Detection and processing method and system for botnet domain names

Abstract

The invention relates to a detection and processing method and a system for botnet domain names. The detection and processing system is composed of an input module, an output module, a real-time calibration module and a processing module. The method comprises the step: 1) carrying out log query on a to-be-detected network domain name, and obtaining a log record of domain name query and inputting the log record to a detection port; 2) extracting and obtaining characteristics of the domain name according to the log record of the domain name query, and carrying out machine learning on the characteristics of the domain name; 3) after the machine learning, extracting the botnet domain names in a domain name on an outgoing line and / or a local domain name log; and 4) building a data base of the botnet domain names, carrying out breakdown through a black hole authoritative server, and finishing the processing. According to the detection and processing method and the system for the botnet domain names, while the botnet domain names can be extracted from a domain name server (DNS) to be broken down and separated so as to crack down botnet crimes, the botnet domain names are collected, and a network bad action that a botnet host is connected with a controlling end through the domain names so as to receive vicious commands is effectively prevented.

Description

technical field [0001] The invention relates to a domain name detection and processing method and system, in particular to a detection and processing of a botnet domain name. Background technique [0002] With the development of social informatization, the Internet has penetrated into all aspects of social life. Therefore, security attacks on the Internet are becoming more frequent and serious. As the most basic addressing protocol of the Internet, DNS is the basis for the smooth development of almost all Internet applications, and its failure to fully consider the flaws in security guarantees and its completely open features at the beginning of its design also make it an important tool for various malicious applications. Preferred attack target or tool. [0003] Botnet is a very harmful and serious Internet malicious attack mode, and in order to hide the control and command end of botnet, DNS has become the mainstream form of communication for botnet in recent years. Its...

AI Technical Summary

Problems solved by technology

This mechanism of constantly changing DNS records makes it more difficult to track and block criminal activities

Images