Covert channel identification method, device, computer equipment and storage medium

Abstract

This application discloses a covert channel identification method, apparatus, computer device, and storage medium. The method includes obtaining a DNS tunnel domain name to be detected, extracting target domain name features of the DNS tunnel domain name using a DFA algorithm, performing feature enhancement processing on the target domain name features using a convolutional neural network algorithm and a long short-term memory algorithm, respectively, to obtain local enhancement features corresponding to the convolutional neural network algorithm and global enhancement features corresponding to the long short-term memory algorithm; and determining whether the DNS tunnel domain name is a DNS covert tunnel domain name of a covert channel based on the fused features of the local and global enhancement features. This method can effectively improve recognition accuracy, reduce the possibility of misjudgment, and thus improve the efficiency of covert channel identification.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and specifically relates to a covert channel identification method, apparatus, computer equipment, and storage medium. Background Art

[0002] A covert channel is a method of transmitting information in violation of system security policies, bypassing mandatory security mechanisms. Common covert channels include those based on the Hypertext Transfer Protocol (HTTP), the Domain Name System (DNS), and the Internet Control Message Protocol (ICMP). DNS covert channels involve transmitting covert information within legitimate DNS messages.

[0003] In related technologies, DNS covert channel identification methods can use rule-based feature matching and traffic anomaly detection methods to build a feature library and match the traffic packets to be detected with the features in the existing feature database to identify covert channels. However, attackers can bypass rule-based and traffic anomaly detection by modifying features such as domain name length and the number of subdomain requests, making it impossible to effectively identify covert channels. Summary of the Invention

[0004] The embodiments of the present application provide a covert channel identification method, apparatus, device, and storage medium, which can solve the problem of low efficiency in covert channel identification in the prior art.

[0005] In a first aspect, an embodiment of the present application provides a covert channel identification method, which may include:

[0006] Get the DNS tunnel domain name to be tested;

[0007] Extract the target domain name features of the DNS tunnel domain name through the DFA algorithm;

[0008] The target domain name features are enhanced by the convolutional neural network algorithm and the long short-term memory algorithm to obtain enhanced features. The enhanced features include local enhanced features corresponding to the convolutional neural network algorithm and global enhanced features corresponding to the long short-term memory algorithm.

[0009] According to the fusion feature obtained by fusing the local enhancement feature and the global enhancement feature, it is determined whether the DNS tunnel domain name is the DNS covert tunnel domain name of the covert channel.

[0010] In a second aspect, an embodiment of the present application provides a covert channel identification device, which may include:

[0011] The acquisition module is used to obtain the DNS tunnel domain name to be detected;

[0012] An extraction module, used to extract target domain name features of the DNS tunnel domain name through a DFA algorithm;

[0013] A processing module is used to perform feature enhancement processing on the target domain name features using a convolutional neural network algorithm and a long short-term memory algorithm, respectively, to obtain enhanced features, wherein the enhanced features include local enhanced features corresponding to the convolutional neural network algorithm and global enhanced features corresponding to the long short-term memory algorithm;

[0014] The determination module is used to determine whether the DNS tunnel domain name is a DNS covert tunnel domain name of a covert channel according to a fusion feature obtained by fusing the local enhancement feature and the global enhancement feature.

[0015] In a third aspect, an embodiment of the present application provides a computing device, the computing device comprising: a processor and a memory storing computer program instructions;

[0016] When the processor executes the computer program instructions, the covert channel identification method as shown in the first aspect is implemented.

[0017] In a fourth aspect, an embodiment of the present application provides a computer storage medium having computer program instructions stored thereon. When the computer program instructions are executed by a processor, the covert channel identification method as shown in the first aspect is implemented.

[0018] In a fifth aspect, an embodiment of the present application provides a chip, which includes a processor and a communication interface, the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the covert channel identification method shown in the first aspect.

[0019] In a sixth aspect, an embodiment of the present application provides a computer program product, which is stored in a storage medium and executed by at least one processor to implement the covert channel identification method as shown in the first aspect.

[0020] The covert channel identification method, device, equipment and storage medium of the embodiment of the present application obtains the DNS tunnel domain name to be detected, and extracts the target domain name features of the DNS tunnel domain name through the DFA algorithm. Then, the target domain name features are respectively enhanced by the convolutional neural network algorithm and the long short-term memory algorithm to obtain enhanced features. The enhanced features include local enhanced features corresponding to the convolutional neural network algorithm and global enhanced features corresponding to the long short-term memory algorithm. Then, based on the fusion features after the fusion of the local enhanced features and the global enhanced features, it is determined whether the DNS tunnel domain name is a DNS covert tunnel domain name of a covert channel. In this way, the semantic features of the DNS tunnel domain name can be fully exploited, and the DFA algorithm can be used to analyze whether the DNS tunnel domain name is composed of unordered characters or a full dictionary to distinguish the composition structure of the domain name, thereby extracting the target domain name features of the DNS tunnel domain name under different domain name structures, and realizing different extraction algorithms corresponding to different target domain name features to accurately extract the target domain name features. In addition, by extracting local enhancement features and global enhancement features through the convolutional neural network algorithm and the long short-term memory algorithm, and judging whether the DNS tunnel domain name is the DNS covert tunnel domain name of the covert channel based on the fusion features of the local enhancement features and the global enhancement features, it can effectively improve the recognition accuracy, reduce the possibility of misjudgment, and thus improve the efficiency of covert channel identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0022] Figure 1 A schematic diagram of the structure of a covert channel identification architecture provided in an embodiment of the present application;

[0023] Figure 2 A schematic diagram of a covert channel identification method provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of a process for determining a target domain name structure in a covert channel identification method provided in an embodiment of the present application;

[0025] Figure 4 This is a schematic diagram of a process for determining enhanced features in a covert channel identification method provided in an embodiment of the present application;

[0026] Figure 5 This is a second flow chart of determining enhanced features in a covert channel identification method provided in an embodiment of the present application;

[0027] Figure 6A schematic diagram of a process for determining fusion features in a covert channel identification method provided in an embodiment of the present application;

[0028] Figure 7 This is a schematic diagram of the structure of a covert channel identification device provided by an embodiment of the present application;

[0029] Figure 8 It is a structural diagram of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0030] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is merely to provide a better understanding of the present application by illustrating the examples of the present application.

[0031] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0032] In related technologies, methods for identifying DNS covert channels can use rule-based feature matching and traffic anomaly-based detection methods. These methods construct a feature library and match the traffic packets to be detected with features in an existing feature database to identify covert channels. However, attackers can easily bypass rule-based and traffic anomaly detection by modifying features such as domain name length and the number of subdomain requests, making it impossible to effectively identify covert channels. Furthermore, these methods require manual compilation and updating of the rule library and are unable to identify unknown covert channels, which not only reduces identification efficiency but also leads to a high rate of missed detections.

