Dns tunnel identification method, dns tunnel identification device, storage medium

Abstract

The application provides a DNS tunnel identification method, a DNS tunnel identification device and a storage medium. The DNS tunnel identification method comprises the following steps: a DNS tunnel detection model establishment step, simulating a DNS tunnel, capturing DNS tunnel data and normal DNS data, grouping the DNS tunnel data and the normal DNS data according to the second last domain name, taking the features of each group of the grouped data as training data to establish a DNS tunnel detection model; a DNS tunnel suspiciousness threshold value calculation step, capturing data similar to the DNS tunnel data in the normal DNS data, grouping the data according to the second last domain name, inputting the features of each group of the grouped data into the DNS tunnel detection model, and taking the maximum value in the output values of the DNS tunnel detection model of each group of data as a first threshold value of DNS tunnel suspiciousness; and a DNS tunnel detection step, inputting the features of to-be-detected DNS data into the DNS tunnel detection model, and judging that the to-be-detected DNS data is DNS tunnel data when the output value of the DNS tunnel detection model of the to-be-detected DNS data is higher than the first threshold value of DNS tunnel suspiciousness.

Description

Technical Field

[0001] This invention relates to network security technology, and in particular to a DNS tunnel identification method, a DNS tunnel identification device, and a storage medium. Background Technology

[0002] Existing DNS (Domain Name System) tunneling detection technologies mainly employ methods such as DGA (Domain Name Generation Method) domain name judgment, threat intelligence matching, and machine learning judgment. These methods have many shortcomings and are insufficient to meet the needs of a layered defense system for network security.

[0003] Specifically, some DNS tunneling detection techniques identify DGA domains solely based on characteristics such as domain entropy and length, thus classifying them as DNS tunnels. However, this method has low accuracy and fails to consider other characteristics of DNS tunnels. Threat intelligence matching relies on the accuracy of threat intelligence; if the threat intelligence is false or invalid, it affects the DNS tunneling judgment. Existing machine learning methods lack comprehensive feature consideration and have low accuracy. Furthermore, current DNS tunneling detection technologies lack efficient mechanisms for excluding normal requests, leading to misjudgments in normal situations and easily misidentifying CNAME (alias) redirected by CDN (Content Delivery Network) and WAF (Web Application Firewall) vendors as DNS tunnel traffic. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a DNS tunnel identification technology that can improve the accuracy of DNS tunnel identification.

[0005] According to one aspect of the present invention, a DNS tunnel identification method is provided, comprising:

[0006] The steps for establishing a DNS tunnel detection model are as follows: simulate a DNS tunnel to transmit DNS tunnel data, crawl the simulated DNS tunnel data and normal DNS data from normal websites, group the crawled DNS tunnel data and normal DNS data according to the second-to-last level domain name, extract features from each group of data after grouping according to the second-to-last level domain name, and use the features of each group of data as training data to train and establish a DNS tunnel detection model.

[0007] The steps for calculating the DNS tunnel suspicion threshold are as follows: First, crawl normal DNS data that is similar to DNS tunnel data. Then, group this similar data according to the second-to-last level domain. Extract features from each group. Input these features into the established DNS tunnel detection model to obtain the output value for each group. The maximum value among the output values ​​of the DNS tunnel detection model for each group is used as the first threshold for DNS tunnel suspicion.

[0008] The DNS tunnel detection steps are as follows: extract features from the DNS data to be detected, input the features of the DNS data to be detected into the established DNS tunnel detection model to obtain the output value of the DNS data to be detected, and judge the DNS data to be detected as DNS tunnel data when the output value of the DNS tunnel detection model of the DNS data to be detected is higher than the first threshold of DNS tunnel suspicion.

[0009] According to another aspect of the present invention, a DNS tunnel identification device is provided, comprising:

[0010] A memory, on which instructions are stored; and

[0011] The processor is configured to execute instructions stored in the memory to perform the DNS tunnel identification method described above.

[0012] According to another aspect of the present invention, a computer-readable storage medium is provided, comprising computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform the DNS tunnel identification method described above.

