Domain name server (DNS) data packet-based bot-net domain name discovery method

Abstract

The invention discloses a domain name server (DNS) data packet-based bot-net domain name discovery method. A DNS data packet is taken as a basic data source in a network layer, and a domain name co-occurrence scoring method is used for tracking and discovering a plurality of bot-net domain names under the condition that a part of bot-net domain names are known by utilizing the two key features of groupment and persistence of a bot-net. Known local features (manifesting as bot-net domain names) of the bot-net are updated or changed into unknown domain names along with time, the unknown domain names are discovered, and the dynamic variations of access behaviors of a specified bio-net are discovered, mastered and tracked, so that the shortcomings of the conventional bio-net detection method are overcome. According to the method, domain names are taken as features, so that the limitation caused by bio-net protocol diversity, information encryption and the like when feature codes are used for detection can be avoided; and an object is observed according to the co-occurrence behaviors of the domain names, so that the unknown bio-net domain names can be discovered by fully utilizing the features of groupment and persistence of the bio-net.

Description

technical field [0001] The method relates to the field of computer network security, and relates to a method for discovering a domain name of a botnet, in particular to a method for discovering a domain name of a botnet based on DNS data packets. Background technique [0002] A botnet is a collection of zombie hosts (zombie) infected by a bot program (bot) and having a command-and-control relationship. These zombie hosts are distributed in various occasions such as homes, enterprises, and government agencies, and receive instructions from the controller (botmaster). , carry out various network attacks such as DDoS, information theft, phishing, spam, advertising abuse, and illegal voting. serious security threat. One-to-many command and control (C&C) is the fundamental feature that distinguishes botnets from traditional virus, Trojan horse, backdoor and other attack technologies. feature. [0003] At present, the traditional method of botnet detection is to use signature c...

AI Technical Summary

Problems solved by technology

[0005] 2) Network-based detection methods have high requirements on data sources, and are difficult to apply to large-scale networks due to complex data calculations

[0006] 3) The detection method based on literal semantic analysis and the detection method using the Fast-Flux phenomenon have strong limitations and cannot effectively detect a wide variety of botnets

Images