[0033] In addition, some methods use machine learning or deep learning to identify DNS covert channels. They mainly extract information from DNS traffic packets to construct traditional statistical features, such as domain name length, DNS request and response ratio, number of visits, information entropy size, and other features as model input. However, for covert channel domain names generated entirely by dictionaries using the Domain Generation Algorithm (DGA), since their character distribution patterns are very similar to those of normal domain names, the above-mentioned recognition methods cannot effectively extract semantic information from them, reducing the recognition effect.

[0034] Thus, in order to solve the above problems, the embodiment of the present application provides a covert channel identification method, which can fully explore the semantic features of the DNS tunnel domain name, judge the composition structure of the domain name in advance, and use the Deterministic Finite Automaton (DFA) algorithm to analyze whether the domain name is composed of disordered characters or a full dictionary. In this way, by taking different features, namely, the attention mechanism (attention fusion) based on statistical features and Chinese language model word segmentation algorithm (n-gram) character features or the attention fusion based on statistical features and dictionary features, through the natural language processing field, namely the Convolutional Neural Networks (CNN) and the Long Short-Term Memory (LSTM) algorithm. The invention relates to a method for detecting a DNS tunnel domain name that is a covert channel. The method adopts a BERT detection model to detect whether the DNS tunnel domain name is a DNS covert tunnel domain name of a covert channel. The method has a better detection effect than the covert channel domain name constructed entirely from a dictionary and generated by DGA. At the same time, in order to further improve the recognition accuracy, the covert channel identification method provided in the embodiment of the present application can also add a step of DNS traffic backtracking on the basis of the detection output result of the BERT detection model. By combining the expert experience of DNS tunnel stealing Trojans and remote control Trojans, corresponding rule strategies are constructed for secondary verification to avoid false positives caused by the use of DNS tunnels by some legitimate software, thereby improving the recognition efficiency and accuracy of covert channels.

[0035] Based on this, the embodiment of the present application provides a covert channel identification architecture, such as Figure 1 As shown, the covert channel identification architecture may include an extraction module 10 , a model processing module 20 , a Bert detection model 30 , a secondary verification module 40 and an output module 50 .

[0036] The following combination Figure 1, the covert channel identification architecture provided in the embodiment of the present application is described in detail.

[0037] like Figure 1 As shown, in one or more possible embodiments, the extraction module 10 is configured to obtain a DNS tunnel domain name to be detected and perform domain name structure identification using a DFA algorithm to determine whether the target domain name structure of the DNS tunnel domain name is a dictionary domain name structure. This structure is used to distinguish whether the domain name is composed of Chinese and English phonetic dictionaries or random characters. If the target domain name structure is a dictionary domain name structure, i.e., the domain name is composed of Chinese and English phonetic dictionaries, then target domain name features, i.e., statistical features and dictionary features, are extracted from the DNS tunnel domain name. Conversely, if the target domain name structure is not a dictionary domain name structure, i.e., the domain name is composed of random characters, then target domain name features, i.e., statistical features and character features, are extracted from the DNS tunnel domain name.

[0038] The model processing module 20 is configured to receive the target domain name features output by the extraction module 10 and extract local and global features from the target domain name features using the convolutional neural network algorithm and the long short-term memory algorithm within the model processing module 20. The module also utilizes block convolution to enhance the local features of the convolutional neural network algorithm and utilizes grouped feature similarity to enhance the global features of the long short-term memory algorithm, thereby obtaining enhanced features. The enhanced features include local enhanced features corresponding to the convolutional neural network algorithm and global enhanced features corresponding to the long short-term memory algorithm. The model processing module 20 is further configured to fuse the local enhanced features and the global enhanced features using an attention mechanism to obtain fused features.

[0039] The Bert detection model 30 is used to receive the fusion features output by the model processing module 20 and use them as input to the Bert detection model. In this way, the Bert detection model is used to perform text classification on the fusion features to obtain text classification results of the fusion features.

[0040] The output module 50 is used to output a result of whether the DNS tunnel domain name is a DNS covert tunnel domain name of a covert channel according to the text classification result output by the BERT detection model 30.

[0041] In one or more other possible embodiments, since some legitimate applications may also use DNS tunnel domain names, making it impossible to effectively distinguish them, in order to avoid such problems, the embodiments of the present application may further provide a secondary verification module 40, which can be used to perform a secondary verification on the text classification results output by the BERT detection model 30. Specifically, the secondary verification module 40 can be used to obtain DNS traffic data corresponding to the DNS tunnel domain name; verify the DNS traffic data using a preset expert experience rule library to obtain a verification result; if the verification result indicates that the DNS traffic data complies with the preset expert rules in the preset expert experience rule library, determine that the DNS tunnel domain name is a DNS hidden tunnel domain name.

[0042] Based on the above covert channel identification architecture, the present invention provides a covert channel identification method, device, equipment and storage medium. Figures 2 to 6 , describes in detail the covert channel identification method, device, equipment and storage medium of the embodiments of the present application. It should be noted that these embodiments are not intended to limit the scope of disclosure of the present application.

[0043] The following combination Figure 2 The covert channel identification method provided in the embodiment of the present application is described in detail.

[0044] Figure 2 A flowchart of a covert channel identification method provided in an embodiment of the present application.

[0045] like Figure 2 As shown, the covert channel identification method can be applied to Figure 1 The covert channel identification architecture shown in FIG. 1 and the covert channel identification method may specifically include the following steps:

[0046] In step 210, the DNS tunnel domain name to be detected is obtained; in step 220, the target domain name features of the DNS tunnel domain name are extracted through the DFA algorithm; in step 230, the target domain name features are enhanced by the convolutional neural network algorithm and the long short-term memory algorithm, respectively, to obtain enhanced features, where the enhanced features include local enhanced features corresponding to the convolutional neural network algorithm and global enhanced features corresponding to the long short-term memory algorithm; in step 240, whether the DNS tunnel domain name is a DNS covert tunnel domain name of a covert channel is determined based on the fusion features after the local enhanced features and the global enhanced features are fused.

[0047] This allows us to fully exploit the semantic features of DNS tunnel domain names. Using the DFA algorithm, we analyze whether DNS tunnel domain names consist of unordered characters or a complete dictionary, thereby distinguishing the domain name's structure. This allows us to extract target domain features from DNS tunnel domain names with different domain name structures. By implementing different extraction algorithms tailored to the specific target domain features, we can accurately extract target domain features. Furthermore, using a convolutional neural network algorithm and a long short-term memory algorithm, we extract local and global enhancement features. Based on the fusion of these local and global enhancement features, we can determine whether a DNS tunnel domain name is a covert channel DNS tunnel domain name. This effectively improves recognition accuracy, reduces the likelihood of misjudgment, and ultimately increases the efficiency of covert channel identification.

[0048] The above steps are explained in detail below:

[0049] First, step 220 is involved. In one or more possible embodiments, the target domain name feature includes a first domain name feature. Based on this, step 220 may specifically include:

[0050] Step 2201: Identify the DNS tunnel domain name using the DFA algorithm to obtain the target domain name structure of the DNS tunnel domain name.

