DNS tunnel detection method and device, electronic equipment and storage medium

Abstract

The invention discloses a DNS tunnel detection method and device, electronic equipment and a storage medium, and relates to the technical field of network security. The method comprises the following steps: acquiring key information in a DNS data packet; wherein the key information comprises a domain name request set and a request timestamp corresponding to each domain name in the domain name request set; dividing the domain name request set into K domain name request subsets according to a domain name grouping rule; according to the request timestamp corresponding to each domain name in the K domain name request subsets, determining respective time interval sequences of the K domain name request subsets, and constructing a time sequence vector set based on the respective time interval sequences; and according to the time sequence vector set, determining respective self-correlation coefficients of the K domain name request subsets, and according to the respective self-correlation coefficients and the N DNS tunnel detection results, improving the accuracy of the DNS tunnel detection results.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a DNS tunnel detection method, device, electronic device and storage medium. Background Art

[0002] DNS Tunneling is a method of using the Domain Name System (DNS) protocol to transmit data on the network. It encapsulates the content of other protocols in the DNS protocol and then completes the data transmission with DNS query request and response packets.

[0003] Although DNS tunneling has certain concealment and flexibility, it can also be used as a communication bridge between the compromised host and the attacker, posing a serious threat to network security. For example, attackers can encapsulate malicious data in seemingly normal DNS query requests and responses to bypass firewalls and invade detection systems. This technology makes it difficult to detect and block malicious data in the network, greatly increasing the complexity and challenges of network security.

[0004] At present, most of the DNS tunnel detection is based on monitoring the rules of abnormally long domain names requested by the terminal, but attackers can use commercial penetration kits (such as Metasploit or Cobalt Strike, etc.) or some open source software (for example, iodine, ozymandns, dns2tcp, dnscat2, etc.) to quickly and easily build DNS covert tunnels, and can also easily bypass the traditional rule-based detection model of DNS tunnels by modifying features such as domain name length or request frequency. Due to the existing DNS tunnel detection, there are many constraints and limited detection capabilities, resulting in the final detection results have a high number of false positives and are easily bypassed.

[0005] Therefore, how to improve the accuracy of DNS tunnel detection results is a problem that needs to be solved urgently. Summary of the invention

[0006] The present application provides a DNS tunnel detection method, device, electronic device and storage medium to improve the accuracy of DNS tunnel detection results.

[0007] In a first aspect, a DNS tunnel detection method is provided, comprising:

[0008] Obtain key information in a DNS data packet; wherein the key information includes a domain name request set and a request timestamp corresponding to each domain name in the domain name request set;

[0009] Dividing the domain name request set into K domain name request subsets according to the domain name grouping rule; wherein K is an integer greater than 1;

[0010] Determine the respective time interval sequences of the K domain name request subsets according to the request timestamps corresponding to each domain name in the K domain name request subsets, and construct a timing vector set based on the respective time interval sequences;

[0011] Determine the autocorrelation coefficients of each of the K domain name request subsets according to the timing vector set, and determine N DNS tunnel detection results according to the respective autocorrelation coefficients; wherein N is an integer less than or equal to K, and any autocorrelation coefficient represents the correlation between the domain names in any domain name request subset.

[0012] In an embodiment of the present application, key information in a DNS data packet is first obtained, where the key information includes a domain name request set and a request timestamp corresponding to each domain name in the domain name request set; the domain name request set is divided into K domain name request subsets according to the domain name grouping rule, so as to facilitate subsequent unified analysis and detection of domain names of the same type or with similar characteristics; then, according to the request timestamp corresponding to each domain name in the K domain name request subsets, the respective time interval sequences of the K domain name request subsets are determined, and a timing vector set is constructed based on the respective time interval sequences; the respective autocorrelation coefficients of the K domain name request subsets are determined according to the timing vector set, and N DNS tunnel detection results are determined according to the respective autocorrelation coefficients. Compared with the prior art, there is no need to be limited by reliance on known features and tools, but by analyzing the respective time interval sequences and autocorrelation coefficients of each domain name request subset, potential threat sources (suspicious domain names) are accurately identified, thereby detecting potential DNS tunnel attacks, and significantly enhancing the active defense capability of network security.

