Malicious domain name detection method and device based on time accompaniment

Abstract

The embodiment of the present invention provides a malicious domain name detection method and device based on time accompaniment. The method includes: obtaining domain name system traffic in a target time period, marking the domain names therein, marking known malicious domain names as initial domain names; cutting the target time period into time windows based on the initial domain name, and determining other domain names that appear with the initial domain name as associated domain names based on the time window; clustering the initial domain name and the associated domain name based on the time window, and determining the associated domain name of the same category as the initial domain name as a malicious domain name family. The embodiment of the present invention does not need to rely on a well-labeled training set and has good generalization ability.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a malicious domain name detection method and device based on time accompaniment. Background Art

[0002] The Domain Name System (DNS) is a basic service of the Internet. It is a distributed database that maps domain names and IP addresses to each other, making it easier for people to access the Internet. DNS is a distributed hierarchical system consisting of trusted root servers and hundreds of millions of authoritative name servers. The Domain Name System protocol is a key infrastructure in the Internet by implementing a two-way association between domain names and IP addresses. Most applications in the Internet architecture rely on DNS, such as websites and mail systems.

[0003] Malicious domain names refer to a type of website with malicious links. Such websites usually exploit loopholes in application software or browsers to implant malicious codes such as Trojans and virus programs in websites, and use disguised website service content to induce users to visit. Once users enter these websites, they may be "hit", causing their computers to be infected by malicious codes, which in turn causes security problems. Malicious domain names play an important role in illegal network attacks.

[0004] In recent years, a large number of methods have emerged to detect malicious domain names using DNS traffic. Their main purpose is to defend and warn users before they access these malicious domain names, thereby mitigating the threats and damages caused by attack activities. A common method is to manually extract features for each domain name from samples, DNS traffic, web page information and other data, and use these features to identify malicious domain names in DNS traffic.

[0005] The existing methods of using DNS traffic to detect malicious domain names have the following problems:

[0006] 1. The features are manually analyzed from existing network behaviors, which are lagging and cannot detect malicious domain names with unknown features;

[0007] 2. The signature is closely related to specific malicious behavior. If the attacker adjusts the strategy appropriately, the signature detection method will fail.

[0008] 3. Signatures are generally targeted at specific versions of malware and cannot detect other versions or variants of the malware. Summary of the invention

[0009] In view of the problems in the prior art, an embodiment of the present invention provides a malicious domain name detection method and device based on time association.

[0010] Specifically, the embodiment of the present invention provides the following technical solutions:

[0011] In a first aspect, an embodiment of the present invention provides a malicious domain name detection method based on time association, comprising:

[0012] Obtain the domain name system traffic in the target time period, mark the domain names in the obtained domain name system traffic, and mark the known malicious domain names as the initial domain names;

[0013] Based on the marked initial domain name, the target time period is divided into time windows, and based on the time windows, other marked domain names that appear with the initial domain name are determined as associated domain names;

[0014] Extracting frequency features of the associated domain names based on the time window, and filtering the associated domain names based on the extracted frequency features to obtain target malicious domain names;

[0015] The initial domain name and the associated domain name are clustered based on the time window, and the associated domain name in the same category as the initial domain name is determined as a malicious domain name family.

[0016] Furthermore, the step of dividing the target time period into time windows based on the marked initial domain name, and determining other marked domain names that appear with the initial domain name as associated domain names based on the time windows includes:

[0017] Taking the marked initial domain name as the center, the target time period is cut according to a preset time window threshold to obtain a time window of the target time period;

[0018] The marked other domain names appearing in all time windows of the target time period are determined as the associated domain names.

[0019] Furthermore, clustering the initial domain name and the associated domain name based on the time window, and determining the associated domain name of the same category as the initial domain name as a malicious domain name family, includes:

[0020] Extracting frequency features of the associated domain names based on the time window, and filtering the associated domain names based on the extracted frequency features to obtain target malicious domain names;

[0021] Clustering the initial domain name and the target malicious domain name based on the time window to obtain categories of the initial domain name and the target malicious domain name;

[0022] Based on the frequency of occurrence of domain name categories and the length of domain name sub-segments formed by continuous occurrence of domain names of the same category, the domain name categories obtained by clustering are filtered, and the target malicious domain names that are of the same category as the initial domain name after filtering are determined as malicious domain name families.

[0023] Further, the extracting the frequency features of the associated domain names based on the time window, and filtering the associated domain names based on the extracted frequency features to obtain the target malicious domain names, includes:

[0024] Based on the time window, extract the occurrence frequency and the inverse frequency of the associated domain name by TF-IDF;

[0025] The associated domain name whose occurrence frequency and reverse frequency are respectively greater than a preset first frequency threshold and a preset second frequency threshold is determined as the target malicious domain name.

[0026] Furthermore, extracting the occurrence frequency and the inverse frequency of the associated domain name based on the time window by TF-IDF includes:

[0027] Counting the number of times the associated domain name appears in all time windows of the target time period as the appearance frequency of the associated domain name;

[0028] The logarithm of the ratio of the number of all time windows in the target time period to the number of time windows in which the associated domain name appears is determined as the inverse frequency of the associated domain name.

