Malicious domain name identification system and method based on DNS collision
By using proactive DNS collision detection and high-confidence verification based on AI analysis modules, malicious domain names can be identified and traced. This solves the problems of lag in dynamic domain name identification and encrypted traffic in existing technologies, enabling early detection and accurate identification of malicious domain names and improving the defense capabilities of the defense system.
Patent Information
- Application Number
- CN202511806943.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-03
- Publication Date
- 2026-02-24
AI Technical Summary
Existing technologies are insufficient to effectively identify and defend against malicious domains that dynamically change their domain names, and they fail in the face of encrypted traffic. They lack proactive detection and high-confidence verification methods and cannot detect malicious infrastructure hidden behind public IP addresses in advance.
A malicious domain name identification system based on DNS collision is adopted. By actively probing and generating fake domain names and resolving IP addresses, combined with an AI judgment module for high-confidence verification, malicious domain names are discovered and traced using DNS collision, thus constructing a new paradigm for malicious domain name identification and tracing.
It enables early detection and accurate identification of malicious domains, reduces false positive rates, enhances the resilience of the defense system and the cost of attacks, and combats advanced persistent threats.
Smart Images
Figure QLYQS_1 
Figure QLYQS_2 
Figure QLYQS_5
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and specifically to a malicious domain name identification system and method based on DNS collision. Background Technology
[0002] In the field of cybersecurity, malicious domain names are a key link in the cyberattack chain, widely used in attacks such as botnet command and control, phishing, malware distribution, and data breaches. To evade detection, attackers commonly employ techniques such as domain name generation algorithms and rapid traffic switching to dynamically alter the mapping relationship between their malicious domain names and servers, making static blacklist-based defenses increasingly ineffective.
[0003] Currently, the industry mainly relies on the following existing technologies for the identification and defense against malicious domain names: 1. Detection method based on static threat intelligence database: This method matches and blocks malicious domains by maintaining and querying a blacklist containing known malicious domains. Its core flaw lies in its severe lag. It is completely ineffective against malicious domains that are appearing for the first time or have not yet been included in the blacklist (i.e., "zero-day" malicious domains). Attackers can bypass such defenses simply by registering new domains.
[0004] 2. Detection methods based on domain behavior and machine learning models: This method analyzes domain registration information, resolution patterns (frequent changes in TTL values, scattered IP addresses, etc.), and domain name characteristics, using a machine learning model to determine their maliciousness. While this method can detect unknown threats to some extent, it suffers from high false positive rates and easily circumvented features. Attackers can deceive the model by mimicking the behavior of legitimate domains, and the model's training quality is highly dependent on the completeness and accuracy of the labeled data.
[0005] 3. Methods based on deep packet inspection of network traffic: This method identifies malicious communications by deeply analyzing the content characteristics of network traffic packets (HTTP headers, SSL certificate information, payload features, etc.). However, with the widespread adoption of encryption protocols such as HTTPS, the effectiveness of this method is being seriously challenged. Encrypted traffic prevents DPI from obtaining effective content characteristics, leading to a significant decrease in detection capabilities.
[0006] 4. Passive DNS traffic analysis method: This method identifies anomalous patterns and correlations by collecting and analyzing a large number of DNS query and response records. However, it is essentially a passive response mechanism, relying on the attack activity having already occurred and generated a certain scale of traffic, making it difficult to detect and warn in the early stages of an attack.
[0007] In summary, existing technologies generally suffer from problems such as lag, high false positive rates, ease of circumvention, and ineffectiveness in the face of encrypted traffic. Their fundamental flaw lies in the fact that most of them rely on "retroactive" analysis based on observed attack traffic or domain names themselves, lacking an effective means to proactively and proactively discover malicious infrastructure hidden behind public IP addresses that is not yet active or carefully disguised.
