DNS traffic anomaly detection based on W-Kmeans algorithm
Jun Yong Wu · Jisuanji gongcheng yu sheji · 2013
To detect DNS query effectively,and figure out DNS traffic anomaly in time,an algorithm of Kmeans based on weights(W-Kmeans) is proposed,which is suitable to detect DNS traffic anomaly.Some useful information is mined from the raw data of dot CN query log on May 19,2009.Several features are extracted from the raw data,and different weights are added to different features.The query log is detected by using W-Kmeans clustering algorithm.The effectiveness is analyzed by choosing different parameters at the same time.The experimental result of DNS query detection on the data of May 19 is presented to show that DNS traffic anomaly can be detected effectively with W-Kmeans algorithm.