{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,15]],"date-time":"2026-01-15T04:47:33Z","timestamp":1768452453917,"version":"3.49.0"},"reference-count":53,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"2","license":[{"start":{"date-parts":[[2021,6,1]],"date-time":"2021-06-01T00:00:00Z","timestamp":1622505600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/501100001691","name":"JSPS KAKENHI","doi-asserted-by":"publisher","award":["JP19K24351"],"award-info":[{"award-number":["JP19K24351"]}],"id":[{"id":"10.13039\/501100001691","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100010661","name":"European Union\u2019s Horizon 2020 Research and Innovation Programme","doi-asserted-by":"publisher","award":["739578"],"award-info":[{"award-number":["739578"]}],"id":[{"id":"10.13039\/100010661","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Government of the Republic of Cyprus through the Deputy Ministry of Research, Innovation and Digital Policy"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Netw. Serv. Manage."],"published-print":{"date-parts":[[2021,6]]},"DOI":"10.1109\/tnsm.2021.3078428","type":"journal-article","created":{"date-parts":[[2021,5,10]],"date-time":"2021-05-10T20:07:10Z","timestamp":1620677230000},"page":"1203-1217","source":"Crossref","is-referenced-by-count":33,"title":["DNS Tunneling Detection by Cache-Property-Aware Features"],"prefix":"10.1109","volume":"18","author":[{"given":"Naotake","family":"Ishikura","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1482-6148","authenticated-orcid":false,"given":"Daishi","family":"Kondo","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1336-5629","authenticated-orcid":false,"given":"Vassilis","family":"Vassiliades","sequence":"additional","affiliation":[]},{"given":"Iordan","family":"Iordanov","sequence":"additional","affiliation":[]},{"given":"Hideki","family":"Tode","sequence":"additional","affiliation":[]}],"member":"263","reference":[{"key":"ref39","year":"2021","journal-title":"DNScat"},{"key":"ref38","year":"2021","journal-title":"DET"},{"key":"ref33","year":"2021","journal-title":"Dns2tcp"},{"key":"ref32","year":"2021","journal-title":"iodine"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1093\/jigpal\/jzs029"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-01244-0_5"},{"key":"ref37","year":"2021","journal-title":"Cobalt strike"},{"key":"ref36","year":"2021","journal-title":"BernhardPOS"},{"key":"ref35","year":"2021","journal-title":"Backdoor Win32 Denis"},{"key":"ref34","first-page":"65","article-title":"DNS tunneling for network penetration","author":"raman","year":"2012","journal-title":"Proc Int Conf Inf Security Cryptol (ICISC)"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"ref27","author":"zipf","year":"1949","journal-title":"Human Behavior and the Principle of Least Effort"},{"key":"ref29","first-page":"560","article-title":"On the viability and performance of DNS tunneling","author":"van leijenhorst","year":"2008","journal-title":"Proc 5th Int Conf Inf Technol Appl (ICITA)"},{"key":"ref2","year":"2021","journal-title":"IT Security Risks Survey 2014 A Business Approach to Managing Data Security Threats"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/ICIN48450.2020.9059472"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/NFV-SDN.2018.8725640"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/IPCCC47392.2019.8958714"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2018.09.006"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.102095"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2019.2940735"},{"key":"ref26","year":"2021","journal-title":"DNScat"},{"key":"ref25","year":"2011","journal-title":"Morto Worm Sets A (DNS) Record"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1016\/0893-6080(91)90009-T"},{"key":"ref51","article-title":"FQDN-based whitelist filter on a DNS cache server against the DNS water torture attack","author":"hasegawa","year":"2021","journal-title":"Proc IFIP\/IEEE Int Symp Integr Netw Manage"},{"key":"ref53","year":"1987","journal-title":"Domain names—Implementation and specification"},{"key":"ref52","author":"kingma","year":"2014","journal-title":"Adam A method for stochastic optimization"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-38998-6_16"},{"key":"ref11","first-page":"17","article-title":"Practical comprehensive bounds on surreptitious communication over DNS","author":"paxson","year":"2013","journal-title":"Proc 22nd USENIX Conf Security"},{"key":"ref40","year":"2021","journal-title":"DNSExfiltrator"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1016\/j.procs.2013.05.109"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2013.10"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2014.6883426"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1002\/dac.2836"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1093\/jigpal\/jzw056"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/2897795.2897804"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/ICMLA.2017.00-71"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/DESEC.2018.8625166"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1016\/S1353-4858(19)30144-8"},{"key":"ref3","year":"2015","journal-title":"Understanding Targeted Attacks The Impact of Targeted Attacks"},{"key":"ref6","year":"2014","journal-title":"New FrameworkPOS variant exfiltrates data via DNS requests"},{"key":"ref5","year":"2021","journal-title":"IDC 2020 Global DNS Threat Report"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/2785956.2787482"},{"key":"ref7","year":"2019","journal-title":"DNS Tunneling in the Wild Overview of OilRig’s DNS Tunneling"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355568"},{"key":"ref9","author":"born","year":"2010","journal-title":"Detecting DNS Tunnels Using Character Frequency Analysis"},{"key":"ref46","year":"2021","journal-title":"TCP-over-DNS"},{"key":"ref45","year":"2021","journal-title":"Reverse DNS Shell"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2001.916678"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.2197\/ipsjjip.21.517"},{"key":"ref42","year":"2018","journal-title":"DNSpionage Campaign Targets Middle East"},{"key":"ref41","year":"2017","journal-title":"Covert Channels and Poor Decisions The Tale of DNSMessenger"},{"key":"ref44","year":"2009","journal-title":"OzymanDNS—Tunneling SSH Over DNS"},{"key":"ref43","year":"2016","journal-title":"Three Month FrameworkPOS Malware Campaign Nabs 43 000 Credit Cards from Point of Sale Systems"}],"container-title":["IEEE Transactions on Network and Service Management"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/4275028\/9450206\/09426926.pdf?arnumber=9426926","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,12,17]],"date-time":"2021-12-17T20:01:53Z","timestamp":1639771313000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9426926\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,6]]},"references-count":53,"journal-issue":{"issue":"2"},"URL":"https:\/\/doi.org\/10.1109\/tnsm.2021.3078428","relation":{},"ISSN":["1932-4537","2373-7379"],"issn-type":[{"value":"1932-4537","type":"electronic"},{"value":"2373-7379","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,6]]}}}