[0029] Furthermore, clustering the initial domain name and the target malicious domain name based on the time window to obtain categories of the initial domain name and the target malicious domain name includes:

[0030] Vectorizing the initial domain name and the target malicious domain name based on the time window to obtain a domain name vector corresponding to each time window;

[0031] The domain name vectors are clustered to obtain categories of the initial domain name and the target malicious domain name.

[0032] Furthermore, vectorizing the initial domain name and the target malicious domain name based on the time window to obtain a domain name vector corresponding to each time window includes:

[0033] For each time window, the positions where the initial domain name and each target malicious domain name appear are set to 1, and the positions where the initial domain name and the target malicious domain name do not appear are set to 0, to obtain a domain name vector corresponding to the time window.

[0034] Furthermore, filtering the domain name categories obtained by clustering based on the frequency of occurrence of the domain name categories and the length of the domain name sub-segment formed by the continuous occurrence of domain names of the same category includes:

[0035] Based on the domain name categories obtained by clustering, determine the frequency of each domain name category and the length of the domain name sub-segment formed by the continuous appearance of domain names of the same category;

[0036] The initial domain name and target malicious domain name whose frequency of occurrence of the domain name category and the length of the domain name sub-segment are respectively less than a preset third frequency threshold and sub-segment length threshold are filtered out.

[0037] Furthermore, the domain name categories obtained by clustering determine the frequency of occurrence of each domain name category and the length of a domain name sub-segment formed by continuous occurrence of domain names of the same category, including:

[0038] Bringing the categories of the initial domain name and the target malicious domain name obtained by clustering into the domain name vector;

[0039] Count the number of times each category of domain names appears in all domain name vectors as the frequency of occurrence of the corresponding domain name category;

[0040] The number of consecutive occurrences of domain names of the same category in all domain name vectors is determined as the length of the corresponding domain name sub-segment.

[0041] In a second aspect, an embodiment of the present invention further provides a malicious domain name detection device based on time association, including:

[0042] A pre-processing module, used to obtain the domain name system traffic in the target time period, mark the domain names in the obtained domain name system traffic, and mark the known malicious domain names as the initial domain names;

[0043] A window segmentation module, configured to segment the target time period into time windows based on the marked initial domain name, and determine other marked domain names that appear with the initial domain name as associated domain names based on the time windows;

[0044] The domain name family extraction module is used to cluster the initial domain name and the associated domain name based on the time window, and determine the associated domain name of the same category as the initial domain name as a malicious domain name family.

[0045] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the malicious domain name detection method based on time accompaniment as described in the first aspect are implemented.

[0046] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the malicious domain name detection method based on time accompaniment as described in the first aspect.

[0047] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the malicious domain name detection method based on time accompaniment described in the first aspect.

[0048] The malicious domain name detection method and device based on time accompaniment provided by the embodiment of the present invention detect malicious domain names by mining the time accompaniment relationship between domain name resolution requests. It only needs to mark the known malicious domain names in the domain name system traffic to expand potential malicious domain names and malicious domain name families that are strongly associated with the marked malicious domain names. It does not need to rely on the features of the malicious domain names in the labeled training set, has good generalization ability, can perform real-time detection of malicious domain names in the domain name system traffic, can promptly discover unknown potential malicious domain names in the domain name system traffic, and uses the expanded malicious domain name family. There is no need to customize detection features for each malicious domain name, has a high precision rate, has important application value in the field of malicious domain name detection, can effectively reduce the harm caused by malicious domain name attacks, and provides important technical support for network security services, emergency response and other businesses. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0050] Figure 1 It is a flowchart of a malicious domain name detection method based on time accompaniment provided by an embodiment of the present invention;

[0051] Figure 2 It is a schematic diagram of a process of clustering initial domain names and associated domain names to obtain a malicious domain name family provided by an embodiment of the present invention;

[0052] Figure 3 It is a schematic diagram of a process of obtaining a target malicious domain name based on the frequency characteristics of an associated domain name provided by an embodiment of the present invention;

[0053] Figure 4 It is a flow chart of determining a malicious domain name family based on clustering and filtering the initial domain name and the target malicious domain name provided by an embodiment of the present invention;

[0054] Figure 5 It is a flow chart of an application scenario of a malicious domain name detection method based on time accompaniment provided by the present invention;

[0055] Figure 6 It is a structural schematic diagram of a malicious domain name detection device based on time accompaniment provided by an embodiment of the present invention;

[0056] Figure 7 It is a schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] The embodiment of the present invention uses the time correlation of domain name resolution requests to detect unknown malicious domain names from the perspective of the correlation of domain name resolution requests. For example, when the browser of the client loads a web page, if the IP address of the loaded web page is not cached in the browser, the client first sends a domain name resolution request to the server of the domain name system, resolves the domain name corresponding to the loaded web page into the corresponding IP address, and feeds back to the client through a response message. After the browser starts to render the page, when the content of the web page begins to appear, it will further trigger the link embedded in the page to send an additional domain name resolution request to the server of the domain name system. These domain name resolution requests sent during the web page loading process are to jointly complete the display of this page, and these domain name resolution requests show the characteristics of co-occurrence. Malicious domain names also have this kind of time-accompanying relationship, and different malicious domain names will appear together in a malicious network activity. For example, malware usually uses domain names generated by DGA (domain generation algorithms) to implement C&C updates and connections. The embodiment of the present invention marks malicious domain names as seeds, and uses the time-accompanying characteristics of domain name resolution requests to perform grouping and clustering to discover new malicious domain names and malicious domain name families.

