Botnet domain name determination method and device, and electronic equipment

Abstract

The application discloses a botnet domain name determination method and device and electronic equipment. It relates to the technical field of data processing, the field of network security and other related technical fields. The method comprises the following steps: constructing a target network relationship graph according to target DNS data; performing community division on the target network relationship graph according to a community discovery algorithm to obtain multiple community structure information; and determining a target botnet domain name from the target DNS data according to the multiple community structure information. Through the application, the problem that the determination accuracy of the botnet domain name is relatively low in the related art, which is caused by calculating the similarity between the target domain name and the historical botnet domain name to determine whether the target domain name is a botnet domain name, is solved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, the field of network security and other related technical fields, in particular, relates to a method and device for determining a botnet domain name, and an electronic device. BACKGROUND

[0002] A botnet refers to a collection of Internet devices controlled by hackers. Botnets are an important threat to network security, and various network attack behaviors such as Distributed Denial of Service (DDos) are launched using botnets. Therefore, it is of great significance to network security and risk reduction to quickly and accurately find the command and control server of a botnet, detect the communication behavior in the botnet, and based on the detection results, cut off the connection between the controlled device and the botnet control server. The traditional method mainly determines the target botnet domain name according to the difference between the suspected botnet domain name and the historical botnet domain name. This method generally considers that the domain names of the same botnet family have some similarity, so it can be detected by statistical features or characteristic features combined with machine learning methods. However, when the domain names of the botnet family do not have similarity, this method is difficult to detect, thereby resulting in a relatively low accuracy of determining the botnet domain name.

[0003] In view of the problem in the related art that the similarity between the target domain name and the historical botnet domain name is calculated to determine whether the target domain name is a botnet domain name, resulting in a relatively low accuracy of determining the botnet domain name, no effective solution has been proposed so far. SUMMARY

[0004] The main purpose of the present application is to provide a method and device for determining a botnet domain name, and an electronic device, to solve the problem in the related art that the similarity between the target domain name and the historical botnet domain name is calculated to determine whether the target domain name is a botnet domain name, resulting in a relatively low accuracy of determining the botnet domain name.

[0005] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for determining a botnet domain name is provided. The method comprises: constructing a target network relationship graph according to target DNS data, wherein the target DNS data at least includes: access domain name information of a target object, IP information of the target object and access relationship of the IP information to the access domain name information, and the target network relationship graph at least includes: an IP node corresponding to the IP information and a domain name node corresponding to the access domain name information; performing community division on the target network relationship graph according to a community discovery algorithm to obtain a plurality of community structure information; and determining a target botnet domain name from the target DNS data according to the plurality of community structure information.

[0006] Further, the determining the target botnet domain name from the target DNS data according to the plurality of community structure information comprises: determining an initial botnet from the plurality of community structure information according to a number of domain name nodes in each community structure information; and determining the target botnet domain name according to a plurality of domain names corresponding to the initial botnet.

[0007] Further, the determining the initial botnet from the plurality of community structure information according to the number of domain name nodes in each community structure information comprises: calculating a first ratio value according to the number of domain name nodes and a number of second-level domain names in each community structure information; calculating a second ratio value according to the number of domain name nodes and a number of multi-level domain names in each community structure information; and screening the plurality of community structure information according to at least one of the number of domain name nodes, a number of edges corresponding to IP nodes in each community structure information, the first ratio value and the second ratio value, to obtain the initial botnet.

[0008] Further, the determining the target botnet domain name according to the plurality of domain names corresponding to the initial botnet comprises: judging whether registration domain names of the plurality of domain names corresponding to the initial botnet are same, to obtain a judgment result; if the judgment result indicates that registration domain names of a plurality of target domain names in the plurality of domain names corresponding to the initial botnet are different, performing similarity calculation on the plurality of target domain names to obtain a target similarity; and determining the target botnet domain name from the plurality of target domain names according to the target similarity.

[0009] Further, the similarity calculation on the plurality of target domain names to obtain a target similarity comprises: for any two target domain names, a first target domain name and a second target domain name, performing similarity calculation on a registration domain name of the first target domain name and multi-level domain names of the second target domain name to obtain a first similarity; performing similarity calculation on multi-level domain names of the first target domain name and a registration domain name of the second target domain name to obtain a second similarity; and determining the target similarity according to the first similarity and the second similarity.

[0010] Further, before the constructing the target network relationship graph according to the target DNS data, the method further comprises: obtaining a plurality of network access requests triggered by the target object in a historical time period, wherein the plurality of network access requests at least comprise IP information and access domain name information of the target object; performing parsing processing on the plurality of network access requests to obtain initial DNS data; and screening the initial DNS data according to a DNS response type to obtain the target DNS data.

[0011] Further, the filtering the initial DNS data according to the DNS response type to obtain the target DNS data comprises: filtering the initial DNS data according to the DNS response type to obtain filtered DNS data; calculating a first quantity of DNS data corresponding to target IP information and a second quantity of network access requests corresponding to the target IP information according to the target IP information in the filtered DNS data; and filtering the filtered DNS data according to the first quantity and the second quantity to obtain the target DNS data.

[0012] Further, the constructing a target network relationship graph according to the target DNS data comprises: determining the domain name node according to the access domain name information of the target object and determining the IP node according to the IP information of the target object; determining an edge according to an access relationship of the access domain name information to the IP information; and constructing the target network relationship graph according to the domain name node, the IP node and the edge.

[0013] To achieve the above object, according to another aspect of the present application, a device for determining a botnet domain name is provided. The device comprises: a constructing unit configured to construct a target network relationship graph according to target DNS data, wherein the target DNS data at least comprises: access domain name information of a target object, IP information of the target object and an access relationship of the IP information to the access domain name information, and the target network relationship graph at least comprises: an IP node corresponding to the IP information and a domain name node corresponding to the access domain name information; a dividing unit configured to divide the target network relationship graph according to a community discovery algorithm to obtain a plurality of community structure information; and a determining unit configured to determine a target botnet domain name from the target DNS data according to the plurality of community structure information.

[0014] Further, the determining unit comprises: a first determining module configured to determine an initial botnet from the plurality of community structure information according to a quantity of domain name nodes in each community structure information; and a second determining module configured to determine the target botnet domain name according to a plurality of domain names corresponding to the initial botnet.