[0013] According to the present invention, a DNS tunnel detection model is established by generating DNS tunnel data and crawling, grouping, extracting features, and training. The DNS tunnel suspicion threshold is calculated using data similar to DNS tunnel data in normal DNS data, thereby improving the detection accuracy of DNS tunnels, reducing the false positive rate, and enhancing the deep detection capability of network security. Attached Figure Description

[0014] Figure 1 This describes the training process of the DNS tunnel detection model according to an embodiment of the present invention.

[0015] Figure 2 This describes the calculation process for the DNS tunnel suspicion threshold in an embodiment of the present invention.

[0016] Figure 3 This is the detection process for real-time DNS tunnel detection in the embodiments of the present invention.

[0017] Figure 4 This is the detection process of performing DNS tunnel detection at regular intervals in the embodiments of the present invention.

[0018] Figure 5 An exemplary configuration of a computing device 500 capable of implementing a DNS tunnel identification device is shown. Detailed Implementation

[0019] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0020] In this embodiment of the invention, a DNS tunnel detection model is first established through training. Then, the DNS tunnel detection model is used to calculate the DNS tunnel suspicion threshold. During actual detection, the DNS tunnel detection model and the calculated DNS tunnel suspicion threshold are used to determine whether the DNS data to be detected is a DNS tunnel.

[0021] Figure 1 This describes the training process of the DNS tunnel detection model according to an embodiment of the present invention.

[0022] Step S101: Simulate a DNS tunnel to transmit DNS tunnel data, and capture the simulated DNS tunnel data and normal DNS data from normal websites.

[0023] As normal DNS data for a normal website, it can be obtained by crawling, for example, the DNS data of the world's top 100 websites.

[0024] In this embodiment, a predetermined number of DNS tunnel data and a predetermined number of normal DNS data can be captured, or DNS tunnel data and normal DNS data within a predetermined time window can be captured. The number of data captured and the size of the time window are not limited here.

[0025] Step S102: Group the captured DNS tunnel data and normal DNS data of normal websites according to the second-to-last level domain name to obtain the data grouped by the second-to-last level domain name.

[0026] In DNS, a domain name consists of strings separated by multiple dots ".", for example, " www.baidu.com In this implementation, the string before the first dot is called the last-level domain name, and the string after the first dot is called the penultimate-level domain name. For example, when the domain name is... www.baidu.com In this case, the last-level domain is "www", and the second-to-last-level domain is "baidu.com".

[0027] Step S103: Extract features from each group of data grouped according to the penultimate level domain name. In this embodiment, features related to DNS record types, features related to DNS requests, and features related to DNS responses are extracted. For example, the following features are extracted:

[0028] 1) Record type proportion characteristics

[0029] Record type proportion is a characteristic related to DNS record types. In this embodiment, record type proportion refers to the proportion of each DNS record type to all record types. Here, DNS record types are defined, for example, in DNS-related RFC documents. Examples of DNS record types include A (Address, IP address), AAAA (IPv6 address), NS (Name Server, Domain Name Server), SOA (Start Of Authority record), MX (Mail Exchanger), CNAME (Canonical Name, Alias), SRV (Service Record), and CERT (Certificate). In this embodiment, for example, the proportion of each of the A, AAAA, NS, SOA, MX, CNAME, SRV, and CERT record types to all record types is calculated.

[0030] 2) Entropy characteristics of last-level domain name request names

[0031] The entropy characteristic of last-level domain name request names is a characteristic related to DNS requests. In this embodiment, the formula is used. Calculate the last-level domain request name information entropy H(U), where U is the last-level domain request name, H(U) is the last-level domain request name information entropy, and P... i Let be the probability that the i-th letter in the last-level domain request name U appears in the last-level domain request name information, and n be the total number of letters in the last-level domain request name U.

[0032] 3) Information entropy features of response items

[0033] The response entropy feature is a characteristic related to DNS responses. In this implementation, the formula is used. Calculate the information entropy of the response item, where W is the response item, K(W) is the information entropy of the response item, and Q... i Let be the probability that the i-th letter in response item W appears in the response item information, and m be the total number of letters in the response item.