[0059] The following will be combined Figure 1-Figure 5 The present invention describes a method for detecting malicious domain names based on time association provided by an embodiment of the present invention.

[0060] See also Figure 1 , Figure 1 is a flow chart of a malicious domain name detection method based on time accompaniment provided by an embodiment of the present invention, Figure 1 The time-based malicious domain name detection method shown can be executed by a time-based malicious domain name detection device, which can be set on a server. For example, the server can be a physical server including an independent host, a virtual server carried by a host cluster, a cloud server, etc., which is not limited in the embodiment of the present invention. Figure 1 As shown, the malicious domain name detection method based on time accompaniment at least includes:

[0061] 101, obtain the domain name system traffic in the target time period, mark the domain names in the obtained domain name system traffic, and mark the known malicious domain names as initial domain names.

[0062] In the embodiment of the present invention, the domain name system traffic may be the traffic generated by the interaction between the server of the domain name system and the client. For example, the domain name system traffic may include a domain name resolution request issued by the client. The domain name system traffic in the target time period may be obtained from the server of the domain name system for detecting malicious domain names. For example, the target time period may be several days or several hours. The embodiment of the present invention does not limit the time corresponding to the target time period. The domain name system traffic may be obtained from the server of the domain name system by using the existing method for collecting domain name system traffic, or the method for collecting domain name system traffic may be designed as needed to obtain the domain name system traffic from the server of the domain name system. The embodiment of the present invention does not limit the method for obtaining the domain name system traffic from the server of the domain name system.

[0063] In an embodiment of the present invention, after obtaining the domain name system traffic of the target time period from the server of the domain name system, the domain names in the obtained domain name system traffic can be marked according to the characteristics of the domain names, so that the same domain name has the same mark in the obtained domain name system traffic, and different domain names have different marks in the obtained domain name system traffic, and the known malicious domain names in the obtained domain name system traffic can be marked as initial domain names according to the known malicious domain names. Among them, the known malicious domain name can be one malicious domain name, or it can also be a plurality of different malicious domain names, which is not limited in the embodiment of the present invention. That is to say, the malicious domain name detection method based on time accompaniment provided in the embodiment of the invention can detect a known malicious domain name, or it can simultaneously process a plurality of different known malicious domain names in parallel. The embodiment of the present invention does not limit the implementation method of marking the domain names in the domain name system traffic and marking the known malicious domain names as initial domain names.

[0064] 102 , dividing the target time period into time windows based on the marked initial domain name, and determining other marked domain names that appear with the initial domain name as associated domain names based on the time windows.

[0065] In an embodiment of the present invention, after obtaining the domain name system traffic of the target time period and marking the domain name in the domain name system traffic, and marking the known malicious domain name as the initial domain name, the entire target time period can be cut into multiple identical time windows according to the initial domain name marked in the domain name system traffic, so that each time window includes an initial domain name. For example, the target time period can be 1 hour, and the time window can be a few minutes or seconds. The embodiment of the present invention does not limit the time corresponding to the target time period and the time window, and the implementation method of cutting the target time period into time windows. In some optional examples, a time window threshold can be preset, and the marked initial domain name is used as the center, and the target time period is cut with the preset time window threshold to obtain the time window of the target time period. For example, the domain name system traffic of 1 hour is obtained from the domain name system server, and 30 identical initial domain names are included in the obtained 1 hour domain name system traffic. The time point at which the 30 identical initial domain names appear can be used as the center of the time window, and 1 minute is used as the time window threshold. 30 seconds can be taken before and after the time point at which each initial domain name appears, and 1 hour can be cut into 30 time windows. After the target time period is divided into time windows, other marked domain names appearing in all time windows obtained by dividing the target time period can be further determined, and the other marked domain names appearing in all time windows of the target time period are determined as associated domain names as domain names that appear with the initial domain name.

[0066] 103. Cluster the initial domain name and the associated domain name based on the time window, and determine the associated domain name in the same category as the initial domain name as a malicious domain name family.

[0067] In an embodiment of the present invention, after the target time period is cut into time windows and the associated domain names of the initial domain name are determined, the initial domain name and the associated domain names can be clustered according to the multiple time windows obtained by cutting the target time period to obtain the categories of the initial domain name and the associated domain name, and the associated domain names of the same category as the initial domain name can be determined as malicious domain name families, so that potential malicious domain names and malicious domain name families in the domain name system traffic can be extracted according to the initial domain name. The embodiment of the present invention does not limit the implementation method of clustering the initial domain name and the associated domain name. For example, commonly used clustering methods such as K-means clustering, hierarchical clustering or X-Means clustering can be used.

