{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,17]],"date-time":"2026-09-17T04:04:14Z","timestamp":1789617854599,"version":"build-2803163510"},"publisher-location":"New York, NY, USA","reference-count":22,"publisher":"ACM","license":[{"start":{"date-parts":[[2014,4,7]],"date-time":"2014-04-07T00:00:00Z","timestamp":1396828800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2014,4,7]]},"DOI":"10.1145\/2567948.2579359","type":"proceedings-article","created":{"date-parts":[[2016,2,5]],"date-time":"2016-02-05T19:44:31Z","timestamp":1454701471000},"page":"707-712","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":58,"title":["Kindred domains"],"prefix":"10.1145","author":[{"given":"Matthew","family":"Thomas","sequence":"first","affiliation":[{"name":"VeriSign Labs, Reston, VA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Aziz","family":"Mohaisen","sequence":"additional","affiliation":[{"name":"VeriSign Labs, Reston, VA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2014,4,7]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"The conficker working group. http:\/\/bit.ly\/1kAYsJA Nov 2012.  --. The conficker working group. http:\/\/bit.ly\/1kAYsJA Nov 2012."},{"key":"e_1_3_2_1_2_1","first-page":"2308","author":"Andrews M.","year":"1998","unstructured":"M. Andrews . Negative caching of DNS queries (DNS NCACHE). RFC 2308 , 1998 . M. Andrews. Negative caching of DNS queries (DNS NCACHE). RFC 2308, 1998.","journal-title":"RFC"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.5555\/1894166.1894169"},{"key":"e_1_3_2_1_4_1","first-page":"273","volume-title":"USENIX Security Symposium","author":"Antonakakis M.","year":"2010","unstructured":"M. Antonakakis , R. Perdisci , D. Dagon , W. Lee , and N. Feamster . Building a dynamic reputation system for dns . In USENIX Security Symposium , pages 273 -- 290 , 2010 . M. Antonakakis, R. Perdisci, D. Dagon, W. Lee, and N. Feamster. Building a dynamic reputation system for dns. In USENIX Security Symposium, pages 273--290, 2010."},{"key":"e_1_3_2_1_5_1","volume-title":"USENIX Security Symposium","author":"Antonakakis M.","year":"2011","unstructured":"M. Antonakakis , R. Perdisci , W. Lee , N. Vasiloglou II, and D. Dagon . Detecting malware domains at the upper dns hierarchy . In USENIX Security Symposium , 2011 . M. Antonakakis, R. Perdisci, W. Lee, N. Vasiloglou II, and D. Dagon. Detecting malware domains at the upper dns hierarchy. In USENIX Security Symposium, 2011."},{"key":"e_1_3_2_1_6_1","volume-title":"USENIX Security","author":"Antonakakis M.","year":"2012","unstructured":"M. Antonakakis , R. Perdisci , Y. Nadji , N. Vasiloglou , S. Abu-Nimeh , W. Lee , and D. Dagon . From throw-away traffic to bots: Detecting the rise of dga-based malware . In USENIX Security , 2012 . M. Antonakakis, R. Perdisci, Y. Nadji, N. Vasiloglou, S. Abu-Nimeh, W. Lee, and D. Dagon. From throw-away traffic to bots: Detecting the rise of dga-based malware. In USENIX Security, 2012."},{"key":"e_1_3_2_1_7_1","volume-title":"Exposure: Finding malicious domains using passive dns analysis","author":"Bilge L.","year":"2011","unstructured":"L. Bilge , E. Kirda , C. Kruegel , and M. Balduzzi . Exposure: Finding malicious domains using passive dns analysis . In NDSS. The Internet Society , 2011 . L. Bilge, E. Kirda, C. Kruegel, and M. Balduzzi. Exposure: Finding malicious domains using passive dns analysis. In NDSS. The Internet Society, 2011."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1361-3723(10)70055-5"},{"key":"e_1_3_2_1_9_1","volume-title":"Recursive dns architectures and vulnerability implications","author":"Dagon D.","year":"2009","unstructured":"D. Dagon , M. Antonakakis , K. Day , X. Luo , C. P. Lee , and W. Lee . Recursive dns architectures and vulnerability implications . In NDSS. The Internet Society , 2009 . D. Dagon, M. Antonakakis, K. Day, X. Luo, C. P. Lee, and W. Lee. Recursive dns architectures and vulnerability implications. In NDSS. The Internet Society, 2009."},{"key":"e_1_3_2_1_10_1","volume-title":"USENIX LEET","author":"Felegyhazi M.","year":"2010","unstructured":"M. Felegyhazi , C. Kreibich , and V. Paxson . On the potential of proactive domain blacklisting . In USENIX LEET , 2010 . M. Felegyhazi, C. Kreibich, and V. Paxson. On the potential of proactive domain blacklisting. In USENIX LEET, 2010."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04342-0_6"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICNP.2010.5762763"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2009.5062066"},{"key":"e_1_3_2_1_14_1","volume-title":"Domain names: implementation and specification (november","author":"Mockapetris P.","year":"1987","unstructured":"P. Mockapetris . Domain names: implementation and specification (november 1987 ). RFC 1035, 2004. P. Mockapetris. Domain names: implementation and specification (november 1987). RFC 1035, 2004."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1145\/2487788.2488056"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516749"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2008.4690854"},{"key":"e_1_3_2_1_18_1","volume-title":"SRI International","author":"Porras P.","year":"2009","unstructured":"P. Porras , H. Saidi , and V. Yegneswaran . Conficker c analysis . SRI International , 2009 . P. Porras, H. Saidi, and V. Yegneswaran. Conficker c analysis. SRI International, 2009."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"crossref","unstructured":"C. Roach. Flashback and mac malware. http:\/\/bit.ly\/1aC1qar April 2012.  C. Roach. Flashback and mac malware. http:\/\/bit.ly\/1aC1qar April 2012.","DOI":"10.1016\/S1353-4858(12)70019-3"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/1920261.1920285"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653738"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1879141.1879148"}],"event":{"name":"WWW '14: 23rd International World Wide Web Conference","location":"Seoul Korea","acronym":"WWW '14","sponsor":["IW3C2 International World Wide Web Conference Committee","SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the 23rd International Conference on World Wide Web"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2567948.2579359","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2567948.2579359","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T08:10:31Z","timestamp":1750234231000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2567948.2579359"}},"subtitle":["detecting and clustering botnet domains using DNS traffic"],"short-title":[],"issued":{"date-parts":[[2014,4,7]]},"references-count":22,"alternative-id":["10.1145\/2567948.2579359","10.1145\/2567948"],"URL":"https:\/\/doi.org\/10.1145\/2567948.2579359","relation":{},"subject":[],"published":{"date-parts":[[2014,4,7]]},"assertion":[{"value":"2014-04-07","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}