{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,20]],"date-time":"2026-05-20T16:38:54Z","timestamp":1779295134690,"version":"3.51.4"},"reference-count":71,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"1","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Major Key Project of PCL","award":["PCL2023A06-4"],"award-info":[{"award-number":["PCL2023A06-4"]}]},{"name":"National Key Research and Development Program of China","award":["2022YFB3105000"],"award-info":[{"award-number":["2022YFB3105000"]}]},{"name":"Shenzhen Key Lab of Software Defined Networking","award":["ZDSYS20140509172959989"],"award-info":[{"award-number":["ZDSYS20140509172959989"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2025,1]]},"DOI":"10.1109\/tdsc.2024.3409545","type":"journal-article","created":{"date-parts":[[2024,6,6]],"date-time":"2024-06-06T17:47:25Z","timestamp":1717696045000},"page":"597-613","source":"Crossref","is-referenced-by-count":11,"title":["DNSGuard: In-Network Defense Against DNS Attacks"],"prefix":"10.1109","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-4917-9536","authenticated-orcid":false,"given":"Guanglin","family":"Duan","sequence":"first","affiliation":[{"name":"Peng Cheng Laboratory, Shenzhen, Guangdong, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6071-473X","authenticated-orcid":false,"given":"Qing","family":"Li","sequence":"additional","affiliation":[{"name":"Peng Cheng Laboratory, Shenzhen, Guangdong, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1578-2597","authenticated-orcid":false,"given":"Zhengxin","family":"Zhang","sequence":"additional","affiliation":[{"name":"Tsinghua Shenzhen International Graduate School, Shenzhen, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9016-5594","authenticated-orcid":false,"given":"Dan","family":"Zhao","sequence":"additional","affiliation":[{"name":"Peng Cheng Laboratory, Shenzhen, Guangdong, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7532-9116","authenticated-orcid":false,"given":"Guorui","family":"Xie","sequence":"additional","affiliation":[{"name":"Tsinghua Shenzhen International Graduate School, Shenzhen, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3481-8447","authenticated-orcid":false,"given":"Yuan","family":"Yang","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-7973-5960","authenticated-orcid":false,"given":"Zhenhui","family":"Yuan","sequence":"additional","affiliation":[{"name":"Department of Computer and Information Science, Northumbria University, Newcastle Upon Tyne, U.K."}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4260-1395","authenticated-orcid":false,"given":"Yong","family":"Jiang","sequence":"additional","affiliation":[{"name":"Tsinghua Shenzhen International Graduate School, Shenzhen, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4847-4585","authenticated-orcid":false,"given":"Mingwei","family":"Xu","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Tsinghua University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108322"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.5555\/3241189.3241275"},{"key":"ref3","article-title":"Target, home depot and ups attacks: Dude, you need to rethink point-of-sale security","author":"Leyden","year":"2014"},{"key":"ref4","first-page":"3829","article-title":"Jaqen: A high-performance switch-native approach for detecting and mitigating volumetric DDoS attacks with programmable switches","volume-title":"Proc. USENIX Secur.","author":"Liu"},{"key":"ref5","first-page":"817","article-title":"Bohatei: Flexible and elastic DDoS defense","volume-title":"Proc. USENIX Secur.","author":"Fayaz"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66399-9_8"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108174"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3482898.3483357"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.14722\/madweb.2022.23012"},{"key":"ref10","first-page":"1083","article-title":"Achieving 100Gbps intrusion prevention on a single server","volume-title":"Proc. USENIX Conf. Operating Syst. Des. Implementation","author":"Zhao"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/2987443.2987487"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/2377677.2377680"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/MNET.107.2100643"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24007"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/2486001.2486011"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/2656877.2656890"},{"key":"ref17","article-title":"Intel tofino 2","year":"2021"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM48880.2022.9796936"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/362686.362692"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1016\/j.jalgor.2003.12.001"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3588960"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939785"},{"key":"ref23","article-title":"Tofino switch","year":"2021"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_14"},{"key":"ref25","first-page":"263","article-title":"A