A method for analyzing and determining malicious domain name access

Abstract

The present invention discloses a malicious domain name access analysis and determination method, which includes: collecting malicious domain names and malicious behaviors, establishing a malicious domain name blacklist and a malicious behavior model library; extracting DNS traffic data packets in traffic data packets; parsing the DNS traffic data packets to obtain a domain name record set; analyzing each domain name in the domain name record set according to the malicious domain name blacklist to obtain a domain name analysis result, and analyzing the access behavior corresponding to each domain name in the domain name record set according to the malicious behavior model library to obtain an access behavior analysis result; comprehensively judging and determining the malicious domain name in the domain name record set according to the domain name analysis result and the access behavior analysis result, and issuing a warning. The present invention determines whether a domain name is a malicious domain name by comprehensively analyzing the domain name and the behavior corresponding to the domain name, improves the accuracy of malicious domain name confirmation, prevents malicious domain names from escaping detection, and issues a warning mark for malicious domain names to ensure that malicious domain names can be discovered in a timely manner.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method for analyzing and determining malicious domain name access. Background Art

[0002] The domain name system is one of the important infrastructures of the current Internet, and a large number of network services rely on domain name services. The Domain Name Resolution Service (DNS) maps abstract IP addresses to easy-to-remember domain names, allowing Internet users to access various network resources more conveniently. It is one of the important basic services in the Internet architecture. Among them, malicious domain names are also called malicious websites. They refer to websites that use vulnerabilities in browsers or application software to embed malicious codes and tamper with or damage users' machines without the knowledge of the users. Websites that pop up plug-ins or prompt users to set them as homepages are not defined as malicious domain names because they require user confirmation. Websites with illegal and unhealthy content are not defined as malicious domain names if they do not tamper with or damage users' machines. However, websites that imitate other websites such as bank websites and e-commerce websites are also defined as malicious domain names even though they do not tamper with or damage users' machines.

[0003] At present, with the rapid development of network technology and the advent of the Internet age, the scale of the Internet has continued to expand, and Internet applications have penetrated into all aspects of people's lives. The Internet has become a huge driving force for promoting social progress and economic development. In particular, the widespread popularity of smart phones in recent years has closely connected human life with the Internet. However, while the Internet brings the public the ability to transcend time and space, fast and convenient, and interactive communication, it also provides possibilities for network attacks, cybercrimes, information leakage, and snooping on privacy. Since the domain name system does not detect the service behaviors that rely on it, the DNS service lacks the ability to detect malicious behaviors, so it is often exploited by malicious programs. A considerable number of known malicious programs in the network use domain name association to steal network information. When a computer is implanted with a malicious program, it will actively send information to the domain name specified by the implanter of the malicious program. In order to reduce the occurrence of these malicious events, it is necessary to analyze and determine the malicious domain name. Summary of the invention

[0004] The technical problem to be solved by the present invention is that the prior art is difficult to analyze malicious domain name access and is unable to determine the malicious domain name.

[0005] In order to solve the above technical problems, the present invention provides a method for analyzing and determining malicious domain name access, including:

[0006] Collect malicious domain names and malicious behaviors, and establish a malicious domain name blacklist and a malicious behavior model library respectively;

[0007] Obtain all traffic data packets captured by the network card, and extract the DNS traffic data packets in the traffic data packets;

[0008] Parsing the DNS traffic data packet to obtain a domain name record set;

[0009] Analyze each domain name in the domain name record set according to the malicious domain name blacklist to obtain a domain name analysis result, and analyze the access behavior corresponding to each domain name in the domain name record set according to the malicious behavior model library to obtain an access behavior analysis result;

[0010] According to the domain name analysis result and the access behavior analysis result, a comprehensive judgment is made to determine the malicious domain names in the domain name record set, and a warning mark is issued for the malicious domain names.

