Domain-floux botnet detection method based on hybrid learning

Abstract

The invention relates to a Domain-floux botnet detection method based on hybrid learning. The method comprises the following steps: distinguishing a training data set and a detection data set from input DNS data, respectively preprocessing the training data set and the detection data set, inputting the preprocessed training data set into a model, training to obtain a classifier, inputting the preprocessed detection data set into the classifier, outputting clustered domain name clusters, calculating domain name cluster scores, and screening domain name cluster scores which belong to Domain-fluxbotnet domain name; and obtaining the IP address of the infected host and the IP address of the C & C server. According to the invention, a foundation is laid for subsequent defense measures, and characteristics related to domain names, time, request IPs, resolution IPs and the like are used during resolution and are not easy to bypass; the advantages of supervised learning and unsupervised learning are considered, the classification and clustering algorithms are combined, unknown zombie samples which are greatly different from a training set and different in expression form can be effectively detected, and the detection speed is higher than that of other clustering algorithms.

Description

technical field [0001] The present invention relates to the transmission of digital information, such as the technical field of telegraph communication, in particular to a method for detecting Domain-flux botnets based on hybrid learning. Background technique [0002] With the development of network technology, more and more computers in various forms are connected to the Internet, which also gives greater opportunities for botnets. Botnet consists of four parts: zombie host, bot program, state transition function, and C&C channel. From the perspective of an attacker, a zombie host can have multiple states, such as unavailable, available, active, etc. These zombie hosts will Without the owner's knowledge and authorization, they do some behaviors that are beneficial to the controller of the botnet, including DDoS (distributed denial of service) attacks, spam, click fraud, traffic eavesdropping and Bitcoin collection, etc. Bots are attackers A tool for manipulating zombie hos...

AI Technical Summary

Problems solved by technology

[0006] The present invention solves the ubiquitous situation in the prior art that includes the use of domain name-related features or time features alone, which is easy to be bypassed, and the detection method based on threshold or classification algorithm is difficult to achieve the situation that the training set covers all the detections , Clustering-based detection methods generally have a high time complexity problem, and an optimized hybrid learning-based Domain-flux botnet detection method is provided

Images