comprehensive measurement study of domain generating malware","volume-title":"Proc. USENIX Secur.","author":"Plohmann"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/ICM.2011.266"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/SRDS53918.2021.00029"},{"key":"ref28","article-title":"Black ops 2008: It\u2019s the end of the cache as we know it","author":"Kaminsky","year":"2008"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2021.3072874"},{"key":"ref30","article-title":"DYN analysis summary of friday october 21 attack","year":"2021"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_7"},{"key":"ref32","article-title":"Deindexing phantom domains","author":"Mergenhagen","year":"2018"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ICC45041.2023.10279024"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3563647.3563654"},{"key":"ref35","first-page":"1","article-title":"Detecting malware domains at the upper DNS hierarchy","volume-title":"Proc. 20th USENIX Secur. Symp.","author":"Antonakakis"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2017.05.204"},{"key":"ref37","first-page":"1","article-title":"EXPOSURE: Finding malicious domains using passive DNS analysis","volume-title":"Proc. Netw. Distrib. Syst. Secur. Symp.","author":"Bilge"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-15512-3_2"},{"key":"ref39","first-page":"273","article-title":"Building a dynamic reputation system for DNS","volume-title":"Proc. 19th USENIX Secur. Symp.","author":"Antonakakis"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4033"},{"key":"ref41","first-page":"1307","article-title":"A longitudinal, end-to-end view of the DNSSEC ecosystem","volume-title":"Proc. 26th USENIX Secur. Symp.","author":"Chung"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.17487\/RFC7858"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.17487\/RFC8484"},{"key":"ref44","article-title":"pForest: In-network inference with random forests","author":"Busse-Grawitz","year":"2019"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3365609.3365864"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1007\/s00521-020-05440-2"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3472716.3472846"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.17487\/rfc1035"},{"key":"ref49","first-page":"649","article-title":"Real-time detection of DNS exfiltration and tunneling from enterprise networks","volume-title":"Proc. IFIP\/IEEE Int. Symp. Integr. Netw. Manage.","author":"Ahmed"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2017.00-71"},{"key":"ref51","article-title":"Public suffix list","year":"2021"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.5555\/1953048.2078195"},{"key":"ref53","article-title":"XGS12 chassis platform","year":"2022"},{"key":"ref54","article-title":"TI-2016 DNS dataset","author":"Singh","year":"2016"},{"key":"ref55","article-title":"Packet traces from wide backbone","author":"Group","year":"2022"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879175"},{"key":"ref57","article-title":"The caida anonymized internet traces data","year":"2008"},{"key":"ref58","article-title":"Iodine","author":"Ekman","year":"2014"},{"key":"ref59","article-title":"Dnscat2","year":"2022"},{"key":"ref60","article-title":"Det","author":"Team","year":"2017"},{"key":"ref61","article-title":"Dns2tcp","author":"de SouzaOliveira","year":"2021"},{"key":"ref62","article-title":"DNSExfiltrator","year":"2018"},{"key":"ref63","article-title":"Metasploit framework","year":"2022"},{"key":"ref64","article-title":"DARPA scalable network monitoring (SNM) program traffic, traces taken 2009\u201311-05 to 2009\u201311-05","year":"2009"},{"key":"ref65","article-title":"Google public DNS","year":"2022"},{"key":"ref66","article-title":"Bind 9 open source DNS server","year":"2022"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3486219"},{"key":"ref68","first-page":"3165","article-title":"Injection attacks reloaded: Tunnelling malicious payloads over DNS","volume-title":"Proc. USENIX Secur.","author":"Jeitner"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1145\/3359989.3365435"},{"key":"ref70","article-title":"Large scale measurement on the adoption of encrypted DNS","author":"Garc\u00eda","year":"2021"},{"key":"ref71","first-page":"507","article-title":"A deep dive into DNS query failures","volume-title":"Proc. USENIX Annu. Tech. Conf.","author":"Yang"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/8858\/10843954\/10550176.pdf?arnumber=10550176","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,1,21]],"date-time":"2025-01-21T03:55:41Z","timestamp":1737431741000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10550176\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,1]]},"references-count":71,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2024.3409545","relation":{},"ISSN":["1545-5971","1941-0018","2160-9209"],"issn-type":[{"value":"1545-5971","type":"print"},{"value":"1941-0018","type":"electronic"},{"value":"2160-9209","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,1]]}}}