Botnet domain name family detection method and device, equipment and storage medium

Abstract

The invention discloses a botnet domain name family detection method. The method comprises the following steps: acquiring a suspicious domain name; constructing a domain name space-time association graph based on the association of each suspicious domain name among different dimensions, wherein in the domain name space-time association graph, each suspicious domain name is used as a node, an edgeis formed between two domain names with at least one association, and the association between the two domain names is used as an attribute value of the edge; and according to the judgment index of thecompactness of each node in graph calculation, determining to obtain domain names in compact connection in the domain name space-time association graph, and taking a set of the corresponding domain names as a botnet domain name family. According to the method, the relevance between different dimensions of the domain names is uniformly expressed in the form of the association graph, so that the method has higher detection capability. Meanwhile, the botnet domain name family can be detected more quickly, and the method has wider applicability. In addition, the invention further provides a botnet domain name family detection device, botnet domain name family detection equipment and a computer readable storage medium which have the technical advantages.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a detection method, device, equipment and computer-readable storage medium of a botnet domain name family. Background technique [0002] Botnets pose a serious threat to network security. Criminals use botnets to launch Distributed Denial of Service (DDoS), malicious mining, information theft, sending spam, etc., seriously endangering countries, enterprises, organizations and For personal interests, it is of great significance to quickly and accurately identify the communication of botnets and block them in time. A large number of botnets communicate with bot hosts by sending Command and Control (C&C) information based on the DNS protocol. [0003] The mainstream botnet domain name family detection schemes mainly include detection based on grammar features and detection based on virus traffic. [0004] The detection of botnet domain name families based on g...

AI Technical Summary

Problems solved by technology

[0006] The object of the present invention is to provide a detection method, device, equipment and computer-readable storage medium of a botnet domain name family, so as to solve the problem of single detection dimension, excessive reliance on virus sample collection, and low real-time detection in the existing botnet domain name family detection. bad question

Images