关键词: 域名系统（DNS）查询失败, 计数型布隆过滤器, 异常检测

Abstract: Considering that DNS query failure can serve as communication evidence for activities of malware, this paper provides a DNS anomaly detection method based on Counting Bloom Filter with failure data as its entry point. This method conducts clustering towards domain names queried and IP which initiates the query, using revertible hash function with semantic features. After the clustering, the few Top N hash strings will be worked backwards to get the dominating shorting strings, which will be spliced according to the results of homology judgment. Experimental results prove that this method can effectively identify the anomaly in DNS flow, thus can be applied to early screening and later validation of anomaly detections, such as botnet and DDoS attack.

Key words: Domain Name System（DNS） query failure, Counting Bloom Filter, anomaly detection