{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T10:01:17Z","timestamp":1777629677284,"version":"3.51.4"},"reference-count":54,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2024,1,1]],"date-time":"2024-01-01T00:00:00Z","timestamp":1704067200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"CCF-NSFOCUS \u201cKunpeng\u201d Research Fund","award":["CCF-NSFOCUS 2023013"],"award-info":[{"award-number":["CCF-NSFOCUS 2023013"]}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62372086"],"award-info":[{"award-number":["62372086"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U2336204"],"award-info":[{"award-number":["U2336204"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100018542","name":"Natural Science Foundation of Sichuan Province","doi-asserted-by":"publisher","award":["24ZNSFSC0038"],"award-info":[{"award-number":["24ZNSFSC0038"]}],"id":[{"id":"10.13039\/501100018542","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Financial Support for Outstanding Talents Training Fund in Shenzhen"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2024]]},"DOI":"10.1109\/tifs.2024.3443596","type":"journal-article","created":{"date-parts":[[2024,8,14]],"date-time":"2024-08-14T17:32:55Z","timestamp":1723656775000},"page":"7705-7719","source":"Crossref","is-referenced-by-count":11,"title":["GraphTunnel: Robust DNS Tunnel Detection Based on DNS Recursive Resolution Graph"],"prefix":"10.1109","volume":"19","author":[{"given":"Guangyuan","family":"Gao","sequence":"first","affiliation":[{"name":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3235-3463","authenticated-orcid":false,"given":"Weina","family":"Niu","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-7970-9968","authenticated-orcid":false,"given":"Jiacheng","family":"Gong","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Dujuan","family":"Gu","sequence":"additional","affiliation":[{"name":"NSFOCUS Technologies Group Company Ltd., Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Song","family":"Li","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Blockchain and Data Security and the School of Cyber Science and Technology, Zhejiang University, Hangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8863-8751","authenticated-orcid":false,"given":"Mingxue","family":"Zhang","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Blockchain and Data Security and the School of Cyber Science and Technology, Zhejiang University, Hangzhou, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9886-1412","authenticated-orcid":false,"given":"Xiaosong","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"72% of Organizations Experienced a DNS Attack in the Past Year","author":"Coker","year":"2021"},{"key":"ref2","volume-title":"IDC 2022 Global DNS Threat Report","year":"2022"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108322"},{"key":"ref4","first-page":"267","article-title":"Detection of DNS based covert channels","volume-title":"Proc. Eur. Conf. Cyber Warfare Secur.","author":"Sheridan"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/j.fraope.2023.100010"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.3390\/s23052760"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.29007\/c4wj"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24388"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1088\/1757-899X\/722\/1\/012064"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-38998-6_16"},{"key":"ref11","first-page":"17","article-title":"Practical comprehensive bounds on surreptitious communication over DNS","volume-title":"Proc. 22nd USENIX Secur. Symp.","author":"Paxson"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2021.3078428"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.11591\/ijece.v11i2.pp1666-1674"},{"issue":"3","key":"ref14","first-page":"241","article-title":"Advance approach for detection of DNS tunneling attack from network packets using deep learning algorithms","volume":"10","author":"Sakarkar","year":"2021","journal-title":"Adv. Distrib. Comput. Artif. Intell. J."},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CTISC54888.2022.9849774"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.ipm.2022.102930"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3085500"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.4316\/AECE.2021.03005"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1007\/s40747-022-00809-3"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103132"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102818"},{"key":"ref22","first-page":"1","article-title":"Inductive representation learning on large graphs","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"30","author":"Hamilton"},{"key":"ref23","volume-title":"Dnscat2","year":"2023"},{"key":"ref24","first-page":"649","article-title":"Real-time detection of DNS exfiltration and tunneling from enterprise networks","volume-title":"Proc. IFIP\/IEEE Symp. Integr. Netw. Service Manage. (IM)","author":"Ahmed"},{"key":"ref25","volume-title":"Scapy","year":"2023"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2013.03.012"},{"key":"ref27","doi-asserted-by":"crossref","DOI":"10.17487\/rfc1035","volume-title":"Domain Names\u2014Implementation and Specification","author":"Mockapetris","year":"1987"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1038\/s41598-024-51825-x"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1186\/s12911-020-1063-x"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.3390\/s22052012"},{"key":"ref31","volume-title":"Dnspot","year":"2023"},{"key":"ref32","volume-title":"DNS-Shell","year":"2023"},{"key":"ref33","volume-title":"Tuns","year":"2023"},{"key":"ref34","volume-title":"TCP-Over-DNS","year":"2023"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1007\/s10207-023-00723-w"},{"key":"ref36","volume-title":"CIC-Bell-DNS-EXF-2021 Dataset","year":"2021"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.34190\/iccws.18.1.962"},{"key":"ref38","volume-title":"Cloudflare","year":"2023"},{"key":"ref39","volume-title":"Iodine","year":"2023"},{"key":"ref40","volume-title":"DNS2TCP","year":"2023"},{"key":"ref41","volume-title":"Ladon","year":"2023"},{"key":"ref42","volume-title":"LinEnum","year":"2023"},{"key":"ref43","volume-title":"Gather","year":"2023"},{"key":"ref44","volume-title":"OneForAll","year":"2023"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/3507509.3507520"},{"key":"ref46","doi-asserted-by":"crossref","DOI":"10.2139\/ssrn.4592811","volume-title":"A novel approach for malicious domain classification based on DNS traffic analysis and machine learning","author":"Suman","year":"2023"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.3390\/jcp3040035"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1609.02907"},{"key":"ref49","article-title":"Graph attention networks","author":"Veli\u010dkovi\u0107","year":"2017","journal-title":"arXiv:1710.10903"},{"key":"ref50","article-title":"How powerful are graph neural networks?","author":"Xu","year":"2018","journal-title":"arXiv:1810.00826"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1109\/ICICCS51141.2021.9432279"},{"key":"ref52","volume-title":"Cobalt Strike","year":"2023"},{"key":"ref53","volume-title":"OzymanDNS","year":"2023"},{"key":"ref54","volume-title":"AndIodine","year":"2023"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10319981\/10636232.pdf?arnumber=10636232","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,12,11]],"date-time":"2024-12-11T00:46:37Z","timestamp":1733877997000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10636232\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024]]},"references-count":54,"URL":"https:\/\/doi.org\/10.1109\/tifs.2024.3443596","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024]]}}}