DNS request response log stream threat abnormal behavior analysis method and system

Abstract

The invention discloses a DNS request response log stream threat abnormal behavior analysis method and system, and belongs to the technical field of log stream threat analysis. The method comprises the following steps: acquiring an original DNS request response log stream in a network environment, extracting a domain name, and performing semantic hierarchy segmentation on the domain name; generating a multi-granularity DGA suspiciousness score based on the character distribution characteristics of each level and a naturalness evaluation result of the pre-training language model; constructing a dynamic heterogeneous graph, learning node embedding, calculating a basic propagation entropy, and correcting the basic propagation entropy; generating a sudden change abnormal score; inputting the DGA suspiciousness score, the corrected propagation entropy and the abrupt change abnormal score into a Bayesian fusion model to generate an initial comprehensive threat score; and performing dynamic attenuation processing on the initial comprehensive threat score, dynamically adjusting a score attenuation rate, and generating a threat score. According to the method and the system, the detection precision and the response capability of the hidden threat behavior in the DNS request response log stream are improved.

Description

Technical Field

[0001] This invention belongs to the field of log stream threat analysis technology, and in particular, it is a method and system for analyzing abnormal threat behavior in DNS request and response log streams. Background Technology

[0002] DNS request-response log stream threat analysis technology is a network security detection method that identifies potential malicious behaviors or security threats by collecting, parsing, and deeply analyzing Domain Name System (DNS) query and response logs generated in the network environment. DNS serves as the internet's telephone directory, and almost all network communications rely on it to resolve domain names to IP addresses. Therefore, how to utilize advanced technologies to improve the intelligence and security of DNS request-response log stream threat analysis has become one of the urgent problems to be solved.

[0003] In the field of DNS request and response log stream threat analysis, existing methods rely on character distribution entropy or length thresholds to determine DGA (Domain Generation Algorithm). This can easily misjudge high-entropy legitimate domains as malicious or miss naturally structured DGAs. Furthermore, traditional techniques typically treat domains as whole strings or simply split them into subdomains and main domains, lacking the ability to semantically recognize and hierarchically classify functional tags in subdomains. This makes it impossible to effectively identify malicious subdomains constructed using legitimate tags. Summary of the Invention

[0004] Purpose of the invention: The technical problem to be solved by the present invention is to provide a method and system for analyzing the threat and abnormal behavior of DNS request and response log streams, addressing the shortcomings of the existing technology.

[0005] To address the aforementioned technical problems, in a first aspect, the present invention provides a method for analyzing the threat and abnormal behavior of DNS request-response log streams, comprising:

[0006] Obtain the original DNS request and response log stream in the network environment, extract the queried domain name, source IP, destination IP, timestamp, and resolution IP list from the log stream, and perform semantic hierarchical segmentation on the queried domain name to obtain a four-level structure;

[0007] Based on the character distribution features of each level of structure and the naturalness evaluation results of the pre-trained language model, a multi-granularity DGA suspicion score is generated by fusion through an attention mechanism.

[0008] Construct a dynamic heterogeneous graph with domain names, IP addresses, and Autonomous Systems (AS) as nodes and resolution, attribution, and subdomain relationships as edges. Utilize graph attention networks to learn node embeddings and calculate the underlying propagation entropy based on the connection frequency distribution within a sliding time window.

[0009] A dynamic influence factor is introduced to correct the basic propagation entropy. The dynamic influence factor is adaptively adjusted according to the difference in connection modes and the burst ratio between adjacent sliding time windows.

[0010] A time series of query frequencies for the main domain is constructed, and a dynamic baseline is generated using trend and periodic decomposition models. A mutation anomaly score is generated by combining residual analysis and new domain name identifiers.

[0011] The DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score are input into the Bayesian fusion model to generate an initial comprehensive threat score.

[0012] The initial comprehensive threat score is dynamically attenuated based on risk probability perturbation. The score attenuation rate is dynamically adjusted according to the current network security situation, asset importance, and contextual information of DNS response actions to generate a threat score.

[0013] Furthermore, the queried domain name is semantically segmented to obtain a four-level structure, including:

[0014] The query domain names in each DNS request and response log stream are reversed using delimiters, and the last string is extracted as the top-level domain level.

[0015] Extract the second-to-last string as the second-level field.

[0016] Merge the remaining prefix strings into subfields in order;

[0017] The subdomain is further divided by delimiters to identify whether it contains preset functional semantic tags, which include api, cdn, mail, www, svc, dev, and test;

[0018] If there are multiple functional semantic tags, the first three tag levels are retained from right to left and set as the third-level domain level, and the rest are merged into the generalized subdomain level, i.e., the fourth-level domain level.

[0019] Furthermore, the character distribution features based on each hierarchical structure and the naturalness evaluation results of the pre-trained language model are fused through an attention mechanism to generate a multi-granularity DGA suspicion score. The specific steps are as follows:

[0020] For each layer of the four-layer structure, count the frequency of each character in the string of that layer, and denot it as... ;

[0021] Calculate the character-level Shannon entropy of this layer based on character frequency. The expression is:

[0022] ;

[0023] in, Character-level Shannon entropy measures the uncertainty of character distribution within a domain name string at a specific level. This represents the probability of a certain character appearing in this level. The sum is obtained by iterating through all the characters that appear in this level.

