A method, system, and apparatus for detecting DNS tunnel attacks.

Abstract

This invention proposes a method, system, and apparatus for detecting DNS tunnel attacks, belonging to the field of computer technology. The method includes: collecting traffic logs through network monitoring; generating corresponding datasets from the collected historical data and online data using filters; extracting preset features from the historical data dataset; performing feature processing; processing the samples using oversampling technology; optimizing model parameters using a genetic algorithm; and training the model to determine the detection model; extracting preset features from the online data dataset; performing feature processing; running the detection model using a model classifier; performing rule analysis; and generating detection results. This invention effectively solves the problem of sample imbalance affecting the model and significantly improves detection accuracy.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and more specifically to a method, system, and apparatus for detecting DNS tunnel attacks. Background Technology

[0002] Intrusion detection refers to "the detection of intrusions or attempts to intrude into a system by manipulating behavior, security logs, audit data, or other information available on the network." Intrusion detection is the discipline of detecting and responding to computer misuse, and its functions include deterrence, detection, response, damage assessment, attack prediction, and prosecution support.

[0003] Most existing network intrusion detection technologies neglect the impact of imbalanced data on classification algorithms, leading to poor intrusion detection performance. In model classification research, many algorithms assume a balanced data distribution. However, when these algorithms are applied to real-world data, they often fail to achieve ideal results, especially in attack detection scenarios where the distribution of white samples is much larger than black samples. Minority samples may be treated as noise during classification, resulting in suboptimal algorithm performance. There are several methods to address imbalanced data: at the data level, oversampling to synthesize minority samples and undersampling to eliminate majority samples can effectively solve the problem; at the algorithm level, choosing an appropriate model can reduce the impact of imbalanced data on the model. For example, using a tree model, since entropy calculation is not directly related to the number of samples, the number of samples has a smaller impact on the model results during calculation; at the evaluation level, using an appropriate evaluation method as the model evaluation result can effectively mitigate the impact of imbalanced samples on the model.

[0004] Since most current intrusion detection techniques ignore sample imbalance, resulting in poor model adaptability in real-world environments, this paper proposes an intrusion detection method based on GBDT and SMOTE. This method uses SMOTE technology to synthesize minority samples to balance the training data. Experimental results show that although the false positive rate is reduced, the overall detection accuracy is not significantly improved. While the combination of ADASYN and XGBoost can effectively handle data redundancy and class imbalance, and significantly improve the F1 score of the anomaly detection model, ADASYN is also susceptible to outliers. If a minority class sample's neighbors are all majority class samples, its weight becomes quite large, leading to the generation of many samples around it.

[0005] Therefore, overcoming the problems of high dimensionality and data imbalance in the training of DNS tunnel attack detection models, and improving the detection performance of DNS tunnel attack detection models, are problems that we urgently need to solve. Summary of the Invention

[0006] In view of the problems existing in the prior art, the purpose of this invention is to provide a method, system and device for detecting DNS tunnel attacks.

[0007] To achieve the above objectives, the present invention employs the following technical solution:

[0008] A method for detecting DNS tunneling attacks includes the following steps:

[0009] S1: Collect traffic logs through network monitoring, and use filters to generate corresponding datasets from the collected historical data and online data respectively;

[0010] S2: Extract preset features from the historical data dataset, process the features, use oversampling technology to process the samples, use a genetic algorithm to optimize the model parameters, and train the model to determine the detection model.

[0011] S3: Extract preset features from the online dataset, process the features, run the detection model using a model classifier, perform rule analysis, and generate detection results.

[0012] Furthermore, the dataset includes: DNS covert tunnel samples and normal DNS traffic samples, where the DNS covert tunnel samples include iodine, dnscat, dns2tcp, and cobalt strike.

[0013] Furthermore, the preset features include:

[0014] The query and response domain length, request time interval, domain confusion level, query message payload, payload upload to download ratio, number of DNS packets, resource record type, percentage of numeric characters in the domain name, number of different characters in the domain name, and consecutive consonant letters.

[0015] Furthermore, oversampling techniques are used for sample processing, including:

[0016] Noise cancellation;

[0017] Delete blurry samples;

[0018] Sample synthesis.

[0019] Furthermore, noise cancellation includes:

[0020] The possibility of noise is reduced by removing outliers. The distance between sample points is calculated using Euclidean distance, as shown in the formula below:

[0021]

[0022] Calculate the distance between each minority sample and its class, using the formula shown below:

[0023]

[0024] The deviation is converted by normalization using the following formula:

[0025]

[0026] Based on the anomaly detection method of the box plot, noise points smaller than Q1-1.5IQR are eliminated.

