Algorithm-generated domain name detection method based on traffic analysis

Abstract

The present invention first collects the traffic information of the algorithm-generated domain name (DGA domain name) with known classification labels and benign domain names, including the resolved IP address and Flow data of the domain name; performs preliminary processing on the collected traffic data, counts the number of occurrences of each resolved IP of the domain name, and filters out the source address, destination address, time and other information from the Flow data; calculates 8 characteristic values ​​of the domain name based on these traffic information, including the number of user IP visits, active frequency, standard deviation mean ratio of the number of occurrences of each resolved IP, etc.; puts the characteristic data into the C4.5 supervised classification model for training to obtain a classification model with classification ability; finally, collects the traffic information of the domain name to be classified, calculates the characteristic data, and puts it into the trained classification model for classification. The present invention utilizes the difference in traffic behavior between the algorithm-generated domain name when performing malicious activities and the benign domain name, effectively distinguishes the two types of domain names and resists adversarial attacks, thereby maintaining the security of the network.

Description

Technical Field

[0001] The present invention relates to a technology of traffic parsing, feature extraction and machine learning knowledge. It extracts key features with obvious differences from the traffic based on the performance differences between algorithm-generated domain names and benign domain names in network traffic behavior, and uses machine learning models to implement domain name classification. The technology belongs to the fields of traffic analysis, artificial intelligence and network security technology. Background Art

[0002] With the increasing popularity of the internet, network security issues are becoming increasingly prominent, and among them, those related to the domain name system (DNS) are becoming increasingly serious. The DNS is a critical infrastructure, closely linked to various online activities, such as email, website services, and instant messaging. By exploiting vulnerabilities in the early design of the internet, domain name resolution services have become a tool for various network security threats, such as attackers using DNS technology to locate command and control (C&C) servers.

[0003] Malicious clients use a domain generation algorithm (DGA) to randomly generate a large number of candidate domain names and perform queries. Attackers and malware run the same DGA algorithm to generate the same list of candidate domain names. When they need to launch an attack, they select a small number of these candidates for registration, establishing communication and carrying out the attack. Furthermore, attackers can apply IP-Flux technology to registered domain names, rapidly changing IP addresses and rendering traditional blacklist-based protection measures ineffective. Therefore, the use of algorithmically generated domain names (DGA domain names) makes attacks easy and defense difficult. To defend against DGA-based network attacks, timely detection of DGA domain names is crucial to prevent attackers from posing further security threats.

[0004] In recent years, many excellent solutions have been proposed for detecting DGA domain names, particularly those focused on the character features of the domain name itself. For example, these methods analyze the differences between DGA domain names and benign domain names in terms of linguistic and statistical characteristics, as well as pronunciation and spelling. Techniques such as machine learning and neural networks have been employed to rapidly detect DGA domain names. However, most of these methods share a common shortcoming: they overly focus on the character features of the domain name to detect the domain name, while ignoring the actual activity of the domain. If DGA classifiers rely solely on the domain name string to make decisions, they are highly vulnerable to adversarial attacks. Therefore, methods that focus solely on character features may be less accurate, and the malicious domains detected may not actually be involved in malicious activity.

[0005] In the present invention, based on the behavioral differences between DGA domain names and benign domain names in actual network traffic, we collect key information of domain names in DNS traffic and Flow traffic, calculate 8 features that can represent the differences between the two types of domain names, and put them into the C4.5 classification model for classification. The C4.5 classification model is a supervised machine learning classification model, so a certain amount of domain name data with known labels is required for training in the early stage. This solution is based on the traffic performance of DGA domain names in the actual network, which is carried out in the process of implementing network attacks, so it is difficult to carry out adversarial attacks against this solution. At the same time, the DGA domain names detected must be domain names that have carried out malicious activities, resulting in the appearance of corresponding traffic characteristics, which improves the accuracy of detection and effectively maintains the security of the network. Summary of the Invention

[0006] The algorithm-generated domain name detection method proposed in this invention, based on traffic analysis, is driven by detection accuracy and long-term effectiveness. It extracts relevant features from network traffic and incorporates them into the C4.5 classification model for detection and classification. This method primarily addresses the problem of effectively detecting algorithm-generated domain names under the domain name generation algorithm and IP-Flux mechanism. Domain name generation algorithms can randomly generate a large number of domain names based on various rules, such as the alphabet, dictionary, and phonetic syllables, while IP-Flux can cause the resolved IP addresses corresponding to domain names to continuously change. Therefore, traditional blacklist schemes and detection schemes based on domain name characters have significant shortcomings. Algorithm-generated domain name detection schemes based on traffic features can achieve high accuracy and effectiveness, bringing significant benefits to network security. During the model training phase, a batch of benign domain names with known classification labels and algorithm-generated domain names are collected. Domain names that have appeared in the detection network segment are screened, and their DNS traffic and flow traffic are collected. The resolved IP addresses of the domain names and interaction information with user IP addresses are extracted from them. The values ​​of eight features are calculated and incorporated into the C4.5 model for training, resulting in a classification model with classification capabilities. During the domain name detection phase, traffic with the detected domain name is collected from the detection network segment. The feature values ​​are calculated in the same way as the domain names in the training set and then put into the C4.5 classification model for detection. Domain names that are determined to be algorithm-generated domain names are screened out.

