DNS Attack Detection and Defense System Based on Adversarial Networks

Abstract

This invention discloses a DNS attack detection and defense system based on adversarial networks, belonging to the DNS field. It consists of a data acquisition and feature engineering module, an adversarial sample generation module, a multimodal detection engine module, and a dynamic defense and feedback system. First, the data acquisition and feature engineering module captures and parses DNS traffic in real time, extracting multi-dimensional behavioral features to generate structured feature data, which is then divided into normal samples and attack samples. This data is input into the adversarial sample generation module, which uses a Wasserstein distance-optimized generative adversarial network to create highly deceptive adversarial attack samples. Next, the normal samples and adversarial attack samples are mixed and input into the multimodal detection engine module for fusion analysis, outputting attack probabilities and classification results. Finally, the classification results are transmitted to the dynamic defense and feedback system, which automatically executes various response strategies and simultaneously feeds feedback into the database update system, forming a closed-loop adaptive defense mechanism. This invention improves the accuracy and efficiency of DNS attack detection.

Description

Technical Field

[0001] This invention belongs to the field of DNS (Domain Name System), specifically a DNS attack detection and defense system based on adversarial networks. Background Technology

[0002] There are currently two common methods for detecting DNS attacks:

[0003] One approach is rule-based detection, which identifies anomalous behavior in DNS traffic using predefined rules. For example, it detects abnormal query frequencies or specific types of DNS requests by setting thresholds. However, this method has the following drawbacks:

[0004] 1. Poor adaptability: Rule-based detection methods rely on predefined rules and are difficult to cope with constantly changing attack patterns.

[0005] 2. High false alarm rate: In complex network environments, rules may not be able to accurately distinguish between normal traffic and attack traffic, resulting in a high false alarm rate.

[0006] Another method is based on statistics, which identifies abnormal behavior by analyzing the statistical characteristics of DNS traffic, such as request frequency and response time. However, this method has the following drawbacks:

[0007] 1. High detection latency: Statistical detection methods require the collection of a large amount of data for accurate analysis, resulting in high detection latency.

[0008] 2. Limited ability to detect new types of attacks: Statistical methods may not be able to identify new DNS attack patterns in a timely manner.

[0009] As cyberattacks continue to evolve, DNS attacks are increasingly becoming a significant threat to network security. Traditional DNS attack detection methods struggle to adapt to rapidly changing attack patterns, thus necessitating a novel adversarial detection mechanism to enhance the robustness of DNS defense systems. Summary of the Invention

[0010] To address the problems of low detection accuracy, weak countermeasures, and inability to dynamically respond to new attack behaviors in existing DNS security protection systems, this invention proposes a DNS attack detection and defense system based on adversarial networks. By simulating the game process between attackers and the detection system, the accuracy and efficiency of DNS attack detection are dynamically optimized.

[0011] The DNS attack detection and defense system based on adversarial networks consists of a data acquisition and feature engineering module, an adversarial sample generation module, a multimodal detection engine module, and a dynamic defense and feedback system.

[0012] During system operation, the data acquisition and feature engineering module first captures and parses DNS traffic in real time, extracts multi-dimensional behavioral features, and combines the rule engine, threat intelligence, historical samples and trapping results to initially label the DNS traffic, generate structured feature data, and divide it into two categories: normal samples and attack samples.

[0013] Subsequently, the attack samples and normal samples are fed into the adversarial sample generation module. By introducing a Generative Adversarial Network (GAN) with Wasserstein distance optimization, adversarial attack samples with strong camouflage are constructed from the attack samples.

[0014] Normal samples and adversarial attack samples are treated as mixed samples and input into the multimodal detection engine module. The mixed samples are fused and analyzed using attention mechanisms, convolutional neural networks and temporal models to output attack probabilities and classification results.

[0015] Ultimately, the classification results are transmitted to the dynamic defense and feedback system, which automatically executes response strategies such as BGP blocking and domain name redirection. At the same time, the mixed samples and detection results are fed back into the database for system updates and strategy optimization, forming a closed-loop adaptive defense mechanism.