[0013] In some embodiments, the step of constructing a timing vector set based on the request timestamp corresponding to each domain name in the K domain name request subsets and based on the respective time interval sequences includes:

[0014] According to the request timestamp of each of the K domain name request subsets, respectively calculate the time intervals between adjacent domain names in the K domain name request subsets to form respective time interval sequences of the K domain name request subsets;

[0015] Counting the number of requests for each of the K domain name request subsets;

[0016] The timing vector set is constructed according to the respective time interval sequences and request times.

[0017] In some embodiments, the set of timing vectors satisfies the following expression:

[0018]

[0019] Among them, the x kt Indicates the time interval corresponding to the request timestamp of the kth domain name in any domain name request subset, wherein k=1, ..., K represents K domain name request subsets, and t=1, ..., T represents the number of requests corresponding to each domain name request subset.

[0020] Through the above method, the time interval sequence of each domain name request subset is extracted and constructed into a time series vector set as the basis for subsequent analysis. There is no need to rely on known features and tools. Just by analyzing the characteristics of the data itself, periodic patterns that may indicate malicious domain names can be discovered, which can cope with ever-changing network threats.

[0021] In some embodiments, the autocorrelation coefficient satisfies the following expression:

[0022]

[0023] Among them, the x kt Represents the time interval corresponding to the request timestamp of the kth domain name in any domain name request subset, Characterizes the average time interval of any domain name request subset, the x k(t-r) Characterizes the time interval between the request timestamp and the historical request timestamp of the k-th domain name.

[0024] Through the above method, the characteristics of the data itself can be analyzed to provide a basis for subsequent DNS tunnel detection.

[0025] In some embodiments, determining N DNS tunnel detection results according to the respective autocorrelation coefficients includes:

[0026] The similarities between any first domain name request subset of the K domain name request subsets and other domain name request subsets are calculated according to the respective autocorrelation coefficients, and N DNS tunnel detection results are determined according to the similarities.

[0027] In some embodiments, the calculating, based on the respective autocorrelation coefficients, similarities between any first domain name request subset of the K domain name request subsets and other domain name request subsets, and determining N DNS tunnel detection results based on the similarities, includes:

[0028] Calculating a Euclidean distance between the first domain name request subset and the second domain name request subset according to an autocorrelation coefficient of the first domain name request subset and an autocorrelation coefficient of any second domain name request subset in the other domain name request subsets;

[0029] If the Euclidean distance is less than the distance threshold, merging the first domain name request subset and the second domain name request subset to obtain a new domain name request subset;

[0030] Remove rows and columns corresponding to the first domain name request subset and the second domain name request subset from the initial distance matrix, and add the Euclidean distances between the new domain name request subset and other domain name request subsets to the initial distance matrix to obtain a new distance matrix;

[0031] If the Euclidean distance between the N domain name request subsets in the new distance matrix is ​​greater than or equal to the distance threshold, the N DNS tunnel detection results are output.

[0032] Through the above method, there is no need to train the model through pre-labeled training data. It is only necessary to analyze the relationship between the data itself to detect suspicious domain names, improve detection efficiency and reduce detection costs, and ensure that it can also be applied to newly emerging DNS tunnel attack methods in a dynamically changing network environment, breaking through the limitations of DNS tunnel detection in existing technologies.

[0033] In some embodiments, after obtaining the key information in the DNS data packet, the method further includes:

[0034] Filter out domain names that are not in a preset whitelist from the domain name request set to form a target domain name request set to be detected;

[0035] The step of dividing the domain name request set into K domain name request subsets according to the domain name grouping rule includes:

[0036] The target domain name request set is divided into K domain name request subsets according to the domain name grouping rule.

[0037] Through the above method, for a domain name in the preset whitelist, it is indicated that the domain name is a safe and reliable domain name, and no subsequent analysis is required, thereby reducing the calculation amount of subsequent analysis and improving processing efficiency.

