Speaker
Description
Long-term passive DNS data contains patterns that are difficult to uncover through conventional analysis. Aggregating large datasets is necessary for scalability, but overly aggressive aggregation can hide temporal patterns and unexpected behavior. Moreover, different users may be interested in different aspects of the same traffic, making fixed analyses and visualizations limiting.
We present an interactive visualization system for exploring passive DNS traffic, and showcase said system with data collected from a university recursive DNS server. The system combines large-scale filtering and aggregation with interactive temporal visualizations, allowing users to dynamically change the time range, granularity, and traffic being analyzed. Rather than presenting a predefined set of results, the system is designed as an exploratory environment where users can follow unexpected patterns, investigate anomalies, and formulate new questions while interacting with the data.
We demonstrate the approach through several unusual observations found in the year-long dataset, showing how changing the perspective and aggregation level can reveal behaviors that are difficult to identify in conventional analyses.
| Talk duration | 15 Minutes (pre-recorded no Q&A) |
|---|