[0008] Current technologies have not effectively utilized the following key insight: Many malicious servers, during initial deployment or for redundancy, bind their public IP addresses to multiple backup domains simultaneously. These domains are likely to be in a low-access state most of the time, not directly resolving to malicious IPs, thus circumventing traditional reverse IP lookup detection. Existing technologies lack a systematic approach to utilizing this principle for malicious domain discovery and correlating it with actual network traffic to form a closed-loop threat hunting strategy. Summary of the Invention
[0009] This invention aims to provide a malicious domain name identification system and method based on DNS collision. This system and method organically combine "active detection" and "high confidence verification" to construct a brand-new paradigm for malicious domain name identification and tracing. It can effectively discover and trace the most hidden and cunning advanced persistent threats, filling a major gap in the existing technology system.
[0010] The technical solution of the present invention is as follows: The malicious domain name identification system based on DNS collision includes a data collection module, an active domain name resolution module, a data cleaning and sorting module, a preliminary matching and filtering module, an AI judgment module, and a storage module. The data acquisition module is used to actively collect and passively receive DNS access record data and transmit it to the system's data receiving buffer. The active domain name resolution module is used to actively access the domain name in the DNS access record data, make active query requests through the DNS service, resolve and obtain its IP address, and then input the domain name information and IP address into the data cleaning and processing module. The data cleaning and organizing module is used to clean and organize the acquired DNS access record data to obtain cleaned data; The preliminary matching and screening module compares the cleaned data with the malicious data in the IOC intelligence database in the storage module. If the data is in the IOC intelligence database, it is listed as blacklisted data and sent to the AI analysis module for further judgment. The AI analysis module first calculates the preliminary similarity by assigning weights; then, based on the similarity attribution formula and the confidence assessment formula, it calculates the similarity of the blacklist data and obtains the judgment result through confidence calculation, ultimately identifying whether it is malicious domain name data.
[0011] The data collection module collects the following recorded data: log streams of recursive DNS servers, DNS packets in network traffic mirrors, public or commercial threat intelligence platforms, and DNS query records generated by enterprise internal network devices.
[0012] The data acquisition module employs two methods for data acquisition: real-time acquisition from backbone nodes and offline import of pcap data packets.
[0013] The active domain name resolution module generates several pseudo domain names in batches using the domain name generation algorithm DGA. Using these pseudo domain names, an access request is sent to the domain name in the DNS access record data through the DNS service xian. The IP address of the response is resolved and obtained. The IP address is then associated with the domain name in the DNS access record data and input into the data cleaning and sorting module.
[0014] The data cleaning and processing module includes the following processes: Remove duplicate data from the DNS access record data, then standardize all data formats; extract the root domain name and IP address from the data format, correct logical errors, and delete incomplete records.
[0015] The preliminary matching and filtering module compares the cleaned root domain name and IP address with malicious data in the IOC intelligence database. If the root domain name or IP address is recorded in the IOC intelligence database, it is listed as blacklisted data and sent to the AI analysis module for further judgment. If the root domain name is not included in the IOC intelligence database, but the IP address is included in the IOC intelligence database, then the root domain name is included in the IOC intelligence database.
[0016] The AI analysis module uses the QWEN model launched by Alibaba Tongyi.
[0017] The process of calculating the preliminary similarity based on weight assignment in the AI judgment module is as follows: Malicious domain association score, weight 0.4; Analyze the association between IP addresses and malicious IP addresses, with a weight of 0.3; Domains registered within the last 45 days are considered high-risk, with a weight of 0.2.
[0018] Domain name character pattern: The presence of meaningless characters and consecutive characters longer than 8 'w' indicates high risk, with a weight of 0.1; Calculate the similarity of the above four feature categories respectively: the value is 0-1, 1 is a perfect match and 0 is a complete mismatch, as shown in the following formula: Total similarity = (Feature 1 similarity × 0.4) + (Feature 2 similarity × 0.3) + (Feature 3 similarity × 0.2) + (Feature 4 similarity × 0.1).
[0019] In the AI analysis module, the similarity attribution formula is: (1) (2) Let the attack entity vector v be the template of the j-th malicious domain. The similarity; θ is the attribution threshold.
