A new statistical approach to DNS traffic anomaly detection
ADMA'10 Proceedings of the 6th international conference on Advanced data mining and applications - Volume Part II
| Hi-index | 0.00 |
Many people want to know how the Internet grows. However, it is hard to answer, especially for the huge Internet today. In this paper, a new choice for the Internet growth measurement is introduced. As a fundamental component of the modern Internet, the Domain Name System (DNS) contains plenty of information about the Internet. By performing a longitudinal evolution analysis on the DNS traffic sampled at .cn name servers between the year 2006 and 2009, we take an investigation of a long term characteristics of DNS traffic evolution, from which we believe that the Internet growth especially in China can be learned. So far, no publication has been found working on this. We find that, during these years, DNS traffic has suffered a great growth and IPv6 applications are becoming more prevalent. While DNS client population has doubled, the fraction for China is going down, indicating that the Internet in China today is becoming more internationalized. Number of domains in registry has grown 12 times from 2006, while most queries are sourced from little fraction of clients visiting similarly little fraction of domains. Domains’ access counts keep a Zipf-like distribution, but with different popularity indexes. Although our works are not perfect enough and still need to do more, we believe that our work can give good insight for the Internet growth in China.