{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,20]],"date-time":"2025-11-20T12:30:36Z","timestamp":1763641836965},"reference-count":27,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2014,6]]},"DOI":"10.1109\/icc.2014.6883426","type":"proceedings-article","created":{"date-parts":[[2014,9,3]],"date-time":"2014-09-03T14:10:33Z","timestamp":1409753433000},"page":"853-858","source":"Crossref","is-referenced-by-count":36,"title":["Detection of malicious payload distribution channels in DNS"],"prefix":"10.1109","author":[{"given":"A. Mert","family":"Kara","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hamad","family":"Binsalleeh","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mohammad","family":"Mannan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Amr","family":"Youssef","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mourad","family":"Debbabi","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"journal-title":"The Role of DNS in Botnet Command & Control","year":"2012","key":"19"},{"journal-title":"Element53","year":"0","key":"17"},{"key":"18","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-01244-0_5"},{"key":"15","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-21323-6_11"},{"journal-title":"Morto Worm Sets A (DNS) Record","year":"2011","author":"mullaney","key":"16"},{"key":"13","article-title":"DNS blacklists and whitelists","author":"levine","year":"2010","journal-title":"RFC 5782 Proposed Standard"},{"journal-title":"Updating of Malicious Code Patterns Using Public DNS Servers","year":"2012","author":"li","key":"14"},{"key":"11","article-title":"Detecting DNS tunnels using character frequency analysis","author":"kenton","year":"2010","journal-title":"Annual Security Conference"},{"key":"12","doi-asserted-by":"publisher","DOI":"10.5769\/J200701001"},{"key":"21","article-title":"DNS tunneling for network penetration","author":"raman","year":"2012","journal-title":"International Conference on Information Security and Cryptology (ICISC)"},{"key":"20","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2013.05.109"},{"key":"22","article-title":"Opportunistic encryption using the internet key exchange (IKE)","author":"richardson","year":"2005","journal-title":"RFC 4322 Informational"},{"key":"23","article-title":"Using the domain name system to store arbitrary string attributes","author":"rosenbaum","year":"1993","journal-title":"RFC 1464 Experimental"},{"key":"24","article-title":"On the viability and performance of DNS tunneling","author":"van leijenhorst","year":"2008","journal-title":"Conference on Information Technology and Applications"},{"key":"25","article-title":"Passive DNS replication","author":"weimer","year":"2005","journal-title":"17th FIRST Conference on Computer Security Incident"},{"key":"26","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4408"},{"key":"27","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2013.10"},{"key":"3","article-title":"From throw-away traffic to bots: Detecting the rise of DGA-based malware","author":"antonakakis","year":"2012","journal-title":"USENIX Security Symposium"},{"key":"2","article-title":"Domainkeys identified mail (DKIM) signatures","author":"allman","year":"2007","journal-title":"RFC 4871 Proposed Standard"},{"key":"10","article-title":"Measurements and mitigation of peer-to-peer-based botnets: A case study on storm worm","author":"holz","year":"2008","journal-title":"USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET)"},{"year":"0","key":"1"},{"key":"7","article-title":"Corrupted DNS resolution paths: The rise of a malicious resolution authority","author":"dagon","year":"2008","journal-title":"Network and Distributed System Security Symposium (NDSS)"},{"key":"6","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455798"},{"journal-title":"DNS As A Covert Channel Within Protected Networks","year":"2011","author":"bromberger","key":"5"},{"key":"4","doi-asserted-by":"publisher","DOI":"10.1109\/PST.2010.5593240"},{"journal-title":"Systems and Methods for Identifying A Network","year":"2013","author":"gordon","key":"9"},{"key":"8","doi-asserted-by":"publisher","DOI":"10.1109\/EC2ND.2011.16"}],"event":{"name":"ICC 2014 - 2014 IEEE International Conference on Communications","start":{"date-parts":[[2014,6,10]]},"location":"Sydney, NSW","end":{"date-parts":[[2014,6,14]]}},"container-title":["2014 IEEE International Conference on Communications (ICC)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/6878057\/6883277\/06883426.pdf?arnumber=6883426","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,6,5]],"date-time":"2017-06-05T20:48:24Z","timestamp":1496695704000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/6883426\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2014,6]]},"references-count":27,"URL":"https:\/\/doi.org\/10.1109\/icc.2014.6883426","relation":{},"subject":[],"published":{"date-parts":[[2014,6]]}}}