A C&C server detection method in DNS traffic heterogeneous graph based on graph neural network

Through the graph neural network-based method, the heterogeneous graph of DNS traffic is analyzed, and the problem of low IP detection efficiency of C&C servers in the prior art is solved, achieving efficient and accurate detection results.

CN118233196BActive Publication Date: 2025-03-28GUANGZHOU UNIVERSITY
3 Cites 0 Cited by

Patent Information

Application Number
CN202410427058.8
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2024-04-09
Publication Date
2025-03-28
Estimated Expiration
2044-04-09

AI Technical Summary

Technical Problem

The prior art lacks efficient analysis and processing methods when analyzing C&C server IP in DNS traffic heterogeneous graphs, resulting in inefficient detection.

Method used

Using a graph neural network-based method, the GRU model is used to determine whether the domain name is a malicious domain name, and the judgment tag is added to the traffic data node; a DNS traffic heterogeneous graph is constructed, aggregate projection and semantic fusion are performed, and the final embedding vector of each node is generated; a linear layer and Sigmoid activation function are used for binary classification to determine whether the server IP is a C&C server.

Benefits of technology

It realizes efficient and accurate detection of C&C server IP, improves detection efficiency, and enhances detection accuracy.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The present invention provides a method for detecting a C&C server in a DNS traffic heterogeneous graph based on a graph neural network, belonging to the field of network security technology. The method comprises: obtaining DNS traffic data, judging whether a domain name in the DNS traffic data is a malicious domain name through a GRU model, and adding a corresponding judgment label to a domain name node corresponding to the traffic data; constructing a DNS traffic heterogeneous graph according to the DNS traffic data, performing aggregation projection and semantic fusion processing on the DNS traffic heterogeneous graph, and obtaining a final embedding vector of each node of the heterogeneous graph; performing binary classification on the final embedding vector of each node through a linear layer and a Sigmoid activation function, and determining whether the server IP node belongs to a benign server or a C&C server. The present invention adopts a graph neural network to analyze a traffic heterogeneous graph, which greatly improves the detection efficiency and accuracy of C&C servers.
Need to check novelty before this filing date? Find Prior Art