{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,7,25]],"date-time":"2024-07-25T10:30:53Z","timestamp":1721903453859},"reference-count":47,"publisher":"Springer Science and Business Media LLC","issue":"6","license":[{"start":{"date-parts":[[2017,12,16]],"date-time":"2017-12-16T00:00:00Z","timestamp":1513382400000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Int. J. Inf. Secur."],"published-print":{"date-parts":[[2018,11]]},"DOI":"10.1007\/s10207-017-0396-7","type":"journal-article","created":{"date-parts":[[2017,12,16]],"date-time":"2017-12-16T07:48:02Z","timestamp":1513410482000},"page":"661-680","update-policy":"http:\/\/dx.doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":8,"title":["DomainProfiler: toward accurate and early discovery of domain names abused in future"],"prefix":"10.1007","volume":"17","author":[{"ORCID":"http:\/\/orcid.org\/0000-0002-7532-6633","authenticated-orcid":false,"given":"Daiki","family":"Chiba","sequence":"first","affiliation":[]},{"given":"Takeshi","family":"Yagi","sequence":"additional","affiliation":[]},{"given":"Mitsuaki","family":"Akiyama","sequence":"additional","affiliation":[]},{"given":"Toshiki","family":"Shibahara","sequence":"additional","affiliation":[]},{"given":"Tatsuya","family":"Mori","sequence":"additional","affiliation":[]},{"given":"Shigeki","family":"Goto","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2017,12,16]]},"reference":[{"key":"396_CR1","unstructured":"(2017) Alexa top sites. URL http:\/\/www.alexa.com\/topsites"},{"key":"396_CR2","unstructured":"(2017) hpHosts. URL http:\/\/www.hosts-file.net\/"},{"key":"396_CR3","unstructured":"(2017) VirusTotal. URL https:\/\/www.virustotal.com\/"},{"key":"396_CR4","unstructured":"Alrwais, S.A., Yuan, K., Alowaisheq, E., Li, Z., Wang, X.: Understanding the dark side of domain parking. In: Proceedings of the 23rd USENIX security symposium, pp. 207\u2013222 (2014)"},{"key":"396_CR5","unstructured":"Antonakakis, M., Perdisci, R., Dagon, D., Lee, W., Feamster, N.: Building a dynamic reputation system for DNS. In: Proceedings of the 19th USENIX security symposium, (2010)"},{"key":"396_CR6","unstructured":"Antonakakis, M., Perdisci, R., Lee, W., Vasiloglou, N. II, Dagon, D.: Detecting malware domains at the upper DNS hierarchy. In: Proceedings of the 20th USENIX security symposium, (2011)"},{"key":"396_CR7","unstructured":"Antonakakis, M., Perdisci, R., Nadji, Y., Vasiloglou, N., Abu-Nimeh, S., Lee, W., Dagon, D.: From throw-away traffic to bots: detecting the rise of DGA-based malware. In: Proceedings of the 21st USENIX security symposium, (2012)"},{"issue":"4","key":"396_CR8","doi-asserted-by":"publisher","first-page":"14:1","DOI":"10.1145\/2584679","volume":"16","author":"L Bilge","year":"2014","unstructured":"Bilge, L., Sen, S., Balzarotti, D., Kirda, E., Kruegel, C.: Exposure: a passive DNS analysis service to detect and report malicious domains. ACM Trans. Inf. Syst. Secur. 16(4), 14:1\u201314:28 (2014). https:\/\/doi.org\/10.1145\/2584679","journal-title":"ACM Trans. Inf. Syst. Secur."},{"issue":"Supplement 1","key":"396_CR9","doi-asserted-by":"publisher","first-page":"S3","DOI":"10.1016\/j.diin.2015.05.002","volume":"14","author":"A Boukhtouta","year":"2015","unstructured":"Boukhtouta, A., Mouheb, D., Debbabi, M., Alfandi, O., Iqbal, F., Barachi, M.E.: Graph-theoretic characterization of cyber-threat infrastructures. Digit. Invest. 14(Supplement 1), S3\u2013S15 (2015). https:\/\/doi.org\/10.1016\/j.diin.2015.05.002","journal-title":"Digit. Invest."},{"issue":"1","key":"396_CR10","doi-asserted-by":"publisher","first-page":"5","DOI":"10.1023\/A:1010933404324","volume":"45","author":"L Breiman","year":"2001","unstructured":"Breiman, L.: Random forests. Mach. Learn. 45(1), 5\u201332 (2001). https:\/\/doi.org\/10.1023\/A:1010933404324","journal-title":"Mach. Learn."