[0011] Furthermore, the collection of malicious domain names and malicious behaviors, and the establishment of a malicious domain name blacklist and a malicious behavior model library, specifically include:

[0012] Use big data mining technology to collect and update public threat intelligence sources in a timely manner, and use big data analysis to process the domain names and behaviors in the collected threat intelligence;

[0013] Determine whether the domain name in the collected threat intelligence is a malicious domain name, and determine whether the behavior in the collected threat intelligence is a malicious behavior;

[0014] If the domain name in the threat intelligence is a malicious domain name, extract the malicious domain name in the threat intelligence and create a malicious domain name blacklist;

[0015] If the behavior in the threat intelligence is malicious, extract the malicious behavior in the threat intelligence and establish a malicious behavior model library.

[0016] Further, the acquiring of all traffic data packets captured by the network card and extracting the DNS traffic data packets in the traffic data packets specifically includes:

[0017] All traffic data packets captured by the network card are saved in internal storage in a mirrored manner;

[0018] Determine the DNS traffic data packet among all the traffic data packets captured by the network card;

[0019] DNS traffic data packets are separated from all traffic data packets captured by the network card.

[0020] Furthermore, the parsing of the DNS traffic data packet to obtain a domain name record set specifically includes:

[0021] Parsing the DNS traffic data packet to obtain DNS resolution data;

[0022] Clean the DNS resolution data, remove the fields that have no impact on the DNS resolution data, and retain the fields that have an impact on the system;

[0023] Extract all domain names from the affected fields and combine them to get a record set of all domain names.

[0024] Further, analyzing each domain name in the domain name record set according to the malicious domain name blacklist to obtain a domain name analysis result specifically includes:

[0025] Obtain each domain name, and match each domain name with the domain names in the malicious domain name blacklist to obtain a matching value;

[0026] Determining whether the domain name is a suspected malicious domain name according to the size of the matching value and a preset matching value;

[0027] If the matching value is less than or equal to the preset matching value, the domain name is not a suspected malicious domain name, and the next domain name behavior is judged;

[0028] If the accessed domain name is an abnormal accessed domain name, the domain name is recorded as a suspected malicious domain name in the domain name analysis result.

[0029] Further, judging whether the domain name is a suspected malicious domain name according to the size of the matching value and the preset matching value specifically includes:

[0030] The malicious domain name model in the malicious domain name blacklist is called, and the matching value between the domain name and the malicious domain name model is calculated to determine whether the domain name is a suspected malicious domain name.

[0031] Furthermore, the access behavior corresponding to each domain name in the domain name record set is analyzed according to the malicious behavior model library to obtain access behavior analysis results, which specifically include:

[0032] Obtaining access behavior corresponding to each domain name, and extracting characteristic information of the access behavior;

[0033] quantizing the entropy value of the feature information, and inputting the entropy value vector obtained after quantization into a classifier to obtain a behavior type corresponding to the access behavior;

[0034] Determining whether the access behavior is an abnormal access behavior according to the behavior type;

[0035] If the access behavior is not an abnormal access behavior, continue to judge the access behavior corresponding to the next domain name;

[0036] If the access behavior is an abnormal access behavior, the abnormal access behavior is recorded in the behavior analysis result.

[0037] Further, judging whether the access behavior is an abnormal access behavior according to the behavior type specifically includes:

[0038] The malicious behavior model in the malicious behavior model library is called, and the access behavior is matched with the malicious behavior model to determine whether the access behavior is an abnormal access behavior.

[0039] Furthermore, the comprehensive judgment based on the domain name analysis result and the access behavior analysis result determines the malicious domain name in the domain name record set, and issues a warning mark for the malicious domain name, specifically including:

[0040] According to the importance of the domain name analysis result and the access behavior analysis result, assigning a first weight value to the domain name analysis result and assigning a second weight value to the access behavior analysis result;

[0041] Adding the first weight value and the second weight value to obtain a malicious value;

[0042] If the malicious value does not exceed the preset malicious value, the domain name in the domain name record set is not a malicious domain name;

[0043] If the malicious value exceeds the preset malicious value, the domain name in the domain name record set is a malicious domain name, and the malicious domain name is warned through color identification.

