SYSTEM AND METHOD FOR DETECTING ANOMALIES WITHIN A DOMAIN NAME SYSTEM (DNS) TRAFFIC

원문 (중국어)

A method and system for detecting anomalies within a domain name system (DNS) traffic is disclosed. Through the utilization of at least one processor, the method comprises receiving DNS traffic data from each of one or more DNS servers in real time, comparing the DNS traffic data with a data stored in a database. Furthermore, the method comprises determining a status of each of one or more DNS servers based on comparison. Further, the method comprises generating an alert for one or more users, based at least on the status. Furthermore, the method comprises determining whether each of one or more DNS servers outside a predefined learning period is queried by one or more DNS hosts. Thereafter, the method comprises adding each of one or more DNS servers to a baseline database upon determining that each of one or more DNS servers outside the predefined learning period is queried.