Anomaly detection in DNS: an empirical study

HOU Ronghao; HE Ming; KONG Kaichuan; CHEN Yong; ZUO Peng

doi:10.11959/j.issn.2096-109x.2025067

您当前的位置：

首页 >

文章列表页 >

Anomaly detection in DNS: an empirical study

Papers | 更新时间：2026-01-28

- Anomaly detection in DNS: an empirical study
- Chinese Journal of Network and Information Security Vol. 11, Issue 6, Pages: 92-104(2025)
- 作者机构：
  
  1.暨南大学网络空间安全学院，广东广州 510000
  2.中国互联网络信息中心，北京 100190
- 作者简介：
- 基金信息：
  
  MIIT Project Industrial Internetidentifcation Resolution System Security Monitoring and Protection(TC220H078);The Natural Science Foundation of Guangdong Province(2021A1515011314)
- DOI：10.11959/j.issn.2096-109x.2025067
  CLC： TP393
- Received：21 March 2025，
  
  Revised：2025-06-23，
  
  Published：25 December 2025
- 稿件说明：
移动端阅览
侯榕浩, 贺明, 孔凯传, 等. ,DNS异常检测：大规模实验分析[J]. 网络与信息安全学报, 2025, 11(6): 92-104.

HOU Ronghao, HE Ming, KONG Kaichuan, et al. Anomaly detection in DNS: an empirical study[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 92-104.
侯榕浩, 贺明, 孔凯传, 等. ,DNS异常检测：大规模实验分析[J]. 网络与信息安全学报, 2025, 11(6): 92-104. DOI： 10.11959/j.issn.2096-109x.2025067.

HOU Ronghao, HE Ming, KONG Kaichuan, et al. Anomaly detection in DNS: an empirical study[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 92-104. DOI： 10.11959/j.issn.2096-109x.2025067.

摘要

域名系统（domain name system

DNS）是互联网实现互联互通的关键基础设施。域名系统的安全，直接关系到互联网是否能够正常提供服务，与人们的工作生活息息相关。围绕DNS，设计了3种常见的DNS服务器攻击场景，并在这些场景下收集构建DNS主被动数据集供异常检测和预测。通过大量实验对比验证了15种机器学习算法，包括机器学习算法、深度学习算法（特别是面向DNS不间断服务特性的时间序列检测算法）对于不同攻击场景异常检测的适用性，并给出最优的算法模型，为DNS安全态势感知和防护提供多样化模型选择。

Abstract

Domain name system (DNS) is a critical infrastructure that enables connectivity on the internet. The security of the DNS is vital for the ability of Internet to provide services and is closely tied to people's daily work and lives. three DNS server attack scenarios are designed and data is collected to build both active and passive DNS datasets for attack detection

anomaly detection and prediction in these scenarios. Through experimental comparisons

the applicability of up to 15 machine learning algorithms

including both machine learning and deep learning algorithms (especially time-series detection algorithms tailored for the continuous service characteristics of DNS)

is validated across various attack and anomaly scenarios. The best algorithm models are presented

providing a diverse set of model choices for DNS system security situational awareness and defense.

关键词

Keywords

references

ALIEYAN K , KADHUM M M , ANBAR M , et al . An overview of DDoS attacks based on DNS [C ] // Proceedings of the 2016 International Conference on Information and Communication Technology Convergence (ICTC) . Piscataway : IEEE Press , 2016 : 276 - 280 .

BUSHART J , ROSSOW C . DNS unchained: amplified application-layer DoS attacks against DNS authoritatives [C ] // Proceedings of Rearch in Attacks, Intrusions, and Defenses (RAID 2018) . Cham : Springer , 2018 : 139 - 160 .

ALHARBI F , CHANG J , ZHOU Y C , et al . Collaborative client-side DNS cache poisoning attack [C ] // Proceedings of the IEEE Infocom 2019-IEEE Conference on Computer Communications . Piscataway : IEEE Press , 2019 : 1153 - 1161

MAN K Y , QIAN Z Y , WANG Z J , et al . DNS cache poisoning attack reloaded: revolutions with side channels [C ] // Proceedings of the 2020 ACM Sigsac Conference on Computer and Communications Security . New York : ACM , 2020 : 1337 - 1350 .

胡杨 . 基于无证书签名的抗DNS中间人攻击方案研究 [D ] . 福州 : 福建师范大学 , 2022 .

HU Y . Research on DNS man-in-the-middle attack resistance scheme based on certificateless signature [D ] . Fuzhou : Fujian Normal University ， 2022 .

ANAGNOSTOPOULOS M , KAMBOURAKIS G , KOPANOS P , et al . DNS amplification attack revisited [J ] . Computers & Security , 2013 , 39 : 475 - 485 .

DNS amplification attacks observer [EB ] . 2025 .

胡蓓蓓 . 异常DNS行为检测 [D ] . 武汉 : 武汉邮电科学研究院 , 2012 .

HU B B . Detection of abnormal DNS behavior [D ] . Wuhan ： Wuhan Research Institute of Posts and Telecommunications , 2012 .

FICHERA S , GALLUCCIO L , GRANCAGNOLO S C , et al . OPERETTA: an OPEnflow-based REmedy to mitigate TCP synflood attacks against web servers [J ] . Computer Networks , 2015 , 92 : 89 - 100 .

LIU D P , ZHAO Y J , XU H W , et al . Opprentice: towards practical and automatic anomaly detection through machine learning [C ] // Proceedings of the 2015 Internet Measurement Conference . New York : ACM , 2015 : 211 - 224 .

HASAN M , ISLAM M M , ZARIF M I I , et al . Attack and anomaly detection in IoT sensors in IoT sites using machine learning approaches [J ] . Internet of Things , 2019 , 7 : 100059 .

