DNS Spikes, Strikes, and The Like

Explore the intricacies of DNS traffic analysis in this conference talk from BSidesSF 2015. Delve into the examination of DNS query spikes and their potential for identifying new threats. Learn how malicious domains often manifest as spiked domains, typically associated with Domain Generation Algorithm (DGA) or exploit kit families. Discover the challenges of distinguishing harmful spikes from benign ones within large datasets. Gain insights into the application of unsupervised learning methods, particularly clustering techniques, for effective data exploration and classification in the context of cybersecurity threat detection.