IPv6 network DNS malicious traffic analysis method, apparatus and device, and storage medium

Abstract

The invention provides an IPv6 (Internet Protocol Version 6) network DNS (Domain Name Server) malicious traffic analysis method. The method comprises the following steps: collecting target IPv6 traffic data; extracting target feature data in the target IPv6 traffic data, wherein the target feature data comprises data representing that malicious behaviors exist in the target IPv6 traffic data; filtering invalid data in the target feature data to obtain detection feature data; and inputting the detection feature data into a preset detection model, and predicting a malicious domain name with a malicious behavior in domain names from which the target IPv6 flow data is sourced based on the detection model. The invention further provides an IPv6 network DNS malicious traffic analysis device and equipment, a medium and a computer program product.

Description

Technical Field

[0001] The present disclosure relates to the field of Internet technology, and more specifically, to an IPv6 network DNS malicious traffic analysis method, device, equipment, storage medium and computer program product. Background Art

[0002] With the large-scale deployment and application of IPv6, the supervision of IPv6 network traffic has become increasingly strict. In particular, the analysis and management of DNS malicious traffic has become an important task in maintaining network security. Fast-flux technology evades tracking by frequently changing IP addresses, which poses a challenge to network security. Therefore, the development of effective DNS malicious traffic analysis technology is crucial to maintaining the security of the network environment. Summary of the invention

[0003] In view of this, the present disclosure provides a method for analyzing malicious DNS traffic in an IPv6 network.

[0004] One aspect of the present disclosure provides an IPv6 network DNS malicious traffic analysis method, comprising: collecting target IPv6 traffic data; extracting target feature data from the target IPv6 traffic data, the target feature data including data characterizing the presence of malicious behavior in the target IPv6 traffic data; filtering invalid data in the target feature data to obtain detection feature data; inputting the detection feature data into a preset detection model, and predicting the presence of malicious domain names with malicious behavior in the domain names from which the target IPv6 traffic data originates based on the detection model.

[0005] According to an embodiment of the present disclosure, the target IPv6 traffic data collection includes: screening the target active domain name and the target passive domain name in the target network; filtering the known malicious domain names in the target active domain name and the target passive domain name based on a preset blacklist; and collecting the target IPv6 traffic data based on the filtered target active domain name and the target passive domain name.

[0006] According to an embodiment of the present disclosure, the target feature data includes the DNS record update frequency of the DNS to which the target feature data belongs, the number of associated IP addresses, the IP address survival time, the IP address geographical distribution diversity, the completeness of the domain name registration information, the domain name registration duration and active period, the DNS query traffic abnormality, and the associated malicious activity detection rate.

[0007] According to an embodiment of the present disclosure, filtering the invalid data in the target feature data to obtain the detection feature data includes: identifying feature indicator data in the target feature data; comparing the feature indicator data with a preset feature threshold, and filtering the invalid data in the target feature data based on the comparison result to obtain the detection feature data; wherein the feature threshold is used to measure whether the feature indicator data indicates that the target feature data is non-malicious domain name data, and when the target feature data is non-malicious domain name data, the target feature data is invalid data.

[0008] According to an embodiment of the present disclosure, the detection feature data is input into a preset detection model, and based on the detection model, a malicious domain name with malicious behavior in the domain name from which the target IPv6 traffic data originates is predicted, including: preprocessing the detection feature data and inputting the detection model, wherein the detection model is constructed based on a fusion of a random forest algorithm and a convolutional neural network; predicting the detection feature data using the random forest algorithm and the convolutional neural network respectively to obtain respective prediction results of the random forest algorithm and the convolutional neural network; weighted fusion of respective prediction results of the random forest algorithm and the convolutional neural network to obtain a predicted malicious domain name with malicious behavior in the target IPv6 traffic data.

