APT attack tracing system and method based on DNS malicious domain name alarm
By using a DNS-based malicious domain name alerting tracing system, combined with timed tracing and delayed query mechanisms, the problem of low efficiency in APT attack tracing in existing technologies has been solved. This system enables efficient and accurate tracing and evidence retention of complex attack paths and is suitable for production-level scenarios in high-traffic environments.
Patent Information
- Application Number
- CN202511660001.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-13
- Publication Date
- 2026-01-13
AI Technical Summary
Existing methods for tracing APT attacks are inadequate in timely detection and complete path reconstruction when faced with threats that are highly covert, long-lasting, and have complex attack paths. They also lack adaptability to unknown threats and are particularly inefficient in large-scale network environments.
A source tracing system based on DNS malicious domain name alerts is adopted, which combines real-time traffic structured parsing and automated backtracking analysis. Through traffic collection and analysis modules, storage modules, and traffic detection and source tracing modules, it realizes the discovery, location, and source tracing analysis of malicious domain name-related attack behaviors. It adopts timed source tracing and delayed query mechanisms, and combines IOC database and Zeek tools to perform multi-dimensional traffic information association and reconstruction.
It improves the accuracy and efficiency of APT attack tracing, can identify malicious traffic in a timely manner, cover covert communication behaviors that are missed by traditional detection timing, reduce false alarm rate and false alarm rate, and support efficient retrieval and real-time tracing in large-scale traffic environments.
Smart Images
Figure CN121333754A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to an APT attack tracing system and method based on DNS malicious domain name alerts, belonging to the field of computer network security technology. Background Technology
[0002] Advanced Persistent Threats (APTs) are a type of cyberattack characterized by their high degree of stealth, deep penetration, long attack cycle, and extreme harm. APT attacks are typically launched by attack groups or hackers, with attackers aiming to steal sensitive information or damage critical infrastructure. They can remain lurking in the target network for extended periods, gradually achieving intrusion and control through multi-stage, chain-like attack paths. Existing APT attack attribution methods (such as network traffic analysis, malware analysis, and log analysis) have significant limitations in practical applications. First, APT attackers often utilize encrypted communication, proxy servers, multi-layered network architectures, and long-term lurking to conceal their tracks, making it difficult for traditional traffic or log analysis to obtain effective clues and reconstruct the complete attack path. Second, in large-scale network environments, massive traffic and log data create storage and computing bottlenecks, resulting in inefficient attribution processes. Furthermore, existing techniques largely rely on known attack characteristics; they are insufficient for detecting and attributing unknown attacks that exploit zero-day vulnerabilities or rapidly change IP addresses, easily leading to attribution failures or the omission of crucial evidence.
[0003] In all stages of an APT attack, the Domain Name System (DNS), as a fundamental service of the internet, plays a crucial role in attack communications. Attackers often utilize malicious domain names to achieve functions such as infection propagation, command and control (C&C), and data backhaul. In the initial stage of an attack, phishing emails or malicious links guide victim hosts to access malicious domain names, thereby triggering the download of malware. In the control and command phase, the controlled host needs to resolve malicious domain names to obtain the IP address of the C&C server, enabling communication with the attacker. Therefore, malicious DNS domain names become an important source of clues for APT attack activities, and monitoring and alerting them can provide crucial support for the timely detection and blocking of attacks.
[0004] Currently, some technologies utilize malicious domain intelligence to achieve basic alerts. For example, by building a malicious domain database, security alerts are issued when DNS resolution requests related to malicious domains are detected. However, these methods rely on static intelligence, making it difficult to promptly cover rapidly changing new malicious domains. Furthermore, they typically remain at the alert level, lacking in-depth analysis and path tracing capabilities for attack behavior. Faced with APT threats that are highly covert, long-lasting, and have complex attack paths, existing methods are insufficient in terms of the timeliness of threat identification, the completeness of attack tracing, and the efficiency of handling large-scale traffic.