[0015] Further, the first determining module comprises: a first calculating sub-module configured to calculate a first ratio according to the quantity of domain name nodes and a quantity of second-level domain names in each community structure information; a second calculating sub-module configured to calculate a second ratio according to the quantity of domain name nodes and a quantity of multi-level domain names in each community structure information; and a filtering sub-module configured to filter the plurality of community structure information according to at least one of the quantity of domain name nodes, a quantity of edges corresponding to IP nodes in each community structure information, the first ratio and the second ratio to obtain the initial botnet.

[0016] Further, the second determining module comprises: a judging sub-module, configured to judge whether the registration domain names of the plurality of domain names corresponding to the initial botnet are same, to obtain a judging result; a third calculating sub-module, configured to, if the judging result indicates that the registration domain names of the plurality of target domain names in the plurality of domain names corresponding to the initial botnet are different, perform similarity calculation on the plurality of target domain names, to obtain a target similarity; and a determining sub-module, configured to determine the target botnet domain name from the plurality of target domain names according to the target similarity.

[0017] Further, the third calculating sub-module comprises: a first calculating secondary sub-module, configured to, for any two target domain names, a first target domain name and a second target domain name, perform similarity calculation on the registration domain name of the first target domain name and the multi-level domain name of the second target domain name, to obtain a first similarity; a second calculating secondary sub-module, configured to perform similarity calculation on the multi-level domain name of the first target domain name and the registration domain name of the second target domain name, to obtain a second similarity; and a determining secondary sub-module, configured to determine the target similarity according to the first similarity and the second similarity.

[0018] Further, the apparatus further comprises: an obtaining unit, configured to, before constructing a target network relationship graph according to target DNS data, obtain a plurality of network access requests triggered by the target object in a historical time period, wherein the plurality of network access requests at least comprise IP information and access domain name information of the target object; a parsing unit, configured to parse the plurality of network access requests, to obtain initial DNS data; and a screening unit, configured to screen the initial DNS data according to a DNS response type, to obtain the target DNS data.

[0019] Further, the screening unit comprises: a first screening module, configured to screen the initial DNS data according to the DNS response type, to obtain screened DNS data; a calculating module, configured to calculate a first number of DNS data corresponding to target IP information and a second number of network access requests corresponding to the target IP information according to the target IP information in the screened DNS data; and a second screening module, configured to screen the screened DNS data according to the first number and the second number, to obtain the target DNS data.

[0020] Further, the constructing unit comprises: a third determining module, configured to determine the domain name node according to the access domain name information of the target object, and determine the IP node according to the IP information of the target object; a fourth determining module, configured to determine an edge according to the access relationship of the IP information to the access domain name information; and a constructing module, configured to construct the target network relationship graph according to the domain name node, the IP node and the edge.

[0021] In order to achieve the above object, according to an aspect of the present application, a computer readable storage medium is provided, the storage medium stores a program, wherein when the program runs, the device where the storage medium is located performs the determination method of the botnet domain name provided in any one of the above embodiments.

[0022] In order to achieve the above object, according to another aspect of the present application, an electronic device is also provided, comprising one or more processors and a memory, the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the determination method of the botnet domain name provided in the above embodiments.

[0023] By the present application, the following steps are adopted: constructing a target network relationship graph according to target DNS data, wherein the target DNS data at least comprises: access domain name information of a target object, IP information of the target object and access relationship of the IP information to the access domain name information, and the target network relationship graph at least comprises: an IP node corresponding to the IP information and a domain name node corresponding to the access domain name information; performing community division on the target network relationship graph according to a community discovery algorithm to obtain multiple community structure information; and determining a target botnet domain name from the target DNS data according to the multiple community structure information. By the present application, the problem that the determination accuracy of the botnet domain name is relatively low in the related art by calculating the similarity of the target domain name and the historical botnet domain name to determine whether the target domain name is a botnet domain name is solved.

[0024] In the present solution, first, a target network relationship graph is established according to the access domain name information, the IP information and the access relationship of the IP information to the access domain name information of the target object in the target DNS data; then, the target network relationship graph is divided into communities by using a community discovery algorithm to obtain multiple community structure information (for example, multiple community clusters); finally, the target botnet domain name in the target DNS data is obtained based on the analysis of the multiple community structure information.

[0025] By constructing the target network relationship graph, the network access behavior of the target object can be accurately analyzed, and the community discovery algorithm is used to divide the target network relationship graph into communities, and then a plurality of community clusters are quickly obtained, and finally the target DNS data is analyzed based on the plurality of community structure information to obtain the target botnet domain name, which further reduces the false positive risk in the result, and avoids the problem of low accuracy of determining the botnet domain name caused by the difference between the suspected botnet domain name and the historical botnet domain name in the traditional method. BRIEF DESCRIPTION OF DRAWINGS

[0026] The accompanying drawings, which form a part of this application, are intended to provide further understanding of the application and are incorporated herein in their entirety, which serve to explain the application and are not intended to limit the application. In the drawings:

[0027] Figure 1 is a flowchart of a method for determining a botnet domain name according to an embodiment of the application;

[0028] Figure 2 is a schematic diagram of the result of a community discovery algorithm according to an embodiment of the application;

[0029] Figure 3 is a schematic diagram of a target network relationship graph according to an embodiment of the application;

[0030] Figure 4 is a schematic diagram of a botnet domain name determination device according to an embodiment of the application;

[0031] Figure 5 is a schematic diagram of an electronic device according to an embodiment of the application. DETAILED DESCRIPTION

[0032] It should be noted that the embodiments and features in the application can be combined with each other without conflict. The application will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0033] In order to enable those skilled in the art to better understand the application scheme, the technical solutions in the embodiments of the application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the application. Obviously, the described embodiments are only a part of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the application.

[0034] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and in the above drawings are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not have to be limited to only those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0035] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, analyzed data, etc.) involved in the present disclosure are all information and data authorized by the user or authorized by all parties. For example, an interface is provided between the system and the relevant user or institution. Before obtaining the relevant information, the interface needs to send a request to the aforementioned user or institution, and after receiving the consent information feedback from the aforementioned user or institution, the relevant information is obtained.

[0036] The present application provides a method for determining a botnet domain name, which can be executed by a domain name detection system or a security protection system as an execution subject, and the system can be realized by software or a combination of software and hardware.

