The realization of DNS anomaly detection based on combination of two methods of similarity and entropy

摘要

The DNS server will often be attacked through various means, which will lead to our DNS server's low efficiency or even make the DNS server not to provide service of DNS analysis normally and correctly. DNS detection is just to detect whether these accusations happen or not in time. There are many methods for anomaly detection of DNS server, for example, the method based on similarity, the method based on entropy and so on. We will research the combination of the two methods and then realize it. This will improve the monitoring effeciency.