DNS异常检测：大规模实验分析

侯榕浩; 贺明; 孔凯传; 陈勇; 左鹏

doi:10.11959/j.issn.2096-109x.2025067

您当前的位置：

首页 >

文章列表页 >

DNS异常检测：大规模实验分析

学术论文 | 更新时间：2026-01-28

- DNS异常检测：大规模实验分析
- Anomaly detection in DNS: an empirical study
- 网络与信息安全学报 2025年11卷第6期页码：92-104
- 作者机构：
  
  1.暨南大学网络空间安全学院，广东广州 510000
  2.中国互联网络信息中心，北京 100190
- 作者简介：
  
  [ "侯榕浩（2000- ），男，广东梅州人，暨南大学硕士生，主要研究方向为恶意软件检测、深度学习。" ]
  [ "贺明（1985− ），男，北京人，中国互联网络信息中心工程师，主要研究方向为域名安全技术。" ]
  [ "孔凯传（1992− ），男，广西柳州人，暨南大学博士生，主要研究方向为内部威胁检测、大型语言模型与异常检测。" ]
  [ "陈勇（1977− ），男，湖南涟源人，中国互联网络信息中心高级工程师，主要研究方向为DNS安全。" ]
  [ "左鹏（1985− ），男，安徽青阳人，中国互联网络信息中心高级工程师，主要研究方向为网络安全、互联网基础资源关键技术。" ]
- 基金信息：
  
  工业和信息化部工业互联网标识解析体系安全监测与防护项目(TC220H078);广东省自然科学基金(2021A1515011314)
- DOI：10.11959/j.issn.2096-109x.2025067
  中图分类号： TP393
- 收稿：2025-03-21，
  
  修回：2025-06-23，
  
  纸质出版：2025-12-25
- 稿件说明：
移动端阅览
侯榕浩, 贺明, 孔凯传, 等. ,DNS异常检测：大规模实验分析[J]. 网络与信息安全学报, 2025, 11(6): 92-104.

HOU Ronghao, HE Ming, KONG Kaichuan, et al. Anomaly detection in DNS: an empirical study[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 92-104.
侯榕浩, 贺明, 孔凯传, 等. ,DNS异常检测：大规模实验分析[J]. 网络与信息安全学报, 2025, 11(6): 92-104. DOI： 10.11959/j.issn.2096-109x.2025067.

HOU Ronghao, HE Ming, KONG Kaichuan, et al. Anomaly detection in DNS: an empirical study[J]. Chinese Journal of Network and Information Security, 2025, 11(6): 92-104. DOI： 10.11959/j.issn.2096-109x.2025067.

摘要

域名系统（domain name system

DNS）是互联网实现互联互通的关键基础设施。域名系统的安全，直接关系到互联网是否能够正常提供服务，与人们的工作生活息息相关。围绕DNS，设计了3种常见的DNS服务器攻击场景，并在这些场景下收集构建DNS主被动数据集供异常检测和预测。通过大量实验对比验证了15种机器学习算法，包括机器学习算法、深度学习算法（特别是面向DNS不间断服务特性的时间序列检测算法）对于不同攻击场景异常检测的适用性，并给出最优的算法模型，为DNS安全态势感知和防护提供多样化模型选择。

Abstract

Domain name system (DNS) is a critical infrastructure that enables connectivity on the internet. The security of the DNS is vital for the ability of Internet to provide services and is closely tied to people's daily work and lives. three DNS server attack scenarios are designed and data is collected to build both active and passive DNS datasets for attack detection

anomaly detection and prediction in these scenarios. Through experimental comparisons

the applicability of up to 15 machine learning algorithms

including both machine learning and deep learning algorithms (especially time-series detection algorithms tailored for the continuous service characteristics of DNS)

is validated across various attack and anomaly scenarios. The best algorithm models are presented

providing a diverse set of model choices for DNS system security situational awareness and defense.

