DNS covert tunnel detection method, device, equipment, medium and product

Abstract

The DNS covert tunnel detection method, apparatus, equipment, medium, and product provided in this application obtains an initial DNS domain name and filters out domain names that meet preset security requirements from the initial DNS domain name to obtain a target DNS domain name; extracts feature information of the target DNS domain name according to an SVM model to determine whether the target DNS domain name is a CDN domain name; if the target DNS domain name is not a CDN domain name, it is processed according to a preset convolutional neural network model to obtain a DNS covert tunnel domain name identification result. The preset convolutional neural network model is used to determine whether the target DNS domain name is a DNS covert tunnel domain name; based on the DNS covert tunnel domain name identification result, attention mechanism, and SVD model, the target DNS domain name is analyzed to generate security information. The security information is used to detect DNS covert tunnels, the attention mechanism is used to encode and trace the target DNS domain name, and the SVD model is used to perform secondary domain name identification of the target DNS domain name, thereby improving the detection efficiency of DNS covert tunnels.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device, medium and product for detecting DNS covert tunnels. Background Technology

[0002] With the rapid development of network technology, network security faces increasing challenges, and effectively identifying and defending against cyberattacks has become crucial for ensuring the stable operation of the economy and society. The Domain Name System (DNS) is one of the fundamental infrastructures of the Internet, indispensablely used for the translation of domain names into IP addresses to provide services to users. However, the widespread use and fundamental status of DNS also make it a primary target for attackers.

[0003] In existing technologies, the detection of DNS covert tunnels is usually achieved by implementing encryption technology and defense against distributed denial-of-service (DDoS) attacks through firewalls, in order to detect abnormal DNS traffic.

[0004] However, the above detection methods require manual extraction of attack features, which cannot accurately identify attack paths and reduces the detection efficiency of DNS covert tunnels. Summary of the Invention

[0005] This application provides a method, apparatus, device, medium, and product for detecting DNS covert tunnels, which solves the technical problem that existing DNS covert tunnel detection methods require manual extraction of attack features, resulting in the inability to accurately identify attack paths and reducing the efficiency of DNS covert tunnel detection.

[0006] Firstly, this application provides a method for detecting DNS covert tunnels, including:

[0007] Obtain the initial DNS domain name, and filter out the domain names that meet the preset security requirements from the initial DNS domain name to obtain the target DNS domain name. The initial DNS domain name is determined based on DNS traffic information.

[0008] Based on the SVM model, feature information of the target DNS domain name is extracted to determine whether the target DNS domain name is a CDN domain name;

[0009] If the target DNS domain name is a non-CDN domain name, the target DNS domain name is processed according to a preset convolutional neural network model to obtain the DNS covert tunnel domain name identification result. The preset convolutional neural network model is used to determine whether the target DNS domain name is a DNS covert tunnel domain name.

[0010] Based on the DNS covert tunnel domain name identification results, attention mechanism, and SVD model, the target DNS domain name is analyzed to generate security information. The security information is used to detect DNS covert tunnels. The attention mechanism is used to encode and trace the source of the target DNS domain name. The SVD model is used to perform secondary domain name identification on the target DNS domain name.

[0011] Optionally, the security information includes security events and security domain names;

[0012] The security event is the first security event obtained by encoding and tracing the target DNS domain name according to the attention mechanism when the DNS covert tunnel domain name identification result indicates that the target DNS domain name is a DNS covert tunnel domain name;

[0013] or,

[0014] The security event is a second security event obtained when the DNS covert tunnel domain name identification result indicates that the target DNS domain name is not a DNS covert tunnel domain name, and the target DNS domain name is determined to be a DNS covert tunnel domain name by performing secondary domain name identification on the target DNS domain name through the SVD model, and the target DNS domain name is encoded and traced according to the attention mechanism.

[0015] Optionally, the security events obtained by encoding and tracing the target DNS domain name according to the attention mechanism include:

[0016] Based on the attention mechanism, identify the set of subdomains under the same second-level domain in the target DNS domain;

[0017] Based on each subdomain set, determine the number of encoding methods for the domains in each subdomain set;

[0018] Based on the number of encoding methods and the seven-tuple information, the target DNS domain name is traced and analyzed to determine the DNS path information;

[0019] By identifying hidden tunnels in the DNS path information, security events can be obtained.

[0020] The seven-tuple information is determined based on the DNS traffic information, and the seven-tuple information includes the source IP, destination IP, message sequence number, record type, resolution result, and communication time.

[0021] Optionally, the security domain name includes a first security domain name and a second security domain name;

[0022] The first security domain name is the CDN domain name identified by the CDN domain name identification module from the initial DNS domain name;

[0023] The second secure domain name is a non-DNS covert tunnel domain name determined from the target DNS domain name through the preset convolutional neural network model and the SVD model.

[0024] Optionally, before obtaining the initial DNS domain name and filtering out domain names that meet preset security requirements from the initial DNS domain name to obtain the target DNS domain name, the method further includes:

[0025] Collect DNS traffic information and clean the DNS traffic information to obtain the initial DNS domain name;

[0026] The DNS traffic information includes source IP, source port, destination IP, destination port, traffic label, domain name, record type, resolution result, resolution time, status code, request method, and request time.

[0027] Optionally, feature information of the target DNS domain name is extracted based on the SVM model to determine whether the target DNS domain name is a CDN domain name, including:

[0028] The target DNS domain name is input into the SVM model to obtain the feature information of the target DNS domain name;

[0029] Based on the characteristic information of the target DNS domain name, determine the CDN keyword characteristic information in the characteristic information of the DNS domain name;

[0030] Based on the CDN keyword feature information, determine whether the target DNS domain name is a CDN domain name;

[0031] If the CDN keyword feature information in the feature information of the DNS domain name contains CDN keyword features, then the target DNS domain name is determined to be a CDN domain name.