[0007] The present invention makes full use of the differences in traffic behavior between algorithm-generated domain names and benign domain names in the network, making it difficult for attackers to launch adversarial attacks against the scheme. At the same time, the domain names screened out are generally currently active domain names, which improves the accuracy and effectiveness of detection.

[0008] Technical Solution: To achieve the above objectives, the technical solution of the present invention is as follows. The process of the algorithm-generated domain name detection method of the present invention is as follows:

[0009] Step 1) Collect algorithm-generated domain names (DGA domain names) and benign domain names with known classification labels as the training set of the model;

[0010] Step 2) Collect traffic information of the training set domain name from the detection network segment, including information related to the domain name's resolved IP address (from DNS traffic) and flow information;

[0011] Step 3) Perform preliminary processing on the collected traffic information, including counting the number of occurrences of each resolved IP address of the domain name, and filtering out data such as the source IP address, destination IP address, specific resolution time, and resolution hour value from the flow information;

[0012] Step 4) Calculate and process the processed flow information to obtain 8 flow characteristic values;

[0013] Step 5) Put the feature values ​​and classification labels of all training set domain names into the C4.5 classification model for training to obtain a model with classification capabilities;

[0014] Step 6) extracting traffic information of the domain name to be classified and calculating its characteristic value;

[0015] Step 7) Put the feature values ​​of the domain name to be classified into the classification model for classification to obtain the classification result.

[0016] In step 1, algorithm-generated domain names (DGA domain names) with known classification labels and benign domain names are collected as the model training set. DGA domain names come from DGA domain name datasets provided by open-source websites such as 360netlab and bambenek. The bambenek database updates the recently detected DGA domain names daily, adding approximately 500,000 new entries each time. These entries also include the time the DGA domain name was first detected and the malware information it belongs to. Benign domain names are the most visited domain names in the detected network segment. Many large networks maintain a collection of the top 1 million domain names, indicating that these are domain names with the highest and most stable traffic in the network segment and can be considered benign domain names. The specific steps are as follows:

[0017] Step 1-1) Collect the DGA domain name dataset provided by open source websites. To ensure its timeliness, the domain name must have last appeared within 1 year;

[0018] Step 1-2) Obtain the top 1 million domains in the test segment. If there are none, count the visits to all domains in the test segment. To ensure that the training set covers all types of benign domains, use the top 1,000 domains, the middle 1,000 domains, and the bottom 1,000 domains as the source of the benign domain training set;

[0019] Step 1-3) performs a matching search in the detection network segment based on the DGA domain names and benign domain names obtained in steps 1-1) and 1-2), and uses the domain names appearing in the detection network segment as a training set.

[0020] Step 2) Collect the traffic information of the training set domain name from the detection network segment, including the domain name's resolved IP address and flow information, as follows:

[0021] Step 2-1) The DGA domain name training set and the benign domain name training set are placed in the DNS traffic of the detection network segment for matching and searching. The search period is two consecutive days (48 hours). The search method is to see if the domain name corresponds to the domain name resolved by the DNS request. If they are the same, it means that the domain name appears in the network segment, and the resolved IP address of the domain name is obtained from the resolution information;

[0022] In step 2-2, all resolved IP addresses in the DGA domain name training set and the benign domain name training set are placed in the flow traffic of the detection network segment for matching and searching. The search period is two consecutive days (48 hours). The search method is to see whether the IP address is the same as the source IP address or destination IP address in the flow traffic. If they are the same, it means that the IP address has interacted with the user's IP address and can be regarded as a valid interaction information.

[0023] Step 3) Perform preliminary processing on the collected traffic information, including counting the number of occurrences of each resolved IP address, filtering out data such as source IP address, destination IP address, specific resolution time, and resolution hour value from the flow information, as follows:

[0024] Step 3-1) Based on the training set domain name resolution information obtained in step 2-1), count all resolved IP addresses for each domain name and the number of occurrences of each resolved IP address in the two days before and after.

[0025] Step 3-2) Based on the training set domain name flow information obtained in step 2-2), the five fields of source IP address, destination IP address, first routing forwarding time, last routing forwarding time, and hour are filtered out from each piece of information.