[0038] In a second aspect, a DNS tunnel detection device is provided, comprising:

[0039] An acquisition module, used to acquire key information in a DNS data packet; wherein the key information includes a domain name request set and a request timestamp corresponding to each domain name in the domain name request set;

[0040] A partitioning module, used to partition the domain name request set into K domain name request subsets according to a domain name grouping rule; wherein K is an integer greater than 1;

[0041] A determination module, configured to determine the respective time interval sequences of the K domain name request subsets according to the request timestamps corresponding to each domain name in the K domain name request subsets, and construct a timing vector set based on the respective time interval sequences;

[0042] A detection module is used to determine the autocorrelation coefficient of each of the K domain name request subsets according to the timing vector set, and determine N DNS tunnel detection results according to the respective autocorrelation coefficients; wherein N is an integer less than or equal to K, and any autocorrelation coefficient represents the correlation between the domain names in any domain name request subset.

[0043] According to a third aspect, an electronic device is provided, including:

[0044] A memory for storing a computer program; a processor for implementing any one of the methods described in the first aspect when executing the computer program stored in the memory.

[0045] According to a fourth aspect, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method according to any one of the first aspects is implemented.

[0046] For each aspect from the second to the fourth aspect and the technical effects that may be achieved by each aspect, please refer to the above description of the technical effects that can be achieved by the first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 A schematic diagram of an application scenario applicable to the embodiments of the present application;

[0048] Figure 2 A flowchart of a DNS tunnel detection method provided in an embodiment of the present application;

[0049] Figure 3 A flowchart of analyzing domain names based on a clustering algorithm provided in an embodiment of the present application;

[0050] Figure 4 A schematic diagram of the structure of a DNS tunnel detection device provided in an embodiment of the present application;

[0051] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0053] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0054] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0055] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are first explained below.

[0056] (1) Euclidean distance is a method for measuring the distance between two points in multidimensional space. It is usually used in cluster analysis and pattern recognition. In time series analysis, Euclidean distance can be used to measure the similarity between two time series.

[0057] (2) Time series analysis is a statistical method used to analyze data points arranged in time order. It can help identify patterns, trends, and periodicities in the data. In the field of network security, it can be used to detect abnormal behavior in network traffic.

[0058] The following is a brief introduction to the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In specific implementation, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0059] Figure 1 Schematic diagram of application scenarios applicable to the embodiments of this application. Figure 1 As shown, the application scenario mainly includes: terminals (1, 2, 3, ..., N) and a server 101. The terminals (1, 2, 3, ..., N) and the server 101 can exchange information through a communication network, and the communication mode adopted by the communication network may include: wireless communication mode and wired communication mode.

[0060] In some scenarios, the terminal (1, 2, 3, ..., N) can access the network and communicate with the server 101 through cellular mobile communication technology, and the cellular mobile communication technology may include the fifth generation mobile communication (5th Generation Mobile Networks, 5G) technology.

[0061] In some scenarios, the terminal (1, 2, 3, ..., N) can access the network and communicate with the server 101 through short-range wireless communication. The short-range wireless communication may include Wireless Fidelity (Wi-Fi) technology.

[0062] The present application embodiment does not impose any restriction on the number of the above-mentioned devices. Figure 1 As shown, only (1, 2, 3, ..., N) and server 101 are described as examples, and the above devices and their respective functions are briefly introduced below.

[0063] The terminal (1, 2, 3, ..., N) is a device that can provide voice and / or data connectivity to the user, including: a handheld terminal device with a wireless connection function, a vehicle-mounted terminal device, etc. The terminal 10 includes but is not limited to: a mobile phone, a tablet computer, a laptop computer, a PDA, a mobile Internet device (Mobile Internet Device, MID), a wearable device, a virtual reality (Virtual Reality, VR) device, an augmented reality (Augmented Reality, AR) device, a wireless terminal device in industrial control, a wireless terminal device in unmanned driving, a wireless terminal device in a smart grid, a wireless terminal device in transportation safety, a wireless terminal device in a smart city, or a wireless terminal device in a smart home, etc.

[0064] In addition, a client for DNS tunnel detection may be installed on the terminal (1, 2, 3, ..., N), and the client may be software (e.g., APP, browser, etc.), or a web page, applet, etc. In the embodiment of the present application, the terminal (1, 2, 3, ..., N) may use the above-mentioned client related to DNS tunnel detection, and may interact with the server 101 for DNS tunnel detection, etc.

[0065] Furthermore, server 101 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDN), as well as big data and artificial intelligence platforms.

