Malicious DNS traffic detection method and system based on graph model and multilevel heuristic relationship

Abstract

The invention discloses a malicious DNS flow detection method based on a graph model and a multi-level heuristic relation, and the method comprises the steps: collecting DNS analysis data, extracting a set of domain names, CNAME and IP addresses, obtaining information of second-level domain names, holders, network segments, ASN and operators, extracting resource correlation, category correlation and supplementary correlation among the domain names in a hierarchical manner, and carrying out the detection of the flow of the DNS. Obtaining an association relationship between the domain names; constructing a multi-level association graph by taking the domain name as a vertex and the association relationship as an edge, eliminating special scene interference through sub-graph analysis, and calculating weights of quantizable and non-quantizable edges; and updating the association graphs based on the node labels and the feature vectors, detecting the malicious domain names by adopting at least one graph reasoning algorithm, and fusing classification results of the association graphs at different levels to output a final detection result.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security, and more specifically, to a malicious DNS traffic detection method and system based on a graph model and a multi-level heuristic relationship. Background Art

[0002] The Domain Name System (DNS) is an important infrastructure in the modern Internet. It converts the website domain names accessed by users into IP addresses for establishing connections between clients and website servers. The entire domain name space is a tree structure, starting from the root domain name ".", and then delegating the resolution data downward to top-level domains, such as ".com", ".cn", etc. Similarly, the top-level domains further delegate the resolution data downward to second-level domains, such as "baidu.com". Finally, the entire DNS system is composed of distributed domain name data. When a user accesses an Internet domain name, the client sends a domain name query request to the DNS for query. The entire query process iteratively proceeds downward level by level from the root domain name, and finally returns the IP address of the server corresponding to the domain name. The client uses the IP address to establish a stable connection with the network service. Many network applications and security practices rely on the domain name resolution service provided by the DNS system, such as cloud resource scheduling, certificate authorization, etc. At the same time, the DNS system is also misused by various cybercrime activities, such as phishing, botnets, malware distribution, etc. Domains used for such malicious activities are called malicious domains. Attacks and malicious network activities carried out through malicious domains every year cause huge losses. Therefore, reviewing DNS traffic and performing malicious domain name detection on domain name queries therein have become important means to protect user assets and purify the cyberspace.

[0003] Currently, malicious domain name detection technologies are mainly divided into three types. The first is the detection method based on black / white lists, which blocks connections and access to malicious resources by setting local security policies; the second is the detection method based on machine learning, which extracts attribute features of domain names through feature engineering and then uses machine learning algorithms to classify domain names to identify malicious domain names; the third is the detection method based on deep learning, and representative ones include Convolutional Neural Network (CNN), Long Short-Term Memory Network (LSTM), etc., which can adaptively extract domain name features for classification.

[0004] However, new malicious domains emerge in an endless stream, and technologies for generating new domains, such as domain name generation algorithms and generative adversarial networks, are also constantly evolving, making it difficult for black / white lists to match the update speed of malicious domains. Although black / white list technologies have advantages such as high accuracy and fast speed, they are completely ineffective for newly created malicious domains. Under this premise, technologies based on machine learning or deep learning have good generalization performance for newly emerged malicious domains and can detect newly created malicious domains, becoming a widely used method for malicious domain detection and gradually forming a malicious domain detection paradigm based on learning models.

[0005] Malicious domain detection technologies based on machine learning and deep learning have roughly the same processing flow, mainly including three modules: model training, classification, and continuous training. The model training module contains three main steps: First, collect a large number of Internet domain names as raw data, mark the domain names through malicious domain name blacklists, benign domain name white lists, security detection APIs, etc., and at the same time clean the data to obtain a list of labeled domain names, which contains both malicious domain names and benign domain names. Next, extract the attribute features of the domain names in the list through feature engineering, convert the domain names into feature vectors, and these features are usually designed by security experts and can represent the differences between malicious domain names and benign domain names. Finally, input the feature vectors and domain name labels into a machine learning model or a deep learning model for domain name classification to detect malicious domain names. The classification module contains two processing steps: When a new domain name is input, feature extraction is performed through feature engineering to convert the domain name into a feature vector. Then, use the model trained by the model training module to classify the domain name and output the domain name label. The continuous training module contains exactly the same processing steps as the model training module. When a batch of domain names is input, the continuous training module can be used to detect the domain names and output the domain name labels. After obtaining more domain names with labels, the model can be retrained to continuously iterate, and the overall detection accuracy will be further improved.