[0020] In the AI judgment module, the confidence assessment formula is: (3) in, For the characteristics of the k-th type of data source, The dynamic weights of the k-th type of data source. This is the Sigmoid function.
[0021] It also includes a graphical interface display module, which is used to display the final recognition results of the AI judgment module in real time, so that operators can grasp the real-time situation and make manual intervention when necessary.
[0022] The information displayed may include the following: top malicious domains, most affected client IPs, and threat type distribution.
[0023] The malicious domain name identification system based on DNS collision of the present invention applies the above-mentioned malicious domain name identification system based on DNS collision, and includes the following steps: A. The data acquisition module actively collects and passively receives DNS access record data, and transmits it to the system's data receiving buffer. B. The active domain name resolution module actively requests the domain name in the DNS access record data, performs active resolution through the DNS service, obtains its IP address, and then inputs the domain name information and IP address into the data cleaning and processing module. C. The data cleaning and organizing module cleans and organizes the acquired DNS access record data to obtain cleaned data; Data cleaning and organization includes the following processes: Remove duplicate data from the DNS access record data, then standardize all data formats; extract the root domain name and IP address from the data format, correct logical errors, and delete incomplete records; D. The preliminary matching and screening module compares the cleaned root domain name and IP address with the malicious data in the IOC intelligence database. If the root domain name or IP address is recorded in the IOC intelligence database, it is listed as blacklisted data and sent to the AI analysis module for further judgment. If the root domain name is not included in the IOC intelligence database, but the IP address is included in the IOC intelligence database, then the root domain name is included in the IOC intelligence database.
[0024] E. The AI analysis module calculates the similarity of the blacklist data based on the similarity attribution formula and the confidence assessment formula. After calculating the confidence, it obtains the judgment result and finally identifies whether the data is malicious domain name data.
[0025] The beneficial effects of this invention are as follows: This invention provides a novel proactive detection mechanism. It primarily utilizes a Domain Name Generation Algorithm (DGA) to generate fake domain names in batches and proactively sends specific DNS queries to known or suspected malicious IP addresses. By triggering "DNS collisions," it directly identifies other inactive hidden domain names bound to those IPs. This allows attackers to detect these backup domains before they can use them for C&C communication or phishing attacks, transforming "post-event response" into "pre-event warning," significantly increasing the lead time for defense and enabling "early" detection of malicious infrastructure. Simultaneously, an AI analysis module performs secondary verification of the DNS collision findings with threat intelligence and domain characteristics, effectively reducing the false positive rate of single detection methods and providing a more accurate means of identifying malicious domain names.
[0026] This invention addresses the challenge that attackers can easily change domain names or communication patterns, but they struggle to frequently change public IP addresses due to increased costs and infrastructure rebuilding. This invention directly targets their relatively fixed IP infrastructure, exploiting the operational weakness of "one IP bound to multiple backup domains," thus achieving precision. It strikes the most vulnerable and costly link in the attack chain (server IP), making it difficult for attackers to evade detection by altering surface characteristics, significantly improving the resilience of the defense system and reducing the attacker's cost.
[0027] The core advantage of this invention lies in its organic combination of "active detection" and "high-confidence verification," constructing a completely new paradigm for malicious domain name identification and tracing. It is not a simple improvement on existing technologies, but a strategic upgrade, capable of effectively discovering and tracing the most covert and cunning advanced persistent threats, filling a significant gap in the existing technological system. Detailed Implementation
[0028] The present invention will now be described in detail. Example 1
[0029] The malicious domain name identification system based on DNS collision includes a data collection module, an active domain name resolution module, a data cleaning and sorting module, a preliminary matching and filtering module, an AI analysis module, a storage module, and a graphical interface display module; the storage module stores an IOC intelligence database. The data acquisition module uses two methods to actively collect and passively receive DNS access record data: real-time acquisition from backbone nodes and offline pcap data packet import. The record data collected and transmitted to the system's data receiving buffer includes: log streams of recursive DNS servers, DNS data packets in network traffic mirrors, public or commercial threat intelligence platforms, and DNS query records generated by internal network devices of enterprises.
