This paper introduced NgViz, a tool that examines DNS traffic and shows anomalies in n-gram frequencies. This is accomplished by comparing input files against a fingerprint of legitimate traffic. Both quantitative analysis and visual aids are provided that allow the user to make determinations about the legitimacy of the DNS traffic.
Cite
@article{arxiv.1004.4359,
title = {NgViz: Detecting DNS Tunnels through N-Gram Visualization and Quantitative Analysis},
author = {Kenton Born and David Gustafson},
journal= {arXiv preprint arXiv:1004.4359},
year = {2010}
}
Comments
In Proceedings of the the 6th Annual Cyber Security and Information Intelligence Research Workshop, Oak Ridge, TN, April 21-23, 2010