{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,10]],"date-time":"2026-04-10T04:51:44Z","timestamp":1775796704231,"version":"3.50.1"},"reference-count":33,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2026,4,10]],"date-time":"2026-04-10T00:00:00Z","timestamp":1775779200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2026,4,10]],"date-time":"2026-04-10T00:00:00Z","timestamp":1775779200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>In recent years, DNS hijacking represents a significant security threat to the infrastructure of the Domain Name System (DNS). A prevalent form of DNS hijacking involves exploiting open resolvers to manipulate DNS records. Such attacks undermine the availability and confidentiality of network services, posing serious risks to legitimate users. Current DNS hijacking detection methods tend to focus on specific domains, leveraging the unique characteristics of domain-specific hijacking to identify attacks. Consequently, these methods are often limited in applicability and may lack accuracy when dealing with diverse hijacking scenarios. Additionally, many existing approaches face challenges related to efficiency, making them less effective for long-term monitoring of hijacking activities. To address these challenges, this paper introduces an efficient detection method F2D tailored for general DNS hijacking. First, F2D uses an accurate and efficient filtration funnel strategy for targeted resolver hijacking detection. Second, two optimized detection algorithms are proposed for comprehensive filtration. Third, the method includes an efficient mechanism for identifying CDN domains, enabling the filtration of a large number of content replication servers and enhancing overall detection efficiency. During the validation phase, we monitor around 36k domains and around 600 resolvers over a one-month period. The effectiveness of our method is validated using manually labeled sample data. Experimental results demonstrate that our method can improve the F1 performance by 10% with the same false alert level, and time efficiency by 39% compared to the state-of-the-arts. Furthermore, we conduct an in-depth analysis of the captured hijacking incidents and deduce the motivation of the hijacking.<\/jats:p>","DOI":"10.1186\/s42400-026-00581-8","type":"journal-article","created":{"date-parts":[[2026,4,10]],"date-time":"2026-04-10T03:55:08Z","timestamp":1775793308000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["F2D: Detection of resolver DNS hijacking based on filtration funnel strategy"],"prefix":"10.1186","volume":"9","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7581-7160","authenticated-orcid":false,"given":"Cong","family":"Dong","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Haoran","family":"Jiao","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jiahai","family":"Yang","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yue","family":"Wu","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Chenglong","family":"Li","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xia","family":"Yin","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2026,4,10]]},"reference":[{"key":"581_CR1","doi-asserted-by":"crossref","unstructured":"Akiwate G, Sommese R, Jonker M, Durumeric Z, Claffy K, Voelker GM, Savage S (2022) Retroactive identification of targeted DNS infrastructure hijacking. In: Proceedings of the 22nd ACM internet measurement conference, pp 14\u201332","DOI":"10.1145\/3517745.3561425"},{"key":"581_CR2","doi-asserted-by":"crossref","unstructured":"Alharbi F, Chang J, Zhou Y, Qian F, Qian Z, Abu-Ghazaleh N (2019) Collaborative client-side DNS cache poisoning attack. In: IEEE INFOCOM 2019-IEEE conference on computer communications, IEEE, pp 1153\u20131161","DOI":"10.1109\/INFOCOM.2019.8737514"},{"key":"581_CR5","unstructured":"Braun B (2016) Investigating DNS hijacking through high frequency measurements. Ph.D. thesis, UC San Diego"},{"key":"581_CR6","doi-asserted-by":"publisher","unstructured":"Chang L, Lu K, Li C, Zhang Z (2022) ZMap performance in open DNS resolver discovery. In: 2022 2nd Asia-Pacific conference on communications technology and computer science (ACCTCS), pp 80\u201385. https:\/\/doi.org\/10.1109\/ACCTCS53867.2022.00024","DOI":"10.1109\/ACCTCS53867.2022.00024"},{"key":"581_CR8","unstructured":"Dickson B (2023) Dozens of web apps vulnerable to DNS cache poisoning via \u2018forgot password\u2019 