A method and system for detecting process anomalies through process DNS behavior data

Abstract

The present invention proposes a method and system for detecting process anomalies through process DNS behavior data. The method includes: S10, collecting process DNS logs; S20, matching and filtering the DNS log data based on preset rules to determine the DNS log data to be detected; S30, performing domain name splitting processing on the DNS log data to be detected based on a preset splitting strategy; S40, aggregating and grouping the split data, and de-duplicating and merging the registered domain name prefix data within each group to obtain a domain name transferable string; S50, performing anomaly detection on the domain name transferable string data within each group. The present invention does not rely on feature rules, but analyzes the DNS resolution behavior of the host process to accurately identify threats such as malicious bots and creeps in the host process using DGA to communicate with botnets and covert communication tunnels implemented by DNS. The innovative data aggregation and analysis method uses a low-complexity model to complete high-precision calculations.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for detecting process anomalies through process DNS behavior data. Background Art

[0002] DNS is the most basic and common protocol in the field of network security attack and defense. There are many attacks and detection methods around the DNS protocol. In this field, there are many detection methods such as DNS tunnels and DGA malicious domain names. However, related technical methods mainly analyze DNS data and lack correlation analysis methods with host processes, process files, etc., resulting in poor detection accuracy and usability of detection results.

[0003] For example, a DNS server may resolve too many domain names, resulting in false alarms. Another example is that the generated alarm only reports which domain names a certain IP address has resolved, with a threat coefficient of N. Information such as the host process and the host process executable file is missing, making the alarm difficult to interpret.

[0004] Traditional technologies typically analyze DNS requests individually, resulting in a lack of a global perspective and difficulty guaranteeing detection rates. Furthermore, detection performance issues are a common problem in this field. Detection models are overly complex, computationally challenging, and require numerous parameters to adjust, making it difficult for users to adjust the models and resulting in low QPS. These issues are addressed by this patented solution. Summary of the Invention

[0005] The technical problem to be solved by the present invention is how to reliably detect abnormal DNS behavior. The present invention proposes a method and system for detecting process anomalies through process DNS behavior data.

[0006] A method for detecting process anomalies using process DNS behavior data according to an embodiment of the present invention includes:

[0007] S10, collecting process DNS logs;

[0008] S20, performing matching filtering on the DNS log data based on preset rules to determine the DNS log data to be detected;

[0009] S30, performing domain name splitting processing on the DNS log data to be detected based on a preset splitting strategy;

[0010] S40, aggregating and grouping the split data, and removing and merging the registered domain name prefix data in each group to obtain a transferable domain name string;

[0011] S50: Perform anomaly detection on the domain name transferable character data in each group.

[0012] According to some embodiments of the present invention, in step S10, the method for collecting process DNS logs includes one or more of the following:

[0013] Collect process DNS logs through the host kernel module Hook, Audit, eBPF, nsswitch mechanism, and custom modules.

[0014] In some embodiments of the present invention, the collected log content includes one or more of the following:

[0015] Host unique identifier, host container unique identifier, process path, parent process path, process name, parent process name, process command line, process MD5, parent process MD5 and resolved domain name.

[0016] According to some embodiments of the present invention, in step S20, the preset rules include one or more of the following:

[0017] Preset built-in policies, pre-set filtering processes, and pre-set domain name related whitelists.

[0018] In some embodiments of the present invention, in step S30, the preset splitting strategy includes:

[0019] Split the domain name based on the built-in list of all registrable top-level domain names;

[0020] When the domain name is split, the domain in the DNS log to be detected is matched from long to short according to the corresponding list.

[0021] According to some embodiments of the present invention, in step S40, the split data is grouped according to the host unique identifier, the parent process path, the child process path, and the registered domain name.

[0022] In some embodiments of the present invention, step S50 includes:

[0023] S51, calculating the initial information entropy of the domain name transfer character string in each group;

[0024] S52, calculating the length of the transferable string of the domain name as a weight, weighting the initial information entropy to obtain a first information entropy;

[0025] S53, calculating the proportion of digits in the domain name transferable string as a weight, weighting the first information entropy to obtain a final information entropy;

[0026] S54: If the final information entropy exceeds a preset threshold, it is determined that the DNS resolution behavior of the corresponding process is abnormal.