[0068] The malicious domain name detection method based on time accompaniment provided by the embodiment of the present invention detects malicious domain names by mining the time accompaniment relationship between domain name resolution requests. It only needs to mark the known malicious domain names in the domain name system traffic to expand potential malicious domain names and malicious domain name families that are strongly associated with the marked malicious domain names. It does not need to rely on the features of the malicious domain names in the labeled training set, has good generalization ability, can perform real-time detection of malicious domain names in the domain name system traffic, can timely discover unknown potential malicious domain names in the domain name system traffic, and uses the expanded malicious domain name family. There is no need to customize detection features for each malicious domain name, has a high precision rate, has important application value in the field of malicious domain name detection, can effectively reduce the harm caused by malicious domain name attacks, and provides important technical support for network security services, emergency response and other businesses.

[0069] See also Figure 2 , Figure 2 FIG. 1 is a flow chart of clustering the initial domain name and the associated domain name to obtain the malicious domain name family provided by an embodiment of the present invention, such as Figure 2 As shown, the initial domain name and the associated domain name are clustered based on the time window, and the associated domain name of the same category as the initial domain name is determined as a malicious domain name family, which includes at least:

[0070] 201 , extracting frequency features of associated domain names based on a time window, and filtering associated domain names based on the extracted frequency features to obtain target malicious domain names.

[0071] In an embodiment of the present invention, the frequency characteristics of the determined associated domain names can be extracted according to the multiple time windows obtained by cutting the target time period, and the importance of the associated domain names can be quantified by the frequency characteristics of the associated domain names, wherein the importance of the associated domain names can include the importance and general importance of the associated domain names for the entire target time period. Generally, domain names with high popularity have high importance in the domain name system traffic, but low general importance, while malicious domain names have high importance and general importance in the domain name system traffic. Therefore, based on the above characteristics of the domain names, the domain names with high popularity in the associated domain names can be filtered according to the frequency characteristics of the extracted associated domain names, and the associated domain names with high popularity filtered out are determined as target malicious domain names, so that potential malicious domain names in the domain name system traffic can be extracted according to the initial domain names. The embodiment of the present invention does not limit the implementation method of extracting the frequency characteristics of the associated domain names according to the time window to obtain the importance of the associated domain names. For example, the existing method can be used to extract the frequency characteristics of the associated domain names to obtain the frequency characteristics used to characterize the importance of the associated domain names, or a method for extracting the frequency characteristics of the associated domain names can be designed as needed to obtain the frequency characteristics used to characterize the importance of the associated domain names.

[0072] 202 , clustering the initial domain name and the target malicious domain name based on the time window to obtain categories of the initial domain name and the target malicious domain name.

[0073] In an embodiment of the present invention, after the target malicious domain name is obtained by extracting the frequency characteristics of the associated domain name according to the time window, the initial domain name and the target malicious domain name can be clustered to obtain the categories of the initial domain name and the target malicious domain name. The embodiment of the present invention does not limit the implementation method of clustering the initial domain name and the target malicious domain name. For example, X-Means can be used to cluster the initial domain name and the target malicious domain name, and the number of clusters k does not need to be specified. The selection of the number of clusters k is determined by the Bayesian Information Criterion (BIC).

[0074] 203. Based on the frequency of occurrence of domain name categories and the length of domain name sub-segments formed by continuous occurrence of domain names of the same category, the domain name categories obtained by clustering are filtered, and the target malicious domain names that are in the same category as the initial domain name after filtering are determined as malicious domain name families.

[0075] In an embodiment of the present invention, after the initial domain name and the target malicious domain name are clustered according to the time window, the domain name category obtained by clustering can be filtered according to pre-set conditions to filter out the target malicious domain name that is not closely associated with the initial domain name category, wherein the pre-set conditions can be pre-set according to the requirements of the malicious domain name family, and can include the frequency characteristics of the domain name category and the number characteristics of the continuous appearance of the domain name category, wherein the domain names of the same category that appear continuously can constitute a domain name sub-segment, and the number of domain names of the same category that appear continuously can be used to characterize the length of the domain name sub-segment. After filtering the domain name category according to the frequency of the domain name category and the length of the domain name sub-segment, the malicious domain name of the same category as the initial domain name can be determined as a malicious domain name family, so that the potential malicious domain name family in the domain name system traffic can be extracted according to the initial domain name.

[0076] This embodiment can filter the associated domain names and the domain name categories obtained by clustering, thereby removing the domain names with high popularity in the associated domain names and the categories of the domain names obtained by clustering that do not meet the requirements of the malicious domain name family, and can further improve the precision rate of the expanded potential malicious domain names and malicious domain name families.

[0077] See also Figure 3 , Figure 3 FIG. 1 is a flow chart of obtaining a target malicious domain name based on the frequency characteristics of an associated domain name according to an embodiment of the present invention. Figure 3 As shown, frequency features of associated domain names are extracted based on the time window, and associated domain names are filtered based on the extracted frequency features, and the target malicious domain names obtained include at least:

[0078] 301, based on the time window, extract the occurrence frequency and inverse frequency of the associated domain name through TF-IDF.

