Authors:
Hikofumi Suzuki
1
and
Katsumi Wasaki
2
Affiliations:
1
Integrated Intelligence Center, Shinshu University, 4–17–1, Wakasato, Nagano City, Nagano 380–8553, Japan
;
2
Faculty of Engineering Electrical and Computer, Engineering, Shinshu University, 4–17–1, Wakasato, Nagano City, Nagano 380–8553, Japan
Keyword(s):
DoS/DDoS Attack Detection, DNS Traffic, Unsupervised Machine Learning, Density-Based Spatial Clustering of Applications with Noise (DBSCAN), Mean Shift, Variational Bayesian Gaussian Mixture Model (VBGMM).
Abstract:
In this study, quantitative traffic data from DNS cache servers are classified as stationary or non-stationary. Then, unsupervised machine learning is performed using the classified traffic data. Among the 17 types of DNS traffic data subject to revision, A Record, MX, SOA Record, and AD Flag are considered. The correlation between A Record and AD Flag is difficult to detect using conventional clustering methods because they form zonal clusters under stationary-state conditions. Therefore, the number of clusters is calculated using the clustering algorithms Density-Based Spatial Clustering of Applications with Noise (DBSCAN), Mean Shift, and variational Bayesian Gaussian mixture model (VBGMM). The possibility of automatic classification is investigated.