A method and system for identifying and classifying massive network malicious domain names

Abstract

The present invention discloses a malicious domain name identification and classification method and system based on massive domain name access logs, which detects malicious domain names and identifies infected zombie hosts by parsing unregistered domain names from domain name server response packets in domain name access logs; From the collection of domain names accessed by the zombie host, the virus infected by the zombie host and the communication control malicious domain name used by the control terminal communication are detected. By adopting the technical solution of the present invention, the calculation complexity is low, and the amount of data calculation is also greatly reduced, and is suitable for the application scenario of efficient identification of malicious domain names in massive domain name access logs.

Description

technical field [0001] The invention relates to the technical fields of network security and network domain name identification, in particular to a method and system for identifying and classifying massive malicious domain names. Background technique [0002] Domain Name System (Domain Name system) is a technology that maps domain names (host names) to IP addresses, enabling users to access the Internet conveniently. Malicious network attacks often use malicious domain names to spread bot viruses and steal network resources. Moreover, in order to improve their own survivability, botnets usually use IP migration or domain name migration technology to bypass traditional blacklist interception defense technology. [0003] IP migration refers to changing the IP address pointed to by a domain name regularly or irregularly by changing resource records. Its advantage is that it can hide the botnet control terminal through IP conversion and bypass the defense system based on IP bl...

AI Technical Summary

Problems solved by technology

However, the amount of domain name access data in the actual network is very large every day. If the domain name detection is performed on all DNS accesses, it will cost a huge amount of computing resources.

Therefore, the existing malicious domain name identification technology has a large amount of calculation when processing massive domain name data, and the calculation efficiency is not high or the accuracy of malicious domain name identification is not high.

Images