[0079] In an embodiment of the present invention, the occurrence frequency TF and inverse frequency IDF of the associated domain name can be extracted by TF-IDF (term frequency-inverse document frequency) according to multiple time windows obtained by cutting the target time period, wherein the occurrence frequency TF of the associated domain name is used to characterize the importance of the associated domain name for the entire target time period, and the inverse frequency IDF of the associated domain name is used to characterize the general importance of the associated domain name for the entire target time period. The embodiment of the present invention does not limit the implementation method of extracting the occurrence frequency and inverse frequency of the associated domain name by TF-IDF according to the time window.

[0080] In some optional examples, for each associated domain name, the frequency of the associated domain name appearing in all time windows of the target time period can be counted as the occurrence frequency TF of the associated domain name. For example, the target time period includes 30 time windows, the associated domain name appears once in 20 of the time windows, and the occurrence frequency TF of the associated domain name is 20; for each associated domain name, the inverse frequency IDF of the associated domain name can be determined by determining the logarithm of the ratio of the number of all time windows of the target time period to the number of time windows in which the associated domain name appears. For example, the target time period includes 30 time windows, the associated domain name appears in 20 of the time windows, and the inverse frequency IDF of the associated domain name is lg1.5.

[0081] 302 , determine the associated domain name whose appearance frequency and reverse frequency are respectively greater than the preset first frequency threshold and the second frequency threshold as the target malicious domain name.

[0082] In the embodiment of the present invention, since the appearance frequency TF of a domain name with high popularity is large and the reverse frequency IDF is small, while the appearance frequency TF and reverse frequency IDF of a malicious domain name are both large, a first frequency threshold of the appearance frequency and a second frequency threshold of the reverse frequency can be pre-set. After the appearance frequency and reverse frequency of the associated domain name are extracted through TF-IDF, the associated domain name can be filtered according to the pre-set first frequency threshold and second frequency threshold, and the associated domain name whose appearance frequency TF and reverse frequency IDF simultaneously exceed the first frequency threshold and the second frequency threshold can be determined as the target malicious domain name.

[0083] See also Figure 4 , Figure 4 FIG. 1 is a flow chart of determining a malicious domain name family based on clustering and filtering the initial domain name and the target malicious domain name provided by an embodiment of the present invention, such as Figure 4As shown, the initial domain name and the target malicious domain name are clustered based on the time window to obtain the categories of the initial domain name and the target malicious domain name. Based on the frequency of occurrence of the category domain name and the length of the domain name sub-segment composed of the continuous occurrence of domain names of the same category, the domain name category obtained by clustering is filtered, and the target malicious domain name of the same category as the initial domain name after filtering is determined as a malicious domain name family. At least including:

[0084] 401, vectorize the initial domain name and the target malicious domain name based on the time window to obtain the domain name vector corresponding to each time window.

[0085] In an embodiment of the present invention, the initial domain name and the target malicious domain name can be vectorized according to each time window obtained by cutting the target time period, and the domain name vector corresponding to each time window can be obtained. The embodiment of the present invention does not limit the implementation method of vectorizing the initial domain name and the target malicious domain name according to the time window. In some optional examples, the domain name vector can be represented by a Boolean type vector, and for each time window, the position where the initial domain name and each target malicious domain name appear can be set to 1, and the position where the initial domain name and the target malicious domain name do not appear can be set to 0, so as to obtain the domain name vector corresponding to each time window. For example, the target time period includes two time windows S1 and S2. For each time window, the initial domain name a appears in the center of the time window. The time point where the initial domain name a appears can be set to 1, the time point where each target malicious domain name vi appears can be set to 1, and the time point where the initial domain name a and the target malicious domain name vi do not appear can be set to 0, so as to obtain the domain name vectors S1:{0,1,1,1,1,0,1} and S2:{0,0,1,1,1,0,0} corresponding to the two time windows.

[0086] 402, clustering the domain name vectors to obtain categories of the initial domain name and the target malicious domain name.

[0087] In an embodiment of the present invention, after the initial domain name and the target malicious domain name are vectorized to obtain the domain name vector, the obtained domain name vector can be clustered to obtain the category of the initial domain name and the target malicious domain name in each domain name vector. The embodiment of the present invention does not limit the implementation method of clustering the domain name vector. For example, X-Means can be used to cluster the domain name vector, and the number of clusters k does not need to be specified. The selection of the number of clusters k is determined by the Bayesian Information Criterion (BIC).

[0088] 403. Based on the domain name categories obtained through clustering, determine the frequency of occurrence of each domain name category and the length of a domain name sub-segment formed by consecutive occurrences of domain names of the same category.