[0066] Furthermore, in an embodiment of the present application, the above-mentioned server 101 may be equipped with an NDS tunnel detection device corresponding to the above-mentioned client, which is used to capture the DNS data packet of the terminal (1, 2, 3, ..., N), and analyze the DNS data packet to determine the suspicious domain name and response address of the suspected DNS tunnel attack, and perform subsequent blocking or forensics operations.

[0067] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps as shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiment of the present application. The method may be executed or executed in parallel in the actual processing process or when the device is executed in accordance with the method sequence shown in the embodiment or drawings.

[0068] Figure 2 The present invention provides a flow chart of a DNS tunnel detection method. The process can be executed by a DNS tunnel detection device, which can be implemented by software and / or hardware to improve the accuracy of DNS tunnel detection results. Figure 2 As shown, the process includes the following steps:

[0069] 201: Get key information in the DNS data packet.

[0070] Among them, the key information may include a domain name request set, a request timestamp corresponding to each domain name in the domain name request set, and a response address corresponding to each domain name (such as a response IP address).

[0071] In some embodiments, it may be a node before a gateway or router to ensure that all terminals (such as Figure 1 The DNS data packets of the terminals (1, 2, 3, ..., N) shown in the figure can be captured by a time synchronization mechanism to ensure the integrity and accuracy of the DNS data packets; further, the captured DNS data packets can be stored in a log file for subsequent real-time use.

[0072] For example, first, after capturing the DNS data packet of the terminal (1, 2, 3, ..., N), the DNS data packet is parsed to extract the corresponding key information (such as the domain name request set (D), the request timestamp corresponding to each domain name (T q ) and the response address (IP r )), and then the key information can be recorded in the log file (such as LogEntry: (D, T q ,IP r )).

[0073] In other embodiments, after obtaining the key information in the DNS data packet, the domain names that are not in the preset whitelist can be filtered out from the domain name request set to form a target domain name request set to be detected. For the domain names in the preset whitelist, it indicates that the domain names are safe and reliable domain names, and no subsequent analysis is required, thereby reducing the computational complexity of subsequent analysis and improving processing efficiency.

[0074] It should be noted that the preset whitelist can be constructed by a network administrator or security expert based on known secure domain names (Alexa's top 1 million domain names or other reliable domain name sources), or it can be constructed through open source intelligence and threat intelligence subscription. The embodiments of this application are not limited here.

[0075] 202: Divide the domain name request set into K domain name request subsets according to the domain name grouping rule.

[0076] In some embodiments, the domain name request set may be divided into K (K is an integer greater than 1) domain name request subsets (e.g., domain name level, first-level domain name, second-level domain name, etc.) according to the domain name level. ), the domain name request set can also be divided into K domain name request subsets according to the domain name structure, the domain name request set can also be divided into K domain name request subsets according to the domain name type, etc., which can be flexibly set according to the actual scenario.

[0077] In some embodiments, when domain names that are not in a preset whitelist are screened out from a domain name request set to form a target domain name request set to be detected, the target domain name request set can be divided into K domain name request subsets according to the domain name grouping rule.

[0078] 203: Determine the respective time interval sequences of the K domain name request subsets according to the request timestamp corresponding to each domain name in the K domain name request subsets, and construct a time series vector set based on the respective time interval sequences.

[0079] In some embodiments, constructing a timing vector set may specifically be: calculating the time intervals between adjacent domain names in the K domain name request subsets according to the request timestamps of each of the K domain name request subsets, respectively, to form a time interval sequence for each of the K domain name request subsets; counting the number of requests for each of the K domain name request subsets; and constructing a timing vector set according to the respective time interval sequences and request times.

[0080] For example, suppose that we group all second-level domain names into the same domain name request subset (for example, domain names "c1.ba", "c2.ba" and "ba" are the same group of domain names, forming a domain name group ), then request a subset based on the domain name The request timestamps between adjacent domain names in the , and their time intervals (e.g., Δt i =t i+1 -t i ; where t i is the request timestamp of the i-th domain name in the same domain name request subset), thus forming the Similarly, for other domain name request subsets, their respective time interval sequences can also be determined in the above manner, which will not be repeated here.

