Detection method, device and equipment for DNS hidden tunnel, medium and product

Abstract

According to the DNS hidden tunnel detection method and apparatus, the device, the medium and the product provided by the present application, the initial DNS domain name is obtained, and the domain name meeting the preset security requirement in the initial DNS domain name is filtered out to obtain the target DNS domain name; extracting feature information of the target DNS domain name according to the SVM model, and determining whether the target DNS domain name is a CDN domain name; if the target DNS domain name is a non-CDN domain name, processing the target DNS domain name according to a preset convolutional neural network model to obtain a DNS hidden tunnel domain name recognition result, the preset convolutional neural network model being used for determining whether the target DNS domain name is a DNS hidden tunnel domain name; according to the DNS hidden tunnel domain name recognition result, the attention mechanism and the SVD model, the target DNS domain name is analyzed, safety information is generated, the safety information is used for detecting the DNS hidden tunnel, the attention mechanism is used for coding and tracing the target DNS domain name, and the SVD model is used for performing domain name secondary recognition on the target DNS domain name, so that the detection efficiency of the DNS hidden tunnel is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a detection method, device, equipment, medium and product for a DNS covert tunnel. Background Art

[0002] With the rapid development of network technology, the challenges faced by network security are increasing. Effectively identifying and defending against network attacks has become the key to ensuring the stable operation of the economy and society. The Domain Name System (DNS) is one of the infrastructures of the Internet. It is indispensable for converting domain names and IP addresses to provide services to users. However, the widespread use and fundamental status of DNS also make it one of the main targets of attackers.

[0003] In the prior art, the detection of DNS covert tunnels is usually carried out by implementing encryption technology and defense measures against distributed denial of service (DDoS) attacks through firewalls to detect abnormal DNS traffic.

[0004] However, the above detection methods require manual extraction of attack features and cannot accurately identify attack paths, thus reducing the detection efficiency of DNS covert tunnels. Summary of the invention

[0005] The present application provides a DNS covert tunnel detection method, device, equipment, medium and product to solve the technical problem that the existing DNS covert tunnel detection method requires manual extraction of attack features, resulting in the inability to accurately identify the attack path and reducing the efficiency of DNS covert tunnel detection.

[0006] In a first aspect, the present application provides a method for detecting a DNS covert tunnel, comprising:

[0007] Obtain an initial DNS domain name, and filter out domain names that meet preset security requirements in the initial DNS domain name to obtain a target DNS domain name, wherein the initial DNS domain name is determined according to DNS traffic information;

[0008] Extract characteristic information of the target DNS domain name according to the SVM model, and determine whether the target DNS domain name is a CDN domain name;

[0009] If the target DNS domain name is a non-CDN domain name, the target DNS domain name is processed according to a preset convolutional neural network model to obtain a DNS covert tunnel domain name identification result, and the preset convolutional neural network model is used to determine whether the target DNS domain name is a DNS covert tunnel domain name;

[0010] According to the DNS hidden tunnel domain name identification result, attention mechanism and SVD model, the target DNS domain name is analyzed to generate security information. The security information is used to detect the DNS hidden tunnel. The attention mechanism is used to encode and trace the target DNS domain name. The SVD model is used to perform secondary domain name identification on the target DNS domain name.

[0011] Optionally, the security information includes security events and security domain names;

[0012] Wherein, the security event is a first security event obtained by encoding and tracing the target DNS domain name according to the attention mechanism when the DNS covert tunnel domain name identification result indicates that the target DNS domain name is a DNS covert tunnel domain name;

[0013] or,

[0014] The security event is when the DNS covert tunnel domain name identification result indicates that the target DNS domain name is a non-DNS covert tunnel domain name, and the target DNS domain name is secondary identified through the SVD model, and when it is determined that the target DNS domain name is a DNS covert tunnel domain name, the target DNS domain name is encoded and traced according to the attention mechanism, resulting in a second security event.

[0015] Optionally, the target DNS domain name is encoded and traced according to the attention mechanism, and the security events obtained include:

[0016] According to the attention mechanism, identifying each subdomain set under the same second-level domain name in the target DNS domain name;

[0017] According to each subdomain name set, determine the number of encoding methods of the domain names in each subdomain name set;

[0018] According to the number of encoding methods and the seven-tuple information, the target DNS domain name is traced and analyzed to determine the DNS path information;

[0019] Identify hidden tunnels in the DNS path information to obtain security events;

[0020] The seven-tuple information is determined according to the DNS traffic information, and the seven-tuple information includes a source IP, a destination IP, a message sequence number, a record type, a parsing result, and a communication time.

[0021] Optionally, the security domain name includes a first security domain name and a second security domain name;

[0022] The first secure domain name is a CDN domain name identified by the initial DNS domain name through the CDN domain name identification module;

[0023] The second secure domain name is a non-DNS covert tunnel domain name determined from the target DNS domain name through the preset convolutional neural network model and the SVD model.

[0024] Optionally, before obtaining an initial DNS domain name and filtering out domain names that meet preset security requirements in the initial DNS domain name to obtain the target DNS domain name, the method further includes:

[0025] Collecting DNS traffic information, and performing information cleaning on the DNS traffic information to obtain the initial DNS domain name;

[0026] The DNS traffic information includes source IP, source port, destination IP, destination port, traffic number, domain name, record type, resolution result, resolution time, status code, request method, and request time.

[0027] Optionally, extracting feature information of the target DNS domain name according to an SVM model to determine whether the target DNS domain name is a CDN domain name includes:

[0028] Input the target DNS domain name into the SVM model to obtain feature information of the target DNS domain name;

[0029] Determining CDN keyword feature information in the feature information of the DNS domain name according to the feature information of the target DNS domain name;

[0030] Determining whether the target DNS domain name is a CDN domain name according to the CDN keyword feature information;

[0031] If the CDN keyword feature information in the feature information of the DNS domain name includes a CDN keyword feature, then the target DNS domain name is determined to be a CDN domain name;

[0032] If the CDN keyword feature information in the feature information of the DNS domain name does not include the CDN keyword feature, it is determined that the target DNS domain name is a non-CDN domain name.

