The DOI matches its Crossref record; 25 of the 25 references it cites were found in a registry or an index.
Exposure: A Passive DNS Analysis Service to Detect and Report Malicious Domains
Abstract
A wide range of malicious activities rely on the domain name service (DNS) to manage their large, distributed networks of infected machines. As a consequence, the monitoring and analysis of DNS queries has recently been proposed as one of the most promising techniques to detect and blacklist domains involved in malicious activities (e.g., phishing, spam, botnets command-and-control, etc.). EXPOSURE is a system we designed to detect such domains in real time, by applying 15 unique features grouped in four categories. We conducted a controlled experiment with a large, real-world dataset consisting of billions of DNS requests. The extremely positive results obtained in the tests convinced us to implement our techniques and deploy it as a free, online service. In this article, we present the Exposure system and describe the results and lessons learned from 17 months of its operation. Over this amount of time, the service detected over 100K malicious domains. The statistics about the time of usage, number of queries, and target IP addresses of each domain are also published on a daily basis on the service Web page.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Data Mining: Practical Machine Learning Tools and Techniques
(2011) · Elsevier eBooks · doi:10.1016/c2009-0-19715-5 · Cited by 25,437
Witten, I. H. (2008) · Cited by 9,143
The use of the area under the ROC curve in the evaluation of machine learning algorithms
Bradley, A. P. (1997) · Pattern Recognition · doi:10.1016/s0031-3203(96)00142-2 · Cited by 7,217
Detection of Abrupt Changes: Theory and Application
Riedel, K. S. (1994) · Technometrics · doi:10.1080/00401706.1994.10485821 · Cited by 3,518
A Survey of Clustering Data Mining Techniques
Berkhin, P. (2006) · Grouping Multidimensional Data · doi:10.1007/3-540-28349-8_2 · Cited by 2,804
Proceedings of the 11th USENIX Security Symposium
Boneh, D. (2002) · Cited by 2,528
Locally adaptive dimensionality reduction for indexing large time series databases
Keogh, E., Chakrabarti, K., Pazzani, M., & Mehrotra, S. (2001) · Proceedings of the 2001 ACM SIGMOD international conference on Management of data · doi:10.1145/375663.375680 · Cited by 866
Beyond blacklists: learning to detect malicious web sites from suspicious URLs
Ma, J., Saul, L. K., Savage, S., & Voelker, G. M. (2009) · Proceedings of the 15th ACM SIGKDD international conference on Knowledge discovery and data mining · doi:10.1145/1557019.1557153 · Cited by 803
Your botnet is my botnet: analysis of a botnet takeover
Stone-Gross, B., Cova, M., Cavallaro, L., Gilbert, B., Szydlowski, M., Kemmerer, R., Kruegel, C., & Vigna, G. (2009) · Proceedings of the 16th ACM conference on Computer and communications security · doi:10.1145/1653662.1653738 · Cited by 577
Self-citationEXPOSURE : Finding malicious domains using passive DNS analysis
Bilge, L. (2011) · Cited by 509
Self-citation
Cited by
A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection
Buczak, A. L., & Guven, E. (2016) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2015.2494502 · Cited by 3,332
PhishStorm: Detecting Phishing With Streaming Analytics
Marchal, S., Francois, J., State, R., & Engel, T. (2014) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2014.2377295 · Cited by 271
Beehive: large-scale log analysis for detecting suspicious activity in enterprise networks
Yen, T.-F., Oprea, A., Onarlioglu, K., Leetham, T., Robertson, W., Juels, A., & Kirda, E. (2013) · Proceedings of the 29th Annual Computer Security Applications Conference · doi:10.1145/2523649.2523670 · Cited by 270
Self-citationDistributed Privacy-Preserving Collaborative Intrusion Detection Systems for VANETs
Zhang, T., & Zhu, Q. (2018) · IEEE Transactions on Signal and Information Processing over Networks · doi:10.1109/tsipn.2018.2801622 · Cited by 168
Metadata
- Authors
- Bilge, L., Sen, S., Balzarotti, D., Kirda, E., & Kruegel, C.
- Venue
- ACM Transactions on Information and System Security
- Published
- 2014-04
- Volume
- 16
- Issue
- 4
- Pages
- 1-28
- ISSN
- 1094-9224 (ISSN-L)
- 1557-7406
- OpenAlex
- W2082550445
- Cited by
- 317
- References
- 25
- FWCI
- 57.32
- Type
- journal article
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Exposure: A Passive DNS Analysis Service to Detect and Report Malicious Domains. https://app.cochat.ai/papers/10.1145/2584679
- The paper
- Bilge, L., Sen, S., Balzarotti, D., Kirda, E., & Kruegel, C. (2014). Exposure: A Passive DNS Analysis Service to Detect and Report Malicious Domains. ACM Transactions on Information and System Security. https://doi.org/10.1145/2584679
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