关键词

Keywords

references

ALIEYAN K , KADHUM M M , ANBAR M , et al . An overview of DDoS attacks based on DNS [C ] // Proceedings of the 2016 International Conference on Information and Communication Technology Convergence (ICTC) . Piscataway : IEEE Press , 2016 : 276 - 280 .

BUSHART J , ROSSOW C . DNS unchained: amplified application-layer DoS attacks against DNS authoritatives [C ] // Proceedings of Rearch in Attacks, Intrusions, and Defenses (RAID 2018) . Cham : Springer , 2018 : 139 - 160 .

ALHARBI F , CHANG J , ZHOU Y C , et al . Collaborative client-side DNS cache poisoning attack [C ] // Proceedings of the IEEE Infocom 2019-IEEE Conference on Computer Communications . Piscataway : IEEE Press , 2019 : 1153 - 1161

MAN K Y , QIAN Z Y , WANG Z J , et al . DNS cache poisoning attack reloaded: revolutions with side channels [C ] // Proceedings of the 2020 ACM Sigsac Conference on Computer and Communications Security . New York : ACM , 2020 : 1337 - 1350 .

胡杨 . 基于无证书签名的抗DNS中间人攻击方案研究 [D ] . 福州 : 福建师范大学 , 2022 .

HU Y . Research on DNS man-in-the-middle attack resistance scheme based on certificateless signature [D ] . Fuzhou : Fujian Normal University ， 2022 .

ANAGNOSTOPOULOS M , KAMBOURAKIS G , KOPANOS P , et al . DNS amplification attack revisited [J ] . Computers & Security , 2013 , 39 : 475 - 485 .

DNS amplification attacks observer [EB ] . 2025 .

胡蓓蓓 . 异常DNS行为检测 [D ] . 武汉 : 武汉邮电科学研究院 , 2012 .

HU B B . Detection of abnormal DNS behavior [D ] . Wuhan ： Wuhan Research Institute of Posts and Telecommunications , 2012 .

FICHERA S , GALLUCCIO L , GRANCAGNOLO S C , et al . OPERETTA: an OPEnflow-based REmedy to mitigate TCP synflood attacks against web servers [J ] . Computer Networks , 2015 , 92 : 89 - 100 .

LIU D P , ZHAO Y J , XU H W , et al . Opprentice: towards practical and automatic anomaly detection through machine learning [C ] // Proceedings of the 2015 Internet Measurement Conference . New York : ACM , 2015 : 211 - 224 .

HASAN M , ISLAM M M , ZARIF M I I , et al . Attack and anomaly detection in IoT sensors in IoT sites using machine learning approaches [J ] . Internet of Things , 2019 , 7 : 100059 .

KIM T , SUH S C , KIM H , et al . An encoding technique for CNN-based network anomaly detection [C ] // Proceedings of the 2018 IEEE International Conference on Big Data . Piscataway : IEEE Press , 2018 : 2960 - 2965 .

MUNIR M , SIDDIQUI S A , DENGEL A , et al . DeepAnT: a deep learning approach for unsupervised anomaly detection in time series [J ] . IEEE Access , 2018 , 7 : 1991 - 2005 .

江友华 , 叶梦豆 , 赵乐 , 等 . 基于seq2seq和SVM双层融合的非侵入式用户异常行为检测 [J ] . 计算机应用与软件 , 2024 , 41 ( 9 ): 97 - 105 .

JIANG Y H , YE M D , ZHAO L , et al . Non-intrusive abnormal user behavior detection based on double-layer fusion of seq2seq and SVM [J ] . Computer Applications and Software , 2024 , 41 ( 9 ): 97 - 105 .

GEIGER A , LIU D Y , ALNEGHEIMISH S , et al . TadGAN: time series anomaly detection using generative adversarial networks [C ] // Proceedings of the 2020 IEEE International Conference on Big Data . Piscataway : IEEE Press , 2020 : 33 - 43 .