[0024] The complete query domain name is input into a language model pre-trained on a corpus of valid domain names. The average log-likelihood score of the model for the complete query domain name is obtained, denoted as [missing information]. ;

[0025] Shannon entropy at each level of character level Convert to perplexity value ;

[0026] Shannon entropy at each level of character level With confusion value As input feature vectors, they are fed into the attention network;

[0027] Attention network computation , , Weighting coefficients for each feature;

[0028] All features are weighted and fused to output a normalized multi-granularity DGA suspicion score.

[0029] By performing fine-grained semantic hierarchical segmentation of domain names and integrating character distribution entropy with language model naturalness assessment, the ability to identify DGA-type malicious domain names has been enhanced.

[0030] Furthermore, the introduction of a dynamic influence factor to correct the basic propagation entropy, wherein the dynamic influence factor is adaptively adjusted according to the difference in connection patterns and the burst ratio between adjacent time windows, specifically through the following steps:

[0031] In a dynamic heterogeneous graph, the connection behavior of each node within a sliding time window is defined;

[0032] Count the number of connections from the node to each of its neighboring nodes to obtain the propagation behavior vector;

[0033] The propagation behavior vector is normalized into a probability distribution, denoted as . ,in Indicates the first One neighboring node;

[0034] Calculate the KL divergence between the probability distributions of the current window and the previous window, as the degree of difference in connection patterns. The expression is:

[0035] ;

[0036] in, This represents the KL divergence, used to quantify the difference in the probability distribution of node connection behavior between the current time window and the previous time window. This indicates that the node in the current window points to the first... The connection probability of each neighbor. This represents the connection probability of the corresponding neighbor in the previous window. Iterate through and sum all possible neighbor nodes.

[0037] Calculate the growth rate of the current total number of window connections relative to the historical average, as the burst rate. ;

[0038] Differences in connection modes With the increase ratio After weighting, a dynamic impact factor is generated using the Sigmoid function. The expression is:

[0039] ;

[0040] in, This represents a dynamic influencing factor, used to enhance sensitivity to short-term burst behaviors. and These are adjustable weighting coefficients to control the contribution of variability and surge ratio to the final impact factor;

[0041] Basic propagation entropy and Multiply by this to obtain the corrected propagation entropy. .

[0042] Furthermore, the query frequency of the main domain is used to construct a time series, a trend-cycle decomposition model is used to generate a dynamic baseline, and residual analysis and new domain name identifiers are combined to generate a mutation anomaly score. The specific steps are as follows:

[0043] Count the number of DNS queries for each primary domain within a continuous time period, using minutes as the unit, and construct a time series;

[0044] The STL decomposition algorithm is used to decompose the time series into trend and periodic components;

[0045] Add the trend term and the period term to obtain the dynamic baseline prediction value;

[0046] Calculate the deviation between the current observation and the dynamic baseline prediction;

[0047] The deviation is standardized to obtain the standardized residual.

[0048] If the current primary domain or its subdomain appears for the first time, the new domain name identifier signal will be activated; otherwise, it will remain inactive.

[0049] The sensitivity gain factor is adjusted based on the rate of change of local variance of the residual sequence;

[0050] The standardized residual, the new domain name identifier signal, and the sensitivity gain factor are multiplied to generate a mutation anomaly score.

[0051] By introducing a dynamic impact factor to correct the propagation entropy, the mutation characteristics of abnormal connection patterns can be effectively captured. Combined with the mutation detection of trend-period decomposition and the new domain name identification mechanism, the sensitivity to attacks such as sudden DNS amplification or C2 communication is improved.

[0052] Furthermore, the specific steps for inputting the DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score into the Bayesian fusion model to generate an initial comprehensive threat score are as follows:

[0053] The multi-granularity DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score are input into the Bayesian inference framework as three independent pieces of evidence.

[0054] Based on historically confirmed malicious event datasets, statistical analysis is performed on each piece of evidence. The conditional probability of occurrence in a malicious attack M is denoted as . , ;

[0055] At the same time, various pieces of evidence were compiled. The conditional probability of occurrence in normal behavior N is denoted as . ;

[0056] Set prior probabilities and This indicates an initial assessment that the event was malicious or normal.

[0057] The posterior probability is calculated using Bayes' theorem and used as the initial comprehensive threat score. The expression is:

[0058] ;

[0059] in, This represents the product of the conditional probabilities of the three pieces of evidence, reflecting the combined probability that the event was malicious given the evidence.

[0060] Furthermore, the initial comprehensive threat score undergoes dynamic attenuation processing based on risk probability perturbations. The attenuation rate is dynamically adjusted according to the current cybersecurity situation, asset importance, and contextual information of response actions to generate a threat score. The specific steps are as follows:

[0061] Set initial comprehensive threat score The fundamental decay function that decays naturally over time ;

[0062] Real-time collection of contextual information, including the importance level of the asset to which the source IP belongs, the current activity index of similar threats in the network and the impact of such threat events, and whether the IP or domain associated with the event has been blocked by security devices;

[0063] Generate risk disturbance factors based on contextual information. ;

[0064] Risk disturbance factors With the basic decay function Add them together to form the dynamic attenuation coefficient. ;

[0065] Initial comprehensive threat score With dynamic attenuation coefficient Multiply them to get the final threat score at the current moment. The expression is:

[0066] ;

[0067] ;

[0068] in, This indicates the final threat score. This indicates the time interval since the event occurred. The score decays as asset importance increases, threat activity rises, or response actions are not taken.