[0005] In summary, there is an urgent need to construct an APT attack tracing method based on DNS malicious domain name alerts, combined with real-time traffic structured resolution and automated backtracking analysis mechanisms, in order to achieve efficient detection, complete path reconstruction and evidence preservation of covert and long-term attack behaviors, and improve the system's scalability and adaptability to unknown threats. Summary of the Invention
[0006] To address the shortcomings of existing technologies, this invention provides an APT attack tracing system and method based on DNS malicious domain name alerts. It combines alert-driven, time-series backtracking, and batch parallel retrieval to improve the ability to discover, associate, and trace the source of covert and intermittent APT attacks based on malicious domain names. It is highly efficient, scalable, and has good forensic support capabilities.
[0007] Terminology Explanation: 1. IOC: Indicators of Compromise. These are data objects found on a network or device that can serve as evidence of a suspected system intrusion. Examples include files not belonging to the system directory, suspicious IP addresses, and abnormal DNS records.
[0008] 2. Zeek: Zeek is a powerful open-source network security monitoring and analysis platform widely used in scenarios such as intrusion detection, threat attribution, network forensics, and situational awareness. Zeek not only focuses on traffic extraction and monitoring but also performs in-depth traffic analysis, event logging, and custom script processing.
[0009] 3. Conn Log: The Conn log, also known as the connection log, is a complete record of network connections such as TCP / UDP / ICMP by Zeek. It covers the entire lifecycle information of the connection, including initiation, duration, and termination, and can intuitively present the network interaction relationship between hosts.
[0010] 4. DNS Logs: DNS logs are Zeek's records of DNS protocol interactions. They contain key information such as domain name queries, response results, and resolution servers. They are core data for identifying IOC indicators such as "malicious domains" and "abnormal DNS records".
[0011] The present invention adopts the following technical solution: An APT attack tracing system based on DNS malicious domain name alerts includes a traffic collection and analysis module, a storage module, and a traffic detection and tracing module. The modules interact and link up through standardized interfaces to collaboratively complete the discovery, location, and tracing analysis of malicious domain name-related attack behaviors. The traffic acquisition and analysis module is based on the Zeek tool and is used to passively listen to and perform event-driven parsing of network traffic at network access points or mirror ports. During the traffic acquisition process, it extracts Conn and DNS logs to realize cross-protocol and multi-dimensional traffic information association and reconstruction, and outputs the parsing results to the storage module according to a predefined standard format. The storage module is used to classify and hierarchically manage the collected raw traffic data, known threat intelligence, and identified malicious traffic information; The traffic detection and tracing module is used to periodically search and compare the original traffic database to gradually restore and locate the attack chain.
[0012] Preferably, the storage module includes an IOC database, a raw traffic database, and a malicious traffic database; The IOC database is used to record and maintain known threat intelligence information, including malicious domains, malicious IPs, and IOC identifiers, providing a basis for feature comparison for subsequent malicious traffic identification and alarm analysis; The raw traffic database stores structured network traffic logs output by the Zeek tool, including connection information, DNS request and response, timestamps, host identifiers, etc., and supports scheduled retrieval and source tracing analysis. The raw traffic database includes a raw IP traffic database and a raw DNS traffic database, which are used to store raw IP traffic and raw DNS traffic, respectively. The malicious traffic database is used to record malicious traffic information that hits IOC during the source tracing analysis process, providing data support for attack path reconstruction, lateral movement analysis and evidence collection; the malicious traffic database includes a malicious IP traffic database and a malicious DNS traffic database, which are used to store malicious IP traffic and malicious DNS traffic respectively.
[0013] The storage module of this invention employs classification and hierarchical management, enabling the categorized storage and processing of different types of data, facilitating subsequent queries and analysis. For example, the IOC database can be updated in a timely manner with known threat intelligence information, the raw traffic database can store complete structured network traffic logs, and the malicious traffic database can specifically store malicious traffic records that have hit IOCs. It supports different query / retrieval paths (real-time retrieval vs. offline backtracking), which is beneficial for performance optimization and lifecycle management.
[0014] Preferably, the traffic detection and tracing module includes a timed tracing module and a delayed query module. The timed tracing module is used to periodically search and compare the original traffic database according to a preset time strategy, identify and extract malicious traffic events that hit IOC, and then update the malicious traffic database synchronously. The main function of the delayed query module is to perform a secondary search operation within a delayed time window on the IP address resolved from the "answer" field in malicious DNS traffic. By performing delayed matching and behavior backtracking on IP addresses within a specified time range (e.g., 1-10 minutes), it can effectively identify further communication activities between attackers and downstream IPs using malicious domains, enabling the gradual reconstruction and source tracing of the attack chain.
