How can I differentiate between a legitimate surge in DNS queries and a DNS Water Torture attack?

The key difference lies in the uniqueness of the queries and the duration of the activity. A legitimate surge typically involves a relatively small number of domain names being queried repeatedly. A Water Torture attack involves a large and constantly increasing number of *unique* domain names over a prolonged period. Analyzing query patterns, source IP addresses, and resource utilization (memory, CPU) is crucial for differentiation. Establishing a baseline of normal behavior is essential for accurate anomaly detection.