[0037] The present application will be described below in conjunction with preferred implementation steps, Figure 1 The flowchart of the method for determining a botnet domain name provided by the embodiments of the present application is shown in Figure 1 The method comprises the following steps:

[0038] Step S101, constructing a target network relationship graph according to target DNS data, wherein the target DNS data at least includes: access domain name information of a target object, IP information of the target object, and an access relationship of the IP information to the access domain name information, and the target network relationship graph at least includes: an IP node corresponding to the IP information and a domain name node corresponding to the access domain name information.

[0039] Optionally, according to the IP information (for example, the source IP address of the target object) and the access domain name information (for example, the access domain name address of the target object) in the target DNS data, a target network relationship graph is constructed based on the access behavior (i.e. the access relationship of the IP information to the access domain name information), and the target network relationship graph can be a directed graph network structure.

[0040] Step S102, performing community division on the target network relationship graph according to a community discovery algorithm to obtain a plurality of community structure information.

[0041] Optionally, Figure 2 is a schematic diagram of the result of the community discovery algorithm provided by the embodiments of the present application, as Figure 2 shown, in the undirected graph network structure constructed by the target DNS data, community division is performed by the community discovery algorithm to obtain a plurality of community clusters (i.e., a plurality of community structure information).

[0042] It should be noted that the community discovery algorithm includes but is not limited to: Louvain, Leiden and other community discovery algorithms derived by clustering algorithm.

[0043] It should be noted that the Louvain algorithm is a greedy heuristic algorithm based on modularity optimization, which aims to divide the nodes in the network into different communities, so that the connections within the community are more intensive and the connections between the communities are more sparse. The algorithm divides the community by optimizing the modularity within the community, and moves the nodes to the community that increases the modularity, until it can no longer be increased.

[0044] It should be noted that the Leiden algorithm is an algorithm based on the idea of local optimization, which divides the network nodes into different communities to maximize the connection strength within the network and minimize the connection strength between the communities. Its advantages lie in the efficiency and scalability of the algorithm, which can handle large networks containing millions of nodes and billions of edges. At the same time, the algorithm also has good stability and robustness, and can produce reasonable community division results for different types of networks.

[0045] Step S103, determining the target botnet domain name from the target DNS data according to the plurality of community structure information.

[0046] Optionally, the plurality of community structure information (for example: community cluster) is screened by one or more threshold conditions to determine the suspected botnet family. The suspected botnet family screened by the threshold condition is subjected to domain name similarity analysis, and the suspected botnet family is further screened by calculating the similarity between a plurality of domain names in the suspected botnet family, and finally the target botnet domain name in the suspected botnet family is determined.

[0047] The one or more threshold conditions include at least one of the following conditions: screening condition one: the number of edges corresponding to IP nodes in the community cluster is greater than or equal to a threshold value x1; screening condition two: the ratio of the number of nodes with one edge in the community cluster to the total number of IP nodes in the community cluster is greater than or equal to a threshold value x2; screening condition three: the number of domain name nodes in the community cluster is greater than or equal to a threshold value x3; screening condition four: the repetition degree k (i.e., a first ratio) of the second-level domain name in the community cluster is greater than or equal to a threshold value x4, where k is the ratio of the number of second-level domain names to the number of domain name nodes in each community cluster; and screening condition five: the ratio (i.e., a second ratio) of the number of multi-level domain names in the community cluster to the number of domain name nodes is greater than or equal to a threshold value x5.

[0048] In some examples, to further improve the accuracy of the determination of the botnet domain name, the community cluster that meets the above five screening conditions can be determined as an initial botnet, and the botnet domain name can be determined from the initial botnet.

[0049] In summary, first, a target network relationship graph is established according to the access domain name information, IP information, and access relationship of the IP information of the target objects in the target DNS data; then, community division is performed on the target network relationship graph by using a community discovery algorithm to obtain a plurality of community clusters (i.e., community structure information); and finally, analysis is performed based on the plurality of community structure information to obtain the target botnet domain name in the target DNS data. By constructing the target network relationship graph, the network access behavior of the target objects can be accurately analyzed, and community division is performed on the target network relationship graph by using the community discovery algorithm, and then a plurality of community clusters are quickly obtained, and finally analysis is performed based on the plurality of community structure information to determine the target botnet domain name in the target DNS data, which further reduces the false positive risk in the result and avoids the problem of low accuracy of the determination of the botnet domain name caused by the difference between the suspected botnet domain name and the historical botnet domain name in the traditional method.

[0050] Optionally, in the method for determining the botnet domain name provided in the embodiments of the present application, the target botnet domain name is determined from the target DNS data according to the plurality of community structure information, including: determining an initial botnet from the plurality of community structure information according to the number of domain name nodes in each community structure information; and determining the target botnet domain name according to the plurality of domain names corresponding to the initial botnet.

[0051] In an optional embodiment, screening conditions are set according to the information such as the domain name nodes, IP nodes, and the number of edges corresponding to the IP nodes, to screen the plurality of community clusters to obtain a suspected DGA family community cluster (i.e., an initial botnet). The target botnet domain name is determined by calculating the string similarity between the subdomain names in the domain name nodes in the suspected DGA family community cluster.

[0052] In some embodiments, the method can further comprise determining a botnet domain name family according to a community structure to which the target botnet domain name belongs.

[0053] By screening the plurality of community clusters, the suspected DGA family community cluster can be accurately located, and then the key domain name in the botnet can be identified, which is helpful for further investigation and prevention of the botnet activities.

[0054] Optionally, in the method for determining the botnet domain name provided in the embodiments of the present application, the initial botnet is determined from the plurality of community structure information according to the number of domain name nodes in each community structure information, comprising: calculating a first ratio value according to the number of domain name nodes and the number of second-level domain names in each community structure information; calculating a second ratio value according to the number of domain name nodes and the number of multi-level domain names in each community structure information; and screening the plurality of community structure information according to at least one of the number of domain name nodes, the number of edges corresponding to the IP nodes in each community structure information, the first ratio value and the second ratio value, to obtain the initial botnet.

[0055] In an optional embodiment, the multi-level domain name comprises a first-level domain name (top-level domain name) field, a second-level domain name (customer domain name) field and a third-level domain name (application domain name) field. For example, the first-level domain name is aaa.com, the second-level domain name is bbb.aaa.com, and the third-level domain name is ccc.bbb.aaa.com, and the third-level domain name ccc.bbb.aaa.com is regarded as a multi-level domain name. Here, ccc is a registered domain name.