[0033] Optionally, if the target DNS domain name is a non-CDN domain name, the target DNS domain name is processed according to a preset convolutional neural network model to obtain a DNS covert tunnel domain name identification result, including:

[0034] Performing character encoding processing on the target DNS domain name to obtain a target DNS multidimensional array;

[0035] The target DNS multidimensional array is input into the preset convolutional neural network model to obtain the DNS hidden tunnel domain name recognition result.

[0036] In a second aspect, the present application provides a detection device for a DNS covert tunnel, comprising:

[0037] A target DNS domain name obtaining module is used to obtain an initial DNS domain name, and filter out domain names that meet preset security requirements in the initial DNS domain name to obtain a target DNS domain name, wherein the initial DNS domain name is determined according to DNS traffic information;

[0038] A CDN domain name determination module, used to extract feature information of the target DNS domain name according to the SVM model, and determine whether the target DNS domain name is a CDN domain name;

[0039] A DNS hidden tunnel domain name identification module, which is used to process the target DNS domain name according to a preset convolutional neural network model to obtain a DNS hidden tunnel domain name identification result if the target DNS domain name is a non-CDN domain name. The preset convolutional neural network model is used to determine whether the target DNS domain name is a DNS hidden tunnel domain name;

[0040] The security information generation module is used to analyze the target DNS domain name according to the DNS covert tunnel domain name identification result, attention mechanism and SVD model to generate security information, wherein the security information is used to detect the DNS covert tunnel, the attention mechanism is used to encode and trace the target DNS domain name, and the SVD model is used to perform secondary domain name identification on the target DNS domain name.

[0041] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0042] The memory stores computer-executable instructions;

[0043] The processor executes the computer-executable instructions stored in the memory to implement the method described in the first aspect.

[0044] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method described in the first aspect.

[0045] In a fifth aspect, the present application provides a computer program product, including a computer program, which implements the method described in the first aspect when executed by a processor.

[0046] The detection method, device, equipment, medium and product of DNS hidden tunnel provided by the present application obtain an initial DNS domain name and filter out the domain names that meet the preset security requirements in the initial DNS domain name to obtain a target DNS domain name, where the initial DNS domain name is determined according to DNS traffic information; extract feature information of the target DNS domain name according to the SVM model to determine whether the target DNS domain name is a CDN domain name; if the target DNS domain name is a non-CDN domain name, process the target DNS domain name according to a preset convolutional neural network model to obtain a DNS hidden tunnel domain name recognition result, where the preset convolutional neural network model is used to determine whether the target DNS domain name is a DNS hidden tunnel domain name; analyze the target DNS domain name according to the DNS hidden tunnel domain name recognition result, the attention mechanism and the SVD model to generate security information, which is used to detect DNS hidden tunnels, the attention mechanism is used to encode and trace the target DNS domain name, and the SVD model is used to perform secondary domain name recognition on the target DNS domain name, thereby improving the detection efficiency of DNS hidden tunnels. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0048] Figure 1 The detection architecture diagram of DNS covert tunnel provided for this application;

[0049] Figure 2 A flowchart of a first embodiment of a method for detecting a DNS hidden tunnel provided by the present application;

[0050] Figure 3 A flowchart of a second embodiment of a method for detecting a DNS hidden tunnel provided by the present application;

[0051] Figure 4 A flowchart of a third embodiment of a method for detecting a DNS hidden tunnel provided in the present application;

[0052] Figure 5 A flowchart of a fourth embodiment of a method for detecting a DNS hidden tunnel provided by the present application;

[0053] Figure 6 A flowchart of a fifth embodiment of a method for detecting a DNS hidden tunnel provided by the present application;

[0054] Figure 7 A schematic diagram of the structure of the detection device for DNS hidden tunnel provided by this application;

[0055] Figure 8 A schematic diagram of the structure of the electronic device provided in this application.

[0056] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0057] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0058] In the prior art, Domain Name System (DNS) covert tunnel attacks have become a major challenge in network security protection. Existing DNS traffic detection methods cannot efficiently filter out high-trust domain names and content delivery network (CDN) service domain names, lack accurate identification of subdomain encoding information, and cannot detect complex or obfuscated coded covert tunnel domain names. For the detected covert tunnel domain names, there is a lack of effective tracing analysis and security incident generation mechanism, which makes DNS covert tunnel attacks difficult to be effectively detected and contained.

[0059] In response to the above technical problems, this technical solution proposes a DNS covert tunnel detection method based on a support vector machine (SVM) model, a convolutional neural network model and a singular value decomposition (SVD) model. By quickly filtering non-target domain names and converting domain name data into a multidimensional array using a character encoding method, covert tunnel domain names are identified. At the same time, the attention mechanism is combined to trace the encoding of the covert tunnel domain name and identify the encoding features under the secondary domain name, thereby achieving efficient detection and security event generation of DNS covert tunnel domain names, and solving the problems of low detection accuracy, insufficient feature extraction, and weak tracing analysis in the prior art.

[0060] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0061] Figure 1 This is the detection architecture diagram of the DNS hidden tunnel provided by this application. Figure 1 As shown, traffic log, cleaning, and domain name extraction are used to obtain DNS traffic logs generated by traffic packet resolution in the existing network and perform corresponding processing. Auxiliary filtering module, used to filter out domain names in the high-trust domain name list. Determine whether it is a CDN domain name, used to perform secondary filtering of DNS data. Neural network module, used to determine in real time whether the domain name is a DNS hidden tunnel domain name. Determine whether it is a hidden tunnel domain name, used to classify attack codes when the domain name is judged as black, actively trace the source, associate the large network situation and intelligence data, and generate security events. The domain name judged as white is clustered for one-way communication within the time period, and the SVM model is used to determine whether there is a DNS hidden tunnel domain name. The domain name judged as safe is added to the high-trust domain name list, and the domain name judged as black continues to be traced. The SVD module is used to perform secondary filtering of DNS data to reduce false positives generated by subsequent identification of DNS hidden tunnels.

