{"id":15,"date":"2019-07-19T11:04:48","date_gmt":"2019-07-19T11:04:48","guid":{"rendered":"https:\/\/websites.fraunhofer.de\/Sappan\/?page_id=15"},"modified":"2026-01-30T13:10:14","modified_gmt":"2026-01-30T13:10:14","slug":"paper","status":"publish","type":"page","link":"https:\/\/sappan-project.eu\/?page_id=15","title":{"rendered":"Publications"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"15\" class=\"elementor elementor-15\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-066d9c2 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"066d9c2\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-9d08c19\" data-id=\"9d08c19\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7505e7d elementor-invisible elementor-widget elementor-widget-shortcode\" data-id=\"7505e7d\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;_animation&quot;:&quot;fadeIn&quot;}\" data-widget_type=\"shortcode.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div class=\"elementor-shortcode\"><!DOCTYPE html>\n<html>\n<head>\n<style>\n\n<!-- https:\/\/www.w3schools.com\/html\/tryit.asp?filename=tryhtml_table -->\n\n\ntable {\n  table-layout: auto;\n  width: 100%;  \n} \n\nth,td {\n  border: 1px solid black;\n}\n\n<\/style>\n<\/head>\n\n<body>\n<h2><\/h2>\n<table style=\"width:100%\">\n  <tr>\n    <th>Name<\/th>\n    <th>Authors<\/th> \n    <th>Published In<\/th>\n    <th> Download <\/th>\n  <\/tr>\n\n\n  \n  <tr>\n    <td>Analyzing the Real-World Applicability of DGA Classifiers<\/td>\n    <td>Arthur Drichel, Ulrike Meyer (RWTH) <br\/> Samuel Sch\u00fcppen, Dominik Teubert (Siemens CERT) <\/td>\n    <td>ARES 2020<\/td>\n    <td>   <a href=\"https:\/\/sappan-project.eu\/wp-content\/uploads\/2020\/08\/Analyzing_the_Real-World_Applicability_of_DGA_Classifiers.pdf\">PDF<\/a> <\/td> \n<\/tr>\n \n  <tr>\n    <td>Privacy Illusion: Beware of Unpadded DoH<\/td>\n    <td>Karel Hynek (CESNET), Tomas Cejka (CESNET) <\/td>\n    <td>IEMCON2020<\/td>\n    <td> <a href=\"https:\/\/sappan-project.eu\/wp-content\/uploads\/2020\/11\/privacy-illusion-20201.pdf\">PDF<\/a>   <\/td> \n <\/tr>\n \n<tr>\n    <td>Interpretable Visualizations of Deep Neural Networks for Domain Generation Algorithm Detection <\/td>\n    <td> Franziska Becker, Arthur Drichel, Christoph M\u00fcller, Thomas Ertl (USTUTT)<\/td>\n    <td>VizSec 2020 <\/td>\n    <td> <a href=\"https:\/\/sappan-project.eu\/wp-content\/uploads\/2020\/11\/fbecker-interpretable-vizsec-20201.pdf\">PDF<\/a>   <\/td> \n <\/tr>  \n\n<tr>\n    <td>DoH Insight: Detecting DNS over HTTPS by Machine Learning <\/td>\n    <td> Dmitrii Vekshin (FIT CTU), Karel Hynek (CESNET), Tomas Cejka (CESNET)<\/td>\n    <td>CyberTIM 2020 <\/td>\n    <td>  <a href=\"https:\/\/sappan-project.eu\/wp-content\/uploads\/2020\/09\/DOH-2.pdf\">PDF<\/a>  <\/td> \n <\/tr>  \n\n\n  <tr>\n    <td>Making Use of NXt to Nothing: The Effect of Class Imbalances on DGA Detection Classifiers\n<\/td>\n    <td>Arthur Drichel, Ulrike Meye (RWTH) <br \/> Samuel Sch\u00fcppen, Dominik Teubert (Siemens CERT) <\/td>\n    <td>CyberTIM 2020<\/td>\n    <td>  <a href=\"https:\/\/sappan-project.eu\/wp-content\/uploads\/2020\/08\/Making_Use_of_NXt_to_Nothing_The_Effect_of_Class_Imbalances_on_DGA_Detection_Classifiers.pdf\">PDF<\/a> <\/td>\n<\/td>\n<\/tr>    \n\n<td> Host Behavior in Computer Network: One-Year Study <\/td>\n    <td> Tomas Jirsik (MU), <br \/>  Petr Velan (MU)<\/td>\n    <td>IEEE Transactions