[0056] In an optional embodiment, a plurality of screening conditions can be set to screen the plurality of community clusters to obtain the initial botnet. The screening condition one: the number of edges corresponding to the IP nodes in the community cluster is greater than or equal to a threshold value x1; the screening condition two: the ratio of the number of nodes with the number of edges corresponding to the IP nodes in the community cluster being 1 to the total number of IP nodes in the community cluster is greater than or equal to a threshold value x2; the screening condition three: the number of domain name nodes in the community cluster is greater than or equal to a threshold value x3; the screening condition four: the repetition degree k of the second-level domain names in the community cluster is greater than or equal to a threshold value x4 (i.e. the first ratio value), wherein k is the ratio of the number of second-level domain names in each community cluster to the number of domain name nodes; and the screening condition five: the ratio of the number of multi-level domain names in the community cluster in the number of domain name nodes (i.e. the second ratio value) is greater than or equal to a threshold value x5. The community cluster satisfying the above five screening conditions is determined as the suspected DGA family community cluster (i.e. the initial botnet).

[0057] Here, the edge corresponding to the IP node can be understood as the edge connected by the IP node.

[0058] It should be noted that x1, x2, x3, x4 and x5 in the above screening conditions are all non-fixed values and can be dynamically adjusted.

[0059] The threshold condition is set to screen the plurality of community clusters obtained by the community discovery algorithm, thereby effectively reducing the false positive risk in the result.

[0060] Optionally, in the method for determining the domain name of the botnet provided in the embodiments of the present application, the target botnet domain name is determined according to the plurality of domain names corresponding to the initial botnet, including: judging whether the registration domain names of the plurality of domain names corresponding to the initial botnet are the same, to obtain a judgment result; if the judgment result indicates that the registration domain names of the plurality of target domain names in the plurality of domain names corresponding to the initial botnet are different, performing similarity calculation on the plurality of target domain names to obtain a target similarity; and determining the target botnet domain name from the plurality of target domain names according to the target similarity.

[0061] In an optional embodiment, it can be judged whether the plurality of domain names corresponding to the initial botnet have the same registration domain name, and the plurality of domain names corresponding to the initial botnet are preliminarily screened according to the judgment result. If the domain names have the same registration domain name, it can be considered that they do not belong to the domain name of the botnet. For the plurality of target domain names with different registration domain names, further screening is performed: the target similarity between any two target domain names in the plurality of target domain names is calculated, and the size relationship between the target similarity and a preset threshold y1 is judged: when the target similarity is greater than or equal to the threshold y1, it is considered that the two target domain names do not belong to the domain name of the botnet; and when the target similarity is less than the threshold y1, it is considered that the two target domain names belong to the domain name of the botnet, wherein the threshold y1 is a non-fixed value and can be dynamically adjusted.

[0062] It should be noted that the dynamic domain name can be regarded as a top-level domain name, for example, in testdomain1.dynu.com, dynu.com can be regarded as a top-level domain name, and testdomain1 can be regarded as a registration domain name.

[0063] By judging whether the plurality of domain names corresponding to the initial botnet have the same registration domain name, some domain names that do not belong to the botnet can be excluded, thereby reducing the workload of subsequent analysis. At the same time, the similarity of the target domain names with different registration domain names is calculated, and the target botnet domain name is determined by judging the size relationship between the target similarity and the preset threshold, which helps to improve the accuracy and pertinence of the analysis.

[0064] Optionally, in the method for determining a botnet domain name provided in the embodiments of the present application, the similarity calculation on the plurality of target domain names to obtain the target similarity includes: for any two target domain names, a first target domain name and a second target domain name, performing similarity calculation on the registration domain name of the first target domain name and the multi-level domain name of the second target domain name to obtain a first similarity; performing similarity calculation on the multi-level domain name of the first target domain name and the registration domain name of the second target domain name to obtain a second similarity; and determining the target similarity according to the first similarity and the second similarity.

[0065] In an optional embodiment, the similarity between the registration domain name string of the first target domain name and the high-level subdomain name (i.e., the multi-level domain name) string of the second target domain name in any two target domain names can be calculated by using an edit distance algorithm or a text similarity calculation method to obtain the target similarity.

[0066] It should be noted that the edit distance algorithm is a method for measuring the similarity between two strings, i.e., the minimum number of operations required to make them equal by adding, deleting, or replacing operations. The smaller the edit distance, the more similar the two strings. Based on the edit distance, the similarity between the strings can be calculated, and the similarity value can be normalized by dividing the edit distance by the maximum length of the string, so that the similarity value is between 0 and 1.

[0067] By performing similarity calculation on the plurality of target domain names, domain names representing the same organization or the same category can be accurately identified, and potential associations can be discovered. Potential botnet domain names or other malicious domain names can be better identified.

[0068] Optionally, in the method for determining a botnet domain name provided in the embodiments of the present application, before the target network relationship graph is constructed according to the target DNS data, the method further includes: obtaining a plurality of network access requests triggered by the target object in a historical time period, wherein the plurality of network access requests at least include IP information of the target object, access domain name information; performing analysis processing on the plurality of network access requests to obtain initial DNS data; and filtering the initial DNS data according to the DNS response type to obtain the target DNS data.

[0069] In an optional embodiment, the plurality of network access requests triggered by the target object in the historical time period can be obtained by using a network packet capture tool, and the network access requests are analyzed and processed to extract the IP information of the target object, the access domain name information of the target object, and the access time information. Then, the access domain name information of the target object is analyzed and processed by DNS to obtain the corresponding IP address to obtain the initial DNS data, and the DNS response type is returned. Finally, the initial DNS data is filtered by using the DNS response type and other filtering conditions to obtain the target DNS data.

[0070] It should be noted that the initial DNS data can also be collected through various DNS data collection methods such as network card flow collection, DNS access log, security device DNS data interface, etc.

[0071] It should be noted that the DNS response type at least includes NOERROR, SERVFAIL, NOXDOMAIN and REFUSE. NOERROR indicates a successful response, that is, the domain name resolution is successful; SERVFAIL indicates that the DNS server resolution fails, that is, the DNS server of the domain name refuses to respond or responds REFUSE; NOXDOMAIN indicates that there is no IP address information corresponding to the domain name, that is, the domain name does not exist in the DNS server; and REFUSE indicates that the request source IP is not within the service range.

[0072] The initial DNS data can be accurately obtained through various ways, and the initial DNS data is filtered through multiple filtering conditions, thereby minimizing the redundancy of the data and laying a foundation for subsequent detection and determination of the botnet domain name.