[0032] If the CDN keyword feature information in the feature information of the DNS domain name does not contain the CDN keyword feature, then the target DNS domain name is determined to be a non-CDN domain name.

[0033] Optionally, if the target DNS domain name is a non-CDN domain name, the target DNS domain name is processed according to a preset convolutional neural network model to obtain the DNS covert tunnel domain name identification result, including:

[0034] The target DNS domain name is processed by character encoding to obtain a multidimensional array of target DNS domain names;

[0035] The target DNS multidimensional array is input into the preset convolutional neural network model to obtain the DNS hidden tunnel domain name identification result.

[0036] Secondly, this application provides a device for detecting DNS covert tunnels, comprising:

[0037] The target DNS domain name acquisition module is used to obtain the initial DNS domain name and filter out the domain names that meet the preset security requirements from the initial DNS domain name to obtain the target DNS domain name. The initial DNS domain name is determined based on DNS traffic information.

[0038] The CDN domain name determination module is used to extract feature information of the target DNS domain name based on the SVM model to determine whether the target DNS domain name is a CDN domain name.

[0039] The DNS hidden tunnel domain name identification module is used to process the target DNS domain name according to a preset convolutional neural network model if the target DNS domain name is a non-CDN domain name, and obtain the DNS hidden tunnel domain name identification result. The preset convolutional neural network model is used to determine whether the target DNS domain name is a DNS hidden tunnel domain name.

[0040] The security information generation module is used to analyze the target DNS domain name based on the DNS covert tunnel domain name identification result, attention mechanism and SVD model, and generate security information. The security information is used to detect DNS covert tunnels, the attention mechanism is used to encode and trace the target DNS domain name, and the SVD model is used to perform secondary domain name identification on the target DNS domain name.

[0041] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0042] The memory stores computer-executed instructions;

[0043] The processor executes computer execution instructions stored in the memory to implement the method described in the first aspect.

[0044] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method described in the first aspect.

[0045] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the method described in the first aspect.

[0046] The DNS covert tunnel detection method, apparatus, equipment, medium, and product provided in this application obtains an initial DNS domain name and filters out domain names that meet preset security requirements from the initial DNS domain name to obtain a target DNS domain name. The initial DNS domain name is determined based on DNS traffic information. Feature information of the target DNS domain name is extracted according to an SVM model to determine whether the target DNS domain name is a CDN domain name. If the target DNS domain name is not a CDN domain name, it is processed according to a preset convolutional neural network model to obtain a DNS covert tunnel domain name identification result. The preset convolutional neural network model is used to determine whether the target DNS domain name is a DNS covert tunnel domain name. Based on the DNS covert tunnel domain name identification result, attention mechanism, and SVD model, the target DNS domain name is analyzed to generate security information. The security information is used to detect DNS covert tunnels. The attention mechanism is used to encode and trace the target DNS domain name. The SVD model is used to perform secondary domain name identification of the target DNS domain name, thereby improving the detection efficiency of DNS covert tunnels. Attached Figure Description

[0047] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0048] Figure 1 A diagram illustrating the detection architecture for the DNS covert tunnel provided in this application;

[0049] Figure 2 A flowchart illustrating an embodiment of the DNS covert tunnel detection method provided in this application;

[0050] Figure 3 A flowchart illustrating Embodiment 2 of the DNS covert tunnel detection method provided in this application;

[0051] Figure 4 A flowchart illustrating Embodiment 3 of the DNS covert tunnel detection method provided in this application;

[0052] Figure 5 A flowchart illustrating Embodiment 4 of the DNS covert tunnel detection method provided in this application;

[0053] Figure 6 A flowchart illustrating Embodiment 5 of the DNS covert tunnel detection method provided in this application;

[0054] Figure 7 A schematic diagram of the structure of the DNS covert tunnel detection device provided in this application;

[0055] Figure 8 A schematic diagram of the structure of the electronic device provided in this application.

[0056] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to specific embodiments. Detailed Implementation

[0057] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0058] In existing technologies, Domain Name System (DNS) covert tunnel attacks have become a major challenge in network security protection. Existing DNS traffic detection methods cannot efficiently filter out high-trust domain names and Content Delivery Network (CDN) service domain names, lack accurate identification of subdomain encoding information, and cannot detect covert tunnel domain names with complex or obfuscated encoding. For detected covert tunnel domain names, there is a lack of effective source tracing analysis and security event generation mechanisms, which makes it difficult to effectively detect and contain DNS covert tunnel attacks.

[0059] To address the aforementioned technical issues, this technical solution proposes a DNS covert tunnel detection method based on Support Vector Machine (SVM), Convolutional Neural Network (CNN), and Singular Value Decomposition (SVD) models. This method rapidly filters out non-target domain names and uses character encoding to transform domain name data into a multi-dimensional array to identify covert tunnel domain names. Simultaneously, it incorporates an attention mechanism to encode and trace the covert tunnel domain names, identifying encoding features under second-level domains. This achieves efficient detection of DNS covert tunnel domain names and generation of security events, solving problems such as low detection accuracy, insufficient feature extraction, and weak source tracing analysis in existing technologies.

[0060] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will be described below with reference to the accompanying drawings.

[0061] Figure 1 This is a diagram illustrating the detection architecture for the DNS covert tunnel provided in this application. Figure 1 As shown, the traffic log, cleaning, and domain name extraction modules are used to obtain DNS traffic logs generated by traffic packet resolution in the live network and perform corresponding processing. The auxiliary filtering module filters out domains from the high-trust domain register. The CDN domain identification module performs secondary filtering on DNS data. The neural network module is used to determine in real time whether a domain is a DNS hidden tunnel domain. The hidden tunnel identification module is used to classify attack encoding for domains identified as malicious, actively trace the source, correlate with overall network situation and intelligence data, and generate security events. Domains identified as legitimate undergo unidirectional communication clustering within a time period, and the SVM model is used for secondary determination of whether there are DNS hidden tunnel domains. Domains identified as secure are added to the high-trust domain register, while domains identified as malicious continue to undergo source tracing processing. The SVD module performs secondary filtering on DNS data to reduce false positives in subsequent DNS hidden tunnel identification.

