A method for detecting anomalies of a DNS traffic in a network comprising: - analysing, through a network analyser connected to said network, each data packet exchanged in said network; - isolating, through said network analyser, from each of said analysed data packets, the related DNS packet; - evaluating, through a computerized data processing unit, each of said DNS packets, generating a DNS packet status; - signaling, through said computerized data processing unit, an anomaly of said DNS traffic when said DNS packet status defines a critical state; wherein said evaluating further comprises: - assessing, through said computerized data processing unit, each of said DNS packets using a plurality of evaluating algorithms, generating a DNS packet classification for each of said evaluating algorithms; - aggregating, through said computerized data processing unit, said DNS packet classifications, generating said DNS packet status; wherein said isolating further comprises extracting, through said computerized data processing unit, all the features from each of said DNS packets, wherein said assessing further comprises defining, through said computerized data processing unit, a plurality of family subsets of said features, wherein each of said plurality of evaluating algorithms generates a DNS packet classification from a sole family subset, wherein said aggregating further comprises generating, through said computerized data processing unit, a DNS family status grouping said DNS packet classifications of a same family subset according to a predefined family-logic evaluation, wherein said aggregating further comprises generating, through said computerized data processing unit, said DNS packet status grouping said DNS family status according to a predefined packet-logic evaluation, and wherein said critical state is identified when said DNS packet status is comprised in a critical state database stored in a storage medium. - analysing, through a network analyser connected to said network, each data packet exchanged in said network; - isolating, through said network analyser, from each of said analysed data packets, the related DNS packet; - evaluating, through a computerized data processing unit, each of said DNS packets, generating a DNS packet status; - signaling, through said computerized data processing unit, an anomaly of said DNS traffic when said DNS packet status defines a critical state; - assessing, through said computerized data processing unit, each of said DNS packets using a plurality of evaluating algorithms, generating a DNS packet classification for each of said evaluating algorithms; - aggregating, through said computerized data processing unit, said DNS packet classifications, generating said DNS packet status; wherein said isolating further comprises extracting, through said computerized data processing unit, all the features from each of said DNS packets, wherein said assessing further comprises defining, through said computerized data processing unit, a plurality of family subsets of said features, wherein each of said plurality of evaluating algorithms generates a DNS packet classification from a sole family subset, wherein said aggregating further comprises generating, through said computerized data processing unit, a DNS family status grouping said DNS packet classifications of a same family subset according to a predefined family-logic evaluation, wherein said aggregating further comprises generating, through said computerized data processing unit, said DNS packet status grouping said DNS family status according to a predefined packet-logic evaluation, and wherein said critical state is identified when said DNS packet status is comprised in a critical state database stored in a storage medium.