[0051] Step 2202: Based on the preset association information between the domain name structure and the feature extraction algorithm, a target feature extraction algorithm corresponding to the target domain name structure is obtained;

[0052] Step 2203: Extract the features in the DNS tunnel domain name through a target feature extraction algorithm to obtain a first domain name feature.

[0053] In an example, step 2201 may specifically include:

[0054] Step 22011: Perform a long match strategy check on the DNS tunnel domain name using the DFA algorithm to obtain the number of matching words in the DNS tunnel domain name.

[0055] Step 22012: If the number of words is greater than or equal to the preset number of words, determine whether the total length of the words matched in the DNS tunnel domain name is greater than or equal to the total length of the DNS tunnel domain name;

[0056] Step 22013: When it is determined that the total length of the words is greater than or equal to the total length of the domain name, the target domain name structure is determined to be a dictionary domain name structure.

[0057] Based on this, the target feature extraction algorithm may include a DFA domain name segmentation algorithm and a word frequency inverse text frequency index conversion algorithm. The first domain name feature includes a dictionary feature. Thus, the above-mentioned step 2203 may specifically include:

[0058] Step 22031: Segment the DNS tunnel domain name using the DFA domain name segmentation algorithm to obtain segmentation objects, where the segmentation objects include at least one of the following: Chinese words, English words, and Pinyin.

[0059] Step 22032: Convert the segmented objects using a word frequency inverse text frequency index conversion algorithm to obtain dictionary features.

[0060] It should be noted that the term frequency inverse document frequency index conversion algorithm (TF-IDF) in the embodiment of the present application, wherein the term frequency is (Term Frequency, TF), the inverse document frequency index (Inverse Document Frequency, IDF), wherein TF-IDF is a commonly used weighting technology for information retrieval and data mining.

[0061] Exemplarily, the DNS tunnel domain name is segmented using the DFA domain name segmentation algorithm to obtain segmentation objects. Each segmentation object, that is, each Chinese word, each English word, or each pinyin, is a feature dimension, and TF-IDF feature extraction is performed on each domain name composed of the segmentation objects.

[0062] The TF-IDF algorithm can be implemented using the following formula (1):

[0063]

[0064] After calculation by the TF-IDF algorithm, the domain name composed of each segmented object can be converted into a matrix with a dimension of 1*r1, where r1 represents the TF-IDF feature vector dimension of the domain name.

[0065] In another example, after step 22011, the covert channel identification method may further include:

[0066] When the number of words is less than the preset number of words, it is determined that the target domain name structure is a non-dictionary domain name structure.

[0067] Alternatively, after step 22013, the covert channel identification method may further include:

[0068] When it is determined that the total word length is less than the total domain name length, the target domain name structure is determined to be a non-dictionary domain name structure.

[0069] Based on this, the target feature extraction algorithm includes the Chinese language model word segmentation algorithm and the word2vec algorithm (word to vector), and the first domain name feature includes a character feature. Thus, the above-mentioned step 2203 may specifically include:

[0070] Use the Chinese language model word segmentation algorithm to segment adjacent characters in the DNS tunnel domain name to obtain at least one random character;

[0071] Using the word2vec algorithm, text feature extraction is performed on each random character in the at least one random character to obtain a character feature.

[0072] For example, the Chinese language model word segmentation algorithm (n-gram word segmentation algorithm) divides each domain name into r consecutive characters (including special characters such as spaces) as a feature, and moves the window by one character unit each time the segmentation is performed. For example, after the domain name hyhirgh.com is segmented into 3-grams, it is obtained as [hyh, yhi, hir, irg, rgh, gh., hc, .co, com]. Then, after performing n-gram word segmentation on each domain name, word2vec text feature extraction is performed. After word2vec word vector conversion, a two-dimensional matrix vector of L*r2 can be obtained, where L represents the number of character features after the domain name is segmented into n-grams, and r2 represents the vector dimension of each character feature.

[0073] In addition, in one or more other possible embodiments, the target domain name feature further includes a second domain name feature. Based on this, the covert channel identification method may further include:

[0074] Step 2501: Acquire domain name attribute information corresponding to the DNS tunnel domain name;

[0075] Step 2502: Determine the domain name attribute information as a second domain name feature;

[0076] The domain name attribute information includes at least one of the following: domain name length, domain name character ratio, domain name information entropy, number of requests, number of subdomains, and number of consecutive digits in the domain name.

[0077] For example, since the request domain name generated when the DNS covert tunnel is running is long and contains a large number of irregular characters, the domain name length, domain name character ratio (domain name letter frequency), domain name information entropy (the degree of confusion of domain name letters), number of requests, number of subdomains, number of consecutive numbers in the domain name, etc. can be used as the second domain name features, such as Figure 1 The statistical characteristics shown in .

[0078] Thus, it can be combined Figure 3 The above step 220 is described in detail.

[0079] like Figure 3As shown, in the embodiments of the present application, the target domain name structure of the DNS tunnel domain name can be identified by the DFA algorithm. That is, as the offensive and defensive confrontations escalate, the attackers' technology is also becoming increasingly advanced. In order to better evade detection and blocking, some covert tunnel domain names use domain name generation algorithms based on Chinese and English word phonetic dictionaries. Unlike the early domain name generation algorithms based on random characters, the DNS tunnel domain name generation algorithms based on Chinese and English words and phonetic dictionaries construct domain names by randomly selecting multiple words from an embedded word list. Because they are similar to the naming rules of benign domain names, character feature-based methods will increase the difficulty of detecting such covert tunnel domain names. Therefore, this type of DNS tunnel domain name has the characteristics of low character distribution randomness and high word combination randomness.

[0080] Domain name example:

[0081] consistentcrazyanxioussleepentireexactbearbankbeach.climbclose.com

[0082] Among them, the above-mentioned domain name is composed of the words consistent, crazy, anxious, sleep, entire, exact, bear, bank, beach, climb, and close. If the feature extraction method based on statistical features and character features is still used, the semantic structure of the domain name word composition will be lost. Therefore, the covert channel identification method provided in the embodiment of the present application can be based on the statistical features and word feature extraction method. By judging the domain name structure in advance, the word composition structure of the domain name can be detected, which is conducive to the model learning its word combination logic and word semantic information.

[0083] The judgment logic is as follows: the DFA algorithm is used to perform long matching strategy detection on the DNS tunnel domain name to be detected. The dictionary consists of the first 10,000 commonly used English words and some Chinese words spelled in English. Here, the long matching strategy detection is explained as follows: If the domain name contains studying, and the constructed dictionary contains study and studying, then according to the long matching strategy detection, studying will be matched and output instead of study. In addition to ignoring the top-level domain name, when the number of words matched by the DFA algorithm is greater than or equal to 2 and the total length of the words is equal to the total length of the domain name after removing the top-level domain name, it indicates that the domain name is composed of a random combination of words, and the corresponding target feature extraction algorithm is selected accordingly.

