• cluster analysis
• country code top level domain
• histogram analysis
• tld
• top level domain

DNS provides a critical function in the Internet infrastructure. Since it is relied on by many Internet applications, security has become a crucial problem in the DNS. Traditional rule-based intrusion detection methods are not able to update the rules dynamically.
In this work, cluster and histogram analyses are employed to detect possible anomalies in DNS query traffic. The proposed methods are used to reveal unusual patterns in a real-word DNS log dataset captured at a country code top level domain server.
Experimental results on such log dataset are achieved and compared performing the proposed algorithms on different query parameters and with different time-bin sizes.