Method for detecting host infection caused by DGA malicious software

Abstract

The invention relates to a method for detecting host infection caused by DGA malicious software. The method comprises the steps: extracting DNS data as an original data set; constructing a training data set, extracting and normalizing all data features, training the processed training data features to obtain a stable model, inputting original data set data into the model to obtain a suspicious DGAdomain name list, and performing host infection confirmation on the suspicious DGA domain name list subjected to false alarm filtering. According to the invention, methods such as information entropy, a hidden Markov chain, an N-gram model and the like are adopted to extract features for modeling and predicting suspicious domain names, and whether the DGA malicious program infects the host is judged by calculating statistical characteristics of suspicious domain name requests initiated by the same IP address; the method is compatible with detection of various DGA suspicious domain names, eliminates false alarms by infecting behavior characteristics of suspicious domain names requested by a host, has the advantage of low artificial participation in discrimination, has the advantages of high detection coverage rate, high recognition rate and low false alarm rate, and has practical application value.

Description

technical field [0001] The invention relates to the transmission of digital information, such as the technical field of telegram communication, and in particular to a detection method for a DGA malware-infected host. Background technique [0002] DGA domain name refers to a series of random domain names generated by Domain Generation Algorithm. DGA malware refers to the use of DGA algorithm to generate a large number of dynamically changing domain names, so as to avoid the detection of threat intelligence and domain name blacklists. It is often used by zombies Network (Botnet). Famous DGA malware families include conficker, zeus, etc. [0003] Using DGA domain names to spread and control malware is relatively hidden and difficult to track. Attackers use algorithms to select one or more random domain names generated every day to register as C2 server domain names, and then control the infected hosts. Some threat intelligence systems cannot effectively detect the reputation ...

AI Technical Summary

Problems solved by technology

[0009] In summary, the existing technology mainly trains machine learning classifiers or constructs neural networks to identify malicious domain names by extracting the features of the DGA domain name itself. It has comparative advantages in feature selection, algorithm optimization, and false positive screening in actual scenarios. Big difficulty, unable to achieve efficient detection results for all types of DGA domain names

Images