[0069] By using a Bayesian fusion model to achieve quantitative integration of multi-source evidence, the rationality of scoring is improved. Furthermore, by leveraging a context-aware dynamic decay mechanism, the attention period for high-risk events is extended, avoiding false decay that could lead to missed reports.

[0070] Secondly, a DNS request and response log stream threat anomaly behavior analysis system is provided, including: a log parsing module, a semantic segmentation module, a DGA scoring module, a graph entropy correction module, a mutation detection module, a Bayesian fusion module, and a dynamic decay module;

[0071] The log parsing module is used to obtain the original DNS request and response log stream in the network environment and extract the queried domain name, source IP, destination IP, timestamp, and list of resolved IPs.

[0072] The semantic segmentation module is used to perform semantic hierarchical division of the query domain name and construct a four-level structure;

[0073] The DGA scoring module is used to generate multi-granularity DGA suspicion scores by fusing the character distribution features of each level structure and the naturalness evaluation results of the pre-trained language model through an attention mechanism.

[0074] The graph entropy correction module is used to construct a dynamic heterogeneous graph with domain name, IP address, and AS as nodes, and resolution relationship, attribution relationship, and subdomain relationship as edges. It calculates the basic propagation entropy by counting the node connection frequency through a sliding time window. It introduces a dynamic influence factor to correct the entropy value. The dynamic influence factor is generated by weighting the KL divergence of the connection probability distribution between adjacent windows and the sudden increase ratio of the total number of connections.

[0075] The mutation detection module is used to construct a time series of query frequencies of the main domain, generate a dynamic baseline using trend and periodic decomposition models, and generate mutation anomaly scores by combining residual analysis and new domain name identifiers.

[0076] The Bayesian fusion module is used to calculate the posterior probability of the DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score through Bayesian inference to generate an initial comprehensive threat score.

[0077] The dynamic attenuation module is used to perform dynamic attenuation processing on the initial comprehensive threat score based on risk probability perturbation. It dynamically adjusts the score attenuation rate according to the current network security situation, asset importance, and context information of response actions to generate a threat score.

[0078] Furthermore, the semantic segmentation module is used to perform hierarchical structure parsing on the queried domain name. It splits the domain in reverse order using delimiters, extracting the last string as the top-level domain; extracts the second-to-last string as the second-level domain; merges the remaining preceding strings sequentially into subdomains, and further segments the subdomains using delimiters. External data is used to identify whether preset functional semantic tags are present. If multiple functional semantic tags exist, the first three tags are retained from right to left and set as the third-level domain, while the rest are merged into a generalized subdomain level, i.e., the fourth-level domain. The subdomains are semantically categorized based on the preset functional tags to construct a four-level structure.

[0079] Furthermore, the DGA scoring module is used to statistically analyze the character distribution of each level in the four-layer structure, calculate the character-level Shannon entropy, evaluate the sequence naturalness of the complete domain name using a language model pre-trained on a legal domain name corpus, generate a perplexity value, and input multi-dimensional features into the attention network to achieve adaptive weight allocation and output a normalized multi-granularity DGA perplexity score.

[0080] Furthermore, the mutation detection module is used to count the DNS query frequency of the main domain at the minute level to form a time series, use the STL decomposition algorithm to separate the trend term and the periodic term, generate a dynamic baseline prediction value, calculate the deviation between the observed value and the baseline and standardize it into a residual, and combine the new domain name identification signal and the sensitivity gain factor adjusted based on the residual variance change rate to comprehensively generate a mutation anomaly score.

[0081] Furthermore, the Bayesian fusion module is used to treat the DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score as three independent pieces of evidence. Based on historical malicious and normal event samples, the conditional probabilities of each piece of evidence under different categories are statistically analyzed. After setting the prior probability, the posterior probability is calculated through Bayesian inference to generate an initial score that reflects the overall threat probability.

[0082] Furthermore, the dynamic decay module is used to implement decay control on the initial comprehensive threat score over time, set a basic decay function, and generate a risk disturbance factor in combination with real-time context information. The context information includes the importance level of the source IP asset, the activity index of similar threats and the impact of such threat events, as well as the blocking response status. The decay rate is adjusted through the disturbance factor, and the threat score at the current moment is output.

[0083] Thirdly, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the DNS request-response log stream threat anomaly behavior analysis method as described in the first aspect of the present invention.

[0084] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the DNS request-response log stream threat anomaly behavior analysis method as described in the first aspect of the present invention.