[0006] The malicious domain detection technology paradigm based on machine learning or deep learning models well solves the problems of slow update speed and difficult version iteration of black / white lists. Even without updating the model, it can rely on features to a certain extent to identify newly created malicious domain names. However, these two methods also have insurmountable defects. The problems that have not been solved and improved include: Machine learning-based detection methods usually rely on feature engineering for feature extraction and require cumbersome processing of raw data, which is a labor-intensive process.

[0007] The features in the feature extraction step are manually designed by security experts through analyzing existing malicious domain names. At the same time, attackers can also analyze existing malicious domain names and specifically reduce or avoid using these features, thus rendering subsequent detections ineffective. That is, expert features are prone to expiration and invalidation in subsequent detections.

[0008] The detection method based on a deep learning model can adaptively extract domain name features according to the training process, avoiding the cumbersome feature engineering process to a certain extent. However, for newly created malicious domain names that are well camouflaged or not present in the training data, it fails to exhibit good detection capabilities.

[0009] In addition to matching the update speed of new domain names, malicious domain name detection technology also needs to overcome the challenge of limited domain name information. The RFC document stipulates that the maximum length of a single domain name label is 63 characters, the total length of the domain name cannot exceed 255 characters, and the domain name can only use 64 characters including A~Z, a~z, 0~9, "-", and ".". Under the limitations of the limited length and available characters, the information contained in the domain name string itself is very little, and it is very difficult to accurately detect all malicious domain names relying solely on the information contained in the domain name string. This is also the reason why methods based on machine learning and deep learning are difficult to be put into practical use, as they all process each domain name string separately. Therefore, there is an urgent need for more robust evidence information to identify malicious domain names.

[0010] The Chinese invention patent with the application number 202410015525.6 discloses "A Malicious DNS Traffic Detection Method and Device Based on Neural Network". The method includes the steps: S1: Obtain the original DNS data and encode and transform the DNS data stream feature sequence into a vector; S2: Clean the encoded DNS data based on the authoritative whitelist domain name data; S3: Convert the DNS request time series into a frequency domain sequence, perform discrete Fourier transform on each request, and then convert the frequency domain sequence into a power spectral density vector, which represents the intensity of the event occurrence rate at time frequency; S4: After normalizing the power spectral density vector, input it into a convolutional neural network for classification to obtain the result of whether the DNS domain name query is sent by a malicious program. Its technical solution is a detection method based on a whitelist. Although the detection method based on a whitelist has the advantages of high accuracy and fast speed, due to the continuous emergence of new malicious domain names with the help of technologies such as domain name generation algorithms and generative adversarial networks, its update speed is difficult to match, and it is ineffective for detecting newly created malicious domain names. Summary of the Invention

[0011] To solve the technical problems existing in the background art, the present invention provides a malicious DNS traffic detection method and system based on a graph model and multi-level heuristic relationships. The technical solution adopted by the present invention is: The first aspect of the present invention provides a malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship. The method includes: Collect DNS resolution data and extract the sets of domain names, CNAMEs, and IP addresses, obtain the information of second-level domain names, holders, network segments, ASNs, and operators, hierarchically extract the resource correlation, category correlation, and supplementary correlation relationships between domain names, and obtain the association relationships between domain names; Construct a multi-level association graph with domain names as vertices and association relationships as edges, exclude interference from special scenarios through subgraph analysis, and calculate the weights of quantifiable and non-quantifiable edges; Update the association graph based on node labels and feature vectors, use at least one graph inference algorithm to detect malicious domain names, and fuse the classification results of different-level association graphs to output the final detection result.

[0012] As a preferred solution, the method for collecting DNS resolution data and extracting the sets of domain names, CNAMEs, and IP addresses, and obtaining the information of second-level domain names, holders, network segments, ASNs, and operators includes: Collect DNS resolution data and extract the set of domain names; , the set of CNAMEs , the set of IP addresses ; According to the set of domain names obtain all the second-level domain sets included therein , and obtain the set of domain name holders from ICANN or other public data sets ; According to the set of IP addresses that have been extracted, obtain the set of network segments corresponding to the IP addresses , regard IP addresses with the same first 24 bits as the same network segment, obtain the set of ASNs corresponding to the IP addresses , and the set of operators corresponding to the IP addresses .