[0089] In some optional examples, after clustering the domain name vector to obtain the categories of the initial domain name and the target malicious domain name in the domain name vector, the categories of the initial domain name and the target malicious domain name obtained by clustering can be brought into the domain name vector, and for each domain name category obtained by clustering, the number of times the domain name of the category appears in all domain name vectors in the target time period is counted as the frequency of occurrence of the corresponding domain name category, and the number of consecutive occurrences of domain names of the same category in all domain name vectors in the target time period is determined as the length of the corresponding domain name sub-segment. For example, the domain name vector obtained by bringing the categories of the initial domain name and the target malicious domain name obtained by clustering into the domain name vector is represented as {0,1,1,1,1,1,0,2,2,0,0}, where 1 and 2 represent two domain name categories obtained by clustering, respectively, and two domain name sub-segments {1,1,1,1,1} and {2,2} can be extracted from the domain name vector, where the domain name sub-segment {1,1,1,1,1} includes the initial domain name located at the center of the time window, the length of the domain name sub-segment {1,1,1,1,1} is 5, and the length of the domain name sub-segment {2,2} is 2.

[0090] 404, filter out the initial domain name and target malicious domain name whose domain name category occurrence frequency and domain name sub-segment length are respectively less than a preset third frequency threshold and sub-segment length threshold.

[0091] In an embodiment of the present invention, a third frequency threshold and a sub-segment length threshold can be pre-set according to the requirements of the malicious domain name family. After determining the frequency of occurrence of the domain name category and the length of the domain name sub-segment formed by the continuous occurrence of domain names of the same category, the frequency of occurrence of the domain name category can be filtered according to the pre-set third frequency threshold, and the domain name category whose frequency of occurrence of the domain name category is less than the pre-set third frequency threshold is filtered out. Then, the length of the domain name sub-segment is filtered according to the pre-set sub-segment length threshold, and the domain name sub-segment whose length is less than the pre-set sub-segment length threshold is filtered out.

[0092] 405, the target malicious domain name that is in the same category as the initial domain name after filtering is determined as a malicious domain name family.

[0093] In an embodiment of the present invention, after filtering out the initial domain names and target malicious domain names whose domain name category occurrence frequencies and domain name sub-segment lengths are less than a preset threshold, the specific domain names of each target malicious domain name in the domain name category can be determined based on the filtered domain name category, thereby obtaining the specific domain names of the target malicious domain names of the same category as the initial domain name, and the specific domain names corresponding to the initial domain name and the specific domain names of the target malicious domain names of the same category constitute a malicious domain name family.

[0094] See also Figure 5 , Figure 5FIG. 1 is a flow chart of an application scenario of a malicious domain name detection method based on time accompaniment provided by the present invention, such as Figure 5 As shown, this embodiment first collects the domain name system traffic of the target time period from the server of the domain name system as a data set, and marks the domain names therein, and marks the known malicious domain names as the initial domain names. The subsequent detection process mainly includes window segmentation, domain name extraction and domain name family extraction. Among them, window segmentation is to divide the target time period into time windows according to the initial domain name through the time window threshold, and according to each time window, other domain names that appear in the same time window with the initial domain name are determined as associated domain names; domain name extraction is to extract the frequency characteristics TF and IDF of the associated domain names according to the divided time windows, and filter the associated domain names according to the TF threshold and IDF threshold, and determine the associated domain names that exceed the TF threshold and IDF threshold at the same time as the target malicious domain name; domain name family extraction is to vectorize the initial domain name and the target malicious domain name according to the divided time windows, obtain the domain name vector corresponding to each time window, cluster the domain name vector through X-Means, and filter the clustering results, filter out the domain name categories with low frequency and domain name sub-segments with small length, and determine the target malicious domain name that is in the same category as the initial domain name after filtering as the malicious domain name family. Experiments have proved that the precision rate of this embodiment can reach 90%. In the present invention, the precision rate refers to the ratio of the number of correct results predicted by the model to the total number of model predictions. For example, if the total number of malicious domain names predicted by the model is 1000 and the number of correct predictions in the model prediction results is 900, then the precision rate is 900 / 1000=90%.

[0095] The malicious domain name detection device based on time accompaniment provided by the present invention is described below. The malicious domain name detection device based on time accompaniment described below and the malicious domain name detection method based on time accompaniment described above can refer to each other.

[0096] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a malicious domain name detection device based on time accompaniment provided by an embodiment of the present invention, Figure 6 The malicious domain name detection device based on time association can be used to perform Figure 1 Malicious domain name detection methods based on time accompaniment, such as Figure 6 As shown, the time-based malicious domain name detection device at least includes:

[0097] The pre-processing module 610 is used to obtain the domain name system traffic in the target time period, mark the domain names in the obtained domain name system traffic, and mark the known malicious domain names as initial domain names.

[0098] The window segmentation module 620 is used to segment the target time period into time windows based on the marked initial domain name, and determine other marked domain names that appear with the initial domain name as associated domain names based on the time windows.

[0099] The domain name family extraction module 630 is used to cluster the initial domain name and the associated domain names based on the time window, and determine the associated domain names in the same category as the initial domain name as a malicious domain name family.

[0100] Optionally, the window segmentation module 620 includes:

[0101] The window segmentation unit is used to segment the target time period with the marked initial domain name as the center and with a preset time window threshold to obtain a time window of the target time period.