[0027] According to the system for detecting process anomalies through process DNS behavior data of an embodiment of the present invention,

[0028] Log collection module, used to collect process DNS logs;

[0029] The filtering module is used to match and filter the DNS log data based on preset rules to determine the DNS log data to be detected;

[0030] A splitting module is used to perform domain name splitting processing on the DNS log data to be detected based on a preset splitting strategy;

[0031] The grouping and merging module is used to aggregate and group the split data, and remove and merge the registered domain name prefix data in each group to obtain the domain name transferable string;

[0032] The anomaly detection module is used to perform anomaly detection on the domain name transferable character data in each group.

[0033] According to some embodiments of the present invention, the preset splitting strategy adopted by the splitting module includes:

[0034] Split the domain name based on the built-in list of all registrable top-level domain names;

[0035] When the domain name is split, the domain in the DNS log to be detected is matched from long to short according to the corresponding list.

[0036] In some embodiments of the present invention, the anomaly detection module includes:

[0037] An initial calculation module is used to calculate the initial information entropy of the domain name transfer string in each group;

[0038] A first weighting module is configured to calculate the length of the transferable character string of the domain name as a weight, and weight the initial information entropy to obtain a first information entropy;

[0039] A second weighting module is used to calculate the proportion of digits in the domain name transferable string as a weight, and weight the first information entropy to obtain a final information entropy;

[0040] The anomaly determination module is used to determine whether the DNS resolution behavior of the corresponding process is abnormal based on the relationship between the final information entropy and the preset threshold.

[0041] The present invention has the following beneficial effects:

[0042] The present invention can accurately identify threats such as malicious zombie processes of host processes using DGA to communicate with botnets and covert communication tunnels implemented by DNS without relying on feature rules through DNS resolution behavior analysis of host processes. The innovative data aggregation analysis method can use low-complexity models to complete high-precision calculations, effectively ensuring computing performance and model tuning complexity. Relevant network layer alarms can accurately locate the host and host process, which helps to quickly analyze security incidents. It also provides the ability to release special scenarios based on process MD5 and other methods, effectively solving the deficiency of traditional analysis methods that can only rely on IP to filter special scenarios such as DNS servers. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 Flowchart of a method for detecting process anomalies through process DNS behavior data according to an embodiment of the present invention;

[0044] Figure 2 Overall flow chart of a method for detecting process anomalies through process DNS behavior data according to an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to further illustrate the technical means and effects adopted by the present invention to achieve the predetermined purpose, the present invention is described in detail below with reference to the accompanying drawings and preferred embodiments.

[0046] like Figure 1 As shown, the method for detecting process anomalies through process DNS behavior data according to an embodiment of the present invention includes:

[0047] S10, collecting process DNS logs;

[0048] According to some embodiments of the present invention, in step S10, the method for collecting process DNS logs includes one or more of the following:

[0049] Collect process DNS logs through the host kernel module Hook, Audit, eBPF, nsswitch mechanism, and custom modules.

[0050] In some embodiments of the present invention, the collected log content includes one or more of the following:

[0051] Host unique identifier, host container unique identifier, process path, parent process path, process name, parent process name, process command line, process MD5, parent process MD5 and resolved domain name.

[0052] S20, performing matching filtering on the DNS log data based on preset rules to determine the DNS log data to be detected;

[0053] According to some embodiments of the present invention, in step S20, the preset rules include one or more of the following:

[0054] Preset built-in policies, pre-set filtering processes, and pre-set domain name related whitelists.

[0055] S30, based on the preset splitting strategy, performing domain name splitting processing on the DNS log data to be detected;

[0056] In some embodiments of the present invention, in step S30, the preset splitting strategy includes:

[0057] Split the domain name based on the built-in list of all registrable top-level domain names;

[0058] When splitting domain names, the domains in the DNS log to be detected are matched from long to short according to the corresponding list.

[0059] S40, aggregating and grouping the split data, and removing and merging the registered domain name prefix data in each group to obtain a transferable domain name string;

[0060] According to some embodiments of the present invention, in step S40, the split data is grouped according to the host unique identifier, the parent process path, the child process path, and the registered domain name.

