{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2024,9,7]],"date-time":"2024-09-07T21:20:03Z","timestamp":1725744003573},"publisher-location":"New York, NY, USA","reference-count":29,"publisher":"ACM","funder":[{"name":"Comunidad de Madrid (ESF and FEDER)","award":["P2018\/TCS-4566"]},{"name":"Comunidad de Madrid (V PRICIT)","award":["EPUC3M21"]},{"name":"Ministerio de Ciencia e Innovaci\u00f3n \/ Agencia Estatal de Investigaci\u00f3n","award":["PID2020-113795RB-C32 - MCIN\/AEI\/10.13039\/501100011033, TEC2017-84197-C4-1-R"]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,10,24]]},"DOI":"10.1145\/3551663.3558605","type":"proceedings-article","created":{"date-parts":[[2022,10,19]],"date-time":"2022-10-19T22:06:16Z","timestamp":1666217176000},"page":"25-32","source":"Crossref","is-referenced-by-count":4,"title":["Detecting Malicious Use of DoH Tunnels Using Statistical Traffic Analysis"],"prefix":"10.1145","author":[{"given":"Marta","family":"Moure-Garrido","sequence":"first","affiliation":[{"name":"University Carlos III of Madrid, Legan\u00e9s, Spain"}]},{"given":"Celeste","family":"Campo","sequence":"additional","affiliation":[{"name":"University Carlos III of Madrid, Legan\u00e9s, Spain"}]},{"given":"Carlos","family":"Garcia-Rubio","sequence":"additional","affiliation":[{"name":"University Carlos III of Madrid, Legan\u00e9s, Spain"}]}],"member":"320","published-online":{"date-parts":[[2022,10,24]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Classifying DNS Tunneling Tools For Malicious DoH Traffic. In 2021 IEEE Symposium Series on Computational Intelligence (SSCI). 1--9. https:\/\/doi.org\/10","author":"Alenezi Rafa","year":"2021","unstructured":"Rafa Alenezi and Simone A. Ludwig . 2021 . Classifying DNS Tunneling Tools For Malicious DoH Traffic. In 2021 IEEE Symposium Series on Computational Intelligence (SSCI). 1--9. https:\/\/doi.org\/10 .1109\/SSCI50451. 2021 .9660136 10.1109\/SSCI50451.2021.9660136 Rafa Alenezi and Simone A. Ludwig. 2021. Classifying DNS Tunneling Tools For Malicious DoH Traffic. In 2021 IEEE Symposium Series on Computational Intelligence (SSCI). 1--9. https:\/\/doi.org\/10.1109\/SSCI50451.2021.9660136"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.12691\/jcsa-8-2-2"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3113294"},{"key":"e_1_3_2_1_4_1","unstructured":"Ron Bowes. 2017. dnscat2. https:\/\/github.com\/iagox86\/dnscat2 Ron Bowes. 2017. dnscat2. https:\/\/github.com\/iagox86\/dnscat2"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICICT50521.2020.00085"},{"key":"e_1_3_2_1_6_1","unstructured":"Catalin Cimpanu. 2020. Iranian hacker group becomes first known APT to weaponize DNS-over-HTTPS (DoH). https:\/\/www.zdnet.com\/article\/iranian-hacker-group-becomes-first-known-apt-to-weaponize-dns-over-https-doh\/ Catalin Cimpanu. 2020. Iranian hacker group becomes first known APT to weaponize DNS-over-HTTPS (DoH). https:\/\/www.zdnet.com\/article\/iranian-hacker-group-becomes-first-known-apt-to-weaponize-dns-over-https-doh\/"},{"key":"e_1_3_2_1_7_1","unstructured":"Olivier Dembour and Nicolas Collignon. 2017. dns2tcp. https:\/\/github.com\/alex-sector\/dns2tcp Olivier Dembour and Nicolas Collignon. 2017. dns2tcp. https:\/\/github.com\/alex-sector\/dns2tcp"},{"key":"e_1_3_2_1_8_1","volume-title":"On Botnets That Use DNS for Command and Control. In 2011 Seventh European Conference on Computer Network Defense. 9--16","author":"Dietrich Christian J.","year":"2011","unstructured":"Christian J. Dietrich , Christian Rossow , Felix C. Freiling , Herbert Bos , Maarten van Steen , and Norbert Pohlmann . 