feature. https:\/\/portswigger.net\/daily-swig\/dozens-of-web-apps-vulnerable-to-dns-cache-poisoning-via-forgot-password-feature, Accessed 28 Aug 2024"},{"key":"581_CR9","doi-asserted-by":"crossref","unstructured":"Fejrskov M, Pedersen JM, Vasilomanolakis E (2022) Detecting DNS hijacking by using netflow data. In: 2022 IEEE conference on communications and network security (CNS), IEEE, pp 273\u2013280","DOI":"10.1109\/CNS56114.2022.9947264"},{"key":"581_CR10","doi-asserted-by":"crossref","unstructured":"Herzberg A, Shulman H (2013) Socket overloading for fun and cache-poisoning. In: Proceedings of the 29th annual computer security applications conference, ACM, pp 189\u2013198","DOI":"10.1145\/2523649.2523662"},{"key":"581_CR11","doi-asserted-by":"publisher","unstructured":"Hoffman PE, McManus P (2018) DNS queries over https (DOH). Request for comments RFC 8484, Internet engineering task force. https:\/\/doi.org\/10.17487\/RFC8484","DOI":"10.17487\/RFC8484"},{"key":"581_CR12","doi-asserted-by":"crossref","unstructured":"Houser R, Hao S, Li Z, Liu D, Cotton C, Wang H (2021) A comprehensive measurement-based investigation of DNS hijacking. In: 2021 40th international symposium on reliable distributed systems (SRDS), IEEE, pp 210\u2013221","DOI":"10.1109\/SRDS53918.2021.00029"},{"key":"581_CR13","doi-asserted-by":"crossref","unstructured":"Huang C, Zhang P, Sun Y, Zhu Y, Liu Y (2019) SFDS: a self-feedback detection system for DNS hijacking based on multi-protocol cross validation. In: 2019 26th International conference on telecommunications (ICT), IEEE, pp 238\u2013243","DOI":"10.1109\/ICT.2019.8798832"},{"key":"581_CR14","doi-asserted-by":"crossref","unstructured":"Izhikevich L, Akiwate G, Berger B, Drakontaidis S, Ascheman A, Pearce P, Adrian D, Durumeric Z (2022) ZDNS: a fast DNS toolkit for internet measurement. In: Proceedings of the 22nd ACM internet measurement conference, pp 33\u201343","DOI":"10.1145\/3517745.3561434"},{"key":"581_CR15","doi-asserted-by":"crossref","unstructured":"Jia J, Dong Z, Li J, Stokes JW (2021) Detection of malicious DNS and web servers using graph-based approaches. In: ICASSP 2021-2021 IEEE International conference on acoustics, speech and signal processing (ICASSP), IEEE, pp 2625\u20132629","DOI":"10.1109\/ICASSP39728.2021.9415092"},{"key":"581_CR16","unstructured":"Jiang J, Liang J, Li K, Li J, Duan H, Wu J, et al (2012) Ghost domain names: revoked yet still resolvable. In: The 19th annual network & distributed system security symposium (NDSS 2012)"},{"key":"581_CR17","doi-asserted-by":"crossref","unstructured":"Jin Y, Tomoishi M, Matsuura S (2019) Detection of hijacked authoritative dns servers by name resolution traffic classification. In: 2019 IEEE international conference on big data (Big Data), IEEE, pp 6084\u20136085","DOI":"10.1109\/BigData47090.2019.9006365"},{"key":"581_CR18","unstructured":"Kaminsky D (2008) Black OPS 2008: it\u2019s the end of the cache as we know it. In: Black Hat USA. 2008"},{"key":"581_CR19","doi-asserted-by":"crossref","unstructured":"Khalil I, Yu T, Guan B (2016) Discovering malicious domains through passive DNS data graph analysis. In: Proceedings of the 11th ACM on Asia conference on computer and communications security, pp 663\u2013674","DOI":"10.1145\/2897845.2897877"},{"key":"581_CR21","doi-asserted-by":"crossref","unstructured":"Li X, Liu B, Bai X, Zhang M, Zhang Q, Li Z, Duan H, Li Q (2023a) Ghost domain reloaded: vulnerable links in domain name delegation and revocation. In: Annual network and distributed system security symposium","DOI":"10.14722\/ndss.2023.23005"},{"key":"581_CR22","unstructured":"Li X, Lu C, Liu B, Zhang Q, Li Z, Duan H, Li Q (2023b) The maginot line: attacking the boundary of $$\\{$$DNS$$\\}$$ caching protection. In: 32nd USENIX security symposium (USENIX Security 23), pp 3153\u20133170"},{"key":"581_CR23","unstructured":"Li X, Lu C, Liu B, Zhang Q, Li Z, Duan H, Li Q (2023c) The maginot line: attacking the boundary of DNS caching protection. In: 32nd USENIX security symposium (USENIX Security 23), USENIX Association, Anaheim, CA, pp 3153\u20133170. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/li-xiang"},{"key":"581_CR24","unstructured":"Liu B, Lu C, Duan H, Liu Y, Li Z, Hao S, Yang M (2018) Who is answering my queries: understanding and characterizing interception of the $$\\{$$DNS$$\\}$$ resolution path. In: 27th USENIX security symposium (USENIX Security 18), pp 1113\u20131128"},{"key":"581_CR25","doi-asserted-by":"crossref","unstructured":"Lyu M, Gharakheili HH, Sivaraman V (2023) A survey on DNS encryption: current development, malware misuse, and inference techniques. https:\/\/ar5iv.labs.arxiv.org\/html\/2201.00900. Accessed 28 Aug 2024","DOI":"10.1145\/3547331"},{"key":"581_CR26","doi-asserted-by":"publisher","unstructured":"Nawrocki M, Koch M, Schmidt TC, W\u00e4hlisch M (2021) Transparent forwarders: an unnoticed component of the open DNS infrastructure. In: Proceedings of the 17th international conference on emerging networking experiments and technologies. CoNEXT \u201921, Association for Computing Machinery, New York, NY, USA, pp 454\u2013462. https:\/\/doi.org\/10.1145\/3485983.3494872","DOI":"10.1145\/3485983.3494872"},{"key":"581_CR27","unstructured":"Niaki AA, Hoang NP, Gill P, Houmansadr A, et al (2020) Triplet censors: demystifying great $$\\{$$Firewall\u2019s$$\\}$$$$\\{$$DNS$$\\}$$ censorship behavior. In: 10th USENIX workshop on free and open communications on the internet (FOCI 20)"},{"key":"581_CR28","doi-asserted-by":"publisher","unstructured":"Park J, Khormali A, Mohaisen M, Mohaisen A (2019) Where are you taking me? behavioral analysis of open DNS resolvers. In: 2019 49th annual IEEE\/IFIP international conference on dependable systems and networks (DSN), IEEE, Portland, OR, USA, pp 493\u2013504. https:\/\/doi.org\/10.1109\/DSN.2019.00057","DOI":"10.1109\/DSN.2019.00057"},{"key":"581_CR29","unstructured":"Pearce P, Jones B, Li F, Ensafi R, Feamster N, Weaver N, Paxson V (2017) Global measurement of $$\\{$$DNS$$\\}$$ manipulation. In: 26th USENIX security symposium (USENIX Security 17), pp 307\u2013323"},{"key":"581_CR32","unstructured":"Pochat VL, Van Goethem T, Tajalizadehkhoob S, Korczy\u0144ski M, Joosen W (2018) Tranco: A research-oriented top sites ranking hardened against manipulation. Preprint at arXiv:1806.01156"},{"key":"581_CR50","unstructured":"Shaos ea (2022) A comprehensive measurement-based investigation of DNS hijacking. In: IMC \u201922, 25\u201327 Oct 2022"},{"key":"581_CR39","unstructured":"Squarcina M, Tempesta M, Veronese L, Calzavara S, Maffei M (2021) Can i take your subdomain? Exploring same-site attacks in the modern web"},{"key":"581_CR40","unstructured":"Suchitra ea (2021) Retroactive identification of targeted DNS infrastructure hijacking. In: Proceedings of the 2021 ACM SIGCOMM conference on internet measurement"},{"key":"581_CR41","doi-asserted-by":"publisher","unstructured":"Vissers T, Barron T, Van Goethem T, Joosen W, Nikiforakis N (2017) The wolf of name street: Hijacking domains through their nameservers. In: Proceedings of the 2017 ACM SIGSAC conference on computer and communications security. ACM, Dallas Texas USA, pp 957\u2013970. https:\/\/doi.org\/10.1145\/3133956.3133988","DOI":"10.1145\/3133956.3133988"},{"key":"581_CR42","doi-asserted-by":"crossref","unstructured":"Wang B, Zhang L, Gong NZ (2017) Sybilscar: sybil detection in online social networks via local rule based propagation. In: IEEE INFOCOM 2017-IEEE Conference on computer communications, IEEE, pp 1\u20139","DOI":"10.1109\/INFOCOM.2017.8057066"},{"key":"581_CR43","unstructured":"Wei M (2021) Domain shadowing: leveraging content delivery networks for robust blocking-resistant communications"},{"key":"581_CR48","unstructured":"Zheng X, Lu C, Peng J, Yang Q, Zhou D, Liu B, Man K, Hao S, Duan H, Qian Z (2020) Poison over troubled forwarders: a cache poisoning attack targeting DNS forwarding devices"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-026-00581-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-026-00581-8","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-026-00581-8.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,10]],"date-time":"2026-04-10T03:55:36Z","timestamp":1775793336000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1186\/s42400-026-00581-8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,10]]},"references-count":33,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2026,12]]}},"alternative-id":["581"],"URL":"https:\/\/doi.org\/10.1186\/s42400-026-00581-8","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4,10]]},"assertion":[{"value":"25 September 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"20 March 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"10 April 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no Competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"153"}}