[0044] Compared with the prior art, the malicious domain name access analysis and determination method of the present invention has the following beneficial effects:

[0045] The present invention determines whether a domain name is a malicious domain name by performing a comprehensive analysis on the domain name and the behavior corresponding to the domain name, thereby improving the accuracy of malicious domain name confirmation, preventing malicious domain names from escaping detection, and providing a warning mark for malicious domain names to ensure that malicious domain names can be discovered in a timely manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a schematic diagram of the overall process of a method for analyzing and determining malicious domain name access in an embodiment of the present invention;

[0047] Figure 2 It is a partial flow chart of a method for analyzing and determining malicious domain name access in an embodiment of the present invention;

[0048] Figure 3 It is a partial flow chart of a method for analyzing and determining malicious domain name access in an embodiment of the present invention;

[0049] Figure 4It is a partial flow chart of a method for analyzing and determining malicious domain name access in an embodiment of the present invention;

[0050] Figure 5 It is a partial flow chart of a method for analyzing and determining malicious domain name access in an embodiment of the present invention;

[0051] Figure 6 It is a partial flow chart of a method for analyzing and determining malicious domain name access in an embodiment of the present invention;

[0052] Figure 7 It is a partial flow chart of a method for analyzing and determining malicious domain name access in an embodiment of the present invention. DETAILED DESCRIPTION

[0053] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0054] In the description of the present application, it should be understood that the terms "center", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present application.

[0055] The terms "second" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, a feature defined with "second" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "multiple" means two or more.

[0056] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0057] like Figure 1As shown, in an embodiment of the present application, a method for analyzing and determining malicious domain name access is provided, including: collecting malicious domain names and malicious behaviors, and establishing a malicious domain name blacklist and a malicious behavior model library respectively; obtaining all traffic data packets captured by a network card, and extracting DNS traffic data packets in the traffic data packets; parsing the DNS traffic data packets to obtain a domain name record set; analyzing each domain name in the domain name record set according to the malicious domain name blacklist to obtain a domain name analysis result, and analyzing the access behavior corresponding to each domain name in the domain name record set according to the malicious behavior model library to obtain an access behavior analysis result; comprehensively judging based on the domain name analysis result and the access behavior analysis result, determining the malicious domain names in the domain name record set, and marking the malicious domain names with a warning mark.

[0058] Furthermore, by conducting a comprehensive analysis of the domain name and the behavior corresponding to the domain name, it is determined whether the domain name is a malicious domain name, the accuracy of malicious domain name confirmation is improved, malicious domain names are prevented from escaping detection, and malicious domain names are marked with warnings to ensure that malicious domain names can be discovered in a timely manner.

[0059] like Figure 2 As shown, in an embodiment of the present application, a method for analyzing and determining malicious domain name access is provided, and the malicious domain names and malicious behaviors are collected, and a malicious domain name blacklist and a malicious behavior model library are established respectively, specifically including: using big data mining technology to collect and timely update public threat intelligence sources, and using big data analysis to process the domain names and behaviors in the collected threat intelligence; judging whether the domain names in the collected threat intelligence are malicious domain names, and judging whether the behaviors in the collected threat intelligence are malicious behaviors; if the domain names in the threat intelligence are malicious domain names, extracting the malicious domain names in the threat intelligence and establishing a malicious domain name blacklist; if the behaviors in the threat intelligence are malicious behaviors, extracting the malicious behaviors in the threat intelligence and establishing a malicious behavior model library.

[0060] Specifically, the existing and publicly available threat intelligence sources are collected and updated in a timely manner through big data mining technology, and then big data is used to analyze and process the collected threat intelligence, and to determine whether the domain names and behaviors are malicious domain names and malicious behaviors. If so, they are extracted, and a malicious domain name blacklist and a malicious behavior model library are established respectively, to provide preliminary data support for subsequent domain name and behavior judgments.

[0061] like Figure 3As shown, in an embodiment of the present application, a method for analyzing and determining malicious domain name access is provided, wherein all traffic data packets captured by a network card are obtained, and the DNS traffic data packets in the traffic data packets are extracted, specifically including: saving all traffic data packets captured by the network card in an internal storage in a mirrored manner; determining the DNS traffic data packets in all traffic data packets captured by the network card; and separating the DNS traffic data packets from all traffic data packets captured by the network card.