[0026] Step 4) Calculate and process the processed flow information to obtain 8 flow characteristic values, as follows:

[0027] Step 4-1) Calculate the number of user IP address visits to the domain name based on the number of occurrences of each resolved IP address the following day. Generally speaking, due to the large scale of botnets and the large number of controlled bot hosts, the C&C servers using DGA domains receive a large amount of traffic, resulting in a large number of user IP address visits to the DGA domain. The specific calculation method is: client_IP_visit = ∑IP i _resolved, where client_IP_visit indicates the number of times the user IP address of the domain name has visited. i _resolved indicates the number of times the i-th resolved IP address of the domain name is resolved in the DNS traffic. The number of times all resolved IP addresses of the domain name are resolved in the DNS traffic is used to represent the number of user IP address visits. The larger the client_IP_visit value, the more times the user IP address has visited, and it is set as the feature value 1;

[0028] Step 4-2) Calculate the domain name's lifespan based on the source IP address, destination IP address, first routing forwarding time, and last routing forwarding time in the flow information from the previous and next two days. Due to the existence of various defense mechanisms in computer networks, various malicious domain names, including DGA domain names, will eventually be discovered and blocked. Therefore, the lifespan of DGA domain names is shorter than that of benign domain names. The specific calculation method is: life_span = last_seen_time - first_seen_time, where life_span represents the domain name's lifespan, last_seen_time represents the last time the domain name appeared in the detected network segment, and first_seen_time represents the first time the domain name appeared in the detected network segment. Both last_seen_time and first_seen_time are in seconds, and the difference between the two represents the domain name's lifespan. A larger life_span value indicates a longer lifespan.

[0029] Take it as eigenvalue 2;

[0030] Step 4-3) Calculate the domain name's active frequency based on the source IP address, destination IP address, first routing forwarding time, and last routing forwarding time in the flow information from the two days before and after. Because bots frequently access C&C servers using DGA domains in a short period of time, and DGA domains have a relatively short lifespan, their active frequency is higher than that of benign domains that are accessed intermittently by users over a long period of time. The specific calculation method is: Where live_freq represents the active frequency of a domain name, life_span represents the life cycle of a domain name, and client_IP_visit(h) represents the number of visits to the domain name by user IP addresses within the time period h. The active frequency is represented by the proportion of the time period when the domain name is visited by user IP addresses in the entire life cycle. The larger the live_freq value, the higher the active frequency, which is taken as the feature value 3.

[0031] Step 4-4) Calculate the domain name periodicity based on the source IP address, destination IP address, and hourly information in the flow information for the two days before and after. For zombie hosts, since commands are regularly issued by the C&C server, their behavior is highly synchronized. This is reflected in the domain name, which means that access to the DGA domain name has a very strong periodicity. The specific calculation method is: Among them, periodic represents the periodicity value of the domain name, client_IP_visit(h) represents the number of visits to the domain name by user IP addresses in the time period h, and the periodicity is represented by the ratio of the Euler distance of the time series curve of the number of visits to the domain name by user IP addresses in the two time periods before and after the domain name to the relative distance of the curve mean. The smaller the periodic value, the stronger the periodicity, which is taken as the eigenvalue 4;

[0032] Steps 4-5) Calculate the domain name's user access burstiness based on the source IP address, destination IP address, and hourly information in the next day's flow information. After the C&C server issues a command, a large number of zombie hosts controlled by it will simultaneously access the DGA domain name, causing the DGA domain to have a higher user access burstiness than benign domain names. The specific calculation method is: Where abrupt represents the user access burstiness of a domain name, client_IP_visit(T, life_span) represents the number of visits by user IP addresses in a fixed time period T during the domain name's life cycle, Avg represents the mean, and Max represents the maximum. The relative distance between the mean and maximum values ​​in the time series curve of user IP address visits represents the user access burstiness. The larger the abrupt value, the higher the user access burstiness. This is used as the feature value 5.

[0033] Steps 4-6) Calculate the standard deviation mean ratio of the number of occurrences of each resolved IP address for the domain name based on the number of occurrences of each resolved IP address the next day. DGA domains frequently change resolved IP addresses using IP-Flux technology. Since Flux is a random polling mechanism, the probability of each resolved IP address being polled is similar, which means that each resolved IP address appears the same number of times. Benign domain names generally do not change resolved IP addresses arbitrarily. For CDN domains with load balancing requirements, the polling mechanism of the CDN nodes is based on the principle of proximity. Therefore, the probability of polling server IP addresses close to the user base is greater. The number of occurrences of each resolved IP address will vary, resulting in a larger variance. The specific calculation method is: Among them, IP_var represents the standard deviation mean ratio of the number of occurrences of each resolved IP address of the domain name, var(IP_appear_times) represents the variance of the number of occurrences of each resolved IP address of the domain name, and avg(IP_appear_times) represents the average number of occurrences of each resolved IP address of the domain name. Their ratio is used to represent the standard deviation mean ratio of the number of occurrences of each resolved IP address. The larger the IP_var value, the larger the standard deviation mean ratio of the number of occurrences of the resolved IP address. It is used as the eigenvalue 6;