[0061] S50: Perform anomaly detection on the domain name transferable character data in each group.

[0062] In some embodiments of the present invention, step S50 includes:

[0063] S51, calculating the initial information entropy of the domain name transfer character string in each group;

[0064] S52, calculating the domain name transferable string length as a weight, weighting the initial information entropy, and obtaining a first information entropy;

[0065] S53, calculating the proportion of digits in the domain name transfer string as a weight, weighting the first information entropy, and obtaining a final information entropy;

[0066] S54: If the final information entropy exceeds a preset threshold, it is determined that the DNS resolution behavior of the corresponding process is abnormal.

[0067] According to an embodiment of the present invention, a system for detecting process anomalies through process DNS behavior data includes: a log collection module, a filtering module, a splitting module, a grouping and merging module, and an anomaly detection module.

[0068] Among them, the log collection module is used to collect process DNS logs;

[0069] The filtering module is used to match and filter DNS log data based on preset rules to determine the DNS log data to be detected;

[0070] The splitting module is used to split the domain name of the DNS log data to be detected based on the preset splitting strategy;

[0071] The grouping and merging module is used to aggregate and group the split data, and remove and merge the registered domain name prefix data in each group to obtain the domain name transferable string;

[0072] The anomaly detection module is used to perform anomaly detection on the domain name transferable character data in each group.

[0073] According to some embodiments of the present invention, the preset splitting strategies adopted by the splitting module include:

[0074] Split the domain name based on the built-in list of all registrable top-level domain names;

[0075] When splitting domain names, the domains in the DNS log to be detected are matched from long to short according to the corresponding list.

[0076] In some embodiments of the present invention, the anomaly detection module includes: an initial calculation module, a first weighting module, a second weighting module and an anomaly determination module.

[0077] The initial calculation module is used to calculate the initial information entropy of the domain name transfer string in each group;

[0078] The first weighting module is used to calculate the length of the transferable string of the domain name as a weight, weight the initial information entropy, and obtain the first information entropy;

[0079] The second weighting module is used to calculate the proportion of numbers in the domain name transferable string as a weight, weight the first information entropy, and obtain the final information entropy;

[0080] The anomaly determination module is used to determine whether the DNS resolution behavior of the corresponding process is abnormal based on the relationship between the final information entropy and the preset threshold.

[0081] The present invention has the following beneficial effects:

[0082] The present invention can accurately identify threats such as malicious zombie processes of host processes using DGA to communicate with botnets and covert communication tunnels implemented by DNS without relying on feature rules through DNS resolution behavior analysis of host processes. The innovative data aggregation analysis method can use low-complexity models to complete high-precision calculations, effectively ensuring computing performance and model tuning complexity. Relevant network layer alarms can accurately locate the host and host process, which helps to quickly analyze security incidents. It also provides the ability to release special scenarios based on process MD5 and other methods, effectively solving the deficiency of traditional analysis methods that can only rely on IP to filter special scenarios such as DNS servers.

[0083] The following describes in detail the method and system for detecting process anomalies through process DNS behavior data according to the present invention with reference to the accompanying drawings. It should be understood that the following description is merely exemplary and should not be construed as a specific limitation of the present invention.

[0084] The present invention mainly realizes the detection and analysis of abnormal DNS behavior of processes, such as malicious botnet processes using DGA to communicate with botnets, and DNS-implemented covert communication tunnels. After basic processing and analysis of DNS and process data obtained by the host side through mechanisms such as eBPF and nsswitch, the solution segments the domain name data according to the host, parent process execution file, child process execution file, and hierarchical domain name list, and optionally adds process name, process ID, etc. to participate in aggregation, aggregates the data in the group, obtains the segmented domain names, removes duplicates, and splices them into complete domain name transferable string data, and performs overall efficient algorithm detection on the integrated data, so as to identify the risk of abnormal behavior of malicious domain name resolution behavior of the process, combined with Figure 2 As shown, the detailed process is as follows.

[0085] A10, host process and DNS log preprocessing;

[0086] The host-side synchronous security detection plug-in collects process DNS logs through the host kernel module Hook, Audit, eBPF, nsswitch mechanism, or other custom modules.