[0062] Specifically, the network card is used to capture traffic data packets to be identified from a preset network device, and all captured traffic data packets are pulled or mirrored, so that the traffic data packets to be identified can be introduced, and the DNS data packets can be separated from the traffic data packets to be identified, wherein the traffic data packets to be identified are pre-processed at the seventh layer application layer of the OSI reference model to obtain UDP request data from port 53, and other data packets can be discarded or transferred to other protocol modules for processing.

[0063] like Figure 4 As shown, in an embodiment of the present application, a method for analyzing and determining malicious domain name access is provided, wherein the DNS traffic data packet is parsed to obtain a domain name record set, specifically comprising: parsing the DNS traffic data packet to obtain DNS resolution data; performing data cleaning on the DNS resolution data, removing fields that have no influence in the DNS resolution data, and retaining fields that have influence; extracting all domain names from the fields that have influence, and obtaining all domain name record sets after aggregation.

[0064] Specifically, the communication data is parsed to extract the IP of the source host involved in the DNS traffic data packet, the domain name queried by the source host, the domain name queried by the source host, and the time of querying the domain name.

[0065] like Figure 5 As shown, in an embodiment of the present application, a malicious domain name access analysis and determination method is provided, wherein each domain name in the domain name record set is analyzed according to the malicious domain name blacklist to obtain a domain name analysis result, specifically including: obtaining each domain name, matching each domain name with the domain name in the malicious domain name blacklist to obtain a matching value; judging whether the domain name is a suspected malicious domain name according to the size of the matching value and a preset matching value; if the matching value is less than or equal to the preset matching value, the domain name is not a suspected malicious domain name, and the next domain name behavior is continued to be judged; if the accessed domain name is an abnormal accessed domain name, the domain name is recorded as a suspected malicious domain name in the domain name analysis result.

[0066] Specifically, each domain name is obtained and matched with the domain names in the malicious domain name blacklist to determine whether the domain name is a suspected malicious domain name. If the accessed domain name is an abnormal accessed domain name, the domain name is recorded as a suspected malicious domain name in the domain name analysis result.

[0067] In an embodiment of the present application, a method for analyzing and determining malicious domain name access is provided, wherein judging whether the domain name is a suspected malicious domain name based on the size of the matching value and a preset matching value specifically includes: calling a malicious domain name model in the malicious domain name blacklist, and calculating the matching value between the domain name and the malicious domain name model to judge whether the domain name is a suspected malicious domain name.

[0068] Specifically, a malicious domain name model is established in the malicious domain name blacklist, the malicious domain name model in the malicious domain name blacklist is called, and the matching value between the domain name and the malicious domain name model is calculated. If the matching value reaches a preset value, the domain name is judged to be a suspected malicious domain name.

[0069] like Figure 6 As shown, in an embodiment of the present application, a malicious domain name access analysis and determination method is provided, and the access behavior corresponding to each domain name in the domain name record set is analyzed according to the malicious behavior model library to obtain an access behavior analysis result, specifically including: obtaining the access behavior corresponding to each domain name, and extracting the characteristic information of the access behavior; quantizing the entropy value of the characteristic information, and inputting the entropy value vector obtained after quantization into a classifier to obtain a behavior type corresponding to the access behavior; judging whether the access behavior is an abnormal access behavior according to the behavior type; if the access behavior is not an abnormal access behavior, continuing to judge the access behavior corresponding to the next domain name; if the access behavior is an abnormal access behavior, recording the abnormal access behavior of the access behavior in the behavior analysis result.

[0070] Specifically, each domain name has its corresponding access behavior. By extracting the characteristic information of the access behavior, quantizing the entropy value of the characteristic information, and inputting the entropy value vector obtained after quantization into the classifier, the behavior type corresponding to the access behavior is obtained, wherein the behavior type can determine whether the access behavior is an abnormal access behavior. The behavior type is a sign to determine whether the access behavior is an abnormal access behavior. If the access behavior is an abnormal access behavior, the abnormal access behavior of the access behavior will be recorded in the behavior analysis result.