[0062] Figure 2 This is a flow chart of the first embodiment of the detection method of DNS hidden tunnel provided by this application. Figure 1 As shown, the method may include:

[0063] S201. Obtain an initial DNS domain name, and filter out domain names that meet preset security requirements in the initial DNS domain name to obtain a target DNS domain name.

[0064] Among them, DNS refers to a distributed system that maps Internet domain names to IP addresses, and is used to convert easy-to-remember domain names into computer-recognizable IP addresses.

[0065] The initial DNS domain name refers to the original domain name set extracted from the DNS traffic information, including all domain names that have undergone DNS resolution requests.

[0066] The target DNS domain name refers to the set of domain names that need to be further analyzed after filtering out the initial DNS domain names that meet the preset security requirements.

[0067] In this step, first, the DNS traffic log is extracted based on the traffic packets captured from the network environment, including the domain name, source IP, destination IP, request time, and resolution results. Then, the high-trust domain name list is used to filter out known safe domain names, where the filtering rule can be: if the domain name is a second-level domain name and meets the whitelist, it is directly filtered, and the high-trust domain name is regularly verified to ensure its security. Finally, the DNS domain name is generated for subsequent analysis.

[0068] Exemplarily, the obtained DNS traffic information contains all resolution requests (such as domain name, source IP, destination IP, etc.), and the above DNS traffic information can be passed as input to the auxiliary filtering module to filter out domain names that cannot be covert tunnels through the auxiliary filtering module. Covert tunnel domain names usually contain complex subdomains to hide sensitive data. Therefore, in the auxiliary filtering module, domain names with simple structures in the DNS traffic information (such as only second-level domain names) can be directly removed, and it is determined that the domain name cannot contain the encoding information of the covert tunnel and is directly filtered. In addition, the domain names in the high-trust domain name register can be filtered out by the auxiliary filtering module, that is, the obtained domain name is compared with the high-trust domain name register. If the domain name exists in the high-trust domain name register, it is filtered. After the above filtering steps, after eliminating the domain names that are obviously risk-free, the remaining domain names are marked as target DNS domain names and enter the next step of analysis.

[0069] S202: Extract feature information of the target DNS domain name according to the SVM model to determine whether the target DNS domain name is a CDN domain name.

[0070] Among them, SVM is a supervised learning algorithm that is used for binary classification tasks or multi-classification tasks by finding the optimal classification boundary in the feature space.

[0071] Feature information refers to a numerical vector formed by extracting attribute information (such as domain name structure and keyword distribution) of a target DNS domain name.

[0072] CDN domain names refer to domain names used for content distribution networks. CDN service providers use distributed servers to accelerate content delivery, which usually generates a large number of domain names. These domain names are usually non-malicious, but may interfere with the detection process in covert tunnel detection.

[0073] In this step, since a large number of CDN domain names in the existing network may contain complex meaningless codes, but these domain names are usually normal and will not constitute hidden tunnel behavior, a CDN domain name recognition model can be designed to reduce the false positives of meaningless coded domain names for hidden tunnel detection. The CDN domain name recognition model is used to extract CDN domain name feature information, including keyword inclusion features and domain name structure features, wherein the keyword inclusion features can determine whether the domain name contains typical keywords, such as CDN, and the domain name structure features are used to extract the hierarchical depth of the domain name. In addition, the construction of the training data set can obtain data from the access domain names on the known CDN services, or from the traffic domain names of the existing network, wherein the traffic domain names of the existing network can be classified as CDN or non-CDN domain names after manual verification. Secondly, SVM can be selected as the classification algorithm of the model, and the above-mentioned feature vectors (keyword features, structural features) are input into the SCM model, and then the hyperparameters are tuned using grid search to obtain the optimal classification model.

[0074] Finally, the trained model is used to perform secondary filtering on the target DNS domain name. The filtering logic is as follows: if the model output result is a CDN domain name, it is filtered and added to the high-trust domain name list; if the model output result is a non-CDN domain name, it is marked as the target DNS domain name and proceeds to the next step.

[0075] This step can accurately identify and filter CDN domain names by building a CDN domain name recognition model and using the SVM classification algorithm, significantly reducing the false positives of subsequent DNS domain name tunnel detection, thereby optimizing the efficiency and accuracy of the detection process.

[0076] S203. If the target DNS domain name is a non-CDN domain name, the target DNS domain name is processed according to a preset convolutional neural network model to obtain a DNS covert tunnel domain name identification result.

[0077] Among them, the preset convolutional neural network model is a deep learning model, which extracts local and global features of data through multi-layer convolution kernel pooling operations, and can determine whether the target DNS domain name is a DNS hidden tunnel domain name.

[0078] Specifically, it is necessary to first construct a preset convolutional neural network model data set, including: establishing a black and white domain name training set, where black domain names refer to malicious domain names marked as hidden tunnels in the public data set, and white domain names refer to authoritative, manually verified safe domain names. Data expansion: Use public data sets and real traffic data captured by the existing network for data expansion, where records with mapping records and authoritative domain names are selected from the real traffic data as white domain names. Data labeling: Label the safe domain name as θ and the hidden tunnel domain name as 1. Data division: 80% of the data is used for training the preset convolutional neural network model, and 20% of the data is used for testing.

[0079] Secondly, domain name preprocessing is performed, including: subdomain extraction, extracting subdomains from the full domain name. Data cleaning, removing black samples without encoding features in the data, removing null values ​​and illegal character domain names, and deduplication to retain unique subdomains. Then character encoding is performed, and a custom encoding method can be used to encode the subdomain into a 64-dimensional tensor vector.

