Flow Level Data Mining of DNS Query Streams for Email Worm Detection

摘要: Email worms remain a major network security concern, as they increasingly attack systems with intensity using more advanced social engineering tricks. Their extremely high prevalence clearly indicates that current defence mechanisms are intrinsically incapable of mitigating email worms, and thereby reducing unwanted traffic traversing the Internet. In this paper we study effect have on flow-level characteristics DNS query streams user machine generates. We propose method based unsupervised learning time series analysis to early detect local name server, which is located topologically near infected machine. evaluate our against an worm stream dataset consists 68 instances show it exhibits remarkable accuracy in detecting various instances.