A dns request response log stream threat abnormal behavior analysis method and system

Abstract

The application discloses a DNS request response log stream threat abnormal behavior analysis method and system, and belongs to the technical field of log stream threat analysis. The method comprises the following steps: acquiring original DNS request response log streams in a network environment, extracting domain names, and performing semantic hierarchical segmentation on the domain names; based on the character distribution characteristics of each level and the naturalness evaluation results of a pre-trained language model, generating a multi-granularity DGA suspiciousness score; constructing a dynamic heterogeneous graph, learning node embedding, calculating basic propagation entropy, and modifying the basic propagation entropy; generating a mutation anomaly score; inputting the DGA suspiciousness score, the modified propagation entropy and the mutation anomaly score into a Bayesian fusion model to generate an initial comprehensive threat score; and performing dynamic attenuation processing on the initial comprehensive threat score, dynamically adjusting the score attenuation rate, and generating a threat score. The method and system improve the detection accuracy and response capability of hidden threat behaviors in the DNS request response log stream.

Description

A method and system for analyzing threat and abnormal behavior in DNS request and response log streams Technical Field

[0001] This invention belongs to the field of log stream threat analysis technology, and in particular, it is a method and system for analyzing abnormal threat behavior in DNS request and response log streams. Background Technology

[0002] DNS request-response log stream threat analysis technology is a network security detection method that identifies potential malicious behaviors or security threats by collecting, parsing, and deeply analyzing Domain Name System (DNS) query and response logs generated in the network environment. DNS serves as the internet's telephone directory, and almost all network communications rely on it to resolve domain names to IP addresses. Therefore, how to utilize advanced technologies to improve the intelligence and security of DNS request-response log stream threat analysis has become one of the urgent problems to be solved.

[0003] In the field of DNS request and response log stream threat analysis, existing methods rely on character distribution entropy or length thresholds to determine DGA (Domain Generation Algorithm). This can easily misjudge high-entropy legitimate domains as malicious or miss naturally structured DGAs. Furthermore, traditional techniques typically treat domains as whole strings or simply split them into subdomains and main domains, lacking the ability to semantically recognize and hierarchically classify functional tags in subdomains. This makes it impossible to effectively identify malicious subdomains constructed using legitimate tags. Summary of the Invention

[0004] Purpose of the invention: The technical problem to be solved by the present invention is to provide a method and system for analyzing the threat and abnormal behavior of DNS request and response log streams, addressing the shortcomings of the existing technology.

[0005] To address the aforementioned technical problems, in a first aspect, the present invention provides a method for analyzing the threat and abnormal behavior of DNS request-response log streams, comprising:

[0006] Obtain the original DNS request and response log stream in the network environment, extract the queried domain name, source IP, destination IP, timestamp, and resolution IP list from the log stream, and perform semantic hierarchical segmentation on the queried domain name to obtain a four-level structure;

[0007] Based on the character distribution features of each level of structure and the naturalness evaluation results of the pre-trained language model, a multi-granularity DGA suspicion score is generated by fusion through an attention mechanism.

[0008] Construct a dynamic heterogeneous graph with domain names, IP addresses, and Autonomous Systems (AS) as nodes and resolution, attribution, and subdomain relationships as edges. Utilize graph attention networks to learn node embeddings and calculate the underlying propagation entropy based on the connection frequency distribution within a sliding time window.

[0009] A dynamic influence factor is introduced to correct the basic propagation entropy. The dynamic influence factor is adaptively adjusted according to the difference in connection modes and the burst ratio between adjacent sliding time windows.

[0010] A time series of query frequencies for the main domain is constructed, and a dynamic baseline is generated using trend and periodic decomposition models. A mutation anomaly score is generated by combining residual analysis and new domain name identifiers.

[0011] The DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score are input into the Bayesian fusion model to generate an initial comprehensive threat score.

[0012] The initial comprehensive threat score is dynamically attenuated based on risk probability perturbation. The score attenuation rate is dynamically adjusted according to the current network security situation, asset importance, and contextual information of DNS response actions to generate a threat score.

[0013] Furthermore, the queried domain name is semantically segmented to obtain a four-level structure, including:

[0014] The query domain names in each DNS request and response log stream are reversed using delimiters, and the last string is extracted as the top-level domain level.

[0015] Extract the second-to-last string as the second-level field.