[0073] Optionally, in the method for determining the botnet domain name provided in the embodiments of the present application, the initial DNS data is filtered according to the DNS response type to obtain target DNS data, comprising: filtering the initial DNS data according to the DNS response type to obtain filtered DNS data; calculating a first number of DNS data corresponding to the target IP information and a second number of network access requests corresponding to the target IP information according to the target IP information in the filtered DNS data; and filtering the filtered DNS data according to the first number and the second number to obtain the target DNS data.

[0074] In an optional embodiment, multiple filtering conditions can be set to filter the initial DNS data to obtain the target DNS data. Among them, filtering condition one: the DNS response type is a preset response type (for example, NOXDOMAIN); filtering condition two: in a fixed-length sliding time window, the number of DNS response types corresponding to a target IP information (that is, the first number of DNS data corresponding to the target IP information) corresponding to a target IP information is greater than or equal to y1% of the total number (that is, the second number of network access requests corresponding to the target IP information); and filtering condition three: in a fixed-length sliding time window, the number of DNS response types corresponding to a target IP information is greater than or equal to a threshold value y2 (that is, the first number of DNS data corresponding to the target IP information). The initial DNS data is preliminarily filtered through the filtering condition one to obtain the filtered DNS data. And the filtered DNS data is twice filtered according to the filtering condition two and the filtering condition three to obtain the target DNS data.

[0075] It should be noted that the threshold value y1 and the threshold value y2 in the above screening condition are both non-fixed values and can be dynamically adjusted.

[0076] Through the above screening condition, the initial DNS data can be gradually filtered, the redundancy of the initial DNS data is reduced, and then the target DNS data meeting the condition is quickly obtained, and potential abnormal or malicious DNS requests are helped to be identified for further analysis and processing.

[0077] Optionally, in the method for determining a botnet domain name provided in the embodiments of the present application, constructing the target network relationship graph according to the target DNS data comprises: determining a domain name node according to the access domain name information of the target object and determining an IP node according to the IP information of the target object; determining an edge according to the access relationship of the access domain name information to the IP information; and constructing the target network relationship graph according to the domain name node, the IP node and the edge.

[0078] In an optional embodiment, Figure 3 is a schematic diagram of the target network relationship graph provided in the embodiments of the present application, as Figure 3 As shown in the figure, the domain name detection system constructs the network relationship (for example, the access relationship of the IP information to the access domain name information) based on the access behavior according to the relationship between the source IP address (for example, the IP information of the target object) and the access domain name address (for example, the access domain name information of the target object) in the target DNS data, and constructs the target network relationship graph. In the network structure, the nodes are divided into two types, the first type is an IP node, and the second type is a domain name node. The edge attribute between the IP node and the domain name node is the access frequency.

[0079] By constructing the target network relationship graph, the corresponding relationship between the domain name information and the IP information of the target object can be clearly presented, which helps to analyze the network traffic, identify potential malicious activities and botnet domain names.

[0080] The method for determining a botnet domain name provided in the embodiments of the present application comprises: constructing a target network relationship graph according to target DNS data, wherein the target DNS data at least comprises: access domain name information of a target object, IP information of the target object and an access relationship of the IP information to the access domain name information, and the target network relationship graph at least comprises: an IP node corresponding to the IP information and a domain name node corresponding to the access domain name information; performing community division on the target network relationship graph according to a community discovery algorithm to obtain multiple community structure information; and determining a target botnet domain name from the target DNS data according to the multiple community structure information, which solves the problem that in the related art, the similarity between a target domain name and a historical botnet domain name is calculated to determine whether the target domain name is a botnet domain name, resulting in a relatively low accuracy of determining the botnet domain name.

[0081] To sum up, in the present solution, first, a target network relationship graph is established according to the access domain name information, IP information and access relationship of the IP information of the target object in the target DNS data; then, community discovery algorithm is used to perform community division on the target network relationship graph to obtain multiple community structure information (for example, multiple community clusters); finally, analysis is performed based on the multiple community structure information to obtain the target botnet domain name in the target DNS data.

[0082] By constructing the target network relationship graph, the network access behavior of the target object can be accurately analyzed, and the community discovery algorithm is used to perform community division on the target network relationship graph, and then multiple community clusters are quickly obtained, and finally analysis is performed based on the multiple community structure information to obtain the target botnet domain name in the target DNS data, which further reduces the false positive risk in the result, and avoids the problem of low accuracy of determining the botnet domain name caused by determining the target botnet domain name according to the difference between the suspected botnet domain name and the historical botnet domain name in the traditional method.

[0083] It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0084] The embodiments or examples of the present application are not exhaustive, but only illustrate some embodiments or examples, and do not specifically limit the protection scope of the present application. In the case of no contradiction, each step in a certain embodiment or example can be implemented as an independent example, and the steps can be combined arbitrarily, for example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be exchanged arbitrarily, in addition, the optional ways or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the embodiments or examples can be combined arbitrarily, for example, the steps of different embodiments or examples can be combined arbitrarily, a certain embodiment or example can be combined with the optional ways or optional examples of other embodiments or examples.

[0085] The present application also provides a botnet domain name determination device, and it should be noted that the botnet domain name determination device of the present application can be used to execute the botnet domain name determination method provided by the present application. The botnet domain name determination device provided by the present application is introduced as follows.

[0086] Figure 4 is a schematic diagram of the botnet domain name determination device according to the present application. As shown in the figure, the botnet domain name determination device according to the present application comprises a target network relationship graph establishment unit 1, a community division unit 2 and a target botnet domain name determination unit 3.Figure 4 As shown in the figure, the device comprises a construction unit 401, a division unit 402, and a determination unit 403.

[0087] The construction unit 401 is configured to construct a target network relationship graph according to target DNS data, wherein the target DNS data at least comprises access domain name information of a target object, IP information of the target object, and an access relationship of the IP information to the access domain name information, and the target network relationship graph at least comprises an IP node corresponding to the IP information and a domain name node corresponding to the access domain name information.

[0088] The division unit 402 is configured to perform community division on the target network relationship graph according to a community discovery algorithm to obtain a plurality of community structure information.

[0089] The determination unit 403 is configured to determine a target botnet domain name from the target DNS data according to the plurality of community structure information.

