.iucc.ac.il\/"},{"issue":"6","key":"502_CR12","doi-asserted-by":"publisher","first-page":"1877","DOI":"10.1109\/JSAC.2016.2558918","volume":"34","author":"R van Rijswijk-Deij","year":"2016","unstructured":"van Rijswijk-Deij, R., Jonker, M., Sperotto, A., Pras, A.: A high-performance, scalable infrastructure for large-scale active DNS measurements. IEEE J. Sel. Areas Commun. 34(6), 1877\u20131888 (2016)","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"502_CR13","doi-asserted-by":"crossref","unstructured":"Ager, B., M\u00fchlbauer, W., Smaragdakis, G., Uhlig, S.: Comparing DNS resolvers in the wild. In: Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement, pp. 15\u201321. ACM (2010)","DOI":"10.1145\/1879141.1879144"},{"key":"502_CR14","unstructured":"Google. Google Public DNS. Google website (2018). https:\/\/developers.google.com\/speed\/public-dns\/"},{"key":"502_CR15","unstructured":"OpenDNS. OpenDNS. Cisco website (2018). https:\/\/www.opendns.com\/"},{"key":"502_CR16","doi-asserted-by":"publisher","first-page":"168020","DOI":"10.1109\/ACCESS.2019.2950325","volume":"7","author":"P Callejo","year":"2019","unstructured":"Callejo, P., Cuevas, R., Vallina-Rodriguez, N., Rumin, A.C.: Measuring the global recursive DNS infrastructure: a view from the edge. IEEE Access 7, 168020\u2013168028 (2019)","journal-title":"IEEE Access"},{"key":"502_CR17","doi-asserted-by":"crossref","unstructured":"Callejo, P., Kelton, C., Vallina-Rodriguez, N., Cuevas, R., Gasser, O., Kreibich, C., Wohlfart, F., Cuevas, A.: Opportunities and challenges of AD-based measurements from the edge of the network. In: Proceedings of the 16th ACM Workshop on Hot Topics in Networks, pp. 87\u201393 (2017)","DOI":"10.1145\/3152434.3152895"},{"key":"502_CR18","unstructured":"Rose, S., Larson, M., Massey, D., Austein, R., Arends, R.: DNS Security Introduction and Requirements. RFC 4033 (2005)"},{"key":"502_CR19","doi-asserted-by":"crossref","unstructured":"Arends, R., Austein, R., Larson, M., Massey, D., Rose, S.: Resource records for the DNS security extensions. In: Internet Requests for Comments (2005). http:\/\/www.rfc-editor.org\/rfc\/rfc4034.txt","DOI":"10.17487\/rfc4034"},{"key":"502_CR20","doi-asserted-by":"crossref","unstructured":"Arends, R., Austein, R., Larson, M., Massey, D., Rose, S.: Protocol modifications for the DNS security extensions. In: Internet Requests for Comments (2005). http:\/\/www.rfc-editor.org\/rfc\/rfc4035.txt","DOI":"10.17487\/rfc4035"},{"key":"502_CR21","unstructured":"Silva, P.: Dnssec: the antidote to DNS cache poisoning and other DNS a ACKS. White paper, F5 (2009)"},{"key":"502_CR22","unstructured":"stats.labs.apnic.net. DNSSEC deploy rate. stats.labs.apnic.net (2018). https:\/\/www.globalservices.bt.com\/static\/assets\/pdf\/products\/diamond_ip\/DNS-Security-Survey-Report-2017.pdf"},{"key":"502_CR23","doi-asserted-by":"crossref","unstructured":"Dai, T., Shulman, H., Waidner, M.: Dnssec misconfigurations in popular domains. In: International Conference on Cryptology and Network Security, pp. 651\u2013660. Springer (2016)","DOI":"10.1007\/978-3-319-48965-0_43"},{"key":"502_CR24","doi-asserted-by":"crossref","unstructured":"Ariyapperuma, S., Mitchell, C.J.: Security vulnerabilities in DNS and DNSSEC. In: The Second International Conference on Availability, Reliability and Security (ARES\u201907), pp. 335\u2013342. IEEE (2007)","DOI":"10.1109\/ARES.2007.139"},{"key":"502_CR25","doi-asserted-by":"crossref","unstructured":"Anu, P., Vimala, S.: A survey on sniffing attacks on computer networks. In: 2017 International Conference on Intelligent