{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,5]],"date-time":"2026-10-05T06:17:22Z","timestamp":1791181042331,"version":"4.1.0"},"reference-count":26,"publisher":"IEEE","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2012,4]]},"DOI":"10.1109\/noms.2012.6212019","type":"proceedings-article","created":{"date-parts":[[2012,6,19]],"date-time":"2012-06-19T17:01:35Z","timestamp":1340125295000},"page":"988-993","source":"Crossref","is-referenced-by-count":15,"title":["DNSSM: A large scale passive DNS security monitoring framework"],"prefix":"10.1109","author":[{"given":"S.","family":"Marchal","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"J.","family":"Francois","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"C.","family":"Wagner","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"R.","family":"State","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"A.","family":"Dulaunoy","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"T.","family":"Engel","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"O.","family":"Festor","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"19","first-page":"129","article-title":"Passive monitoring of dns anomalies","author":"zdrnja","year":"2007","journal-title":"DIM'07"},{"key":"17","doi-asserted-by":"publisher","DOI":"10.1145\/1452520.1452547"},{"key":"18","first-page":"18","article-title":"Building a dynamic reputation system for dns","author":"antonakakis","year":"2010","journal-title":"Usenix Security"},{"key":"15","author":"dagon","year":"0","journal-title":"Corrupted Dns Resolution Paths The Rise of a Malicious Resolution Authority"},{"key":"16","author":"hunt","year":"2010","journal-title":"Visualizing the Hosting Patterns of Modern Cybercriminal"},{"key":"13","author":"yadav","year":"2011","journal-title":"Detecting Algorithimically Generated Malicious Domain Names"},{"key":"14","article-title":"Detecting dns tunnels using character frequency analysis","author":"born","year":"2010","journal-title":"CoRR"},{"key":"11","first-page":"15","article-title":"Measuring and evaluating large-scale cdns paper withdrawn at mirosoft's request","author":"huang","year":"2008","journal-title":"IMC' 08"},{"key":"12","doi-asserted-by":"publisher","DOI":"10.2307\/2346830"},{"key":"21","author":"zdrnja","year":"2006","journal-title":"Security Monitoring of DNS Traffic"},{"key":"20","article-title":"Finding malicious domains using passive dns analysis","author":"bilge","year":"0","journal-title":"NDSS'11 18th Annual Network & Distributed System Security Symposium 6-9 February 2011 San Diego California USA February 2011"},{"key":"22","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-15512-3_2"},{"key":"23","author":"spring","year":"2010","journal-title":"Large Scale Dns Traffic Analysis of Malicious Internet Activity with a Focus on Evaluating the Response Time of Blocking Phishing Site"},{"key":"24","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2009.36"},{"key":"25","author":"van der heide","year":"2011","journal-title":"Dns Anomaly Detection"},{"key":"26","year":"2011","journal-title":"EXPOSURE Finding Malicious Domains Using Passive DNS Analysis"},{"key":"3","author":"dan","year":"2005","journal-title":"Ozymandns Kaminsky Dns Tunnel"},{"key":"2","author":"mockapetris","year":"1987","journal-title":"RFC 1035 Domain names - implementation and specification"},{"key":"10","doi-asserted-by":"publisher","DOI":"10.1002\/j.1538-7305.1948.tb00917.x"},{"key":"1","author":"mockapetris","year":"1987","journal-title":"RFC 1034 Domain names - concepts and facilities"},{"key":"7","author":"weimer","year":"2005","journal-title":"Passive DNS Replication"},{"key":"6","year":"0","journal-title":"Akamai CDN"},{"key":"5","year":"2009","journal-title":"Botnet Communication Topologies"},{"key":"4","year":"2010","journal-title":"The Command Structure of the Aurora Botnet"},{"key":"9","author":"mark","year":"2009","journal-title":"The WEKA Data Mining Software An Update"},{"key":"8","year":"0","journal-title":"R Project"}],"event":{"name":"2012 IEEE\/IFIP Network Operations and Management Symposium (NOMS 2012)","location":"Maui, HI","start":{"date-parts":[[2012,4,16]]},"end":{"date-parts":[[2012,4,20]]}},"container-title":["2012 IEEE Network Operations and Management Symposium"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx5\/6203618\/6211874\/06212019.pdf?arnumber=6212019","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2017,3,21]],"date-time":"2017-03-21T12:55:31Z","timestamp":1490100931000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/6212019\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2012,4]]},"references-count":26,"URL":"https:\/\/doi.org\/10.1109\/noms.2012.6212019","relation":{},"subject":[],"published":{"date-parts":[[2012,4]]}}}