[0090] The determination device for the botnet domain name provided by the embodiment of the application, the construction unit 401 constructs a target network relationship graph according to target DNS data, wherein the target DNS data at least comprises access domain name information of a target object, IP information of the target object, and an access relationship of the IP information to the access domain name information, and the target network relationship graph at least comprises an IP node corresponding to the IP information and a domain name node corresponding to the access domain name information; the division unit 402 performs community division on the target network relationship graph according to a community discovery algorithm to obtain a plurality of community structure information; and the determination unit 403 determines a target botnet domain name from the target DNS data according to the plurality of community structure information, thereby solving the problem of low accuracy of determination of the botnet domain name in the related art by calculating the similarity of the target domain name and the historical botnet domain name to determine whether the target domain name is a botnet domain name.

[0091] In the present scheme, first, a target network relationship graph is established according to the access domain name information of a target object, IP information, and an access relationship of the IP information to the access domain name information in target DNS data; then, a community discovery algorithm is used to perform community division on the target network relationship graph to obtain a plurality of community structure information (for example, a plurality of community clusters); finally, analysis is performed based on the plurality of community structure information to obtain a target botnet domain name in the target DNS data.

[0092] By constructing the target network relationship graph, the network access behavior of the target object can be accurately analyzed, and the community discovery algorithm is used to divide the target network relationship graph into communities, and then multiple community clusters are quickly obtained. Finally, based on the multiple community structure information, the target DNS data is analyzed to obtain the target botnet domain name, which further reduces the false positive risk in the result and avoids the problem of low accuracy of determining the botnet domain name in the traditional method by determining the target botnet domain name according to the difference between the suspected botnet domain name and the historical botnet domain name.

[0093] Optionally, in the botnet domain name determination apparatus provided in the embodiments of the present application, the determination unit comprises: a first determination module, configured to determine an initial botnet from the multiple community structure information according to the number of domain name nodes in each community structure information; and a second determination module, configured to determine the target botnet domain name according to the multiple domain names corresponding to the initial botnet.

[0094] Optionally, in the botnet domain name determination apparatus provided in the embodiments of the present application, the first determination module comprises: a first calculation submodule, configured to calculate a first ratio according to the number of domain name nodes and the number of second-level domain names in each community structure information; a second calculation submodule, configured to calculate a second ratio according to the number of domain name nodes and the number of multi-level domain names in each community structure information; and a screening submodule, configured to screen the multiple community structure information according to at least one of the number of domain name nodes, the number of edges corresponding to the IP nodes in each community structure information, the first ratio and the second ratio, to obtain the initial botnet.

[0095] Optionally, in the botnet domain name determination apparatus provided in the embodiments of the present application, the second determination module comprises: a judgment submodule, configured to judge whether the registration domain names of the multiple domain names corresponding to the initial botnet are the same, to obtain a judgment result; a third calculation submodule, configured to, if the judgment result indicates that the registration domain names of the multiple target domain names in the multiple domain names corresponding to the initial botnet are different, perform similarity calculation on the multiple target domain names, to obtain a target similarity; and a determination submodule, configured to determine the target botnet domain name from the multiple target domain names according to the target similarity.

[0096] Optionally, in the botnet domain name determination apparatus provided in the embodiments of the present application, the third calculation submodule comprises: a first calculation sub-submodule, configured to, for any two target domain names, a first target domain name and a second target domain name, perform similarity calculation on the registration domain name of the first target domain name and the multi-level domain name of the second target domain name, to obtain a first similarity; a second calculation sub-submodule, configured to perform similarity calculation on the multi-level domain name of the first target domain name and the registration domain name of the second target domain name, to obtain a second similarity; and a determination sub-submodule, configured to determine the target similarity according to the first similarity and the second similarity.

[0097] Optionally, in the device for determining a botnet domain name provided in the embodiments of the present application, the device further comprises an acquisition unit, configured to acquire a plurality of network access requests triggered by the target object in a historical time period before constructing the target network relationship graph according to the target DNS data, wherein the plurality of network access requests at least comprise IP information of the target object and access domain name information; a parsing unit, configured to parse the plurality of network access requests to obtain initial DNS data; and a screening unit, configured to screen the initial DNS data according to the DNS response type to obtain the target DNS data.

[0098] Optionally, in the device for determining a botnet domain name provided in the embodiments of the present application, the screening unit comprises a first screening module, configured to screen the initial DNS data according to the DNS response type to obtain screened DNS data; a calculation module, configured to calculate a first number of DNS data corresponding to the target IP information and a second number of network access requests corresponding to the target IP information according to the target IP information in the screened DNS data; and a second screening module, configured to screen the screened DNS data according to the first number and the second number to obtain the target DNS data.

[0099] Optionally, in the device for determining a botnet domain name provided in the embodiments of the present application, the constructing unit comprises a third determination module, configured to determine a domain name node according to the access domain name information of the target object and an IP node according to the IP information of the target object; a fourth determination module, configured to determine an edge according to the access relationship of the access domain name information to the IP information; and a constructing module, configured to construct the target network relationship graph according to the domain name node, the IP node and the edge.

[0100] The device for determining a botnet domain name comprises a processor and a memory, the above-mentioned constructing unit 401, dividing unit 402 and determining unit 403 are all stored in the memory as program units, and the processor is configured to execute the above-mentioned program units stored in the memory to accurately determine a botnet domain name.

[0101] The processor comprises a core, and the core is configured to call corresponding program units from the memory. The core can be set as one or more, and the core parameters are adjusted to accurately determine a botnet domain name.

[0102] The memory can comprise a non-permanent memory in a computer readable medium, a random access memory (RAM) and / or a non-volatile memory such as a read-only memory (ROM) or a flash memory (flash RAM), and the memory comprises at least one memory chip.

[0103] This invention provides a computer-readable storage medium storing a program that, when executed by a processor, implements a method for determining botnet domain names.

[0104] This invention provides a processor for running a program, wherein the program executes a method for determining botnet domain names during runtime.

[0105] like Figure 5 As shown, an embodiment of the present invention provides an electronic device, the device including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors perform the following steps: constructing a target network relationship graph based on target DNS data, wherein the target DNS data includes at least: access domain name information of the target object, IP information of the target object, and access relationship between IP information and access domain name information, and the target network relationship graph includes at least: IP nodes corresponding to IP information and domain name nodes corresponding to access domain name information; dividing the target network relationship graph into communities based on a community detection algorithm to obtain multiple community structure information; and determining the target botnet domain name from the target DNS data based on the multiple community structure information.