[0081] In some embodiments, the set of timing vectors satisfies the following expression:

[0082]

[0083] Among them, x ktRepresents the time interval corresponding to the request timestamp of the kth domain name in any domain name request subset, k=1,…,K represents K domain name request subsets, and t=1,…,T represents the number of requests corresponding to each domain name request subset.

[0084] Through the above method, the time interval sequence of each domain name request subset is extracted and constructed into a time series vector set as the basis for subsequent analysis. There is no need to rely on known features and tools. Just by analyzing the characteristics of the data itself, periodic patterns that may indicate malicious domain names can be discovered, which can cope with ever-changing network threats.

[0085] 204: Determine the autocorrelation coefficients of the K domain name request subsets according to the time series vector set, and determine N DNS tunnel detection results according to the respective autocorrelation coefficients.

[0086] In this step, N is an integer less than or equal to K, and any autocorrelation coefficient represents the correlation between domain names in any domain name request subset.

[0087] In some embodiments, the autocorrelation coefficient satisfies the following expression:

[0088]

[0089] Among them, x kt Represents the time interval corresponding to the request timestamp of the kth domain name in any domain name request subset, Characterizes the average time interval of any domain name request subset, x k(t-r) Represents the time interval between the request timestamp of the kth domain name and the historical request timestamp. For example, the value of r is 1 to T-1, which represents the time interval between the current request timestamp and any historical request timestamp. When r=1, it represents the time interval between the current request timestamp (t) and the historical request timestamp (t-1) of the same domain name. When r=2, it represents the time interval between the current request timestamp (t) and the historical request timestamp (t-2) of the same domain name. And so on, until r=T-1, the time interval between the current request timestamp (t) and the historical request timestamp (t-(T-1)) of the same domain name is calculated.

[0090] Based on the above expression of autocorrelation coefficient, the autocorrelation coefficients of all domain names included in each domain name request subset can be calculated (for example, ).

[0091] In some embodiments, determining N DNS tunnel detection results based on their respective autocorrelation coefficients may be: calculating the similarity between any first domain name request subset of the K domain name request subsets and other domain name request subsets based on their respective autocorrelation coefficients, and determining N DNS tunnel detection results based on the similarity.

[0092] Further, according to the respective autocorrelation coefficients, N DNS tunnel detection results are determined, which may be: according to the respective autocorrelation coefficients, the similarity between any first domain name request subset in the K domain name request subsets and the other domain name request subsets is calculated, and the N DNS tunnel detection results are determined according to the similarity, as follows: Figure 3 FIG. 1 is a flowchart of analyzing domain names based on a clustering algorithm provided in an embodiment of the present application. The process may include the following steps:

[0093] 301: Calculate the Euclidean distance between the first domain name request subset and the second domain name request subset according to the autocorrelation coefficient of the first domain name request subset and the autocorrelation coefficient of any second domain name request subset in other domain name request subsets.

[0094] For example, assuming that the first domain name request subset is the above In The second domain name request subset is in, The autocorrelation coefficient and The autocorrelation coefficients are Then the Euclidean distance satisfies the following expression: The d kk′ The smaller the value is, the more similar the first domain name request subset is to the second domain name request subset, and they may be generated by the same DNS tunnel tool.

[0095] 302: If the Euclidean distance is less than the distance threshold, the first domain name request subset and the second domain name request subset are merged to obtain a new domain name request subset.

[0096] For example, and Merge into a new domain name request subset

[0097] 303: Remove the rows and columns corresponding to the first domain name request subset and the second domain name request subset from the initial distance matrix, and add the Euclidean distances between the new domain name request subset and the other domain name request subsets to the initial distance matrix to obtain a new distance matrix.

[0098] For example, from the initial distance matrix (representing the above The initial distance matrix is ​​D) and remove The corresponding rows and columns are added in D The Euclidean distances with other domain name request subsets are respectively obtained to obtain a new distance matrix (D'), so that the K domain name request subsets can be clustered into multiple suspicious domain name request clusters, which is convenient for the subsequent output of DNS tunnel detection results based on accuracy and reference.

[0099] 304: If the Euclidean distance between the N domain name request subsets in the new distance matrix is ​​greater than or equal to the distance threshold, output N DNS tunnel detection results.