[0016] The data acquisition and feature engineering module is deployed at the DNS server entry point or network boundary to collect DNS traffic data in real time and perform structured feature extraction and preliminary labeling; it includes a data acquisition layer, a protocol parsing unit, a three-level feature extraction unit, and a hybrid labeling unit.

[0017] Among them, the data acquisition layer is based on FPGA hardware probes to achieve 10Gbps line-speed packet capture;

[0018] The protocol resolution unit uses the DPDK high-performance framework to resolve protocols such as DNS, DoT, and DoH, supports encrypted traffic decryption, and relies on a pre-built CA certificate store.

[0019] The three-level feature extraction unit extracts three types of features based on dimensions: basic features, advanced features, and load features.

[0020] The hybrid annotation unit provides IOC context information based on historical sample databases and threat intelligence sources. It also combines attack traffic captured by spoofed DNS servers to perform preliminary annotation and obtain a 48-dimensional structured feature vector, which is divided into normal samples and attack samples.

[0021] The adversarial sample generation module is designed based on Generative Adversarial Network (GAN), including a generator and a discriminator, and uses Wasserstein distance as the optimization objective to generate adversarial attack samples;

[0022] The generator takes attack samples as input and learns from the attack sample distribution P.s Towards the normal sample distribution P t The optimal projection mapping relationship is obtained to generate adversarial samples with a structure that is approximately normal but retains attack features.

[0023] Generator A θ The training objective of (·) is to minimize the Wasserstein distance between the adversarial attack samples and the normal sample distribution, and its loss function is defined as:

[0024]

[0025] Where x~P s A represents the input sampled from the attack sample distribution. θ (x) represents the generator's projection output onto the attack sample. The Wasserstein distance between the generated adversarial attack sample and the normal sample distribution is minimized by adjusting θ. D(·) is a real-valued function of the discriminator's output.

[0026] The training objective of the discriminator is to maximize the normal sample distribution P. t The Wasserstein distance between the adversarial attack sample distribution and the adversarial sample distribution is used to evaluate the "camouflage" of the adversarial sample, and its loss function is defined as:

[0027]

[0028] Where x′~P t D represents the input sampled from the normal sample distribution. w (·) is the discriminant function that satisfies the 1-Lipschitz constraint. The output value is used to measure the distance between the adversarial attack sample and the normal sample. The Wasserstein distance between the distribution of normal samples and the distribution of adversarial attack samples is maximized by adjusting w. A(x) represents the generator's output result for the attack sample.

[0029] The parameters w of the discriminator and generator are optimized independently of θ. In each training round, the generator parameters θ are first fixed, and the discriminator parameters w are updated through multiple rounds of gradient ascent to maximize the Wasserstein distance. Then, the discriminator parameters w are fixed, and the generator loss function is minimized to guide the generator to learn a mapping strategy that approaches the normal sample distribution. When the Wasserstein distance is less than 0.05, multiple adversarial attack samples, including DNS tunneling attack samples and DDoS samples, are generated. The generated adversarial attack samples are then mixed with normal samples and input into the multimodal detection engine module.

[0030] The multimodal detection engine module performs fusion recognition and attack classification judgment on the input mixed samples; it is specifically divided into an input layer, a feature fusion layer and an output layer, and is equipped with a dynamic threshold adjustment mechanism.

[0031] The input layer receives the 48-dimensional normalized feature vector of the sample and inputs it to the feature fusion layer. A four-head attention mechanism is used to extract key contextual information, while simultaneously combining the spatial structure features F extracted by the CNN. t Time series behavioral features F extracted by GRU s Spatiotemporal features are cross-fused to obtain fused feature F. fusion The fusion process formula is as follows:

[0032]

[0033] This fused feature is then fed into a Softmax classifier to calculate the attack probability score P. attack The attack probability ranges from [0,1], representing the confidence level that the sample is an attack.

[0034] In the real-time detection process, the classification threshold is dynamically adjusted based on the KL divergence of the sliding window data. The adjustment formula is as follows:

[0035] T = T0 + α·D KL (P||Q)

[0036] T0 is the initial threshold value, α is the adjustment factor, and D... KL (P||Q) represents the divergence between the current model output distribution and the normal distribution.