[0034] 4) Characteristics of the length of the last-level request domain name

[0035] The last-level request domain name length feature is a characteristic related to DNS requests. In this embodiment, the value obtained by processing the last-level request domain name length using the zero-mean normalization algorithm is used as the last-level request domain name length feature.

[0036] 5) Response item length characteristics

[0037] Response length is a feature related to DNS responses. In this implementation, the value obtained by processing the response length using a zero-mean normalization algorithm is used as the response length feature.

[0038] 6) Response time characteristics of last-level domains

[0039] The last-level domain response time characteristic is a feature related to DNS responses. In this embodiment, the last-level domain response time refers to the value obtained by subtracting the time of sending the request from the time the response is received in a single last-level domain request.

[0040] 7) Maximum TTL (Time to Live) characteristics of last-level domains

[0041] The maximum TTL (Time To Live) characteristic of the last-level domain is a feature related to DNS requests. In this implementation, the maximum TTL of the last-level domain within a time window is obtained as the maximum TTL of the last-level domain. For example, α max =max(α) i ), α i Let α represent the TTL of the i-th last-level domain within a time window. max This represents the maximum TTL (Time To Live) value of the last-level domain within a given time window.

[0042] 8) QPS (queries per second) characteristic of the penultimate level domain.

[0043] The penultimate-level domain query QPS (queries per second) is a characteristic related to DNS requests. In this implementation, the formula is used. Calculate the second-to-last level domain query QPS within a time window, where Sec is the length of the time window and Req is the total number of requests within that time window.

[0044] 9) Historical occurrence rate characteristics of last-level domain names

[0045] The historical occurrence rate of last-level domain names is a characteristic related to DNS requests. In this implementation, the formula is used. Calculate the historical occurrence rate of the last-level domain within a time window, where α is the historical occurrence rate of the last-level domain within a time window, β is the total number of historical occurrences of the last-level domain within a time window, and γ is the total number of historical requests for the second-to-last-level domain within a time window.

[0046] 10) Characteristics of last-level domain caching rate

[0047] The last-level domain caching rate characteristic is a feature related to DNS requests. In this implementation, the formula is used. Calculate the cache rate characteristic of the last-level domain within a time window, where δ is the cache rate of the last-level domain within a time window, ε is the total number of LocalDNS upward queries within a time window, and ( is the total number of client requests within a time window).

[0048] In this embodiment, at least one of the above features needs to be extracted. The extracted features are not limited to the features described above, and the features can be appropriately adjusted. As long as they can reflect the characteristics of DNS record types, requests, and responses, they can be in any form.

[0049] Step S104: Use the features of each set of data as training data to train and establish a DNS tunnel detection model.

[0050] In this embodiment, a DNS tunneling detection model can be established using machine learning algorithms such as random forests or transmission algorithms such as SVM (Support Vector Machine). The model can be trained using any existing method, and no particular limitation is made here.

[0051] In this embodiment of the invention, DNS data is grouped according to the penultimate level domain name. This conforms to the DNS tunneling operation mode, maximizing the goal of grouping suspicious DNS tunnels, thereby enabling a more appropriate DNS tunnel detection model to be trained. In this embodiment, the features used in training the DNS tunnel detection model include DNS record types, request and response characteristics, resulting in comprehensive DNS feature analysis and enabling a more appropriate DNS tunnel detection model to be trained.

[0052] Figure 2 This describes the calculation process for the DNS tunnel suspicion threshold in an embodiment of the present invention.

[0053] Step S201: Extract data from normal DNS data that is similar to DNS tunnel data.

[0054] Similar data to DNS tunneling data includes DNS data from well-known CDNs (Content Delivery Networks), object storage, WAFs (Web Application Firewalls), SCDNs (Secure Content Delivery Networks), and home DDNS (Dynamic Domain Name System) data.