[0034] Step 4-7) Calculate the total number of domain names that are reverse mapped to the resolved IP based on the correspondence between the domain name and the resolved IP on the next day. Attackers usually use Domain-Flux technology to avoid the problem of single point failure of domain names. Therefore, the resolved IP address of the C&C server will be mapped to a set of DGA domain names. The mapping relationship between benign domain names and resolved IP addresses generally does not change, and the CDN node servers in the CDN domain name may run multiple services on the same server to improve utilization, but the resolved IP address set of the CDN node server usually belongs to the same or a few second-level domain names. The specific calculation method is: IP_domain_num = |{d(IP)|IP∈resolvedIPset(W)}|, where IP_domain_num represents the total number of domain names that are reverse mapped to all resolved IP addresses of the domain name, d(IP) represents the domain name that is reverse mapped to the IP address, and resolvedIPset(W) represents the set of all resolved IP addresses of the domain name in the current time window. The larger the IP_domain_num value, the more domain names that are reverse mapped to the resolved IP address. It is used as the feature value 7;

[0035] Steps 4-8) Calculate the difference between the resolved IP address sets based on the correspondence between the domain name and the resolved IP address for the two days before and after. Attackers often use IP-Flux technology to evade security defense mechanisms such as IP address blacklists. The resolved IP addresses of botnet domain names change frequently, resulting in a significant difference in the resolved IP address sets between the two time windows. While CDN node servers in benign domain names also have several resolved IP addresses, these secure IP addresses are stable and long-term and do not change frequently. Therefore, the difference in the resolved IP address sets of benign domain names is not significant. The specific calculation method is: Among them, IP_diff represents the difference of the resolved IP address set, resolvedIPset(W) represents the set of all resolved IP addresses of the domain name in the current time window, and resolvedIPset(W') represents the set of all resolved IP addresses of the domain name in the previous time window. The ratio of their intersection and union is used to calculate the difference of the resolved IP address set of the domain name. The larger the IP_diff value, the greater the difference of the resolved IP address set, and it is used as the feature value 8.

[0036] Step 5) Put the feature values ​​and classification labels of all training set domain names into the C4.5 classification model for training to obtain a model with classification capabilities. The C4.5 model is a relatively mature supervised machine learning classification model and can be used directly. The details are as follows:

[0037] Step 5-1) For each domain name in the training set, first retrieve its related resolved IP address and its occurrence count in the collected DNS traffic information database based on its domain name. Then use the resolved IP address to find the number of user IP addresses, interaction time and other information from the flow traffic. The 8 features calculated according to the calculation method described in step 5) are added with the classification label of the domain name (1 and 0 are used to represent DGA domain names and benign domain names respectively) to form a 9-dimensional vector. The specific content of this vector is: {Feature 1: Number of user IP address visits; Feature 2: Lifecycle; Feature 3: Active frequency; Feature 4: Periodicity; Feature 5: User access burstiness; Feature 6: Standard deviation mean ratio of the number of occurrences of each resolved IP address; Feature 7: Total number of domain names reverse-mapped by the resolved IP address; Feature 8: Difference between the resolved IP address sets; Classification label (0 or 1)},

[0038] In step 5-2, n (n is the number of domain names in the training set) 9-dimensional vectors are placed into the C4.5 classification model for model training, resulting in a classification model with classification capabilities. To make the classification results of this model more valuable, a method for calculating confidence is added based on the general model structure. Confidence can be measured by the proportion of labels in leaf nodes. For example, if a leaf node contains 80% positive and 20% negative, the confidence is 0.8. A class_counts attribute is added to the Node class to record the label distribution in each leaf node. Then, class_counts is calculated when creating a leaf node in the grow_tree method, and the predicted value and confidence are returned in the predict_with_confidence method.

[0039] Step 6) extracts the traffic information of the domain name to be classified in the detection network segment and calculates its characteristic value. The specific data processing and calculation process is consistent with steps 3) to 6).

[0040] Step 7) Put the feature value of the domain name to be classified into the classification model for classification to obtain the classification result, which includes the classification prediction value and confidence.

[0041] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the method for detecting domain names generated by an algorithm based on traffic analysis is implemented.

[0042] A computer-readable storage medium stores computer instructions, which, when executed by a processor, implement the algorithm-generated domain name detection method based on traffic analysis.

[0043] This solution collects algorithmically generated and benign domains with known classification labels, collects their DNS and Flow traffic, extracts key information, and calculates the values ​​of eight distinct features. These features are then trained on a C4.5 model. After model training, traffic data for the domains to be detected is collected and their feature values ​​are calculated using the same steps. These features are then classified in a C4.5 classification model to identify domains classified as algorithmically generated. The eight features are: number of user IP accesses, lifetime, frequency of activity, periodicity, burstiness of user accesses, standard deviation to mean ratio of the number of occurrences of each resolved IP address, total number of domain names mapped to the resolved IP address, and degree of dissimilarity of the resolved IP address set. These features distinguish algorithmically generated domains from benign domains due to malicious activity, effectively distinguishing between algorithmically generated and benign domains. This solution detects these differences in traffic behavior between algorithmically generated and benign domains, defending against anti-detection attacks, improving detection accuracy and effectiveness, and safeguarding network security.

