Skip to content
master
Switch branches/tags
Go to file
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.

Anomalous-DNS

A set of zeek scripts providing a module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain. Statistical classification of fast flux networks based on A records and ASNs.

Requirements

domain-tld: https://github.com/sethhall/domain-tld (automatically installed with package)

Installation

zkg install jbaggs/anomalous-dns

Documentation

Current documentation consists of inline comments.

About

A set of zeek scripts providing a module for tracking and correlating abnormal DNS behavior.

Resources

License

Packages

No packages published

Languages