[0015] A method for tracing APT attacks based on DNS malicious domain name alerts, implemented using the aforementioned APT attack tracing system based on DNS malicious domain name alerts, includes the following steps: (1) Deploy a traffic collection and analysis module to perform real-time parsing and event triggering of traffic, extract Conn and DNS structured log information including timestamp, source IP address, destination IP address, port, host identifier, DNS request and response, and output the parsing results to the storage module in a predefined standard format; (2) The storage module classifies and hierarchically manages the collected data; (3) Construct a traffic detection and tracing module. The timed tracing module executes periodic retrieval tasks according to a preset time strategy, accesses the IOC database to read and update malicious domain name and IP information, and generates an IOC task list based on the IOC information. Based on the IOC task list, construct batch query statements to match and retrieve the original traffic database, and compare the retrieval results with the IOC information one by one. For the hit traffic records, write them into the malicious IP traffic database or malicious DNS traffic database according to the data type, and record the associated IOC identifier and time information for subsequent analysis. The delayed query module is triggered at a preset period (every 5 minutes in this embodiment, which is a configurable parameter) to periodically search the malicious DNS traffic database and filter out DNS log records marked as "malicious" by the timed source tracing module as candidate objects for delayed queries. The delayed query module performs backtracking analysis on DNS traffic that has been marked as malicious. The delayed query module periodically retrieves the malicious DNS traffic database, parses the answer field of each malicious DNS log to extract IP address information, and deduplicates and sorts the extracted results by time to form a malicious IP task list. Each malicious IP task list includes: IP address, associated source DNS log identifier, first discovery time, and delayed query time. Triggered by a preset period (every minute in this embodiment, which is a configurable parameter), the generated IP task list is polled and scheduled. The system determines whether to enter the query process based on the preset lag query time. During the scheduling process, the lag query time of each task in the IP task list is judged one by one: when the preset lag query time of a task is less than or equal to the current system time, the system determines that the IP task has expired and performs a batch query; if the lag time has not yet reached the current time, the IP task is not triggered for the time being, and the system continues to schedule other tasks in the list. For the expired IP task list, the system automatically constructs an efficient batch query statement, calls the batch query statement to search the original IP traffic database, and matches whether there is a traffic record corresponding to the IP in the IP task list. If the query result is not found, the system returns to the task queue to continue to execute other query tasks; if the query result is found, it is written to the malicious IP traffic database and the relevant timestamp and task identification information are recorded to form complete evidence for tracing the APT attack chain.
[0016] Preferably, the lag query time = first discovery time + preset lag query threshold, where the lag query threshold is as follows: T lag = clamp (α⋅TTL+β⋅RTT , T min , T max ) Among them, T lag The lag threshold is indicated in seconds; `clamp()` represents a clamping function used to limit the range of values. Its core function is to constrain the input value between the user-specified minimum threshold (min) and maximum threshold (max), preventing the value from exceeding the preset boundaries. The expression is as follows: clamp(x, min, max) = max(min(x, max), min) Where x is the input value, min is the lower threshold, and max is the upper threshold.
[0017] TTL represents the time, in seconds, that a DNS record in the answer field of a malicious DNS log can remain in the cache; it is mainly used to control the caching time of the record by the client or DNS server, after which a new query must be made to the authoritative server.
[0018] RTT represents the estimated round-trip time, in seconds (obtained through passive observation or probing); α represents the weight of TTL on the lag query threshold; β represents the weight of RTT on the lag query threshold; T min T represents the lower limit threshold for delayed queries; max This indicates the upper limit threshold for delayed queries.
[0019] Preferably, α=0.3, β=5.0, T min = 60 seconds, T max = 600 seconds.