[0055] In this embodiment, a predetermined number of data similar to DNS tunnel data can be captured, or data similar to DNS tunnel data within a predetermined time window can be captured. The number of data captured and the size of the time window are not limited here.

[0056] Step S202: Group the captured data similar to DNS tunnel data according to the second-to-last level domain name to obtain the data grouped by the second-to-last level domain name.

[0057] Step S203: Extract features from each group of data after grouping by the second-to-last level domain name. The extracted features are the same as those extracted during training and will not be described in detail here.

[0058] Step S204: Input the features of each set of data into the DNS tunnel detection model established during training, and use the maximum value in the output value of the DNS tunnel detection model as the DNS tunnel suspicion threshold p1.

[0059] Step S205: Set a DNS tunnel suspicion threshold p2 that is larger than the DNS tunnel suspicion threshold p1.

[0060] Setting the DNS tunnel suspicion threshold p2 is optional. In this embodiment of the invention, only one DNS tunnel suspicion threshold p1 can be calculated, or a DNS tunnel suspicion threshold p2 larger than p1 can be set after calculating p1. That is, when only one DNS tunnel suspicion threshold p1 is used for DNS tunnel detection, step S205 can be omitted; when two DNS tunnel suspicion thresholds p1 and p2 are used for DNS tunnel detection, step S205 is executed.

[0061] In this embodiment of the invention, the DNS tunnel suspicion threshold p1 is calculated using data similar to DNS tunnel data from normal DNS data, which greatly reduces the false alarm rate of normal DNS data and the false alarm rate for special network services. By further setting a DNS tunnel suspicion threshold p2 that is larger than the DNS tunnel suspicion threshold p1, the false alarm rate of normal DNS data can be further reduced.

[0062] In embodiments of the present invention, using, for example Figure 1 The DNS tunneling detection model established through the training process shown and as follows Figure 2 The calculation process shown employs a DNS tunneling suspicion threshold to determine whether the DNS data to be detected is a DNS tunnel. In actual detection of DNS data as a DNS tunnel, detection can be performed in real-time or at regular intervals.

[0063] Figure 3 This is the detection process for real-time DNS tunnel detection in the embodiments of the present invention.

[0064] Step S301: Capture the DNS data to be tested.

[0065] Step S302: Determine whether the captured DNS data to be detected is known whitelist DNS data. If it is, return to step S301; otherwise, proceed to step S303.

[0066] In this embodiment, the known whitelist DNS data is, for example, manually set whitelist data. In this embodiment, step S302 is an optional step. This optional step S302 can prevent manually set DNS tunnel data, which is whitelist data, from being detected as illegitimate DNS tunnel data. For example, in cases where DNS tunneling is used legitimately or in good faith to transmit data, this step S302 can be set to avoid detection.

[0067] Step S303: Extract features from the DNS data to be detected. The extracted features are the same as those extracted during training, and will not be described in detail here.

[0068] Step S304: Input the features of the DNS data to be detected into the DNS tunnel detection model established during the training process to obtain the output value.

[0069] Step S305: Compare the output value of the DNS tunnel detection model with the DNS tunnel suspicion threshold p1. If the output value of the DNS tunnel detection model is higher than the DNS tunnel suspicion threshold p1, proceed to step S306. If the output value of the DNS tunnel detection model is lower than the DNS tunnel suspicion threshold p1, proceed to step S308.

[0070] Step S306: Compare the output value of the DNS tunnel detection model with the DNS tunnel suspicion threshold p2. If the output value of the DNS tunnel detection model is higher than the DNS tunnel suspicion threshold p2, proceed to step S307. If the output value of the DNS tunnel detection model is lower than the DNS tunnel suspicion threshold p2, proceed to step S308.

[0071] Step S307: Determine that the DNS data to be detected is DNS tunnel data.

[0072] Step S308: Determine that the DNS data to be detected is not DNS tunnel data.