[0062] Figure 2 This is a flowchart illustrating an embodiment of the DNS covert tunnel detection method provided in this application. Figure 1 As shown, the method may include:

[0063] S201. Obtain the initial DNS domain name and filter out the domain names that meet the preset security requirements from the initial DNS domain name to obtain the target DNS domain name.

[0064] DNS refers to a distributed system that maps Internet domain names to IP addresses, and is used to convert easy-to-remember domain names into IP addresses that computers can recognize.

[0065] The initial DNS domain name refers to the set of original domain names extracted from DNS traffic information, including all domain names that have been requested for DNS resolution.

[0066] The target DNS domain name refers to the set of domain names that need further analysis after filtering out the initial DNS domain names that meet the preset security requirements.

[0067] In this step, DNS traffic logs are first extracted from traffic packets captured from the network environment, including domain name, source IP, destination IP, request time, and resolution result. Then, a high-trust domain list is used to filter out known secure domains. The filtering rules can be: if a domain is a subdomain and meets the whitelist criteria, it is directly filtered; high-trust domains are periodically verified to ensure their security. Finally, DNS domain names are generated for subsequent analysis.

[0068] For example, the acquired DNS traffic information includes all resolution requests (such as domain name, source IP, destination IP, etc.). This DNS traffic information can be passed as input to the auxiliary filtering module to filter out domain names that are unlikely to be hidden tunnels. Hidden tunnel domain names usually contain complex subdomains used to hide sensitive data. Therefore, the auxiliary filtering module can directly remove domain names with simple structures (such as only second-level domains) from the DNS traffic information, thus determining that the domain name is unlikely to contain the encoding information of a hidden tunnel and filtering it directly. In addition, the auxiliary filtering module can filter out domain names in the high-trust domain name register, that is, compare the acquired domain name with the high-trust domain name register. If the domain name exists in the high-trust domain name register, it is filtered. After the above filtering steps, after removing obviously risk-free domain names, the remaining domain names are marked as target DNS domain names and proceed to the next step of analysis.

[0069] S202. Extract the feature information of the target DNS domain name based on the SVM model to determine whether the target DNS domain name is a CDN domain name.

[0070] SVM is a supervised learning algorithm that finds the optimal classification boundary in the feature space for binary or multi-class classification tasks.

[0071] Feature information refers to a numerical vector formed by extracting attribute information (such as domain structure and keyword distribution) of the target DNS domain name.

[0072] CDN domains refer to domains used for content delivery networks. CDN service providers accelerate content delivery by using distributed servers, which usually generates a large number of domains. These domains are generally not malicious, but they may interfere with the detection process in covert tunnel detection.

[0073] In this step, since many CDN domains on the existing network may contain complex and meaningless encoding, but these domains are usually normal and do not constitute covert tunneling behavior, a CDN domain identification model can be designed to reduce false positives for covert tunnel detection caused by meaningless encoded domains. This CDN domain identification model extracts CDN domain feature information, including keyword inclusion features and domain structure features. Keyword inclusion features determine whether the domain contains typical keywords, such as "CDN," while domain structure features are used to extract the hierarchical depth of the domain. Furthermore, the training dataset can be obtained from known access domains on CDN services or from traffic domains on the existing network. The traffic domains on the existing network can be manually verified and classified as either CDN or non-CDN domains. Next, SVM can be chosen as the classification algorithm for the model. By inputting the aforementioned feature vectors (keyword features and structural features) into the SVM model and then using grid search to fine-tune the hyperparameters, the optimal classification model can be obtained.

[0074] Finally, the trained model is used to perform secondary filtering on the target DNS domain name. The filtering logic is as follows: if the model output is a CDN domain name, it is filtered and added to the high-trust domain name register; if the model output is a non-CDN domain name, it is marked as the target DNS domain name and proceeds to the next step of processing.

[0075] This step, by constructing a CDN domain name identification model and using the SVM classification algorithm, can accurately identify and filter CDN domain names, significantly reducing false alarms in subsequent DNS domain name tunnel detection, thereby optimizing the efficiency and accuracy of the detection process.

[0076] S203. If the target DNS domain name is not a CDN domain name, then the target DNS domain name is processed according to the preset convolutional neural network model to obtain the DNS hidden tunnel domain name identification result.

[0077] Among them, the preset convolutional neural network model is a deep learning model that extracts local and global features of data through multi-layer convolutional kernel pooling operations, which can determine whether the target DNS domain name is a DNS hidden tunnel domain name.

[0078] Specifically, the first step is to construct a pre-defined convolutional neural network model dataset, including: establishing a blacklist and whitelist domain training set. Blacklisted domains refer to malicious domains marked as hidden tunnels in the public dataset, while whitelisted domains refer to authoritative, manually verified, and secure domains. Data augmentation: Data augmentation is performed using the public dataset and real traffic data captured from the live network. Records with mapping records and authoritative domains are selected from the real traffic data as whitelisted domains. Data labeling: Secure domains are labeled as θ, and hidden tunnel domains are labeled as 1. Data partitioning: 80% of the data is used for training the pre-defined convolutional neural network model, and 20% is used for testing.

[0079] Secondly, domain name preprocessing is performed, including: subdomain extraction, extracting subdomains from the full domain name; data cleaning, removing black samples without encoded features, removing null values ​​and illegal character domain names, and deduplication to retain unique subdomains. Then, character encoding is performed, which can use a custom encoding method to encode the subdomains into 64-dimensional tensor vectors.

[0080] Next, the convolutional network model is designed. Specifically, the network architecture is designed first, using a four-layer one-dimensional convolutional network with a kernel size of 3. The number of channels in each layer decreases, and each convolution is followed by Batch Normalization and ReLU activation functions. The convolution operation formula is as follows:

[0081]

[0082] Where X represents the input vector, K represents the convolution kernel, and Y represents the output vector.