[0084] Furthermore, regarding step 230, since the dimension of the statistic feature is 1*k, the dimension of the dictionary feature is 1*r1, and the dimension of the character feature is k*r1, and k < r1, k < r2, it is necessary to pad the statistic feature with 0 to make the dimension consistent when concatenating with the dictionary or character feature. Since CNN is good at extracting phrase information and LSTM is good at capturing global context information, the input data is respectively used by CNN and LSTM to extract local features and global features. However, whether it is the local or global features extracted by CNN or LSTM, they are all composed of small sub-feature groups, and there is no importance distinction between each sub-feature group. In order to weaken the unimportant sub-feature groups and strengthen the weights of the important sub-feature groups, in the embodiments of the present application, the local features extracted by CNN and all the features extracted by LSTM are respectively subjected to feature enhancement. <> <>

[0085] Based on this, in one or more possible embodiments, step 230 may specifically include: <> <>

[0086] Step 2301, extracting local features of the target domain name feature through a convolutional neural network algorithm to obtain local domain name features; <> <>

[0087] Step 2302, and extracting global features of the target domain name feature through a long short-term memory algorithm to obtain global domain name features; <> <>

[0088] Step 2303, performing block convolution local feature enhancement processing on the local domain name features to obtain local enhanced features; <> <>

[0089] Step 2304, and performing global feature enhancement processing on the global domain name features through grouped feature similarity to obtain global enhanced features. <> <>

[0090] In one example, step 2303 mentioned above may specifically include: <> <>

[0091] According to the first preset division condition, equally dividing the local domain name features into blocks to obtain N block matrices, where N is a positive integer; <> <>

[0092] Using the target convolution kernel in the convolutional neural network corresponding to the convolutional neural network algorithm to perform convolution operations on each of the N block matrices respectively, to obtain the first convolution result of each convolution layer in the M convolution layers of each block matrix in the target convolution kernel, where M is a positive integer; <> <>

[0093] According to the M first convolution results, calculating the second convolution result corresponding to each block matrix and the target convolution kernel; <> <>

[0094] According to the N second convolution results, calculating the third convolution result corresponding to the N block matrices and the target convolution kernel;

[0095] Processing the first mean value corresponding to the second convolution result and the second mean value corresponding to the third convolution result by a normalized exponential function to obtain a first probability value;

[0096] Performing probability assignment on each block matrix according to the first probability value to obtain a first assignment result of each block matrix;

[0097] Screening a first target assignment result that satisfies a first preset assignment result from the N first assignment results;

[0098] The features after the target block matrix conversion corresponding to the first target assignment result are determined as local enhancement features.

[0099] For example, Figure 4 As shown, the block convolution local feature enhancement process is as follows. This process can be achieved by equally dividing the local features extracted by the CNN model into blocks. For example, the input matrix dimension is R m*k , the segmentation length is 3, then the segmented block matrix n = m*k / (3*3). Specifically, the extracted local features are segmented into n equal blocks to obtain n block matrices; the same convolution kernel, namely the target convolution kernel conv(k*k), is used to perform convolution operations on the n block matrices; the sum of each block convolution layer is accumulated, namely the second convolution result sum i ,i=1,....,n; calculate the sum of all block convolution layers, that is, the third convolution result sum i and sum all Find the average value avg i ,avg sum ; Calculate softmax(avg i / avg sum ); Then, the block matrix partial_n is assigned with softmax probability to weaken the unimportant group feature group or strengthen the important group feature group.

[0100] In order to better illustrate that the above process is feasible, the pseudo code is provided below:

[0101]

[0102] In another example, this step is different from the existing method. In addition to considering the similarity between each local feature in the group and the global average feature of the group, the similarity between it and the global features of all groups is also considered. Based on the similarity, the importance of the local features in the group within its group and between all groups is analyzed to assign weights.

[0103] Based on this, the above-mentioned step 2304 may specifically include:

[0104] Divide the domain name global feature into N groups according to the second preset division condition, where each of the N groups includes at least one sub-feature;

[0105] Calculate the feature mean of each group based on the sub-features in each group; and, based on the feature mean of each group, sum and average the feature means of N groups to obtain the feature mean of N groups;

[0106] Performing dot product similarity calculation on each sub-feature in each group and the feature mean of each group to obtain a first similarity set; and performing dot product similarity calculation on the sub-features in each group and the feature mean of N groups to obtain a second similarity set;

[0107] Performing regularization normalization processing on the first similarity set and the second similarity set respectively to obtain a first regularized set of the first similarity set and a second regularized set of the second similarity set;

[0108] Assigning a value to at least one sub-feature of each of the N groups using the weight values ​​calculated by the first regular set and the second regular set, to obtain a second assignment result for each sub-feature;

[0109] The target domain name global feature whose second assignment result satisfies the second preset assignment result is determined as the global enhanced feature.

[0110] It should be noted that the second preset division condition in the embodiment of the present application can be divided according to the feature dimension of the global feature of the domain name.

[0111] For example, Figure 5 As shown, the global feature enhancement process of group feature similarity is as follows: the global feature matrix R generated by LSTM l*c , divided into N groups according to the feature dimension, where l represents the number of features and c represents the dimension of the feature. For example, the Nth group can be expressed by the following formula (2):

[0112] Specifically, the extracted global features are divided into N groups; each group is subjected to feature s k Mean calculation; each local feature in the group and s k Doing point multiplication similarity calculation, we get right Do regularization; for all s k The mean is summed and averaged to obtain the characteristic mean s of all groups all; Traverse the local features and s in each group all Doing point multiplication similarity calculation, we get right Do regularization; and Perform full connection and weighted processing; use sigmoid activation function; multiply all group features of the original group by Assign weights to weaken unimportant group features or strengthen important group features.

[0113] In order to better illustrate that the above process is feasible, the pseudo code is provided below:

[0114]

[0115]

[0116] It should be noted that the above-mentioned steps 2301 and 2302 can be executed successively or simultaneously. Similarly, the above-mentioned steps 2303 and 2304 can be executed successively or simultaneously. No specific limitation is given here.

[0117] Then, step 240 is involved. In one or more possible embodiments, step 240 may specifically include:

[0118] Step 2401: Fusing the local enhanced features and the global enhanced features through an attention mechanism to obtain a fused feature.

[0119] Step 2402: Using the Bert detection model, perform text classification on the fused features to obtain a text classification result of the fused features.

[0120] Step 2403: When the text classification result is the first result, determine that the DNS tunnel domain name is the DNS covert tunnel domain name of the covert channel.

[0121] It should be noted that the Bert detection model (Bidirectional Encoder Representations from Transformer, BERT) in the embodiment of the present application is a bidirectional encoder of Transformer.

[0122] For example, since the BERT detection model is open source and performs very well in the field of natural language processing, it is represented by a bidirectional encoder of Transformer. In the embodiment of the present application, it can be transformed into a text classification problem by fusing the attention of the domain name semantic (character, dictionary) features and statistical features. The fused feature vector is used as the input of the BERT detection model to detect whether the domain name is a DNS hidden tunnel domain name.