[0073] Here, step S306 is an optional step. That is, in the embodiment of the present invention, step S306 may not be executed. Instead, a DNS tunnel suspicion threshold p1 may be used for judgment. That is, in step S305, if the output value of the DNS tunnel detection model is higher than the DNS tunnel suspicion threshold p1, the process can directly proceed to step S307 to determine that the DNS data to be detected is DNS tunnel data.

[0074] Figure 4This is the detection process of performing DNS tunnel detection at regular intervals in the embodiments of the present invention.

[0075] Step S401: At regular intervals, capture the DNS data to be tested.

[0076] In this embodiment of the invention, DNS data to be detected can be captured at predetermined intervals, and the predetermined interval is not limited.

[0077] Step S402: First, remove known whitelisted DNS data from the captured DNS data to be detected.

[0078] Step S402 is optional. The known whitelist DNS data may be, for example, manually configured whitelist data. This optional step S402 can prevent manually configured DNS tunnel data, which is used as whitelist data, from being detected as illegitimate DNS tunnel data. For example, in cases where DNS tunneling is used legitimately or in good faith to transmit data, this step S402 can be set to remove known whitelist DNS data.

[0079] Step S403: Group the DNS data to be tested according to the second-to-last level domain name to obtain the DNS data to be tested after being grouped by the second-to-last level domain name.

[0080] Step S404: Extract features for each group of DNS data to be detected. The extracted features are the same as those extracted during training, and will not be described in detail here.

[0081] Step S405: The features of each group of DNS data to be detected are input into the DNS tunnel detection model established during training to determine whether each group of DNS data to be detected is DNS tunnel data. Specifically, for a group of DNS data to be detected, the output value of the DNS tunnel detection model is compared with the DNS tunnel suspicion threshold p1. If it is lower than the DNS tunnel suspicion threshold p1, it is determined that the group of DNS data to be detected is not DNS tunnel data. If it is higher than the DNS tunnel suspicion threshold p1, it is further compared with the DNS tunnel suspicion threshold p2. If it is lower than the DNS tunnel suspicion threshold p2, it is determined that the group of DNS data to be detected is not DNS tunnel data. If it is higher than the DNS tunnel suspicion threshold p2, it is determined that the group of DNS data to be detected is DNS tunnel data.

[0082] In this embodiment, only one DNS tunnel suspicion threshold p1 can be used to determine DNS tunnel data. That is, when the output value of a certain DNS tunnel detection model is higher than the DNS tunnel suspicion threshold p1, it is no longer compared with the DNS tunnel suspicion threshold p2, but can be determined that the DNS data to be detected is DNS tunnel data.

[0083] In addition, Figure 4 In the detection process shown, DNS data to be detected is captured at regular intervals in step S401. However, in other implementations, a predetermined number of DNS data to be detected can also be captured. Here, the predetermined number is not limited.

[0084] According to this embodiment, utilizing, as... Figure 1 The training process shown establishes a DNS tunnel detection model and, through methods such as... Figure 2 The calculation process shown calculates a DNS tunnel suspicion threshold to determine whether the DNS data to be detected is a DNS tunnel, thereby improving the detection accuracy of DNS tunnels, reducing the false positive rate, and enhancing the deep detection capability of network security.

[0085] The DNS tunnel identification method of this invention can be implemented by a DNS tunnel identification device. Figure 5 An exemplary configuration of a computing device 500 capable of implementing a DNS tunnel identification device is shown.

[0086] Computing device 500 is an example of a hardware device capable of applying the DNS tunnel identification method of the present invention. Computing device 500 can be any machine configured to perform processing and / or computation. Computing device 500 can be, but is not limited to, a workstation, server, desktop computer, laptop computer, tablet computer, personal data assistant (PDA), smartphone, in-vehicle computer, or a combination thereof.