Computing and Control (I2C2), pp. 1\u20135. IEEE (2017)","DOI":"10.1109\/I2C2.2017.8321914"},{"key":"502_CR26","doi-asserted-by":"crossref","unstructured":"van Rijswijk-Deij, R., Sperotto, A., Pras, A.: DNSSEC and its potential for DDOS attacks: a comprehensive measurement study. In: Proceedings of the 2014 Conference on Internet Measurement Conference, pp. 449\u2013460. ACM (2014)","DOI":"10.1145\/2663716.2663731"},{"key":"502_CR27","doi-asserted-by":"crossref","unstructured":"van Rijswijk-Deij, R., Jonker, M., Sperotto, A.: On the adoption of the elliptic curve digital signature algorithm (ECDSA) in DNSSEC. In: 12th International Conference on Network and Service Management (CNSM), pp. 258\u2013262. IEEE (2016)","DOI":"10.1109\/CNSM.2016.7818428"},{"key":"502_CR28","unstructured":"Bernstein, D.J.: Dnscurve: usable security for DNS. dnscurve.org (2009)"},{"key":"502_CR29","unstructured":"Bernstein, D.J.: Dnscurve: usable security for DNS, 2009 (2011)"},{"key":"502_CR30","unstructured":"DNScrypt. DNScrypt. DNScrypt website (2013). https:\/\/dnscrypt.info\/"},{"key":"502_CR31","doi-asserted-by":"publisher","first-page":"13640","DOI":"10.1109\/ACCESS.2020.2966428","volume":"8","author":"Y Zhong","year":"2020","unstructured":"Zhong, Y., Xue, D., Fan, J., Guo, C.: Dnstsm: DNS cache resources trusted sharing model based on consortium blockchain. IEEE Access 8, 13640\u201313650 (2020)","journal-title":"IEEE Access"},{"key":"502_CR32","doi-asserted-by":"crossref","unstructured":"Wang, Y., Hu, M.Z., Li, B., Yan, B.R.: Tracking anomalous behaviors of name servers by mining DNS traffic. In: Frontiers of High Performance Computing and Networking\u2014ISPA 2006 Workshops, pp. 351\u2013357. Springer (2006)","DOI":"10.1007\/11942634_37"},{"key":"502_CR33","doi-asserted-by":"crossref","unstructured":"Yamada, A., Miyake, Y., Terabe, M., Hashimoto, K., Kato, N.: Anomaly detection for DNS servers using frequent host selection. In: International Conference on Advanced Information Networking and Applications, AINA\u201909, pp. 853\u2013860. IEEE (2009)","DOI":"10.1109\/AINA.2009.93"},{"key":"502_CR34","unstructured":"Haya\u00a0Shulman Klein, A., Waidner, M.: Internet-wide study of DNS cache injections. In: IEEE International Conference on Computer Communications 2017, Atlanta. IEEE"},{"key":"502_CR35","doi-asserted-by":"crossref","unstructured":"Alharbi, F., Chang, J., Zhou, Y., Qian, F., Qian, Z., Abu-Ghazaleh, N.: Collaborative client-side DNS cache poisoning attack. In: IEEE INFOCOM 2019-IEEE Conference on Computer Communications, pp. 1153\u20131161. IEEE (2019)","DOI":"10.1109\/INFOCOM.2019.8737514"},{"key":"502_CR36","unstructured":"Celik, Z.B., Oktug, S.: Detection of fast-flux networks using various DNS feature sets. In: IEEE Symposium on Computers and Communications (ISCC), pp. 868\u2013873. IEEE (2013)"},{"key":"502_CR37","unstructured":"Ertoz, L., Eilertson, E., Lazarevic, A., Tan, P.N., Kumar, V., Srivastava, J., Dokas, P.: Minds-minnesota intrusion detection system. In: Next Generation Data Mining, pp. 199-218. MIT Press, Cambridge, USA (2004)"},{"issue":"6","key":"502_CR38","doi-asserted-by":"publisher","first-page":"1978","DOI":"10.1109\/TNET.2013.2294254","volume":"22","author":"H Yao","year":"2014","unstructured":"Yao, H., Silva, D., Jaggi, S., Langberg, M.: Network codes resilient to jamming and eavesdropping. IEEE\/ACM Trans. Netw. 22(6), 1978\u20131987 (2014)","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"502_CR39","doi-asserted-by":"crossref","unstructured":"Herzberg, A., Shulman, H.: Socket overloading for fun and cache-poisoning. In: