%0 Journal Article
%A E Xin-hua
%A HUANG Tao
%A JI Xing
%A SUN Li
%T A DNS Query Anomaly Detection Algorithm Based on Log Information
%D 2018
%R 10.13190/j.jbupt.2018-007
%J Journal of Beijing University of Posts and Telecommunications
%P 83-89
%V 41
%N 6
%X Point at the anomaly queries existing in domain name system (DNS), an anomaly detection algorithm based on DNS query logs is proposed to detect suspicious and abnormal internet protocol addresses (IP). First, multiple dimensions of information in the DNS logs are extracted to characterize the source IPs after analyzing the difference between normal DNS query behaviors and the abnormal ones. Secondly, the datasets are mapped to a three-dimensional space through dimensionality reduction, which is beneficial for intuitive visualization and rapid data analysis. Finally, clustering the source IPs and calculating the credibility of them to identify the abnormal ones. The experiment results show that this algorithm can not only observe the correlation characteristics of multi-dimensional datasets directly, but also identify the abnormal source IPs in the global and local aspects.
%U https://journal.bupt.edu.cn/EN/10.13190/j.jbupt.2018-007