[0087] like Figure 5As shown, computing device 500 may include one or more components that can be connected to or communicate with bus 502 via one or more interfaces. Bus 502 may include, but is not limited to, Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus. Computing device 500 may include, for example, one or more processors 504, one or more input devices 506, and one or more output devices 508. The one or more processors 504 may be any type of processor and may include, but is not limited to, one or more general-purpose processors or special-purpose processors (such as special-purpose processing chips). Processor 504 may, for example, execute... Figure 1 , Figure 2 , Figure 3 , Figure 4 The steps in are configured to implement Figures 1-4 The steps described above are functional. Input device 506 can be any type of input device capable of inputting information to the computing device, and may include, but is not limited to, a mouse, keyboard, touchscreen, microphone, and / or remote controller. Output device 508 can be any type of device capable of presenting information, and may include, but is not limited to, a monitor, speaker, video / audio output terminal, vibrator, and / or printer.

[0088] The computing device 500 may also include or be connected to a non-transitory storage device 514, which may be any non-transitory storage device capable of storing data, and may include, but is not limited to, disk drives, optical storage devices, solid-state storage, floppy disks, flexible disks, hard disks, magnetic tapes or any other magnetic media, compressed disks or any other optical media, cache memory and / or any other storage chip or module, and / or any other medium from which a computer may read data, instructions and / or code. The computing device 500 may also include random access memory (RAM) 510 and read-only memory (ROM) 512. ROM 512 may store executable programs, utilities, or processes in a non-volatile manner. RAM 510 provides volatile data storage and stores instructions related to the operation of the computing device 500. The computing device 500 may also include a network / bus interface 516 coupled to a data link 518. The network / bus interface 516 can be any kind of device or system capable of enabling communication with external devices and / or networks, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication devices and / or chipsets (such as Bluetooth™ devices, 802.11 devices, WiFi devices, WiMax devices, cellular communication facilities, etc.).

[0089] This invention can be implemented as any combination of apparatus, system, integrated circuit, and computer program on a non-transitory computer-readable medium. One or more processors can be implemented as integrated circuits (ICs), application-specific integrated circuits (ASICs), or large-scale integrated circuits (LSIs), system LSIs, super LSIs, or super LSI components that perform some or all of the functions described in this disclosure.

[0090] This invention includes the use of software, application programs, computer programs, or algorithms. Software, application programs, computer programs, or algorithms can be stored on a non-transitory computer-readable medium to cause a computer, such as one or more processors, to perform the steps described above and in the accompanying drawings. For example, one or more memories store the software or algorithm in executable instructions, and one or more processors can associate and execute a set of instructions of the software or algorithm to provide various functionalities according to embodiments described in this invention.

[0091] Software and computer programs (also referred to as programs, software applications, applications, components, or code) include machine instructions for programmable processors and can be implemented in high-level procedural languages, object-oriented programming languages, functional programming languages, logic programming languages, assembly languages, or machine languages. The term "computer-readable medium" means any computer program product, apparatus, or device used to provide machine instructions or data to a programmable data processor, such as magnetic disks, optical disks, solid-state storage devices, memories, and programmable logic devices (PLDs), including computer-readable media that receive machine instructions as computer-readable signals.

[0092] For example, computer-readable media may include dynamic random access memory (DRAM), random access memory (RAM), read-only memory (ROM), electrically erasable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage devices, magnetic disk storage devices or other magnetic storage devices, or any other medium that can be used to carry or store required computer-readable program code in the form of instructions or data structures, and that can be accessed by a general-purpose or special-purpose computer or a general-purpose or special-purpose processor. As used herein, a disk or disc includes compact discs (CD), laser discs, optical discs, digital versatile discs (DVD), floppy disks, and Blu-ray discs, wherein a disk typically copies data magnetically, while a disc copies data optically using a laser. Combinations of the above are also included within the scope of computer-readable media.

[0093] The subject matter of this invention is provided as examples of apparatus, systems, methods, and procedures for performing the features described in this disclosure. However, other features or variations are contemplated in addition to the features described above. It is anticipated that components and functions of the invention can be implemented using any emerging techniques that may replace any of the above-described implementations.

[0094] Furthermore, the above description provides examples and does not limit the scope, applicability, or configuration set forth in the claims. Changes may be made to the function and arrangement of the elements discussed without departing from the spirit and scope of the invention. Various processes or components may be appropriately omitted, substituted, or added in various embodiments. For example, features described with respect to certain embodiments may be combined in other embodiments.

