Botnet detection method based on Netflow and DNS blog

Abstract

The invention discloses a Botnet detection method based on Netflow and DNS blogs. The method includes the following steps: conducting quintuple correlation analysis on acquired Netflow data through an abnormal flow monitoring technique, and analyzing IP addresses of infected hosts of a service provider network, IP addresses of attack targets initiated by the IP addresses of the infected hosts and attack characteristics; and in a DNS server, acquiring DNS query request blogs, conducting correlation analysis on domain name request situations initiated when the IP addresses of the infected hosts attack the service provider network, searching for common domain name access records and eliminating normal common domain names, and obtaining FFSN dynamic malicious domain names. According to the method, the FFSN dynamic malicious domain names can be located quickly, locating precision and timeliness of the FFSN dynamic malicious domain names are greatly improved, and misjudgement rates are reduced.

Description

technical field [0001] The invention relates to the field of network security, in particular to a botnet detection method based on Netflow and DNS logs. Background technique [0002] Fast-Flux is used to allocate multiple (hundreds or even thousands) IP addresses for a legal domain name (such as flux.example.com). These IP addresses are changed very quickly. Through a rotating IP address resource pool and A resolution mapping implementation with a short life cycle is set for a specific DNS domain name resource. Website domains can assign new IP addresses every three minutes, and browsers that connect to these same websites may actually be connecting to different infected hosts. [0003] With the continuous evolution of the FFSN botnet and the enhanced concealment of DNS traffic attacks and the emergence of attack forms, the existing Netflow traffic analysis solutions can only detect DDos (Distributed Denial of Service, Distributed Denial of Service) initiated by the FFSN ne...

AI Technical Summary

Problems solved by technology

[0003] With the continuous evolution of the FFSN botnet and the enhancement of the concealment of DNS traffic attacks and the emergence of attack forms, the existing Netflow traffic analysis solutions can only detect DDos (Distributed Denial of Service, distributed denial of service) initiated by the FFSN network. The source IP address, target IP address and attack characteristics of the attack, but the control domain name controlling the FFSN network cannot be found. The existing DNS log analysis solution uses the DGA algorithm to find the abnormal domain name, but this method has a high misjudgment rate and cannot be accurate Locating FFSN dynamic malicious domain names

Images