A malware domain name detection method and system based on periodic detection

Abstract

The present invention proposes a malware domain name detection method based on periodic detection, which includes the following steps: 1) filtering the input data to obtain a rare domain name set; 2) extracting from the rare domain name set <请求主机，稀少域名>3) Obtain the feature vector of each periodic domain name in the periodic domain name set; 4) Manually mark the periodic domain name in the periodic domain name set, According to the eigenvector, use the marked legal domain name and malicious domain name to train the classifier; 5) use the new unlabeled domain name as the input of the trained classifier in step 4) to detect, and the output result is a malware domain name. Ability to detect recurring malware domains in covert communications. At the same time, a system based on the above method is proposed.< / 请求主机，稀少域名>

Description

technical field [0001] The invention relates to a method and system for detecting malicious software domain names based on periodic detection, and belongs to the field of network security. Background technique [0002] DNS (Domain Name System, Domain Name System) is a key infrastructure on the Internet, and its main function is to map domain names and IP addresses. However, many malware exploit DNS to locate remote command and control (C&C) servers for a range of malicious activities. In recent years, network security research has developed rapidly, but many attackers evade existing security strategies by developing special malware. The communication between malware and C&C servers is very hidden and difficult to be found. A small number of malicious domain name requests are mixed in a large amount of DNS data, making it difficult to discover malicious domain names. [0003] Existing research and practice have shown that the life cycle followed by many different malware is...

AI Technical Summary

Problems solved by technology

Existing research has little effect on malicious software domain names with high concealment. These domain names are very similar to normal domain names in many characteristics, and such software malicious domain names cannot be found by existing detection methods

Images