[0016] Merge the remaining prefix strings into subfields in order;

[0017] The subdomain is further divided by delimiters to identify whether it contains preset functional semantic tags, which include api, cdn, mail, www, svc, dev, and test;

[0018] If there are multiple functional semantic tags, the first three tag levels are retained from right to left and set as the third-level domain level, and the rest are merged into the generalized subdomain level, i.e., the fourth-level domain level.

[0019] Furthermore, the character distribution features based on each hierarchical structure and the naturalness evaluation results of the pre-trained language model are fused through an attention mechanism to generate a multi-granularity DGA suspicion score. The specific steps are as follows:

[0020] For each layer of the four-layer structure, count the frequency of each character in the string of that layer, and denot it as... ;

[0021] Calculate the character-level Shannon entropy of this layer based on character frequency. The expression is:

[0022] ;

[0023] in, Character-level Shannon entropy measures the uncertainty of character distribution within a domain name string at a specific level. This represents the probability of a certain character appearing in this level. To sum the probabilities, iterate through all characters that appear in this level.

[0024] The complete query domain name is input into a language model pre-trained on a corpus of legal domain names, and the average log-likelihood score of the model for the complete query domain name is obtained, denoted as . ;

[0025] Shannon entropy at each level of character level Convert to perplexity value ;

[0026] Shannon entropy at each level of character level With confusion value As input feature vectors, they are fed into the attention network;

[0027] Attention network computation , , Weighting coefficients for each feature;

[0028] All features are weighted and fused to output a normalized multi-granularity DGA suspicion score.

[0029] By performing fine-grained semantic hierarchical segmentation of domain names and integrating character distribution entropy with language model naturalness assessment, the ability to identify DGA-type malicious domain names has been enhanced.

[0030] Furthermore, the introduction of a dynamic influence factor to correct the basic propagation entropy, wherein the dynamic influence factor is adaptively adjusted according to the difference in connection patterns and the burst ratio between adjacent time windows, specifically through the following steps:

[0031] In a dynamic heterogeneous graph, the connection behavior of each node within a sliding time window is defined;

[0032] Count the number of connections from the node to each of its neighboring nodes to obtain the propagation behavior vector;

[0033] The propagation behavior vector is normalized into a probability distribution, denoted as . ,in Indicates the first One neighboring node;

[0034] Calculate the KL divergence between the probability distributions of the current window and the previous window, as the degree of difference in connection patterns. The expression is:

[0035] ;

[0036] in, This represents the KL divergence, used to quantify the difference in the probability distribution of node connection behavior between the current time window and the previous time window. This indicates that the node in the current window points to the first... The connection probability of each neighbor. This represents the connection probability of the corresponding neighbor in the previous window. Iterate through and sum all possible neighbor nodes.

[0037] Calculate the growth rate of the current total number of window connections relative to the historical average, as the burst rate. ;

[0038] Differences in connection modes With the increase ratio After weighting, a dynamic impact factor is generated using the Sigmoid function. The expression is:

[0039] ;

[0040] in, This represents a dynamic influencing factor, used to enhance sensitivity to short-term burst behaviors. and These are adjustable weighting coefficients to control the contribution of variability and surge ratio to the final impact factor;

[0041] Basic propagation entropy and Multiply by this to obtain the corrected propagation entropy. .

[0042] Furthermore, the query frequency of the main domain is used to construct a time series, a trend-cycle decomposition model is used to generate a dynamic baseline, and residual analysis and new domain name identifiers are combined to generate a mutation anomaly score. The specific steps are as follows:

[0043] Count the number of DNS queries for each primary domain within a continuous time period, using minutes as the unit, and construct a time series;

[0044] The STL decomposition algorithm is used to decompose the time series into trend and periodic components;

[0045] Add the trend term and the period term to obtain the dynamic baseline prediction value;

[0046] Calculate the deviation between the current observation and the dynamic baseline prediction;

[0047] The deviation is standardized to obtain the standardized residual.

[0048] If the current primary domain or its subdomain appears for the first time, the new domain name identifier signal will be activated; otherwise, it will remain inactive.

[0049] The sensitivity gain factor is adjusted based on the rate of change of local variance of the residual sequence;

[0050] The standardized residual, the new domain name identifier signal, and the sensitivity gain factor are multiplied to generate a mutation anomaly score.

