Visual Detection of Anomalies in DNS Query Log Data

DNS (Domain Name System) is an essential component of the functionality of the Internet, which converts domain names to the IP addresses. The security of DNS is related to the whole Internet. DNS query log file provide the insights of the DNS security. In this paper we propose an interactive visual analysis system for the DNS log files to intuitively detect the anomalies in DNS query logs. With a theme river based ranking visualization linked with Heat-Dial-map and tree map, user could easy identify anomalies and then further analyze regional and temporal features to help the administrators figure out the reason. Moreover, the features of DNS queries in time and region could also be analysis with this system.