A set of zeek scripts providing a module for tracking and correlating abnormal DNS behavior. Detection of tunneling and C&C through connection duration and volume, request and answer size, DNS request type, and unique queries per domain. Statistical classification of fast flux networks based on A records and ASNs.

Requirements ____________

domain-tld: (automatically installed with package)

Installation ____________

zkg install jbaggs/anomalous-dns

Documentation _____________

Current documentation consists of inline comments.

Package Version :