Tiered remediation of outlier domain name system requests

An apparatus comprising:

• one or more computer readable storage media;
• a processing system operatively coupled with the one or more computer readable storage media;
• and
• program instructions stored on the one or more computer readable storage media that, when read and executed by the processing system, direct the apparatus to:
• group DNS requests into one or more groups based on characteristics of the DNS requests;
• identify an outlier request of the DNS requests, wherein the outlier request is one of the DNS requests that is not included in the one or more groups;
• and
• determine a remedial action from tiered remedial actions for the outlier request based on a distance of the outlier request to the one or more groups, wherein the tiered remedial actions correspond to different distances;
• and
• perform the remedial action.

One or more non-transitory computer readable storage media having program instructions stored thereon, the program instructions, when read and executed by a processing system, direct the processing system to:

• group DNS requests into one or more groups based on characteristics of the DNS requests;
• identify an outlier request of the DNS requests, wherein the outlier request is one of the DNS requests that is not included in the one or more groups;
• and
• determine a remedial action from tiered remedial actions for the outlier request based on a distance of the outlier request to the one or more groups, wherein the tiered remedial actions correspond to different distances;
• and
• perform the remedial action.