Domain Name System Security Extensions Complete Self-Assessment Guide by Gerardus Blokdyk (2018, Trade Paperback)
A graphic that uses arrows to illustrate DNS-layer activity flowing from any device, to recursive DNS servers, to authoritative DNS servers and then back again. Underneath the image are two bulleted lists. The first reads: "User request patterns used to detect: compromised systems, command and control callbacks, algorithm-generated domains, domain co-occurrences, and newly seen domains." The second list reads: "Authoritative DNS logs used to find: newly staged infrastructures, BulletProofHostings, and malicious domains, IPs, and ASNs."