[0080] Then, the convolutional network model is designed. Specifically, the network architecture is designed first, using a four-layer one-dimensional convolutional network with a convolution kernel size of 3, a decreasing number of channels in each layer, and a batch normalization and Relu activation function after each convolution. The convolution operation formula is:

[0081]

[0082] Among them, X represents the input vector, K represents the convolution kernel, and Y represents the output vector.

[0083] For the classification layer, the convolution is followed by two linear fully connected layers for global feature integration, and then the Sigmoid function is used to output the value:

[0084]

[0085] The output value ranges from 0 to 1, indicating the domain name classification result, where 0 indicates a secure domain name and 1 indicates a DNS hidden tunnel domain name.

[0086] Finally, the model is trained and optimized, and the performance of the model is optimized by adjusting the learning rate, regularization parameters, etc.

[0087] This step can accurately identify DNS covert tunnel domain names through multi-layer feature extraction and optimization of deep convolutional neural networks, with the advantages of high accuracy and lightweight computing.

[0088] S204: Analyze the target DNS domain name based on the DNS hidden tunnel domain name recognition result, attention mechanism and SVD model to generate security information.

[0089] Among them, security information is used to detect DNS covert tunnels, including domain name encoding methods, communication frequencies, tracing paths, etc., to further analyze the behavioral patterns and potential threats of covert tunnel attacks.

[0090] The attention mechanism is a deep learning technology that is used to simulate the attention allocation of workers when processing information. It focuses on the unique coding or behavioral features in the hidden tunnel domain names and is used to trace the coding of the domain names.

[0091] The SVD model is a matrix decomposition algorithm that can extract important features from domain name log data and achieve secondary identification of the target DNS domain name by decomposing the DNS communication matrix.

[0092] In this step, based on the analysis of the hidden tunnel domain name recognition results, the output of the convolutional neural network model is used as input to further analyze the samples detected as hidden tunnel domain names and enter the attention mechanism and SVD model. Then, the attention mechanism is used to trace the encoding source, and the SVD model is used for secondary domain name recognition to generate the final security information, and the security information is output in a structured form to facilitate further analysis and response by the security operation and maintenance team.

[0093] Furthermore, the security information includes security events and security domain names;

[0094] Among them, security events refer to specific events generated through coding tracing, behavior analysis or secondary identification when the target domain name is identified as a DNS hidden tunnel domain name, indicating a potential security threat. Specifically, it includes the first security event and the second security event, wherein the first security event is a security event generated by further tracing the coding characteristics of the hidden tunnel domain name directly represented by the DNS hidden tunnel domain name identification result through the attention cutoff; the second security event refers to the target domain name initially identified as a non-hidden tunnel domain name, but after secondary identification by the SVD model, it is re-identified as a hidden tunnel domain name, and then the security event is generated after the coding is traced through the attention mechanism.

[0095] Specifically, the premise of generating the first security event is that the DNS covert tunnel domain name identification result directly indicates that the target DNS domain name is a covert tunnel domain name, for example, the target DNS domain name is encoded and traced using processing to analyze whether the subdomain part of the domain name contains encoding features, and the specific type of attack encoding and the information carried, such as sensitive data or control commands, are determined. Then the first security event is output, including the domain name, encoding type, attack path and potential harm, domain name communication frequency and behavior pattern.

[0096] The premise for generating the second security event is that the DNS covert tunnel domain name identification result indicates that the target DNS domain name is a non-covert tunnel domain name, but after secondary identification by the SVD model, it is re-marked as a covert tunnel domain name. For example, the SVD model is used to decompose and analyze the domain name communication matrix, extract hidden patterns (such as abnormal high-frequency communication, data transmission anomalies), and then combine the attention mechanism to identify encoding features and trace the source. Finally, the second security event is output, including the domain name, the secondary identified communication behavior characteristics and encoding characteristics, and potential attack behaviors.

[0097] By combining the DNS covert tunnel domain name recognition results, attention mechanism and SVD model, security events are generated for the initial recognition and secondary recognition results respectively, which significantly improves the depth and accuracy of covert tunnel domain name detection. Among them, the attention mechanism focuses on encoding tracing and accurately locates attack features. The SVD model supplements the secondary verification capability of complex communication behaviors to ensure that no potential threats are missed. At the same time, it generates comprehensive security information, providing comprehensive support for complete security defense.

[0098] Furthermore, a secure domain name refers to a DNS domain name that meets preset security requirements and is not identified as a covert tunnel domain name, including a first secure domain name and a second secure domain name.

[0099] The first secure domain name is a CDN domain name identified by the initial DNS domain name through the SVM model identification module.

[0100] The second secure domain name is a non-DNS hidden tunnel domain name determined from the target DNS domain name through a preset convolutional neural network model and an SVD model.

[0101] The process of determining the first secure domain name is to identify the CDN domain name through the SVM model. The N-gram features, keyword inclusion features and domain name structure features in the target DNS domain name are extracted through the SVM model. Among them, if the keyword inclusion features contain words such as "cdn" and "cloud" that represent CDN services, then the target CDN domain name is characterized as the first secure domain name, and the domain name can be added to the list of high-trust domain names.

[0102] The identification of the second safe domain name is determined by deep detection and secondary identification through the preset convolutional neural network and SCD model. The specific process includes: inputting the target DNS domain name after filtering out the CDN domain name into the preset convolutional neural network model for detection, extracting the subdomain part of the target CDN domain name, and encoding it into a 64-dimensional Tensor vector. Then the Tensor vector is input into the preset four-layer convolutional neural network model for feature extraction and classification. Specifically, the convolution layer extracts the local features of the domain name, while the attention mechanism focuses on the encoding information unique to the hidden tunnel. The Sigmoid activation function normalizes the output result to 0 or 1, 0 for a safe domain name, and 1 for a hidden tunnel domain name. If the CNN detection result is a safe domain name, enter the SVD model for secondary confirmation.