[0123] Furthermore, the attention mechanism includes an average pooling algorithm, a maximum pooling algorithm, and a multi-layer perceptron (MLP) algorithm. Based on this, the above step 2401 may specifically include:

[0124] The local enhanced features are downsampled by the average pooling algorithm to obtain the average pooling feature Avgpool(F); and the global enhanced features are downsampled by the maximum pooling algorithm to obtain the maximum pooling feature Maxpool(F);

[0125] The multi-layer perceptron algorithm is used to perform weighted summation on the average pooling features and the maximum pooling features to obtain the fusion features.

[0126] For example, Figure 6 As shown in Figure 1, the channel attention mechanism is used to fuse the enhanced local features and global features. The main steps are as follows: the local enhanced features are downsampled using average pooling. The average value of the "divided pool block" is calculated to replace the pool block information. Average pooling can retain a large amount of information about the "less important" elements of the divided pool block, while maximum pooling is less effective in retaining local information. Similarly, the global enhanced features are downsampled using maximum pooling. The maximum value of the "divided pool block" is calculated to replace the pool block information. Maximum pooling can retain the "most important" element information of the divided pool block and reduce the interference of local useless information. The pooled features are respectively subjected to weighted summation calculation using a multi-layer perceptron (MLP) based on soft attention. The weight can be calculated by the query and key, and the weight is used to perform weighted summation on the value to obtain the attention value. Based on this, a new vector containing complementary information between different features can be obtained as the input of the classification model through the following formula (3).

[0127] M c (F)=MLP(AvgPool(F))+MLP(MaxPool(F)) (3)

[0128] Furthermore, in one or more other possible embodiments, after step 2402, the covert channel identification method may further include:

[0129] When the text classification result is the second result, obtaining DNS traffic data corresponding to the DNS tunnel domain name;

[0130] Through the preset expert experience rule base, the DNS traffic data is tested to obtain the test results;

[0131] When the inspection result indicates that the DNS traffic data complies with the preset expert rules in the preset expert experience rule base, the DNS tunnel domain name is determined to be the DNS covert tunnel domain name.

[0132] For example, since some legitimate applications also use DNS tunnel domain names, it is impossible to effectively distinguish them. In order to avoid such problems, the embodiment of the present application adds a step of DNS traffic backtracking on the basis of model detection of suspected DNS tunnel domain names. By combining the expert experience of DNS tunnel stealing Trojans and remote control Trojans, corresponding rule strategies are constructed to perform secondary inspections. When the model and rule strategies are met at the same time, there is a high probability that it is a covert channel domain name, where the preset expert rules may include at least one of the following: DNS tunnel stealing Trojan detection rules, DNS tunnel remote control Trojan detection rules.

[0133] Furthermore, the DNS tunnel stealing Trojan detection rules include at least one of the following: (1) domain name length > 50; (2) the number of requests for abnormal second-level domain names per second during the active period is greater than 2; (3) the request failure ratio is higher than 20%; (4) the number of requests for abnormal second-level domain names within one hour is greater than 500; (5) the number of different subdomains is greater than 200.

[0134] DNS tunnel remote control Trojan detection rules include at least one of the following: (1) The domain name length is greater than 36 characters; (2) The number of abnormal second-level domain name requests per second during the active period is greater than 2; (3) The proportion of TXT request types is greater than 70%; (4) The number of abnormal second-level domain name requests within an hour is greater than 250; (5) The number of different subdomains is greater than 100

[0135] Therefore, in the embodiments of the present application, the domain name structure can be pre-identified. Dictionary construction and the DFA algorithm are used to analyze whether the domain name consists of random characters or dictionary words. Modeling is then performed using attention fusion methods with different features. This method effectively detects covert channel domain names generated entirely from dictionary structures using DGA technology. Furthermore, to further improve accuracy, a DNS traffic backtracking step is added to the model detection output. By incorporating expert experience in DNS tunneling and remote control Trojans, corresponding rules and policies are constructed for secondary verification to avoid false positives caused by legitimate applications also using DNS tunneling. In this way, in the face of increasingly severe network security situations and evolving attack and defense technologies, where attackers can construct covert tunnels to steal valuable and sensitive data, the covert channel identification method provided in the embodiments of the present application can identify covert tunnel domain names based on random characters or word combinations. The model has strong generalization capabilities and can be applied to full-flow detection and website security protection products. It is widely used in the government and enterprise markets, identifying malicious network activity through DNS traffic analysis and providing security protection for users.

[0136] Based on the same inventive concept, the present application also provides a covert channel identification device. Figure 7 Provide detailed explanation.

[0137] Figure 7 It is a structural diagram of a covert channel identification device provided by an embodiment of the present application.

[0138] In some embodiments of the present application, Figure 7 The covert channel identification device shown can be set as follows Figure 1 The covert channel identification architecture shown in Figure 2.

[0139] like Figure 7 As shown, the covert channel identification device 70 may specifically include:

[0140] An acquisition module 701 is used to acquire a DNS tunnel domain name to be detected;

[0141] An extraction module 702 is configured to extract target domain name features of the DNS tunnel domain name using a DFA algorithm;

[0142] Processing module 703 is used to perform feature enhancement processing on the target domain name features using a convolutional neural network algorithm and a long short-term memory algorithm, respectively, to obtain enhanced features, where the enhanced features include local enhanced features corresponding to the convolutional neural network algorithm and global enhanced features corresponding to the long short-term memory algorithm;

[0143] The determination module 704 is configured to determine whether the DNS tunnel domain name is a DNS covert tunnel domain name of a covert channel according to a fusion feature obtained by fusing the local enhancement feature and the global enhancement feature.

[0144] In the embodiments of the present application, the semantic features of the DNS tunnel domain name can be fully exploited. The DFA algorithm is used to analyze whether the DNS tunnel domain name is composed of unordered characters or a full dictionary to determine the domain name structure. This allows the target domain name features of the DNS tunnel domain names under different domain name structures to be extracted, and different extraction algorithms are implemented according to different target domain name features to accurately extract the target domain name features. Furthermore, the convolutional neural network algorithm and the long short-term memory algorithm are used to extract local and global enhancement features. Based on the fusion features of the local and global enhancement features, it is determined whether the DNS tunnel domain name is a DNS covert tunnel domain name for a covert channel. This can effectively improve recognition accuracy, reduce the possibility of misjudgment, and thus improve the efficiency of covert channel identification.

[0145] The covert channel identification device 70 in the embodiment of the present application is described in detail below.

[0146] In one or more optional embodiments, the covert channel identification device 70 in the embodiment of the present application may further include an identification module; wherein,

[0147] an identification module, configured to identify the DNS tunnel domain name by using a DFA algorithm when the target domain name feature includes the first domain name feature, and obtain a target domain name structure of the DNS tunnel domain name;

[0148] The acquisition module 701 may also be used to acquire a target feature extraction algorithm corresponding to the target domain name structure based on preset association information between the domain name structure and the feature extraction algorithm;

[0149] The extraction module 702 may also be configured to extract features from the DNS tunnel domain name using a target feature extraction algorithm to obtain a first domain name feature.