[0071] In an embodiment of the present application, a method for analyzing and determining malicious domain name access is provided, wherein judging whether the access behavior is abnormal access behavior based on the behavior type specifically includes: calling a malicious behavior model in the malicious behavior model library, and matching the access behavior with the malicious behavior model to judge whether the access behavior is abnormal access behavior.

[0072] A malicious behavior model is established in the malicious behavior model library, by calling the malicious behavior model in the malicious behavior model library and calculating the matching value between the access behavior and the malicious behavior model, if the matching value reaches a preset value, the access behavior is judged to be an abnormal access behavior.

[0073] like Figure 7 As shown, in an embodiment of the present application, a method for analyzing and determining malicious domain name access is provided, wherein a malicious domain name in a domain name record set is determined based on a comprehensive judgment of the domain name analysis result and the access behavior analysis result, and a warning mark is issued for the malicious domain name, specifically comprising: assigning a first weight value to the domain name analysis result and a second weight value to the access behavior analysis result based on the importance of the domain name analysis result and the access behavior analysis result; adding the first weight value to the second weight value to obtain a malicious value; if the malicious value does not exceed the preset malicious value, the domain name in the domain name record set is not a malicious domain name; if the malicious value exceeds the preset malicious value, the domain name in the domain name record set is a malicious domain name, and a warning is issued for the malicious domain name through color marking.

[0074] Specifically, a first weight value and a second weight value are assigned correspondingly to the domain name analysis result and the access behavior analysis result, and the first weight value and the second weight value are added to obtain a malicious value. Whether the domain name is a malicious domain name is determined based on the size relationship between the malicious value and the preset malicious value, and a malicious domain name is warned through color identification.

[0075] In summary, the embodiment of the present invention provides a method for analyzing and determining malicious domain name access, which includes: collecting malicious domain names and malicious behaviors, establishing a malicious domain name blacklist and a malicious behavior model library respectively; obtaining all traffic data packets captured by the network card, and extracting the DNS traffic data packets in the traffic data packets; parsing the DNS traffic data packets to obtain a domain name record set; analyzing each domain name in the domain name record set according to the malicious domain name blacklist to obtain a domain name analysis result, and analyzing the access behavior corresponding to each domain name in the domain name record set according to the malicious behavior model library to obtain an access behavior analysis result; comprehensively judging based on the domain name analysis result and the access behavior analysis result, determining the malicious domain name in the domain name record set, and marking the malicious domain name with a warning. The present invention determines whether a domain name is a malicious domain name by comprehensively analyzing the domain name and the behavior corresponding to the domain name, thereby improving the accuracy of malicious domain name confirmation, preventing malicious domain names from escaping detection, and marking the malicious domain name with a warning to ensure that the malicious domain name can be discovered in a timely manner.

[0076] Finally, it should be noted that it is obvious that those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

[0077] The above is only an example of implementation of the present invention, but it cannot be used to limit the scope of the present invention. Any structural changes made according to the present invention, as long as they do not lose the essence of the present invention, should be regarded as falling within the scope of protection of the present invention and being restricted. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process and related instructions of the system described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0078] The term "comprise" or any other similar term is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus / device that includes a list of elements includes not only those elements but also other elements not expressly listed, or also includes elements inherent to such process, method, article, or apparatus / device.

[0079] So far, the technical solutions of the present invention have been described in conjunction with the further embodiments shown in the accompanying drawings, but it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0080] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention.

