Thats a unique idea.You should consider the following idea to enhance your idea so that it would impact uniquely: Email worms and the high amount of unsolicited email traffic on the Internet continue to be persistent operational security issues. In this work,  present a method to detect email worms soon after they appear at the local name server, which is topologically near the infected machines. Our method analyses at flow level the communication patterns beten user machines and the local name server. With respect to this, it uses exact similarity search over time series produced by the Domain Name System (DNS) query streams of user machines, and unsupervised learning. To evaluate our method,  have constructed and used a DNS query dataset that consists of 71 recent email worms.  demonstrate that our method is remarkably effective in the long run, and that time series similarity search can be a useful tool for intrusion detection, one that has not yet been adequately explored.
['Nikolaos Chatzis', 'Nevil Brownlee']
I am writing a research paper on a idea Similarity Search over DNS Query Streams for Email Worm Detection
[{"from": "human", "value": "I am writing a research paper on a idea Similarity Search over DNS Query Streams for Email Worm Detection"}, {"from": "gpt", "value": "Thats a unique idea.You should consider the following idea to enhance your idea so that it would impact uniquely: Email worms and the high amount of unsolicited email traffic on the Internet continue to be persistent operational security issues. In this work,  present a method to detect email worms soon after they appear at the local name server, which is topologically near the infected machines. Our method analyses at flow level the communication patterns beten user machines and the local name server. With respect to this, it uses exact similarity search over time series produced by the Domain Name System (DNS) query streams of user machines, and unsupervised learning. To evaluate our method,  have constructed and used a DNS query dataset that consists of 71 recent email worms.  demonstrate that our method is remarkably effective in the long run, and that time series similarity search can be a useful tool for intrusion detection, one that has not yet been adequately explored."}]