Method and device for realizing malicious domain name identification

Abstract

The invention discloses a method and a device for realizing malicious domain name identification. The method comprises the following steps: extracting a dynamic characteristic set of a domain name system (DNS) domain name, and making malicious domain name high credibility judgment on the dynamic characteristics of the dynamic characteristic set through a malicious domain name credibility judgment model of the dynamic characteristics; and determining whether the DNS domain name is a malicious domain name according to the malicious domain name high credibility judgment result of the dynamic characteristic set, and storing the result about whether the DNS domain name is a malicious domain name in a corresponding black or white list, wherein the dynamic characteristic set at least includes IP-related characteristics and / or authoritative DNS server main domain name consistence rate. By adopting the technical scheme, a malicious domain name can be determined according to the dynamic characteristic set, and the efficiency of malicious domain name identification is improved through static characteristic high credibility judgment and dynamic characteristic high credibility judgment.

Description

technical field [0001] The invention relates to the field of information security, in particular to a method and device for realizing identification of malicious domain names. Background technique [0002] Domain Name System (DNS) and its supporting technologies, DNS has become an indispensable technology for the Internet, and it is the Internet entrance for most users and application systems. It has the function of decoupling IP and domain names and can be configured flexibly. In recent years, With the gradual popularization of technologies such as Round-robin DNS and Content Distribution Network (CDN, Content Distribution Network), DNS technology has been widely used in load balancing and high-reliability network architecture design. [0003] But what follows is that the application of DNS technology has also attracted the attention of hackers, and DNS technology has become a protective barrier for hackers. Because the cost of this barrier is very low and the effect is go...

AI Technical Summary

Problems solved by technology

However, this method has the problem of unsatisfactory precision and recall.

The malicious domain name identification method with dynamic features is generally based on the original data through active detection of DNS records. Although the identification effect is good, it cannot respond in real time, and the application conditions are harsh.

[0008] DNS technology has become a protective barrier for hackers. Domain names are used as the communication basis of botnets, which greatly improves the robustness of botnets, and it is more difficult for C&C servers to locate physical locations. Only dynamic malicious domain name identification methods and static malicious domain names are used. The domain name identification method cannot effectively identify malicious domain names

Images