[0030] The active domain name resolution module generates several pseudo domain names in batches using the domain name generation algorithm DGA. Using these pseudo domain names, an access request is sent to the domain name in the DNS access record data through the DNS service xian. The IP address of the response is resolved and obtained. The IP address is then associated with the domain name in the DNS access record data and input into the data cleaning and sorting module.
[0031] The data cleaning and organization module is used to clean and organize the acquired DNS access record data to obtain cleaned data. The data cleaning and organization includes the following processes: deleting duplicate data in the DNS access record data, then unifying all data formats to JSON format for data structure processing, and adapting to UTF-8 encoding format; extracting the root domain name and IP address from the data format, correcting logical errors, and deleting incomplete data records.
[0032] The preliminary matching and filtering module compares the cleaned root domain name and IP address with malicious data in the IOC intelligence database. If the root domain name or IP address is recorded in the IOC intelligence database, it is listed as blacklisted data and sent to the AI analysis module for further judgment. If the root domain name is not included in the IOC intelligence database, but the IP address is included in the IOC intelligence database, then the root domain name is included in the IOC intelligence database.
[0033] The AI analysis module first calculates the preliminary similarity by assigning weights; then, based on the similarity attribution formula and the confidence assessment formula, it calculates the similarity of the blacklist data and obtains the judgment result through confidence calculation, ultimately identifying whether it is malicious domain name data.
[0034] The process of calculating preliminary similarity based on weight assignment is as follows: Malicious domain association score, weight 0.4; Analyze the association between IP addresses and malicious IP addresses, with a weight of 0.3; Domains registered within the last 45 days are considered high-risk, with a weight of 0.2.
[0035] Domain name character pattern: The presence of meaningless characters and consecutive characters longer than 8 'w' indicates high risk, with a weight of 0.1; Calculate the similarity of the above four feature categories respectively: the value is 0-1, 1 is a perfect match and 0 is a complete mismatch, as shown in the following formula: Total similarity = (Feature 1 similarity × 0.4) + (Feature 2 similarity × 0.3) + (Feature 3 similarity × 0.2) + (Feature 4 similarity × 0.1).
[0036] The AI analysis module uses the QWEN model launched by Alibaba Tongyi.
[0037] In the AI analysis module, the similarity attribution formula is: (1) (2) Let the attack entity vector v be the template of the j-th malicious domain. The similarity; θ is the attribution threshold.
[0038] θ is determined through learning and updating. In this embodiment, ROC curve is used for determination, and its calculation process is as follows: If the threshold θ is designed with a step size of 0.1, then there exists an array [0, 0.1, 0.2, ..., 9.9, 1]. Calculate the true positive rate (TPR) and false positive rate (FPR) for the corresponding threshold θ in the threshold array, using the following formulas: True Positive Rate (TPR) = TP / (TP + FN) False positive rate (FPR) = FP / (FP+TN) (4) Wherein, TP represents true positives, which are the number of actual malicious instances that are predicted to be malicious; FP represents false positives, which are the number of actual normal instances that are predicted to be malicious; TN represents true negatives, which are the number of actual normal instances that are predicted to be normal; and FN represents false negatives, which are the number of actual malicious instances that are predicted to be normal. Plotting ROC curves Plot the FPR on the horizontal axis and the TPR on the vertical axis, and connect the (FPR, TPR) points corresponding to each threshold to form a curve. Initially, 1000 sampled DNS records were used for detection (100 of which were malicious and 900 were normal). The similarity score distribution is as follows: Threshold (θ) TP FP TN FN TPR = TP / (TP + FN) FPR = FP / (FP + TN) 0.0 100 900 0 0 1.0 1.0 0.3 85 100 800 15 0.85 0.11 0.5 70 30 870 30 0.7 0.033 0.7 50 10 890 50 0.5 0.011 1.0 0 0 900 100 0.0 0.0 .