2011 . On Botnets That Use DNS for Command and Control. In 2011 Seventh European Conference on Computer Network Defense. 9--16 . https:\/\/doi.org\/10.1109\/EC2ND.2011.16 10.1109\/EC2ND.2011.16 Christian J. Dietrich, Christian Rossow, Felix C. Freiling, Herbert Bos, Maarten van Steen, and Norbert Pohlmann. 2011. On Botnets That Use DNS for Command and Control. In 2011 Seventh European Conference on Computer Network Defense. 9--16. https:\/\/doi.org\/10.1109\/EC2ND.2011.16"},{"key":"e_1_3_2_1_9_1","unstructured":"Erik Ekman and Bjorn Andersson. 2014. iodine. https:\/\/github.com\/yarrick\/iodine Erik Ekman and Bjorn Andersson. 2014. iodine. https:\/\/github.com\/yarrick\/iodine"},{"key":"e_1_3_2_1_10_1","volume-title":"Investigating Data Exfiltration in DNS Over HTTPS Queries. In 2019 IEEE 12th International Conference on Global Security, Safety and Sustainability (ICGS3). 212--212","author":"Haddon David A E","year":"2019","unstructured":"David A E Haddon and Haider Alkhateeb . 2019 . Investigating Data Exfiltration in DNS Over HTTPS Queries. In 2019 IEEE 12th International Conference on Global Security, Safety and Sustainability (ICGS3). 212--212 . https:\/\/doi.org\/10.1109\/ICGS3.2019.8688016 10.1109\/ICGS3.2019.8688016 David A E Haddon and Haider Alkhateeb. 2019. Investigating Data Exfiltration in DNS Over HTTPS Queries. In 2019 IEEE 12th International Conference on Global Security, Safety and Sustainability (ICGS3). 212--212. https:\/\/doi.org\/10.1109\/ICGS3.2019.8688016"},{"key":"e_1_3_2_1_11_1","volume-title":"Hoffman and Patrick McManus","author":"Paul","year":"2018","unstructured":"Paul E. Hoffman and Patrick McManus . 2018 . DNS Queries over HTTPS (DoH). RFC 8484. https:\/\/doi.org\/10.17487\/RFC8484 10.17487\/RFC8484 Paul E. Hoffman and Patrick McManus. 2018. DNS Queries over HTTPS (DoH). RFC 8484. https:\/\/doi.org\/10.17487\/RFC8484"},{"key":"e_1_3_2_1_12_1","volume-title":"International journal of data mining & knowledge management process","author":"Hossin Mohammad","year":"2015","unstructured":"Mohammad Hossin and Md Nasir Sulaiman . 2015. A review on evaluation metrics for data classification evaluations . International journal of data mining & knowledge management process , Vol. 5 , 2 ( 2015 ), 1. Mohammad Hossin and Md Nasir Sulaiman. 2015. A review on evaluation metrics for data classification evaluations. International journal of data mining & knowledge management process, Vol. 5, 2 (2015), 1."},{"key":"e_1_3_2_1_13_1","volume-title":"Hoffman","author":"Hu Zi","year":"2016","unstructured":"Zi Hu , Liang Zhu , John Heidemann , Allison Mankin , Duane Wessels , and Paul E . Hoffman . 2016 . Specification for DNS over Transport Layer Security (TLS). RFC 7858. https:\/\/doi.org\/10.17487\/RFC7858 10.17487\/RFC7858 Zi Hu, Liang Zhu, John Heidemann, Allison Mankin, Duane Wessels, and Paul E. Hoffman. 2016. Specification for DNS over Transport Layer Security (TLS). RFC 7858. https:\/\/doi.org\/10.17487\/RFC7858"},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3175497"},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNSM.2021.3078428"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSC53193.2021.9673380"},{"key":"#cr-split#-e_1_3_2_1_17_1.1","doi-asserted-by":"crossref","unstructured":"Paul Mockapetris. 1987. Domain names - implementation and specification. RFC 1035. https:\/\/doi.org\/10.17487\/RFC1035 10.17487\/RFC1035","DOI":"10.17487\/rfc1035"},{"key":"#cr-split#-e_1_3_2_1_17_1.2","doi-asserted-by":"crossref","unstructured":"Paul Mockapetris. 