{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,19]],"date-time":"2026-06-19T16:27:20Z","timestamp":1781886440461,"version":"3.54.5"},"reference-count":91,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2018,1,1]],"date-time":"2018-01-01T00:00:00Z","timestamp":1514764800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"funder":[{"DOI":"10.13039\/501100000038","name":"Natural Sciences and Engineering Research Council of Canada","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100000038","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002914","name":"Concordia University","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100002914","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Commun. Surv. Tutorials"],"published-print":{"date-parts":[[2018]]},"DOI":"10.1109\/comst.2018.2849614","type":"journal-article","created":{"date-parts":[[2018,6,21]],"date-time":"2018-06-21T19:04:21Z","timestamp":1529607861000},"page":"3389-3415","source":"Crossref","is-referenced-by-count":47,"title":["Detecting Internet Abuse by Analyzing Passive DNS Traffic: A Survey of Implemented Systems"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-2811-3536","authenticated-orcid":false,"given":"Sadegh","family":"Torabi","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Amine","family":"Boukhtouta","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3161-1846","authenticated-orcid":false,"given":"Chadi","family":"Assi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mourad","family":"Debbabi","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2014.6883426"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-40667-1_12"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/2960409"},{"key":"ref70","year":"2017","journal-title":"Fire"},{"key":"ref76","first-page":"163","article-title":"Efficient multidimensional aggregation for large scale monitoring","author":"dolberg","year":"0"},{"key":"ref77","year":"2017","journal-title":"E-Mail Reputation–Protect Against False Positives"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.17487\/rfc5782"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1049\/iet-ifs.2014.0386"},{"key":"ref75","first-page":"1376","article-title":"CROFlux—Passive DNS method for detecting fast-flux domains","author":"gr\u017eini?","year":"2014","journal-title":"Proc 37th Int Conv Inf Commun Technol Elect Microelect (MIPRO)"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/505659.505664"},{"key":"ref78","year":"2017","journal-title":"The DMOZ Project"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2494502"},{"key":"ref33","author":"edmonds","year":"2017","journal-title":"DNSTAP"},{"key":"ref32","year":"2017","journal-title":"Spamhaus Technology Passive DNS Service"},{"key":"ref31","year":"2017","journal-title":"The Computer Incident Response Center Luxembourg (CIRCL) Passive DNS"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CATCH.2009.48"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.17487\/rfc3833"},{"key":"ref36","first-page":"621","article-title":"Eradicating DNS rebinding with the extended same-origin policy","author":"johns","year":"0"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815683"},{"key":"ref34","author":"carli","year":"2003","journal-title":"Security Issues with DNS"},{"key":"ref60","first-page":"65","article-title":"DNS tunneling for network penetration","author":"raman","year":"2012","journal-title":"Proc Int Conf Inf Security Cryptol"},{"key":"ref62","first-page":"65","article-title":"An Internet-wide view of Internet-wide scanning","author":"durumeric","year":"2014","journal-title":"Proc 23rd USENIX Conf Security Symp (SEC 14)"},{"key":"ref61","year":"2017","journal-title":"The ZMap Project"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2017.15"},{"key":"ref28","author":"hofmann","year":"2005","journal-title":"Content Networking Architecture Protocols and Practice"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/CATCH.2009.44"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.17487\/rfc1794"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2009.36"},{"key":"ref66","first-page":"589","article-title":"ExecScent: Mining for new C&C domains in live networks with adaptive control protocol templates","author":"nelms","year":"0"},{"key":"ref29","year":"2017","journal-title":"Security Information Exchange (SIE)"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/LCN.2013.6761271"},{"key":"ref68","year":"2017","journal-title":"The DNS-BH Project–Malware Domain Blocklist"},{"key":"ref69","year":"2017","journal-title":"Exposure"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815706"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/2584679"},{"key":"ref20","year":"2017","journal-title":"ACM Digital Library"},{"key":"ref22","author":"ellingwood","year":"2014","journal-title":"An Introduction to DNS Terminology Components and Concepts"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2012.35"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.17487\/rfc1035"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.17487\/rfc1034"},{"key":"ref26","author":"klensin","year":"2008","journal-title":"Simple mail transfer protocol (SMTP)"},{"key":"ref25","year":"2009","journal-title":"A Visual Explanation of How DNS Lookups Work"},{"key":"ref50","first-page":"1093","article-title":"Understanding the Mirai botnet","author":"antonakakis","year":"2017","journal-title":"Proc 26th USENIX Security Symp (USENIX Security)"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.091213.00134"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.17487\/RFC8484"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2017.2707140"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1145\/2987443.2987455"},{"key":"ref58","author":"mullaney","year":"2011","journal-title":"Morto Worm Sets A (DNS) Record"},{"key":"ref57","first-page":"17","article-title":"Practical comprehensive bounds on surreptitious