[0020] Preferably, the traffic detection and tracing module employs a multi-threaded parallel processing mechanism to launch scheduled tasks for different purposes, improving tracing efficiency and response speed. Through deduplication, window control, automatic intelligence updates, and fault-tolerant retry mechanisms, the accuracy and stability of the tracing process are ensured. Simultaneously, the associated indexes established in the malicious traffic database support lateral analysis and attack path reconstruction, enabling precise location and auditable traceability of APT attack activities.
[0021] This invention employs a dual mechanism of timed batch source tracing and delayed querying, enabling the source tracing of attacks from different perspectives. Timed source tracing can promptly detect malicious traffic related to known IOCs, while delayed querying, through retrospective analysis of malicious DNS traffic, can uncover more IP addresses and communication behaviors related to the attack, forming a complete chain of attack evidence and improving the comprehensiveness and accuracy of source tracing.
[0022] Based on the TTL and RTT delay strategy, the timing of backtracking is determined according to TTL and RTT. This avoids both querying too early and causing invalid searches, and querying too late and causing missed evidence. It can more accurately associate malicious domains with downstream communication IPs, significantly reducing the false negative rate and false positive rate of source tracing, and forming a closed-loop evidence chain of "domain name-IP-communication link".
[0023] In summary, this invention significantly enhances data management (layered storage), retrieval strategies (timed batch processing + delayed backtracking), intelligent scheduling (dynamic thresholds based on TTL / RTT), task-oriented and parallel processing mechanisms, and attack chain reconstruction capabilities. Furthermore, malicious domain name retrieval is based on a dedicated IOC database for matching, which significantly improves the accuracy and auditability of source tracing while also considering system scalability and resource utilization efficiency. Therefore, this invention is particularly suitable for production-level scenarios requiring offline backtracking and complete attack chain analysis in high-traffic environments.
[0024] For any details not covered in this invention, please refer to the prior art.
[0025] The beneficial effects of this invention are as follows: 1. Improve the accuracy of APT attack tracing: This invention can accurately reconstruct the attack chain by collecting and retrospectively tracing malicious DNS domain name alerts in real time and combining multi-source traffic correlation analysis, which significantly improves the accuracy of APT attack detection and location.
[0026] 2. Improve detection timeliness and coverage: Adopt a two-stage detection strategy of "timed source tracing + delayed query", which can not only identify malicious traffic in the early stage of attack, but also perform secondary backtracking on the IP of the answer field through the delayed window, effectively covering the hidden communication behaviors missed by traditional detection timing.
[0027] 3. Enhance system processing performance: Through multi-process task scheduling and batch query mechanism, efficient retrieval and real-time source tracing are achieved in large-scale traffic environments, significantly reducing single retrieval latency and increasing processing throughput.
[0028] 4. Improve the evidence chain and collaborative protection capabilities: Store and identify records of malicious traffic in a structured manner, and support collaboration with security devices such as threat intelligence databases, firewalls, and SIEMs. This satisfies both pre-emptive warning and in-process detection, as well as post-event evidence collection and response tracing. Attached Figure Description
[0029] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments of this application and their descriptions are used to explain this application and do not constitute an undue limitation of this application.
[0030] Figure 1 This is a schematic diagram of the APT attack tracing system based on DNS malicious domain name alerts according to the present invention; Figure 2 Here is the flowchart for the timed traceability module; Figure 3 This is the flowchart for the delayed query module. Detailed Implementation
[0031] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. However, this is not the only description; all aspects not described in detail herein are based on conventional techniques in the art.
[0032] Example 1 An APT attack tracing system based on DNS malicious domain name alerts, such as Figure 1 As shown, it includes a traffic collection and analysis module, a storage module, and a traffic detection and tracing module. The modules interact and link up through standardized interfaces to collaboratively complete the discovery, location, and tracing analysis of malicious domain-related attack behaviors. The traffic acquisition and analysis module is based on the Zeek tool and is used to passively listen to and perform event-driven parsing of network traffic at network access points or mirror ports. During the traffic acquisition process, it extracts Conn and DNS logs to realize cross-protocol and multi-dimensional traffic information association and reconstruction, and outputs the parsing results to the storage module according to a predefined standard format. The storage module is used to classify and hierarchically manage the collected raw traffic data, known threat intelligence, and identified malicious traffic information; The traffic detection and tracing module is used to periodically search and compare the original traffic database to gradually restore and locate the attack chain.
