@misc{39654,
   author = {Čermák, Milan},
   keywords = {DNS; anomaly; detection; amplification attack; cybersquatting; open resolver; malware domains; tunneling},
   language = {eng},
   institution = {Ústav výpočetní techniky},
   organization = {Ústav výpočetní techniky},
   title = {DNSAnomDet},
   year = {2014}
}

TY  - 
ID  - 39654
AU  - Čermák, Milan
PY  - 2014
TI  - DNSAnomDet
KW  - DNS
KW  - anomaly
KW  - detection
KW  - amplification attack
KW  - cybersquatting
KW  - open resolver
KW  - malware domains
KW  - tunneling
N2  - DNSAnomDet is a suite of scripts that automate detection of DNS traffic anomalies, using IP flows in the IPFIX format extended by information from DNS packets. Scripts focus on detection of cybersquatting, DNS amplification attacks, open DNS resolvers, malware domain queries, and DNS tunneling detection.
ER  - 

ČERMÁK, Milan. \textit{DNSAnomDet}. 2014.