A Study of DNS Log Analysis for Anomaly Query Detection

• Main Authors: CHUN-HUNG CHOU, 周俊宏
• Other Authors: Tsang-Long pao
• Format: Others
• Language: zh-TW
• Published: 2019
• Online Access: http://ndltd.ncl.edu.tw/handle/shhmm2

碩士 === 大同大學 === 資訊工程學系(所) === 107 === The Domain Name System (DNS) is one of the most important services in the Internet. With the advancement of information technology, the Internet is an indispensable part of our daily life. Any application that uses the Internet, the DNS service is needed. There are a lot of attacks in the Internet, and the DNS has gradually become the target of hacking attacks. Whenever a user enters the website domain name into the address part, the system will query the IP address corresponding to the domain name through DNS. The DNS server will store all the query records and log data to the log file. By integrating the source IP address, domain name and other information for an predefined interval, a dashboard is designed to show possible abnormal query records. The managers can then judge the seriousness and take appropriate countermeasures.