[0044] Compared with the prior art, the advantages of the present invention are as follows:

[0045] 1) This paper fully utilizes the differences in traffic behavior between algorithmically generated domain names and benign domain names, and proposes eight features based on traffic analysis, including {Feature 1: Number of user IP address visits; Feature 2: Lifecycle; Feature 3: Active frequency; Feature 4: Periodicity; Feature 5: User access burstiness; Feature 6: Standard deviation to mean ratio of the number of occurrences of each resolved IP address; Feature 7: Total number of domain names reverse-mapped to the resolved IP address; Feature 8: Difference between the resolved IP address sets}. Based on these features, algorithmically generated domain names can be effectively distinguished from benign domain names.

[0046] 2) This invention designs a precise and concise calculation method for each feature, which can be expressed as a specific mathematical formula. While facilitating the calculation of the feature into a specific numerical value, the value can also correspond to the variation of the feature, reflecting the differences in various features between algorithm-generated domain names and benign domain names.

[0047] 3) This invention fully considers the privacy and security of network traffic information. When designing the algorithm, it avoids using sensitive information as much as possible. During the collection and processing process, it only obtains the data required for the subsequent feature calculation process, avoiding the collection of data such as the user's specific IP address and geographic location. The domain name and resolved IP address and other information required are encapsulated in the algorithm, and only the feature value and classification result information are displayed in the final result.

[0048] 4) When selecting a machine learning classification model, the present invention took into account that each feature has both continuous and discrete values, and that some features may have default values. Therefore, the C4.5 classification model was selected to address these issues. At the same time, a confidence calculation method was independently added to the basic model, so that the classification results contain more effective information.

[0049] 5) The present invention is based on the fact that the algorithm-generated domain name generates traffic performance that is different from that of benign domain names when carrying out attack behaviors. This is a must-have feature of the algorithm-generated domain name after malicious activities. Unlike its domain name, the characteristics based on traffic activity are difficult to mask against detection methods. Therefore, this method can ensure the long-term effectiveness of the classification model and resist anti-detection attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 This is a flow chart of a domain name detection method generated by an algorithm based on traffic analysis. DETAILED DESCRIPTION

[0051] In order to deepen the knowledge and understanding of the present invention, the solution is described in detail below with reference to the accompanying drawings and embodiments.

[0052] Example 1: See Figure 1 ,based on Figure 1 The method process is described in detail, including the model training stage and the domain name classification stage to be detected.

[0053] A method for detecting domain names generated by an algorithm based on traffic analysis, the method comprising the following steps:

[0054] Step 1) Collect algorithm-generated domain names (DGA domain names) and benign domain names with known classification labels as the training set of the model.

[0055] Step 1-1) Collect a dataset of DGA domain names from open-source websites. The domain name's most recent appearance must be within one year of the current detection time. Open-source websites such as 360netlab and bambenek can be selected. The bambenek database updates the recently detected DGA domain names daily, adding approximately 500,000 new entries each time. It also includes information such as the time the DGA domain was first detected and the malware it belongs to.

[0056] Step 1-2) Obtain the top 1 million domains in the test segment. If there are none, count the visits to all domains in the test segment. To ensure that the training set covers all types of benign domains, use the top 1,000 domains, the middle 1,000 domains, and the bottom 1,000 domains as the source of the benign domain training set;

[0057] In step 1-3), based on the DGA domain names and benign domain names obtained in steps 1-1) and 1-2), a matching search is performed in the DNS traffic of the detection network segment, and the domain names appearing in the detection network segment are used as a training set.

[0058] Step 2) Collect traffic information of the training set domain name from the detection network segment, including the domain name's resolved IP address and flow information;

[0059] Step 2-1) The DGA domain name training set and the benign domain name training set are placed in the DNS traffic of the detection network segment for matching and searching. The search period is two consecutive days (48 hours). The search method is to see if the domain name corresponds to the domain name resolved by the DNS request. If they are the same, it means that the domain name appears in the network segment, and the resolved IP address of the domain name is obtained from the resolution information;

[0060] In step 2-2, all resolved IP addresses in the DGA domain name training set and the benign domain name training set are placed in the flow traffic of the detection network segment for matching and searching. The search period is two consecutive days (48 hours). The search method is to see whether the IP address is the same as the source IP address or destination IP address in the flow traffic. If they are the same, it means that the IP address has interacted with the user's IP address and can be regarded as a valid interaction information.

[0061] Step 3) Perform preliminary processing on the collected traffic information, including counting the number of occurrences of each resolved IP address of the domain name, filtering out data such as source IP address, destination IP address, specific resolution time, and resolution hour value from the flow information,

[0062] Step 3-1) Based on the training set domain name resolution information obtained in step 2-1), count all resolved IP addresses for each domain name and the number of occurrences of each resolved IP address in the two days before and after.

[0063] Step 3-2) Based on the training set domain name flow information obtained in step 2-2), the five fields of source IP address, destination IP address, first routing forwarding time, last routing forwarding time, and hour are filtered out from each piece of information.

[0064] Step 4) Calculate and process the processed flow information to obtain 8 flow characteristic values.