[0033] Example 2 An APT attack tracing system based on DNS malicious domain name alerts, as described in Example 1, except that the storage module includes an IOC database, a raw traffic database, and a malicious traffic database; The IOC database is used to record and maintain known threat intelligence information, including malicious domains, malicious IPs, and IOC identifiers, providing a basis for feature comparison for subsequent malicious traffic identification and alarm analysis; The raw traffic database stores structured network traffic logs output by the Zeek tool, including connection information, DNS request and response, timestamps, host identifiers, etc., and supports scheduled retrieval and source tracing analysis. The raw traffic database includes a raw IP traffic database and a raw DNS traffic database, which are used to store raw IP traffic and raw DNS traffic, respectively. The malicious traffic database is used to record malicious traffic information that hits IOC during the source tracing analysis process, providing data support for attack path reconstruction, lateral movement analysis and evidence collection; the malicious traffic database includes a malicious IP traffic database and a malicious DNS traffic database, which are used to store malicious IP traffic and malicious DNS traffic respectively.
[0034] The storage module of this invention employs classification and hierarchical management, enabling the categorized storage and processing of different types of data, facilitating subsequent queries and analysis. For example, the IOC database can be updated in a timely manner with known threat intelligence information, the raw traffic database can store complete structured network traffic logs, and the malicious traffic database can specifically store malicious traffic records that have hit IOCs. It supports different query / retrieval paths (real-time retrieval vs. offline backtracking), which is beneficial for performance optimization and lifecycle management.
[0035] Example 3 An APT attack tracing system based on DNS malicious domain name alerts, as described in Example 2, differs in that the traffic detection and tracing module includes a timed tracing module and a delayed query module. The timed tracing module is used to periodically search and compare the original traffic database according to a preset time strategy, identify and extract malicious traffic events that hit IOCs, and then synchronously update the malicious traffic database. The main function of the delayed query module is to perform a secondary retrieval operation within a delayed time window for the IP address resolved from the "answer" field in malicious DNS traffic. By performing delayed matching and behavior backtracking on IP addresses within a specified time range, it can effectively identify further communication activities between attackers using malicious domains and downstream IPs, enabling the gradual reconstruction and source tracing of the attack chain.
[0036] Example 4 A method for tracing APT attacks based on DNS malicious domain name alerts, implemented using the aforementioned APT attack tracing system based on DNS malicious domain name alerts, includes the following steps: (1) Deploy a traffic collection and analysis module to perform real-time parsing and event triggering of traffic, extract Conn and DNS structured log information including timestamp, source IP address, destination IP address, port, host identifier, DNS request and response, and output the parsing results to the storage module in a predefined standard format; (2) The storage module classifies and hierarchically manages the collected data; (3) Construct a traffic detection and tracing module. The timed tracing module executes periodic retrieval tasks according to a preset time strategy, accesses the IOC database to read and update malicious domain name and IP information, and generates an IOC task list based on the IOC information. Based on the IOC task list, construct batch query statements to match and retrieve the original traffic database, and compare the retrieval results with the IOC information one by one. For the hit traffic records, write them into the malicious IP traffic database or malicious DNS traffic database according to the data type, and record the associated IOC identifier and time information for subsequent analysis. The delayed query module is triggered at a preset period (every 5 minutes in this embodiment, which is a configurable parameter) to periodically search the malicious DNS traffic database and filter out DNS log records marked as "malicious" by the timed source tracing module as candidate objects for delayed queries. The delayed query module performs backtracking analysis on DNS traffic that has been marked as malicious. The delayed query module periodically retrieves the malicious DNS traffic database, parses the answer field of each malicious DNS log to extract IP address information, and deduplicates and sorts the extracted results by time to form a malicious IP task list. Each malicious IP task list includes: IP address, associated source DNS log identifier, first discovery time, and delayed query time. Triggered by a preset period (every minute in this embodiment, which is a configurable parameter), the generated IP task list is polled and scheduled. The system determines whether to enter the query process based on the preset lag query time. During the scheduling process, the lag query time of each task in the IP task list is judged one by one: when the preset lag query time of a task is less than or equal to the current system time, the system determines that the IP task has expired and performs a batch query; if the lag time has not yet reached the current time, the IP task is not triggered for the time being, and the system continues to schedule other tasks in the list. For the expired IP task list, the system automatically constructs an efficient batch query statement, calls the batch query statement to search the original IP traffic database, and matches whether there is a traffic record corresponding to the IP in the IP task list. If the query result is not found, the system returns to the task queue to continue to execute other query tasks; if the query result is found, it is written to the malicious IP traffic database and the relevant timestamp and task identification information are recorded to form complete evidence for tracing the APT attack chain.
