This script is used to detect DNS tunnels, and written according to the paper Chimera: A Declarative Language for Streaming Network Traffic Analysis and the report Detecting DNS Tunneling.
It based on the count of the DNS query in a period time, the length of the DNS query, and the percentage of the numerical characters in the DNS query.
This rep is used for Bro package.