[0027] Furthermore, removing blurry samples includes:

[0028] Use Euclidean distance to calculate the k nearest neighbors for each small number of samples; if most of the k nearest neighbors are samples of the same class, keep the sample; if most of the neighbors are samples of other classes, delete the samples of that class.

[0029] Furthermore, sample synthesis includes:

[0030] Calculate the required number of samples n using the following formula. gen The calculation method is as follows:

[0031] n gen =n maj -n min

[0032] Where, n maj n is the number of samples in the majority class. min This refers to the number of samples in the minority class.

[0033] Based on the k nearest neighbors of the minority sample, randomly select the nearest neighbors and construct a new sample according to the following formula:

[0034]

[0035] The number of new samples synthesized from each sample is:

[0036]

[0037] Where, Δ i Z is the number of similar samples in the k-nearest neighbors, the opposite of ADASYN; Z is the normalization factor to ensure that the left half of the formula can form a distribution.

[0038] Accordingly, the present invention also discloses a DNS tunneling attack detection system, comprising:

[0039] The data acquisition module is used to collect traffic logs through network monitoring and to generate corresponding datasets from the collected historical data and online data using filters.

[0040] The offline training module is used to extract preset features from the historical data dataset. After feature processing, oversampling technology is used for sample processing, a genetic algorithm is selected to optimize the model parameters, and the model is trained to determine the detection model.

[0041] The online detection module is used to extract preset features from online datasets, process the features, run the detection model using a model classifier, perform rule analysis, and generate detection results.

[0042] Accordingly, the present invention also discloses a DNS tunnel attack detection device, comprising:

[0043] Memory, used to store computer programs;

[0044] A processor, configured to implement the steps of the DNS tunneling attack detection method as described in any of the preceding descriptions when executing the computer program.

[0045] Compared with existing technologies, the advantages of this invention are as follows: This invention provides a method, system, and device for detecting DNS tunnel attacks. After feature selection, the PCA algorithm is used to reduce the dimensionality of the sample data and reduce the number of feature attributes. A new adaptive oversampling method is proposed to synthesize a small number of samples in imbalanced data. XGboost is used to complete model training, and genetic algorithm is used to optimize parameters to achieve the purpose of online detection.

[0046] This invention utilizes a novel oversampling method to effectively address the impact of sample imbalance on the model. The generated new samples do not overlap, and the method avoids the influence of outliers on oversampling. The synthesized samples have clear boundaries, which is more conducive to model training. Furthermore, principal component analysis is performed on high-dimensional features, ensuring high independence for each dimension of the samples. Verification through DNS tunneling attack detection shows that adding this feature engineering process effectively improves detection accuracy.

[0047] Therefore, it is evident that the present invention has outstanding substantive features and significant progress compared with the prior art, and the beneficial effects of its implementation are also obvious. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0049] Figure 1This is a flowchart illustrating a specific embodiment of the present invention.

[0050] Figure 2 This is a system structure diagram of a specific embodiment of the present invention. Detailed Implementation

[0051] The specific embodiments of the present invention will now be described with reference to the accompanying drawings.

[0052] like Figure 1 The method for detecting a DNS tunneling attack, as shown, includes the following steps:

[0053] S1: Collect traffic logs through network monitoring, and use filters to generate corresponding datasets from the collected historical data and online data respectively.

[0054] The dataset includes DNS covert tunnel samples (i.e., malicious samples) and normal DNS traffic samples (i.e., benign samples). There are approximately 700,000 benign samples, and the malicious samples include four types: iodine, dnscat, dns2tcp, and cobalt strike, with 208, 6935, 5630, and 2086 samples respectively. The main purpose of the filter is to filter out a large amount of normal DNS traffic and some malicious DNS, thereby improving the model's detection efficiency.

[0055] S2: Extract preset features from the historical data dataset, process the features, use oversampling technology to process the samples, use a genetic algorithm to optimize the model parameters, and train the model to determine the detection model.