[0106] Optionally, determining the target botnet domain name from the target DNS data based on multiple community structure information includes: determining the initial botnet from multiple community structure information based on the number of domain name nodes in each community structure information; and determining the target botnet domain name based on the multiple domain names corresponding to the initial botnet.

[0107] Optionally, determining the initial botnet from multiple community structure information based on the number of domain name nodes in each community structure information includes: calculating a first ratio based on the number of domain name nodes and the number of second-level domains in each community structure information; calculating a second ratio based on the number of domain name nodes and the number of multi-level domains in each community structure information, wherein multi-level domains are different from second-level domains; and filtering multiple community structure information based on at least one of the number of domain name nodes, the number of edges corresponding to IP nodes in each community structure information, the first ratio, and the second ratio to obtain the initial botnet.

[0108] Optionally, determining the target botnet domain name based on the multiple domain names corresponding to the initial botnet includes: determining whether the registered domain names of the multiple domain names corresponding to the initial botnet are the same, and obtaining a determination result; if the determination result indicates that there are multiple target domain names among the multiple domain names corresponding to the initial botnet whose registered domain names are different, then performing similarity calculation on the multiple target domain names to obtain the target similarity; and determining the target botnet domain name from the multiple target domain names based on the target similarity.

[0109] Optionally, the similarity calculation on the plurality of target domain names to obtain the target similarity includes: for any two target domain names, a first target domain name and a second target domain name, performing similarity calculation on the registered domain name of the first target domain name and the multi-level domain name of the second target domain name to obtain a first similarity; performing similarity calculation on the multi-level domain name of the first target domain name and the registered domain name of the second target domain name to obtain a second similarity; and determining the target similarity according to the first similarity and the second similarity.

[0110] Optionally, before the constructing the target network relationship graph according to the target DNS data, the method further includes: obtaining a plurality of network access requests triggered by the target object in a historical time period, wherein the plurality of network access requests at least include IP information of the target object and access domain name information; performing analysis processing on the plurality of network access requests to obtain initial DNS data; and performing filtering on the initial DNS data according to a DNS response type to obtain the target DNS data.

[0111] Optionally, the filtering on the initial DNS data according to the DNS response type to obtain the target DNS data includes: performing filtering on the initial DNS data according to the DNS response type to obtain filtered DNS data; calculating a first quantity of DNS data corresponding to the target IP information and a second quantity of network access requests corresponding to the target IP information according to the target IP information in the filtered DNS data; and performing filtering on the filtered DNS data according to the first quantity and the second quantity to obtain the target DNS data.

[0112] Optionally, the constructing the target network relationship graph according to the target DNS data includes: determining a domain name node according to the access domain name information of the target object and an IP node according to the IP information of the target object; determining an edge according to an access relationship of the access domain name information to the IP information; and constructing the target network relationship graph according to the domain name node, the IP node and the edge.

[0113] The device herein can be a server, a PC, a PAD, a mobile phone, etc.

[0114] The application further provides a computer program product adapted to execute the program of the following method steps when executed on a data processing device: constructing a target network relationship graph according to target DNS data, wherein the target DNS data at least includes access domain name information of a target object, IP information of the target object and an access relationship of the IP information to the access domain name information, and the target network relationship graph at least includes an IP node corresponding to the IP information and a domain name node corresponding to the access domain name information; performing community division on the target network relationship graph according to a community discovery algorithm to obtain a plurality of community structure information; and determining target botnet domain names from the target DNS data according to the plurality of community structure information.

[0115] Optionally, determining the target botnet domain name from the target DNS data according to the plurality of community structure information comprises: determining an initial botnet from the plurality of community structure information according to the number of domain name nodes in each community structure information; and determining the target botnet domain name according to the plurality of domain names corresponding to the initial botnet.

[0116] Optionally, determining the initial botnet from the plurality of community structure information according to the number of domain name nodes in each community structure information comprises: calculating a first ratio according to the number of domain name nodes and the number of second-level domain names in each community structure information; calculating a second ratio according to the number of domain name nodes and the number of multi-level domain names in each community structure information, wherein the multi-level domain names are different from the second-level domain names; and screening the plurality of community structure information according to at least one of the number of domain name nodes, the number of edges corresponding to the IP nodes in each community structure information, the first ratio, and the second ratio, to obtain the initial botnet.

[0117] Optionally, determining the target botnet domain name according to the plurality of domain names corresponding to the initial botnet comprises: judging whether the registration domain names of the plurality of domain names corresponding to the initial botnet are the same, to obtain a judgment result; if the judgment result indicates that the registration domain names of the plurality of domain names corresponding to the initial botnet are not the same, performing similarity calculation on a plurality of target domain names to obtain a target similarity; and determining the target botnet domain name from the plurality of target domain names according to the target similarity.

[0118] Optionally, the similarity calculation on the plurality of target domain names to obtain the target similarity comprises: for any two target domain names, a first target domain name and a second target domain name, performing similarity calculation on the registration domain name of the first target domain name and the multi-level domain name of the second target domain name to obtain a first similarity; performing similarity calculation on the multi-level domain name of the first target domain name and the registration domain name of the second target domain name to obtain a second similarity; and determining the target similarity according to the first similarity and the second similarity.

[0119] Optionally, before constructing the target network relationship graph according to the target DNS data, the method further comprises: obtaining a plurality of network access requests triggered by the target object in a historical time period, wherein the plurality of network access requests at least include IP information of the target object and access domain name information; performing parsing processing on the plurality of network access requests to obtain initial DNS data; and screening the initial DNS data according to a DNS response type to obtain the target DNS data.

[0120] Optionally, the screening the initial DNS data according to the DNS response type to obtain the target DNS data comprises: screening the initial DNS data according to the DNS response type to obtain screened DNS data; calculating a first quantity of DNS data corresponding to the target IP information and a second quantity of network access requests corresponding to the target IP information according to the target IP information in the screened DNS data; and screening the screened DNS data according to the first quantity and the second quantity to obtain the target DNS data.

[0121] Optionally, the constructing the target network relationship diagram according to the target DNS data comprises: determining a domain name node according to the access domain name information of the target object and an IP node according to the IP information of the target object; determining an edge according to an access relationship of the access domain name information to the IP information; and constructing the target network relationship diagram according to the domain name node, the IP node and the edge.

[0122] Those skilled in the art should understand that embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) containing computer usable program code.

[0123] The present application is described with reference to the flowcharts and / or block diagrams according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a device that implements the flow Figure 1 The function specified in one or more flows and / or blocks. Figure 1 The function specified in one or more flows and / or blocks.