[0013] As a preferred solution, the method for hierarchically extracting the resource correlation, category correlation, and supplementary correlation association relationships between domain names includes: The method for resource correlation extraction includes: Resource correlation extraction includes: Two different domain names are resolved to the same CNAME, expressed as a triple , where D is the set of domain names, C is the set of CNAMEs, R 1 represents the resolution relationship - a domain name is resolved to a CNAME; or two different domain names are resolved to the same IP address, expressed as a triple , where D is the set of domain names, I is the set of IP addresses, and R2 represents the resolution relationship - a domain name is resolved to an IP address; The methods for extracting category relevance include: Two different domain names have the same second-level domain suffix, represented as a triple , where D is the set of domain names, SLD is the set of second-level domain suffixes, and R3 represents the inclusion relationship between the domain name and the specific suffix; two different domain names are resolved to IP addresses within the same network segment, represented as a triple , where D is the set of domain names, Subnet is the set of network segments corresponding to the set of IP addresses, and R4 represents that the IP address resolved by the domain name belongs to a specific network segment; The methods for extracting supplementary relevance association relationships include: Two different domain names have the same holder, represented as a triple , where D represents the set of domain names, P is the set of holders, and R5 represents the holding relationship of the domain name; two different domain names are resolved to IP addresses with the same ASN, represented as a triple , where D represents the set of domain names, ASN is the set of all ASNs corresponding to the set of IP addresses resolved by the domain name, and R6 represents that the IP address resolved by the domain name belongs to a specific ASN; two different domain names are resolved to IP addresses belonging to the same operator, represented as a triple , where D is the set of domain names, OP is the set of operators corresponding to the set of IP addresses resolved by the domain name, and R7 represents that the IP resolved by the domain name belongs to a certain specific operator.

[0014] As a preferred solution, a method for constructing a multi-level association graph with domain names as vertices and association relationships as edges, excluding interference from special scenarios through subgraph analysis, and calculating the weights of quantifiable and non-quantifiable edges includes: Construct an association graph between domain names based on the association relationships between domain names that have been extracted. Among them, using domain names as the vertices of the graph and the association relationships between domain names as the edges of the graph, a set of 7 domain name association graphs corresponding to the association relationships is obtained , where , V is the set of all domain name vertices, and E i is the set of all edges; Exclude interference from large cloud service providers, registration agents, or resource clusters through subgraph scale analysis; Perform edge weight calculation and update the association graph; The edge weight calculation is divided into: The quantifiable edge weight uses an improved basic value similarity coefficient formula , where represents the intersection of domain name d1 and domain name d2 in relationship R1; The non-quantifiable edge weight is directly set to 0 or 1 according to the actual graph inference algorithm used.

[0015] As a preferred solution, the method for updating the association graph based on node labels and feature vectors includes: Mark domain names based on a public or custom black and white list, and the updated association graph after labeling should be , where , L is the label of node V, representing whether the domain name is a benign or malicious domain name. Usually, 1 represents a malicious domain name, and 0 represents a benign domain name; At the same time, use ASCII encoding or other feature extraction means to extract the features of all domain name vertices and convert them into feature vectors. At this time, the association graph should be , where , where X is the feature vector matrix corresponding to all nodes V.

[0016] As a preferred solution, the graph inference algorithm includes any one or a combination of the following: Based on the marginal probability calculation of the belief propagation algorithm, set the propagation probability from a malicious domain name to a benign / malicious domain name; Generate a graph embedding representation based on LINE and combine it with SVM for classification; Node feature aggregation and classification based on GCN or GAT.

[0017] As a preferred solution, the classification results of different-level association graphs are fused in any of the following ways: Select the majority result based on a voting mechanism; Weighted fusion based on hierarchical weights, where the weights of resource association, category association, and supplementary association decrease in turn.

[0018] As a preferred solution, in the belief propagation algorithm, the propagation probability from a malicious domain name to a benign domain name is set to 0.25, and the propagation probability from a malicious domain name to a malicious domain name is set to 0.75, and the probability value can be dynamically adjusted based on model training.

