{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,28]],"date-time":"2025-08-28T12:01:41Z","timestamp":1756382501600,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":16,"publisher":"ACM","license":[{"start":{"date-parts":[[2016,4,5]],"date-time":"2016-04-05T00:00:00Z","timestamp":1459814400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2016,4,5]]},"DOI":"10.1145\/2897795.2897804","type":"proceedings-article","created":{"date-parts":[[2016,4,7]],"date-time":"2016-04-07T22:22:33Z","timestamp":1460067753000},"page":"1-4","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":36,"title":["Detection of Tunnels in PCAP Data by Random Forests"],"prefix":"10.1145","author":[{"given":"Anna L.","family":"Buczak","sequence":"first","affiliation":[{"name":"The Johns Hopkins University Applied Physics Laboratory, 11100 Johns Hopkins Road, Laurel, MD 20723, Primary contact: 240-228-9350"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Paul A.","family":"Hanke","sequence":"additional","affiliation":[{"name":"The Johns Hopkins University Applied Physics Laboratory, 11100 Johns Hopkins Road, Laurel, MD 20723, Primary contact: 240-228-9350"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"George J.","family":"Cancro","sequence":"additional","affiliation":[{"name":"The Johns Hopkins University Applied Physics Laboratory, 11100 Johns Hopkins Road, Laurel, MD 20723, Primary contact: 240-228-9350"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Michael K.","family":"Toma","sequence":"additional","affiliation":[{"name":"The Johns Hopkins University Applied Physics Laboratory, 11100 Johns Hopkins Road, Laurel, MD 20723, Primary contact: 240-228-9350"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Lanier A.","family":"Watkins","sequence":"additional","affiliation":[{"name":"The Johns Hopkins University Applied Physics Laboratory, 11100 Johns Hopkins Road, Laurel, MD 20723, Primary contact: 240-228-9350"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jeffrey S.","family":"Chavis","sequence":"additional","affiliation":[{"name":"The Johns Hopkins University Applied Physics Laboratory, 11100 Johns Hopkins Road, Laurel, MD 20723, Primary contact: 240-228-9350"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2016,4,5]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/ARES.2013.32"},{"key":"e_1_3_2_1_2_1","unstructured":"Lumension. Redefining-Defense-in-Depth. Accessed 11 Jan 2016. https:\/\/www.lumension.com\/Media_Files\/Documents\/Marketing---Sales\/Whitepapers\/Redefining-Defense-in-Depth.aspx  Lumension. Redefining-Defense-in-Depth. Accessed 11 Jan 2016. https:\/\/www.lumension.com\/Media_Files\/Documents\/Marketing---Sales\/Whitepapers\/Redefining-Defense-in-Depth.aspx"},{"key":"e_1_3_2_1_3_1","volume-title":"APT1: Exposing one of China's cyber espionage units. Accessed","author":"Mandiant","year":"2016","unstructured":"Mandiant . APT1: Exposing one of China's cyber espionage units. Accessed 11 Jan 2016 . http:\/\/intelreport.mandiant.com\/Mandiant_APT1_Report.pdf. Mandiant. APT1: Exposing one of China's cyber espionage units. Accessed 11 Jan 2016. http:\/\/intelreport.mandiant.com\/Mandiant_APT1_Report.pdf."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/EC2ND.2011.16"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1002\/dac.2836"},{"key":"e_1_3_2_1_6_1","volume-title":"Detecting DNS Tunneling","author":"Farnham G.","year":"2013","unstructured":"Farnham , G. Detecting DNS Tunneling . SANS Institute White Paper . February 2013 . Accessed 11 Jan 2016. http:\/\/www.sans.org\/reading-room\/whitepapers\/dns\/detecting-dns-tunneling-34152. Farnham, G. Detecting DNS Tunneling. SANS Institute White Paper. February 2013. Accessed 11 Jan 2016. http:\/\/www.sans.org\/reading-room\/whitepapers\/dns\/detecting-dns-tunneling-34152."