Applying Process Mining Techniques to DNS Traces Analysis

One of the key technologies on the Internet is the DNS protocol. While many studies have taken a statistical approach, the representation of DNS traces as a graph has not received enough attention. In this position paper we present our work of applying Process Mining (PM) techniques to study DNS traffic. Process Mining has been successfully used to understand processes on the enterprise as part of Business Process Management (BPM) analysis tools and techniques. Applying PM techniques allow us discovering unexpected behaviors in DNS operations such as spam botnet attacks. We show examples of the studies performed by our group and we also present new ideas for future work.