[0037] Example 5 An APT attack tracing method based on DNS malicious domain name alerts, as described in Example 4, differs in that the delayed query time = initial discovery time + preset delayed query threshold, and the delayed query threshold is as follows: T lag = clamp (α⋅TTL+β⋅RTT , T min , T max ) Among them, T lag The lag threshold is indicated in seconds; `clamp()` represents a clamping function used to limit the range of values. Its core function is to constrain the input value between the user-specified minimum threshold (min) and maximum threshold (max), preventing the value from exceeding the preset boundaries. The expression is as follows: clamp(x, min, max) = max(min(x, max), min) Where x is the input value, min is the lower threshold, and max is the upper threshold.
[0038] TTL represents the time, in seconds, that a DNS record in the answer field of a malicious DNS log can remain in the cache; it is mainly used to control the caching time of the record by the client or DNS server, after which a new query must be made to the authoritative server.
[0039] RTT represents the estimated round-trip time, in seconds (obtained through passive observation or probing); α represents the weight of TTL on the lag query threshold; β represents the weight of RTT on the lag query threshold; T min T represents the lower limit threshold for delayed queries;max This indicates the upper limit threshold for delayed queries.
[0040] In this embodiment, α=0.3, β=5.0, T min = 60 seconds, T max = 600 seconds.
[0041] Example 6 An APT attack tracing method based on DNS malicious domain name alerts, as described in Example 5, includes a flowchart of the timed tracing module as follows. Figure 2 The steps are as follows: Step S100: Start the timed traceability module.
[0042] When the system is running, the timed source tracing module starts automatically and a timed task schedule is set (every 10 minutes in this embodiment, and this period is a configurable parameter) to achieve automated malicious traffic retrieval and source tracing.
[0043] Step S200: Access the IOC database and read the IOC information.
[0044] The timed source tracing module periodically accesses the IOC database to obtain the latest malicious domain and malicious IP threat intelligence information, and generates an IOC task list based on this IOC information.
[0045] Step S300: Construct batch query statements.
[0046] Based on the malicious domain and IP information in the IOC task list, construct efficient batch query statements to quickly match and retrieve data from the original traffic database.
[0047] Step S400: Retrieve the raw traffic database.
[0048] The scheduled source tracing module calls batch query statements to match and retrieve the raw traffic database in the storage module, filtering out traffic log records related to malicious indicators in the IOC task list. The IP task list retrieves the raw IP traffic database; the DNS task list retrieves the raw DNS traffic database.
[0049] Step S500: Comparison and hit processing.
[0050] The search results are compared with the IOC task list one by one. If no match is found, the subsequent query tasks are executed. If a match is found, step S600 is executed.
[0051] Step S600: Write to the malicious traffic database.
[0052] Malicious traffic logs are stored in the malicious traffic database according to a predefined data format; malicious IP logs are written to the malicious IP traffic database; and malicious DNS logs are written to the malicious DNS traffic database. The corresponding IOC identifier and timestamp information are also recorded for subsequent delayed queries and APT attack path tracing analysis.
[0053] Example 7 An APT attack tracing method based on DNS malicious domain name alerts, as described in Example 5, employs a delayed query method. This method, implemented by a delayed query module, performs a delayed backtracking query on the IP addresses resolved from the "answer" field in identified malicious DNS traffic to supplement and reconstruct the attack chain. Figure 3 As shown, the method includes the following steps: Step S700: Start multi-process task processing.
[0054] When the delayed query module starts, it initializes a multi-process task processing mechanism, starting timed task instances for different purposes in parallel to improve processing throughput and response speed.