[0083] For the classification layer, two fully connected linear layers are followed by the convolution to integrate global features, and then the Sigmoid function is used to output the value:

[0084]

[0085] The output value ranges from 0 to 1, representing the domain name classification result. 0 represents a secure domain name, and 1 represents a DNS hidden tunnel domain name.

[0086] Finally, the model is trained and optimized by adjusting the learning rate, regularization parameters, and other parameters to improve its performance.

[0087] This step, through multi-layer feature extraction and optimization using deep convolutional neural networks, can accurately identify DNS hidden tunnel domain names, offering advantages in both high accuracy and lightweight computation.

[0088] S204. Based on the DNS hidden tunnel domain name identification results, attention mechanism and SVD model, analyze the target DNS domain name and generate security information.

[0089] Among them, security information is used to detect DNS covert tunnels, including domain name encoding methods, communication frequencies, and tracing paths, in order to further analyze the behavioral patterns and potential threats of covert tunnel attacks.

[0090] Attention mechanisms are a deep learning technique used to simulate the attention allocation of workers when processing information. They focus on the unique encoding or behavioral characteristics of hidden tunnel domains for the purpose of tracing the encoding of domains.

[0091] The SVD model is a matrix factorization algorithm that can extract important features from domain name log data and perform secondary domain name identification on the target DNS domain by decomposing the DNS communication matrix.

[0092] In this step, based on the analysis of the hidden tunnel domain name identification results, the output of the convolutional neural network model is used as input to further analyze the samples detected as hidden tunnel domain names, which then enter the attention mechanism and SVD model. Next, the attention mechanism is used for encoding and source tracing, and the SVD model is used for secondary domain name identification to generate the final security information. This security information is output in a structured form to facilitate further analysis and response by the security operations team.

[0093] Furthermore, security information includes security incidents and security domains;

[0094] A security event refers to a specific event generated through encoding tracing, behavioral analysis, or secondary identification when a target domain name is identified as a DNS covert tunnel domain name, signifying a potential security threat. Specifically, it includes a first security event and a second security event. The first security event is generated after further tracing and analyzing the encoding characteristics of a covert tunnel domain name directly represented by the DNS covert tunnel domain name identification result, using attention cutoff. The second security event refers to a security event generated after a target domain name is initially identified as a non-covert tunnel domain name, but is re-identified as a covert tunnel domain name after secondary identification using the SVD model, and then the encoding is traced and analyzed using an attention mechanism.

[0095] Specifically, generating the first security event presupposes that the DNS covert tunnel domain identification result directly indicates that the target DNS domain is a covert tunnel domain. For example, processing can be used to trace the encoding of the target DNS domain, analyze whether the subdomain part of the domain contains encoding characteristics, determine the specific type of attack encoding and the information it carries, such as sensitive data or control commands. Then, the first security event is output, including the domain name, encoding type, attack path and potential harm, domain communication frequency, and behavior pattern.

[0096] The prerequisite for generating a second security event is that the DNS covert tunnel domain name identification result indicates that the target DNS domain name is not a covert tunnel domain name, but after secondary identification by the SVD model, it is re-marked as a covert tunnel domain name. For example, the SVD model is used to decompose and analyze the domain name communication matrix, extract covert patterns (such as abnormally high-frequency communication, abnormal data transmission), and then combined with an attention mechanism to identify encoding features and trace the source. Finally, the second security event is output, including the domain name, the communication behavior characteristics and encoding features identified in the secondary identification, and potential attack behaviors.

[0097] By combining DNS covert tunnel domain name identification results, an attention mechanism, and an SVD model, security events are generated for both initial and secondary identification results, significantly improving the depth and accuracy of covert tunnel domain name detection. Specifically, the attention mechanism focuses on encoding source tracing to accurately locate attack characteristics, while the SVD model supplements the capability for secondary verification of complex communication behaviors, ensuring no potential threats are overlooked. Simultaneously, it generates comprehensive security information, providing full support for robust security defense.

[0098] Furthermore, a secure domain name refers to a DNS domain name that meets the preset security requirements and is not identified as a hidden tunnel domain name, including the first secure domain name and the second secure domain name.

[0099] The first security domain name is the CDN domain name identified by the SVM model identification module from the initial DNS domain name.

[0100] The second secure domain name is a non-DNS hidden tunnel domain name determined from the target DNS domain name through a preset convolutional neural network model and SVD model.

[0101] The process of determining the first secure domain name involves identifying CDN domain names through the SVM model. The SVM model extracts N-gram features, keyword inclusion features, and domain structure features from the target DNS domain name. If the keyword inclusion features contain words such as "cdn" or "cloud" that represent CDN services, then the target CDN domain name is considered the first secure domain name and can be added to the list of high-trust domain names.

[0102] The identification of the second secure domain name is determined through deep detection and secondary identification using a pre-set convolutional neural network and an SCD model. The specific process includes: inputting the target DNS domain name (after filtering out CDN domain names) into the pre-set convolutional neural network model for detection, extracting the subdomain portion of the target CDN domain name, and encoding it as a 64-dimensional Tensor vector. Then, the Tensor vector is input into a pre-set four-layer convolutional neural network model for feature extraction and classification. Specifically, the convolutional layers extract local features of the domain name, while the attention mechanism focuses on the encoding information unique to hidden tunnels. The Sigmoid activation function normalizes the output result to 0 or 1, where 0 represents a secure domain name and 1 represents a hidden tunnel domain name. If the CNN detection result is a secure domain name, it is then processed by the SVD model for secondary confirmation.