[0065] Step 4-1) Calculate the number of user IP address visits to the domain name based on the number of occurrences of each resolved IP address on the next day. The calculation formula is client_IP_visit = ∑IP i_resolved. In step 3-1), the number of occurrences of each resolved IP address for each domain name has been counted. The sum of the number of occurrences of all resolved IP addresses for each domain name is the number of user IP address visits to the domain name, which is used as feature 1.

[0066] Step 4-2) Calculate the domain name's lifespan based on the source IP address, destination IP address, first forwarding time, and last forwarding time in the flow information from the two days before and after. The formula is life_span = last_seen_time - first_seen_time. Use all resolved IP addresses of the domain name to filter out all first forwarding times and last forwarding times from the flow information obtained in step 3-2). Calculate the difference between the latest and earliest times to obtain the domain name's lifespan, which is used as feature 2.

[0067] Step 4-3) Calculate the active frequency of the domain name based on the source IP address, destination IP address, first routing forwarding time, and last routing forwarding time in the flow information of the two days before and after. The calculation formula is: After calculating the domain name's lifecycle in step 4-2), use all resolved IP addresses to filter out the first and last routing forwarding times from the flow information. Calculate the sum of all time intervals less than 5 minutes as the domain name's active time. Calculate the ratio of the active time to the lifecycle to determine the domain name's active frequency, which is used as Feature 3.

[0068] Step 4-4) Calculate the periodicity of the domain name based on the source IP address, destination IP address, and hour information in the flow information of the two days before and after. The calculation formula is: Use all resolved IP addresses of the domain name to filter out the hourly user IP address visits from the flow information within the life cycle. Calculate the relative distance between the hourly user IP address visits and the curve mean between the two days before and after (the interval T can be adjusted according to the observation time) as the periodicity of the domain name and use it as feature 4.

[0069] Step 4-5) Calculate the user access burstiness of the domain name based on the source IP address, destination IP address, and hour information in the flow information of the next day. The calculation formula is: Use all resolved IP addresses of a domain name to filter out the hourly user IP address access count from the flow information within the domain's lifetime. Calculate the average access count for each hour and select the maximum value. To ensure that the variation in the abrupt value is consistent with the intensity of user access burstiness, use the difference between 1 and the ratio of the mean to the maximum value to represent the abrupt value. This represents the user access burstiness of the domain name and is used as feature 5.

[0070] Step 4-6) Calculate the standard deviation mean ratio of the number of occurrences of each resolved IP address of the domain name based on the number of occurrences of each resolved IP address on the next day. The calculation formula is Based on the number of occurrences of each resolved IP address for each domain name counted in step 3-1), calculate its variance and mean. To ensure that the calculated values ​​of domain names of different magnitudes do not differ too much, use the ratio of the variance to the mean to represent the difference in the number of occurrences of each resolved IP address for the domain name, and use this ratio as feature 6;

[0071] Step 4-7) Calculate the total number of domain names mapped to the resolved IP addresses based on the correspondence between the domain name and the resolved IP address for the next day. The calculation formula is IP_domain_num = |{d(IP)|IP∈resolvedIPset(W)}|. After counting all the resolved IP addresses for all domain names, create a dictionary with IP address as key and domain name as value. From this dictionary, calculate the total number of domain names mapped to all resolved IP addresses for that domain name and use this dictionary as feature 7.

[0072] Step 4-8) Calculate the difference between the resolved IP address set based on the correspondence between the domain name and the resolved IP address two days before and after. The calculation formula is: Establish all the resolved IP address sets of the domain name for the time window of two days before and after, and calculate their intersection and union, and then calculate the ratio of the number of elements in the intersection and union. In order to make the change pattern of the size of the IP_diff value consistent with the change in the size of the difference of the resolved IP address set, use the difference between 1 and the ratio of the number of elements in the intersection and union to represent the difference of the resolved IP address set of the domain name, and use it as feature 8.

[0073] Step 5) Put the feature values ​​and classification labels of all training set domain names into the C4.5 classification model for training to obtain a model with classification capabilities.

[0074] Step 5-1) For each training set domain name, combine the eight features calculated in step 5) and the domain name classification label (using 1 and 0 to represent DGA domains and benign domains, respectively) to obtain a 9-dimensional vector. The specific content of this vector is: {Feature 1: Number of user IP address visits; Feature 2: Lifecycle; Feature 3: Active frequency; Feature 4: Periodicity; Feature 5: User access burstiness; Feature 6: Standard deviation mean ratio of the number of occurrences of each resolved IP address; Feature 7: Total number of domain names reverse-mapped to the resolved IP address; Feature 8: Dissimilarity of the resolved IP address set; Classification label (0 or 1)};

[0075] Step 5-2) Place n (n is the number of domain names in the training set) 9-dimensional vectors into the C4.5 classification model for model training to obtain a classification model with classification capabilities. To make the classification results of this model more valuable, a method for calculating confidence is added based on the general model structure. Confidence can be measured by the proportion of labels in leaf nodes. For example, if a leaf node contains 80% positive classes and 20% negative classes, the confidence is 0.8. Add a class_counts attribute to the Node class to record the label distribution in each leaf node. Then, calculate class_counts when creating a leaf node in the build_tree_grow_tree method, and return the predicted value and confidence in the predict_with_confidence method.