KIM T , SUH S C , KIM H , et al . An encoding technique for CNN-based network anomaly detection [C ] // Proceedings of the 2018 IEEE International Conference on Big Data . Piscataway : IEEE Press , 2018 : 2960 - 2965 .

MUNIR M , SIDDIQUI S A , DENGEL A , et al . DeepAnT: a deep learning approach for unsupervised anomaly detection in time series [J ] . IEEE Access , 2018 , 7 : 1991 - 2005 .

江友华 , 叶梦豆 , 赵乐 , 等 . 基于seq2seq和SVM双层融合的非侵入式用户异常行为检测 [J ] . 计算机应用与软件 , 2024 , 41 ( 9 ): 97 - 105 .

JIANG Y H , YE M D , ZHAO L , et al . Non-intrusive abnormal user behavior detection based on double-layer fusion of seq2seq and SVM [J ] . Computer Applications and Software , 2024 , 41 ( 9 ): 97 - 105 .

GEIGER A , LIU D Y , ALNEGHEIMISH S , et al . TadGAN: time series anomaly detection using generative adversarial networks [C ] // Proceedings of the 2020 IEEE International Conference on Big Data . Piscataway : IEEE Press , 2020 : 33 - 43 .

LI C , CHEN J , ZHANG Z X , et al . DNS root server resolution anomaly detection [J ] . Computers & Security , 2024 , 144 : 103946 .

HU A L , GONG L Y , XIE J L , et al . A large-scale study of abnormal recursive DNS [C ] // Proceedings of Network and Parallel Computing . Singapore : Springer , 2025 : 351 - 362 .

向思羽 , 刘才铭 . 结合混合特征选择和Transformer的网络数据流异常检测 [J ] . 电子科技大学学报 , 2025 , 54 ( 3 ): 442 - 454 .

XIANG S Y , LIU C M . Network data anomaly detection combined with hybrid feature selection and Transformer [J ] . Journal of University of Electronic Science and Technology of China , 2025 , 54 ( 3 ): 442 - 454 .

LIU C , ALBITZ P . DNS and Bind [M ] . O'Reilly Media Inc , 2006 .

AITCHISON R . DNS diagnostics and tools [M ] . Berkeley, CA : Apress , 2011 .

DNS-iptables-rules [EB ] . 2025 .

YING S , WANG B M , WANG L , et al . An improved KNN-based efficient log anomaly detection method with automatically labeled samples [J ] . ACM Transactions on Knowledge Discovery from Data , 2021 , 15 ( 3 ): 1 - 22 .

HOSSEINZADEH M , RAHMANI A M , VO B , et al . Improving security using SVM-based anomaly detection: issues and challenges [J ] . Soft Computing , 2021 , 25 ( 4 ): 3195 - 3223 .

SALEM O , GUERASSIMOV A , MEHAOUA A , et al . Anomaly detection in medical wireless sensor networks using SVM and linear regression models [J ] . International Journal of E-Health and Medical Communications , 2014 , 5 ( 1 ): 20 - 45 .

MUNIYANDI A P , RAJESWARI R , RAJARAM R . Network anomaly detection by cascading K-means clustering and C4.5 decision tree algorithm [J ] . Procedia Engineering , 2012 , 30 : 174 - 182 .

PRIMARTHA R , TAMA B A . Anomaly detection using random forest: a performance revisited [C ] // Proceedings of the 2017 International Conference on Data and Software Engineering (ICoDSE) . Piscataway : IEEE Press , 2017 : 1 - 6 .

QU Z J , LIU H X , WANG Z X , et al . A combined genetic optimization with AdaBoost ensemble model for anomaly detection in buildings electricity consumption [J ] . Energy and Buildings , 2021 , 248 : 111193 .

BENGIO Y . Learning deep architectures for AI [EB ] . 2009 .

LECUN Y , BOTTOU L , BENGIO Y , et al . Gradient-based learning applied to document recognition [J ] . Proceedings of the IEEE , 1998 , 86 ( 11 ): 2278 - 2324 .

ELMAN J L . Finding structure in time [J ] . Cognitive Science , 1990 , 14 ( 2 ): 179 - 211 .

DEY R , SALEM F M . Gate-variants of gated recurrent unit (GRU) neural networks [C ] // Proceedings of the 2017 IEEE 60th International Midwest Symposium on Circuits and Systems (MWSCAS) . Piscataway : IEEE Press , 2017 : 1597 - 1600 .

GRAVES A . Long short-term memory [M ] . Supervised Sequence Labelling with Recurrent Neural Networks . Berlin : Springer , 2012 .

HEWAGE P , BEHERA A , TROVATI M , et al . Temporal convolutional neural (TCN) network for an effective weather forecasting using time-series data from the local weather station [J ] . Soft Computing , 2020 , 24 ( 21 ): 16453 - 16482 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Review of malware detection and classification visualization techniques

Research progress and trend of text summarization

Phishing website detection based on two-way feature extraction and adaptive fusion

Research progress on detection of software vulnerabilities based on code similarity

method for machine learning backdoor attacks based on defense method based on diffusion models

Related Author

Jinwei WANG

Zhengjia CHEN

Xue XIE

Xiangyang LUO

Bin MA

Tuosiyu MING

Hongchang CHEN

Guo Kai

Related Institution

Engineering Research Center of Digital Forensics, Ministry of Education, Nanjing University of Information Science and Technology

Department of Computer, Nanjing University of Information Science and Technology

State Key Laboratory of Mathematical Engineering and Advanced Computing

University of Science and Technology of China

China Aerospace Academy of Systems Science and Engineering

⁰