Entropy Method for DNS Abnormal Detection
利用熵检测DNS异常

This paper propose a method of detecting DNS abnormalities by calculating the entropies of the DNS query types observed in consecutive windows of fixed-size. Applied to the DNS query data targeting .CN on May 19th 2009 when there was a major DNS accident happened, this method demonstrates ability of detecting the abnormal behavior towards DNS before the event was observed and reported.