A malicious domain name detection method based on sandbox traffic to build a heterogeneous graph

Abstract

The present invention discloses a malicious domain name detection method based on sandbox traffic to construct a heterogeneous graph. The goal is to use sandbox traffic to construct a heterogeneous graph and combine it with a graph neural network algorithm to detect malicious domain names. The method includes: collecting active samples of malicious files, running them in a cuckoo sandbox and collecting sandbox traffic data; constructing a sandbox traffic scenario heterogeneous graph based on the sandbox traffic data, and using a normal domain name annotation dataset and a malicious domain name annotation dataset to annotate the domain name nodes in the sandbox scenario heterogeneous graph; and detecting malicious domain names in the sandbox traffic scenario heterogeneous graph through heterogeneous graph neural network embedding learning. The present invention constructs a sandbox traffic heterogeneous graph by extracting four types of nodes and the corresponding ten relationships in the sandbox traffic, and uses a heterogeneous graph neural network to learn the graph embedding features of domain names. Finally, a classifier is used to classify the graph embedding features of domain names with unknown attributes, thereby detecting malicious domain names.

Description

Technical Field

[0001] The present invention relates to the field of malicious domain name detection, and in particular to a malicious domain name detection method based on sandbox traffic to construct a heterogeneous graph. Background Art

[0002] In recent years, with the emergence of emerging technologies such as big data, cloud computing, and the Internet of Things, the internet industry has diversified, making daily life more convenient and intelligent. As internet technology continues to improve and develop, its services and protocols have also been abused for various malicious activities, such as spreading malware, conducting command and control (C&C) communications, sending spam, hosting scams, and phishing websites. Domain names, while a crucial component of internet services, have also become a key avenue for malicious activity. Malicious domain names, containing malicious links, exploit vulnerabilities in application software or browsers to embed malicious code such as Trojans and viruses within websites, and then use disguised website content to lure users into visiting them.

[0003] Current mainstream malicious domain name detection systems mainly use machine learning methods to learn the character features of malicious domain names or build domain name relationship graphs based on DNS traffic and combine them with graph embedding methods for detection. However, these methods do not take into account the malicious behavior characteristics of malicious domain names and are easily evaded by technologies such as Domain-Flux or IP-Flux.

[0004] In summary, in order to more effectively and timely curb a series of network attacks launched using malicious domain names as control centers, the detection and identification of malicious domain names has become an important research object in the field of network security. Summary of the Invention

[0005] The purpose of the present invention is to provide a malicious domain name detection method based on sandbox traffic to construct a heterogeneous graph, use sandbox traffic to construct a heterogeneous graph and combine it with a graph neural network algorithm to detect malicious domain names, identify malicious domain names with complete association patterns, newly emerging malicious domain names and malicious domain names with incomplete association patterns, and ultimately improve the accuracy of malicious domain name detection.

[0006] To achieve the above object, the technical solution of the present invention is as follows:

[0007] The present invention discloses a malicious domain name detection method based on sandbox traffic to construct a heterogeneous graph. The goal is to use sandbox traffic to construct a heterogeneous graph and combine it with a graph neural network algorithm to detect malicious domain names, including: collecting active samples of malicious files, running them in a cuckoo sandbox and collecting sandbox traffic data; constructing a sandbox traffic scenario heterogeneous graph based on the sandbox traffic data, and using a normal domain name annotation data set and a malicious domain name annotation data set to annotate the domain name nodes in the sandbox scenario heterogeneous graph; detecting malicious domain names in the sandbox traffic scenario heterogeneous graph through heterogeneous graph neural network embedding learning. The present invention constructs a sandbox traffic heterogeneous graph by extracting four types of nodes and the corresponding ten relationships in the sandbox traffic, and uses a heterogeneous graph neural network to learn the graph embedding features of domain names, and finally uses a classifier to classify the graph embedding features of unknown attribute domain names, thereby detecting malicious domain names. The steps include:

[0008] 1) First, sandbox traffic extraction is performed to collect malicious samples: active malicious file samples are collected from the open source projects Malware and APTDATASETS on GitHub, and a Cuckoo sandbox is built. The collected active malicious file samples are run in the sandbox to obtain semi-structured sandbox traffic data. The sandbox traffic data includes network traffic packets in PCAP format and file behavior information packets in JSON format. The malicious files include Trojan software, rogue software, eavesdropping software, and ransomware.