on Network and Service Management 2021<\/td>\n    <td>  <a href=\"https:\/\/sappan-project.eu\/wp-content\/uploads\/2021\/04\/Host-Behavior-in-Computer-Network-One-Year-Study.pdf\">PDF<\/a> \n <\/td> \n<\/tr>\n\n<tr>\n    <td>Predictive methods in cyber defense: Current experience and research challenges\n<\/td>\n    <td>Martin Hus\u00e1k (MU),  V\u00e1clav Barto\u0161 (CESNET)<br \/> Pavol Sokol and Andrej Gajdo\u0161 (Pavol Jozef \u0160af\u00e1rik University)\n\n <\/td>\n    <td>Future Generation Computer Systems <\/td>\n    <td>  <a href=\"https:\/\/www.researchgate.net\/profile\/Martin-Husak\/publication\/344649158_Predictive_methods_in_cyber_defense_Current_experience_and_research_challenges\/links\/5f86d2fa92851c14bcc6b6c2\/Predictive-methods-in-cyber-defense-Current-experience-and-research-challenges.pdf?origin=publication_detail\">Link<\/a> <\/td>\n<\/tr>\n\n\n<tr>\n    <td>GRANEF: Utilization of a Graph Database for Network Forensics\n<\/td>\n    <td>Milan Cermak (MU),  <br \/> Denisa Sramkova  (MU) <\/td>\n    <td>SECRYPT 2021<\/td>\n    <td>  <a href=\"https:\/\/sappan-project.eu\/wp-content\/uploads\/2021\/08\/2021-SECRYPT-granef-utilization-of-a-graph-database-for-network-forensics-paper.pdf\">PDF<\/a> <\/td>\n<\/tr>\n\n<tr>\n    <td>Towards Privacy-Preserving Sharing of Cyber Threat Intelligence for Effective Response and Recovery\n<\/td>\n    <td>Lasse Nitz, Mehdi Akbari Gurabi, Avikarsha Mandal and Benjamin Heitmann (FIT)\n    <td> ERCIM NEWS 126<\/td>\n    <td>  <a href=\"https:\/\/ercim-news.ercim.eu\/images\/stories\/EN126\/EN126-web.pdf#page=33\">PDF<\/a> <\/td>\n<\/tr>   \n\n\n\n<tr>\n    <td>Finding Phish in a  Haystack: A Pipeline for Phishing Classification on Certificate Transparency Logs\n<\/td>\n    <td>Arthur Drichel (RWTH), Vincent Drury (RWTH), Justus von Brandt (RWTH), Ulrike Meyer (RWTH)\n    <td> IWCC 2021<\/td>\n    <td>  <a href=\"https:\/\/sappan-project.eu\/wp-content\/uploads\/2021\/11\/2021-drichel-Finding_Phish_in_a_Haystack-_A_Pipeline_for_Phishing_Classification_on_Certificate_Transparency_Logs.pdf\">PDF<\/a> <\/td>\n<\/tr>   \n\n\n<tr>\n    <td>First Step Towards EXPLAINable DGA Multiclass Classification\n<\/td>\n    <td>Arthur Drichel (RWTH), Nils Faerber (RWTH), Ulrike Meyer (RWTH)\n    <td> ARES 2021<\/td>\n    <td>  <a href=\"https:\/\/sappan-project.eu\/wp-content\/uploads\/2021\/11\/2021-drichel-First_Step_Towards_EXPLAINable_DGA_Multiclass_Classification.pdf\">PDF<\/a> <\/td>\n<\/tr>\n\n<tr>\n    <td>Sharing FANCI Features: A Privacy Analysis of Feature Extraction for DGA Detection\n<\/td>\n    <td>Benedikt Holmes (RWTH), Arthur Drichel (RWTH), Ulrike Meyer (RWTH)\n    <td> CYBER 2021<\/td>\n    <td>  <a href=\"https:\/\/sappan-project.eu\/wp-content\/uploads\/2021\/11\/2021-holmes-Sharing_FANCI_Features.pdf\">PDF<\/a> <\/td>\n<\/tr>  \n\n<tr>\n    <td>The More, the Better? A Study on Collaborative Machine Learning for DGA Detection\n<\/td>\n    <td>Arthur Drichel (RWTH), Benedikt Holmes (RWTH), Justus von Brandt (RWTH), Ulrike Meyer (RWTH)\n    <td> CYSARM 2021<\/td>\n    <td>  <a href=\"https:\/\/sappan-project.eu\/wp-content\/uploads\/2021\/11\/2021-drichel-The_More_the_Better.pdf\">PDF<\/a> <\/td>\n<\/tr>  \n\n<tr>\n    <td>Towards Privacy-Preserving Classification-as-a-Service for DGA Detection\n<\/td>\n    <td>Arthur Drichel (RWTH), Mehdi Akbari Gurabi (FIT), Tim Amelung (RWTH), Ulrike Meyer (RWTH)\n    <td>PST 