基于相对密度的DNS请求数据流源IP异常检测算法

摘要

The study focused on the anomaly detection for domain name systems (DNS).Through the investigation of the outlier detection algorithm based on relative density,an algorithm for detection of source IP anomalies in DNS query data streams based on relative density was proposed.The algorithm calculates the relative density of each source IP,and uses the inverse of the density as an abnormal value.When calculating the relative density,it uses the nine dimensions of number of query,entropy of source port,proportion of queried illegal domain name and so on to represent a source IP.The experimental results show that the proposed source IP anomaly detection algorithm based on relative density can put forward the corresponding abnormal value accurately according to the abnormality of each source IP.%研究了域名系统(DNS)的异常检测.通过对基于相对密度的离群点检测算法的研究,提出了一种基于相对密度的DNS请求数据流源IP异常检测算法.该算法计算每个源IP的相对密度,并将该密度的倒数作为其异常值评分;在计算相对密度时,从查询次数、源端口熵值、所请求非法域名占比等9个维度来表示一个源IP.试验结果表明,这种基于相对密度的源IP异常检测方法,能正确地根据各个源IP不同的异常程度,给出其相应的异常值评分.