},{"key":"396_CR11","unstructured":"Breiman, L.: Manual on setting up, using, and understanding random forests v3.1. (2002) URL https:\/\/www.stat.berkeley.edu\/~breiman\/Using_random_forests_V3.1.pdf"},{"key":"396_CR12","unstructured":"CAIDA (2017) Routeviews prefix to AS mappings dataset (pfx2as) for IPv4 and IPv6. URL http:\/\/www.caida.org\/data\/routing\/routeviews-prefix2as.xml"},{"key":"396_CR13","doi-asserted-by":"publisher","unstructured":"Chen, Y., Antonakakis, M., Perdisci, R., Nadji, Y., Dagon, D., Lee, W.: DNS noise: Measuring the pervasiveness of disposable domains in modern DNS traffic. In: Proceedings of the 44th annual IEEE\/IFIP international conference on dependable systems and networks (DSN\u201914), pp 598\u2013609, (2014). https:\/\/doi.org\/10.1109\/DSN.2014.61","DOI":"10.1109\/DSN.2014.61"},{"key":"396_CR14","doi-asserted-by":"publisher","unstructured":"Chiba, D., Tobe, K., Mori, T., Goto, S.: Detecting malicious websites by learning IP address features. In: Proceedings of the 12th IEEE\/IPSJ international symposium on applications and the internet (SAINT\u201912), pp 29\u201339, (2012). https:\/\/doi.org\/10.1109\/SAINT.2012.14","DOI":"10.1109\/SAINT.2012.14"},{"key":"396_CR15","doi-asserted-by":"publisher","unstructured":"Chiba, D., Yagi, T., Akiyama, M., Shibahara, T., Yada, T., Mori, T., Goto, S.: DomainProfiler: Discovering domain names abused in future. In: Proceedings of the 46th annual IEEE\/IFIP international conference on dependable systems and networks (DSN\u201916), pp 491\u2013502, (2016). https:\/\/doi.org\/10.1109\/DSN.2016.51","DOI":"10.1109\/DSN.2016.51"},{"key":"396_CR16","doi-asserted-by":"crossref","unstructured":"Eshete, B., Alhuzali, A., Monshizadeh, M., Porras, P.A., Venkatakrishnan, V.N., Yegneswaran, V.: EKHunter: A counter-offensive toolkit for exploit kit infiltration. In: Proceedings of the 22nd annual network and distributed system security symposium (NDSS\u201915), (2015)","DOI":"10.14722\/ndss.2015.23237"},{"key":"396_CR17","unstructured":"Farsight Security, Inc (2017) DNSDB. URL https:\/\/www.dnsdb.info\/"},{"key":"396_CR18","unstructured":"Felegyhazi, M., Kreibich, C., Paxson, V.: On the potential of proactive domain blacklisting. In: Proceedings of the 3rd USENIX conference on large-scale exploits and emergent threats (LEET\u201910), (2010)"},{"key":"396_CR19","doi-asserted-by":"publisher","unstructured":"Grier, C., Ballard, L., Caballero, J., Chachra, N., Dietrich, C.J., Levchenko, K., Mavrommatis, P., McCoy, D., Nappa, A., Pitsillidis, A., Provos, N., Rafique, M.Z., Rajab, M.A., Rossow, C., Thomas, K., Paxson, V., Savage, S., Voelker, G.M.: Manufacturing compromise: the emergence of exploit-as-a-service. In: Proceedings of the 19th ACM conference on computer and communications security (CCS\u201912), pp 821\u2013832, (2012). https:\/\/doi.org\/10.1145\/2382196.2382283","DOI":"10.1145\/2382196.2382283"},{"key":"396_CR20","doi-asserted-by":"publisher","unstructured":"Halvorson, T., Der, M.F., Foster, I., Savage, S., Saul, L.K., Voelker, G.M.: From .academy to .zone: An analysis of the new TLD land rush. In: Proceedings of the ACM conference on internet measurement conference (IMC\u201915), pp 381\u2013394, (2015). https:\/\/doi.org\/10.1145\/2815675.2815696","DOI":"10.1145\/2815675.2815696"},{"key":"396_CR21","doi-asserted-by":"crossref","unstructured":"Hao, S., Kantchelian, A., Miller, B., Paxson, V., Feamster, N.: PREDATOR: Proactive recognition and elimination of domain abuse at time-of-registration. In: Proceedings of the 23rd ACM conference on computer and communications security (CCS\u201916), (2016)","DOI":"10.1145\/2976749.2978317"},{"key":"396_CR22","unstructured":"ICANN (2017) ICANN new gTLDs delegated strings. URL https:\/\/newgtlds.icann.org\/en\/program-status\/delegated-strings"},{"issue":"282","key":"396_CR23","doi-asserted-by":"crossref","first-page":"457","DOI":"10.1080\/01621459.1958.10501452","volume":"53","author":"EL Kaplan","year":"1958","unstructured":"Kaplan, E.L., Meier, P.: Nonparametric estimation from incomplete observations. J. Am. Stat. Assoc. 