Massive network malicious domain name identification and classification method and system

Abstract

The invention discloses a malicious domain name recognition and classification method and system based on massive domain name access logs, and the method comprises the steps: obtaining an unregistereddomain name by analyzing a domain name server response data packet in a domain name access log, detecting a malicious domain name, and recognizing an infected zombie host; and detecting viruses infected by the zombie host and communication control malicious domain names used for communication of the control end from the domain name set accessed by the zombie host. By adopting the technical schemeof the invention, the calculation complexity is relatively low, the data calculation amount is greatly reduced, and the method is suitable for efficiently identifying malicious domain names in massive domain name access logs.

Description

technical field [0001] The invention relates to the technical fields of network security and network domain name identification, in particular to a method and system for identifying and classifying massive malicious domain names. Background technique [0002] Domain Name System (Domain Name system) is a technology that maps domain names (host names) to IP addresses, enabling users to access the Internet conveniently. Malicious network attacks often use malicious domain names to spread bot viruses and steal network resources. Moreover, in order to improve their own survivability, botnets usually use IP migration or domain name migration technology to bypass traditional blacklist interception defense technology. [0003] IP migration refers to changing the IP address pointed to by a domain name regularly or irregularly by changing resource records. Its advantage is that it can hide the botnet control terminal through IP conversion and bypass the defense system based on IP bl...

AI Technical Summary

Problems solved by technology

However, the amount of domain name access data in the actual network is very large every day. If the domain name detection is performed on all DNS accesses, it will cost a huge amount of computing resources.

Therefore, the existing malicious domain name identification technology has a large amount of calculation when processing massive domain name data, and the calculation efficiency is not high or the accuracy of malicious domain name identification is not high.

Images