[0103] The second step involves secondary identification using the SVD model. The communication log data of the target DNS domain is constructed into a communication matrix, where rows and columns represent the source and destination IPs of the communication pair, respectively. The element values ​​of the matrix represent the number of communications, frequency, or other communication behavior indicators. The SVD model is used to decompose the communication matrix, extract features, and then singular value analysis is performed to determine whether the domain's communication behavior is abnormal. If the SVD model confirms that the domain's communication is normal, it is identified as a second-level secure domain, and the non-covert tunnel domain is marked as a second-level secure domain and added to the high-trust domain list.

[0104] The DNS covert tunnel detection method provided in this application combines DNS covert tunnel domain name identification results, an attention mechanism, and an SVD model for analysis. This solution can accurately identify and deeply analyze the characteristics of covert tunnel domain names. It can not only effectively determine whether a domain name carries covert encoding, but also reveal potential threats and associated attack paths through encoding tracing and communication behavior analysis. The attention mechanism focuses on encoding characteristics, improving the ability to discover covert data; the SVD model uses a communication matrix to extract behavioral features, enhancing the detection accuracy of complex anomaly patterns. The resulting structured security information comprehensively covers threat assessment and tracing details, providing efficient and accurate decision support for network security defense while reducing false positives and optimizing security operation and maintenance efficiency.

[0105] Figure 3 This is a flowchart illustrating Embodiment Two of the DNS covert tunnel detection method provided in this application. Figure 3 As shown, in Figure 2 Based on the implementation examples, security events obtained by encoding and tracing the target DNS domain name using an attention mechanism include:

[0106] S301. Based on the attention mechanism, identify the set of subdomains under the same second-level domain in the target DNS domain.

[0107] The subdomain set is a collection of all subdomains extracted from the same second-level domain.

[0108] In this step, an attention mechanism is used to analyze the target DNS domain name, with a focus on subdomains under the same second-level domain. All subdomains under each second-level domain are extracted, and the sets of subdomains under the same second-level domain are output.

[0109] S302. Based on each subdomain set, determine the number of domain name encoding methods in each subdomain set.

[0110] The number of encoding methods refers to the number of various encoding forms contained in the subdomain set, which is used to determine the encoding characteristics of the hidden tunnel.

[0111] In this step, the encoding of subdomains in each subdomain set is identified to determine the encoding method of each subdomain. Common encoding methods include Base32, Base64, and Base128. Then, the number of different encoding methods in each subdomain set is counted and the number of different encoding methods in each subdomain set is output.

[0112] S303. Based on the number of encoding methods and the seven-tuple information, perform source tracing analysis on the target DNS domain name to determine the DNS path information.

[0113] Among them, the seven-tuple information is an important data structure for DNS traffic information, including source IP, destination IP, message sequence number, record type, resolution result, and communication time. The seven-tuple information is used to comprehensively describe the details of DNS communication and can support source tracing analysis.

[0114] DNS path information refers to the domain name resolution path information obtained through source analysis of DNS traffic, including the server addresses of the communicating parties and the resolution process, which helps to determine whether the domain name has hidden tunnel communication behavior.

[0115] In this step, DNS traffic source analysis is performed by combining the number of encoding methods in the subdomain set and the seven-tuple information. A key focus is on analyzing the path information within the DNS traffic, including the DNS servers traversed during domain name resolution, the number of requests, frequency, and communication time between communication pairs. Then, the seven-tuple information is used for correlation analysis to construct the complete domain name resolution path. Finally, the DNS path information of the target DNS domain is output to reveal potential hidden communication behaviors within the traffic.

[0116] S304. Identify hidden tunnels in DNS path information to obtain security events.

[0117] In this step, covert tunneling behavior in traffic can be identified by analyzing DNS path information. Key indicators for judgment include: abnormally high DNS communication frequency, multiple encoding methods within the same subdomain set, and abnormally dense communication frequency or obvious temporal patterns. Based on these indicators, and combined with an attention mechanism to trace the domain name encoding characteristics, it is determined whether the target DNS domain name belongs to covert tunneling communication.

[0118] Finally, the first security event and the second security event are output. If the target DNS domain name is initially identified as a DNS covert tunnel domain name, the security event is obtained by encoding and tracing through the attention mechanism. If the target DNS domain name is identified as a covert tunnel domain name through the SVD model, the security event is generated by further encoding and tracing.

[0119] The DNS covert tunnel detection method provided in this application combines attention mechanism and seven-tuple information to perform in-depth encoding tracing and traffic path analysis on the target DNS domain name, thereby achieving accurate detection of DNS covert tunnel communication and automatically generating security events. It distinguishes covert tunnel domain names from ordinary domain names, providing strong support for network security monitoring.

[0120] Figure 4 This is a flowchart illustrating Embodiment 3 of the DNS covert tunnel detection method provided in this application. Figure 4 As shown, in Figure 2Based on the previous embodiment, before obtaining the target DNS domain name by obtaining the initial DNS domain name and filtering out domain names that meet preset security requirements from the initial DNS domain name, the method further includes:

[0121] S401. Collect DNS traffic information and clean the DNS traffic information to obtain the initial DNS domain name.

[0122] Information cleaning refers to processing DNS traffic information to remove incomplete, duplicate, erroneous, or irrelevant data, ensuring that high-quality, usable initial DNS domain names are obtained.

[0123] Specifically, raw network traffic data can be obtained from the data packets of network monitoring devices. Then, traffic capture tools or DNS traffic resolution tools can be used to extract DNS-related traffic information, extracting key fields from the DNS protocol, including: source IP and source port (to identify the source of the request); destination IP and destination port (to identify the target server); traffic label (to uniquely identify the traffic packet); domain name (to indicate the domain name requested by the client); record type (e.g., A record (IPv4 address resolution)); resolution result (the resolution result returned by the DNS server); resolution time and request time (timestamps recording the traffic request and response); status code (to return the status of whether the request was successful or not), and outputting a complete set of DNS traffic information data for subsequent processing.

