Botnet program domain name identification method and device, equipment and storage medium

Abstract

The invention discloses a zombie program domain name identification method and device, equipment and a storage medium. The method comprises the following steps: carrying out domain name feature extraction on domain names in a set time length in a domain name system (DNS) log, and determining domain name feature values respectively corresponding to a plurality of domain names in the set time length; loading the domain name feature value into a domain name classification model for identification to obtain a first suspected domain name generation algorithm (DGA) domain name set; filtering the first suspected DGA domain name set based on a domain name blacklist and a domain name whitelist to obtain a second suspected DGA domain name set; performing tracking query on each domain name in the second suspected DGA domain name set based on the DNS log to obtain access record information corresponding to each domain name; and determining an identification result of whether each domain name is a DGA domain name based on the access record information corresponding to each domain name.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method, device, equipment and storage medium for identifying a bot domain name. Background technique [0002] With the development of botnet technology, attackers use Domain Flux technology in bot programs to deal with the blocking of security technicians. The C&C (command control) domain name that the bot initiates access is based on a certain algorithm, selects a fixed feature as a random number seed, dynamically generates a changing prefix string, and then adds a fixed TLD (Top Level Domain, top-level domain name). This domain name generation algorithm is called DGA (Domain Generation Algorithm). Attackers will use the DGA algorithm to generate a large number of domain names, but only register a small number of them as C&C domain names. [0003] In related technologies, for DGA domain names generated by bots, the monitoring and detection methods mainly include: [0004] 1. ...

AI Technical Summary

Problems solved by technology

[0006] Among them, the honeypot-based detection method is complex to deploy, and requires strong technical support to reverse the captured bots, and it is found that the real-time performance of the DGA domain name is poor; the botnet detection technology based on network traffic requires long-term monitoring and comparison confirmation Similar data traffic, if the time span is short, the detection accuracy is not high; and data traffic with similar classification characteristics, if the data traffic is large, it will consume a lot of computing resources

Images