[0055] In Example 6, step S100, which starts the timed tracing module, is timed task 1; Step S800: Start scheduled task 2—retrieve the malicious DNS traffic database.
[0056] Scheduled task 2 is triggered at a preset period (every 5 minutes in this example, and this period is a configurable parameter) to periodically search the malicious DNS traffic database and filter out DNS log records marked as "malicious" by the scheduled source tracing module as candidates for delayed queries.
[0057] Step S810: Extract information from the “answer” field.
[0058] For each malicious DNS log entry selected, the system parses the `answer` field to extract the IP address information it contains. `answer` (the response section): The DNS server's response to the query, containing DNS records related to the domain name. The `answer` field is the resolution result returned in the DNS response; malicious DNS logs record this field, from which the system extracts the IP address for security analysis and tracing.
[0059] Step S820: Generate a list of malicious IP tasks The extracted IP addresses are deduplicated and arranged in chronological order to form a structured list of malicious IP tasks. The associated source log identifier and timestamp of each task are recorded. Each IP task includes: IP address, associated source DNS log identifier, first discovery time, and delayed query time (delayed query time = first discovery time + preset delayed query threshold).
[0060] Step S900: Start scheduled task 3—to schedule and manage the IP task list.
[0061] The scheduled task 3 is triggered at a preset period (every minute in the embodiment, which is a configurable parameter) to poll and schedule the IP task list generated in step S820, and to determine whether to enter the query process based on the preset lag query time.
[0062] Step S910: Determine if the IP task has expired.
[0063] During the scheduling process, scheduled task 3 checks the lag time for each task in the IP task list. When the preset lag time for a task is less than or equal to the current system time, the system determines that the IP task has expired and proceeds to step S920 for batch querying; if the lag time has not yet reached the current time, the IP task will not be triggered, and the system will continue to schedule other tasks in the list.
[0064] Step S920: Construct batch query statements.
[0065] For the list of expired IP tasks, the system automatically constructs efficient batch query statements to quickly retrieve the original IP traffic database.
[0066] Step S930: Query the raw IP traffic database.
[0067] Call a batch query statement to search the original IP traffic database and match whether there are traffic records corresponding to the IPs in the IP task list.
[0068] Step S940: Determine if a hit has occurred.
[0069] If the query result is not found, the system returns to the task queue to continue executing other query tasks; if the query result is found, the process proceeds to step S950.
[0070] Step S950: Write to the malicious IP traffic database.
[0071] The malicious IP traffic records are written into the malicious IP traffic database, and relevant timestamps and task identification information are recorded to form complete evidence for tracing the APT attack chain.
[0072] The method of this invention can quickly capture the behavioral chain of attackers using domain names and IPs to communicate after a malicious domain name alert is issued, through timed retrieval and delayed backtracking, providing effective technical support for attack discovery, path reconstruction, threat tracking and evidence collection.
[0073] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.
Claims
1. An APT attack tracing system based on DNS malicious domain name alerts, characterized in that, It includes a traffic acquisition and analysis module, a storage module, and a traffic detection and tracing module; The traffic acquisition and analysis module is based on the Zeek tool and is used to passively listen to and perform event-driven resolution of network traffic at network access points or mirror ports. During the traffic acquisition process, it extracts Conn and DNS logs and outputs the resolution results to the storage module in a predefined standard format. The storage module is used to classify and hierarchically manage the collected raw traffic data, known threat intelligence, and identified malicious traffic information; The traffic detection and tracing module is used to periodically search and compare the original traffic database to gradually restore and locate the attack chain.
2. The APT attack tracing system based on DNS malicious domain name alerts according to claim 1, characterized in that, The storage module includes an IOC database, a raw traffic database, and a malicious traffic database; The IOC database is used to record and maintain known threat intelligence information, including malicious domains, malicious IPs, and IOC identifiers; The raw traffic database is used to store structured network traffic logs output by the Zeek tool after parsing, including connection information, DNS request and response, timestamps, and host identifiers; the raw traffic database includes a raw IP traffic database and a raw DNS traffic database, which are used to store raw IP traffic and raw DNS traffic, respectively; The malicious traffic database is used to record malicious traffic information that hits IOC during the source tracing analysis process. The malicious traffic database includes a malicious IP traffic database and a malicious DNS traffic database, which are used to store malicious IP traffic and malicious DNS traffic, respectively.