[0103] Step 2: The SVD model performs secondary identification and constructs the communication log data of the target DNS domain name into a communication matrix, where the rows and columns represent the source IP and destination IP of the communication pair, respectively, and the element values ​​of the matrix represent the number of communications, frequency, or other communication behavior indicators. The SVD model is used to decompose the communication matrix, extract features, and then use singular value analysis to determine whether the communication behavior of the domain name is abnormal. If the SVD model confirms that the domain name communication is normal, it is determined to be the second security domain name, and the non-covert tunnel domain name is marked as the second security domain name and added to the list of high-trust domain names.

[0104] The detection method of DNS hidden tunnel provided in the embodiment of the present application, by combining the DNS hidden tunnel domain name recognition results, attention mechanism and SVD model analysis method, this solution can accurately identify and deeply analyze the characteristics of hidden tunnel domain names, not only can effectively determine whether the domain name carries hidden codes, but also through code tracing and communication behavior analysis, reveal the potential threats and associated attack paths of the domain name. The attention mechanism focuses on the coding characteristics to improve the ability to discover hidden data; the SVD model uses the communication matrix to extract behavioral features and enhance the detection accuracy of complex abnormal patterns. The structured security information finally generated comprehensively covers threat assessment and tracing details, providing efficient and accurate decision support for network security defense, while reducing false alarm rates and optimizing security operation and maintenance efficiency.

[0105] Figure 3 The following is a flow chart of the second embodiment of the detection method of DNS hidden tunnel provided by this application. Figure 3 As shown, in Figure 2 Based on the embodiment, the target DNS domain name is encoded and traced according to the attention mechanism, and the security events obtained include:

[0106] S301. According to the attention mechanism, identify each subdomain set under the same second-level domain name in the target DNS domain name.

[0107] The subdomain name set is a set of all subdomain names extracted under the same second-level domain name.

[0108] In this step, the attention mechanism is used to analyze the target DNS domain name, focusing on the subdomains under the same second-level domain name, extracting all subdomain sets under each second-level domain name, and outputting each subdomain set under the same second-level domain name.

[0109] S302: According to each subdomain name set, determine the number of encoding methods of the domain names in each subdomain name set.

[0110] The number of encoding methods refers to the number of various encoding forms contained in the subdomain set, which is used to determine the encoding characteristics of the covert tunnel.

[0111] In this step, the subdomains in each subdomain set are encoded and identified to determine the encoding method of each subdomain. Common encoding methods include Base32, Base64, and Base128. Then, the number of different encoding methods in each subdomain set is counted, and the number of different encoding methods in each subdomain set is output.

[0112] S303: According to the number of encoding methods and the seven-tuple information, the target DNS domain name is traced and analyzed to determine the DNS path information.

[0113] Among them, the seven-tuple information is an important data structure of DNS traffic information, including source IP, destination IP, message sequence number, record type, resolution result and communication time. The seven-tuple information is used to comprehensively describe the details of DNS communication and can support tracing analysis.

[0114] DNS path information refers to the domain name resolution path information obtained through tracing analysis of DNS traffic, including the server addresses and resolution process of the communicating parties, which helps determine whether the domain name has hidden tunnel communication behavior.

[0115] In this step, we combine the number of encoding methods in the subdomain name set and the seven-tuple information to perform DNS traffic source tracing analysis. We need to focus on analyzing the path information that appears in the DNS traffic, including the DNS servers that the domain name resolution passes through, the number of requests, frequency, and communication time between the communication pairs. We then use the seven-tuple information to perform correlation analysis and construct the complete path of the domain name resolution. Finally, we output the DNS path information of the target DNS domain name to reveal the hidden communication behavior that may exist in the traffic.

[0116] S304: Identify hidden tunnels in the DNS path information and obtain security events.

[0117] In this step, the DNS path information can be analyzed to identify covert tunneling behaviors in traffic. The key indicators are: abnormally high number of DNS communications, multiple encoding methods in the same subdomain set, abnormally dense communication frequency, or obvious time patterns. Based on the above indicators, the domain name encoding features are traced in combination with the attention mechanism to determine whether the target DNS domain name belongs to covert tunneling communication.

[0118] Finally, the first security event and the second security event are output. If the target DNS domain name is initially identified as a DNS hidden tunnel domain name, the encoding is traced through the attention mechanism to obtain a security event; if the target DNS domain name is secondarily identified as a hidden tunnel domain name through the SVD model, further encoding is traced to generate a security event.

[0119] The DNS covert tunnel detection method provided in the embodiment of the present application combines the attention mechanism with the seven-tuple information to perform in-depth coding tracing and traffic path analysis on the target DNS domain name, thereby achieving accurate detection of DNS covert tunnel communication, and automatically generating security events to distinguish covert tunnel domain names from ordinary domain names, thereby providing strong support for network security monitoring.

[0120] Figure 4 This is a flow chart of the third embodiment of the detection method of DNS hidden tunnel provided by this application. Figure 4 As shown, in Figure 2Based on the embodiment, the initial DNS domain name is obtained, and domain names that meet the preset security requirements in the initial DNS domain name are filtered out, and before the target DNS domain name is obtained, the method further includes:

[0121] S401, collecting DNS traffic information, and cleaning the DNS traffic information to obtain an initial DNS domain name.

[0122] Among them, information cleaning refers to the processing of DNS traffic information to remove incomplete, duplicate, erroneous or irrelevant data to ensure a high-quality and available initial DNS domain name.

[0123] Specifically, you can obtain the original network traffic data from the data packets of the network monitoring device, and then use the traffic capture tool or DNS traffic resolution tool to extract DNS-related traffic information and extract the key fields in the DNS protocol, including source IP, source port: used to identify the source of the request; destination IP, destination port: used to identify the target server of the request; traffic label: uniquely identifies the traffic packet; domain name: indicates the domain name requested by the client for resolution; record type: such as A record (IPv4 address resolution); resolution result: the resolution result returned by the DNS server; resolution time and request time: record the timestamp of the traffic request and response; status code: returns the status of whether the request is successful or not, and outputs a complete DNS traffic information data set for subsequent processing.