[0009] According to an embodiment of the present disclosure, the method includes: before applying the detection model, training the detection model, including: obtaining training data, dividing the training data into a training set, a validation set and a test set, the training data being feature data after feature extraction; training a random forest algorithm sub-model and a convolutional neural network sub-model of the detection model based on the training set, and adjusting the parameters of the random forest algorithm sub-model and the convolutional neural network sub-model; validating and testing the trained detection model based on the validation set and the test set; repeating the above steps until the prediction result of the detection model reaches a preset target.

[0010] Another aspect of the present disclosure provides an IPv6 network DNS malicious traffic analysis device, including: a data collection module, used to collect target IPv6 traffic data; a feature extraction module, used to extract target feature data in the target IPv6 traffic data, the target feature data including data characterizing the presence of malicious behavior in the target IPv6 traffic data; a feature filtering module, used to filter invalid data in the target feature data to obtain detection feature data; a model prediction module, used to input the detection feature data into a preset detection model, and predict the presence of malicious domain names with malicious behavior in the domain names from which the target IPv6 traffic data originates based on the detection model.

[0011] Another aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of the aspects.

[0012] Another aspect of the present disclosure provides a computer-readable storage medium, characterized in that executable instructions are stored thereon, and when the instructions are executed by a processor, the processor executes the method according to any one of the aspects.

[0013] Another aspect of the present disclosure provides a computer program product, including a computer program or instructions, characterized in that when the computer program or instructions are executed by a processor, the steps of any one of the methods in one aspect are implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0015] Figure 1 The method for analyzing malicious DNS traffic in an IPv6 network according to an embodiment of the present disclosure is schematically shown;

[0016] Figure 2 A schematic diagram of a method for analyzing malicious traffic of a DNS in an IPv6 network according to an embodiment of the present disclosure is shown;

[0017] Figure 3 A block diagram schematically shows an apparatus for analyzing malicious DNS traffic in an IPv6 network according to an embodiment of the present disclosure; and

[0018] Figure 4 A block diagram of an electronic device 400 suitable for implementing a robot according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0019] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0020] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0021] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0022] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0023] In the embodiments of the present disclosure, the collection, updating, analysis, processing, use, transmission, provision, disclosure, storage, etc. of the data involved (for example, including but not limited to user personal information) are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. In particular, necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security, and national security.

[0024] In the embodiments of the present disclosure, the user's authorization or consent is obtained before obtaining or collecting the user's personal information.

[0025] Figure 1 The present invention schematically illustrates a method for analyzing malicious DNS traffic in an IPv6 network according to an embodiment of the present disclosure.

[0026] like Figure 1 As shown, the present disclosure provides an IPv6 network DNS malicious traffic analysis method, including S110~S140.

[0027] S110, collecting target IPv6 traffic data.

[0028] In the disclosed embodiment, CERNET2 traffic data, i.e., target IPv6 traffic data, can be collected through Netflow technology and port mirroring technology. The collected target IPv6 traffic data includes information such as access time, source IP, source port, target IP, target port, third layer protocol type, inbound and outbound traffic. Although the focus of the data set is on malicious traffic, the actual captured data must also include normal network traffic related to the daily operation of the infected computer, such as web browsing, email sending and receiving, etc.

[0029] S120, extracting target feature data from the target IPv6 traffic data, where the target feature data includes data characterizing the presence of malicious behavior in the target IPv6 traffic data.

[0030] In the disclosed embodiment, in order to distinguish the Fast-flux network from the legitimate network, 8 target features are selected according to their characteristics. Usually, the TTL of the Fast-flux network is very small, but the legitimate domain name has similar requirements in adapting to network congestion through technologies such as CDN or circular DNS, and the TTL value is not used as a selected feature.

[0031] DNS record update frequency includes the update frequency of Fast-flux domain names and legal domain names. The quantitative indicator of Fast-flux domain names is the number of DNS record updates per unit time (such as one day or one week), which is usually much higher than that of legal domain names. The quantitative indicator of legal domain names is the number of DNS record updates within the same time window, which usually rarely changes or even does not update.