[0100] In this step, when the Euclidean distance between the N domain name request subsets in the new distance matrix is ​​greater than or equal to the distance threshold, it indicates that the domain name request subsets contained in the new distance matrix have been clustered to form N domain name request subsets (also called N suspicious domain name clusters), each of which represents a group of highly similar suspicious domain names.

[0101] Through the above method, there is no need to train the model through pre-labeled training data. It is only necessary to analyze the relationship between the data itself to detect suspicious domain names, improve detection efficiency and reduce detection costs, and ensure that it can also be applied to newly emerging DNS tunnel attack methods in a dynamically changing network environment, breaking through the limitations of DNS tunnel detection in existing technologies.

[0102] In some embodiments, the output of N DNS tunnel detection results may be based on the above log file (LogEntry: (D, T q ,IP r )) Output the suspicious domain names and response addresses corresponding to each of the N domain name request subsets, so as to facilitate the subsequent timely interception and protection measures.

[0103] It should be noted that the specific value of the above distance threshold can be flexibly set according to the actual scenario, and the embodiment of the present application does not limit it here.

[0104] In an embodiment of the present application, key information in a DNS data packet is first obtained, where the key information includes a domain name request set and a request timestamp corresponding to each domain name in the domain name request set; the domain name request set is divided into K domain name request subsets according to the domain name grouping rule, so as to facilitate subsequent unified analysis and detection of domain names of the same type or with similar characteristics; then, according to the request timestamp corresponding to each domain name in the K domain name request subsets, the respective time interval sequences of the K domain name request subsets are determined, and a timing vector set is constructed based on the respective time interval sequences; the respective autocorrelation coefficients of the K domain name request subsets are determined according to the timing vector set, and N DNS tunnel detection results are determined according to the respective autocorrelation coefficients. Compared with the prior art, there is no need to be limited by reliance on known features and tools, but by analyzing the respective time interval sequences and autocorrelation coefficients of each domain name request subset, potential threat sources (suspicious domain names) are accurately identified, thereby detecting potential DNS tunnel attacks, and significantly enhancing the active defense capability of network security.

[0105] Based on the same technical concept, a DNS tunnel detection device is also provided in an embodiment of the present application, and the device can implement the above-mentioned DNS tunnel detection method process in the embodiment of the present application.

[0106] Figure 4 A schematic diagram of the structure of a DNS tunnel detection device provided in an embodiment of the present application. Figure 4 As shown, the device includes an acquisition module 401, a division module 402, a determination module 403, and a detection module 404.

[0107] The acquisition module 401 is used to acquire key information in the DNS data packet; wherein the key information includes a domain name request set and a request timestamp corresponding to each domain name in the domain name request set.

[0108] The division module 402 is used to divide the domain name request set into K domain name request subsets according to the domain name grouping rule; wherein K is an integer greater than 1.

[0109] The determination module 403 is used to determine the respective time interval sequences of the K domain name request subsets according to the request timestamp corresponding to each domain name in the K domain name request subsets, and construct a timing vector set based on the respective time interval sequences.

[0110] The detection module 404 is used to determine the autocorrelation coefficient of each of the K domain name request subsets according to the timing vector set, and determine N DNS tunnel detection results according to the respective autocorrelation coefficients; wherein N is an integer less than or equal to K, and any autocorrelation coefficient represents the correlation between the domain names in any domain name request subset.

[0111] In some embodiments, the determination module 403 is specifically used to: calculate the time intervals between adjacent domain names in the K domain name request subsets according to the request timestamp of each of the K domain name request subsets, to form a time interval sequence for each of the K domain name request subsets; count the number of requests for each of the K domain name request subsets; and construct the timing vector set according to the respective time interval sequences and request times.

[0112] In some embodiments, the detection module 404 is specifically configured to:

[0113] The similarities between any first domain name request subset of the K domain name request subsets and other domain name request subsets are calculated according to the respective autocorrelation coefficients, and N DNS tunnel detection results are determined according to the similarities.