[0037] If the attack probability P attack If the result is greater than or equal to T, the mixed sample is judged to be abnormal; and the detection result is synchronously transmitted to the dynamic defense and feedback system.

[0038] The dynamic defense and feedback system executes automated defense strategies based on detection results and enables the detection system to learn and continuously optimize itself. Upon confirmation of an attack, it automatically issues BGP FlowSpec rules to block malicious domain name resolution; simultaneously, it injects adversarial attack samples into the training set through an online learning mechanism, incrementally updating the detection model weekly.

[0039] The advantages of this invention are:

[0040] 1. This invention provides a DNS attack detection and defense system based on adversarial networks. Through multi-module collaboration, it integrates data collection, feature extraction, adversarial training, intelligent detection, and automatic defense. It has the advantages of automated processing, strong detection capabilities, and good adaptability. It can effectively improve the security protection level of DNS infrastructure and is suitable for attack detection and response scenarios in operator networks, enterprise intranets, and various public DNS service platforms.

[0041] 2. A DNS attack detection and defense system based on adversarial networks, integrating hardware and software: combining FPGA acceleration and DPDK optimization, it solves the bottleneck of high-bandwidth traffic capture and resolution.

[0042] 3. A DNS attack detection and defense system based on adversarial networks, with an adversarial training mechanism based on Wasserstein distance: it adopts optimal transmission theory to generate adversarial samples with higher camouflage, thereby improving the model's defense capability.

[0043] 4. A DNS attack detection and defense system based on adversarial networks, which adopts a detection model that integrates spatiotemporal features: applying a multimodal deep learning model to DNS traffic analysis improves the ability to identify complex attack patterns.

[0044] 5. A DNS attack detection and defense system based on adversarial networks, with an automated and self-learning defense mechanism: an online learning and feedback mechanism is introduced, enabling the system to continuously optimize in the face of new types of attacks. Attached Figure Description

[0045] Figure 1 This is a schematic diagram of a DNS attack detection and defense system based on adversarial networks according to the present invention.

[0046] Figure 2 This is a structural diagram of the multimodal detection engine module used in the system described in this invention;

[0047] Figure 3 This is a flowchart illustrating the practical application of the DNS attack detection and defense system based on adversarial networks according to the present invention. Detailed Implementation

[0048] The specific implementation method of the present invention will be further described in detail below with reference to the accompanying drawings.

[0049] This invention proposes a DNS attack detection and defense system based on adversarial networks. It employs Generative Adversarial Networks (GANs) to generate diverse DNS attack samples, and combines real-time feedback and optimization mechanisms to enable the system to quickly adapt to new attack patterns and improve its ability to detect unknown attacks. This invention offers the following advantages:

[0050] 1. Introduce GAN to generate adversarial examples: simulate new attacks through adversarial training to improve the detection system's ability to identify unknown attacks.

[0051] 2. Dynamically optimize the detection model: optimize the GAN and detection system based on real-time feedback to enhance adaptability.

[0052] 3. Deep learning multi-dimensional analysis of DNS traffic: Combining various DNS features (such as query frequency, TTL value, query domain name pattern, etc.) to improve detection accuracy and reduce false alarm rate.

[0053] The DNS attack detection and defense system based on adversarial networks, such as Figure 1 As shown, it consists of a data acquisition and feature engineering module, an adversarial sample generation module, a multimodal detection engine module, and a dynamic defense and feedback system; through the synergy of real-time traffic analysis, deep learning models, and automated defense strategies, it achieves accurate identification and dynamic handling of attack behaviors.

[0054] During system operation, the data acquisition and feature engineering module first captures and parses DNS traffic in real time, extracting multi-dimensional behavioral features including request frequency, response latency, domain entropy, TTL fluctuations, and packet length. This data, combined with a rule engine, threat intelligence, historical samples, and trapping results, is then used to initially label the DNS traffic, generating structured feature data categorized into normal and attack samples for subsequent modules. This module employs a multi-source fusion approach to labeling, supporting semi-automatic classification under large-scale traffic conditions, and continuously optimizes label accuracy and system self-learning capabilities through a model feedback mechanism.

[0055] Subsequently, the attack samples and normal samples are fed into the adversarial sample generation module. By introducing a generative adversarial network (GAN) with Wasserstein distance optimization, adversarial attack samples with strong camouflage are constructed to enhance the robustness of the downstream detection model.