[0032] The number of associated IP addresses includes the number of Fast-flux domains and legal domains. The quantitative indicator of Fast-flux domains is the total number of IP addresses associated with the domain name, which usually reaches hundreds or even thousands. The quantitative indicator of legal domains is the total number of IP addresses associated with the domain name, which usually ranges from 1 to 10, and large websites or services may have dozens.

[0033] The IP address survival time includes the survival time of Fast-flux domain names and legal domain names. The quantitative indicator of Fast-flux domain names is the average survival time of IP addresses in DNS records (e.g., in minutes), which is usually less than 1 hour. The quantitative indicator of legal domain names is the average survival time of IP addresses in DNS records, which is usually from several hours to several days, or even longer.

[0034] IP address geographic distribution diversity includes the distribution diversity of Fast-flux domain names and legal domain names. The quantitative indicator of Fast-flux domain names is the number of countries / regions covered by the associated IP addresses, which are usually widely distributed around the world. The quantitative indicator of legal domain names is the number of countries / regions covered by the associated IP addresses, which are usually concentrated in specific geographical locations or cloud service areas.

[0035] The completeness of domain name registration information includes the completeness of registration information of Fast-flux domain names and legal domain names. The quantitative indicator of Fast-flux domain names is the completeness score of domain name registration information (such as owner, email, phone, etc.), which is usually low and may be forged, inconsistent or missing. The quantitative indicator of legal domain names is the completeness score of domain name registration information, which is usually high and the information is accurate, complete and consistent.

[0036] Domain name registration duration and active cycle include the registration duration and active cycle of Fast-flux domain names and legal domain names. The quantitative indicators of Fast-flux domain names are the duration (in days) since the domain name was registered and the active cycle (such as the time interval from registration to abandonment), which are usually shorter. The quantitative indicators of legal domain names are the duration and active cycle since the domain name was registered, which are usually longer and consistent with business needs.

[0037] DNS query traffic anomalies include the traffic anomalies of Fast-flux domain names and legitimate domain names. The quantitative indicators of Fast-flux domain names are the degree of deviation of DNS query traffic from the normal level (such as standard deviation, Z-score, etc.), which are usually significantly higher than those of legitimate domain names. The quantitative indicators of legitimate domain names are the normal level of DNS query traffic, which is consistent with website visits and business needs, and the query pattern is stable.

[0038] The detection rate of associated malicious activities includes the detection rate of malicious activities of Fast-flux domains and legitimate domains. The quantitative indicator of Fast-flux domains is the detection rate of malicious activities associated with domains (such as DDoS attacks, spam, malware propagation, etc.), which is usually significantly higher than that of legitimate domains. The quantitative indicator of legitimate domains is the detection rate of malicious activities associated with domains, which is usually very low or zero.

[0039] S130, filtering invalid data in the target feature data to obtain detection feature data.

[0040] In the disclosed embodiment, the means of filtering data is, on the one hand, collecting designated data, on the other hand, filtering data by means of black and white lists, and further, filtering data by means of feature filtering.

[0041] In S110 , collecting target IPv6 traffic data includes S111 to S113 .

[0042] In operation S111, target active domain names and target passive domain names in a target network are screened.

[0043] In operation S112, known malicious domain names in the target active domain name and the target passive domain name are filtered based on a preset blacklist.

[0044] In operation S113, target IPv6 traffic data is collected based on the filtered target active domain name and target passive domain name.

[0045] The more comprehensive the data is, the more credible it is. The original data is obtained by aggregating and filtering the DNS, DOT port number, and passive DNS data.

[0046] The filtering data based on blacklist and whitelist include: using blacklist and whitelist based filtering to reduce the relatively large DNS traffic. If the data of the current data packet matches the record in the blacklist and whitelist, it will not be detected. The whitelist selects the top 100,000 domain names of Alexa and the commonly used legal domain names in the local area, and the blacklist is the known Fast-flux malicious domain names.