53(282), 457\u2013481 (1958)","journal-title":"J. Am. Stat. Assoc."},{"key":"396_CR24","doi-asserted-by":"publisher","unstructured":"K\u00fchrer, M., Rossow, C., Holz, T.: Paint it black: Evaluating the effectiveness of malware blacklists. In: Proceedings of the 17th international symposium on research in attacks, intrusions and defenses (RAID\u201914), pp 1\u201321, (2014). https:\/\/doi.org\/10.1007\/978-3-319-11379-1_1","DOI":"10.1007\/978-3-319-11379-1_1"},{"key":"396_CR25","doi-asserted-by":"publisher","unstructured":"Lever, C., Walls, R.J., Nadji, Y., Dagon, D., McDaniel, P., Antonakakis, M.: Domain-Z: 28 registrations later measuring the exploitation of residual trust in domains. In: Proceedings of the 37th IEEE symposium on security and privacy (SP\u201916), pp 691\u2013706, (2016). https:\/\/doi.org\/10.1109\/SP.2016.47","DOI":"10.1109\/SP.2016.47"},{"key":"396_CR26","doi-asserted-by":"publisher","unstructured":"Li, Z., Alrwais, S.A., Xie, Y., Yu, F., Wang, X.: Finding the linchpins of the dark web: a study on topologically dedicated hosts on malicious web infrastructures. In: Proceedings of the 34th IEEE symposium on security and privacy (SP\u201913), pp 112\u2013126, (2013). https:\/\/doi.org\/10.1109\/SP.2013.18","DOI":"10.1109\/SP.2013.18"},{"key":"396_CR27","unstructured":"Liaw, A., Wiener, M.: Classification and regression by randomForest. R News 2(3):18\u201322 (2002) URL http:\/\/CRAN.R-project.org\/doc\/Rnews\/"},{"key":"396_CR28","unstructured":"Liaw, A., Wiener, M.: Package \u2019randomForest\u2019. (2015) URL https:\/\/cran.r-project.org\/web\/packages\/randomForest\/randomForest.pdf"},{"key":"396_CR29","doi-asserted-by":"publisher","unstructured":"Ma, J., Saul, L.K., Savage, S., Voelker, G.M.: Beyond blacklists: Learning to detect malicious web sites from suspicious URLs. In: Proceedings of the 15th ACM SIGKDD international conference on knowledge discovery and data mining (KDD\u201909), pp 1245\u20131254, (2009). https:\/\/doi.org\/10.1145\/1557019.1557153","DOI":"10.1145\/1557019.1557153"},{"key":"396_CR30","unstructured":"Maigron, P.: Regional internet registries statistics. (2017) URL http:\/\/www-public.tem-tsp.eu\/~maigron\/RIR_Stats\/index.html"},{"key":"396_CR31","doi-asserted-by":"publisher","unstructured":"Manadhata, P., Yadav, S., Rao, P., Horne, W.: Detecting malicious domains via graph inference. In: Computer security\u2014ESORICS 2014, lecture notes in computer science, vol 8712, Springer, Berlin, pp 1\u201318, (2014). https:\/\/doi.org\/10.1007\/978-3-319-11203-9_1","DOI":"10.1007\/978-3-319-11203-9_1"},{"key":"396_CR32","unstructured":"MaxMind (2017) GeoIP2 databases. URL https:\/\/www.maxmind.com\/en\/geoip2-databases"},{"key":"396_CR33","doi-asserted-by":"crossref","unstructured":"Mockapetris, P.: Domain names - implementation and specification. RFC 1035, (1987) URL http:\/\/www.ietf.org\/rfc\/rfc1035.txt","DOI":"10.17487\/rfc1035"},{"key":"396_CR34","unstructured":"Mozilla foundation: Public suffix list. (2017) URL https:\/\/publicsuffix.org\/list\/"},{"issue":"5","key":"396_CR35","doi-asserted-by":"publisher","first-page":"714","DOI":"10.1109\/TDSC.2012.35","volume":"9","author":"R Perdisci","year":"2012","unstructured":"Perdisci, R., Corona, I., Giacinto, G.: Early detection of malicious flux networks via large-scale passive DNS traffic analysis. IEEE Trans. Depend. Sec. Comput. 9(5), 714\u2013726 (2012). https:\/\/doi.org\/10.1109\/TDSC.2012.35","journal-title":"IEEE Trans. Depend. Sec. Comput."