[0150] In another or more optional embodiments, the covert channel identification device 70 in the embodiment of the present application may further include a detection module; wherein,

[0151] A detection module is used to perform a long matching strategy detection on the DNS tunnel domain name through a DFA algorithm to obtain the number of matching words in the DNS tunnel domain name;

[0152] The determination module 704 may also be configured to, when the number of words is greater than or equal to a preset number of words, determine whether the total length of the words matched in the DNS tunnel domain name is greater than or equal to the total length of the domain name of the DNS tunnel domain name;

[0153] The determination module 704 may also be configured to, when it is determined that the total length of the words is greater than or equal to the total length of the domain name, determine that the target domain name structure is a dictionary domain name structure.

[0154] In one or more optional embodiments, the covert channel identification device 70 in the embodiment of the present application may further include a segmentation module and a conversion module; wherein,

[0155] a segmentation module configured to segment the DNS tunnel domain name using the DFA domain name segmentation algorithm when the target feature extraction algorithm includes a DFA domain name segmentation algorithm and a word frequency inverse text frequency index conversion algorithm, and when the first domain name feature includes a dictionary feature, to obtain segmentation objects, where the segmentation objects include at least one of the following: Chinese words, English words, and pinyin;

[0156] The conversion module is used to convert the segmented objects through the word frequency inverse text frequency index conversion algorithm to obtain dictionary features.

[0157] In one or more optional embodiments, the determination module 704 may also be configured to, when the number of words is less than a preset number of words, determine that the target domain name structure is a non-dictionary domain name structure;

[0158] Alternatively, the determination module 704 may also be configured to determine that the target domain name structure is a non-dictionary domain name structure when it is determined that the total length of the words is less than the total length of the domain name.

[0159] In one or more optional embodiments, the covert channel identification device 70 in the embodiment of the present application may further include a first division module; wherein,

[0160] a first segmentation module configured to, when the target feature extraction algorithm includes a Chinese language model word segmentation algorithm and a word2vec algorithm and the first domain name feature includes a character feature, segment adjacent characters in the DNS tunnel domain name using the Chinese language model word segmentation algorithm to obtain at least one random character;

[0161] The extraction module 702 is further configured to extract text features from each of the at least one random character using a word2vec algorithm to obtain character features.

[0162] In one or more optional embodiments, the acquisition module 701 may also be configured to, when the target domain name feature further includes a second domain name feature, acquire domain name attribute information corresponding to the DNS tunnel domain name;

[0163] The determination module 704 can also be used to determine domain name attribute information as a second domain name feature; wherein the domain name attribute information includes at least one of the following: domain name length, domain name character ratio, domain name information entropy, number of requests, number of subdomains, and number of consecutive digits in the domain name.

[0164] In one or more optional embodiments, the extraction module 702 may further be configured to extract local features of the target domain name using a convolutional neural network algorithm to obtain local features of the domain name; and extract global features of the target domain name using a long short-term memory algorithm to obtain global features of the domain name.

[0165] The processing module 703 can also be used to perform block convolution local feature enhancement processing on the local features of the domain name to obtain local enhanced features; and perform global feature enhancement processing on the global features of the domain name by grouping feature similarities to obtain global enhanced features.

[0166] In one or more optional embodiments, the covert channel identification device 70 in the embodiment of the present application may further include a segmentation module, a convolution module, a statistics module, a first calculation module, an assignment module and a screening module; wherein,

[0167] A segmentation module, configured to equally segment the local features of the domain name into blocks according to a first preset segmentation condition to obtain N block matrices, where N is a positive integer;

[0168] A convolution module is used to perform a convolution operation on each of the N block matrices using a target convolution kernel in a convolutional neural network corresponding to the convolutional neural network algorithm, and obtain a first convolution result of each convolution layer of each block matrix in the M convolution layers in the target convolution kernel, where M is a positive integer;

[0169] A statistics module is used to count the second convolution results corresponding to each block matrix and the target convolution kernel based on the M first convolution results;

[0170] A first calculation module is used to calculate the third convolution results of N block matrices and the target convolution kernel according to the N second convolution results;

[0171] The processing module 703 may also be configured to process the first mean value corresponding to the second convolution result and the second mean value corresponding to the third convolution result using a normalized exponential function to obtain a first probability value;

[0172] an assignment module, configured to perform probability assignment on each block matrix according to the first probability value, to obtain a first assignment result for each block matrix;

[0173] A screening module, configured to screen a first target assignment result that satisfies a first preset assignment result from the N first assignment results;

[0174] The determination module 704 may also be configured to determine features converted from the target block matrix corresponding to the first target assignment result as local enhancement features.

[0175] In one or more optional embodiments, the covert channel identification device 70 in the embodiment of the present application may further include a second division module and a second calculation module; wherein,

[0176] A second division module is configured to divide the domain name global feature into N groups according to a second preset division condition, where each of the N groups includes at least one sub-feature;

[0177] A second calculation module is configured to calculate a feature mean of each group based on the sub-features in each group; and, based on the feature mean of each group, sum and average the feature means of N groups to obtain the feature means of the N groups;

[0178] The second calculation module can also be used to perform a dot product similarity calculation on each sub-feature in each group and the feature mean of each group to obtain a first similarity set; and traverse the sub-features in each group and perform a dot product similarity calculation on the feature means of N groups to obtain a second similarity set;

[0179] The processing module 703 may also be configured to perform regularization normalization processing on the first similarity set and the second similarity set respectively to obtain a first regularized set of the first similarity set and a second regularized set of the second similarity set;

[0180] The second calculation module may also be configured to assign a value to at least one sub-feature of each of the N groups using the weight values ​​calculated by the first regular set and the second regular set, to obtain a second assignment result for each sub-feature;

[0181] The determining module 704 may also be configured to determine the target domain name global feature whose second evaluation result satisfies the second preset evaluation result as a global enhanced feature.

[0182] In one or more optional embodiments, the covert channel identification device 70 in the embodiment of the present application may further include a fusion module and a classification module; wherein,

[0183] The fusion module is used to fuse local enhancement features and global enhancement features through the attention mechanism to obtain fusion features;

[0184] The classification module is used to perform text classification on the fused features through the Bert detection model to obtain the text classification results of the fused features;

[0185] The determination module 704 may also be configured to, when the text classification result is the first result, determine that the DNS tunnel domain name is a DNS covert tunnel domain name of a covert channel.

[0186] In one or more optional embodiments, the covert channel identification device 70 in the embodiment of the present application may further include a sampling module and a third calculation module; wherein,

[0187] A sampling module is used to, when the attention mechanism includes the average pooling algorithm, the maximum pooling algorithm, and the multi-layer perceptron algorithm, perform feature downsampling on the local enhanced features by the average pooling algorithm to obtain the average pooling features; and perform feature downsampling on the global enhanced features by the maximum pooling algorithm to obtain the maximum pooling features;

[0188] The third computing module is used to perform weighted summation of the average pooling features and the maximum pooling features through a multi-layer perceptron algorithm to obtain a fusion feature.

