NgViz: Detecting DNS Tunnels through N-Gram Visualization and Quantitative Analysis
Kenton Born, David H. Gustafson · arXiv (Cornell University) · 2010
This paper introduced NgViz, a tool that examines DNS traffic and shows anomalies in n-gram frequencies. This is accomplished by comparing input files against a fingerprint of legitimate traffic. Both quantitative analysis and visual aids are provided that allow the user to make determinations about the legitimacy of the DNS traffic.