{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,29]],"date-time":"2025-12-29T22:00:52Z","timestamp":1767045652255},"reference-count":52,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"1","license":[{"start":{"date-parts":[[2016,2,1]],"date-time":"2016-02-01T00:00:00Z","timestamp":1454284800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2016,2,1]],"date-time":"2016-02-01T00:00:00Z","timestamp":1454284800000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2016,2,1]],"date-time":"2016-02-01T00:00:00Z","timestamp":1454284800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2016,2,1]],"date-time":"2016-02-01T00:00:00Z","timestamp":1454284800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Science Foundation","award":["CNS-0831300","CNS-1314956"],"award-info":[{"award-number":["CNS-0831300","CNS-1314956"]}]},{"name":"Army Research Office","award":["W911NF-06-1-0316"],"award-info":[{"award-number":["W911NF-06-1-0316"]}]},{"name":"National Basic Research Program (973 Program) of China","award":["2009CB320505"],"award-info":[{"award-number":["2009CB320505"]}]},{"name":"National Natural Science Foundation of China","award":["61472215"],"award-info":[{"award-number":["61472215"]}]},{"name":"Open Foundation of the State Key Laboratory of Networking and Switching Technology (Beijing University of Posts and Telecommunications) SKLNST-2013-1-17"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE\/ACM Trans. Networking"],"published-print":{"date-parts":[[2016,2]]},"DOI":"10.1109\/tnet.2014.2358637","type":"journal-article","created":{"date-parts":[[2014,10,21]],"date-time":"2014-10-21T18:52:34Z","timestamp":1413917554000},"page":"43-57","source":"Crossref","is-referenced-by-count":35,"title":["Reexamining DNS From a Global Recursive Resolver Perspective"],"prefix":"10.1109","volume":"24","author":[{"given":"Hongyu","family":"Gao","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Vinod","family":"Yegneswaran","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jian","family":"Jiang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yan","family":"Chen","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Phillip","family":"Porras","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shalini","family":"Ghosh","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haixin","family":"Duan","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/1452520.1452548"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-28537-0_21"},{"key":"ref33","author":"mockapetris","year":"1987","journal-title":"?Domain names?Concepts and facilities ?"},{"key":"ref32","year":"0","journal-title":"?MaxMind Inc ?"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511809071"},{"key":"ref30","year":"0","journal-title":"?Malware domain list ?"},{"key":"ref37","author":"mullaney","year":"2011","journal-title":"?Morto worm sets a (DNS) record ?"},{"key":"ref36","author":"mockapetris","year":"1983","journal-title":"?Domain names?Implementation and specification ?"},{"key":"ref35","author":"mockapetris","year":"1987","journal-title":"?Domain names?Implementation and specification ?"},{"key":"ref34","author":"mockapetris","year":"1983","journal-title":"?Domain names?Concepts and facilities ?"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382267"},{"key":"ref27","first-page":"219","article-title":"Dynamics of online scam hosting infrastructure","author":"konte","year":"2009","journal-title":"Proc Passive Active Meas Conf"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-36516-4_15"},{"key":"ref2","year":"0","journal-title":"?McAfee SiteAdvisor ?"},{"key":"ref1","year":"0","journal-title":"?Malware domain blocklist ?"},{"key":"ref20","year":"2013","journal-title":"?Farsight Security archive ?"},{"key":"ref22","article-title":"Measuring and detecting fast-flux service networks","author":"holz","year":"2008","journal-title":"Proc Symp Netw Distrib Syst Security"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/2068816.2068842"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028838"},{"key":"ref23","year":"0","journal-title":"?TLD DNSSEC report ?"},{"key":"ref26","author":"kaminsky","year":"2008","journal-title":"?It is the end of the cache as we know it ?"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2002.803905"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879148"},{"key":"ref51","first-page":"446","article-title":"Winning with DNS failures: Strategies for faster botnet detection","author":"yadav","year":"2011","journal-title":"Proc Securecomm"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-05284-2_11"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4033"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4035"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/2398776.2398831"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.17487\/rfc4034"},{"key":"ref13","first-page":"18","article-title":"Using the domain name system for system break-ins","volume":"5","author":"bellovin","year":"1995","journal-title":"Proc 5th USENIX UNIX Security Symp"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOMW.2011.5928919"},{"key":"ref15","article-title":"EXPOSURE : Finding malicious domains using passive DNS analysis","author":"bilge","year":"2011","journal-title":"Proc 8th Annu Symp Netw Distrib Syst Security"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/GLOCOM.2001.965864"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/1452335.1452341"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/144179.144301"},{"key":"ref19","author":"dietrich","year":"2011","journal-title":"?Feederbot?A bot using DNS as carrier for its C&C ?"},{"key":"ref4","year":"0","journal-title":"?Safe Browsing Tool?WOT ?"},{"key":"ref3","year":"0","journal-title":"?PhishTank ?"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879144"},{"key":"ref5","article-title":"Understanding and preparing for DNS evolution","volume":"6003","year":"2010","journal-title":"Proc Traffic Monit Anal"},{"key":"ref8","first-page":"27","article-title":"Detecting malware domains at the upper DNS hierarchy","author":"antonakakis","year":"2011","journal-title":"Proc Usenix Security Symp"},{"key":"ref7","first-page":"18","article-title":"Building a dynamic reputation system for DNS","author":"antonakakis","year":"2010","journal-title":"Proc 19th USENIX Security Symp"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24668-8_15"},{"key":"ref9","first-page":"24","article-title":"From throw-away traffic to bots: Detecting the rise of DGA-based malware","author":"antonakakis","year":"2012","journal-title":"Proc Usenix Security Symposium"},{"key":"ref46","article-title":"Correlating domain registrations and DNS first activity in general and for malware","author":"spring","year":"2011","journal-title":"Securing and Trusting Internet Names"},{"key":"ref45","first-page":"8","article-title":"Extending black domain name list by using co-occurrence relation between DNS queries","author":"sato","year":"2010","journal-title":"Proc lEE"},{"key":"ref48","article-title":"Wow, that's a lot of packets","author":"wessels","year":"2003","journal-title":"Proc PAM"},{"key":"ref47","author":"stewart","year":"2003","journal-title":"?DNS cache poisoning?The next generation ?"},{"key":"ref42","first-page":"727","article-title":"X-means: Extending K-means with efficient estimation of the number of clusters","volume":"1","author":"pelleg","year":"2000","journal-title":"Proc 17th Int Conf Mach Learning"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/1028788.1028790"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/1852096.1852097"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/ACSAC.2009.36"}],"container-title":["IEEE\/ACM Transactions on Networking"],"original-title":[],"link":[{"URL":"http:\/\/ieeexplore.ieee.org\/ielaam\/90\/7398272\/6932501-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/90\/7398272\/06932501.pdf?arnumber=6932501","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,4,8]],"date-time":"2022-04-08T18:49:10Z","timestamp":1649443750000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/6932501\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,2]]},"references-count":52,"journal-issue":{"issue":"1"},"URL":"https:\/\/doi.org\/10.1109\/tnet.2014.2358637","relation":{},"ISSN":["1063-6692","1558-2566"],"issn-type":[{"value":"1063-6692","type":"print"},{"value":"1558-2566","type":"electronic"}],"subject":[],"published":{"date-parts":[[2016,2]]}}}