[0085] The beneficial effects of this invention are as follows: By using a multi-dimensional feature extraction and dynamic adaptive analysis mechanism, the detection accuracy and response capability of hidden threat behaviors in DNS request and response log streams are improved; by performing fine-grained semantic hierarchical segmentation of domain names and fusing character distribution entropy and language model naturalness assessment, the ability to identify DGA-type malicious domain names is enhanced; by introducing a dynamic influence factor to correct propagation entropy, the mutation characteristics of abnormal connection patterns are effectively captured; by combining trend-period decomposition mutation detection and new domain name identification mechanism, the sensitivity to sudden DNS amplification or C2 communication attacks is improved; by using a Bayesian fusion model to achieve quantitative integration of multi-source evidence, the rationality of scoring is improved; and by using a context-aware dynamic decay mechanism, the attention period for high-risk events is extended, avoiding false decay leading to missed detections. To address the problem that existing methods rely on character distribution entropy or length thresholds to determine DGAs, which can easily misclassify high-entropy legitimate domains as malicious or miss naturally structured DGAs, and that traditional techniques typically treat domains as whole strings or simply split them into subdomains and main domains, lacking the ability to semantically recognize and hierarchically classify functional tags in subdomains, thus failing to effectively identify malicious subdomains constructed through legitimate tags. Attached Figure Description

[0086] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, and the advantages of the present invention in the above and / or other aspects will become clearer.

[0087] Figure 1 A flowchart illustrating a method for analyzing the threat and abnormal behavior of DNS request and response log streams, as provided in this application embodiment.

[0088] Figure 2 This is a schematic diagram of a DNS request and response log stream threat and abnormal behavior analysis system provided in an embodiment of this application. Detailed Implementation

[0089] The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0090] The first embodiment of this application provides a method for analyzing the threat and abnormal behavior of DNS request and response log streams, such as... Figure 1 As shown, it includes the following steps:

[0091] Step S1: Obtain the raw DNS request and response log stream in the network environment, extract the queried domain name, source IP, destination IP, timestamp, and list of resolved IPs, and perform semantic hierarchical segmentation on the domain name to obtain a four-level structure, specifically including:

[0092] The query domain names in each DNS request and response log stream are reversed and resolved using a delimiter. The last field is extracted as the top-level domain level; the second-to-last field is extracted as the second-level domain level; the remaining preceding fields are merged in order into subdomains; the subdomains are then separated again using a delimiter, and it is identified whether they contain preset functional semantic tags, including api, cdn, mail, www, svc, dev, and test.

[0093] If there are multiple functional semantic tags, the first three tag levels are retained from right to left and set as the third-level domain level; the rest are merged into a generalized subdomain level, i.e., the fourth-level domain level.

[0094] By semantically segmenting domain names, their structural composition can be effectively restored, laying the foundation for subsequent multi-dimensional feature extraction. This hierarchical structure not only preserves the syntactic information of the domain names, but also enhances semantic understanding capabilities through functional tag recognition, which helps to distinguish normal business domain names from disguised malicious domain names and improves the accuracy of perceiving abnormal domain-level behavior.

[0095] Step S2: Based on the character distribution features of each hierarchical structure and the naturalness evaluation results of the pre-trained language model, a multi-granularity DGA suspicion score is generated by fusing them through an attention mechanism, specifically including:

[0096] For each level in the four-level structure, count the frequency of each character in the string of that level, and denot it as... Calculate the character-level Shannon entropy of this layer based on character frequency. The expression is:

[0097] ;

[0098] in, Character-level Shannon entropy measures the uncertainty of character distribution within a domain name string at a specific level. This represents the probability of a certain character appearing in this level. Iterate through and sum all the characters that appear in this level.

[0099] The complete query domain name is input into a pre-trained language model based on a corpus of valid domain names. The average log-likelihood score of the model for the complete query domain name is obtained and denoted as . ; The character-level Shannon entropy at each level Convert to perplexity value using the Shannon-McMillan theorem. ; The character-level Shannon entropy at each level With confusion value The input feature vector is fed into the attention network; the attention network calculates... , , Weighting coefficients for each feature; weighted fusion , , All features are used to output a normalized multi-granularity DGA suspicion score.

[0100] The multi-granularity DGA suspiciousness scoring mechanism integrates character-level statistical features with the naturalness assessment of sequence language models, taking into account both local randomness and overall readability. It adaptively weights entropy and perplexity at different levels through an attention mechanism, avoiding the subjectivity of manually setting weights and enhancing the model's ability to generalize and identify new or variant DGA domain names.

[0101] Step S3: Construct a dynamic heterogeneous graph with domain name, IP address, and AS as nodes, and resolution, attribution, and subdomain relationships as edges. Use a graph attention network to learn node embeddings and calculate the basic propagation entropy based on the connection frequency distribution within a sliding time window. Specifically, this includes:

[0102] Three types of nodes are defined, including domain name nodes, IP address nodes, and autonomous system (AS) nodes. Domain name nodes represent the complete or hierarchical domain name being queried, IP address nodes represent the source and destination IP addresses returned in the resolution response, and AS nodes represent the autonomous system number to which the IP address belongs. AS affiliation mapping is performed through an IP geodatabase or a BGP (Border Gateway Protocol) routing table.

[0103] Three edge types are defined, including resolution edges, home edges, and subdomain edges. Resolution edges connect domain name nodes to their corresponding IP name nodes, with the direction from the domain name to the IP name. The edge weight is initialized to the number of times the domain name resolves to the IP name within a specified time window. Home edges connect IP name nodes to their respective AS nodes, are undirected, and are used to express network topology affiliation. Subdomain edges connect subdomain name nodes to their parent domain name nodes, with the direction from the subdomain to the parent domain, and are used to characterize the domain name hierarchy.