[0019] The second aspect of the present invention provides a malicious DNS traffic detection system based on a graph model and a multi-level heuristic relationship. The system includes an association relationship extraction module, an association graph construction module, and a detection module; The association relationship extraction module is used to collect DNS resolution data and extract the sets of domain names, CNAMEs, and IP addresses, obtain information such as second-level domain names, holders, network segments, ASNs, and operators, and hierarchically extract the resource correlation, category correlation, and supplementary correlation relationships between domain names to obtain the association relationships between domain names; The association graph construction module is used to construct a multi-level association graph with domain names as vertices and association relationships as edges, exclude special scenario interference through subgraph analysis, and calculate the weights of quantifiable and non-quantifiable edges; The detection module is used to construct a multi-level association graph with domain names as vertices and association relationships as edges, exclude interference from special scenarios through subgraph analysis, and calculate the weights of quantifiable and non-quantifiable edges.

[0020] The third aspect of the present invention provides a computer device, including a storage medium, a processor, and a computer program stored in the storage medium and executable by the processor. When the computer program is executed by the processor, it implements the steps of the foregoing malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship.

[0021] Compared with the prior art, the beneficial effects of the present invention are as follows: By extracting association relationships, constructing an association graph, and applying a graph inference algorithm, the present invention comprehensively considers the association between domain names. When a new malicious domain name appears, it can be confirmed based on the association relationship between the new domain name and the domain names in the existing resource association graph. That is, although an attacker can continuously register new malicious domain names, when deploying these domain names, they cannot update all the resources they hold. Therefore, this method can discover this association as a robust feature for detecting malicious domain names and effectively detect new malicious domain names. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a flowchart of the malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship provided for this embodiment. DETAILED DESCRIPTION The drawings are only for illustrative purposes and cannot be construed as limiting the present invention; It should be clear that the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without creative efforts belong to the scope of protection of the embodiments of the present application.

[0023] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments and are not intended to limit the embodiments of the present application. The singular forms "a", "the", and "said" used in the embodiments of the present application and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0024] When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims. In the description of the present application, it should be understood that the terms "first", "second", "third", etc. are only used to distinguish similar objects, and do not have to be used to describe a specific order or sequence, nor can they be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present application can be understood according to specific circumstances.

[0025] In addition, in the description of the present application, unless otherwise specified, "a plurality" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. The character " / " generally represents an "or" relationship between the associated objects before and after. The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0026] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0027] Embodiment 1 Please refer to Figure 1 , this embodiment provides a malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship. The method includes: S1: Collect DNS resolution data and extract the sets of domain names, CNAMEs, and IP addresses, obtain the information of second-level domain names, holders, network segments, ASNs, and operators, and hierarchically extract the resource correlation, category correlation, and supplementary correlation relationships between domain names to obtain the association relationship between domain names; In a specific embodiment, the method for collecting DNS resolution data and extracting the sets of domain names, CNAMEs, and IP addresses, and obtaining the information of second-level domain names, holders, network segments, ASNs, and operators includes: Collect DNS resolution data and extract the set of domain names; , the set of CNAMEs , the set of IP addresses ; According to the set of domain names obtain all the second-level domain sets included therein , and obtain the set of domain name holders from ICANN or other public data sets ; according to the set of IP addresses that have been extracted, obtain the set of network segments corresponding to the IP addresses , IP addresses with the same first 24 - bit addresses are regarded as belonging to the same network segment, and the ASN set corresponding to the IP addresses is obtained , the operator set corresponding to the IP address .

[0028] In a specific embodiment, the method for hierarchically extracting the resource correlation, category correlation, and supplementary correlation association relationships between domain names includes: The method for resource correlation extraction includes: Resource correlation extraction includes: Two different domain names are resolved to the same CNAME, represented as a triple , where D is the domain name set, C is the CNAME set, R 1 represents the resolution relationship - a domain name is resolved to a CNAME; or two different domain names are resolved to the same IP address, represented as a triple , where D is the domain name set, I is the IP address set, and R2 represents the resolution relationship - a domain name is resolved to an IP address; The method for category correlation extraction includes: Two different domain names have the same second - level domain suffix, represented as a triple , where D is the domain name set, SLD is the second - level domain suffix set, and R3 represents the inclusion relationship between the domain name and the specific suffix; two different domain names are resolved to IP addresses within the same network segment, represented as a triple , where D is the domain name set, Subnet is the network segment set corresponding to the IP address set, and R4 represents that the IP address resolved by the domain name belongs to a specific network segment; The method for supplementary correlation association relationship extraction includes: Two different domain names have the same holder, represented as a triple , where D represents the domain name set, P is the holder set, and R5 represents the holding relationship of the domain name; two different domain names are resolved to IP addresses with the same ASN, represented as a triple , where D represents the domain name set, ASN is the set of all ASNs corresponding to the IP address set resolved by the domain name, and R6 represents that the IP address resolved by the domain name belongs to a specific ASN; two different domain names are resolved to IP addresses belonging to the same operator, represented as a triple , where D is the domain name set, OP is the operator set corresponding to the IP address set resolved by the domain name, and R7 represents that the IP resolved by the domain name belongs to a certain specific operator.