[0102] The domain name determination unit is used to determine other marked domain names appearing in all time windows of the target time period as associated domain names.

[0103] Optionally, the domain name family extraction module 630 includes:

[0104] The domain name extraction unit is used to extract the frequency characteristics of the associated domain names based on the time window, and filter the associated domain names based on the extracted frequency characteristics to obtain the target malicious domain names.

[0105] The clustering unit is used to cluster the initial domain name and the target malicious domain name based on the time window to obtain the categories of the initial domain name and the target malicious domain name.

[0106] The domain name family extraction unit is used to filter the domain name categories obtained by clustering based on the frequency of occurrence of the domain name categories and the length of the domain name sub-segment composed of the continuous occurrence of domain names of the same category, and determine the target malicious domain names that are of the same category as the initial domain name after filtering as malicious domain name families.

[0107] Optionally, the domain name extraction unit includes:

[0108] The feature extraction subunit is used to extract the occurrence frequency and inverse frequency of the associated domain name through TF-IDF based on the time window.

[0109] The domain name filtering subunit is used to determine the associated domain names whose appearance frequency and reverse frequency are respectively greater than the preset first frequency threshold and second frequency threshold as target malicious domain names.

[0110] Optionally, the feature extraction subunit is used to:

[0111] Count the number of times the associated domain name appears in all time windows of the target time period as the occurrence frequency of the associated domain name;

[0112] The logarithm of the ratio of the number of all time windows in the target time period to the number of time windows in which the associated domain name appears is determined as the inverse frequency of the associated domain name.

[0113] Optionally, the clustering unit comprises:

[0114] The vector generation subunit is used to vectorize the initial domain name and the target malicious domain name based on the time window to obtain the domain name vector corresponding to each time window.

[0115] The category extraction subunit is used to cluster the domain name vectors to obtain the categories of the initial domain name and the target malicious domain name.

[0116] Optionally, the vector generation subunit is used to set the position where the initial domain name and each target malicious domain name appear to 1 for each time window, and set the position where the initial domain name and the target malicious domain name do not appear to 0, to obtain a domain name vector corresponding to the time window.

[0117] Optionally, the domain name family extraction unit includes:

[0118] The vector processing subunit is used to determine the frequency of occurrence of each domain name category and the length of a domain name sub-segment formed by continuous occurrence of domain names of the same category based on the domain name categories obtained by clustering.

[0119] The category filtering subunit is used to filter out the initial domain names and target malicious domain names whose domain name category occurrence frequency and domain name sub-segment length are respectively less than a preset third frequency threshold and sub-segment length threshold.

[0120] Optionally, the vector processing subunit is used to:

[0121] Bring the categories of the initial domain name and target malicious domain name obtained by clustering into the domain name vector;

[0122] Count the number of times each category of domain names appears in all domain name vectors as the frequency of occurrence of the corresponding domain name category;

[0123] The number of consecutive occurrences of domain names of the same category in all domain name vectors is determined as the length of the corresponding domain name sub-segment.

[0124] Figure 7 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 7As shown, the electronic device may include: a processor 710, a communication interface 720, a memory 730 and a communication bus 740, wherein the processor 710, the communication interface 720 and the memory 730 communicate with each other through the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute the following method: obtain the domain name system traffic of the target time period, mark the domain names in the obtained domain name system traffic, and mark the known malicious domain names as the initial domain names; cut the target time period into time windows based on the marked initial domain names, and determine the marked other domain names that appear with the initial domain names as associated domain names based on the time windows; cluster the initial domain names and the associated domain names based on the time windows, and determine the associated domain names of the same category as the initial domain names as the malicious domain name family.

[0125] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0126] On the other hand, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the methods provided by the above embodiments, for example, including: obtaining domain name system traffic in a target time period, marking the domain names in the obtained domain name system traffic, and marking known malicious domain names as initial domain names; cutting the target time period into time windows based on the marked initial domain names, and determining other marked domain names that appear with the initial domain name as associated domain names based on the time windows; clustering the initial domain names and the associated domain names based on the time windows, and determining the associated domain names that are in the same category as the initial domain name as a malicious domain name family.

[0127] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0128] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting malicious domain names based on time accompaniment, characterized in that: include: Obtain the domain name system traffic in the target time period, mark the domain names in the obtained domain name system traffic, and mark the known malicious domain names as the initial domain names; Based on the marked initial domain name, the target time period is divided into time windows, and based on the time windows, other marked domain names that appear with the initial domain name are determined as associated domain names; Clustering the initial domain name and the associated domain name based on the time window, and determining the associated domain name in the same category as the initial domain name as a malicious domain name family; The clustering of the initial domain name and the associated domain name based on the time window, and determining the associated domain name in the same category as the initial domain name as a malicious domain name family, includes: Extracting frequency features of the associated domain names based on the time window, and filtering the associated domain names based on the extracted frequency features to obtain target malicious domain names; Clustering the initial domain name and the target malicious domain name based on the time window to obtain categories of the initial domain name and the target malicious domain name; Based on the frequency of occurrence of domain name categories and the length of domain name sub-segments formed by continuous occurrence of domain names of the same category, the domain name categories obtained by clustering are filtered, and the target malicious domain names that are of the same category as the initial domain name after filtering are determined as malicious domain name families.