3. The APT attack tracing system based on DNS malicious domain name alerts according to claim 2, characterized in that, The traffic detection and tracing module includes a timed tracing module and a delayed query module. The timed tracing module is used to periodically search and compare the original traffic database according to a preset time strategy, identify and extract malicious traffic events that hit IOC, and then update the malicious traffic database synchronously. The delayed query module is used to perform delayed matching and behavior backtracking on IP addresses, enabling the gradual reconstruction and source tracing of the attack chain.
4. A method for tracing the source of APT attacks based on DNS malicious domain name alerts, characterized in that, The APT attack tracing system based on DNS malicious domain name alerts as described in claim 3 is implemented by including the following steps: (1) Deploy a traffic collection and analysis module to perform real-time parsing and event triggering of traffic, extract Conn and DNS structured log information including timestamp, source IP address, destination IP address, port, host identifier, DNS request and response, and output the parsing results to the storage module in a predefined standard format; (2) The storage module classifies and hierarchically manages the collected data; (3) Construct a traffic detection and tracing module. The timed tracing module performs periodic retrieval tasks according to a preset time strategy, accesses the IOC database to read and update malicious domain name and IP information, and generates an IOC task list based on the IOC information. A batch query statement is constructed based on the IOC task list to match and retrieve the original traffic database. The retrieval results are then compared with the IOC information one by one. For the matched traffic records, they are written into the malicious IP traffic database or the malicious DNS traffic database according to the data type, and the associated IOC identifier and time information are recorded. The delayed query module is triggered at a preset period to periodically search the malicious DNS traffic database and filter out DNS log records marked as "malicious" by the timed source tracing module as candidates for delayed queries. The delayed query module performs backtracking analysis on DNS traffic that has been marked as malicious. The delayed query module periodically retrieves the malicious DNS traffic database, parses the answer field of each malicious DNS log to extract IP address information, and deduplicates and sorts the extracted results by time to form a malicious IP task list. Each malicious IP task list includes: IP address, associated source DNS log identifier, first discovery time, and delayed query time. Triggered at a preset period, the generated IP task list is polled and scheduled. The system determines whether to enter the query process based on the preset lag query time. During the scheduling process, the lag query time of each task in the IP task list is judged one by one: when the preset lag query time of a task is less than or equal to the current system time, the system determines that the IP task has expired and performs a batch query; if the lag time has not yet reached the current time, the IP task is not triggered for the time being, and the system continues to schedule other tasks in the list. For the list of expired IP tasks, the system automatically constructs a batch query statement and calls the batch query statement to search the original IP traffic database to check if there are traffic records corresponding to the IPs in the IP task list. If the query results do not match, the system returns to the task queue to continue executing other query tasks. If the query results match, they are written to the malicious IP traffic database, and timestamps and task identification information are recorded to form complete evidence for tracing the APT attack chain.
5. The APT attack tracing method based on DNS malicious domain name alerts according to claim 4, characterized in that, Lag query time = first discovery time + preset lag query threshold, where the lag query threshold is as follows: T lag = clamp (α⋅TTL+β⋅RTT , T min , T max ) Among them, T lag `tl.tl.` represents the query latency threshold, in seconds; `clamp()` represents the clamping function, used to limit the range of values; `TTL` represents the time a DNS record in the `answer` field of a malicious DNS log can survive in the cache, in seconds; `RTT` represents the estimated round-trip time, in seconds; `α` represents the weight of `TTL` on the query latency threshold; `β` represents the weight of `RTT` on the query latency threshold; `T` represents the query latency threshold. min T represents the lower limit threshold for delayed queries; max This indicates the upper limit threshold for delayed queries.
6. The APT attack tracing method based on DNS malicious domain name alerts according to claim 5, characterized in that, α=0.3, β=5.0, T min = 60 seconds, T max = 600 seconds.
7. The APT attack tracing method based on DNS malicious domain name alerts according to claim 5, characterized in that, The traffic detection and tracing module uses a multi-threaded parallel processing mechanism to launch scheduled tasks for different purposes.