\contentsline {todo}{also check papers for motivations}{1}{section*.11} \contentsline {todo}{verify}{1}{section*.13} \contentsline {todo}{machine learning vs others}{2}{section*.16} \contentsline {todo}{add somewhere here}{4}{section*.19} \contentsline {todo}{see kopis section 2 end, DNS blacklisting etc}{4}{section*.21} \contentsline {todo}{statistic about usage}{6}{section*.29} \contentsline {todo}{TODO}{8}{section*.34} \contentsline {todo}{do something with this}{11}{section*.46} \contentsline {todo}{\url {http://www.tcpipguide.com/free/t_DNSNameNotationandMessageCompressionTechnique.htm}}{12}{section*.49} \contentsline {todo}{TODO}{13}{section*.50} \contentsline {todo}{all tables h!}{13}{section*.51} \contentsline {todo}{TODO structure of a domain, etc. top-level, second-level, third-level}{13}{section*.54} \contentsline {todo}{explain delegation (e.g. of TLDs) somewhere here}{13}{section*.57} \contentsline {todo}{not referenced atm}{13}{section*.59} \contentsline {todo}{literature exposure section 6.1}{15}{section*.62} \contentsline {todo}{list of what is running}{15}{section*.66} \contentsline {todo}{rename to survey?}{17}{section*.84} \contentsline {todo}{why this two or three?}{17}{section*.85} \contentsline {todo}{figure not referenced atm}{25}{section*.103} \contentsline {todo}{explain domain flux}{30}{section*.117} \contentsline {todo}{link comprehensive decision tree explanation}{33}{section*.120} \contentsline {todo}{detailed explanation of 10 fold cross validation}{33}{section*.122} \contentsline {todo}{make reduction more clear}{40}{section*.135} \contentsline {todo}{see section one for contributions}{43}{section*.139} \contentsline {todo}{==> Exposure much simpler, much less data available (ips of malicious servers, honeypots, dyndns,...) \par ==> difference notos exposure, see literature exposure section 5.5.2 \par ==> not possible to simply block everything, always false positives \par ==> read all 'limitations' sections again and compare here \par ==> no concepts of kopis because of caching, no data available}{44}{section*.141} \contentsline {todo}{include more graphs/pictures in general}{46}{section*.151}