[0087] The data reported includes but is not limited to: host UUID (host unique identifier), container ID (host container unique identifier), ppath (process path, including file name), pppath (parent process path, including file name), pname (process name), ppname (parent process name), cmdline (process command line), pmd5 (process md5), ppmd5 (parent process md5), domain (resolved domain name), etc. Relevant logs are reported to the data analysis platform in real time for further analysis.

[0088] After the data analysis platform obtains real-time data, it first processes it through the built-in process and DNS data filtering engine. This engine has a series of built-in policies that filter processes or domain names related to whitelists. For example, MD5 of DNS server-related processes will be filtered out and not tested, and requests for domain names related to "*.taobao.com" will not be tested. All built-in policies support addition, modification, and deletion. Data that does not match the whitelist will continue to the following detection process.

[0089] Optional custom filtering plug-in can be used to add custom data pre-filtering logic according to actual scenarios.

[0090] A20, domain name split;

[0091] Domain name splitting is performed on filtered domain data, which is a key step in subsequent group detection. Traditional detection generally splits domain names based on the dot in the domain name. For example, a.taobao.com is split into a, taobao.com, and com, and taobao.com is considered a registered domain name and a is its subdomain. This splitting model will cause problems in scenarios such as a.taobao.cn.com, resulting in the failure to identify taobao.cn.com as a registered domain name, leading to problems in subsequent aggregation calculations.

[0092] In the present invention, a built-in list of all registrable top-level domain names is set, such as: '.xyz', '.yachts', '.yahoo', '.yamaxun', '.yandex', '.ye', '.yodobashi', '.yoga', '.cn.com', '.com', '.cn' and the like.

[0093] The domains in the log are matched from longest to shortest according to the list. For example, if '.cn.com' (length 2) or '.com' (length 1), the data cc.a.taobao.cn.com will be split into the registered domain name taobao.cn.com with the registered domain name prefix cc.a. For example, cc.test.com will be split into the registered domain name test.com with the registered domain name prefix cc.

[0094] A30, host process and DNS log aggregation;

[0095] A31. In the data analysis platform, create a custom time window. The default window is 30 minutes. This means that the following aggregation calculations are performed within a window for all data within 30 minutes. The window period can optionally be adjusted.

[0096] A32. After the above processing, the data continues to enter the aggregation grouping process. By default, it is grouped according to the host UUID, parent process path, child process path, and registered domain name. It can optionally support modifying or adding custom grouping conditions.

[0097] That is, by default, data from the same host, the same parent process path, the same child process path, and the same registered domain name will be grouped into the same group.

[0098] A33. De-duplicate and merge different registered domain name prefixes within the same group. For example:

[0099] Process host UUID: ACDCCA-CACCCA-CCCACA's process / tmp / xx, whose parent process is / bin / crond, generates registered domain name prefix data such as cadcafqa, cadcafqa, cadcafqa, qoqqoq.c, cccccc for the hacker.com registered domain name. After deduplication and merging, it becomes: "cadcafqaqoqqoq.ccccccc". The above data output is: domain name transferable string.

[0100] A40, process abnormal behavior analysis;

[0101] The present invention performs anomaly detection on the domain name transfer string data within each group. This exemplary implementation includes a built-in high-performance detection algorithm, with optional support for custom detection algorithms. Traditional detection involves individually checking each DNS request. The present invention integrates and processes process domain name data to generate parsed and calculated domain name transfer string data, ensuring the use of an extremely streamlined algorithm model for high-accuracy, high-performance calculations. Traditional models require the use of multi-dimensional, complex features and multiple weighted parameter adjustments, resulting in computational complexity, poor performance, and difficulty in model tuning.

[0102] Example algorithm:

[0103] A41, calculate the information entropy of the domain name transfer string in each group, denoted as S0

[0104] A42, the domain name can be calculated by passing the string length (L0) as the weight to weight the initial information entropy S0: the information entropy is calculated as S0*L0

[0105] A43, calculate the proportion of digits in the domain name transfer string to further weight the information entropy: the length of the number is recorded as L, then the proportion of digits is L / L0, and the information entropy is further calculated as L / L0*S0*L0, simplified to L*S0, recorded as the final information entropy S.

