Implement applications for DNS anomalies detection

CSIRT-MU / Stream4Flow

A framework for the real-time network traffic analysis based on world-leading technologies for distributed stream processing, network traffic monitoring, and visualization.

https://csirt.muni.cz/?lang=en

MIT License

99 stars 36 forks source link

Implement applications for DNS anomalies detection #56

Closed cermmik closed 6 years ago

cermmik commented 7 years ago

Utilize IP flows extended by DNS information for following applications:

[x] Compute basic DNS statistics (allow for both the whole network and subnets)
Top query types
Top response codes
Top queried domains
Top queried non-existing domains
Top queried external DNS servers
Top queried local domains
Top devices with the most DNS requests
[x] Detection usage of external DNS resolvers
[x] Detection of open DNS resolvers (add amplification attack detection if possible)

cermmik commented 7 years ago

Also prepare web-interface for each application.

cermmik commented 6 years ago

Merged and done :)