[0009] 2) Construct a sandbox traffic scenario heterogeneous graph G = (V, E) based on the sandbox traffic data, where V is the node type and E is the edge type;

[0010] 3) Use the heterogeneous graph neural network algorithm based on the attention mechanism to perform heterogeneous graph embedding learning on the constructed sandbox traffic scenario heterogeneous graph to obtain the graph embedding features of the domain name;

[0011] 4) Construct a malicious domain name classifier. The classifier uses a four-layer fully connected neural network to classify graph embedding features. The four-layer fully connected neural network has an output dimension of 16×128×64×2 per layer, an input layer dimension of 16, which is the dimension of the graph embedding feature, and an output layer dimension of 2. It classifies unknown domain names as malicious or normal, and ultimately detects malicious domain names. The sandbox traffic scenario heterogeneous graph G = (V, E) is specifically:

[0012] 2.1) V is a node, including domain name nodes, file nodes, IP address nodes, and URL nodes; the domain name nodes include black domain names, white domain names, and unknown domain names to be predicted;

[0013] 2.2) E is the number of edges corresponding to the node. Specifically, network edges are extracted from network traffic packets, and file edges are extracted from file behavior information packets.

[0014] File edges include: "DOWNLOAD_TO": download a file through a URL; "DROP_TO": the starting node file releases the end point file; "CONTACT_IP_TO": the file communicates with the IP; "CONTACT_DOMAIN_TO": the file communicates with the domain name; "CONTACT_URL_TO": the file communicates with the URL; "QUERY_DOMAIN_TO": the file queries the DNS server;

[0015] Network edges include: "RESOLVE_TO_IP": domain name resolved to IP; "PARENT_DOMAIN_OF": the domain name of the starting node is the parent domain of the domain name of the end point; "HOST_OF": the domain name or IP is the host of the URL; "RESOLVE_TO_DOMAIN": the domain name of the starting node is resolved to the domain name of the end point;

[0016] Said step 3) specifically comprises:

[0017] 3.1) Neighbor sampling: Obtain the neighbor list to be aggregated and the corresponding edge information of each node in the heterogeneous graph through a neighbor sampling algorithm;

[0018] 3.2) Information Aggregation: Each node in the heterogeneous graph learns the neighbor information obtained by the neighbor sampling through the information aggregation algorithm, and finally obtains the graph embedding feature; including the following steps:

[0019] Step a. Calculate the node-level attention of each of the node's neighbors, aggregate the neighbor information according to the node-level attention score, and update the node-level attention information of the node;

[0020]

[0021]

[0022]

[0023] in, is the set of neighbor nodes of node i with relationship r, then j is the neighbor node of node i; is the l-th layer information of node i; is the trainable parameter matrix, d in is the input vector dimension; || is the splicing operation, and the information dimension after splicing is is the dimension adjustment parameter matrix, which is used to adjust the information dimension; i，j Use the LeakyReLU activation function to activate and then perform Softmax normalization to calculate the final node-based attention score α i，r, the node-level attention information of the node after the aggregation operation is updated is

[0024] Step b. Calculate the edge-level attention score, aggregate the node-level attention information of the neighbors based on the edge-level attention score, and update the next layer of node information; the specific implementation formula is as follows:

[0025]

[0026]

[0027]

[0028] in, is the in-degree of node i, r (i，j) is the weight of the edge between nodes i→j, which is set manually; The role of is the same as that of a in node attention calculation, which is used to adjust the information dimension; is the trainable parameter matrix; is the bias value, and the edge-level attention is activated using the ReLU: f(x) = max(0, x) activation function; the l+1 layer information of node i is updated through the above calculation

[0029] By using the information aggregation method, the information is updated three times, so that each node learns three layers of neighbor information and obtains the final graph embedding features of each domain name node.

