Detection method, device, equipment and storage medium of botnet domain name family

Abstract

The invention discloses a detection method of a botnet domain name family. By obtaining suspicious domain names; based on the relevance of each suspicious domain name in different dimensions, a domain name space-time correlation graph is constructed; in the domain name spatio-temporal correlation graph, each suspicious domain name is used as a Nodes, two domain names with at least one kind of correlation form an edge, and the correlation between the two domain names is used as the attribute value of the edge; according to the judgment index of the compactness of each node in the graph calculation, it is determined to obtain the domain name space-time correlation graph The closely related domain names in the domain name are used as the set of corresponding domain names as the botnet domain name family. In this application, the correlation between different dimensions between domain names is uniformly expressed in the form of a correlation graph, which has stronger detection capabilities. At the same time, it can detect zombie domain name families more quickly and has wider applicability. In addition, the present application also provides a detection device, device and computer-readable storage medium of a botnet domain name family having the above-mentioned technical advantages.

Description

technical field [0001] The present invention relates to the technical field of information security, and in particular, to a method, apparatus, device and computer-readable storage medium for detecting a botnet domain name family. Background technique [0002] Botnets pose a serious threat to network security. Criminals launch Distributed Denial of Service (DDoS) attacks through botnets, conduct malicious mining, information theft, send spam, etc., which seriously endanger countries, enterprises, organizations and For personal interests, it is of great significance to quickly and accurately identify the communication of botnets and block them in time. A large number of botnets communicate with bots by sending Command and Control (C&C) information based on the DNS protocol. [0003] The mainstream botnet domain name family detection schemes mainly include two types: detection based on grammar features and detection based on virus traffic. [0004] The detection of botnet do...

AI Technical Summary

Problems solved by technology

[0006] The object of the present invention is to provide a detection method, device, equipment and computer-readable storage medium of a botnet domain name family, so as to solve the problem of single detection dimension, excessive reliance on virus sample collection, and low real-time detection in the existing botnet domain name family detection. bad question

Images