2021<\/td>\n    <td>  <a href=\"https:\/\/sappan-project.eu\/wp-content\/uploads\/2021\/11\/2021-drichel-Towards_Privacy-Preserving_Classification-as-a-Service_for_DGA_Detection.pdf\">PDF<\/a> <\/td>\n<\/tr>\n\n\n<tr>\n    <td>VITALflow: Visual Interactive Traffic Analysis with NetFlow\n<\/td>\n    <td>Tina Tremel, Jochen K\u00f6gel, Florian Jauernig, Sebastian Meier (IsarNet), Dennis Thom, Franziska Becker, Christoph M\u00fcller, Steffen Koch (USTUTT)\n    <td>NOMS 2022 Workshops - AnNet 2022 <\/td>\n    <td>  <a href=\"https:\/\/sappan-project.eu\/wp-content\/uploads\/2022\/04\/VITALflow_2022.pdf\">PDF<\/a> <\/td>\n<\/tr>\n\n<tr>\n    <td>From Collaboration to Automation: A Proof of Concept for Improved Incident Response\n<\/td>\n    <td>Lasse Nitz (Fraunhofer FIT), Martin Zadnik (CESNET), Mehdi Akbari Gurabi (Fraunhofer FIT), Mischa Obrecht (Dreamlab Technologies AG), Avikarsha Mandal (Fraunhofer FIT)\n    <td>ERCIM News 129 <\/td>\n    <td>  <a href=\"https:\/\/ercim-news.ercim.eu\/en129\/special\/from-collaboration-to-automation-a-proof-of-concept-for-improved-incident-response\">Link<\/a> <\/td>\n<\/tr>\n\n<tr>\n    <td>On the Integration of Course of Action Playbooks into Shareable Cyber Threat Intelligence\n<\/td>\n    <td>Vasileios Mavroeidis (University of Oslo), Pavel Eis (CESNET), Martin Zadnik (CESNET), Marco Caselli (Siemens), Bret Jordan (Broadcom)\n    <td>IEEE International Conference on Big Data (Big Data)<\/td>\n    <td>  <a href=\"https:\/\/ieeexplore.ieee.org\/document\/9671893\">Link<\/a> <\/td>\n<\/tr>\n\n<tr>\n    <td>Towards Evaluating Quality of Datasets for Network Traffic Domain\n<\/td>\n    <td>Dominik Soukup (CTU), Peter Tisov\u010d\u00edk (Brno University of Technology), Karel Hynek and Tom\u00e1\u0161 \u010cejka (CESNET)\n    <td>7th International Conference on Network and Service Management (CNSM)<\/td>\n    <td>  <a href=\"https:\/\/ieeexplore.ieee.org\/document\/9615601\">Link<\/a> <\/td>\n<\/tr>\n\n<tr>\n    <td>Towards Inference of DDoS Mitigation Rules\n<\/td>\n    <td>Martin \u017d\u00e1dn\u00edk (CESNET)\n    <td>IEEE\/IFIP Network Operations and Management Symposium<\/td>\n    <td>  <a href=\" \"> <\/a> <\/td>\n<\/tr>\n\n<tr>\n    <td>Predictivemethodsincyberdefense:Currentexperienceandresearchchallenges\n<\/td>\n    <td> Martin Hus\u00e1k (MU), V\u00e1clav Barto\u0161 (CESNET), Pavol Sokol, Andrej Gajdo\u0161 (Pavol Jozef \u0160af\u00e1rik University) <\/td>\n    <td>Future Generation Computer Systems Vol. 115<\/td>\n    <td>  <a href=\" https:\/\/www.researchgate.net\/profile\/Martin-Husak\/publication\/344649158_Predictive_methods_in_cyber_defense_Current_experience_and_research_challenges\/links\/5f86d2fa92851c14bcc6b6c2\/Predictive-methods-in-cyber-defense-Current-experience-and-research-challenges.pdf\">Link<\/a> <\/td>\n<\/tr>\n\n<tr>\n    <td>Interactive process tree analysis Poster\n<\/td>\n    <td>Robert Rapp, Christoph M\u00fcller, Franziska Becker (USTUTT), Paolo Palumbo (F-Secure), Thomas Ertl (USTUTT)\n    <td>VizSec 2021 \n    <td>  <a href=\"https:\/\/ieeevis.b-cdn.net\/vis_2021\/posters\/a-vizsec-posters-1016-summary.pdf\">PDF<\/a> <\/td>\n<\/tr>\n\n<tr>\n    <td> SoK: Applications and Challenges of using Recommender Systems in Cybersecurity Incident Handling and Response\n<\/td>\n    <td>Martin Hus\u00e1k, Milan \u010cerm\u00e1k (MU)\n    <td> ARES 2022\n    <td>  <a href=\"\"><\/a> <\/td>\n<\/tr>\n\n\n<tr>\n    <td> SASP: a Semantic web-based Approach for management of Sharable cybersecurity Playbooks\n<\/td>\n    <td> Mehdi Akbari Gurabi (RWTH, FIT), Avikarsha Mandal , Jan Popanda (FIT), Robert Rapp (USTUTT), Stefan Decker (RWTH, FIT)\n\n    <td> ARES 2022\n    <td>  <a href=\"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3538969.3544478\">Link<\/a> <\/td>\n<\/tr>\n\n<tr>\n    <td> Detecting Unknown DGAs without Context Information<\/td>\n    <td> Arthur Drichel, Justus von Brandt, Ulrike Meyer (RWTH)\n\n    <td> ARES 2022\n    <td>  <a href=\"\"><\/a> <\/td>\n<\/tr>\n\n\n\n<tr>\n    <td> Dating Phish: An Analysis of the Life Cycles of Phishing Attacks and Campaigns\n<\/td>\n    <td> Vincent Drury, Luisa Lux, Ulrike Meyer (RWTH)\n\n    <td> ARES 2022\n    <td>  <a href=\"\"><\/a> <\/td>\n<\/tr>\n\n<tr>\n    <td> DGA Detection Using Similarity-Preserving Bloom Encodings\n<\/td>\n    <td> Lasse Nitz (FIT, RWTH), Avikarsha Mandal (FIT)\n\n    <td> EICC 2023\n    <td>  <a href=\"https:\/\/sappan-project.eu\/wp-content\/uploads\/2023\/05\/DGA_Detection_Using_Similarity-Preserving_Bloom_Encodings.pdf\">PDF<\/a> <\/td>\n<\/tr>\n\n<tr>\n    <td> On Collaboration and Automation in the Context of Threat Detection and Response with Privacy-Preserving Features\n<\/td>\n    <td> Lasse Nitz, Mehdi Akbari Gurabi (FIT, RWTH), Milan Cermak (MU), Martin Zadnik (CESNET), David Karpuk (WithSecure), Arthur Drichel, Sebastian Sch\u00e4fer, Benedikt Holmes (RWTH), Avikarsha Mandal (FIT)\n\n    <td> Digital Threats: Research and Practice\n    <td>  <a href=\"https:\/\/dl.acm.org\/doi\/full\/10.1145\/3707651\">Link<\/a> <\/td>\n<\/tr>\n\n\n\n\n\n\n<\/table>\n<\/body>\n<\/html>\n<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Name Authors Published In Download Analyzing the Real-World Applicability of DGA Classifiers Arthur Drichel, Ulrike Meyer (RWTH) Samuel Sch\u00fcppen, Dominik Teubert (Siemens CERT) ARES 2020 PDF Privacy Illusion: Beware of Unpadded DoH Karel Hynek (CESNET), Tomas Cejka (CESNET) IEMCON2020 PDF Interpretable Visualizations of Deep Neural Networks for Domain Generation Algorithm Detection Franziska Becker, Arthur Drichel,&hellip;<\/p>\n","protected":false},"author":6,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"inline_featured_image":false,"footnotes":""},"coauthors":[9],"class_list":["post-15","page","type-page","status-publish","hentry","post"],"_links":{"self":[{"href":"https:\/\/sappan-project.eu\/index.php?rest_route=\/wp\/v2\/pages\/15","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/sappan-project.eu\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/sappan-project.eu\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/sappan-project.eu\/index.php?rest_route=\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/sappan-project.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=15"}],"version-history":[{"count":94,"href":"https:\/\/sappan-project.eu\/index.php?rest_route=\/wp\/v2\/pages\/15\/revisions"}],"predecessor-version":[{"id":2272,"href":"https:\/\/sappan-project.eu\/index.php?rest_route=\/wp\/v2\/pages\/15\/revisions\/2272"}],"wp:attachment":[{"href":"https:\/\/sappan-project.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15"}],"wp:term":[{"taxonomy":"author","embeddable":true,"href":"https:\/\/sappan-project.eu\/index.php?rest_route=%2Fwp%2Fv2%2Fcoauthors&post=15"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}