[0124] Then, for the above DMS traffic information, cleaning operations are performed, including: deduplication processing, removing duplicate traffic data to ensure the uniqueness of domain name data; invalid data filtering, removing data with missing necessary fields or incorrect formats, such as records with missing domain names or resolution results; illegal data removal, removing domain names containing illegal characters or not compliant with DNS specifications; timestamp filtering, filtering DNS request records within the valid time period according to the set time window; for valid DNS traffic data, extracting the domain name field as the initial DNS domain name. Finally, the high-quality domain name set after information cleaning can provide input for subsequent filtering and detection processes.

[0125] The DNS hidden tunnel detection method provided in the embodiment of the present application cleans the DNS traffic information, removes invalid data and redundant information, improves data processing efficiency, and the initial DNS domain name data after cleaning is accurate and complete, providing a reliable data basis for subsequent DNS domain name filtering and hidden tunnel detection, and reducing the interference of erroneous input on the detection results.

[0126] Figure 5 This is a flow chart of the fourth embodiment of the detection method of DNS hidden tunnel provided by this application. Figure 5As shown, extracting characteristic information of the target DNS domain name according to the SVM model to determine whether the target DNS domain name is a CDN domain name includes:

[0127] S501: Input the target DNS domain name into the SVM model to obtain feature information of the target DNS domain name.

[0128] The target DNS domain name is input into the trained SVM model, and the SVM model can automatically extract domain name feature information based on the trained data (including samples of CDN domain names and non-CDN domain names). The extracted feature information includes N-gram features, continuous substring statistics based on domain name characters, keyword inclusion features, detecting whether the domain name contains keywords such as "cdn" and "clou", domain name structure features, and analyzing the hierarchical structure of the domain name, such as subdomains, primary domain names, and secondary domain names. Then the feature information of the target DNS domain name is output.

[0129] S502: Determine CDN keyword feature information in the feature information of the DNS domain name according to the feature information of the target DNS domain name.

[0130] In this step, keyword features related to CDN services are screened out from the extracted target DNS domain name feature information. For example, check whether the domain name contains preset CDN keyword features, such as "cdn", "clou", etc., and then analyze the frequency and position of the keyword, such as the keyword appears in the subdomain part or the main domain part. If the detection result contains the keyword "cdn", it is determined to be CDN keyword feature information, and the CDN keyword feature information is output.

[0131] S503: Determine whether the target DNS domain name is a CDN domain name according to the CDN keyword feature information.

[0132] Among them, if the CDN keyword feature information in the feature information of the DNS domain name contains the CDN keyword feature, the target DNS domain name is determined to be a CDN domain name, and the target DNS domain name is marked and added to the high-trust domain name list.

[0133] If the CDN keyword feature information in the feature information of the DNS domain name does not include the CDN keyword feature, it is determined that the target DNS domain name is a non-CDN domain name.

[0134] The DNS covert tunnel detection method provided in the embodiment of the present application can effectively identify CDN domain names, reduce the false alarm rate, filter CDN domain names, and add them to the high-trust domain name list, thereby reducing the computational burden of subsequent modules and ensuring that non-CDN domain names can be accurately input into subsequent detection processes to avoid misjudgment of DNS covert tunnels.

[0135] Figure 6 This is a flow chart of the fifth embodiment of the detection method of DNS hidden tunnel provided by this application. Figure 6 As shown, if the target DNS domain name is a non-CDN domain name, the target DNS domain name is processed according to the preset convolutional neural network model to obtain the DNS hidden tunnel domain name identification result, including:

[0136] S601. Perform character encoding processing on the target DNS domain name to obtain a target DNS multi-dimensional array.

[0137] In this step, for non-CDN domain names, subdomains can be extracted from the target DNS domain name. Since the hidden tunnel information is mainly encoded in the subdomain part, the subdomain part is mainly focused when extracting the subdomain. Then the extracted subdomain is converted into a numerical representation. For example, a custom encoding method can be used, that is, each character is mapped to a number using ASCII code, or the character is encoded into a vector of fixed length, such as a 64-dimensional Tensor vector. Finally, the character-encoded data is organized into a multidimensional array form, which is suitable for the input structure of the convolutional neural network. For example, the one-dimensional character encoding is expanded into a two-dimensional Tensor format (such as a 64-dimensional array), and the target DNS multidimensional array is finally output to represent the encoded target DNS domain name data.

[0138] S602: Input the target DNS multidimensional array into a preset convolutional neural network model to obtain the DNS covert tunnel domain name recognition result.

[0139] In this step, the target DNS multidimensional array is input into the preset convolutional neural network model, wherein the preset convolutional neural network model includes an input layer, which can accept multidimensional array input, such as a 64-dimensional Tensor vector; a convolution layer, which can extract local features, such as the features of hidden tunnel encoding in the domain name; an activation function, which uses the ReLU (rectified linear unit) activation function to improve the nonlinear expression ability of the model; batch normalization, which can avoid model overfitting and accelerate training; a pooling layer, which can perform feature dimensionality reduction and reduce the amount of calculation; a fully connected layer, which further processes the convolutional features and integrates all feature information; an output layer, which uses the Sigmoid function to limit the output result between 0 and 1 for binary classification, wherein 0 represents a secure domain name and 1 represents a DNS hidden tunnel domain name.

[0140] The convolution calculation formula is:

[0141]

[0142] Among them, X represents the input vector, K represents the convolution kernel, Y represents the output vector, and i represents the element index. Then, the trained convolutional neural network model is used to classify the input target DNS multidimensional array, and the output domain name classification results include: if the output value is close to 1, it indicates that the domain name is a DNS hidden tunnel domain name; if the output value is close to 0, it indicates that the domain name is a safe domain name. Finally, the DNS hidden tunnel domain name identification result is output.

