A method for detecting anomalies of a DNS traffic in a network comprising: - analysing, through a network analyser connected to said network, each data packet exchanged in said network; - isolating, through said network analyser , from each of said analysed data packets, the related DNS packet; - evaluating, through a computerized data processing unit , each of said DNS packets, generating a DNS packet status; - signaling, through said computerized data processing unit , an anomaly of said DNS traffic when said DNS packet status defines a critical state; wherein said evaluating further comprises: - assessing, through said computerized data processing unit , each of said DNS packets using a plurality of evaluating algorithms, generating a DNS packet classification for each of said evaluating algorithms; - aggregating, through said computerized data processing unit , said DNS packet classifications, generating said DNS packet status; wherein said isolating further comprises extracting, through said computerized data processing unit , all the features from each of said DNS packets, wherein said assessing further comprises defining, through said computerized data processing unit , a plurality of family subsets of said features, wherein each of said plurality of evaluating algorithms generates a DNS packet classification from a sole family subset, wherein said aggregating further comprises generating, through said computerized data processing unit , a DNS family status grouping said DNS packet classifications of a same family subset according to a predefined family-logic evaluation, wherein said aggregating further comprises generating, through said computerized data processing unit , said DNS packet status grouping said DNS family status according to a predefined packet-logic evaluation, and wherein said critical state is identified when said DNS packet status is comprised in a critical state database stored in a storage medium . - analysing, through a network analyser connected to said network, each data packet exchanged in said network; - isolating, through said network analyser , from each of said analysed data packets, the related DNS packet; - evaluating, through a computerized data processing unit , each of said DNS packets, generating a DNS packet status; - signaling, through said computerized data processing unit , an anomaly of said DNS traffic when said DNS packet status defines a critical state; - assessing, through said computerized data processing unit , each of said DNS packets using a plurality of evaluating algorithms, generating a DNS packet classification for each of said evaluating algorithms; - aggregating, through said computerized data processing unit , said DNS packet classifications, generating said DNS packet status; wherein said isolating further comprises extracting, through said computerized data processing unit , all the features from each of said DNS packets, wherein said assessing further comprises defining, through said computerized data processing unit , a plurality of family subsets of said features, wherein each of said plurality of evaluating algorithms generates a DNS packet classification from a sole family subset, wherein said aggregating further comprises generating, through said computerized data processing unit , a DNS family status grouping said DNS packet classifications of a same family subset according to a predefined family-logic evaluation, wherein said aggregating further comprises generating, through said computerized data processing unit , said DNS packet status grouping said DNS family status according to a predefined packet-logic evaluation, and wherein said critical state is identified when said DNS packet status is comprised in a critical state database stored in a storage medium . <EOS>