[0095] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring the operations to be performed in the specific order shown or in sequential order, or requiring the execution of all illustrated operations to achieve the desired result. In some cases, multitasking and parallel processing can be advantageous.

[0096] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical applications, or technical improvements to market technology of the embodiments, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A DNS tunnel identification method, comprising: The steps for establishing a DNS tunnel detection model are as follows: simulate a DNS tunnel to transmit DNS tunnel data, crawl the simulated DNS tunnel data and normal DNS data from normal websites, group the crawled DNS tunnel data and normal DNS data according to the second-to-last level domain name, extract features from each group of data after grouping according to the second-to-last level domain name, and use the features of each group of data as training data to train and establish a DNS tunnel detection model. The steps for calculating the DNS tunnel suspicion threshold are as follows: crawl data similar to DNS tunnel data from normal DNS data, group the crawled data similar to DNS tunnel data according to the second-to-last level domain name, extract features from each group of data after grouping by the second-to-last level domain name, input the features of each group of data into the established DNS tunnel detection model to obtain the output value of each group of data, and take the maximum value of the output value of the DNS tunnel detection model of each group of data as the first threshold of DNS tunnel suspicion. as well as The DNS tunnel detection steps are as follows: extract features from the DNS data to be detected, input the features of the DNS data to be detected into the established DNS tunnel detection model to obtain the output value of the DNS data to be detected, and judge the DNS data to be detected as DNS tunnel data when the output value of the DNS tunnel detection model of the DNS data to be detected is higher than the first threshold of DNS tunnel suspicion.

2. The DNS tunnel identification method according to claim 1, wherein, In the DNS tunnel detection step, a predetermined number of DNS data are captured, or DNS data within a predetermined time period is captured at predetermined intervals. The captured DNS data is grouped according to the penultimate level domain name, and each group of DNS data is used as the DNS data to be detected.

3. The DNS tunnel identification method according to claim 1 or 2, wherein, Remove known whitelisted DNS data from the DNS data to be tested.

4. The DNS tunnel identification method according to claim 1 or 2, wherein, In the DNS tunnel suspicion threshold calculation step, a second DNS tunnel suspicion threshold is set that is larger than the first DNS tunnel suspicion threshold. In the DNS tunnel detection step, when the output value of the DNS tunnel detection model of the DNS data to be detected is higher than the first threshold of DNS tunnel suspicion, it is further determined whether the output value of the DNS tunnel detection model of the DNS data to be detected is higher than the second threshold of DNS tunnel suspicion. When the output value of the DNS tunnel detection model of the DNS data to be detected is higher than the second threshold of DNS tunnel suspicion, it is determined that the DNS data to be detected is DNS tunnel data.

5. The DNS tunnel identification method according to claim 1, wherein, The features include at least one of the following: features related to DNS record types, features related to DNS requests, and features related to DNS responses.

6. The DNS tunnel identification method according to claim 5, wherein, Characteristics related to DNS record types include record type percentage characteristics. Features related to DNS requests include at least one of the following: last-level domain name request name information entropy feature, last-level domain name length feature, last-level domain name maximum lifetime feature, penultimate-level domain name query rate per second feature, last-level domain name historical occurrence rate feature, and last-level domain name caching rate feature; Features related to DNS responses include at least one of the following: response item entropy feature, response item length feature, and last-level domain response time feature.

7. The DNS tunnel identification method according to claim 1, wherein, Data similar to DNS tunneling data in normal DNS data includes DNS data from content delivery networks, object storage, web application firewalls, secure content delivery networks, or home dynamic domain name systems.

8. The DNS tunnel identification method according to claim 1, wherein, The penultimate level domain name is the string following the first dot in the DNS data.

9. A DNS tunnel identification device, comprising: A memory that stores instructions; as well as The processor is configured to execute instructions stored in the memory to perform the method according to any one of claims 1 to 8.

10. A computer-readable storage medium comprising computer-executable instructions, which, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 8.

Images