[0029] S2: Construct a multi - level association graph with domain names as vertices and association relationships as edges, exclude the interference of special scenarios through sub - graph analysis, and calculate the weights of quantifiable and non - quantifiable edges; In a specific embodiment, a multi-level association graph is constructed with domain names as vertices and association relationships as edges. The method for excluding interference from special scenarios through subgraph analysis and calculating the weights of quantifiable and non-quantifiable edges includes: Construct an association graph between domain names based on the extracted association relationships between domain names. Among them, use domain names as the vertices of the graph and the association relationships between domain names as the edges of the graph to obtain a set of 7 domain name association graphs corresponding to the association relationships , where , V is the set of all domain name vertices, and E i is the set of all edges; Exclude interference from large cloud service operators, registration agents, or resource clusters through subgraph scale analysis; Perform edge weight calculation and update the association graph; The edge weight calculation is divided into: The quantifiable edge weight uses an improved basic value similarity coefficient formula , where represents the intersection of domain name d1 and domain name d2 in relationship R1; The non-quantifiable edge weight is directly set to 0 or 1 according to the actual graph reasoning algorithm used.

[0030] S3: Update the association graph based on node labels and feature vectors, use at least one graph reasoning algorithm to detect malicious domain names, and fuse the classification results of different-level association graphs to output the final detection result; In a specific embodiment, the method for updating the association graph based on node labels and feature vectors includes: Mark domain names based on public or custom black and white lists, and the updated association graph after labeling should be , where , L is the label of node V, representing whether the domain name is a benign or malicious domain name. Usually, 1 represents a malicious domain name and 0 represents a benign domain name; At the same time, use ASCII encoding or other feature extraction means to extract the features of all domain name vertices and convert them into feature vectors. At this time, the association graph should be , where , where X is the feature vector matrix corresponding to all nodes V.

[0031] In a specific embodiment, the graph reasoning algorithm includes any one or combination of the following: Calculate the marginal probability based on the belief propagation algorithm and set the propagation probability from malicious domain names to benign / malicious domain names; Generate graph embedding representations based on LINE and combine with SVM for classification; Node feature aggregation and classification based on GCN or GAT.

[0032] In a specific embodiment, the classification results of different-level association graphs are fused in any of the following ways: Selecting the majority result based on a voting mechanism; Weighted fusion based on hierarchical weights, where the weights of resource association, category association, and supplementary association decrease in turn.

[0033] In a specific embodiment, in the belief propagation algorithm, the propagation probability from a malicious domain name to a benign domain name is set to 0.25, and the propagation probability from a malicious domain name to a malicious domain name is set to 0.75, and the probability value can be dynamically adjusted based on model training.

[0034] Embodiment 2 Please refer to Figure 1 , this embodiment provides a malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship. The method includes: S1: Collect DNS resolution data and extract the sets of domain names, CNAMEs, and IP addresses, obtain information such as second-level domain names, holders, network segments, ASNs, and operators, and hierarchically extract the resource correlation, category correlation, and supplementary correlation relationships between domain names to obtain the association relationships between domain names; Specifically, collect domain name resolution data, including resolver logs, DNS traffic data, and publicly available PDNS data.