[0039] Based on the scatter plot, plot the ROC curve: based on the scatter plot point (0.033, 0.7): when the threshold is 0.5, the FPR is 3.3% and the TPR is 70%; obtain the initial optimal threshold candidate θ; and then continuously learn g to update the θ value in subsequent processes.
[0040] In the AI judgment module, the confidence assessment formula is: (3) in, For the characteristics of the k-th type of data source, The dynamic weights of the k-th type of data source. This is the Sigmoid function.
[0041] The weights are learned through the Gradient Boosting Tree (GBDT) algorithm. The input of the GBDT algorithm is the credibility of threat intelligence and domain name features. The output is dynamically adjusted weight values. Finally, it is combined with the Sigmoid function to generate standardized weights in the [0,1] interval.
[0042] The graphical interface display module shows the final recognition results of the AI analysis module in real time, which makes it easy for operators to grasp the real-time situation and make manual intervention when necessary.
[0043] The information displayed may include the following: top malicious domains, most affected client IPs, and threat type distribution.
[0044] The malicious domain name identification system based on DNS collision of the present invention applies the above-mentioned malicious domain name identification system based on DNS collision, and includes the following steps: A. The data acquisition module actively collects and passively receives DNS access record data, and transmits it to the system's data receiving buffer. B. The active domain name resolution module actively requests the domain name in the DNS access record data, performs active resolution through the DNS service, obtains its IP address, and then inputs the domain name information and IP address into the data cleaning and processing module. C. The data cleaning and organizing module cleans and organizes the acquired DNS access record data to obtain cleaned data; Data cleaning and organization includes the following processes: Remove duplicate data from the DNS access record data, then standardize all data formats; extract the root domain name and IP address from the data format, correct logical errors, and delete incomplete records; D. The preliminary matching and screening module compares the cleaned root domain name and IP address with the malicious data in the IOC intelligence database. If the root domain name or IP address is recorded in the IOC intelligence database, it is listed as blacklisted data and sent to the AI analysis module for further judgment. If the root domain name is not included in the IOC intelligence database, but the IP address is included in the IOC intelligence database, then the root domain name is included in the IOC intelligence database.
[0045] E. The AI analysis module calculates the similarity of the blacklist data based on the similarity attribution formula and the confidence assessment formula. After calculating the confidence, it obtains the judgment result and finally identifies whether the data is malicious domain name data.
[0046] Those skilled in the art should recognize that the above embodiments are merely illustrative of the present invention and are not intended to limit the present invention. Any variations or modifications to the above embodiments that are within the essential spirit of the present invention will fall within the scope of the claims of the present invention.
Claims
1. A malicious domain name identification system based on DNS collision, comprising a data collection module, an active domain name resolution module, a data cleaning and sorting module, a preliminary matching and filtering module, an AI analysis module, and a storage module, characterized in that: The data acquisition module is used to actively collect and passively receive DNS access record data and transmit it to the system's data receiving buffer. The active domain name resolution module is used to actively access the domain name in the DNS access record data, make active query requests through the DNS service, resolve and obtain its IP address, and then input the domain name information and IP address into the data cleaning and processing module. The data cleaning and organizing module is used to clean and organize the acquired DNS access record data to obtain cleaned data; The preliminary matching and screening module compares the cleaned data with the malicious data in the IOC intelligence database in the storage module. If the data is in the IOC intelligence database, it is listed as blacklisted data and sent to the AI analysis module for further judgment. In the AI analysis module, a preliminary similarity is first calculated by assigning weights; Based on the similarity attribution formula and the confidence assessment formula, the blacklist data is similar to the data, and then the confidence is calculated to obtain the judgment result, which ultimately identifies whether the data is malicious domain name data.
2. The malicious domain name identification system based on DNS collision as described in claim 1, characterized in that: The data acquisition module uses two methods for data acquisition: real-time acquisition from backbone nodes and offline pcap data packet import. The data collection module collects the following recorded data: log streams of recursive DNS servers, DNS packets in network traffic mirrors, public or commercial threat intelligence platforms, and DNS query records generated by enterprise internal network devices.