Proceedings of the 29th Annual Computer Security Applications Conference, pp. 189\u2013198. ACM (2013)","DOI":"10.1145\/2523649.2523662"},{"key":"502_CR40","doi-asserted-by":"crossref","unstructured":"Herzberg, A., Shulman, H.: Dnssec: security and availability challenges. In: 2013 IEEE Conference on Communications and Network Security (CNS), pp. 365\u2013366. IEEE (2013)","DOI":"10.1109\/CNS.2013.6682730"},{"key":"502_CR41","doi-asserted-by":"crossref","unstructured":"Eastlake, D., Brunner-Williams, E., Manning, B.: RFC, 2929: domain name system (DNS) IANA considerations (2000)","DOI":"10.17487\/rfc2929"},{"key":"502_CR42","unstructured":"Klein, A.: Bind 9 DNS cache poisoning. Report, Trusteer, Ltd, p. 3 (2007)"},{"issue":"1","key":"502_CR43","doi-asserted-by":"publisher","first-page":"377","DOI":"10.1109\/COMST.2016.2622240","volume":"19","author":"B Al-Musawi","year":"2016","unstructured":"Al-Musawi, B., Branch, P., Armitage, G.: Bgp anomaly detection techniques: a survey. IEEE Commun. Surv. Tutor. 19(1), 377\u2013396 (2016)","journal-title":"IEEE Commun. Surv. Tutor."},{"issue":"2","key":"502_CR44","doi-asserted-by":"publisher","first-page":"199","DOI":"10.1109\/SURV.2011.041010.00041","volume":"13","author":"G Huston","year":"2010","unstructured":"Huston, G., Rossi, M., Armitage, G.: Securing BGP\u2014a literature survey. IEEE Commun. Surv. Tutor. 13(2), 199\u2013222 (2010)","journal-title":"IEEE Commun. Surv. Tutor."},{"key":"502_CR45","unstructured":"Nichols, S.: AWS DNS network hijack turns MyEtherWallet into ThievesEtherWallet. The Register websire (2018). https:\/\/www.theregister.co.uk\/2018\/04\/24\/myetherwallet_dns_hijack\/"},{"key":"502_CR46","unstructured":"Siddiqui, A.: Public DNS in Taiwan the latest victim to BGP hijack. MANRS website (2019). https:\/\/www.manrs.org\/2019\/05\/public-dns-in-taiwan-the-latest-victim-to-bgp-hijack\/"},{"key":"502_CR47","doi-asserted-by":"crossref","unstructured":"Bush, R., Austein, R.: The resource public key infrastructure (RPKI) to router protocol (2013)","DOI":"10.17487\/rfc6810"},{"key":"502_CR48","unstructured":"IANA.: IANA roots table. IANA website (2018). https:\/\/www.iana.org\/domains\/root\/servers"},{"key":"502_CR49","unstructured":"gPrado. dnspoof attack tool. github (2011). https:\/\/github.com\/maurotfilho\/dns-spoof"},{"key":"502_CR50","doi-asserted-by":"crossref","unstructured":"Kotsiantis, S.B., Zaharakis, I., Pintelas, P.: Supervised machine learning: a review of classification techniques. In: Emerging artificial intelligence applications in computer engineering, pp. 3\u201324. IOS Press, Amsterdam (2007)","DOI":"10.1007\/s10462-007-9052-3"},{"key":"502_CR51","doi-asserted-by":"crossref","unstructured":"Gentleman, R., Huber, W., Carey, V.J.: Supervised machine learning. In: Bioconductor Case Studies, pp. 121\u2013136. Springer (2008)","DOI":"10.1007\/978-0-387-77240-0_9"},{"key":"502_CR52","unstructured":"Ho, T.K.: Random decision forests. In: Proceedings of the Third International Conference on Document Analysis and Recognition, vol. 1, pp. 278\u2013282. IEEE (1995)"},{"issue":"8","key":"502_CR53","doi-asserted-by":"publisher","first-page":"832","DOI":"10.1109\/34.709601","volume":"20","author":"Tin Kam Ho","year":"1998","unstructured":"Tin Kam Ho: The random subspace method for constructing decision forests. IEEE Trans. Pattern Anal. Mach. Intell. 20(8), 832\u2013844 (1998)","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"issue":"9\u201310","key":"502_CR54","doi-asserted-by":"publisher","first-page":"1469","DOI":"10.1007\/s10994-017-5642-8","volume":"106","author":"HM Gomes","year":"2017","unstructured":"Gomes, H.M., Bifet, A., Read, J., Barddal, J.P., Enembreck, F., Pfharinger, B., Holmes, G., Abdessalem, T.: Adaptive random forests for evolving data stream classification. Mach. Learn. 