[0035] S2: Construct a multi-level association graph with domain names as vertices and association relationships as edges, exclude interference from special scenarios through subgraph analysis, and calculate the weights of quantifiable and non-quantifiable edges; Specifically, prune the graph structure. The main purpose is to exclude special application scenarios, such as: large cloud service operators, that is, the situation where a large number of domain names are resolved to the same IP; registration agents, that is, the situation where the same person holds a large number of domain names; relationship aggregates formed by huge amounts of resources, that is, resource clusters jointly organized and operated by cloud platforms, video platforms, operators, etc. Specifically, the pruning range can be determined by analyzing the scale of subgraphs in the graph; Specifically, calculate the weights of the edges. Regarding the weight problem of the edges, it should be noted that part of the association relationships extracted in 1.4 can be quantified, such as "domain name 1 - CNAME - domain name 2", "domain name 1 - IP - domain name 2", "domain name 1 - network segment - domain name 2", "domain name 1 - ASN - domain name 2", "domain name 1 - operator - domain name 2"; another part of the relationships cannot be quantified, such as "domain name 1 - second-level domain suffix - domain name 2", "domain name 1 - holder - domain name 2".

[0036] Specifically, for the calculation of the weights of quantifiable association relationships, an improved Jaccard similarity coefficient is adopted, which can be specifically expressed as . Among them Denotes the intersection of domain name d1 and domain name d2 in relation R1. For example, it is the number of elements in the CNMAE set that both domain names can be resolved to. It can be inferred that under this weight formula, the greater the number of repetitions of the association relationship between two domain names, the greater the edge weight between them, and as this value increases, the rate of increase in its weight gradually slows down. This conforms to the objective fact that after the relevance exceeds a certain degree, they can all be called strongly associated without caring about the specific quantitative differences. Update the association graph to obtain a graph set , where , where W i represents the set of edge weights corresponding to relation R i .

[0037] S3: Update the association graph based on node labels and feature vectors, use at least one graph inference algorithm to detect malicious domain names, and fuse the classification results of association graphs at different levels to output the final detection result; Specifically, update the node labels in the graph. Collect black / white lists to mark and filter domain names. Both public black / white lists and internally defined black / white lists within the organization can be used as the basis for domain name marking. The updated association graph should be , where , L is the label of node V, representing whether the domain name is a benign or malicious domain name. Usually, 1 represents a malicious domain name and 0 represents a benign domain name. Optionally, ASCII encoding or other feature extraction means can be used to extract the features of all domain name vertices and convert them into feature vectors. At this time, the association graph should be , where , where X is the feature vector matrix corresponding to all nodes V.

[0038] Optionally, a method based on marginal probability calculation can be used. Its main idea is to infer the states of the remaining nodes with unknown labels based on the domain name nodes with known labels in the graph. The available algorithm is the belief propagation algorithm (BP). This algorithm does not depend on edge weights and vertex features and only needs to use the graph structure and vertex labels to perform the inference task. The initial label of the node with an unknown label will be set to 0.5. At the same time, the propagation probability from a malicious domain name to a benign domain name is set to 0.25, and the propagation probability from a malicious domain name to a malicious domain name is set to 0.75. That is, the probability that a domain name associated with a malicious domain name is malicious is 0.75, and the probability that a domain name associated with a benign domain name is a benign domain name is 0.25. For association graphs at different levels, this probability propagation is not fixed and should be adjusted according to the actual training situation of the model. Finally, after the algorithm runs stably, use an appropriate threshold to screen out malicious domain names. The detection result is denoted as , where y i represents the detection result on the association graph .

[0039] Optionally, a graph reasoning method based on the graph embedding structure can be used. The main idea is to generate the embedding representation of nodes in the graph based on the graph structure, so as to vectorize the graph structure near the nodes, and then use a classification algorithm for classification. The available algorithm is the combination of LINE + SVM. First, the embedding representation of domain name nodes in the relationship graph is generated through the LINE algorithm, and then SVM is used to classify the nodes to detect malicious domain names. This algorithm completely depends on the graph structure and node labels, and optionally uses edge weights. The detection result is denoted as , where y i represents the detection result on the association graph .

[0040] Optionally, a graph reasoning method based on node feature aggregation can be used. The main idea is to propagate node features along the graph structure, update the node feature vectors in the continuous iteration process, and finally use the node feature vectors for node classification to detect malicious domain names. The available algorithms include GCN, GAT and their other variants. Such algorithms need to use the graph structure and node features for reasoning tasks, and optionally use edge weights. The detection result is denoted as , where y i represents the detection result on the association graph .