1987. Domain names - implementation and specification. RFC 1035. https:\/\/doi.org\/10.17487\/RFC1035","DOI":"10.17487\/rfc1035"},{"key":"#cr-split#-e_1_3_2_1_18_1.1","doi-asserted-by":"crossref","unstructured":"Mohammadreza MontazeriShatoori Logan Davidson Gurdip Kaur and Arash Habibi Lashkari. 2020. Detection of DoH Tunnels using Time-series Classification of Encrypted Traffic. In 2020 IEEE Intl Conf on Dependable Autonomic and Secure Computing Intl Conf on Pervasive Intelligence and Computing Intl Conf on Cloud and Big Data Computing Intl Conf on Cyber Science and Technology Congress (DASC\/PiCom\/CBDCom\/CyberSciTech). 63--70. https:\/\/doi.org\/10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00026 10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00026","DOI":"10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00026"},{"key":"#cr-split#-e_1_3_2_1_18_1.2","doi-asserted-by":"crossref","unstructured":"Mohammadreza MontazeriShatoori Logan Davidson Gurdip Kaur and Arash Habibi Lashkari. 2020. Detection of DoH Tunnels using Time-series Classification of Encrypted Traffic. In 2020 IEEE Intl Conf on Dependable Autonomic and Secure Computing Intl Conf on Pervasive Intelligence and Computing Intl Conf on Cloud and Big Data Computing Intl Conf on Cyber Science and Technology Congress (DASC\/PiCom\/CBDCom\/CyberSciTech). 63--70. https:\/\/doi.org\/10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00026","DOI":"10.1109\/DASC-PICom-CBDCom-CyberSciTech49142.2020.00026"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2018.2871719"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.3390\/app12052416"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/3ICT51146.2020.9312004"},{"key":"e_1_3_2_1_22_1","volume-title":"An Analysis of Godlua Backdoor. 360 Netlab Blog","author":"Turing Alex","year":"2019","unstructured":"Alex Turing and Genshen Ye. 2019. An Analysis of Godlua Backdoor. 360 Netlab Blog ( 2019 ). Alex Turing and Genshen Ye. 2019. An Analysis of Godlua Backdoor. 360 Netlab Blog (2019)."},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3407023.3409192"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2021.108322"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2013.10"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3183390"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2022.108919"}],"event":{"name":"MSWiM '22: Int'l ACM Conference on Modeling Analysis and Simulation of Wireless and Mobile Systems","sponsor":["SIGSIM ACM Special Interest Group on Simulation and Modeling"],"location":"Montreal Quebec Canada","acronym":"MSWiM '22"},"container-title":["Proceedings of the 19th ACM International Symposium on Performance Evaluation of Wireless Ad Hoc, Sensor, & Ubiquitous Networks on 19th ACM International Symposium on Performance Evaluation of Wireless Ad Hoc, Sensor, & Ubiquitous Networks"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3551663.3558605","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,10,24]],"date-time":"2022-10-24T13:32:39Z","timestamp":1666618359000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3551663.3558605"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,10,24]]},"references-count":29,"alternative-id":["10.1145\/3551663.3558605","10.1145\/3551663"],"URL":"https:\/\/doi.org\/10.1145\/3551663.3558605","relation":{},"subject":[],"published":{"date-parts":[[2022,10,24]]}}}