DNS covert channel detection method based on neural network

Abstract

The invention provides a DNS covert channel detection method based on a neural network. The deep learning is applied to the technical field of DNS covert channel detection, the accuracy of the existing DNS covert channel detection method is improved, the false alarm rate of the existing DNS covert channel detection method is reduced, numeric features are combined with character features for use toshorten the model training time and to improve the accuracy rate, a suspicious domain name is queried by whois, whether the domain name is legal is automatically judged according to rules, and the domain name that does not conform to a neural network prediction result is used for retraining the neural network to form a loop so as to continuously improve the neural network.

Description

technical field [0001] The invention relates to the technical field of covert channel detection methods, in particular to a neural network-based DNS covert channel detection method. Background technique [0002] The DNS domain name system plays a vital role in the operation of the Internet today. It provides a two-way mapping service between domain names and IP addresses. You need to remember a relatively meaningful domain name. Because DNS is essential in network communication, few firewalls and intrusion detection systems will filter DNS traffic, which provides conditions for hackers to use DNS to attack. [0003] DNS Tunneling is a kind of covert channel, which establishes communication by encapsulating other protocols in the DNS protocol for transmission. Hackers can use it to achieve operations such as remote control and file transfer. Now more and more research proves that DNS covert channels also often play an important role in botnet and APT attacks. DNS covert c...

AI Technical Summary

Problems solved by technology

The method is too simple, lacks more basis, and the effect is not ideal

Images