[0106] A44: If the information entropy S exceeds a certain threshold (default >= 600, which can be dynamically adjusted or introduced through training), the DNS resolution behavior of the process is determined to be abnormal.

[0107] As a result, it is finally possible to accurately identify which host and which process generated abnormal DNS behavior.

[0108] Through the description of the specific implementation methods, a deeper and more specific understanding of the technical means and effects adopted by the present invention to achieve the intended purpose should be obtained. However, the accompanying drawings are only for reference and illustration purposes and are not intended to limit the present invention.

Claims

1. A method for detecting process anomalies through process DNS behavior data, characterized in that: include: S10, collecting process DNS logs; the collected log content includes one or more of the following: Host unique identifier, host container unique identifier, process path, parent process path, process name, parent process name, process command line, process MD5, parent process MD5, and resolved domain name; S20, performing matching filtering on the DNS log data based on preset rules to determine the DNS log data to be detected; S30, performing domain name splitting processing on the DNS log data to be detected based on a preset splitting strategy; S40, aggregating and grouping the split data, and removing and merging the registered domain name prefix data in each group to obtain a transferable domain name string; S50, performing anomaly detection on the domain name transferable character data in each group; Step S50 includes: S51, calculating the initial information entropy of the domain name transfer character string in each group; S52, calculating the length of the transferable string of the domain name as a weight, weighting the initial information entropy to obtain a first information entropy; S53, calculating the proportion of digits in the domain name transferable string as a weight, weighting the first information entropy to obtain a final information entropy; S54: If the final information entropy exceeds a preset threshold, it is determined that the DNS resolution behavior of the corresponding process is abnormal.

2. The method for detecting process anomalies through process DNS behavior data according to claim 1, characterized in that: In step S10, the method of collecting the process DNS log includes one or more of the following: Collect process DNS logs through the host kernel module Hook, Audit, eBPF, nsswitch mechanism, and custom modules.

3. The method for detecting process anomalies through process DNS behavior data according to claim 1, characterized in that: In step S20, the preset rules include one or more of the following: Preset built-in policies, pre-set filtering processes, and pre-set domain name related whitelists.

4. The method for detecting process anomalies through process DNS behavior data according to claim 1, characterized in that: In step S30, the preset splitting strategy includes: Split the domain name based on the built-in list of all registrable top-level domain names; When the domain name is split, the domain in the DNS log to be detected is matched from long to short according to the corresponding list.

5. The method for detecting process anomalies through process DNS behavior data according to claim 1, characterized in that: In step S40, the split data is grouped according to the host unique identifier, the parent process path, the child process path, and the registered domain name.

6. A system for detecting process anomalies through process DNS behavior data, characterized in that: The log collection module is used to collect process DNS logs. The collected log content includes one or more of the following: Host unique identifier, host container unique identifier, process path, parent process path, process name, parent process name, process command line, process MD5, parent process MD5, and resolved domain name; The filtering module is used to match and filter the DNS log data based on preset rules to determine the DNS log data to be detected; A splitting module is used to perform domain name splitting processing on the DNS log data to be detected based on a preset splitting strategy; The grouping and merging module is used to aggregate and group the split data, and remove and merge the registered domain name prefix data in each group to obtain the domain name transferable string; Anomaly detection module, used to detect anomalies in the domain name transferable data in each group; The anomaly detection module includes: An initial calculation module is used to calculate the initial information entropy of the domain name transfer string in each group; A first weighting module is configured to calculate the length of the transferable character string of the domain name as a weight, and weight the initial information entropy to obtain a first information entropy; A second weighting module is used to calculate the proportion of digits in the domain name transferable string as a weight, and weight the first information entropy to obtain a final information entropy; The anomaly determination module is used to determine whether the DNS resolution behavior of the corresponding process is abnormal based on the relationship between the final information entropy and the preset threshold.

7. The system for detecting process anomalies through process DNS behavior data according to claim 6, characterized in that: The preset splitting strategies adopted by the splitting module include: Split the domain name based on the built-in list of all registrable top-level domain names; When the domain name is split, the domain in the DNS log to be detected is matched from long to short according to the corresponding list.

Images