2. The method for detecting malicious domain names based on time association according to claim 1 is characterized in that: The step of dividing the target time period into time windows based on the marked initial domain name, and determining other marked domain names that appear with the initial domain name as associated domain names based on the time windows includes: Taking the marked initial domain name as the center, the target time period is cut according to a preset time window threshold to obtain a time window of the target time period; The marked other domain names appearing in all time windows of the target time period are determined as the associated domain names.

3. The method for detecting malicious domain names based on time association according to claim 1, characterized in that: The extracting the frequency feature of the associated domain name based on the time window, and filtering the associated domain name based on the extracted frequency feature to obtain the target malicious domain name includes: Based on the time window, extract the occurrence frequency and the inverse frequency of the associated domain name by TF-IDF; The associated domain name whose occurrence frequency and reverse frequency are respectively greater than a preset first frequency threshold and a preset second frequency threshold is determined as the target malicious domain name.

4. The method for detecting malicious domain names based on time association according to claim 3 is characterized in that: The extracting the occurrence frequency and the reverse frequency of the associated domain name by TF-IDF based on the time window includes: Counting the number of times the associated domain name appears in all time windows of the target time period as the appearance frequency of the associated domain name; The logarithm of the ratio of the number of all time windows in the target time period to the number of time windows in which the associated domain name appears is determined as the inverse frequency of the associated domain name.

5. The method for detecting malicious domain names based on time association according to claim 1, characterized in that: The clustering the initial domain name and the target malicious domain name based on the time window to obtain the categories of the initial domain name and the target malicious domain name includes: Vectorizing the initial domain name and the target malicious domain name based on the time window to obtain a domain name vector corresponding to each time window; The domain name vectors are clustered to obtain categories of the initial domain name and the target malicious domain name.

6. The method for detecting malicious domain names based on time association according to claim 5 is characterized in that: The vectorizing the initial domain name and the target malicious domain name based on the time window to obtain a domain name vector corresponding to each time window includes: For each time window, the positions where the initial domain name and each target malicious domain name appear are set to 1, and the positions where the initial domain name and the target malicious domain name do not appear are set to 0, to obtain a domain name vector corresponding to the time window.

7. The method for detecting malicious domain names based on time association according to claim 1, characterized in that: The filtering of the domain name categories obtained by clustering based on the frequency of occurrence of the domain name categories and the length of the domain name sub-segment formed by the continuous occurrence of domain names of the same category includes: Based on the domain name categories obtained by clustering, determine the frequency of each domain name category and the length of the domain name sub-segment formed by the continuous appearance of domain names of the same category; The initial domain name and target malicious domain name whose frequency of occurrence of the domain name category and the length of the domain name sub-segment are respectively less than a preset third frequency threshold and sub-segment length threshold are filtered out.

8. The method for detecting malicious domain names based on time association according to claim 7 is characterized in that: The domain name categories obtained based on clustering, determining the frequency of occurrence of each domain name category and the length of the domain name sub-segment formed by the continuous occurrence of domain names of the same category, includes: Bringing the categories of the initial domain name and the target malicious domain name obtained by clustering into the domain name vector; Count the number of times each category of domain names appears in all domain name vectors as the frequency of occurrence of the corresponding domain name category; The number of consecutive occurrences of domain names of the same category in all domain name vectors is determined as the length of the corresponding domain name sub-segment.

9. A malicious domain name detection device based on time accompaniment, characterized in that: include: A pre-processing module, used to obtain the domain name system traffic in the target time period, mark the domain names in the obtained domain name system traffic, and mark the known malicious domain names as the initial domain names; A window segmentation module, configured to segment the target time period into time windows based on the marked initial domain name, and determine other marked domain names that appear with the initial domain name as associated domain names based on the time windows; A domain name family extraction module, configured to cluster the initial domain name and the associated domain name based on the time window, and determine the associated domain name of the same category as the initial domain name as a malicious domain name family; The domain name family extraction module includes: A domain name extraction unit, configured to extract the frequency characteristics of the associated domain name based on the time window, and filter the associated domain name based on the extracted frequency characteristics to obtain a target malicious domain name; A clustering unit, configured to cluster the initial domain name and the target malicious domain name based on the time window to obtain categories of the initial domain name and the target malicious domain name; The domain name family extraction unit is used to filter the domain name categories obtained by clustering based on the frequency of occurrence of the domain name categories and the length of the domain name sub-segment composed of the continuous occurrence of domain names of the same category, and determine the target malicious domain names that are of the same category as the initial domain name after filtering as malicious domain name families.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the malicious domain name detection method based on time accompaniment as described in any one of claims 1 to 8 are implemented.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the malicious domain name detection method based on time accompaniment as described in any one of claims 1 to 8 are implemented.

Images