摘要
利用DNS查询数据中出现的查询类型作为随机条件计算熵值,根据熵值的突发性变化,检测DNS查询中是否出现异常。利用该算法对2009年5月19日发生大面积断网事件时的DNS查询原始数据进行分析,证明这种方法可以及时检测到DNS查询中的异常情况的发生,并具有较好的检测效果。
This paper propose a method of detecting DNS abnormalities by calculating the entropies of the DNS query types observed in consecutive windows of fixed-size. Applied to the DNS query data targeting .CN on May 19th 2009 when there was a major DNS accident happened, this method demonstrates ability of detecting the abnormal behavior towards DNS before the event was observed and reported.
出处
《计算机系统应用》
2010年第12期195-198,共4页
Computer Systems & Applications
基金
国家发改委2009CNGI项目(CNGI-09-03-04)