[0124] Next, the DMS traffic information is cleaned, including: deduplication to remove duplicate traffic data and ensure the uniqueness of domain name data; invalid data filtering to remove data missing necessary fields or with incorrect formats, such as records lacking domain names or resolution results; illegal data removal to remove domain names containing illegal characters or not conforming to DNS specifications; timestamp filtering to filter DNS request records within a set time window; and extracting the domain name field from valid DNS traffic data as the initial DNS domain name. Finally, the high-quality domain name set after information cleansing can provide input for subsequent filtering and detection processes.

[0125] The DNS covert tunnel detection method provided in this application cleans DNS traffic information, removing invalid and redundant information, thus improving data processing efficiency. Furthermore, the cleaned initial DNS domain name data is accurate and complete, providing a reliable data foundation for subsequent DNS domain name filtering and covert tunnel detection, and reducing the interference of erroneous input on the detection results.

[0126] Figure 5 This is a flowchart illustrating Embodiment 4 of the DNS covert tunnel detection method provided in this application. Figure 5As shown, feature information of the target DNS domain name is extracted based on the SVM model to determine whether the target DNS domain name is a CDN domain name, including:

[0127] S501. Input the target DNS domain name into the SVM model to obtain the characteristic information of the target DNS domain name.

[0128] The process involves inputting the target DNS domain name into a pre-trained SVM model. The SVM model then automatically extracts domain name feature information based on the trained data (including samples of CDN and non-CDN domain names). This extracted feature information includes N-gram features (statistics on consecutive substrings based on domain name characters), keyword inclusion features (detecting whether the domain name contains keywords such as "cdn" or "clou"), and domain structure features (analyzing the domain's hierarchical structure, such as subdomains, main domains, and second-level domains). Finally, it outputs the feature information of the target DNS domain name.

[0129] S502. Based on the characteristic information of the target DNS domain name, determine the CDN keyword characteristic information in the characteristic information of the DNS domain name.

[0130] In this step, keyword features related to CDN services are filtered out from the extracted target DNS domain name feature information. For example, it checks whether the domain name contains preset CDN keyword features, such as "cdn" or "clou". Then, it analyzes the frequency and location of the keywords, such as whether the keywords appear in the subdomain or the main domain. If the detection result contains the keyword "cdn", it is determined to be CDN keyword feature information, and the CDN keyword feature information is output.

[0131] S503. Based on CDN keyword feature information, determine whether the target DNS domain name is a CDN domain name.

[0132] If the CDN keyword feature information in the feature information of the DNS domain name contains the CDN keyword feature, then the target DNS domain name is determined to be a CDN domain name, and the target DNS domain name is marked and added to the list of high-trust domain names.

[0133] If the CDN keyword feature information in the DNS domain name feature information does not contain the CDN keyword feature, then the target DNS domain name is determined to be a non-CDN domain name.

[0134] The DNS covert tunnel detection method provided in this application uses an SVM model to extract features from the target DNS domain name and identify CDN keyword features. This effectively identifies CDN domain names, reduces the false alarm rate, and filters CDN domain names, adding them to the high-trust domain name list. This reduces the computational burden of subsequent modules and ensures that non-CDN domain names can be accurately input into the subsequent detection process, avoiding misjudgment of DNS covert tunnels.

[0135] Figure 6 This is a flowchart illustrating Embodiment 5 of the DNS covert tunnel detection method provided in this application. Figure 6 As shown, if the target DNS domain name is not a CDN domain name, the target DNS domain name is processed according to a preset convolutional neural network model to obtain the DNS hidden tunnel domain name identification result, including:

[0136] S601. Perform character encoding on the target DNS domain name to obtain a multidimensional array of the target DNS.

[0137] In this step, for non-CDN domains, subdomains can be extracted from the target DNS domain. Since the covert tunnel information is mainly encoded in the subdomain portion, the extraction process focuses primarily on the subdomain. The extracted subdomains are then converted into numerical representations. For example, a custom encoding method can be used, mapping each character to a number using ASCII codes, or encoding the characters into fixed-length vectors, such as 64-dimensional Tensor vectors. Finally, the encoded data is organized into a multidimensional array format suitable for the input structure of convolutional neural networks. For instance, one-dimensional character encoding can be expanded into a two-dimensional Tensor format (such as a 64-dimensional array). The final output is a multidimensional array of target DNS data, representing the encoded target DNS domain name data.

[0138] S602. Input the target DNS multidimensional array into the preset convolutional neural network model to obtain the DNS hidden tunnel domain name identification result.

[0139] In this step, the target DNS multidimensional array is input into a pre-defined convolutional neural network model. This model includes an input layer that accepts multidimensional array inputs, such as a 64-dimensional Tensor vector; convolutional layers that extract local features, such as features of hidden tunnel encoding in the domain name; an activation function using ReLU (Modified Linear Unit) to improve the model's non-linear expressive power; batch normalization to prevent overfitting and accelerate training; pooling layers for feature dimensionality reduction to decrease computation; fully connected layers for further processing of the convolutional features, integrating all feature information; and an output layer that uses the Sigmoid function to constrain the output between 0 and 1 for binary classification, where 0 represents a secure domain and 1 represents a DNS hidden tunnel domain.

[0140] The formula for calculating convolution is:

[0141]

[0142] Where X represents the input vector, K represents the convolution kernel, Y represents the output vector, and i represents the element index. Then, the trained convolutional neural network model is used to classify the input target DNS multidimensional array. The output domain classification results include: if the output value is close to 1, it indicates that the domain is a DNS hidden tunnel domain; if the output value is close to 0, it indicates that the domain is a secure domain. Finally, the DNS hidden tunnel domain identification result is output.

[0143] The DNS covert tunnel detection method provided in this application embodiment utilizes the feature extraction capability of a preset convolutional neural network model, which can adapt to different types of covert tunnel domain names, capture covert encoding features in domain names, and achieve high-precision identification of DNS covert tunnels. At the same time, character encoding and convolution operations reduce data complexity, making domain name classification faster.