[0124] These computer program instructions can also be stored in a computer readable memory that can direct the computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including instruction devices that implement the flow Figure 1 The function specified in one or more flows and / or blocks. Figure 1 The function specified in one or more flows and / or blocks.

[0125] These computer program instructions can also be loaded into a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 Figure 1

[0126] In one typical configuration, the computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0127] The memory can include non-persistent memory and / or volatile memory, such as random access memory (RAM) about which the processor can execute instructions. The memory can also include non-volatile memory, such as read only memory (ROM), electrically programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), programmable read only memory (PROM), erasable programmable read only memory (EPROM), flash memory, or a combination of non-volatile memories in different types. The memory can also include a compact disk read only memory (CD-ROM), digital versatile disk (DVD), Blu-ray, or another non-transitory computer readable medium, which is non-volatile and non-transitory in nature, but volatile in that it can lose its content if the power to the computer is turned off or if the computer crashes. The memory is an example of a computer readable medium.

[0128] Computer readable media includes permanent and non-permanent, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read only memory (CD-ROM), digital versatile disk (DVD), or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer readable media does not include transitory media such as modulated data signals and carriers.

[0129] It should also be noted that the terms "comprising," "including," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements recited, but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element preceded by "comprises a" does not, without more constraints, foreclose the existence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0130] ​​Those skilled in the art will appreciate that embodiments of the present application can be devised for a method, a system, or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer-readable program code thereon for use by or in connection with an instruction execution system. For the purposes of this description, a computer-usable or computer readable storage medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.

[0131] The foregoing is merely illustrative of the embodiments of this application, and is not intended to limit the application. Numerous variations and modifications can be possible to the embodiments without departing from the spirit and scope of the application. Any equivalent modification or variation, made in light of the above teachings, should be included within the scope of the application.

Claims

1. A botnet domain name determination method, characterized in that, The method comprises the following steps: constructing a target network relationship graph according to target DNS data, wherein the target DNS data at least comprises access domain name information of a target object, IP information of the target object, and an access relationship of the IP information to the access domain name information, and the target network relationship graph at least comprises an IP node corresponding to the IP information and a domain name node corresponding to the access domain name information; performing community division on the target network relationship graph according to a community discovery algorithm to obtain a plurality of community structure information; determining a target botnet domain name from the target DNS data according to the plurality of community structure information; wherein determining the target botnet domain name from the target DNS data according to the plurality of community structure information comprises: calculating a first ratio according to a number of domain name nodes in each community structure information and a number of second-level domain names in each community structure information; calculating a second ratio according to the number of domain name nodes and a number of multi-level domain names in each community structure information, wherein the multi-level domain names are different from the second-level domain names; screening the plurality of community structure information according to at least one of the number of domain name nodes, a number of edges corresponding to IP nodes in each community structure information, the first ratio, and the second ratio to obtain an initial botnet; judging whether registration domain names of a plurality of domain names corresponding to the initial botnet are the same to obtain a judgment result; if the judgment result represents that registration domain names of a plurality of target domain names in the plurality of domain names corresponding to the initial botnet are different, performing similarity calculation on the plurality of target domain names to obtain a target similarity; determining the target botnet domain name from the plurality of target domain names according to the target similarity.

2. The method of claim 1, wherein, The similarity calculation on the plurality of target domain names comprises: for any two target domain names, a first target domain name and a second target domain name, performing similarity calculation on a registration domain name of the first target domain name and multi-level domain names of the second target domain name to obtain a first similarity; performing similarity calculation on the multi-level domain names of the first target domain name and a registration domain name of the second target domain name to obtain a second similarity; determining the target similarity according to the first similarity and the second similarity.

3. The method of claim 1, wherein, Before constructing a target network relationship graph according to target DNS data, the method further comprises: obtaining a plurality of network access requests triggered by the target object in a historical time period, wherein the plurality of network access requests at least comprise IP information of the target object and access domain name information; performing analysis processing on the plurality of network access requests to obtain initial DNS data; screening the initial DNS data according to a DNS response type to obtain the target DNS data.

4. The method of claim 3, wherein, Screening the initial DNS data according to a DNS response type to obtain the target DNS data comprises: screening the initial DNS data according to the DNS response type to obtain screened DNS data; According to the target IP information in the screened DNS data, a first quantity of DNS data corresponding to the target IP information and a second quantity of network access requests corresponding to the target IP information are calculated; According to the first quantity and the second quantity, the screened DNS data is screened to obtain the target DNS data.

5. The method of claim 1, wherein, According to the target DNS data, a target network relationship graph is constructed, including: According to the access domain name information of the target object, the domain name node is determined, and according to the IP information of the target object, the IP node is determined; According to the access relationship of the IP information to the access domain name information, the edge is determined; According to the domain name node, the IP node and the edge, the target network relationship graph is constructed.

6. A botnet domain name determination apparatus, characterized by comprising: Including: A construction unit is configured to construct a target network relationship graph according to target DNS data, wherein the target DNS data at least includes: access domain name information of a target object, IP information of the target object and access relationship of the IP information to the access domain name information, and the target network relationship graph at least includes: an IP node corresponding to the IP information and a domain name node corresponding to the access domain name information; A division unit is configured to perform community division on the target network relationship graph according to a community discovery algorithm to obtain a plurality of community structure information; A determination unit is configured to determine a target botnet domain name from the target DNS data according to the plurality of community structure information; The determination unit is further configured to calculate a first ratio according to a quantity of domain name nodes in each community structure information and a quantity of second-level domain names in each community structure information; A second ratio is calculated according to the quantity of domain name nodes and a quantity of multi-level domain names in each community structure information, wherein the multi-level domain names are different from the second-level domain names; At least one of the quantity of domain name nodes, a quantity of edges corresponding to IP nodes in each community structure information, the first ratio and the second ratio is used to screen the plurality of community structure information to obtain an initial botnet; A judgment result is obtained by judging whether registration domain names of a plurality of domain names corresponding to the initial botnet are the same; If the judgment result represents that registration domain names of a plurality of target domain names in the plurality of domain names corresponding to the initial botnet are different, similarity calculation is performed on the plurality of target domain names to obtain a target similarity; The target botnet domain name is determined from the plurality of target domain names according to the target similarity.

7. An electronic device, comprising: The device includes one or more processors and a memory configured to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method for determining a botnet domain name in any one of claims 1 to 5.

Images