Pattern Discovery in DNS Query Traffic

详细信息    查看全文

• 作者：Weizhang Ruan^a ; ^{ruanweizhang@gmail.com} ; Ying Liu^b ; ^c ; ^{yingliu@ucas.ac.cn} ; Renliang Zhao^b ; ^{zhaorenliang1@126.com}
• 关键词：Pattern discvery ; Data mining ; DNS ; Clustering ; Prediction ; Anomaly detection
• 刊名：Procedia Computer Science
• 出版年：2013
• 出版时间：2013
• 年：2013
• 卷：17
• 期：Complete
• 页码：80-87
• 全文大小：966 K

文摘

DNS provides a critical function in directing Internet traffic. Traditional rule-based anomaly or intrusion detection methods are not able to update the rules dynamically. Data mining based approaches can find various patterns in massive dynamic query traffic data. In this paper, a novel periodic trend mining method is proposed, as well as a periodic trend pattern based traffic prediction method. Clustering is adopted to partition numerous domain names into separate groups by the characteristics of their query traffic time series. Experimental results on a real-word DNS log indicate data mining based approaches are promising in the domain of DNS service.