[0030] Compared with the existing method, the present invention has the following beneficial effects:

[0031] The present invention provides a method for detecting malicious domain names in a heterogeneous graph based on sandbox traffic. The method uses information obtained from file sandbox traffic to construct a heterogeneous graph. Compared with the traditional method of constructing a heterogeneous graph based on DNS traffic information, the method contains richer node and relationship information, can better restore the behavioral information of malicious domain names when being used to perform malicious behaviors, and learn richer malicious domain name features. The method uses information aggregation to learn graph embedding information. Compared with the traditional domain name detection algorithm based on meta-path processing of heterogeneous graphs, the method reduces the use of expert knowledge and utilizes and learns the information of all nodes and edges. The method uses a heterogeneous graph neural network method based on an attention mechanism to process the embedding of the heterogeneous graph. The node-level attention is calculated first, and then the edge-level attention is calculated. The characteristics of the nodes and edges can be learned at the same time. Artificial interference is added to the edge-level attention to realize artificial control of the graph learning direction and increase interpretability. The method provided by the present invention can identify malicious domain names with complete association patterns, newly emerging malicious domain names, and malicious domain names with incomplete association patterns, thereby improving the accuracy of malicious domain name detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 Flowchart of the present invention;

[0033] Figure 2 This is a schematic diagram of the sandbox traffic extraction process of the present invention;

[0034] Figure 3 This is a schematic diagram of a heterogeneous graph constructed based on sandbox traffic in the present invention. DETAILED DESCRIPTION

[0035] The present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only used to illustrate and explain the present invention and are not intended to limit the present invention.

[0036] like Figure 1 As shown, the present invention proposes a method for detecting malicious domain names in a heterogeneous graph based on sandbox traffic, the steps of which include:

[0037] Step 1: If Figure 2 As shown in the figure, we collected active malicious file samples from the open source project Malware and APT DATASETS on GitHub. We built a Cuckoo sandbox and ran the collected active malicious file samples in the sandbox to obtain semi-structured sandbox traffic data. The data mainly includes network traffic packets in the PCAP format and file behavior information packets in the JSON format.

[0038] Step 2: Construct a sandbox traffic scenario heterogeneous graph G = (V, E) based on the sandbox traffic data. The constructed heterogeneous graph is as follows: Figure 3 As shown. Where V is the node type, mainly including domain name nodes, file nodes, IP address nodes, and URL nodes; E is the edge type, mainly including ten types of relationships between the four types of nodes; the domain name nodes include black domain names, white domain names, and unknown domain names to be predicted; Where V is the node, mainly including four types of nodes, namely domain name nodes, file nodes, IP address nodes, and URL nodes. The domain name nodes include black domain names, white domain names, and unknown domain names to be predicted; E is the ten types of edges corresponding to the nodes. Specifically, network-related edges are extracted from network traffic packets, and file-related edges are extracted from file behavior information packets.

[0039] The file-related edges mainly include: "DOWNLOAD_TO": download a file through a URL; "DROP_TO": the starting node file releases the end point file; "CONTACT_IP_TO": the file communicates with the IP; "CONTACT_DOMAIN_TO": the file communicates with the domain name; "CONTACT_URL_TO": the file communicates with the URL; "QUERY_DOMAIN_TO": the file queries the DNS server.

[0040] The network-related edges mainly include: "RESOLVE_TO_IP": domain name is resolved to IP; "PARENT_DOMAIN_OF": the domain name of the starting node is the parent domain of the domain name of the end point; "HOST_OF": the domain name or IP is the host of the URL; "RESOLVE_TO_DOMAIN": the domain name of the starting node is resolved to the domain name of the end point;

[0041] Step 3: Use the attention-based heterogeneous graph neural network algorithm to perform heterogeneous graph embedding learning to obtain the graph embedding features of the domain name. This specifically includes the following two parts:

[0042] 1) Neighbor sampling. Obtain the neighbor list to be aggregated and the corresponding edge information for each node in the heterogeneous graph through the neighbor sampling algorithm;

[0043] 2) Information aggregation. Each node in the heterogeneous graph learns the neighbor information obtained by the neighbor sampling through the information aggregation algorithm, and finally obtains the graph embedding feature;

[0044] By updating the information three times through the information aggregation method, each node learns three layers of neighbor information and obtains the final graph embedding features of each domain name node;

[0045] Step 4: Build a malicious domain name classifier. This classifier uses a four-layer fully connected neural network to classify the processed graph embedding features. Each layer of this four-layer fully connected neural network has an output dimension of 16 × 128 × 64 × 2. The input layer dimension is 16, which corresponds to the dimension of the graph embedding features, and the output layer dimension is 2. This classifier classifies unknown domain names as malicious or benign, ultimately detecting malicious domain names.

[0046] Example

[0047] Step 1. In this embodiment, malicious files are first collected. The following two types of data are mainly collected: malicious file samples and domain name related data.