[0056] Normal samples and adversarial attack samples are input into the multimodal detection engine module. The module uses attention mechanisms, convolutional neural networks and temporal models to fuse and analyze the mixed sample data, outputting attack probabilities and classification results to train the module's detection capabilities.

[0057] Ultimately, the classification results are transmitted to the dynamic defense and feedback system, which automatically executes response strategies such as BGP blocking and domain name redirection. At the same time, the identified adversarial attack samples and detection results are fed back into the database for system updates and strategy optimization, forming a closed-loop adaptive defense mechanism.

[0058] The data acquisition and feature engineering module is deployed at the DNS server entry point or network boundary to collect DNS traffic data in real time and perform structured feature extraction and preliminary labeling; it includes a data acquisition layer (traffic probe), a protocol parsing unit, a three-level feature extraction unit, and a hybrid labeling unit.

[0059] Among them, the data acquisition layer deploys a hardware probe (FPGA-based traffic mirroring) at the DNS server entry point, supporting 10Gbps line-speed packet capture.

[0060] The protocol resolution unit uses the DPDK high-performance framework to resolve protocols such as DNS, DoT, and DoH, optimizes resolution efficiency, supports decryption of DoT / DoH encrypted traffic, and relies on a pre-built CA certificate store.

[0061] The three-level feature extraction unit extracts three types of features based on dimensions: basic features (such as request frequency QPS, response latency, and record type ratio), advanced features (such as domain information entropy and TTL value standard deviation), and payload features (such as message length and subdomain depth).

[0062] o Request frequency: Counts the number of queries per second (QPS) from a single client.

[0063] o Response latency: Calculates the time difference between the request and the response (with μs-level accuracy)

[0064] o Record type distribution: Percentage of A / AAAA / MX records (threshold: A records account for >80% of normal traffic)

[0065] Domain entropy: Information entropy is calculated based on character distribution (formula: H(X) = -P(x)). i log2P(x) i Threshold: >3.5 triggers an alarm.

[0066] o TTL fluctuation analysis: Detects the standard deviation of TTL values ​​(standard deviation > 300 seconds in abnormal scenarios)

[0067] The domain name information entropy value is calculated based on character distribution, and the formula is:

[0068]

[0069] Where H(x) represents the information entropy value of domain name x; x represents the complete domain name string input; x i P(x) represents the i-th unique character in the domain name; i ) represents the character x i The probability of the character appearing in the domain name is the number of times the character appears divided by the total length of the domain name.

[0070] Information entropy reflects the dispersion of a domain name's character distribution. A higher entropy value indicates a more uniform and disordered character distribution, typically meaning the domain may have been automatically generated or contain embedded encoded content (such as Base64). This system sets a threshold of 3.5. If a domain's entropy value H(x) > 3.5, it is marked as a high-risk domain and used as one of the characteristics for judging attack behavior. In addition, abnormal indicators such as TTL fluctuations greater than 300 seconds also trigger suspicious traffic marking.

[0071] o Payload length: Statistical distribution of DNS packet lengths (tunnel attack length > 512B)

[0072] o Subdomain depth: Analyze the hierarchical structure (e.g., abcmalicious.com has a depth of 4).

[0073] The hybrid annotation unit is based on historical sample databases (such as loading CIC-DNS2021 annotation data, with malicious samples covering spam, phishing, and malware) and threat intelligence sources (such as the AlienVault OTX API, which updates IOC metrics hourly). It provides IOC context information and, combined with attack traffic captured by spoofed DNS servers, performs initial annotation to obtain a 48-dimensional structured feature vector, categorized into normal samples and attack samples. See Table 1 for details.

[0074] Table 1

[0075]

[0076]

[0077] The adversarial sample generation module is based on a Generative Adversarial Network (GAN) design, aiming to generate highly disguised adversarial attack samples to enhance the robustness of the detection model. It includes a generator and a discriminator, using Wasserstein distance as the optimization objective to generate adversarial attack samples and improve the alignment between the generated samples and the normal sample distribution.