106(9\u201310), 1469\u20131495 (2017)","journal-title":"Mach. Learn."},{"issue":"1","key":"502_CR55","doi-asserted-by":"publisher","first-page":"21","DOI":"10.1109\/TIT.1967.1053964","volume":"13","author":"T Cover","year":"1967","unstructured":"Cover, T., Hart, P.: Nearest neighbor pattern classification. IEEE Trans. Inf. Theory 13(1), 21\u201327 (1967)","journal-title":"IEEE Trans. Inf. Theory"},{"key":"502_CR56","first-page":"269","volume":"21","author":"Y Lihua","year":"2006","unstructured":"Lihua, Y., Qi, D., Yanjun, G.: Study on knn text categorization algorithm. Micro Comput. Inf. 21, 269\u2013271 (2006)","journal-title":"Micro Comput. Inf."},{"key":"502_CR57","unstructured":"Dasarathy, B.V.: Nearest neighbor ($$\\{$$NN$$\\}$$) norms:$$\\{$$NN$$\\}$$ pattern classification techniques (1991)"},{"key":"502_CR58","unstructured":"Internet\u00a0Systems consortium. Bind. BIND (2018). https:\/\/www.isc.org\/downloads\/bind\/"},{"key":"502_CR59","unstructured":"wireshark. Tshark. wireshark command line tool (2018). https:\/\/www.wireshark.org\/docs\/man-pages\/tshark.html"},{"key":"502_CR60","unstructured":"IANA. IANA database. IANA website (2018). https:\/\/www.iana.org\/domains\/root\/db"},{"key":"502_CR61","unstructured":"dnspython. DNSpython tool. DNS python tool (2018). http:\/\/www.dnspython.org\/"},{"key":"502_CR62","volume-title":"Applied Networking Labs","author":"RJ Boyle","year":"2013","unstructured":"Boyle, R.J.: Applied Networking Labs. Prentice Hall, Upper Saddle River (2013)"},{"key":"502_CR63","unstructured":"scikit learn. scikit learn python library. scikit learn webpage (2018). http:\/\/scikit-learn.org\/stable\/"},{"key":"502_CR64","unstructured":"Google. archive google drive. Google drive (2018). https:\/\/drive.google.com\/file\/d\/16dwFZHmu94wsJGA5MePhr8MPRnP3LNjM\/view?usp=sharing"}],"container-title":["International Journal of Information Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-020-00502-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10207-020-00502-x\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-020-00502-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,5,28]],"date-time":"2021-05-28T12:05:50Z","timestamp":1622203550000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10207-020-00502-x"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,5,15]]},"references-count":64,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2021,6]]}},"alternative-id":["502"],"URL":"https:\/\/doi.org\/10.1007\/s10207-020-00502-x","relation":{},"ISSN":["1615-5262","1615-5270"],"issn-type":[{"value":"1615-5262","type":"print"},{"value":"1615-5270","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,5,15]]},"assertion":[{"value":"15 May 2020","order":1,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Compliance with ethical standards"}},{"value":"Mr. Harel Berger declares that he has no conflict of interest. Mr. Amit Z. Dvir declares that he has no conflict of interest. Mr. Moti Geva declares that he has no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}},{"value":"No funding was received for this study","order":3,"name":"Ethics","group":{"name":"EthicsHeading","label":"Funding"}},{"value":"This article does not contain any studies with human participants or animals performed by any of the authors.","order":4,"name":"Ethics","group":{"name":"EthicsHeading","label":"Ethical approval"}}]}}