Claims

1. A method for analyzing and determining malicious domain name access, characterized in that: include: Collect malicious domain names and malicious behaviors, and establish a malicious domain name blacklist and a malicious behavior model library respectively; Obtain all traffic data packets captured by the network card, and extract the DNS traffic data packets in the traffic data packets; Parsing the DNS traffic data packet to obtain a domain name record set; Analyze each domain name in the domain name record set according to the malicious domain name blacklist to obtain a domain name analysis result, and analyze the access behavior corresponding to each domain name in the domain name record set according to the malicious behavior model library to obtain an access behavior analysis result; The collection of malicious domain names and malicious behaviors, and the establishment of a malicious domain name blacklist and a malicious behavior model library, specifically include: Use big data mining technology to collect and update public threat intelligence sources in a timely manner, and use big data analysis to process the domain names and behaviors in the collected threat intelligence; Determine whether the domain name in the collected threat intelligence is a malicious domain name, and determine whether the behavior in the collected threat intelligence is a malicious behavior; If the domain name in the threat intelligence is a malicious domain name, extract the malicious domain name in the threat intelligence. Establish a blacklist of malicious domain names; If the behavior in the threat intelligence is malicious, extract the malicious behavior in the threat intelligence and establish a malicious behavior model library; Determine malicious domain names in the domain name record set based on the domain name analysis results and the access behavior analysis results, and issue warning marks to the malicious domain names; The analyzing each domain name in the domain name record set according to the malicious domain name blacklist to obtain the domain name analysis result specifically includes: Obtain each domain name, and match each domain name with the domain names in the malicious domain name blacklist to obtain a matching value; Determining whether the domain name is a suspected malicious domain name according to the size of the matching value and a preset matching value; If the matching value is less than or equal to the preset matching value, the domain name is not a suspected malicious domain name, and the next domain name behavior is judged; If the domain name is an abnormally accessed domain name, the domain name is recorded as a suspected malicious domain name in the domain name analysis result; The determining whether the domain name is a suspected malicious domain name according to the size of the matching value and the preset matching value specifically includes: Calling a malicious domain name model in the malicious domain name blacklist, and calculating a matching value between the domain name and the malicious domain name model to determine whether the domain name is a suspected malicious domain name; The access behavior corresponding to each domain name in the domain name record set is analyzed according to the malicious behavior model library to obtain the access behavior analysis result, specifically including: Obtaining access behavior corresponding to each domain name, and extracting characteristic information of the access behavior; quantizing the entropy value of the feature information, and inputting the entropy value vector obtained after quantization into a classifier to obtain a behavior type corresponding to the access behavior; Determining whether the access behavior is an abnormal access behavior according to the behavior type; If the access behavior is not an abnormal access behavior, continue to judge the access behavior corresponding to the next domain name; If the access behavior is an abnormal access behavior, recording the access behavior in the access behavior analysis result; The determining, according to the behavior type, whether the access behavior is an abnormal access behavior specifically includes: The malicious behavior model in the malicious behavior model library is called, and the access behavior is matched with the malicious behavior model to determine whether the access behavior is an abnormal access behavior.

2. According to claim 1, a malicious domain name access analysis and determination method is characterized in that: The obtaining of all traffic data packets captured by the network card and extracting the DNS traffic data packets in the traffic data packets specifically includes: All traffic data packets captured by the network card are saved in internal storage in a mirrored manner; Determine the DNS traffic data packet among all the traffic data packets captured by the network card; DNS traffic data packets are separated from all traffic data packets captured by the network card.

3. A method for analyzing and determining malicious domain name access according to claim 1, characterized in that: The parsing of the DNS traffic data packet to obtain a domain name record set specifically includes: Parsing the DNS traffic data packet to obtain DNS resolution data; Cleaning the DNS resolution data, removing the fields that have no impact in the DNS resolution data, and retaining the fields that have impact; Extract all domain names from the affected fields and combine them to get a record set of all domain names.

4. A method for analyzing and determining malicious domain name access according to claim 1, characterized in that: The comprehensive judgment based on the domain name analysis result and the access behavior analysis result determines the malicious domain name in the domain name record set, and issues a warning mark for the malicious domain name, specifically including: According to the importance of the domain name analysis result and the access behavior analysis result, assigning a first weight value to the domain name analysis result and assigning a second weight value to the access behavior analysis result; Adding the first weight value and the second weight value to obtain a malicious value; If the malicious value does not exceed the preset malicious value, the domain name in the domain name record set is not a malicious domain name; If the malicious value exceeds the preset malicious value, the domain name in the domain name record set is a malicious domain name, and the malicious domain name is warned through color identification.

Images