基于k-means算法的DNS查询模式分析  

Analysis of domain name queries based on the k-means algorithm

作　　者：季成[1,3] 李晓东[3] 袁坚[1] 尉迟学彪[2,3] 山秀明[1] 

机构地区：[1]清华大学电子工程系,复杂工程系统实验室,北京100084 [2]中国科学院研究生院,北京100049 [3]中国科学院计算机网络信息中心,中国互联网络信息中心,北京100190

出　　处：《清华大学学报（自然科学版）》2010年第4期601-604,608,共5页Journal of Tsinghua University(Science and Technology)

基　　金：中国科学院知识创新工程青年人才领域资助项目(O714011601);国家自然科学基金资助项目(60772053,60674048,60672142)

摘　　要：为了研究互联网用户对网站的访问模式,借助中国互联网络信息中心负责管理的国家域名系统资源,选取了一整天CN域名权威服务器的日志。提出了域名规约的方法,将日志中的域名合并为二级域名或者CN下41个类别和行政区的三级域名。该方法不仅保留了用户对网站的访问信息,而且能够达到压缩数据的目的。采用k-means算法对所提取的IP和域名的时间行为特征矢量进行聚类。结果表明:根据时间行为模式的不同,IP地址有3个主要类别,即攻击者、主要ISP的递归服务器和非主流递归服务器;域名有4个主要类别,对其中大量访问的域名进一步分类,找到了真正体现绝大多数用户网络访问需求的域名集合。A full day＇s queries looking up the IP address associated with the CN domain names were investigated to study the Internet access pattern. The queries were collected from the authoritative CN name servers running by the China Internet Network Information Center. A data compression method was designed,which reduces the volume of data while retaining the valid information about users＇ visiting website. The feature vector of IPs and domain names＇ temporal behavior were clustering with the k-means algorithm. The results show that according to the differences between the temporal behaviors,IP addresses are divided into three main clusters,attackers,the main ISP＇s recursive server,and other recursive servers and that domain names are divided into four main clusters. The further clustering of the domain names queried by large number of users finds the domain names truly reflecting the need of the majority of the users.

关 键 词：聚类 DNS服务器 日志分析 时间行为模式 K-MEANS算法 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]