Abstract: An apparatus has a processor and a memory connected to the processor. The memory stores instructions executed by the processor to receive domain name system (DNS) query event data. A timestamp, source internet protocol (IP) address, and fully qualified domain name (FQDN) value are extracted from each DNS query event record. Each FQDN value is classified to generate corresponding key-value pairs. For each source IP address, key-value pairs during a period of time are counted. It is determined if a FQDN value or key-value pair value indicates anomalous behavior. One or more alert messages are generated if anomalous behavior is determined.