[0143] The DNS covert tunnel detection method provided in the embodiment of the present application utilizes the feature extraction capability of a preset convolutional neural network model, can adapt to different types of covert tunnel domain names, can capture the covert coding features in the domain names, and achieve high-precision identification of DNS covert tunnels. At the same time, character encoding and convolution operations reduce data complexity, making domain name classification faster.

[0144] Figure 7 This is a schematic diagram of the structure of the detection device for DNS hidden tunnel provided in the embodiment of the present application. Figure 7 As shown, the detection device 70 of the DNS hidden tunnel includes:

[0145] The target DNS domain name obtaining module 701 is used to obtain the initial DNS domain name and filter out the domain names that meet the preset security requirements in the initial DNS domain name to obtain the target DNS domain name. The initial DNS domain name is determined according to the DNS traffic information.

[0146] The CDN domain name determination module 702 is used to extract feature information of the target DNS domain name according to the SVM model, and determine whether the target DNS domain name is a CDN domain name.

[0147] The DNS hidden tunnel domain name identification module 703 is used to process the target DNS domain name according to the preset convolutional neural network model to obtain the DNS hidden tunnel domain name identification result if the target DNS domain name is a non-CDN domain name. The preset convolutional neural network model is used to determine whether the target DNS domain name is a DNS hidden tunnel domain name.

[0148] The security information generation module 704 is used to analyze the target DNS domain name according to the DNS hidden tunnel domain name identification result, attention mechanism and SVD model to generate security information. The security information is used to detect the DNS hidden tunnel, the attention mechanism is used to encode and trace the target DNS domain name, and the SVD model is used to perform secondary domain name identification on the target DNS domain name.

[0149] Furthermore, the security information generating module 704 is also specifically used for:

[0150] Security information includes security events and security domain names;

[0151] Among them, the security event is the first security event obtained by encoding and tracing the target DNS domain name according to the attention mechanism when the DNS covert tunnel domain name identification result indicates that the target DNS domain name is a DNS covert tunnel domain name;

[0152] or,

[0153] The security event is when the DNS covert tunnel domain name identification result indicates that the target DNS domain name is a non-DNS covert tunnel domain name, and the target DNS domain name is secondary identified through the SVD model. When the target DNS domain name is determined to be a DNS covert tunnel domain name, the target DNS domain name is encoded and traced according to the attention mechanism, resulting in the second security event.

[0154] Furthermore, the security information generating module 704 is also specifically used for:

[0155] According to the attention mechanism, identify the subdomain sets under the same second-level domain name in the target DNS domain name;

[0156] According to each subdomain name set, determine the number of encoding methods of the domain names in each subdomain name set;

[0157] According to the number of encoding methods and seven-tuple information, the target DNS domain name is traced and analyzed to determine the DNS path information;

[0158] Identify hidden tunnels in DNS path information and obtain security events;

[0159] The seven-tuple information is determined based on the DNS traffic information, and the seven-tuple information includes source IP, destination IP, message sequence number, record type, resolution result, and communication time.

[0160] Furthermore, the security information generating module 704 is also specifically used for:

[0161] The first secure domain name is the CDN domain name identified by the initial DNS domain name through the SVM model;

[0162] The second secure domain name is a non-DNS hidden tunnel domain name determined from the target DNS domain name through a preset convolutional neural network model and an SVD model.

[0163] Furthermore, the target DNS domain name obtaining module 701 is also specifically used for:

[0164] Collect DNS traffic information, clean the DNS traffic information, and obtain the initial DNS domain name;

[0165] Among them, DNS traffic information includes source IP, source port, destination IP, destination port, traffic label, domain name, record type, resolution result, resolution time, status code, request method, and request time.

[0166] Furthermore, the CDN domain name determination module is also specifically used for:

[0167] Input the target DNS domain name into the SVM model to obtain the feature information of the target DNS domain name;

[0168] Determine CDN keyword feature information in the feature information of the DNS domain name according to the feature information of the target DNS domain name;

[0169] Determine whether the target DNS domain name is a CDN domain name based on CDN keyword feature information;

[0170] If the CDN keyword feature information in the feature information of the DNS domain name includes the CDN keyword feature, then the target DNS domain name is determined to be a CDN domain name;

[0171] If the CDN keyword feature information in the feature information of the DNS domain name does not include the CDN keyword feature, it is determined that the target DNS domain name is a non-CDN domain name.

[0172] Furthermore, the DNS covert tunnel domain name identification module 703 is also specifically used for:

[0173] Perform character encoding processing on the target DNS domain name to obtain a target DNS multidimensional array;

[0174] The target DNS multidimensional array is input into the preset convolutional neural network model to obtain the DNS covert tunnel domain name identification result.

[0175] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 8 As shown, the electronic device 80 includes:

[0176] The electronic device 80 may include a processor 801 with one or more processing cores, a memory 802 with one or more computer-readable storage media, a communication component 803 and other components. The processor 801 , the memory 802 and the communication component 803 are connected via a bus 404 .

[0177] In a specific implementation process, at least one processor 801 executes the computer execution instructions stored in the memory 802, so that the at least one processor 801 executes the above-mentioned DNS covert tunnel detection method.

[0178] The specific implementation process of the processor 801 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0179] In the above Figure 8 In the illustrated embodiment, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0180] The memory may include a high-speed memory (Random Access Memory, RAM), and may also include a non-volatile memory (Non-volatile Memory, NVM), such as at least one disk memory.

[0181] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0182] In some embodiments, a computer program product is also proposed, including a computer program or instructions, which, when executed by a processor, implements the steps in any of the above-mentioned methods for detecting a DNS covert tunnel.

[0183] The specific implementation of the above operations can be found in the previous embodiments, which will not be described in detail here.