},{"key":"396_CR36","unstructured":"Rahbarinia, B., Perdisci, R., Antonakakis, M., Dagon, D.: SinkMiner: Mining botnet sinkholes for fun and profit. In: Proceedings of the 6th USENIX workshop on large-scale exploits and emergent threats (LEET\u201913), (2013)"},{"key":"396_CR37","doi-asserted-by":"publisher","unstructured":"Rahbarinia, B., Perdisci, R., Antonakakis, M.: Segugio: Efficient behavior-based tracking of malware-control domains in large ISP networks. In: Proceedings of the 45th annual IEEE\/IFIP international conference on dependable systems and networks (DSN\u201915), pp 403\u2013414, (2015). https:\/\/doi.org\/10.1109\/DSN.2015.35","DOI":"10.1109\/DSN.2015.35"},{"key":"396_CR38","unstructured":"Sato, K., Ishibashi, K., Toyono, T., Miyake, N.: Extending black domain name list by using co-occurrence relation between DNS queries. In: Proceedings of the 3rd USENIX conference on large-scale exploits and emergent threats (LEET\u201910), (2010)"},{"key":"396_CR39","doi-asserted-by":"publisher","unstructured":"Sebasti\u00e1n, M., Rivera, R., Kotzias, P., Caballero, J.: AVclass: A tool for massive malware labeling. In: Proceedings of the 19th international symposium on research in attacks, intrusions, and defenses (RAID\u201916), pp 230\u2013253 (2016). https:\/\/doi.org\/10.1007\/978-3-319-45719-2_11","DOI":"10.1007\/978-3-319-45719-2_11"},{"key":"396_CR40","unstructured":"Soska, K., Christin, N.: Automatically detecting vulnerable websites before they turn malicious. In: Proceedings of the 23rd USENIX security symposium, pp 625\u2013640, (2014)"},{"key":"396_CR41","unstructured":"Szurdi, J., Kocso, B, Cseh, G., Spring, J., Felegyhazi, M., Kanich, C.: The long \u201ctaile\u201d of typosquatting domain names. In: Proceedings of the 23rd USENIX security symposium, pp 191\u2013206, (2014)"},{"key":"396_CR42","doi-asserted-by":"publisher","unstructured":"Thomas, M., Mohaisen, A.: Kindred domains: Detecting and clustering botnet domains using DNS traffic. In: Proceedings of the 23rd international conference on World Wide Web (WWW\u201914), pp 707\u2013712, (2014). https:\/\/doi.org\/10.1145\/2567948.2579359","DOI":"10.1145\/2567948.2579359"},{"key":"396_CR43","unstructured":"Venkataraman, S., Brumley, D., Sen, S., Spatscheck, O.: Automatically inferring the evolution of malicious activity on the Internet. In: Proceedings of the 20th annual network and distributed system security symposium, (NDSS\u201913) (2013)"},{"key":"396_CR44","unstructured":"Verisign (2017) Domain name industry brief. URL http:\/\/www.verisign.com\/en_US\/innovation\/dnib\/index.xhtml"},{"key":"396_CR45","doi-asserted-by":"crossref","unstructured":"Vissers, T., Joosen, W., Nikiforakis, N.: Parking sensors: Analyzing and detecting parked domains. In: Proceedings of the 22nd annual network and distributed system security symposium, (NDSS\u201915), (2015)","DOI":"10.14722\/ndss.2015.23053"},{"key":"396_CR46","unstructured":"Weimer, F.: Passive DNS replication. In: Proceedings of the 17th annual FIRST conference, (2005)"},{"issue":"5","key":"396_CR47","doi-asserted-by":"publisher","first-page":"1663","DOI":"10.1109\/TNET.2012.2184552","volume":"20","author":"S Yadav","year":"2012","unstructured":"Yadav, S., Reddy, A.K.K., Reddy, A.L.N., Ranjan, S.: Detecting algorithmically generated domain-flux attacks with DNS traffic analysis. IEEE\/ACM Trans. Netw. 20(5), 1663\u20131677 (2012). https:\/\/doi.org\/10.1109\/TNET.2012.2184552","journal-title":"IEEE\/ACM Trans. Netw."}],"container-title":["International Journal of Information Security"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/link.springer.com\/article\/10.1007\/s10207-017-0396-7\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-017-0396-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/link.springer.com\/content\/pdf\/10.1007\/s10207-017-0396-7.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2019,10,8]],"date-time":"2019-10-08T03:47:02Z","timestamp":1570506422000},"score":1,"resource":{"primary":{"URL":"http:\/\/link.springer.com\/10.1007\/s10207-017-0396-7"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017,12,16]]},"references-count":47,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2018,11]]}},"alternative-id":["396"],"URL":"https:\/\/doi.org\/10.1007\/s10207-017-0396-7","relation":{},"ISSN":["1615-5262","1615-5270"],"issn-type":[{"value":"1615-5262","type":"print"},{"value":"1615-5270","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017,12,16]]}}}