3. The malicious domain name identification system based on DNS collision as described in claim 1, characterized in that: The active domain name resolution module generates several pseudo domain names in batches using the domain name generation algorithm DGA. Using these pseudo domain names, an access request is sent to the domain name in the DNS access record data through the DNS service xian. The IP address of the response is resolved and obtained. The IP address is then associated with the domain name in the DNS access record data and input into the data cleaning and sorting module.
4. The malicious domain name identification system based on DNS collision as described in claim 1, characterized in that: The data cleaning and processing module includes the following processes: Remove duplicate data from the DNS access record data, then standardize all data formats; extract the root domain name and IP address from the data format, correct logical errors, and delete incomplete records.
5. The malicious domain name identification system based on DNS collision as described in claim 4, characterized in that: The preliminary matching and filtering module compares the cleaned root domain name and IP address with malicious data in the IOC intelligence database. If the root domain name or IP address is recorded in the IOC intelligence database, it is listed as blacklisted data and sent to the AI analysis module for further judgment. If the root domain name is not included in the IOC intelligence database, but the IP address is included in the IOC intelligence database, then the root domain name is included in the IOC intelligence database.
6. The malicious domain name identification system based on DNS collision as described in claim 1, characterized in that: The AI analysis module uses the QWEN model launched by Alibaba Tongyi.
7. The malicious domain name identification system based on DNS collision as described in claim 1, characterized in that: The process of calculating the preliminary similarity based on weight assignment in the AI judgment module is as follows: Malicious domain association score, weight 0.4; Analyze the association between IP addresses and malicious IP addresses, with a weight of 0.3; Domains registered within the last 45 days are considered high-risk, with a weight of 0.
2. Domain name character pattern: The presence of meaningless characters and consecutive characters longer than 8 'w' indicates high risk, with a weight of 0.1; Calculate the similarity of the above four feature categories respectively: the value is 0-1, 1 is a perfect match and 0 is a complete mismatch, as shown in the following formula: Total similarity = (Feature 1 similarity × 0.4) + (Feature 2 similarity × 0.3) + (Feature 3 similarity × 0.2) + (Feature 4 similarity × 0.1).
8. The malicious domain name identification system based on DNS collision as described in claim 7, characterized in that: The similarity attribution formula is: （1） （2） Let the attack entity vector v be the template of the j-th malicious domain. The similarity; θ is the attribution threshold; The confidence level assessment formula is: （3） in, For the characteristics of the k-th type of data source, The dynamic weights of the k-th type of data source. This is the Sigmoid function.
9. The malicious domain name identification system based on DNS collision as described in claim 1, characterized in that: It also includes a graphical interface display module, which is used to display the final recognition results of the AI judgment module in real time.
10. A malicious domain name identification system based on DNS collision, employing the malicious domain name identification system based on DNS collision as described in any one of claims 1-9, characterized in that, Includes the following steps: A. The data acquisition module actively collects and passively receives DNS access record data, and transmits it to the system's data receiving buffer. B. The active domain name resolution module actively requests the domain name in the DNS access record data, performs active resolution through the DNS service, obtains its IP address, and then inputs the domain name information and IP address into the data cleaning and processing module. C. The data cleaning and organizing module cleans and organizes the acquired DNS access record data to obtain cleaned data; Data cleaning and organization includes the following processes: Remove duplicate data from the DNS access record data, then standardize all data formats; extract the root domain name and IP address from the data format, correct logical errors, and delete incomplete records; D. The preliminary matching and screening module compares the cleaned root domain name and IP address with the malicious data in the IOC intelligence database. If the root domain name or IP address is recorded in the IOC intelligence database, it is listed as blacklisted data and sent to the AI analysis module for further judgment. If the root domain name is not included in the IOC intelligence database, but the IP address is included in the IOC intelligence database, then the root domain name is included in the IOC intelligence database. E. The AI analysis module calculates the similarity of the blacklist data based on the similarity attribution formula and the confidence assessment formula. After calculating the confidence, it obtains the judgment result and finally identifies whether the data is malicious domain name data.