[0078] The generator employs a multilayer perceptron structure, consisting of three fully connected layers: an input layer (128-dimensional random noise), two hidden layers (sizes 256 and 128 respectively), a LeakyReLU activation function (α = 0.2), and an output layer mapped to a 48-dimensional structured vector, which is then normalized using the Tanh function.

[0079] The generator takes labeled attack samples as input and learns from the attack sample distribution P. s Towards the normal sample distribution P t The optimal projection mapping relationship is obtained to generate adversarial samples with a structure that is approximately normal but retains attack features.

[0080] The generator A θ The training objective of (·) is to minimize the Wasserstein distance between the generated adversarial examples and the normal sample distribution, and its loss function is defined as:

[0081]

[0082] Where x~P s A represents the input sampled from the attack sample distribution. θ (x) represents the generator's projection output onto the attack sample. The Wasserstein distance between the generated adversarial sample and the normal sample distribution is minimized by adjusting θ. D(·) is a real-valued function of the discriminator's output.

[0083] The discriminator is composed of a convolutional neural network (using 3×3 and 5×5 parallel convolutional kernels) combined with an attention mechanism, and outputs a distance score between the adversarial attack sample and the normal sample distribution.

[0084] The discriminator is a real-valued function that satisfies 1-Lipschitz continuity, and its training objective is to maximize the normal sample distribution P. t The Wasserstein distance between the adversarial examples and the distribution generated by the generator is used to evaluate the "camouflage" of the adversarial examples, and its loss function is defined as:

[0085]

[0086] Where x′~P t The input is sampled from the normal sample distribution. D(·) is the discriminant function that satisfies the 1-Lipschitz constraint. The output value is used to measure the distance between the adversarial sample and the normal sample. The Wasserstein distance between the normal sample distribution and the adversarial sample distribution is maximized by adjusting w.

[0087] The parameters w and θ of the discriminator and generator are optimized independently, and an alternating training strategy is adopted during training. In each round of training, the system first fixes the generator parameter θ and performs multiple rounds of gradient ascent to update the discriminator parameter w to maximize the Wasserstein distance; then fixes the discriminator parameter w and minimizes the generator loss function to guide the generator to learn a mapping strategy that approaches the normal sample distribution.

[0088] Unlike traditional adversarial example construction methods that focus on perturbing individual samples, this invention employs an adversarial example generation strategy based on distribution mapping. The core idea is to learn the optimal mapping relationship from the source domain attack sample distribution to the target domain normal sample distribution, thereby generating data that approximates normal traffic in the overall feature space, thus improving the realism and deceptiveness of the generated samples. To achieve this goal, Wasserstein distance is introduced as a metric function to evaluate the difference between the original and target distributions during training. The generator's training objective is to minimize the Wasserstein distance between the generated samples and the normal sample distribution, while the discriminator's training objective is to attempt to maximize this distance, thus constituting a game theory process.

[0089] The adversarial samples generated through the above mechanism approximate normal samples in overall distribution, but retain some key attack features, thus effectively overcoming the detection capabilities of static rules and shallow models. The training convergence criterion is a Wasserstein distance of less than 0.05, generating multiple types of adversarial samples, including DNS tunneling attack samples (such as extremely long subdomains: b64.a1b2.c3d4.[...].exfil.com (length > 63 characters), frequent simulated 600 TXT record queries per minute) and DDoS samples (such as spoofing source IPs: generating random IP addresses conforming to the / 24 network segment distribution, and large-scale concurrent queries: burst traffic reaching 10,000 QPS). The generated adversarial attack samples are then mixed with normal samples and input into the multimodal detection engine module.

[0090] The multimodal detection engine module is used to perform fusion recognition and attack classification judgment on the input mixed samples. The model structure is as follows: Figure 2 As shown, it is specifically divided into an input layer, a feature fusion layer and an output layer, and is equipped with a dynamic threshold adjustment mechanism; it can realize spatiotemporal feature fusion and dynamic threshold adjustment to achieve high-precision attack classification.

