Method and system for detecting DNS (domain name system) traffic abnormality

Abstract

The invention provides a method and a system for detecting DNS (domain name system) traffic abnormality. The method includes: extracting corresponding characteristic values for DNS traffic data to be processed, giving different weights to each characteristic, and detecting an abnormality cluster marked in a training set by the aid of the W-Kmeans algorithm and the additional Euclidean distance threshold Dthreshold so that new unknown characteristic abnormality can be discovered. The method and the system have the advantages that the algorithm is high in convergence speed and small in calculation, new samples to be detected only need to be compared with a processed training clustering center, calculation of a great quantity of original training data is not needed, the method and the system are low in deployment cost, strong in generalization ability and capable of discovering DNS traffic abnormality rapidly and effectively, and the system is particularly suitable for being deployed on a large DNS server.

Description

technical field [0001] The invention belongs to the field of computer networks, and relates to a DNS traffic detection system, in particular to a method and system for detecting abnormal DNS traffic. Background technique [0002] The Domain Name System (Domain Name System, DNS) is the link connecting the application layer and the network layer of the entire Internet. It is the nerve center of today's Internet system. Its main function is to realize the conversion between IP addresses and domain names for precise positioning and identification. The vast resources on the Internet are the cornerstone of the normal operation of many important network applications (web browsing, email, etc.). [0003] Although DNS provides various basic services for Internet users, it is a pity that DNS is still often attacked maliciously by saboteurs, such as DNS cache poisoning, DNS redirection, DNS information hijacking, DNS amplification attacks, etc. DNS DDOS attack, etc. The security situ...

AI Technical Summary

Problems solved by technology

[0023] (2) The detection method has a large amount of computation, the convergence speed of the algorithm is slow, and consumes too much system resources

Such as: some existing neural network detection methods, in the process of feature extraction and detection and classification, the amount of calculation is too large and too complicated

[0024] (3) Lack of ability to detect attacks with unknown features, and the generalization ability of the detection algorithm is low

For example, some existing detection schemes perform similarity analysis on DNS traffic and can only detect attack traffic with similar characteristics

[0025] (4) The sensitivity of the detection algorithm is low, the practice is not good, and it has a large hysteresis

For example: some attack detection based on traffic accumulation, when the attack traffic accumulates to a certain level, the best time for exception handling has been missed

Images