[0076] Step 6) Extract the traffic information of the domain name to be classified in the detection network segment and calculate its characteristic value.

[0077] Step 7) Put the feature values ​​of the domain name to be classified into the trained classification model for classification to obtain the classification result, which includes the category prediction value and confidence level.

[0078] Finally, it should be noted that the above embodiments are intended only to illustrate preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will appreciate that modifications or equivalent substitutions may be made to the technical solutions described in the foregoing embodiments. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the present invention.

Claims

1. A domain name detection method based on traffic analysis algorithm, characterized in that: The method comprises the following steps: Step 1) Collect algorithm-generated domain names and benign domain names with known classification labels as the training set for the model; Step 2) Collect traffic information of the training set domain name from the detection network segment, including the domain name's resolved IP address related information and flow information; Step 3) Perform preliminary processing on the collected traffic information, including counting the number of occurrences of each resolved IP address of the domain name, and filtering out the source IP address, destination IP address, specific resolution time, and resolution hourly value data from the flow information; Step 4) Calculate and process the processed flow information to obtain 8 flow characteristic values; Step 5) Put the feature values ​​and classification labels of all training set domain names into the C4.5 classification model for training to obtain a model with classification capabilities; Step 6) extracting traffic information of the domain name to be classified and calculating its characteristic value; Step 7) Put the feature values ​​of the domain name to be classified into the classification model for classification to obtain the classification result; Wherein, step 4) is specifically as follows: Step 4-1) The specific calculation method is: client_IP_visit = ∑IP i _resolved, where client_IP_visit indicates the number of times the user IP address of the domain name has visited. i _resolved indicates the number of times the i-th resolved IP address of the domain name is resolved in the DNS traffic. The number of times all resolved IP addresses of the domain name are resolved in the DNS traffic is used to represent the number of user IP address visits. The larger the client_IP_visit value, the more times the user IP address has visited, and it is set as the feature value 1; Step 4-2) The specific calculation method is: life_span = last_seen_time - first_seen_time, where life_span represents the life cycle of the domain name, last_seen_time represents the last time the domain name appears in the detection segment, and first_seen_time represents the first time the domain name appears in the detection segment. Both last_seen_time and first_seen_time are in seconds, and the difference between the two represents the life cycle of the domain name. The larger the life_span value, the longer the life cycle, which is used as the feature value 2; Step 4-3), the specific calculation method is: Where live_freq represents the active frequency of a domain name, life_span represents the life cycle of a domain name, and client_IP_visit(h) represents the number of visits to the domain name by user IP addresses within the time period h. The active frequency is represented by the proportion of the time period when the domain name is visited by user IP addresses in the entire life cycle. The larger the live_freq value, the higher the active frequency, which is taken as the feature value 3. The specific calculation method of step 4-4) is: Among them, periodic represents the periodicity value of the domain name, client_IP_visit(h) represents the number of visits to the domain name by user IP addresses in the time period h, and the periodicity is represented by the ratio of the Euler distance of the time series curve of the number of visits to the domain name by user IP addresses in the two time periods before and after the domain name to the relative distance of the curve mean. The smaller the periodic value, the stronger the periodicity, which is taken as the eigenvalue 4; Steps 4-5) are calculated as follows: Where abrupt represents the user access burstiness of a domain name, client_IP_visit(T, life_span) represents the number of visits by user IP addresses in a fixed time period T during the domain name's life cycle, Avg represents the mean, and Max represents the maximum. The relative distance between the mean and maximum values ​​in the time series curve of user IP address visits represents the user access burstiness. The larger the abrupt value, the higher the user access burstiness. This is used as the feature value 5. The specific calculation method for steps 4-6) is: Among them, IP_var represents the standard deviation mean ratio of the number of occurrences of each resolved IP address of the domain name, var(IP_appear_times) represents the variance of the number of occurrences of each resolved IP address of the domain name, and avg(IP_appear_times) represents the average number of occurrences of each resolved IP address of the domain name. Their ratio is used to represent the standard deviation mean ratio of the number of occurrences of each resolved IP address. The larger the IP_var value, the larger the standard deviation mean ratio of the number of occurrences of the resolved IP address. It is used as the eigenvalue 6; Step 4-7) The specific calculation method is: IP_domain_num = |{d(IP)|IP∈resolvedIPset(W)}|, where IP_domain_num represents the total number of domain names that are reverse-mapped to the resolved IP addresses of a domain name, d(IP) represents the domain name that is reverse-mapped to the IP address, and resolvedIPset(W) represents the set of all resolved IP addresses for the domain name in the current time window. A larger value of IP_domain_num indicates a greater number of domain names that are reverse-mapped to the resolved IP address. This is used as the feature value 7. The specific calculation method for steps 4-8) is: Among them, IP_diff represents the difference of the resolved IP address set, resolvedIPset(W) represents the set of all resolved IP addresses of the domain name in the current time window, and resolvedIPset(W') represents the set of all resolved IP addresses of the domain name in the previous time window. The ratio of their intersection and union is used to calculate the difference of the resolved IP address set of the domain name. The larger the IP_diff value, the greater the difference of the resolved IP address set, which is used as the feature value 8; Step 6) extracts the traffic information of the domain name to be classified in the detection network segment and calculates its characteristic value. The specific data processing and calculation process is consistent with steps 3) to 6).