[0047] The target feature data includes the DNS record update frequency of the DNS to which the target feature data belongs, the number of associated IP addresses, the survival time of IP addresses, the geographical distribution diversity of IP addresses, the completeness of domain name registration information, the domain name registration duration and active period, the abnormality of DNS query traffic, and the detection rate of associated malicious activities.

[0048] The method of filtering data based on target features includes S131~S132.

[0049] In operation S131 , feature index data in target feature data is identified.

[0050] In operation S132, the feature index data is compared with a preset feature threshold, and invalid data in the target feature data is filtered out based on the comparison result to obtain detection feature data.

[0051] Among them, the feature threshold is used to measure whether the feature indicator data indicates that the target feature data is non-malicious domain name data. When the target feature data is non-malicious domain name data, the target feature data is invalid data.

[0052] For example, according to the "Study on Fast-flux Domain Name Availability Model", when TTL is greater than 1800s, the probability of availability of the Fast-flux network is close to zero. Therefore, queries with TTL greater than 1800s will be filtered.

[0053] S140, inputting the detection feature data into a preset detection model, and predicting based on the detection model whether there is a malicious domain name with malicious behavior in the domain name from which the target IPv6 traffic data originates.

[0054] In the disclosed embodiment, a detection model is constructed using a machine learning algorithm and training data, and then feature vectors are extracted from the filtered traffic. The selected feature content is used to detect the extracted feature vector data set using the trained detection model to verify whether the detected domain name is a Fast-flux malicious domain name data.

[0055] Before inputting the detection feature data into the preset detection model, the detection feature data is preprocessed. The appropriate preprocessing method is determined based on the nature of the features and the requirements of the model, with the goal of enabling the model to effectively understand and learn the inherent structure and patterns of the data.

[0056] Features suitable for mean normalization (standardization) include: traffic features, such as the traffic anomaly of DNS queries. These are usually continuous values, and standardization can ensure that traffic data of different sizes have the same importance in the model, making it easier for the model to learn traffic behavior patterns; survival time, the survival time of an IP address is also a continuous numerical feature, and standardization can help the model understand the relative importance of different survival time lengths, especially when identifying abnormal activities; update frequency, if the update frequency is continuous, standardization can help the model better capture the relative changes between different frequencies, especially when the frequency span is large.

[0057] Features that are not suitable for mean normalization and use other methods include: IP address geographic distribution diversity, which is a category or classification information that indicates the geographical distribution of IP addresses. It is more suitable to use one-hot encoding (One-Hot Encoding) or label encoding (Label Encoding) to convert geographic information into a numerical form that the model can understand; domain name registration information completeness, this feature may be a discrete score or grade, not a simple continuous value. Ordinal encoding can be considered if there is a natural order relationship, or it can be treated as a categorical feature for one-hot encoding; categorical features, such as the type of domain name (commercial, education, government, etc.), these non-numerical features should use one-hot encoding or label encoding instead of standardization.

[0058] The preprocessed detection feature data is input into the detection model, which is constructed based on the fusion of the random forest algorithm and the convolutional neural network. The detection feature data is predicted using the random forest algorithm and the convolutional neural network respectively to obtain the prediction results of the random forest algorithm and the convolutional neural network respectively; the prediction results of the random forest algorithm and the convolutional neural network are weighted and fused to obtain the malicious domain names with malicious behaviors in the predicted target IPv6 traffic data.

[0059] Before applying the detection model, the detection model is trained, including S151~S154.

[0060] In operation S151, training data is acquired, and the training data is divided into a training set, a validation set, and a test set, wherein the training data is feature data after feature extraction.

[0061] In operation S152, the random forest algorithm sub-model and the convolutional neural network sub-model of the detection model are trained based on the training set, and the parameters of the random forest algorithm sub-model and the convolutional neural network sub-model are adjusted.

[0062] In operation S153, the trained detection model is verified and tested based on the verification set and the test set.

[0063] In operation S154, the above steps are repeated until the prediction result of the detection model reaches a preset target.

