DNS water sentencing attack detection model construction method and flow cleaning method

The invention provides a DNS water sentencing attack detection model construction method and a flow cleaning method, and the method comprises the steps: monitoring DNS request flow, so as to obtain a DNS request flow set of a target second-level domain name; according to the DNS request distribution condition of the DNS request flow set of the target second-level domain name, judging whether the target second-level domain name has a DNS water sentencing attack or not; if yes, determining the DNS request traffic in the DNS request traffic set of the target second-level domain name as abnormal traffic; and training the initial DNS water sentencing attack detection model by using the abnormal traffic to obtain a target DNS water sentencing attack detection model. The target DNS water sentencing attack detection model obtained by the above scheme can detect the attack of a one-time domain, and lays a foundation for comprehensively guaranteeing the security of a DNS server. 本申请提供一种DNS水刑攻击检测模型构建方法及流量清洗方法，该DNS水刑攻击检测