[0104] A fixed-length sliding time window is divided on a continuous time axis. All DNS resolution records for that period are collected within each sliding time window, and the dynamic heterogeneous graph structure is dynamically updated accordingly. At the same time, the sliding window changes according to the domain name creation time and the current time difference: newly added nodes and edges are added, the connection frequency of existing edges is accumulated, and old connections that exceed the time window range are aged out and removed, forming a dynamic heterogeneous graph that evolves over time.

[0105] The original features of each node are vectorized. The features of the domain name node include length, character entropy, whether it contains sensitive tags and DGA suspicion score. The features of the IP node include geographical location, whether it is a CDN (Content Delivery Network) node and historical resolution frequency. The features of the AS node include country of origin, organization type and historical activity.

[0106] Using the above features as input, the graph attention network (GAT) aggregates neighbor information through a multi-layer attention mechanism to learn low-dimensional dense node embedding vectors. During the embedding process, a heterogeneous attention mechanism is used to distinguish the influence weights of different edge types, enabling the GAT model to capture the semantic associations between cross-type nodes.

[0107] Based on the node embedding, for each domain name node, the propagation behavior vector consisting of the frequency of connections to each resolved IP within the current time window is extracted and normalized into a probability distribution.

[0108] Based on this probability distribution, its Shannon entropy is calculated and used as the basic propagation entropy of this node. The entropy value reflects the dispersion and uncertainty of the resolution target. The higher the entropy value, the more dispersed the resolution target, corresponding to DGA or load balancing behavior. The lower the entropy value, the more fixed the resolution of a certain IP in the long term.

[0109] Dynamic heterogeneous graph modeling enables a structured representation of complex relationships between DNS entities. Graph attention networks fully capture the association patterns between cross-type nodes during the learning node embedding process. The basic propagation entropy calculated based on sliding windows quantifies the distribution dispersion of domain name resolution targets, providing an effective criterion for identifying abnormal propagation behaviors such as C2 communication and wildcard domain name resolution.

[0110] Step S4: Introduce a dynamic influence factor to correct the basic propagation entropy. The dynamic influence factor is adaptively adjusted according to the difference and surge ratio of the connection patterns between adjacent time windows, specifically including:

[0111] In a dynamic heterogeneous graph, the connection behavior of each node within a sliding time window is defined, where the length of the sliding time window is the difference between the domain name creation time and the current time. Negative correlation; count the number of connections from this node to each of its neighboring nodes to form a propagation behavior vector; normalize the propagation behavior vector into a probability distribution, denoted as . ,in Indicates the first Calculate the KL (Kullback-Leibler) divergence between the probability distributions of the current window and the previous window, using it as the connectivity pattern dissimilarity. The expression is:

[0112] ;

[0113] in, This represents the KL divergence, used to quantify the difference in the probability distribution of node connection behavior between the current time window and the previous window. This indicates that the node in the current window points to the first... The connection probability of each neighbor. This represents the connection probability of the corresponding neighbor in the previous window. The sum is obtained by iterating through all possible neighbor nodes.

[0114] Calculate the growth rate of the current total number of window connections relative to the historical average, as the burst rate. ;Will and After weighting, a dynamic impact factor is generated using the Sigmoid function. The expression is:

[0115] ;

[0116] in, This represents a dynamic influencing factor, used to enhance sensitivity to short-term burst behaviors. and The adjustable weighting coefficients control the contribution of the degree of difference and the rate of increase to the final influencing factor.

[0117] The basic propagation entropy and Multiply by this to obtain the corrected propagation entropy. .

[0118] The introduction of a dynamic influencing factor to correct the basic propagation entropy significantly improves the sensitivity to short-term abrupt changes. This mechanism measures the drift of connectivity patterns through KL divergence and reflects the characteristics of traffic bursts by combining the burst ratio. The dynamic influencing factor generated by the fusion of the two can adaptively enhance the entropy response during abnormal periods and effectively suppress misjudgments caused by normal periodic fluctuations.

[0119] Step S5: Construct a time series of query frequencies for the main domain, generate a dynamic baseline using trend and periodic decomposition models, and generate abrupt change anomaly scores by combining residual analysis and new domain name identifiers. Specifically, this includes:

[0120] The number of DNS queries for each primary domain within a continuous time period is counted in minutes to construct a time series. The STL (Seasonal and Trend decomposition using Loess) decomposition algorithm is used to decompose the time series into trend items and periodic items.

[0121] The trend term and the periodic term are added together to generate the dynamic baseline prediction value; the deviation between the current observation value and the dynamic baseline is calculated; the deviation is standardized to obtain the standardized residual; if the current main domain or its subdomain appears in the system for the first time, the new domain name identification signal is activated; otherwise, it remains inactive.

[0122] The sensitivity gain factor is adjusted based on the rate of change of local variance of the residual sequence; the standardized residual, the new domain name identifier signal, and the sensitivity gain factor are multiplied to generate a mutation anomaly score.