[0144] Figure 7 This is a schematic diagram of the DNS covert tunnel detection device provided in an embodiment of this application. Figure 7 As shown, the DNS covert tunnel detection device 70 includes:

[0145] The target DNS domain name acquisition module 701 is used to obtain the initial DNS domain name and filter out the domain names that meet the preset security requirements from the initial DNS domain name to obtain the target DNS domain name. The initial DNS domain name is determined based on DNS traffic information.

[0146] The CDN domain name determination module 702 is used to extract feature information of the target DNS domain name based on the SVM model and determine whether the target DNS domain name is a CDN domain name.

[0147] The DNS hidden tunnel domain name identification module 703 is used to process the target DNS domain name according to a preset convolutional neural network model if the target DNS domain name is a non-CDN domain name, and obtain the DNS hidden tunnel domain name identification result. The preset convolutional neural network model is used to determine whether the target DNS domain name is a DNS hidden tunnel domain name.

[0148] The security information generation module 704 is used to analyze the target DNS domain name based on the DNS covert tunnel domain name identification results, attention mechanism and SVD model, and generate security information. The security information is used to detect DNS covert tunnels, the attention mechanism is used to encode and trace the target DNS domain name, and the SVD model is used to perform secondary domain name identification on the target DNS domain name.

[0149] Furthermore, the security information generation module 704 is also specifically used for:

[0150] Security information includes security incidents and security domains;

[0151] Among them, the security event is the first security event obtained by encoding and tracing the target DNS domain name according to the attention mechanism when the DNS covert tunnel domain name identification result indicates that the target DNS domain name is a DNS covert tunnel domain name;

[0152] or,

[0153] The security event is a second security event obtained when the DNS covert tunnel domain name identification result indicates that the target DNS domain name is not a DNS covert tunnel domain name, and the target DNS domain name is identified as a DNS covert tunnel domain name through secondary domain name identification using the SVD model, and the target DNS domain name is encoded and traced according to the attention mechanism.

[0154] Furthermore, the security information generation module 704 is also specifically used for:

[0155] Based on the attention mechanism, identify the set of subdomains under the same second-level domain in the target DNS domain;

[0156] Based on each subdomain set, determine the number of encoding methods for the domains in each subdomain set;

[0157] Based on the number of encoding methods and the seven-tuple information, the target DNS domain name is traced and analyzed to determine the DNS path information;

[0158] Identify hidden tunnels in DNS path information to obtain security events;

[0159] The seven-tuple information is determined based on DNS traffic information and includes the source IP, destination IP, message sequence number, record type, resolution result, and communication time.

[0160] Furthermore, the security information generation module 704 is also specifically used for:

[0161] The first security domain name is the CDN domain name identified by the SVM model from the initial DNS domain name;

[0162] The second secure domain name is a non-DNS hidden tunnel domain name determined from the target DNS domain name through a preset convolutional neural network model and SVD model.

[0163] Furthermore, the target DNS domain name retrieval module 701 is also specifically used for:

[0164] Collect DNS traffic information and clean the DNS traffic information to obtain the initial DNS domain name;

[0165] The DNS traffic information includes source IP, source port, destination IP, destination port, traffic label, domain name, record type, resolution result, resolution time, status code, request method, and request time.

[0166] Furthermore, the CDN domain name determination module is also specifically used for:

[0167] Input the target DNS domain name into the SVM model to obtain the feature information of the target DNS domain name;

[0168] Based on the characteristic information of the target DNS domain name, determine the CDN keyword characteristic information in the characteristic information of the DNS domain name;

[0169] Based on CDN keyword feature information, determine whether the target DNS domain name is a CDN domain name;

[0170] If the CDN keyword feature information in the feature information of the DNS domain name contains the CDN keyword feature, then the target DNS domain name is determined to be a CDN domain name.

[0171] If the CDN keyword feature information in the DNS domain name feature information does not contain the CDN keyword feature, then the target DNS domain name is determined to be a non-CDN domain name.

[0172] Furthermore, the DNS covert tunnel domain name identification module 703 is also specifically used for:

[0173] The target DNS domain name is character encoded to obtain a multidimensional array of the target DNS;

[0174] The target DNS multidimensional array is input into a preset convolutional neural network model to obtain the DNS hidden tunnel domain name identification result.

[0175] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 8 As shown, the electronic device 80 includes:

[0176] The electronic device 80 may include a processor 801 with one or more processing cores, a memory 802 with one or more computer-readable storage media, a communication component 803, and other components. The processor 801, memory 802, and communication component 803 are connected via a bus 404.

[0177] In the specific implementation process, at least one processor 801 executes computer execution instructions stored in memory 802, causing at least one processor 801 to execute the DNS covert tunnel detection method described above.

[0178] The specific implementation process of processor 801 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0179] In the above Figure 8 In the illustrated embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0180] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0181] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0182] In some embodiments, a computer program product is also provided, comprising a computer program or instructions that, when executed by a processor, implement the steps in any of the DNS covert tunnel detection methods described above.

[0183] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0184] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0185] Therefore, embodiments of this application provide a computer-readable storage medium storing a plurality of instructions that can be loaded by a processor to execute the steps in any of the DNS covert tunnel detection methods provided in embodiments of this application.

[0186] The storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0187] Since the instructions stored in the storage medium can execute the steps in any of the DNS covert tunnel detection methods provided in the embodiments of this application, the beneficial effects that any of the DNS covert tunnel detection methods provided in the embodiments of this application can achieve can be realized. For details, please refer to the previous embodiments, which will not be repeated here.

