To understand a network anomaly, you must first understand yourself

A presentation about my statistical approach to analyzing network anomalies by comparing the anomaly against a previously recorded baseline. Using temporal comparison can more easily highlight "what has changed" that has caused an event, regardless of its size. Note: the examples in this presentation were collected from a DNS root server and an understanding of DNS packets will help in following portions of this video.