[0048] 1) Active malicious file samples are collected from the Malshare open-source sandbox website, the open-source project MalwareDataBase on GitHub, and APT Malware DATASETS, and automatically submitted to the Cuckoo sandbox for analysis. The Malware DataBase contains malicious file types such as Trojans, rogue software, eavesdropping software, and ransomware. APT Malware DATASETS collects malware from active APT activities.

[0049] 2) Domain name data is used to mark domain names involved in sandbox traffic. Domain names involved in sandbox traffic are marked as malicious based on public domain blacklists and whitelists from security organizations such as 360 Network Security Lab, Alexa, and Umbrella.

[0050] Step 2. Then build the Cuckoo sandbox. This example uses the Ubuntu 20.04 operating system as the Cuckoo host and Windows XP and Windows 7 operating systems as the Cuckoo client. The client is installed on Virtulbox, and the network of the client virtual machine is configured as a host-only network interface to isolate the actual network of the Cuckoo host from the client virtual network. In order to obtain the maximum execution and call information of the file, the client's security protection processes such as Windows Firewall and automatic updates are turned off. The client Cuckoo agent acts as a communication medium between the Cuckoo host and the Cuckoo client.

[0051] After setting up the Cuckoo sandbox, a script was written based on Cuckoo's built-in "REST API" service to batch submit malicious files to the client for analysis, and save the obtained file analysis report in JSON format and network traffic tracking package in PCAP format.

[0052] Step 3. Construct a heterogeneous graph. First, parse the two types of analysis reports obtained by the file sandbox. Analyze the file analysis report and extract file edges. Analyze the network traffic packets and extract network edges. Finally, extract four types of node information. File-related relationships come from certain behaviors during file operations, such as releasing other files and file communication. These relationships are primarily extracted from file behavior reports in JSON format combined with network traffic packets in PCAP format. Network-related edges are generated during network communication behaviors, such as DNS domain name resolution, and are primarily extracted from network traffic packets in PCAP format. The extracted node information is shown in the following table:

[0053]

[0054] Construct a heterogeneous graph based on the extracted node and edge information, such as Figure 3 shown.

[0055] Step 4. Build a graph neural network model and conduct experiments. This embodiment uses the pytorch deep learning framework to build the model. The framework provides GPU-accelerated tensor calculations, can process large amounts of data in a short period of time, and the framework also supports dynamic neural networks, can modify the neural network layer by layer, and the neural network has the function of automatic differentiation, which greatly facilitates the implementation of the model of this embodiment. In terms of graph construction, this embodiment chooses the DGL framework. Its advantages and speed in graph processing provide guarantees for the implementation of large-scale graph neural networks.

[0056] In this example, to ensure graph connectivity, we extracted three-hop data for 300 domain nodes, including 100 black and white unknown nodes and 100 black and white unknown nodes. The total number of extracted nodes was 2,430,050, and the number of edges was 10,416,032. The distribution of the number of nodes of a specific type with malicious attributes is shown in the table:

[0057] node domain name document URL IP address Total number of nodes 539863 1598053 1110736 443905 Malicious nodes 50855 1049373 323656 0 Normal nodes 223866 174156 0 0 Unknown attributes 265142 374524 787080 443905

[0058] To model and train large graphs, we employ a batch training approach. First, we perform neighbor sampling to determine the neighbor nodes to be aggregated for each domain node to be trained, and then perform batch training. With batch training, the model's resource usage is solely dependent on the batch size (the amount of data loaded by each dataloader) and the neighbor sampling algorithm (the number of neighbor nodes to be aggregated for each node). This makes it possible to train large graphs even with limited resources.

[0059] The final prediction results are shown in the table:

[0060] Accuracy Recall F1 score AUC This model 92.22％ 90.74％ 91.42％ 94.67％ RGCN 88.56％ 76.31％ 81.98％ 87.26％ HAN 23.62％ 46.13％ 31.24％ 59.52％

[0061] Through experiments, the domain name detection model is evaluated in terms of precision, recall, AUC, and F1-score, and compared with existing models to prove the effectiveness of the present invention.

[0062] Obviously, the above embodiments of the present invention are merely examples for the purpose of illustrating the present invention clearly, and are not intended to limit the embodiments of the present invention. It should be understood by those skilled in the art that various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention, and such changes and modifications fall within the scope of the present invention as claimed.

