{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,31]],"date-time":"2026-03-31T06:36:03Z","timestamp":1774938963695,"version":"3.50.1"},"reference-count":45,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"Zhongguancun Laboratory"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2026.3675876","type":"journal-article","created":{"date-parts":[[2026,3,19]],"date-time":"2026-03-19T20:05:59Z","timestamp":1773950759000},"page":"3240-3253","source":"Crossref","is-referenced-by-count":0,"title":["HINHJ: Hierarchical Attention-Based Heterogeneous Graph Neural Network for DNS Hijacking Detection"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0009-0005-8512-5922","authenticated-orcid":false,"given":"Haoran","family":"Jiao","sequence":"first","affiliation":[{"name":"Zhongguancun Laboratory, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7581-7160","authenticated-orcid":false,"given":"Cong","family":"Dong","sequence":"additional","affiliation":[{"name":"Zhongguancun Laboratory, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4300-678X","authenticated-orcid":false,"given":"Chenglong","family":"Li","sequence":"additional","affiliation":[{"name":"Zhongguancun Laboratory, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6109-6737","authenticated-orcid":false,"given":"Jiahai","family":"Yang","sequence":"additional","affiliation":[{"name":"Zhongguancun Laboratory, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Leyao","family":"Nie","sequence":"additional","affiliation":[{"name":"Zhongguancun Laboratory, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2740-9362","authenticated-orcid":false,"given":"Yuling","family":"Liu","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jing","family":"Wang","sequence":"additional","affiliation":[{"name":"College of Artificial Intelligence, Beijing Normal University, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-0122-9322","authenticated-orcid":false,"given":"Changzhi","family":"Zhao","sequence":"additional","affiliation":[{"name":"Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-0037-2777","authenticated-orcid":false,"given":"Xia","family":"Yin","sequence":"additional","affiliation":[{"name":"Zhongguancun Laboratory, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4033"},{"key":"ref2","first-page":"307","article-title":"Global measurement of DNS manipulation","volume-title":"Proc. 26th USENIX Secur. Symp. (USENIX Secur.)","author":"Pearce"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670336"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3450084"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1145\/3360468.3368172"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3486219"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417280"},{"key":"ref8","first-page":"3153","article-title":"The maginot line: Attacking the boundary of DNS caching protection","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur.)","author":"Li"},{"key":"ref9","first-page":"631","article-title":"NXNSAttack: Recursive DNS inefficiencies and vulnerabilities","volume-title":"Proc. 29th USENIX Secur. Symp. (USENIX Secur.)","author":"Afek"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3487552.3487817"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/CSCWD57460.2023.10152616"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3517745.3561425"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-28486-1_19"},{"key":"ref14","first-page":"1113","article-title":"Who is answering my queries: Understanding and characterizing interception of the DNS resolution path","volume-title":"Proc. 27th USENIX Secur. Symp. (USENIX Secur.)","author":"Liu"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/SRDS53918.2021.00029"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/CNS56114.2022.9947264"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/NCA.2019.8935025"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/ICASSP39728.2021.9415092"},{"key":"ref19","volume-title":"Analysis of a Large Number of Abnormal Network Access and Traffic Hijacking Incidents of Domestic Home Routers","year":"2024"},{"key":"ref20","volume-title":"Google Public DNS","year":"2025"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939754"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/WCNC.2018.8376947"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3387514.3405881"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/1557019.1557107"},{"key":"ref25","volume-title":"GeoIP2\/GeoLite2 Database","year":"2025"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2016.2598561"},{"key":"ref27","first-page":"8026","article-title":"PyTorch: An imperative style, high-performance deep learning library","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"32","author":"Paszke"},{"key":"ref28","volume-title":"Resolvers: The Most Exhaustive List of Reliable DNS Resolvers","year":"2024"},{"key":"ref29","volume-title":"Public-DNS-Resolvers: List of Periodically Validated Public DNS Resolvers","year":"2023"},{"key":"ref30","volume-title":"Public DNS Server List","year":"2023"},{"key":"ref31","volume-title":"Top Public Recursive Name Servers","year":"2021"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-06975-8_7"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3419394.3423640"},{"key":"ref34","article-title":"Tranco: A research-oriented top sites ranking hardened against manipulation","author":"Le Pochat","year":"2018","journal-title":"arXiv:1806.01156"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3517745.3561434"},{"key":"ref36","volume-title":"Virustotal: R Client for the Virustotal API","year":"2025"},{"key":"ref37","volume-title":"Threatbook","year":"2025"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/INFOCOM.2017.8057066"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v37i9.26283"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.52202\/079017-1404"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/3696410.3714918"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3308558.3313562"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2024.110975"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.103059"},{"key":"ref45","volume-title":"Albania Shuts Down Tiktok for a Year Amid Concerns Over Violence Among Children","year":"2025"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11447326.pdf?arnumber=11447326","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,31]],"date-time":"2026-03-31T05:08:25Z","timestamp":1774933705000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11447326\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":45,"URL":"https:\/\/doi.org\/10.1109\/tifs.2026.3675876","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}