[0064] Among them, the random forest algorithm uses training data to generate many decision trees to form a forest, and then selects several trees from the forest for prediction each time, and selects the one with the most results as the prediction result. Because the random forest algorithm introduces randomness, it is not easy to overfit, has a high classification accuracy, and can be effectively used on large data sets.

[0065] The most commonly used decision tree algorithms for the random forest algorithm are C4.5 and CART algorithms, which perform feature selection based on the Information Gain Ratio (IGR) and Gini Impurity (Gini Impurity) respectively. Since both are important indicators for feature selection, the linear combination of the two is selected as the indicator for node splitting.

[0066] The Gini impurity and information gain ratio are linearly combined as the basis for feature selection. The weights are assigned through cross-validation. Different weight combinations are tried to observe which weight combination performs best on the test set, and the weights are determined accordingly. In order to reduce the risk of overfitting and simplify the complexity of the model, continuous features need to be converted into discrete attributes for easy processing or optimization of machine learning algorithms. The K-means clustering algorithm is used to determine the split point threshold.

[0067] The decision tree is generated based on the C4.5 or CART algorithm, taking into account the information gain ratio and Gini impurity. Multiple decision trees are constructed by randomly selecting features and sample subsets. The results of multiple trees are merged through a voting mechanism to improve the prediction accuracy.

[0068] Convolutional Neural Networks (CNN): Although CNN is commonly used for image recognition, one-dimensional CNN can also be used to efficiently extract features in time series analysis, especially when analyzing patterns and frequency characteristics in traffic data. By applying CNN to the time series of traffic data, the high-frequency change characteristics unique to fast-flux can be detected.

[0069] The input layer of the convolutional neural network (CNN) is set according to the sequence length, such as (1000, 1); the convolution layer uses 1D convolution to capture patterns in the time series and sets the number and size of filters; the activation function ReLU and other enhanced model nonlinearities; the pooling layer reduces the dimension and retains important features; the fully connected layer integrates global features; the output layer uses softmax for classification tasks and linear output for regression tasks; the compiled model configures the loss function and optimizer.

[0070] During the validation phase: After each round of training, use the validation set to evaluate the performance of the model. If the performance improvement of the model on the validation set begins to plateau or decrease, it means that the model may begin to overfit the training data. At this time, you can stop training or adjust the model parameters.

[0071] During the testing phase: Once the model is trained and tuned, a final evaluation is performed using a completely independent test set. This step gives an unbiased estimate of how the model might perform in real-world applications. If the accuracy on the test set is satisfactory, the model can be deployed to the production environment.

[0072] In the ensemble learning framework, CNN and random forest can be regarded as separate weak learners, which are combined through bagging (bootstrap aggregating) or boosting strategies to form a stronger model. In this method, each model (CNN and random forest) is trained independently, and then their prediction results are combined to improve the overall prediction performance.

[0073] The random forest algorithm already has randomness, reduces the correlation between models, and improves the accuracy of prediction through the voting mechanism of multiple decision trees, which is consistent with the idea of ​​the bagging strategy. CNN can independently learn the time series characteristics in traffic data. Therefore, in this case, the bagging strategy seems to be more suitable for integrating the two models, because it can maintain the independence and diversity of each model, improve the overall performance by voting or averaging the prediction results, without paying too much attention to the cumulative correction of erroneous samples, and avoid the risk of overfitting that may be caused by the boosting method.

[0074] In summary, the method proposed in this disclosure is more suitable for integrating CNN and random forest using the Bagging strategy to maintain the stability and diversity of the model while improving the accuracy of the overall prediction.

[0075] Figure 2 A schematic diagram of an IPv6 network DNS malicious traffic analysis method according to an embodiment of the present disclosure is shown schematically.

[0076] The present invention provides an efficient and reliable DNS malicious traffic analysis method through the above-mentioned technical means, which helps to improve the security of the IPv6 network environment of the education network.

[0077] Figure 3 A block diagram of an IPv6 network DNS malicious traffic analysis device according to an embodiment of the present disclosure is schematically shown.