[0041] Specifically, the classification results of multi-level association graphs are fused. For nodes representing the same domain name on different levels of association graphs, there may be different classification results. Finally, all classification results need to be organically combined to form the final detection result of the domain name. Optionally, a voting-based fusion scheme can be used, that is, the detection result with more votes is selected as the final detection result; or a weight-based fusion scheme can be used. Among the three levels of association relationships, the resource association is the most stable and reliable, the category association is the second, and the supplementary association is the weakest. Therefore, different weights can be designed according to this ranking to fuse all classification results. The final detection result should be

[0042] Embodiment 3 This embodiment provides a malicious DNS traffic detection system based on a graph model and a multi-level heuristic relationship. The system includes an association relationship extraction module, an association graph construction module, and a detection module; The association relationship extraction module is used to collect DNS resolution data and extract the sets of domain names, CNAMEs, and IP addresses, obtain information such as second-level domain names, holders, network segments, ASNs, and operators, and hierarchically extract the resource correlation, category correlation, and supplementary correlation relationships between domain names to obtain the association relationships between domain names; The association graph construction module is used to construct a multi-level association graph with domain names as vertices and association relationships as edges, exclude special scenario interferences through subgraph analysis, and calculate the weights of quantifiable and non-quantifiable edges; The detection module is used to construct a multi-level association graph with domain names as vertices and association relationships as edges, exclude special scenario interferences through subgraph analysis, and calculate the weights of quantifiable and non-quantifiable edges.

[0043] Embodiment 4 A computer device includes a storage medium, a processor, and a computer program stored in the storage medium and executable by the processor. When the computer program is executed by the processor, it implements the steps of the malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship described in Embodiment 1.

[0044] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the present invention, rather than limitations on the implementation manners of the present invention. For those of ordinary skill in the art, other different forms of changes or variations can be made based on the above description. It is not necessary and impossible to enumerate all the implementation manners here. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the claims of the present invention.

Claims

1. A malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship, characterized in that, The method includes: Collect DNS resolution data and extract the sets of domain names, CNAMEs, and IP addresses, obtain information about second-level domain names, holders, network segments, ASNs, and operators, hierarchically extract the resource correlation, category correlation, and supplementary correlation relationships between domain names, and obtain the association relationships between domain names; Construct a multi-level association graph with domain names as vertices and association relationships as edges, exclude interference from special scenarios through subgraph analysis, and calculate the weights of quantifiable and non-quantifiable edges; Update the association graph based on node labels and feature vectors, use at least one graph inference algorithm to detect malicious domain names, and fuse the classification results of different-level association graphs to output the final detection result.

2. The malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship according to claim 1, characterized in that The method for collecting DNS resolution data and extracting the sets of domain names, CNAMEs, and IP addresses, and obtaining information about second-level domain names, holders, network segments, ASNs, and operators includes: Collect DNS resolution data and extract a set of domain names; and a set of CNAMEs and a set of IP addresses ; According to the set of the domain names obtain all the sets of second-level domains included therein , and obtain the set of domain name holders from ICANN or other public data sets ; according to the set of IP addresses that have been extracted, obtain the set of network segments corresponding to the IP addresses , regard the IP addresses with the same first 24-bit addresses as the same network segment, and obtain the set of ASNs corresponding to the IP addresses , the set of operators corresponding to the IP addresses .