[0123] The construction of mutation anomaly scores fully considers the trend and periodicity of time series, uses STL decomposition to generate dynamic baselines, avoids the high false alarm problem of static threshold detection in complex network environments, and combines new domain name identification and adaptive sensitivity adjustment to enable the system to respond quickly when facing the first appearance of malicious domain or sudden query flooding attacks.

[0124] Step S6: Input the DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score into the Bayesian fusion model to generate the initial comprehensive threat score.

[0125] The multi-granularity DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score are input as three independent pieces of evidence into the Bayesian inference framework.

[0126] Based on historically confirmed malicious event datasets, statistical analysis is performed on each piece of evidence. The conditional probability of occurrence in a malicious attack M is denoted as . At the same time, various pieces of evidence were compiled. The conditional probability of occurrence in normal behavior N is denoted as . .

[0127] Set prior probabilities and This represents the initial estimate of whether the event is malicious or normal; the posterior probability is calculated using Bayes' theorem as the initial comprehensive threat score, expressed as:

[0128] ;

[0129] in, This indicates the initial overall threat score. This represents the product of the conditional probabilities of the three pieces of evidence, reflecting the combined probability that the event was malicious given the evidence.

[0130] The Bayesian fusion model achieves the quantitative integration of multi-source heterogeneous evidence, unifying DGA scores, propagation entropy, and mutation scores into a probabilistic framework for reasoning. The method learns conditional probabilities based on historical data, possesses clear interpretability, and can reasonably assess the comprehensive threat level in uncertain environments, reducing the impact of misjudgments by a single indicator on the overall results.

[0131] Step S7: Implement dynamic attenuation processing on the initial comprehensive threat score based on risk probability perturbation. Adjust the score attenuation rate dynamically according to the current network security situation, asset importance, and contextual information of DNS response actions to generate a threat score. Specifically, this includes:

[0132] Set initial comprehensive threat score The fundamental decay function that decays naturally over time .

[0133] Real-time collection of contextual information, including the importance level of the asset to which the source IP belongs, the current activity index of similar threats in the network, and whether the IP or domain associated with the event has been blocked by security devices.

[0134] Threat scoring is performed on the subjects and objects accessing DNS based on their historical behavior. The access time is evaluated based on behavioral dimensions such as abnormal time and frequency to obtain a behavioral score. Then, after linear combination normalization, the risk disturbance factor is generated. Risk disturbance factors With the basic decay function Add them together to form the dynamic attenuation coefficient. The initial comprehensive threat score will be used to determine the threat level. With dynamic attenuation coefficient Multiply them to get the final threat score at the current moment. The expression is:

[0135]

[0136] ;

[0137] in, This indicates the final threat score. This indicates the time interval since the event occurred. The score decays as asset importance increases, threat activity rises, or response actions are not taken.

[0138] Based on the current threat score, a corresponding level of alert can also be triggered.

[0139] The dynamic decay mechanism based on risk probability perturbation enables lifecycle management of threat scores. By introducing contextual information such as asset importance, threat activity, and response status to adjust the decay rate, it ensures that high-value target-related events or unaddressed threats maintain a sufficiently long window of attention, preventing important alerts from disappearing prematurely and improving the continuity and effectiveness of security operations.

[0140] The second embodiment of this application provides a DNS request-response log stream threat anomaly behavior analysis system, such as... Figure 2 As shown, it includes a log parsing module, a semantic segmentation module, a DGA scoring module, a graph entropy correction module, a mutation detection module, a Bayesian fusion module, and a dynamic decay module;

[0141] The log parsing module is used to obtain the original DNS request and response log stream in the network environment, extract the queried domain name, source IP, destination IP, timestamp and resolution IP list, and pass the data to the subsequent processing unit;

[0142] The semantic segmentation module is used to perform semantic hierarchical division of the query domain name, constructing a four-level structure. Specifically, it parses the query domain name hierarchically, splits it in reverse order using delimiters, extracts the last string as the top-level domain, extracts the second-to-last string as the second-level domain, merges the remaining preceding strings in order into subdomains, further splits the subdomains by delimiters, and identifies whether they contain preset functional semantic tags through external data. If multiple functional semantic tags exist, the first three tag levels are retained from right to left and set as the third-level domain, while the rest are merged into generalized subdomain levels, i.e., the fourth-level domain. The subdomains are then semantically categorized based on the preset functional tags to construct the four-level structure.

[0143] The DGA scoring module is used to evaluate the naturalness of character distribution features at each level and the pre-trained language model. It generates multi-granularity DGA suspicion scores by fusing them through an attention mechanism. Specifically, it performs statistical analysis on the character distribution at each level of the four-layer structure, calculates character-level Shannon entropy, evaluates the sequence naturalness of complete domain names using a language model pre-trained on a legal domain name corpus, generates perplexity values, and inputs multi-dimensional features into the attention network to achieve adaptive weight allocation and output normalized multi-granularity DGA suspicion scores.

[0144] The graph entropy correction module is used to construct a dynamic heterogeneous graph with domain name, IP, and AS as nodes and resolution relationship, attribution relationship and subdomain relationship as edges. It calculates the basic propagation entropy by statistically analyzing the node connection frequency through a sliding time window and introduces a dynamic influence factor to correct the entropy value. This factor is generated by weighting the KL divergence of the connection probability distribution between adjacent windows and the sudden increase ratio of the total number of connections, thereby improving the sensitivity to the identification of abnormal propagation behavior.