communication over DNS","author":"paxson","year":"0"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/2897795.2897804"},{"key":"ref55","first-page":"263","article-title":"A comprehensive measurement study of domain generating malware","author":"plohmann","year":"2016","journal-title":"Proc 25th USENIX Secur Symp (USENIX Secur )"},{"key":"ref54","first-page":"12","article-title":"Measuring and detecting fast-flux service networks","author":"holz","year":"2008","journal-title":"Proc Network and Distributed System Security Symp (NDSS)"},{"key":"ref53","year":"2008","journal-title":"SAC 025 Ssa Advisory on Fast Flux Hosting and DNS"},{"key":"ref52","year":"2016","journal-title":"DNS Analysis A Goldmine for Your Protection Against Malicious Activities"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2012.2184552"},{"key":"ref11","author":"herzberg","year":"2016","journal-title":"Breaking Down Mirai An IoT DDoS Botnet Analysis"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2011.090710.00029"},{"key":"ref12","author":"mckeay","year":"2017","journal-title":"The state of the Internet\/security report for Q4 2016"},{"key":"ref13","author":"hilton","year":"2016","journal-title":"Dyn Analysis Summary of Friday October 21 Attack"},{"key":"ref14","first-page":"98","article-title":"Passive DNS replication","author":"weimer","year":"2005","journal-title":"Proc 1st Conf Comput Security Incident"},{"key":"ref15","doi-asserted-by":"crossref","first-page":"129","DOI":"10.1007\/978-3-540-73614-1_8","article-title":"Passive monitoring of DNS anomalies","author":"zdrnja","year":"2007","journal-title":"Detection of Intrusions and Malware and Vulnerability Assessment"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2013.6691646"},{"key":"ref16","first-page":"1","article-title":"Detecting malware domains at the upper DNS hierarchy","volume":"11","author":"antonakakis","year":"2011","journal-title":"Proc Usenix Security Symp"},{"key":"ref81","first-page":"2","article-title":"Resilient distributed datasets: A fault-tolerant abstraction for in-memory cluster computing","author":"zaharia","year":"2012","journal-title":"Proc 9th USENIX Conf Netw Syst Des Implement"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2015.35"},{"key":"ref84","article-title":"The six most dangerous new attack techniques and what’s coming next","author":"skoudis","year":"2012","journal-title":"Proc RSA Conf (RSA)"},{"key":"ref18","article-title":"Guidelines for performing systematic literature reviews in software engineering, version 2.3","author":"kitchenham","year":"2007"},{"key":"ref83","author":"chavuenet","year":"1871","journal-title":"A Manual of Spherical and Practical Astronomy"},{"key":"ref19","year":"2017","journal-title":"IEEE Xplore Digital Library"},{"key":"ref80","first-page":"10","article-title":"Spark: Cluster computing with working sets","volume":"10","author":"zaharia","year":"2010","journal-title":"Proc 2nd USENIX Conf Hot Topics in Cloud Computing"},{"key":"ref89","volume":"1","author":"goodfellow","year":"2016","journal-title":"Deep Learning"},{"key":"ref4","first-page":"491","article-title":"From throw-away traffic to bots: Detecting the rise of DGA-based malware","author":"antonakakis","year":"0"},{"key":"ref3","first-page":"273","article-title":"Building a dynamic reputation system for DNS","author":"antonakakis","year":"2010","journal-title":"Proc Usenix Security Symp"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/1216370.1216373"},{"key":"ref5","article-title":"EXPOSURE: Finding malicious domains using passive DNS analysis","author":"bilge","year":"2011","journal-title":"Proc Network and Distributed System Security Symp (NDSS)"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/EC2ND.2011.16"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879148"},{"key":"ref86","year":"2017","journal-title":"Apache SPARK"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-41284-4_20"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23233"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010933404324"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939785"},{"key":"ref9","first-page":"446","article-title":"Winning with DNS failures: Strategies for faster botnet detection","author":"yadav","year":"2011","journal-title":"Proc Int Conf Secur Privacy Commun Syst"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/NTMS.2014.6814019"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.47"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/2663716.2663731"},{"key":"ref47","first-page":"111","article-title":"Exit from hell? Reducing the impact of amplification DDoS attacks","author":"k\u00fchrer","year":"2014","journal-title":"Proc 23rd USENIX Conf Security Symp (SEC 14)"},{"key":"ref42","first-page":"191","article-title":"The long ‘Taile’ of typosquatting domain names","author":"szurdi","year":"2014","journal-title":"Proc 23rd USENIX Secur Symp (USENIX Secur )"},{"key":"ref41","article-title":"The anticybersquatting consumer protection act (ACPA)","year":"1999"},{"key":"ref44","first-page":"207","article-title":"Understanding the dark side of domain parking","author":"alrwais","year":"2014","journal-title":"Proc 23rd USENIX Secur Symp (USENIX Secur )"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2015.23058"}],"container-title":["IEEE Communications Surveys & Tutorials"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9739\/8540503\/08391393.pdf?arnumber=8391393","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,1,27]],"date-time":"2022-01-27T02:40:31Z","timestamp":1643251231000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/8391393\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018]]},"references-count":91,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/comst.2018.2849614","relation":{},"ISSN":["1553-877X","2373-745X"],"issn-type":[{"value":"1553-877X","type":"electronic"},{"value":"2373-745X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018]]}}}