Raw DNS data transformed into vectors of features to detect anomalies following the SGC model as in [1]:
Reference: [1] Alonso, R.; Monroy, R.; Trejo, L.A. Mining IP to Domain Name Interactions to Detect DNS Flood Attacks on Recursive DNS Servers. Sensors 2016, 16, 1311.