},{"volume-title":"Scale your DNS Infrastructure. Accessed","year":"2016","key":"e_1_3_2_1_7_1","unstructured":"F5. Scale your DNS Infrastructure. Accessed 11 Jan 2016 . https:\/\/f5.com\/portals\/1\/pdf\/events\/Scale-your-DNS-Infrastructure-to-ensure-App-and-Service-Availability.pdf. F5. Scale your DNS Infrastructure. Accessed 11 Jan 2016. https:\/\/f5.com\/portals\/1\/pdf\/events\/Scale-your-DNS-Infrastructure-to-ensure-App-and-Service-Availability.pdf."},{"volume-title":"NATO Research and Technology Organization Symp. on Information Assurance and Cyber Defence.","author":"Allard F.","key":"e_1_3_2_1_8_1","unstructured":"Allard , F. , Dubois , R. , Gompel , P. , and Morel , M . 2010. Tunneling activities detection using machine learning techniques . NATO Research and Technology Organization Symp. on Information Assurance and Cyber Defence. Allard, F., Dubois, R., Gompel, P., and Morel, M. 2010. Tunneling activities detection using machine learning techniques. NATO Research and Technology Organization Symp. on Information Assurance and Cyber Defence."},{"key":"e_1_3_2_1_9_1","volume-title":"Catching DNS Tunnels with A.I. DefCon 17. 29 July to","author":"Hind J.","year":"2009","unstructured":"Hind , J. 2009. Catching DNS Tunnels with A.I. DefCon 17. 29 July to 2 August 2009 . Las Vegas , NV. Hind, J. 2009. Catching DNS Tunnels with A.I. DefCon 17. 29 July to 2 August 2009. Las Vegas, NV."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-37682-5_6"},{"key":"e_1_3_2_1_11_1","unstructured":"IETF. Accessed 11 Jan 2016. https:\/\/www.ietf.org\/  IETF. Accessed 11 Jan 2016. https:\/\/www.ietf.org\/"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010933404324"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1023\/A:1018054314350"},{"key":"e_1_3_2_1_14_1","volume-title":"Package Random Forest. Accessed","author":"Cran R","year":"2016","unstructured":"Cran R Project . Package Random Forest. Accessed 11 Jan 2016 . https:\/\/cran.r-project.org\/web\/packages\/randomForest\/randomForest.pdf Cran R Project. Package Random Forest. Accessed 11 Jan 2016. https:\/\/cran.r-project.org\/web\/packages\/randomForest\/randomForest.pdf"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1093\/biomet\/70.1.163"},{"issue":"2","key":"e_1_3_2_1_16_1","first-page":"271","article-title":"Comparative Study of Attribute Selection using Gain Ratio and Correlation Based Feature","volume":"2","author":"Gowda Karegowda A.","year":"2010","unstructured":"Gowda Karegowda , A. , Manjunath A. S. , and Jayaram M. A. 2010 . Comparative Study of Attribute Selection using Gain Ratio and Correlation Based Feature Selection. Int. J Inf. Tech. & Knowledge Management. 2 ( 2 ). 271 -- 277 . Gowda Karegowda, A., Manjunath A. S., and Jayaram M. A. 2010. Comparative Study of Attribute Selection using Gain Ratio and Correlation Based Feature Selection. Int. J Inf. Tech. & Knowledge Management. 2(2). 271--277.","journal-title":"Selection. Int. J Inf. Tech. & Knowledge Management."}],"event":{"name":"CISRC '16: 11th Annual Cyber and Information Security Research","sponsor":["Oak Ridge National Laboratory"],"location":"Oak Ridge TN USA","acronym":"CISRC '16"},"container-title":["Proceedings of the 11th Annual Cyber and Information Security Research Conference"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2897795.2897804","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/2897795.2897804","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T04:38:45Z","timestamp":1750221525000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/2897795.2897804"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,4,5]]},"references-count":16,"alternative-id":["10.1145\/2897795.2897804","10.1145\/2897795"],"URL":"https:\/\/doi.org\/10.1145\/2897795.2897804","relation":{},"subject":[],"published":{"date-parts":[[2016,4,5]]},"assertion":[{"value":"2016-04-05","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}