Malicious domain name determination method based on frequency characteristics

Abstract

The invention provides a malicious domain name determination method based on frequency characteristics in the field of network information security. The invention is characterized by putting forward a method for detecting network attacks by fusing a multi-dimensional frequency characteristic evaluation system, synthesizing high-frequency domain name resolution and search engine collection analysis and evaluating the risk levels of malicious domain names. The existing method for judging a domain name as a malicious domain name based on a single condition has high false alarm rate, which needs to be urgently solved. The method adopts the multi-dimensional frequency characteristic evaluation system for allocating different weights for different level determination conditions, performing overall evaluation on a domain name according to the weight of each condition to obtain a risk level percentage that the domain name is a malicious domain name, and then determining whether the domain name is a malicious domain name.

Description

technical field [0001] The invention belongs to the field of network information security, relates to a method for judging a malicious domain name, in particular to a method for judging a malicious domain name based on frequency characteristics. Background technique [0002] In recent years, network attacks are common, and network information security is of paramount importance. Cyber ​​attackers use various methods to enter the target host and steal user information. After the attacker enters the target host, he usually uses a malicious domain name to connect back to the control server. This behavioral pattern is one of the most important discovery and detection opportunities attackers give defenders. We can determine whether the host has been attacked based on frequency feature detection of malicious domain names (malicious domain names: including C&C domain names, botnet domain names, RAT domain names, etc.). [0003] Among the existing technologies for detecting netwo...

AI Technical Summary

Problems solved by technology

However, these techniques for detecting attack events based on malicious domain names have certain limitations, so this scheme proposes an evaluation system based on fusion of multi-latitude frequency features to evaluate the risk level of malicious domain names, thereby determining malicious domain names, and then detecting network attacks.

Images