[0056] This method identifies the following features as preset features for detection and uses principal component analysis (PCA) to reduce redundant features in the data. The selected preset features are as follows:

[0057] 1. Query and respond to domain name length

[0058] 2. Request time interval

[0059] 3. Domain name disorder

[0060] 4. Payload size of the Query message

[0061] 5. Payload upload to download ratio

[0062] 6. Number of DNS packets

[0063] 7. Resource record type

[0064] 8. Percentage of numeric characters in the domain name

[0065] 9. Number of different characters in the domain name

[0066] 10. Consecutive consonant letters

[0067] If there is a correlation between data feature attributes, it will lead to poor model generalization ability. The sparsity of high-dimensional space samples makes it difficult for the model to find data features. Too many feature attributes will increase the difficulty of the model to search for rules. Therefore, by reducing the dimensionality of high-dimensional data and the number of feature attributes, each feature attribute is made relatively independent. This method uses PCA to reduce the redundancy of features such as domain names and enhance the generalization of the model.

[0068] In this step, a genetic algorithm is used to optimize the model parameters. Probabilistic search effectively avoids the model getting stuck in local optima during iteration. The search direction and range are determined to address optimization situations where the objective function is not differentiable or its derivative does not exist.

[0069] S3: Extract preset features from the online dataset, process the features, run the detection model using a model classifier, perform rule analysis, and generate detection results.

[0070] Rule analysis includes: after the model determines the positive samples, rule verification is performed on them.

[0071] As an example, this method uses oversampling technology for sample processing, which mainly consists of three steps: noise removal, deletion of blurry samples, and sample synthesis.

[0072] Noise cancellation includes:

[0073] The possibility of noise is reduced by removing outliers. The distance between sample points is calculated using Euclidean distance, as shown in the formula below:

[0074]

[0075] Calculate the distance between each minority sample and its class, using the formula shown below:

[0076]

[0077] The deviation is converted by normalization using the following formula:

[0078]

[0079] Based on the anomaly detection method of the box plot, noise points smaller than Q1-1.5IQR are eliminated.

[0080] Deleting blurry samples includes:

[0081] Use Euclidean distance to calculate the k nearest neighbors for each small number of samples; if most of the k nearest neighbors are samples of the same class, keep the sample; if most of the neighbors are samples of other classes, delete the samples of that class.

[0082] Sample synthesis includes:

[0083] Calculate the required number of samples n using the following formula. gen The calculation method is as follows:

[0084] n gen =n maj -n min

[0085] Where, n maj n is the number of samples in the majority class. min This refers to the number of samples in the minority class.

[0086] Based on the k nearest neighbors of the minority sample, randomly select the nearest neighbors and construct a new sample according to the following formula:

[0087]

[0088] The number of new samples synthesized from each sample is:

[0089]

[0090] Where, Δ i Z is the number of similar samples in the k-nearest neighbors, the opposite of ADASYN; Z is the normalization factor to ensure that the left half of the formula can form a distribution.

[0091] In actual operation, the DNS tunnel attack detection system is installed inside the firewall and detects DNS tunnel attack traffic hidden in DNS traffic through a switch connection to the traffic port. Sample analysis shows that the new samples generated by the proposed oversampling method do not overlap, and this method avoids the influence of outliers on oversampling; the boundaries of the synthesized samples are clear. Therefore, this method, combining principal component analysis and proposing a novel oversampling method, effectively solves the problems of high dimensionality and data imbalance encountered in the training of DNS tunnel attack detection models, thus improving the detection performance of the DNS tunnel attack detection model.

[0092] Correspondingly, such as Figure 2 As shown, the present invention also discloses a DNS tunnel attack detection system, including: a data acquisition module, an offline training module, and an online detection module.

[0093] The data acquisition module is used to collect traffic logs through network monitoring and to generate corresponding datasets from the collected historical data and online data using filters.

[0094] The offline training module is used to extract preset features from the historical data dataset. After feature processing, oversampling technology is used for sample processing, a genetic algorithm is selected to optimize the model parameters, and the model is trained to determine the detection model.

[0095] The online detection module is used to extract preset features from online datasets, process the features, run the detection model using a model classifier, perform rule analysis, and generate detection results.

[0096] Accordingly, the present invention also discloses a DNS tunnel attack detection device, comprising:

[0097] Memory, used to store computer programs;

[0098] A processor, configured to implement the steps of the DNS tunneling attack detection method as described in any of the preceding descriptions when executing the computer program.

[0099] Those skilled in the art will clearly understand that the techniques in the embodiments of the present invention can be implemented using software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solutions in the embodiments of the present invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium such as a USB flash drive, mobile hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk, or any other medium capable of storing program code. It includes several instructions to cause a computer terminal (which may be a personal computer, server, or a second terminal, network terminal, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. Similar or identical parts between the various embodiments in this specification can be referred to mutually. In particular, for the terminal embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and relevant parts can be referred to the description in the method embodiments.