[0189] In one or more optional embodiments, the covert channel identification device 70 in the embodiment of the present application may further include a verification module; wherein,

[0190] The acquisition module 701 may also be configured to, when the text classification result is the second result, acquire DNS traffic data corresponding to the DNS tunnel domain name;

[0191] The inspection module is used to inspect DNS traffic data using a preset expert experience rule base to obtain inspection results;

[0192] The determination module 704 may also be configured to determine that the DNS tunnel domain name is a DNS covert tunnel domain name when the inspection result indicates that the DNS traffic data conforms to a preset expert rule in a preset expert experience rule library.

[0193] Based on the same inventive concept, the present application also provides a computer device. Figure 8 Provide detailed explanation.

[0194] Figure 8 It is a structural diagram of a computer device provided in one embodiment of the present application.

[0195] like Figure 8 As shown, the computer device may include at least one of the following involved in the embodiments of the present application: an electronic device, a server. The computer device may include a processor 801 and a memory 802 storing computer program instructions.

[0196] Specifically, the processor 801 may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0197] The memory 802 may include a large capacity memory for data or instructions. By way of example and not limitation, the memory 802 may include a hard disk drive (HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a universal serial bus (USB) drive, or a combination of two or more of these. Where appropriate, the memory 802 may include a removable or non-removable (or fixed) medium. Where appropriate, the memory 802 may be inside or outside the integrated gateway disaster recovery device. In a specific embodiment, the memory 802 is a non-volatile solid-state memory. In a specific embodiment, the memory 802 includes a solid-state memory (ROM). Where appropriate, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or a flash memory, or a combination of two or more of these.

[0198] The processor 801 implements any one of the covert channel identification methods in the above embodiments by reading and executing computer program instructions stored in the memory 802.

[0199] In one example, the computer device may further include a communication interface 803 and a bus 810. Figure 8 As shown, the processor 801, the memory 802, and the communication interface 803 are connected via a bus 810 and communicate with each other.

[0200] The communication interface 803 is mainly used to implement communication between various modules, devices, units and / or equipment in the embodiments of the present application.

[0201] Bus 810 comprises hardware, application or both, and the parts of flow control device are coupled to each other.For example, and not limitation, bus can comprise accelerated graphics port (AGP) or other graphics bus, enhanced industry standard architecture (EISA) bus, front side bus (FSB), hypertransport (HT) interconnection, industry standard architecture (ISA) bus, infinite bandwidth interconnection, low pin count (LPC) bus, memory bus, micro channel architecture (MCA) bus, peripheral component interconnection (PCI) bus, PCI-Express (PCI-X) bus, serial advanced technology attachment (SATA) bus, video electronics standard association local (VLB) bus or other suitable bus or two or more of these combinations.In suitable cases, bus 810 can comprise one or more buses.Although the present application embodiment describes and shows specific bus, the application considers any suitable bus or interconnection.

[0202] The computer device can execute the covert channel identification method in the embodiment of the present application, thereby realizing the combination Figures 1 to 7 Described covert channel identification method and device.

[0203] In addition, in conjunction with the covert channel identification method in the above embodiments, embodiments of the present application may provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any of the covert channel identification methods in the above embodiments is implemented.

[0204] It should be understood that the present application is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted here. In the above embodiments, several specific steps are described and illustrated as examples. However, the method process of the present application is not limited to the specific steps described and illustrated. Those skilled in the art can make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present application.

[0205] The functional blocks shown in the above block diagram can be implemented as hardware, application, firmware or a combination thereof. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in an application, the elements of the present application are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link by a data signal carried in a carrier wave. "Machine-readable medium" can include any medium that can store or transmit information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, optical fiber media, radio frequency (RF) links, etc. The code segment can be downloaded via a computer network such as the Internet, an intranet, etc.

[0206] It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, this application is not limited to the order of the above steps. In other words, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0207] The above is only a specific implementation method of the present application. Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the systems, modules and units described above can refer to the corresponding processes in the aforementioned method embodiments, and will not be repeated here. It should be understood that the scope of protection of the present application is not limited to this. Any technician familiar with this technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in this application, and these modifications or replacements should be included in the scope of protection of this application.

Claims

1. A covert channel identification method, characterized in that: include: Get the DNS tunnel domain name to be tested; Extracting target domain name features of the DNS tunnel domain name through a target feature extraction algorithm, where the target domain name features include a first domain name feature; Extracting local features of the target domain name features using a convolutional neural network algorithm to obtain local features of the domain name; and extracting global features of the target domain name features using a long short-term memory algorithm to obtain global features of the domain name; According to a first preset division condition, the domain name local features are equally divided into blocks to obtain N block matrices, where N is a positive integer; through the target convolution kernel in the convolutional neural network corresponding to the convolutional neural network algorithm, a convolution operation is performed on each block matrix in the N block matrices to obtain a first convolution result of each convolution layer of the M convolution layers in the target convolution kernel of each block matrix, where M is a positive integer; based on the M first convolution results, a second convolution result corresponding to each block matrix and the target convolution kernel is counted; based on the N second convolution results, a third convolution result corresponding to the N block matrices and the target convolution kernel is calculated; through a normalized exponential function, a first mean corresponding to the second convolution result and a second mean corresponding to the third convolution result are processed to obtain a first probability value; based on the first probability value, a probability assignment is performed on each block matrix to obtain a first assignment result of each block matrix; a first target assignment result that meets the first preset assignment result is screened from the N first assignment results; Determine the features after target block matrix conversion corresponding to the first target assignment result as local enhancement features; and, dividing the domain name global feature according to a second preset division condition to obtain N groups, each of the N groups including at least one sub-feature; Calculating the feature mean of each group based on the sub-features in each group; and, based on the feature mean of each group, summing and averaging the feature means of the N groups to obtain the feature mean of the N groups; performing dot product similarity calculation on each sub-feature in each group and the feature mean of each group to obtain a first similarity set; and, traversing the sub-features in each group and performing dot product similarity calculation on the feature means of the N groups to obtain a second similarity set; performing regularization normalization processing on the first similarity set and the second similarity set to obtain a first regularized set of the first similarity set and a second regularized set of the second similarity set; assigning a value to at least one sub-feature of each of the N groups using the weight values ​​calculated from the first regularized set and the second regularized set to obtain a second assignment result for each sub-feature; Determining the target domain name global feature that the second assignment result satisfies the second preset assignment result as a global enhanced feature; Using a Bert detection model, performing text classification on the fused features formed by fusing the local enhancement features and the global enhancement features to obtain a text classification result of the fused features; When the text classification result is the first result, determining that the DNS tunnel domain name is a DNS covert tunnel domain name of a covert channel; The method of extracting the target domain name feature of the DNS tunnel domain name by using a target feature extraction algorithm includes: identifying the DNS tunnel domain name by using a DFA algorithm to obtain a target domain name structure of the DNS tunnel domain name; obtaining a target feature extraction algorithm corresponding to the target domain name structure based on preset association information between the domain name structure and the feature extraction algorithm; and extracting features from the DNS tunnel domain name by using the target feature extraction algorithm to obtain the first domain name feature.

