Self-adaptive malicious domain name detection method based on DNS (Domain Name Server) flow

Abstract

The invention discloses a self-adaptive malicious domain name detection method based on a DNS (Domain Name Server) flow. The method comprises the following steps: collecting a blacklist and whitelistsample set provided by a third party platform, and selecting a random forest classifier to train a domain name structure detection model by using the blacklist and whitelist sample set as a training set base line according to domain name structure characteristic list; performing Whois query and tracking verification on a domain name which is judged as a malicious domain name; training a flow detection model; performing data preprocessing on a domain name to be detected and DNS flow data, inputting the domain name and the DNS flow data as a loaded domain name structure detection engine and a flow detection engine, and acquiring prediction results; updating a training set blacklist of the domain name structure detection engine according to data set of malicious domain name judged by the flowdetection engine, and establishing a self-adaptive malicious domain name detection. By adopting the method, suspicious domain names can be rapidly detected, a relatively low time delay and an acceptable accuracy rate can be maintained, multiple types of malicious domain names can be detected from a massive amount of data, and a relatively high accuracy rate and a relatively low false alarm rate can be maintained.

Description

technical field [0001] The invention relates to the field of network security, in particular to an adaptive malicious domain name detection method based on DNS flow. Background technique [0002] At present, the rapid development of Internet technology has made the security threats from the network more prominent. Attackers gradually form a domain name generated using Domain Generation Algorithm (DGA) technology to control a botnet, that is, a network composed of puppet machines that are attacked by malware, and then through the command and control server (Command And Control) Server, C&C) sends commands to each node of the botnet to launch attack modes such as DDOS, click fraud, spam and other network attacks. [0003] In order to effectively control the botnet and hide itself, the C&C server controller adopts technical means such as fast-changing domain names and DGA to avoid the detection of security software. Among them, DGA technology is the mainstream active in malwar...

AI Technical Summary

Problems solved by technology

[0008] 1) The existing lightweight malicious domain name detection method has a simplified feature model, poor accuracy in the face of massive data, and unreasonable design of calculation time and space overhead

[0009] 2) Unable to solve the detection blind spots of multi-type malicious domain names, especially advanced DGA domain names (word combinations, pinyin, init

Images