LI C , CHEN J , ZHANG Z X , et al . DNS root server resolution anomaly detection [J ] . Computers & Security , 2024 , 144 : 103946 .

HU A L , GONG L Y , XIE J L , et al . A large-scale study of abnormal recursive DNS [C ] // Proceedings of Network and Parallel Computing . Singapore : Springer , 2025 : 351 - 362 .

向思羽 , 刘才铭 . 结合混合特征选择和Transformer的网络数据流异常检测 [J ] . 电子科技大学学报 , 2025 , 54 ( 3 ): 442 - 454 .

XIANG S Y , LIU C M . Network data anomaly detection combined with hybrid feature selection and Transformer [J ] . Journal of University of Electronic Science and Technology of China , 2025 , 54 ( 3 ): 442 - 454 .

LIU C , ALBITZ P . DNS and Bind [M ] . O'Reilly Media Inc , 2006 .

AITCHISON R . DNS diagnostics and tools [M ] . Berkeley, CA : Apress , 2011 .

DNS-iptables-rules [EB ] . 2025 .

YING S , WANG B M , WANG L , et al . An improved KNN-based efficient log anomaly detection method with automatically labeled samples [J ] . ACM Transactions on Knowledge Discovery from Data , 2021 , 15 ( 3 ): 1 - 22 .

HOSSEINZADEH M , RAHMANI A M , VO B , et al . Improving security using SVM-based anomaly detection: issues and challenges [J ] . Soft Computing , 2021 , 25 ( 4 ): 3195 - 3223 .

SALEM O , GUERASSIMOV A , MEHAOUA A , et al . Anomaly detection in medical wireless sensor networks using SVM and linear regression models [J ] . International Journal of E-Health and Medical Communications , 2014 , 5 ( 1 ): 20 - 45 .

MUNIYANDI A P , RAJESWARI R , RAJARAM R . Network anomaly detection by cascading K-means clustering and C4.5 decision tree algorithm [J ] . Procedia Engineering , 2012 , 30 : 174 - 182 .

PRIMARTHA R , TAMA B A . Anomaly detection using random forest: a performance revisited [C ] // Proceedings of the 2017 International Conference on Data and Software Engineering (ICoDSE) . Piscataway : IEEE Press , 2017 : 1 - 6 .

QU Z J , LIU H X , WANG Z X , et al . A combined genetic optimization with AdaBoost ensemble model for anomaly detection in buildings electricity consumption [J ] . Energy and Buildings , 2021 , 248 : 111193 .

BENGIO Y . Learning deep architectures for AI [EB ] . 2009 .

LECUN Y , BOTTOU L , BENGIO Y , et al . Gradient-based learning applied to document recognition [J ] . Proceedings of the IEEE , 1998 , 86 ( 11 ): 2278 - 2324 .

ELMAN J L . Finding structure in time [J ] . Cognitive Science , 1990 , 14 ( 2 ): 179 - 211 .

DEY R , SALEM F M . Gate-variants of gated recurrent unit (GRU) neural networks [C ] // Proceedings of the 2017 IEEE 60th International Midwest Symposium on Circuits and Systems (MWSCAS) . Piscataway : IEEE Press , 2017 : 1597 - 1600 .

GRAVES A . Long short-term memory [M ] . Supervised Sequence Labelling with Recurrent Neural Networks . Berlin : Springer , 2012 .

HEWAGE P , BEHERA A , TROVATI M , et al . Temporal convolutional neural (TCN) network for an effective weather forecasting using time-series data from the local weather station [J ] . Soft Computing , 2020 , 24 ( 21 ): 16453 - 16482 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

恶意软件检测和分类可视化技术综述

文本摘要研究进展与趋势

基于双路特征提取和自适应融合的钓鱼网站检测

基于代码相似性的软件漏洞检测研究进展

基于扩散模型的机器学习后门攻击防御方法