[0114] In some other embodiments, the detection module 404 is specifically used to:

[0115] Calculating a Euclidean distance between the first domain name request subset and the second domain name request subset according to an autocorrelation coefficient of the first domain name request subset and an autocorrelation coefficient of any second domain name request subset in the other domain name request subsets;

[0116] If the Euclidean distance is less than the distance threshold, merging the first domain name request subset and the second domain name request subset to obtain a new domain name request subset;

[0117] Remove rows and columns corresponding to the first domain name request subset and the second domain name request subset from the initial distance matrix, and add the Euclidean distances between the new domain name request subset and other domain name request subsets to the initial distance matrix to obtain a new distance matrix;

[0118] If the Euclidean distance between the N domain name request subsets in the new distance matrix is ​​greater than or equal to the distance threshold, the N DNS tunnel detection results are output.

[0119] In some embodiments, the acquisition module 401 is also used to: filter out domain names that are not in a preset whitelist from the domain name request set to form a target domain name request set to be detected; the division module 402 is specifically used to: divide the target domain name request set into K domain name request subsets according to the domain name grouping rules.

[0120] It should be noted here that the above-mentioned device provided in the embodiment of the present application can implement all the method steps in the above-mentioned method embodiment and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0121] Based on the same technical concept, an electronic device is also provided in an embodiment of the present application, and the electronic device can realize the functions of the aforementioned data processing device.

[0122] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0123] At least one processor 501, and a memory 502 connected to the at least one processor 501. The specific connection medium between the processor 501 and the memory 502 is not limited in the embodiment of the present application. Figure 5 In the example, the processor 501 and the memory 502 are connected via a bus 500. The bus 500 is Figure 5 The connections between other components are shown in bold lines, and are not intended to be limiting. The bus 500 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Figure 5 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 501 can also be called a controller, and there is no limitation on the name.

[0124] In the embodiment of the present application, the memory 502 stores instructions that can be executed by at least one processor 501. The at least one processor 501 can execute a data processing method discussed above by executing the instructions stored in the memory 502. The processor 501 can implement Figure 4 The functions of each module in the device shown.

[0125] Among them, the processor 501 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 502 and calling data stored in the memory 502, the various functions of the device and processing data, the device can be monitored as a whole.

[0126] In the embodiment of the present application, the processor 501 may include one or more processing units, and the processor 501 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 501. In some embodiments, the processor 501 and the memory 502 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0127] The processor 501 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of a DNS tunnel detection method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0128] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 502 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 502 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 502 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0129] By programming the processor 501, the code corresponding to the data processing method described in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 2 The embodiment shown is a DNS tunnel detection method. How to design and program the processor 501 is a technology well known to those skilled in the art and will not be described in detail here.

[0130] It should be noted here that the above-mentioned electronic device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment, and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as the method embodiment will not be described in detail here.

[0131] Based on the same technical concept, an embodiment of the present application provides a computer storage medium, the computer storage medium includes: computer program code, when the computer program code is executed on a computer, the computer executes any one of the DNS tunnel detection methods discussed above. Since the principle of solving the problem by the above computer storage medium is similar to that of a DNS tunnel detection method, the implementation of the above computer storage medium can refer to the implementation of the method, and the repeated parts will not be repeated.

[0132] In the specific implementation process, the computer storage medium may include: Universal Serial Bus Flash Drive (USB), mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and other storage media that can store program codes.

[0133] Based on the same technical concept, the embodiment of the present application also provides a computer program product, which includes: computer program code, when the computer program code is run on a computer, the computer executes any one of the DNS tunnel detection methods discussed above. Since the principle of solving the problem by the above computer program product is similar to that of a DNS tunnel detection method, the implementation of the above computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0134] The computer program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more conductors, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0135] The method in the present application can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed on a computer, the process or function described in the present application is executed in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user device, a core network device, an OAM or other programmable device.

[0136] The computer program or instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program or instructions may be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired or wireless means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium, such as a floppy disk, a hard disk, or a magnetic tape; it may also be an optical medium, such as a digital video disk; it may also be a semiconductor medium, such as a solid-state drive. The computer-readable storage medium may be a volatile or non-volatile storage medium, or may include both volatile and non-volatile types of storage media.

[0137] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) that contain computer-usable program code.

