{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,20]],"date-time":"2026-03-20T09:38:16Z","timestamp":1773999496549,"version":"3.50.1"},"reference-count":20,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,12,8]],"date-time":"2025-12-08T00:00:00Z","timestamp":1765152000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,12,8]],"date-time":"2025-12-08T00:00:00Z","timestamp":1765152000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100012492","name":"Youth Innovation Promotion Association","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100012492","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,12,8]]},"DOI":"10.1109\/globecom59602.2025.11431652","type":"proceedings-article","created":{"date-parts":[[2026,3,19]],"date-time":"2026-03-19T20:04:01Z","timestamp":1773950641000},"page":"3049-3054","source":"Crossref","is-referenced-by-count":0,"title":["Unveiling Stealthy DGA Traffic: A Hybrid Threshold-Behavior Analysis Framework for Detecting Botnet Domains"],"prefix":"10.1109","author":[{"given":"Jiankang","family":"Sun","sequence":"first","affiliation":[{"name":"University of Science and Technology of China,School of Cyber Science and Technology,Hefei,China,230027"}]},{"given":"Lutong","family":"Chen","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China,Network and Information Center,Hefei,China,230026"}]},{"given":"Xuanbo","family":"Huang","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China,School of Cyber Science and Technology,Hefei,China,230027"}]},{"given":"Xuanchao","family":"Xie","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China,School of Cyber Science and Technology,Hefei,China,230027"}]},{"given":"Zixu","family":"Huang","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China,School of Cyber Science and Technology,Hefei,China,230027"}]},{"given":"Kaiping","family":"Xue","sequence":"additional","affiliation":[{"name":"University of Science and Technology of China,School of Cyber Science and Technology,Hefei,China,230027"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2018.2874896"},{"key":"ref2","first-page":"5735","article-title":"You can obfuscate, but you cannot hide:CrossPoint attacks against network topology obfuscation","volume-title":"proceedings of the 2024 USENIX Security Symposium (USENIX Security)","author":"Huang"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.3724\/SP.J.1001.2008.00702"},{"key":"ref4","article-title":"JACKSTRAWS: Picking command and control connections from bot traffic","volume-title":"Proceedings of the 2011 USENIX Security Symposium (USENIX Security)","author":"Jacob"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1002\/ett.3537"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1002\/sec.1495"},{"key":"ref7","first-page":"263","article-title":"A comprehensive measurement study of domain generating malware","volume-title":"Proceedings of the 2016 USENIX Security Symposium (USENIX Security)","author":"Plohmann"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3678890.3678913"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879148"},{"key":"ref10","first-page":"491","article-title":"From throw-away traffic to bots: Detecting the rise of DGA-based malware","volume-title":"Proceedings of the 2012 USENIX Security Symposium (USENIX Security)","author":"Antonakakis"},{"key":"ref11","first-page":"1165","article-title":"FANCI: Feature-based automated NXDomain classification and intelligence","volume-title":"Proceedings of the 2018 USENIX Security Symposium (USENIX Security)","author":"Sch\u00fcppen"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2019.8823200"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/8887881"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1007\/978-981-13-5826-5_54"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN55064.2022.9892081"},{"key":"ref16","article-title":"TI-2016 DNS dataset","author":"Singh","year":"2019"},{"key":"ref17","article-title":"DomURLs BERT: Pre-trained bert-based model for malicious domains and URLs detection and classification","author":"Mahdaouy","year":"2024"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-84186-7_31"},{"key":"ref19","article-title":"DGArchive","author":"Plohmann","year":"2018"},{"issue":"3","key":"ref20","first-page":"35","article-title":"Design and implementation of a DGA domain name detection system by machine learning","volume":"5","author":"Yu","year":"2020","journal-title":"Journal of Cyber Security"}],"event":{"name":"GLOBECOM 2025 - 2025 IEEE Global Communications Conference","location":"Taipei, Taiwan","start":{"date-parts":[[2025,12,8]]},"end":{"date-parts":[[2025,12,12]]}},"container-title":["GLOBECOM 2025 - 2025 IEEE Global Communications Conference"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11431620\/11431622\/11431652.pdf?arnumber=11431652","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,20]],"date-time":"2026-03-20T06:07:34Z","timestamp":1773986854000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11431652\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,12,8]]},"references-count":20,"URL":"https:\/\/doi.org\/10.1109\/globecom59602.2025.11431652","relation":{},"subject":[],"published":{"date-parts":[[2025,12,8]]}}}