[0145] The mutation detection module is used to construct a time series of query frequencies of the main domain, generate a dynamic baseline using trend and periodic decomposition models, and generate a mutation anomaly score by combining residual analysis and new domain name identifiers. Specifically, it counts the DNS query frequency of the main domain at the minute level to form a time series, uses the STL decomposition algorithm to separate the trend term and periodic term, generates a dynamic baseline prediction value, calculates the deviation between the observed value and the baseline and standardizes it into a residual, and combines the new domain name identifier signal and a sensitivity gain factor adjusted based on the residual variance change rate to comprehensively generate a mutation anomaly score.

[0146] The Bayesian fusion module is used to treat the DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score as three independent pieces of evidence. Based on historical malicious and normal event samples, the conditional probabilities of each piece of evidence under different categories are statistically analyzed. After setting the prior probability, the posterior probability is calculated through Bayesian inference to generate an initial score that reflects the overall threat probability.

[0147] The dynamic attenuation module is used to dynamically attenuate the initial comprehensive threat score based on risk probability perturbations. It dynamically adjusts the score attenuation rate according to the current network security situation, asset importance, and contextual information of response actions to generate a threat score. Specifically, it implements time-evolving attenuation control on the initial comprehensive threat score, sets a basic attenuation function, and generates risk perturbation factors based on real-time context information. Contextual information includes the importance level of the source IP asset, the activity index of similar threats, and the blocking response status. The attenuation rate is adjusted through the perturbation factor to output the threat score at the current moment. Based on the threat score at the current moment, corresponding alerts can also be triggered.

[0148] The third embodiment of this application provides a computer device, including a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the DNS request-response log stream threat abnormal behavior analysis method proposed in the first embodiment.

[0149] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals. Wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0150] The fourth embodiment of this application provides a storage medium on which a computer program is stored. When executed by a processor, the program implements a DNS request-response log stream threat abnormal behavior analysis method proposed in the first embodiment. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0151] This invention provides a method and system for analyzing the threat and abnormal behavior of DNS request and response log streams. Many methods and approaches exist for implementing this technical solution; the above description is merely a preferred embodiment of the invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention. All components not explicitly stated in this embodiment can be implemented using existing technologies.

Claims

1. A DNS request response log stream threat anomaly behavior analysis method, characterized in that, The method comprises the following steps: acquiring original DNS request response log streams in a network environment, extracting query domain names, source IPs, destination IPs, timestamps and IP lists from the log streams, performing semantic hierarchical segmentation on the query domain names to obtain four hierarchical structures; based on the character distribution features of each hierarchical structure and the naturalness evaluation results of the pre-trained language model, a multi-granularity DGA suspiciousness score is generated through attention mechanism fusion; a dynamic heterogeneous graph is constructed with domain names, IPs and ASs as nodes, and resolution, attribution and subdomain relationships as edges, node embeddings are learned using graph attention networks, and basic propagation entropy is calculated based on the connection frequency distribution within a sliding time window; a dynamic influence factor is introduced to modify the basic propagation entropy, which is adaptively adjusted according to the difference in connection mode between adjacent sliding time windows and the sudden increase ratio; a time series is constructed for the query frequency of the main domain, a dynamic baseline is generated using a trend and periodic decomposition model, and a mutation anomaly score is generated by combining residual analysis and new domain name identification; the DGA suspiciousness score, the modified propagation entropy and the mutation anomaly score are input into a Bayesian fusion model to generate an initial comprehensive threat score; the initial comprehensive threat score is subjected to dynamic attenuation processing based on risk probability perturbation, the score attenuation rate is dynamically adjusted according to the current network security situation, asset importance and the context information of DNS response actions, and a threat score is generated.

2. The DNS request response log stream threat anomaly behavior analysis method of claim 1, wherein, The method comprises the following steps: The query domain names are subjected to semantic hierarchical segmentation to obtain four hierarchical structures, including: The query domain names in each DNS request response log stream are inversely parsed with a delimiter, the last string of characters is extracted as the top-level domain level; the second last string of characters is extracted as the second-level domain level; 3. The DNS request-response log stream anomaly behavior analysis method of claim 2, wherein, the remaining preposed characters are combined in order to form a subdomain part, the subdomain part is separated again by the delimiter, and it is identified whether it contains a preset functional semantic label by external data, if there are multiple functional semantic labels, the first three label levels are retained in the order from right to left, set as the third-level domain level, and the rest are combined as the generalized subdomain level, i.e. the fourth-level domain level. The method comprises the following steps: calculating a character-level shannon entropy of the layer according to the frequency of occurrence of each character ; The complete query domain name is input into a legal domain name corpus pre-training language model to obtain an average log-likelihood score of the complete query domain name by the model, denoted as ; Converting the character level Shannon entropy of each level to a perplexity value ; The character-level Shannon entropy of each level is calculated with the perplexity value as an input feature vector, into the attention network; Attention network computing , , The weight distribution coefficient of each feature; all features are weighted and fused, and the normalized multi-granularity DGA suspicious degree score is output.