[0091] The input layer receives a 48-dimensional feature vector of the sample (normalized to the [0,1] interval), which is then fed into the feature fusion layer. A four-head attention mechanism (4 heads, Key dimension = 64) extracts key contextual information, while simultaneously combining the spatial structure features F extracted by the CNN. t Time series behavioral features F extracted by GRU s Spatiotemporal features are cross-fused to obtain fused feature F. fusion The fusion expression is as follows:

[0092]

[0093] This fused feature is then fed into a Softmax classifier to calculate the attack probability score P. attackThe attack probability ranges from [0,1], representing the system's confidence level that the sample constitutes an attack. The calculation formula is as follows:

[0094]

[0095] Among them, z i z represents the raw score (logit) of the sample in the i-th class (e.g., attack class). j This represents the model output score for all candidate categories j. The Softmax function transforms the model output into values ​​that satisfy probability distribution constraints through exponential mapping and normalization operations, ensuring that the sum of the probabilities of all classification outputs is 1.

[0096] In the real-time detection process, this module processes sliding window data every 5 seconds (window length 300 seconds) and dynamically adjusts the classification threshold based on the KL divergence. The adjustment formula is as follows:

[0097] T = T0 + α·D KL (P||Q)

[0098] T0 is the initial threshold value, α is the adjustment factor, and D... KL (P||Q) represents the divergence between the current model output distribution and the normal distribution.

[0099] If the attack probability P output by the model attack If the mixed sample is ≥T and conforms to the behavior pattern defined in the rule engine (e.g., the NXDOMAIN response ratio is greater than 50%), then the mixed sample is judged to be abnormal; and the detection result is synchronously transmitted to the dynamic defense and feedback system.

[0100] The dynamic defense and feedback system executes automated defense strategies based on detection results and enables the detection system to learn and continuously optimize itself. Upon confirmation of an attack, it automatically issues BGP FlowSpec rules to block malicious domain name resolution; simultaneously, it injects adversarial attack samples into the training set through an online learning mechanism, incrementally updating the detection model weekly.

[0101] This module includes a defense execution unit and a model optimization mechanism: In terms of defense execution, the system supports IP reputation database management; IPs that trigger more than 3 alarms within 10 minutes will be marked as malicious; access filtering policies based on target IPs or UDP port 53 can be quickly deployed via the BGP FlowSpec protocol; for example:

[0102] deny udp any any eq 53to 192.168.1.0 / 24;

[0103] In conjunction with the DNS Sinkhole mechanism, suspicious domain names are resolved to black hole IPs (such as 10.0.0.1), enabling rapid interception. Regarding model optimization, the system supports an online learning mechanism, allowing newly detected attack samples to be injected into the training dataset in real-time within one second. Simultaneously, the system automatically generates 10,000 new adversarial attack samples weekly for incremental training, further enhancing the model's ability to identify new types of attacks. Furthermore, this module introduces a feature importance adjustment mechanism based on SHAP values, dynamically calculating feature weights to enhance the interpretability and continuously optimize the model's discrimination logic. The feature weight calculation formula is:

[0104]

[0105] Among them, f i Let SHAP(f) represent the i-th input feature. i ) represents the SHAP score corresponding to this feature in the current sample prediction, ∑ j SHAP(f j ) represents the sum of the SHAP values ​​of all input features in this sample, w i Representing feature f i The relative importance weights in the model's discrimination logic. Through the above mechanism, the system can dynamically adjust feature sensitivity during model operation, improving the interpretability, controllability, and training stability of the model under different traffic scenarios.

[0106] Example 1:

[0107] In a real-world application scenario, a large enterprise network deployed the DNS attack detection and defense system based on adversarial networks described in this invention. The process is as follows: Figure 3 As shown, the system is installed in front of the enterprise's outbound DNS server and uses mirroring to obtain DNS request traffic in the network in real time as a data source for training and detection.

[0108] In the initial stage of system deployment, the platform was in the pre-training phase. The data acquisition module continuously captured DNS request behavior initiated by various terminals using FPGA hardware probes deployed at the network boundary. The DPDK protocol parsing engine then performed protocol decoding and field extraction on the traffic, refining a 48-dimensional structured feature vector including query frequency, response latency, domain name structure, TTL changes, and encoding features. After initial annotation and denoising, the samples were input into the adversarial sample generation module. A generator based on Generative Adversarial Networks (GANs) constructed adversarial samples, and the training process was optimized using Wasserstein distance to enhance the model's ability to identify complex camouflaged attack samples. Both normal and adversarial samples were used to train the multimodal detection engine and build a preliminary detection model. After completing offline training and model convergence, the system switched to online detection mode.

