TY - GEN
T1 - Approximate String Matching for DNS Anomaly Detection
AU - Mateless, Roni
AU - Segal, Michael
N1 - Publisher Copyright:
© Springer Nature Switzerland AG 2019.
PY - 2019/1/1
Y1 - 2019/1/1
N2 - In this paper we propose a novel approach to identify anomalies in DNS traffic. The traffic time-points data is transformed to a string, which is used by new fast approximate string matching algorithm to detect anomalies. Our approach is generic in its nature and allows fast adaptation to different types of traffic. We evaluate the approach on a large public dataset of DNS traffic based on 10 days, discovering more than order of magnitude DNS attacks in comparison to auto-regression as a baseline. Moreover, the additional comparison has been made including other common regressors such as Linear Regression, Lasso, Random Forest and KNN, all of them showing the superiority of our approach.
AB - In this paper we propose a novel approach to identify anomalies in DNS traffic. The traffic time-points data is transformed to a string, which is used by new fast approximate string matching algorithm to detect anomalies. Our approach is generic in its nature and allows fast adaptation to different types of traffic. We evaluate the approach on a large public dataset of DNS traffic based on 10 days, discovering more than order of magnitude DNS attacks in comparison to auto-regression as a baseline. Moreover, the additional comparison has been made including other common regressors such as Linear Regression, Lasso, Random Forest and KNN, all of them showing the superiority of our approach.
KW - Anomaly detection
KW - Approximate string matching
KW - Similarity measures
UR - http://www.scopus.com/inward/record.url?scp=85069802068&partnerID=8YFLogxK
U2 - 10.1007/978-3-030-24907-6_37
DO - 10.1007/978-3-030-24907-6_37
M3 - Conference contribution
AN - SCOPUS:85069802068
SN - 9783030249069
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 490
EP - 504
BT - Security, Privacy, and Anonymity in Computation, Communication, and Storage - 12th International Conference, SpaCCS 2019, Proceedings
A2 - Wang, Guojun
A2 - Feng, Jun
A2 - Bhuiyan, Md Zakirul Alam
A2 - Lu, Rongxing
PB - Springer Verlag
T2 - 12th International Conference on Security, Privacy, and Anonymity in Computation, Communication, and Storage, SpaCCS 2019
Y2 - 14 July 2019 through 17 July 2019
ER -