2. The method for detecting domain names generated by an algorithm based on traffic analysis according to claim 1, characterized in that: Step 1) Collect algorithm-generated domain names (DGA domain names) and benign domain names with known classification labels as the training set for the model. The DGA domain names come from the DGA domain name dataset provided by open source websites. The specific steps are as follows: Step 1-1) Collect the DGA domain name dataset provided by open source websites. To ensure its timeliness, the domain name must have last appeared within 1 year; Step 1-2) Obtain the top 1 million domains in the test segment. If there are none, count the visits to all domains in the test segment. To ensure that the training set covers all types of benign domains, use the top 1,000 domains, the middle 1,000 domains, and the bottom 1,000 domains as the source of the benign domain training set; Step 1-3) performs a matching search in the detection network segment based on the DGA domain names and benign domain names obtained in steps 1-1) and 1-2), and uses the domain names appearing in the detection network segment as a training set.

3. The method for detecting domain names generated by an algorithm based on traffic analysis according to claim 1, characterized in that: Step 2) Collect the traffic information of the training set domain name from the detection network segment, including the domain name's resolved IP address and flow information, as follows: Step 2-1) The DGA domain name training set and the benign domain name training set are placed in the DNS traffic of the detection network segment for matching and searching. The search period is two consecutive days (48 hours). The search method is to see if the domain name corresponds to the domain name resolved by the DNS request. If they are the same, it means that the domain name appears in the network segment, and the resolved IP address of the domain name is obtained from the resolution information; In step 2-2, all resolved IP addresses in the DGA domain name training set and the benign domain name training set are placed in the flow traffic of the detection network segment for matching and searching. The search period is two consecutive days (48 hours). The search method is to see whether the IP address is the same as the source IP address or destination IP address in the flow traffic. If they are the same, it means that the IP address has interacted with the user's IP address and is considered a valid interaction information.

4. The method for detecting domain names generated by an algorithm based on traffic analysis according to claim 1, wherein: Step 3) Perform preliminary processing on the collected traffic information, including counting the number of occurrences of each resolved IP address, filtering out the source IP address, destination IP address, specific resolution time, and resolution hourly value data from the flow information, as follows: Step 3-1) Based on the training set domain name resolution information obtained in step 2-1), count all resolved IP addresses for each domain name and the number of occurrences of each resolved IP address in the two days before and after. Step 3-2) Based on the training set domain name flow information obtained in step 2-2), the five fields of source IP address, destination IP address, first routing forwarding time, last routing forwarding time, and hour are filtered out from each piece of information.

5. The method for detecting domain names generated by an algorithm based on traffic analysis according to claim 1, characterized in that: Step 5) Put the feature values ​​and classification labels of all training set domain names into the C4.5 classification model for training to obtain a model with classification capabilities. The C4.5 model is a relatively mature supervised machine learning classification model and can be used directly. The details are as follows: Step 5-1) For each domain name in the training set, first retrieve its related resolved IP address and its occurrence count in the collected DNS traffic information database based on its domain name. Then use the resolved IP address to find the number of user IP addresses and interaction time information from the flow traffic. The eight features calculated according to the calculation method described in step 4) are added with the classification label of the domain name to obtain a 9-dimensional vector. The specific content of this vector is: {Feature 1 Number of user IP address visits; Feature 2 Lifecycle; Feature 3 Active frequency; Feature 4 Periodicity; Feature 5 User access burstiness; Feature 6 Standard deviation mean ratio of the number of occurrences of each resolved IP; Feature 7 Total number of domain names reverse-mapped by the resolved IP; Feature 8 Difference between the resolved IP address sets; Classification label (0 or 1)}, Step 5-2) Place n (n is the number of domain names in the training set) 9-dimensional vectors into the C4.5 classification model for model training to obtain a classification model with classification capabilities. Assume that a leaf node contains 80% positive classes and 20% negative classes, and the confidence level is 0.

8. Add a class_counts attribute to the Node class to record the label distribution in each leaf node. Then, calculate class_counts when creating a leaf node in the build_tree_grow_tree method, and return the predicted value and confidence level in the predict_with_confidence method.

6. The method for detecting domain names generated by an algorithm based on traffic analysis according to claim 1, characterized in that: Step 7) Put the feature value of the domain name to be classified into the classification model for classification to obtain the classification result, which includes the classification prediction value and confidence.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for detecting domain names generated by an algorithm based on traffic analysis is implemented as described in any one of claims 1 to 6.

8. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed by a processor, the domain name detection method for generating an algorithm based on traffic analysis according to any one of claims 1 to 6 is implemented.

Images