Claims

1. A malicious domain name detection method based on sandbox traffic to build a heterogeneous graph, characterized in that: The method comprises the following specific steps: 1) First, sandbox traffic extraction is performed to collect malicious samples: active malicious file samples are collected from the open source projects Malware and APTDATASETS on GitHub, and a Cuckoo sandbox is built. The collected active malicious file samples are run in the sandbox to obtain semi-structured sandbox traffic data. The sandbox traffic data includes network traffic packets in PCAP format and file behavior information packets in JSON format. The malicious files include Trojan software, rogue software, eavesdropping software, and ransomware. 2) Construct a sandbox traffic scenario heterogeneous graph G = (V, E) based on the sandbox traffic data, where V is the node type and E is the edge type; 3) Use the heterogeneous graph neural network algorithm based on the attention mechanism to perform heterogeneous graph embedding learning on the constructed sandbox traffic scenario heterogeneous graph to obtain the graph embedding features of the domain name; 4) Construct a malicious domain name classifier. The classifier uses a four-layer fully connected neural network to classify graph embedding features. The four-layer fully connected neural network has an output dimension of 16×128×64×2 per layer. The input layer dimension is 16, which is the dimension of the graph embedding feature. The output layer dimension is 2. The classifier classifies unknown domain names as malicious or normal. Finally, malicious domain names are detected. The sandbox traffic scenario heterogeneous graph G = (V, E) is specifically: 2.1) V is a node, including domain name nodes, file nodes, IP address nodes, and URL nodes; the domain name nodes include black domain names, white domain names, and unknown domain names to be predicted; 2.2) E is the number of edges corresponding to the node. Specifically, network edges are extracted from network traffic packets, and file edges are extracted from file behavior information packets. The file edge includes: "DOWNLOAD_TO": download a file through the URL; "DROP_TO": the starting node file releases the end point file; "CONTACT_IP_TO": the file communicates with the IP; "CONTACT_DOMAIN_TO": the file communicates with the domain name; "CONTACT_URL_TO": the file communicates with the URL; "QUERY_DOMAIN_TO": the file queries the DNS server; The network edge includes: "RESOLVE_TO_IP": domain name resolved to IP; "PARENT_DOMAIN_OF": the domain name of the starting node is the parent domain of the end domain name; "HOST_OF": the domain name or IP is the host of the URL; "RESOLVE_TO_DOMAIN": the domain name of the starting node is resolved to the domain name of the end.

2. The malicious domain name detection method based on sandbox traffic to construct a heterogeneous graph according to claim 1 is characterized in that: Said step 3) specifically comprises: 3.1) Neighbor sampling: Obtain the neighbor list to be aggregated and the corresponding edge information of each node in the heterogeneous graph through a neighbor sampling algorithm; 3.2) Information Aggregation: Each node in the heterogeneous graph learns the neighbor information obtained by the neighbor sampling through the information aggregation algorithm, and finally obtains the graph embedding feature.

3. The malicious domain name detection method based on sandbox traffic to construct a heterogeneous graph according to claim 2 is characterized in that: The information aggregation in 3.2) specifically includes the following steps: Step a. Calculate the node-level attention of each of the node's neighbors, aggregate the neighbor information according to the node-level attention score, and update the node-level attention information of the node; in, is the set of neighbor nodes of node i whose relationship is r, then j is the neighbor node of node i; is the l-th layer information of node i; is the trainable parameter matrix, d in is the input vector dimension; || is the splicing operation, and the information dimension after splicing is is the dimension adjustment parameter matrix, which is used to adjust the information dimension; i,j Use the LeakyReLU activation function to activate and then perform Softmax normalization to calculate the final node-based attention score α i,r , the node-level attention information of the node after the aggregation operation is updated is Step b. Calculate the edge-level attention score, aggregate the node-level attention information of the neighbors based on the edge-level attention score, and update the next layer of node information; the specific implementation formula is as follows: in, is the in-degree of node i, r (i,j) is the weight of the edge between nodes i→j, which is set manually; The role of is the same as that of a in node attention calculation, which is used to adjust the information dimension; is the trainable parameter matrix, d out is the output vector dimension; is the bias value, and the edge-level attention is activated using the ReLU:f(x)=max(0,x) activation function; the l+1 layer information of node i is updated through the above calculation By updating the information three times through the information aggregation method, each node learns the three-layer neighbor information and obtains each Final graph embedding features of domain name nodes.

Images