[0138] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the instructions in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0139] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0140] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A DNS tunnel detection method, characterized in that: include: Obtain key information in a DNS data packet; wherein the key information includes a domain name request set and a request timestamp corresponding to each domain name in the domain name request set; Dividing the domain name request set into K domain name request subsets according to the domain name grouping rule; wherein K is an integer greater than 1; Determine the respective time interval sequences of the K domain name request subsets according to the request timestamps corresponding to each domain name in the K domain name request subsets, and construct a timing vector set based on the respective time interval sequences; Determine the autocorrelation coefficients of each of the K domain name request subsets according to the timing vector set, and determine N DNS tunnel detection results according to the respective autocorrelation coefficients; wherein N is an integer less than or equal to K, and any autocorrelation coefficient represents the correlation between the domain names in any domain name request subset.

2. The method according to claim 1, characterized in that The step of constructing a timing vector set based on the request timestamp corresponding to each domain name in the K domain name request subsets and based on the respective time interval sequences includes: According to the request timestamp of each of the K domain name request subsets, respectively calculate the time intervals between adjacent domain names in the K domain name request subsets to form respective time interval sequences of the K domain name request subsets; Counting the number of requests for each of the K domain name request subsets; The timing vector set is constructed according to the respective time interval sequences and request times.

3. The method according to claim 2, characterized in that The timing vector set satisfies the following expression: Among them, the x kt Indicates the time interval corresponding to the request timestamp of the kth domain name in any domain name request subset, wherein k=1, ..., K represents K domain name request subsets, and t=1, ..., T represents the number of requests corresponding to each domain name request subset.

4. The method according to claim 1, characterized in that The autocorrelation coefficient satisfies the following expression: Among them, the x kt Represents the time interval corresponding to the request timestamp of the kth domain name in any domain name request subset, Characterizes the average time interval of any domain name request subset, the x k(t-r) Characterizes the time interval between the request timestamp and the historical request timestamp of the k-th domain name.

5. The method according to claim 1, characterized in that The determining N DNS tunnel detection results according to the respective autocorrelation coefficients includes: The similarities between any first domain name request subset of the K domain name request subsets and other domain name request subsets are calculated according to the respective autocorrelation coefficients, and N DNS tunnel detection results are determined according to the similarities.

6. The method according to claim 5, characterized in that The step of calculating similarities between any first domain name request subset of the K domain name request subsets and other domain name request subsets according to the respective autocorrelation coefficients, and determining N DNS tunnel detection results according to the similarities includes: Calculating a Euclidean distance between the first domain name request subset and the second domain name request subset according to an autocorrelation coefficient of the first domain name request subset and an autocorrelation coefficient of any second domain name request subset in the other domain name request subsets; If the Euclidean distance is less than the distance threshold, merging the first domain name request subset and the second domain name request subset to obtain a new domain name request subset; Remove rows and columns corresponding to the first domain name request subset and the second domain name request subset from the initial distance matrix, and add the Euclidean distances between the new domain name request subset and other domain name request subsets to the initial distance matrix to obtain a new distance matrix; If the Euclidean distance between the N domain name request subsets in the new distance matrix is ​​greater than or equal to the distance threshold, the N DNS tunnel detection results are output.

7. The method according to any one of claims 1 to 6, characterized in that: After obtaining the key information in the DNS data packet, the method further includes: Filter out domain names that are not in a preset whitelist from the domain name request set to form a target domain name request set to be detected; The step of dividing the domain name request set into K domain name request subsets according to the domain name grouping rule includes: The target domain name request set is divided into K domain name request subsets according to the domain name grouping rule.

8. A DNS tunnel detection device, characterized in that: include: An acquisition module, used to acquire key information in a DNS data packet; wherein the key information includes a domain name request set and a request timestamp corresponding to each domain name in the domain name request set; A partitioning module, used to partition the domain name request set into K domain name request subsets according to a domain name grouping rule; wherein K is an integer greater than 1; A determination module, configured to determine the respective time interval sequences of the K domain name request subsets according to the request timestamps corresponding to each domain name in the K domain name request subsets, and construct a timing vector set based on the respective time interval sequences; A detection module is used to determine the autocorrelation coefficient of each of the K domain name request subsets according to the timing vector set, and determine N DNS tunnel detection results according to the respective autocorrelation coefficients; wherein N is an integer less than or equal to K, and any autocorrelation coefficient represents the correlation between the domain names in any domain name request subset.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method according to any one of claims 1 to 7 when executing a computer program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images