3. The malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship according to claim 1, characterized in that The method for hierarchically extracting the resource correlation, category correlation, and supplementary correlation association relationships between domain names includes: The method for extracting resource correlation includes: Resource relevance extraction includes: two different domain names resolved to the same CNAME, represented as a triple , where D is the set of domain names, C is the set of CNAMEs, R 1 represents the resolution relationship - a domain name is resolved to a CNAME; or two different domain names are resolved to the same IP address, represented as a triple , where D is the set of domain names, I is the set of IP addresses, and R2 represents the resolution relationship - a domain name is resolved to an IP address; The method for extracting category correlation includes: Two different domain names have the same second-level domain suffix, represented as a triple , where D is the set of domain names, SLD is the set of second-level domain suffixes, and R3 represents the inclusion relationship between a domain name and a specific suffix; two different domain names are resolved to IP addresses within the same network segment, represented as a triple , where D is the set of domain names, Subnet is the set of network segments corresponding to the set of IP addresses, and R4 represents that the IP address resolved by a domain name belongs to a specific network segment; The method for extracting supplementary correlation association relationships includes: Two different domain names have the same holder, represented as a triple , where D represents the set of domain names, P is the set of holders, and R5 represents the holding relationship of domain names; two different domain names resolved to IP addresses with the same ASN are represented as a triple , where D represents the set of domain names, ASN is the set of all ASNs corresponding to the set of IP addresses resolved by the domain names, and R6 represents that the IP address resolved by the domain name belongs to a specific ASN; two different domain names resolved to IP addresses belonging to the same operator are represented as a triple , where D is the set of domain names, OP is the set of operators corresponding to the set of IP addresses resolved by the domain names, and R7 represents that the IP resolved by the domain name belongs to a certain specific operator 4. The malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship according to claim 1, characterized in that The method for constructing a multi-level association graph with domain names as vertices and association relationships as edges, excluding interference from special scenarios through subgraph analysis, and calculating the weights of quantifiable and non-quantifiable edges includes: Construct an association graph between domain names based on the extracted association relationships between domain names. Among them, use domain names as the vertices of the graph and the association relationships between domain names as the edges of the graph to obtain 7 domain name association graph sets corresponding to the association relationships , where , V is the set of all domain name vertices, and E i is the set of all edges; Exclude interference from large cloud service providers, registration agents, or resource clusters through subgraph scale analysis; Perform edge weight calculation and update the association graph; The edge weight calculation is divided into: The quantifiable edge weight adopts an improved basic value similarity coefficient formula , where represents the intersection of domain name d1 and domain name d2 in relation R1; The weight of non-quantifiable edges is directly set to 0 or 1 according to the actually used graph inference algorithm.

5. The malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship according to claim 1, characterized in that The method for updating the association graph based on node labels and feature vectors includes: Mark the domain names based on the public or custom black and white lists. The associated graph after updating the labels should be , where , L is the label of node V, representing whether the domain name is a benign or malicious domain name. Usually, 1 represents a malicious domain name and 0 represents a benign domain name; Extract the features of all domain name vertices using ASCII encoding or other feature extraction means simultaneously, and convert them into feature vectors. At this time, the associated graph should be , where , where X is the feature vector matrix corresponding to all nodes V.

6. The malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship according to claim 1, characterized in that, The graph inference algorithm includes any one or combination of the following: Calculate the marginal probability based on the belief propagation algorithm and set the propagation probability from malicious domain names to benign / malicious domain names; Generate graph embedding representations based on LINE and combine with SVM for classification; Node feature aggregation and classification based on GCN or GAT.

7. The malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship according to claim 1, characterized in that The classification results of different-level association graphs are fused in any of the following ways: Select the majority result based on the voting mechanism; Weighted fusion based on hierarchical weights, where the weights of resource association, category association, and supplementary association decrease in sequence.

8. The malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship according to claim 6, characterized in that, In the belief propagation algorithm, the propagation probability from malicious domain names to benign domain names is set to 0.25, and the propagation probability from malicious domain names to malicious domain names is set to 0.75, and the probability values can be dynamically adjusted based on model training.

9. A malicious DNS traffic detection system based on a graph model and multi-level heuristic relationships, characterized in that The system includes an association relationship extraction module, an association graph construction module, and a detection module; The association relationship extraction module is used to collect DNS resolution data and extract the sets of domain names, CNAMEs, and IP addresses, obtain information about second-level domain names, holders, network segments, ASNs, and operators, hierarchically extract the resource correlation, category correlation, and supplementary correlation relationships between domain names, and obtain the association relationships between domain names; The association graph construction module is used to construct a multi-level association graph with domain names as vertices and association relationships as edges, exclude interference from special scenarios through subgraph analysis, and calculate the weights of quantifiable and non-quantifiable edges; The detection module is used to construct a multi-level association graph with domain names as vertices and association relationships as edges, exclude special scenario interferences through subgraph analysis, and calculate the weights of quantifiable and non-quantifiable edges.

10. A computer device, characterized in that: It includes a storage medium, a processor, and a computer program stored in the storage medium and executable by the processor. When the computer program is executed by the processor, it implements the steps of the malicious DNS traffic detection method based on a graph model and a multi-level heuristic relationship as described in any one of claims 1 to 8.

Images