Malicious domain name detection system based on cloud computing

Abstract

A malicious domain name detection system based on cloud computing comprises a sensor, an external data collection module, a data storage module, a resource exchanging and sharing module, a detection module, a detection interface and a submit interface, wherein the sensor is used for monitoring and compressing DNS data and submitting the DNS data to the data storage module through the submit interface; the external data collection module is used for regularly downloading external data and uploading the external data to the data storage module; the detection module is used for storing a detection algorithm and detecting domain names; the resource exchanging and sharing module is used for controlling data added into resource sharing plans. A user can share the data in the resource sharing plans through the detection interface, and provides a request of the detection algorithm or domain name detection for the detection module. The malicious domain name detection system based on cloud computing improves the detection efficiency, lowers the user cost and has wide application prospects on research institutions, security manufacturers and government network management departments.

Description

technical field [0001] The invention relates to a malicious domain name detection system, in particular to a cloud computing-based malicious domain name detection system. Background technique [0002] At present, Trojan horses, viruses, and botnets generally use domain names to locate, and phishing websites usually use similar domain names to deceive. At present, various malicious domain name detection algorithms mainly include: illegal domain name identification method and device (patent number 201110382578.4), counterfeit domain name detection method and equipment (patent number 201210104110.3), abnormal domain name detection method and system (patent number 200910237594.7) , a Domain flux botnet domain name detection (Patent No. 201210475596.1), Trojan web page detection based on domain name structure features (Patent No. 201110146967.7), method, device and system for detecting domain names of control hosts in botnets (Patent No. 201010109069. X), Systems and methods for...

AI Technical Summary

Problems solved by technology

[0003] Existing malicious domain name detection algorithms have certain limitations, mainly in: the detection data source is single, and the results generated by detection in a single data source have poor versatility; lack of data collaboration, multi-source data collaboration can improve detection efficiency, including accuracy and Speed; For malicious domain name detection, organizations / users need to build their own detection systems, which is too expensive; there is no malicious domain name detection algorithm in the SIE system, only resource record storage and query services are provided; users cannot randomly read the entire SIE database, based on SIE data mining needs to generate a large number of API queries, which is extremely inefficient

Images