[0109] In one attack, attackers implanted malicious programs into corporate office terminals and attempted to bypass firewall restrictions using DNS tunneling technology to transfer data outside the company.

[0110] Specifically, the behavior manifests as follows: the terminal continuously sends a large number of TXT queries to the spoofed domain name such as b64.a1b2.c3d4.exfil.com every second, with a request frequency of up to 600 times / second. The domain name structure is complex (the subdomain depth exceeds 5 levels), the requests contain a large amount of Base64 encoded content, and the TTL value is fixed and the response message is empty.

[0111] This system first captures the DNS behavior of the terminal in real time using FPGA hardware probes deployed at the network boundary. After extracting the corresponding structured features, it directly injects them into the pre-trained multimodal detection engine module. The multimodal detection engine utilizes CNN, GRU, and attention mechanisms to extract the spatial structure features and temporal sequence behavior of the input samples. Combined with a Softmax classifier, it outputs an attack probability of 0.91 and triggers subsequent rule matching. This behavior simultaneously meets several preset attack characteristic conditions, including "TXT record ratio greater than 50%, suspected Base64 encoding, high-frequency queries, and deep subdomain hierarchy," and is therefore identified by the system as a DNS tunneling attack. The detection result is fed back to the dynamic defense and feedback module in real time, triggering the following automatic defense measures: blocking the UDP port 53 access of the terminal IP (e.g., 192.168.1.104) via the BGP FlowSpec protocol; simultaneously redirecting the target malicious domain *.exfil.com to the black hole address 10.0.0.1 to interrupt the data channel; and recording the attack event in the system log, which is automatically archived to the visualization management platform.

[0112] Furthermore, the attack sample and its generated adversarial samples are fed back into the training set in real time to support incremental learning of the model. In subsequent training rounds, through an online learning mechanism and SHAP value update process, the weights of features such as "Base64_Pattern" and "Subdomain_Depth" in the model are dynamically increased, further enhancing the ability to detect similar attacks.

[0113] Through the above closed-loop process, the system of the present invention successfully identified and blocked a typical DNS tunneling attack, realizing the entire process from abnormal behavior identification, adversarial sample construction, multimodal detection, to automatic defense and model update, demonstrating the system's intelligence, adaptability and real-time protection capabilities in the actual network environment.

[0114] This invention employs GANs to generate attack samples, improving the detection system's adaptability to unknown attacks; it introduces a real-time detection and feedback mechanism to ensure the system can respond promptly to new attacks. Furthermore, it combines various traffic feature analyses to reduce false alarm rates and improve detection accuracy. It can effectively improve detection rates, reduce false alarms, and enhance defense against new attacks in various DNS attack scenarios.