[0078] like Figure 3 As shown, the IPv6 network DNS malicious traffic analysis device 300 includes a data collection module 310, a feature extraction module 320, a feature filtering module 330 and a model prediction module 340.

[0079] The data collection module 310 is used to collect target IPv6 traffic data.

[0080] The feature extraction module 320 is used to extract target feature data from the target IPv6 traffic data, where the target feature data includes data characterizing the presence of malicious behavior in the target IPv6 traffic data.

[0081] The feature filtering module 330 is used to filter invalid data in the target feature data to obtain detection feature data.

[0082] The model prediction module 340 is used to input the detection feature data into a preset detection model, and predict the existence of malicious domain names with malicious behaviors in the domain names from which the target IPv6 traffic data originates based on the detection model.

[0083] According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging circuits, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, units, and subunits can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0084] For example, any multiple of the data acquisition module 310, the feature extraction module 320, the feature filtering module 330, and the model prediction module 340 can be combined in one module / unit / sub-unit for implementation, or any one of the modules / units / sub-units can be split into multiple modules / units / sub-units. Alternatively, at least part of the functions of one or more of these modules / units / sub-units can be combined with at least part of the functions of other modules / units / sub-units and implemented in one module / unit / sub-unit. According to an embodiment of the present disclosure, at least one of the data acquisition module 310, the feature extraction module 320, the feature filtering module 330, and the model prediction module 340 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, at least one of the data collection module 310 , the feature extraction module 320 , the feature filtering module 330 and the model prediction module 340 may be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function may be executed.

[0085] It should be noted that the IPv6 network DNS malicious traffic analysis device part in the embodiment of the present disclosure corresponds to the IPv6 network DNS malicious traffic analysis method part in the embodiment of the present disclosure, and the description of the IPv6 network DNS malicious traffic analysis device part and the specific IPv6 network DNS malicious traffic analysis method part will not be repeated here.

[0086] Figure 4 A block diagram of an electronic device suitable for implementing the method described above according to an embodiment of the present disclosure is schematically shown. Figure 4 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0087] like Figure 4 As shown, the electronic device 400 according to an embodiment of the present disclosure includes a processor 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage part 408 to a random access memory (RAM) 403. The processor 401 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 401 may also include an onboard memory for caching purposes. The processor 401 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0088] In RAM 403, various programs and data required for the operation of electronic device 400 are stored. Processor 401, ROM 402 and RAM 403 are connected to each other via bus 404. Processor 401 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 402 and / or RAM 403. It should be noted that the program can also be stored in one or more memories other than ROM 402 and RAM 403. Processor 401 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0089] According to an embodiment of the present disclosure, the electronic device 400 may further include an input / output (I / O) interface 405, which is also connected to the bus 404. The electronic device 400 may further include one or more of the following components connected to the input / output (I / O) interface 405: an input portion 406 including a keyboard, a mouse, etc.; an output portion 407 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 408 including a hard disk, etc.; and a communication portion 409 including a network interface card such as a LAN card, a modem, etc. The communication portion 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the input / output (I / O) interface 405 as needed. A removable medium 411, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 410 as needed, so that a computer program read therefrom is installed into the storage portion 408 as needed.

[0090] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 409, and / or installed from the removable medium 411. When the computer program is executed by the processor 401, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0091] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0092] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. For example, it may include, but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, apparatus, or device.

[0093] For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 402 and / or the RAM 403 described above and / or one or more memories other than the ROM 402 and the RAM 403 .

[0094] An embodiment of the present disclosure also includes a computer program product, which includes a computer program, which contains program code for executing the method provided by the embodiment of the present disclosure. When the computer program product runs on an electronic device, the program code is used to enable the electronic device to implement the IPv6 network DNS malicious traffic analysis method provided by the embodiment of the present disclosure.