4. The DNS request-response log stream anomaly behavior analysis method of claim 3, wherein, For each layer in the four hierarchical structures, the frequency of each character in the string of the layer is counted; The method comprises the following steps: In the dynamic heterogeneous graph, the connection behavior of each node within the sliding time window is defined; normalizing the propagation behavior vector into a probability distribution, calculating the KL divergence between the probability distribution of the current window and the previous window probability distribution as the connection pattern difference degree ; calculating a surge ratio as a growth ratio of the current window connection total relative to the historical mean ; The connection mode difference degree The sudden increase ratio The dynamic influence factor is generated by a sigmoid function after weighting The number of connections from the node to each neighbor node is counted to form a propagation behavior vector; 5. The DNS request-response log stream anomaly behavior analysis method of claim 4, wherein, The basic propagation entropy is multiplied by the dynamic influence factor to obtain the modified propagation entropy. The method comprises the following steps: The number of DNS queries of each main domain within a continuous time period is counted in units of minutes to construct a time series; The STL decomposition algorithm is used to decompose the time series into trend and periodic terms; The trend term and the periodic term are added to obtain the dynamic baseline prediction value; Calculate the deviation of the current observation value and the dynamic baseline prediction value; Standardize the deviation to obtain standardized residuals; If the current main domain or its sub-domain appears for the first time, activate the new domain name identification signal, otherwise keep it inactivated state; Adjust the sensitivity gain factor according to the local variance rate of the residual sequence; Multiply the standardized residuals, the new domain name identification signal and the sensitivity gain factor to generate a mutation anomaly score.

6. The DNS request-response log stream anomaly behavior analysis method of claim 5, wherein, The DGA suspiciousness score, the corrected propagation entropy and the mutation anomaly score are input into the Bayesian fusion model to generate an initial comprehensive threat score, which comprises: The multi-granularity DGA suspiciousness score, the corrected propagation entropy and the mutation anomaly score are input into the Bayesian inference framework as three independent evidences; Statistical each piece of evidence based on historical confirmed malicious event dataset The conditional probability of the occurrence of a malicious attack M, denoted as , ; Simultaneously, statistics of each evidence The conditional probability of occurrence in normal behavior N, denoted as ; Setting the prior probability and represents the initial estimate that the event is malicious or normal; The posterior probability is calculated using Bayes' formula as the initial composite threat score , expressed as: ； where, represents the multiplication of the conditional probabilities of the three pieces of evidence, reflecting the combined likelihood of the event being malicious given the evidence.

7. The DNS request-response log stream anomaly behavior analysis method of claim 6, wherein, The dynamic attenuation processing based on risk probability disturbance is performed on the initial comprehensive threat score, and the score attenuation rate is dynamically adjusted according to the current network security situation, asset importance and context information of DNS response actions, and a threat score is generated, including: setting an initial comprehensive threat score an attenuation function that naturally attenuates over time; Real-time collection of context information, including the importance level of the source IP, the current active index of similar threats in the network and the impact of such threat events, and whether the IP or domain name associated with the event has been blocked by the security device; Generate a risk disturbance factor according to the context information; Add the risk disturbance factor to the basic decay function to obtain a dynamic decay coefficient; The initial comprehensive threat score is obtained The final threat score at the current time is obtained by multiplying the dynamic attenuation coefficient.

8. A DNS request-response log stream threat anomaly behavior analysis system, characterized in that, It comprises a log analysis module, a semantic segmentation module, a DGA scoring module, a graph entropy correction module, a mutation detection module, a Bayesian fusion module and a dynamic decay module; The log analysis module is used to obtain the original DNS request response log stream in the network environment, and extract the query domain name, source IP, destination IP, timestamp and resolved IP list; The semantic segmentation module is used to perform semantic hierarchical division on the query domain name and construct a four-level structure; The DGA scoring module is used to generate a multi-granularity DGA suspiciousness score through attention mechanism fusion based on the character distribution features of each hierarchical structure and the naturalness evaluation results of the pre-trained language model; The graph entropy correction module is used to construct a dynamic heterogeneous graph with domain names, IPs and ASs as nodes, and analysis relationship, ownership relationship and sub-domain relationship as edges, to calculate the basic propagation entropy by sliding time window statistics of node connection frequency, and to correct the entropy value by introducing a dynamic influence factor, which is generated by weighting the KL divergence of connection probability distribution and the connection total amount sudden increase ratio between adjacent windows; The mutation detection module is used to construct a time series of the query frequency of the main domain, generate a dynamic baseline by using a trend and period decomposition model, and generate a mutation anomaly score by combining residual analysis and new domain name identification; The Bayesian fusion module is used to calculate the posterior probability by Bayesian inference after inputting the DGA suspiciousness score, the corrected propagation entropy and the mutation anomaly score, and generate an initial comprehensive threat score; The dynamic decay module is used to implement dynamic decay processing of the initial comprehensive threat score based on risk probability disturbance, dynamically adjust the score decay rate according to the current network security situation, asset importance and context information of response actions, and generate a threat score. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor executes the computer program to realize the steps of the DNS request response log stream threat abnormal behavior analysis method in any one of claims 1-7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the DNS request response log stream threat abnormal behavior analysis method according to any one of claims 1-7.

Images