Preprocessing DNS Log Data for Effective Data Mining

13 years 11 months ago

Download www.ccs.neu.edu

—The Domain Name Service (DNS) provides a critical function in directing Internet trafﬁc. Defending DNS servers from bandwidth attacks is assisted by the ability to effectively mine DNS log data for statistical patterns. Processing DNS log data can be classiﬁed as a data-intensive problem, and as such presents challenges unique to this class of problem. When problems occur in capturing log data, or when the DNS server experiences an outage (scheduled or unscheduled), the normal pattern of trafﬁc for that server becomes clouded. Simple linear interpolation of the holes in the data does not preserve features such as peaks in trafﬁc (which can occur during an attack, making them of particular interest). We demonstrate a method for estimating values for missing portions of time sensitive DNS log data. This method would be suitable for use with a variety of datasets containing time series values where certain portions are missing.

Mark E. Snyder, Ravi Sundaram, Mayur Thakur

Real-time Traffic