[0184] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0185] To this end, an embodiment of the present application provides a computer-readable storage medium, in which multiple instructions are stored. The instructions can be loaded by a processor to execute the steps in any one of the DNS covert tunnel detection methods provided in the embodiments of the present application.

[0186] The storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0187] Since the instructions stored in the storage medium can execute the steps in any one of the DNS covert tunnel detection methods provided in the embodiments of the present application, the beneficial effects that can be achieved by any one of the DNS covert tunnel detection methods provided in the embodiments of the present application can be achieved. For details, please refer to the previous embodiments and will not be repeated here.

[0188] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0189] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for detecting a DNS covert tunnel, characterized in that: include: Obtain an initial DNS domain name, and filter out domain names that meet preset security requirements in the initial DNS domain name to obtain a target DNS domain name, wherein the initial DNS domain name is determined according to DNS traffic information; Extract characteristic information of the target DNS domain name according to the SVM model, and determine whether the target DNS domain name is a CDN domain name; If the target DNS domain name is a non-CDN domain name, the target DNS domain name is processed according to a preset convolutional neural network model to obtain a DNS covert tunnel domain name identification result, and the preset convolutional neural network model is used to determine whether the target DNS domain name is a DNS covert tunnel domain name; According to the DNS hidden tunnel domain name identification result, attention mechanism and SVD model, the target DNS domain name is analyzed to generate security information. The security information is used to detect the DNS hidden tunnel. The attention mechanism is used to encode and trace the target DNS domain name. The SVD model is used to perform secondary domain name identification on the target DNS domain name.

2. The method according to claim 1, characterized in that The security information includes security events and security domain names; Wherein, the security event is a first security event obtained by encoding and tracing the target DNS domain name according to the attention mechanism when the DNS covert tunnel domain name identification result indicates that the target DNS domain name is a DNS covert tunnel domain name; or, The security event is when the DNS covert tunnel domain name identification result indicates that the target DNS domain name is a non-DNS covert tunnel domain name, and the target DNS domain name is secondary identified through the SVD model, and when it is determined that the target DNS domain name is a DNS covert tunnel domain name, the target DNS domain name is encoded and traced according to the attention mechanism, resulting in a second security event.

3. The method according to claim 2, characterized in that The target DNS domain name is encoded and traced according to the attention mechanism, and the security events obtained include: According to the attention mechanism, identifying each subdomain set under the same second-level domain name in the target DNS domain name; According to each subdomain name set, determine the number of encoding methods of the domain names in each subdomain name set; According to the number of encoding methods and the seven-tuple information, the target DNS domain name is traced and analyzed to determine the DNS path information; Identify hidden tunnels in the DNS path information to obtain security events; The seven-tuple information is determined according to the DNS traffic information, and the seven-tuple information includes a source IP, a destination IP, a message sequence number, a record type, a parsing result, and a communication time.

4. The method according to claim 2, characterized in that: The security domain name includes a first security domain name and a second security domain name; The first secure domain name is a CDN domain name identified by the initial DNS domain name through the SVM model; The second secure domain name is a non-DNS covert tunnel domain name determined from the target DNS domain name through the preset convolutional neural network model and the SVD model.

5. The method according to any one of claims 1 to 4, characterized in that: Before obtaining the initial DNS domain name and filtering out domain names that meet preset security requirements in the initial DNS domain name to obtain the target DNS domain name, the method further includes: Collecting DNS traffic information, and performing information cleaning on the DNS traffic information to obtain the initial DNS domain name; The DNS traffic information includes source IP, source port, destination IP, destination port, traffic number, domain name, record type, resolution result, resolution time, status code, request method, and request time.

6. The method according to any one of claims 1 to 4, characterized in that: Extracting feature information of the target DNS domain name according to the SVM model to determine whether the target DNS domain name is a CDN domain name includes: Input the target DNS domain name into the SVM model to obtain feature information of the target DNS domain name; Determining CDN keyword feature information in the feature information of the DNS domain name according to the feature information of the target DNS domain name; Determining whether the target DNS domain name is a CDN domain name according to the CDN keyword feature information; If the CDN keyword feature information in the feature information of the DNS domain name includes a CDN keyword feature, then the target DNS domain name is determined to be a CDN domain name; If the CDN keyword feature information in the feature information of the DNS domain name does not include the CDN keyword feature, it is determined that the target DNS domain name is a non-CDN domain name.

7. The method according to any one of claims 1 to 4, characterized in that: If the target DNS domain name is a non-CDN domain name, the target DNS domain name is processed according to a preset convolutional neural network model to obtain a DNS covert tunnel domain name identification result, including: Performing character encoding processing on the target DNS domain name to obtain a target DNS multidimensional array; The target DNS multidimensional array is input into the preset convolutional neural network model to obtain the DNS hidden tunnel domain name recognition result.

8. A detection device for DNS hidden tunnel, characterized in that: include: A target DNS domain name obtaining module is used to obtain an initial DNS domain name, and filter out domain names that meet preset security requirements in the initial DNS domain name to obtain a target DNS domain name, wherein the initial DNS domain name is determined according to DNS traffic information; A CDN domain name determination module, used to extract feature information of the target DNS domain name according to the SVM model, and determine whether the target DNS domain name is a CDN domain name; A DNS hidden tunnel domain name identification module, which is used to process the target DNS domain name according to a preset convolutional neural network model to obtain a DNS hidden tunnel domain name identification result if the target DNS domain name is a non-CDN domain name. The preset convolutional neural network model is used to determine whether the target DNS domain name is a DNS hidden tunnel domain name; The security information generation module is used to analyze the target DNS domain name according to the DNS covert tunnel domain name identification result, attention mechanism and SVD model to generate security information, wherein the security information is used to detect the DNS covert tunnel, the attention mechanism is used to encode and trace the target DNS domain name, and the SVD model is used to perform secondary domain name identification on the target DNS domain name.

9. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 7 when executed by a processor.

11. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 7 when being executed by a processor.

Images