NgViz: 通过N-gram可视化和定量分析检测DNS隧道
密码学与安全
2010-04-27 v1
摘要
本文介绍了NgViz，一种检查DNS流量并显示n-gram频率异常的工具。这是通过将输入文件与合法流量的指纹进行比较来实现的。提供了定量分析和可视化辅助工具，使用户能够判断DNS流量的合法性。
引用
@article{arxiv.1004.4359,
title = {NgViz: Detecting DNS Tunnels through N-Gram Visualization and Quantitative Analysis},
author = {Kenton Born and David Gustafson},
journal= {arXiv preprint arXiv:1004.4359},
year = {2010}
}
备注
In Proceedings of the the 6th Annual Cyber Security and Information Intelligence Research Workshop, Oak Ridge, TN, April 21-23, 2010