FLOW DETECTION METHOD FOR DOMAIN NAME SYSTEM AND DOMAIN NAME SERVER THEREOF

摘要

A flow detection method for a domain name system (DNS) and a domain name server thereof are provided in the present invention. The method includes the following steps: acquiring the number of domain name inquiry requests and the actual value of the type of a measurement index, which are received during a detection period (11); acquiring a predicted value of the type of the measurement index, according to the mapping relationship between the domain name inquiry request and the measurement index and the number of the domain name inquiry requests (12); determining the first difference value between the actual value and the predicted value of the type of the measurement index (13); and outputting alarm information indicating the abnormality of the DNS flow when the fact that the first difference value is larger than the threshold obtained in advance is confirmed (14). The domain name server can be used for executing the flow detection method for a DNS. By applying the flow detection method and the domain name server for a DNS provided in the present invention, the rate of false alarm for the judgment about the abnormality of the DNS flow can be reduced, and the accuracy of the detection about the abnormality of the DNS flow is improved.