[0188] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0189] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for detecting DNS covert tunnels, characterized in that, include: Obtain the initial DNS domain name, and filter out the domain names that meet the preset security requirements from the initial DNS domain name to obtain the target DNS domain name. The initial DNS domain name is determined based on DNS traffic information. Based on the SVM model, feature information of the target DNS domain name is extracted to determine whether the target DNS domain name is a CDN domain name; If the target DNS domain name is a non-CDN domain name, the target DNS domain name is processed according to a preset convolutional neural network model to obtain the DNS covert tunnel domain name identification result. The preset convolutional neural network model is used to determine whether the target DNS domain name is a DNS covert tunnel domain name. Based on the DNS covert tunnel domain name identification results, attention mechanism, and SVD model, the target DNS domain name is analyzed to generate security information. The security information is used to detect DNS covert tunnels. The attention mechanism is used to encode and trace the source of the target DNS domain name. The SVD model is used to perform secondary domain name identification on the target DNS domain name. The security information includes security events and security domains; The security event is the first security event obtained by encoding and tracing the target DNS domain name according to the attention mechanism when the DNS covert tunnel domain name identification result indicates that the target DNS domain name is a DNS covert tunnel domain name; or, The security event is a second security event obtained when the DNS covert tunnel domain name identification result indicates that the target DNS domain name is a non-DNS covert tunnel domain name, and the target DNS domain name is determined to be a DNS covert tunnel domain name by performing secondary domain name identification on the target DNS domain name through the SVD model; and the target DNS domain name is encoded and traced according to the attention mechanism. The target DNS domain name is encoded and traced using the attention mechanism to obtain security events, including: Based on the attention mechanism, identify the set of subdomains under the same second-level domain in the target DNS domain; Based on each subdomain set, determine the number of encoding methods for the domains in each subdomain set; Based on the number of encoding methods and the seven-tuple information, the target DNS domain name is traced and analyzed to determine the DNS path information; By identifying hidden tunnels in the DNS path information, security events can be obtained. The seven-tuple information is determined based on the DNS traffic information, and the seven-tuple information includes the source IP, destination IP, message sequence number, record type, resolution result, and communication time.

2. The method according to claim 1, characterized in that, The security domain name includes a first security domain name and a second security domain name; The first security domain name is the CDN domain name identified by the SVM model from the initial DNS domain name; The second secure domain name is a non-DNS covert tunnel domain name determined from the target DNS domain name through the preset convolutional neural network model and the SVD model.

3. The method according to claim 1 or 2, characterized in that, Before obtaining the initial DNS domain name and filtering out domain names that meet preset security requirements from the initial DNS domain name to obtain the target DNS domain name, the method further includes: Collect DNS traffic information and clean the DNS traffic information to obtain the initial DNS domain name; The DNS traffic information includes source IP, source port, destination IP, destination port, traffic label, domain name, record type, resolution result, resolution time, status code, request method, and request time.

4. The method according to claim 1 or 2, characterized in that, Based on the SVM model, feature information of the target DNS domain name is extracted to determine whether the target DNS domain name is a CDN domain name, including: The target DNS domain name is input into the SVM model to obtain the feature information of the target DNS domain name; Based on the characteristic information of the target DNS domain name, determine the CDN keyword characteristic information in the characteristic information of the DNS domain name; Based on the CDN keyword feature information, determine whether the target DNS domain name is a CDN domain name; If the CDN keyword feature information in the feature information of the DNS domain name contains CDN keyword features, then the target DNS domain name is determined to be a CDN domain name. If the CDN keyword feature information in the feature information of the DNS domain name does not contain the CDN keyword feature, then the target DNS domain name is determined to be a non-CDN domain name.

5. The method according to claim 1 or 2, characterized in that, If the target DNS domain name is a non-CDN domain name, then the target DNS domain name is processed according to a preset convolutional neural network model to obtain the DNS covert tunnel domain name identification result, including: The target DNS domain name is processed by character encoding to obtain a multidimensional array of target DNS domain names; The target DNS multidimensional array is input into the preset convolutional neural network model to obtain the DNS hidden tunnel domain name identification result.

6. A detection device for DNS covert tunnels, characterized in that, include: The target DNS domain name acquisition module is used to obtain the initial DNS domain name and filter out the domain names that meet the preset security requirements from the initial DNS domain name to obtain the target DNS domain name. The initial DNS domain name is determined based on DNS traffic information. The CDN domain name determination module is used to extract feature information of the target DNS domain name based on the SVM model to determine whether the target DNS domain name is a CDN domain name. The DNS hidden tunnel domain name identification module is used to process the target DNS domain name according to a preset convolutional neural network model if the target DNS domain name is a non-CDN domain name, and obtain the DNS hidden tunnel domain name identification result. The preset convolutional neural network model is used to determine whether the target DNS domain name is a DNS hidden tunnel domain name. The security information generation module is used to analyze the target DNS domain name based on the DNS covert tunnel domain name identification result, attention mechanism and SVD model, and generate security information. The security information is used to detect DNS covert tunnels, the attention mechanism is used to encode and trace the target DNS domain name, and the SVD model is used to perform secondary domain name identification on the target DNS domain name. The security information includes security events and security domains; The security event is the first security event obtained by encoding and tracing the target DNS domain name according to the attention mechanism when the DNS covert tunnel domain name identification result indicates that the target DNS domain name is a DNS covert tunnel domain name; or, The security event is a second security event obtained when the DNS covert tunnel domain name identification result indicates that the target DNS domain name is a non-DNS covert tunnel domain name, and the target DNS domain name is determined to be a DNS covert tunnel domain name by performing secondary domain name identification on the target DNS domain name through the SVD model; and the target DNS domain name is encoded and traced according to the attention mechanism. The security information generation module is specifically used for: Based on the attention mechanism, identify the set of subdomains under the same second-level domain in the target DNS domain; Based on each subdomain set, determine the number of encoding methods for the domains in each subdomain set; Based on the number of encoding methods and the seven-tuple information, the target DNS domain name is traced and analyzed to determine the DNS path information; By identifying hidden tunnels in the DNS path information, security events can be obtained. The seven-tuple information is determined based on the DNS traffic information, and the seven-tuple information includes the source IP, destination IP, message sequence number, record type, resolution result, and communication time.

7. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 5.

9. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 5.

Images