2. The method according to claim 1, characterized in that The identifying the DNS tunnel domain name by the DFA algorithm and obtaining the target domain name structure of the DNS tunnel domain name includes: Performing a long match strategy detection on the DNS tunnel domain name using the DFA algorithm to obtain the number of matching words in the DNS tunnel domain name; If the number of words is greater than or equal to the preset number of words, determining whether the total length of the words matched in the DNS tunnel domain name is greater than or equal to the total length of the domain name of the DNS tunnel domain name; When it is determined that the total length of the words is greater than or equal to the total length of the domain name, the target domain name structure is determined to be a dictionary domain name structure.

3. The method according to claim 2, characterized in that The target feature extraction algorithm includes a DFA domain name segmentation algorithm and a word frequency inverse text frequency index conversion algorithm, and the first domain name feature includes a dictionary feature; The step of extracting features from the DNS tunnel domain name using the target feature extraction algorithm to obtain the first domain name features includes: Segment the DNS tunnel domain name using the DFA domain name segmentation algorithm to obtain segmentation objects, where the segmentation objects include at least one of the following: Chinese words, English words, and pinyin; The segmented objects are converted by the word frequency inverse text frequency index conversion algorithm to obtain the dictionary features.

4. The method according to claim 2, characterized in that The method further comprises: In a case where the number of words is less than the preset number of words, determining that the target domain name structure is a non-dictionary domain name structure; Alternatively, when it is determined that the total length of the words is less than the total length of the domain name, it is determined that the target domain name structure is a non-dictionary domain name structure.

5. The method according to claim 4, characterized in that The target feature extraction algorithm includes a Chinese language model word segmentation algorithm and a word2vec algorithm, and the first domain name feature includes a character feature; The step of extracting features from the DNS tunnel domain name using the target feature extraction algorithm to obtain the first domain name features includes: Using the Chinese language model word segmentation algorithm, adjacent characters in the DNS tunnel domain name are divided to obtain at least one random character; Using the word2vec algorithm, text feature extraction is performed on each random character in the at least one random character to obtain the character feature.

6. The method according to claim 1, characterized in that The target domain name feature further includes a second domain name feature; and the method further includes: Obtain domain name attribute information corresponding to the DNS tunnel domain name; Determining the domain name attribute information as the second domain name feature; The domain name attribute information includes at least one of the following: domain name length, domain name character ratio, domain name information entropy, number of requests, number of subdomains, and number of consecutive digits in the domain name.

7. The method according to claim 1, characterized in that Determining the fusion feature includes: The local enhancement feature and the global enhancement feature are fused through an attention mechanism to obtain the fused feature.

8. The method according to claim 7, wherein: The attention mechanism includes average pooling algorithm, maximum pooling algorithm and multi-layer perceptron algorithm; The local enhancement feature and the global enhancement feature are subjected to feature fusion through the attention mechanism to obtain a fusion feature, including: Downsampling the local enhanced features using the average pooling algorithm to obtain average pooling features; and downsampling the global enhanced features using the maximum pooling algorithm to obtain maximum pooling features; The multi-layer perceptron algorithm is used to perform weighted summation on the average pooling feature and the maximum pooling feature to obtain the fusion feature.

9. The method according to claim 7, characterized in that Before determining whether the DNS tunnel domain name is a DNS covert tunnel domain name of a covert channel, the method further includes: When the text classification result is the second result, obtaining DNS traffic data corresponding to the DNS tunnel domain name; The DNS traffic data is tested by using a preset expert experience rule base to obtain a test result; When the inspection result indicates that the DNS traffic data complies with the preset expert rules in the preset expert experience rule base, the DNS tunnel domain name is determined to be a DNS covert tunnel domain name.

10. A covert channel identification device, characterized in that: include: The acquisition module is used to obtain the DNS tunnel domain name to be detected; an extraction module, configured to extract a target domain name feature of the DNS tunnel domain name by using a target feature extraction algorithm, wherein the target domain name feature includes a first domain name feature; A processing module is configured to extract local features of the target domain name features using a convolutional neural network algorithm to obtain local features of the domain name; and extract global features of the target domain name features using a long short-term memory algorithm to obtain global features of the domain name; According to a first preset division condition, the domain name local features are equally divided into blocks to obtain N block matrices, where N is a positive integer; through the target convolution kernel in the convolutional neural network corresponding to the convolutional neural network algorithm, a convolution operation is performed on each block matrix in the N block matrices to obtain a first convolution result of each convolution layer of the M convolution layers in the target convolution kernel of each block matrix, where M is a positive integer; based on the M first convolution results, a second convolution result corresponding to each block matrix and the target convolution kernel is counted; based on the N second convolution results, a third convolution result corresponding to the N block matrices and the target convolution kernel is calculated; through a normalized exponential function, a first mean corresponding to the second convolution result and a second mean corresponding to the third convolution result are processed to obtain a first probability value; based on the first probability value, a probability assignment is performed on each block matrix to obtain a first assignment result of each block matrix; a first target assignment result that meets the first preset assignment result is screened from the N first assignment results; Determine the features after target block matrix conversion corresponding to the first target assignment result as local enhancement features; and, dividing the domain name global feature according to a second preset division condition to obtain N groups, each of the N groups including at least one sub-feature; Calculating the feature mean of each group based on the sub-features in each group; and, based on the feature mean of each group, summing and averaging the feature means of the N groups to obtain the feature mean of the N groups; performing dot product similarity calculation on each sub-feature in each group and the feature mean of each group to obtain a first similarity set; and, traversing the sub-features in each group and performing dot product similarity calculation on the feature means of the N groups to obtain a second similarity set; performing regularization normalization processing on the first similarity set and the second similarity set to obtain a first regularized set of the first similarity set and a second regularized set of the second similarity set; assigning a value to at least one sub-feature of each of the N groups using the weight values ​​calculated from the first regularized set and the second regularized set to obtain a second assignment result for each sub-feature; Determining the target domain name global feature that the second assignment result satisfies the second preset assignment result as a global enhanced feature; A determination module is used to perform text classification on the fused features obtained by fusing the local enhancement features and the global enhancement features through a Bert detection model to obtain a text classification result of the fused features; When the text classification result is the first result, determining that the DNS tunnel domain name is a DNS covert tunnel domain name of a covert channel; The extraction module is further configured to identify the DNS tunnel domain name through a DFA algorithm to obtain a target domain name structure of the DNS tunnel domain name; and obtain a target feature extraction algorithm corresponding to the target domain name structure based on preset association information between the domain name structure and the feature extraction algorithm; The target feature extraction algorithm is used to extract features from the DNS tunnel domain name to obtain the first domain name features.

11. A computer device, comprising: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the covert channel identification method according to any one of claims 1 to 9 is implemented.

12. A storage medium having computer program instructions stored thereon, wherein the computer program instructions, when executed by a processor, implement the covert channel identification method according to any one of claims 1 to 9.

Images