[0100] In the embodiments provided by this invention, it should be understood that the disclosed systems, methods, and approaches can be implemented in other ways. For example, the system embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between systems or units may be electrical, mechanical, or other forms.

[0101] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0102] In addition, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit.

[0103] Similarly, in the various embodiments of the present invention, each processing unit can be integrated into a functional module, or each processing unit can exist physically, or two or more processing units can be integrated into a functional module.

[0104] The present invention will be further described in conjunction with the accompanying drawings and specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined in this application.

Claims

1. A method for detecting a DNS tunneling attack, characterized in that, The method comprises the following steps: S1: collecting traffic logs through network monitoring, and generating corresponding data sets for the collected historical data and online data respectively by using filters; S2: extracting preset features from the data set of historical data, performing sample processing by using oversampling technology after feature processing, selecting a genetic algorithm to optimize model parameters, and performing model training to determine a detection model; S3: extracting preset features from the data set of online data, performing rule analysis by using a model classifier to run the detection model after feature processing, and generating a detection result; The sample processing by using the oversampling technology comprises: noise elimination; deletion of ambiguous samples; sample synthesis; The noise elimination comprises: reducing the possibility of generating noise by deleting outliers, calculating the distance between sample points by using the Euclidean distance, and the formula is as follows: calculating the distance of each minority sample from the same type, and the formula is as follows: wherein, is the number of minority class samples; normalizing and converting to deviation degree by using the following formula: According to the abnormality detection method of the box plot, the noise points less than are removed. The deletion of ambiguous samples comprises: Using the Euclidean distance, the number of nearest neighbors for each minority sample is calculated. If the majority of the nearest neighbors are of the same class as the sample, the sample is retained. If the majority of the nearest neighbors are of a different class, the sample is removed. If the majority of the nearest neighbors are of the same class as the sample, the sample is retained. If the majority of the nearest neighbors are of a different class, the sample is removed.

2. The method of claim 1, wherein, The data set comprises: DNS covert tunnel samples and normal DNS traffic samples, wherein the DNS covert tunnel samples comprise iodine, dnscat, dns2tcp, and cobalt strike.

3. The method of claim 1, wherein, The preset features comprise: query and response domain name length, request time interval, domain name confusion degree, Query message payload load, upload and download ratio of effective payload, DNS packet quantity, resource record type, percentage of numerical characters in domain name, number of different characters in domain name, and consecutive consonant letters.

4. The method of claim 1, wherein, The sample synthesis comprises: The number of samples to be generated is calculated according to the following formula The calculation method is shown as follows: wherein, is the number of majority class samples, is the number of minority class samples; According to a few samples of nearest neighbors, randomly select the nearest neighbors, and construct a new sample according to the following formula: The number of new samples synthesized from each sample is: where, is The number of in-neighbors of the same class, as opposed to ADASYN; Z is a normalization factor to ensure that the left half of the formula constitutes a distribution.

5. A system for detecting DNS tunneling attacks, the system comprising: comprises: a data collection module, configured to collect traffic logs through network monitoring, and generate corresponding data sets for the collected historical data and online data respectively by using filters; an offline training module, configured to extract preset features from the data set of historical data, perform sample processing by using oversampling technology after feature processing, select a genetic algorithm to optimize model parameters, and perform model training to determine a detection model; an online detection module, configured to extract preset features from the data set of online data, perform rule analysis by using a model classifier to run the detection model after feature processing, and generate a detection result; The sample processing by using the oversampling technology comprises: noise elimination; deletion of ambiguous samples; sample synthesis; The noise elimination comprises: reducing the possibility of generating noise by deleting outliers, calculating the distance between sample points by using the Euclidean distance, and the formula is as follows: calculating the distance of each minority sample from the same type, and the formula is as follows: wherein, is the number of minority class samples; normalizing and converting to deviation degree by using the following formula: According to the abnormality detection method of the box plot, the noise points less than are removed. The deletion of ambiguous samples comprises: Using the Euclidean distance, the k nearest neighbors of each minority sample are calculated; if the majority of the k nearest neighbors are of the same class as the sample, the sample is retained, otherwise the sample is removed. If the majority of the k nearest neighbors are of the same class as the sample, the sample is retained, otherwise the sample is removed.

6. An apparatus for detecting a DNS tunneling attack, the apparatus comprising: comprises: a memory, configured to store a computer program; a processor, configured to implement the steps of the DNS tunnel attack detection method according to any one of claims 1 to 4 when the computer program is executed.

Images