[0095] When the computer program is executed by the processor 401, the above functions defined in the system / device of the embodiment of the present disclosure are executed. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0096] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 409, and / or installed from the removable medium 411. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0097] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0098] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram may represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box may also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions. It can be understood by those skilled in the art that the features recorded in the various embodiments of the present disclosure can be combined and / or combined in a variety of ways, even if such a combination or combination is not explicitly recorded in the present disclosure. In particular, without departing from the spirit and teaching of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0099] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for analyzing malicious DNS traffic in an IPv6 network, characterized in that: include: Collect target IPv6 traffic data; Extracting target feature data from the target IPv6 traffic data, wherein the target feature data includes data characterizing the presence of malicious behavior in the target IPv6 traffic data; Filtering invalid data in the target feature data to obtain detection feature data; The detection feature data is input into a preset detection model, and based on the detection model, it is predicted that there is a malicious domain name with malicious behavior in the domain name from which the target IPv6 traffic data originates.

2. The method according to claim 1, characterized in that The target IPv6 traffic data to be collected includes: Screen the target active domain name and target passive domain name in the target network; Filter known malicious domain names in the target active domain name and the target passive domain name based on a preset blacklist; The target IPv6 traffic data is collected based on the filtered target active domain name and the target passive domain name.

3. The method according to claim 1, characterized in that The target feature data includes the DNS record update frequency of the DNS to which the target feature data belongs, the number of associated IP addresses, the IP address survival time, the IP address geographical distribution diversity, the completeness of the domain name registration information, the domain name registration time and active period, the DNS query traffic anomaly, and the associated malicious activity detection rate.

4. The method according to claim 1, characterized in that: The filtering of invalid data in the target feature data to obtain detection feature data comprises: Identifying characteristic indicator data in the target characteristic data; Comparing the characteristic index data with a preset characteristic threshold, filtering invalid data in the target characteristic data based on the comparison result, and obtaining the detection characteristic data; The characteristic threshold is used to measure whether the characteristic indicator data indicates that the target characteristic data is non-malicious domain name data. When the target characteristic data is non-malicious domain name data, the target characteristic data is invalid data.

5. The method according to claim 1, characterized in that The step of inputting the detection feature data into a preset detection model and predicting based on the detection model that there is a malicious domain name with malicious behavior in the domain name from which the target IPv6 traffic data originates includes: Preprocessing the detection feature data and inputting them into the detection model, wherein the detection model is constructed based on the fusion of random forest algorithm and convolutional neural network; Using the random forest algorithm and the convolutional neural network to predict the detection feature data respectively, and obtaining prediction results of the random forest algorithm and the convolutional neural network respectively; The prediction results of the random forest algorithm and the convolutional neural network are weighted and fused to obtain a malicious domain name with malicious behavior in the predicted target IPv6 traffic data.

6. The method according to claim 5, characterized in that The method comprises: Before applying the detection model, training the detection model includes: Acquire training data, and divide the training data into a training set, a validation set, and a test set, wherein the training data is feature data after feature extraction; Training the random forest algorithm sub-model and the convolutional neural network sub-model of the detection model based on the training set, and adjusting the parameters of the random forest algorithm sub-model and the convolutional neural network sub-model; Verifying and testing the trained detection model based on the verification set and the test set; Repeat the above steps until the prediction result of the detection model reaches the preset target.

7. An IPv6 network DNS malicious traffic analysis device, characterized in that: include: Data collection module, used to collect target IPv6 traffic data; A feature extraction module, used to extract target feature data from the target IPv6 traffic data, wherein the target feature data includes data characterizing the presence of malicious behavior in the target IPv6 traffic data; A feature filtering module, used to filter invalid data in the target feature data to obtain detection feature data; The model prediction module is used to input the detection feature data into a preset detection model, and predict the existence of malicious domain names with malicious behavior in the domain names from which the target IPv6 traffic data originates based on the detection model.

8. An electronic device, characterized in that: include: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: Executable instructions are stored thereon, and when the instructions are executed by a processor, the processor executes the method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images