Claims

1. A DNS attack detection and defense system based on adversarial networks, characterized in that, The system is composed of a data acquisition and feature engineering module, an adversarial sample generation module, a multi-modal detection engine module and a dynamic defense and feedback system. During system operation, the data acquisition and feature engineering module first captures and parses DNS traffic in real time, extracts multi-dimensional behavior features, and combines rule engines, threat intelligence, historical samples and trap results to preliminarily label DNS traffic, generate structured feature data, and divide it into normal samples and attack samples. Then, the attack samples and normal samples are sent to the adversarial sample generation module, which uses a Wasserstein distance optimized generative adversarial network (GAN) to construct adversarial attack samples with strong camouflage. The adversarial sample generation module is designed based on a generative adversarial network (GAN), including a generator and a discriminator, and uses Wasserstein distance as the optimization objective to generate adversarial attack samples. The generator takes the attack sample as input, learns the optimal projection mapping relationship from the attack sample distribution to the normal sample distribution , so as to generate an adversarial sample which is approximately normal in structure but retains the attack characteristics; Generator The training objective is to minimize the Wasserstein distance between the adversarial samples and the normal samples distribution, whose loss function is defined as: ； wherein, denotes an input sampled from the attack sample distribution, denotes the projection output of the generator on the attack sample, by adjusting to minimize the Wasserstein distance between the generated adversarial attack sample and the normal sample distribution, is a real-valued function of the discriminator output; The training objective of the discriminator is to maximize the normal sample distribution the Wasserstein distance between the adversarial attack sample distribution, thereby for evaluating the "disguise" of the adversarial sample, and the loss function is defined as: ； wherein, represents the input sampled from the normal sample distribution, is a discriminant function satisfying the 1-Lipschitz constraint, the output value is used to measure the distance between the adversarial attack sample and the normal sample, and the Wasserstein distance between the normal sample distribution and the adversarial attack sample distribution is maximized by adjusting represents the output result of the generator on the attack sample;​ The parameters of the discriminator and generator and Independent optimization: In each training round, the generator parameters are first fixed. For discriminator parameters Perform multiple rounds of gradient ascent updates to maximize the Wasserstein distance; then fix the discriminator parameters. Minimize the generator loss function to guide the generator to learn a mapping strategy that moves closer to the normal sample distribution; When the Wasserstein distance is less than 0.05, multi-class adversarial attack samples including DNS tunnel attack samples and DDoS samples are generated. The normal samples and adversarial attack samples are input into the multi-modal detection engine module as mixed samples, which relies on attention mechanisms, convolutional neural networks and time series models to analyze the mixed samples and output attack probability scores and classification results. Finally, the classification results are transmitted to the dynamic defense and feedback system, which automatically executes BGP blocking or domain name redirection response strategies, and feeds the mixed samples and detection results back into the database for system updates and strategy optimization, forming a closed-loop adaptive defense mechanism.

2. The adversarial network-based DNS attack detection and defense system of claim 1, wherein, The data acquisition and feature engineering module is deployed at the DNS server entrance or network boundary to collect DNS traffic data in real time and extract and preliminarily label structured features. 3.The adversarial network based DNS attack detection and defense system of claim 1 or 2, wherein, The data acquisition and feature engineering module includes a data acquisition layer, a protocol parsing unit, a three-level feature extraction unit and a mixed labeling unit. The data acquisition layer uses FPGA-based hardware probes to achieve 10Gbps line speed packet capture. The protocol parsing unit uses the DPDK high-performance framework to parse DNS, DoT and DoH protocols, supports encrypted traffic decryption, and relies on a pre-installed CA certificate library. The three-level feature extraction unit extracts three types of features according to dimensions: basic features, advanced features and payload features. The mixed labeling unit provides IOC context information based on the historical sample library and threat intelligence sources, and combines attack traffic captured by the camouflage DNS server to preliminarily label 48-dimensional structured feature vectors into normal samples and attack samples.

4. The adversarial network-based DNS attack detection and defense system of claim 1, wherein, The multi-modal detection engine module performs fusion recognition and attack classification on the input mixed samples; it is specifically divided into an input layer, a feature fusion layer and an output layer, and is equipped with a dynamic threshold adjustment mechanism. The input layer receives the 48-dimensional normalized feature vector of the mixed sample, inputs into the feature fusion layer, extracts key context information through the four-head attention mechanism, and combines the spatial structure features extracted by the CNN with the time series behavior features extracted by the GRU , performs spatio-temporal feature cross fusion to obtain fusion features ; the fusion process formula is as follows: The fusion features are then input into a Softmax classifier to compute the attack probability scores , with values in the range [0, 1], representing the confidence that the mixed sample is an attack. In real-time detection, the classification threshold is dynamically adjusted according to the KL divergence of the sliding window data, and the adjustment formula is: is an initial set threshold value, is an adjustment factor, denotes a divergence between the current model output distribution and the normal distribution; If the attack probability score then the mixed sample is judged as abnormal. 5.The adversarial network based DNS attack detection and defense system of claim 1, wherein, The dynamic defense and feedback system executes an automatic defense strategy according to a detection result, and realizes self-learning and continuous optimization of the detection system; after attack confirmation, a BGP FlowSpec rule is automatically issued to block malicious domain name resolution; meanwhile, through an online learning mechanism, an attack sample is injected into a training set, and a detection model is incrementally updated every week.

Images