[0051] By introducing a dynamic impact factor to correct the propagation entropy, the mutation characteristics of abnormal connection patterns can be effectively captured. Combined with the mutation detection of trend-period decomposition and the new domain name identification mechanism, the sensitivity to attacks such as sudden DNS amplification or C2 communication is improved.

[0052] Furthermore, the specific steps for inputting the DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score into the Bayesian fusion model to generate an initial comprehensive threat score are as follows:

[0053] The multi-granularity DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score are input into the Bayesian inference framework as three independent pieces of evidence.

[0054] Based on historically confirmed malicious event datasets, statistical analysis is performed on each piece of evidence. The conditional probability of a malicious attack M occurring is denoted as . , ;

[0055] At the same time, various pieces of evidence were compiled. The conditional probability of occurrence in normal behavior N is denoted as . ;

[0056] Set prior probabilities and This indicates an initial assessment that the event was malicious or normal.

[0057] The posterior probability is calculated using Bayes' theorem and used as the initial comprehensive threat score. The expression is:

[0058] ;

[0059] in, This represents the product of the conditional probabilities of the three pieces of evidence, reflecting the combined probability that the event was malicious given the evidence.

[0060] Furthermore, the initial comprehensive threat score undergoes dynamic attenuation processing based on risk probability perturbations. The attenuation rate is dynamically adjusted according to the current cybersecurity situation, asset importance, and contextual information of response actions to generate a threat score. The specific steps are as follows:

[0061] Set initial comprehensive threat score The fundamental decay function that decays naturally over time ;

[0062] Real-time collection of contextual information, including the importance level of the asset to which the source IP belongs, the current activity index of similar threats in the network and the impact of such threat events, and whether the IP or domain associated with the event has been blocked by security devices;

[0063] Generate risk disturbance factors based on contextual information. ;

[0064] Risk disturbance factors With the basic decay function Add them together to form the dynamic attenuation coefficient. ;

[0065] Initial comprehensive threat score With dynamic attenuation coefficient Multiply them to get the final threat score at the current moment. The expression is:

[0066] ;

[0067] ;

[0068] in, This indicates the final threat score. This indicates the time interval since the event occurred. The score decays as asset importance increases, threat activity rises, or response actions are not taken.

[0069] By using a Bayesian fusion model to achieve quantitative integration of multi-source evidence, the rationality of scoring is improved. Furthermore, by leveraging a context-aware dynamic decay mechanism, the attention period for high-risk events is extended, avoiding false decay that could lead to missed reports.

[0070] Secondly, a DNS request and response log stream threat anomaly behavior analysis system is provided, including: a log parsing module, a semantic segmentation module, a DGA scoring module, a graph entropy correction module, a mutation detection module, a Bayesian fusion module, and a dynamic decay module;

[0071] The log parsing module is used to obtain the original DNS request and response log stream in the network environment and extract the queried domain name, source IP, destination IP, timestamp, and list of resolved IPs.

[0072] The semantic segmentation module is used to perform semantic hierarchical division of the query domain name and construct a four-level structure;

[0073] The DGA scoring module is used to generate multi-granularity DGA suspicion scores by fusing the character distribution features of each level structure and the naturalness evaluation results of the pre-trained language model through an attention mechanism.

[0074] The graph entropy correction module is used to construct a dynamic heterogeneous graph with domain name, IP address, and AS as nodes, and resolution relationship, attribution relationship, and subdomain relationship as edges. It calculates the basic propagation entropy by counting the node connection frequency through a sliding time window. It introduces a dynamic influence factor to correct the entropy value. The dynamic influence factor is generated by weighting the KL divergence of the connection probability distribution between adjacent windows and the sudden increase ratio of the total number of connections.

[0075] The mutation detection module is used to construct a time series of query frequencies of the main domain, generate a dynamic baseline using trend and periodic decomposition models, and generate mutation anomaly scores by combining residual analysis and new domain name identifiers.

[0076] The Bayesian fusion module is used to calculate the posterior probability of the DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score through Bayesian inference to generate an initial comprehensive threat score.

[0077] The dynamic attenuation module is used to perform dynamic attenuation processing on the initial comprehensive threat score based on risk probability perturbation. It dynamically adjusts the score attenuation rate according to the current network security situation, asset importance, and context information of response actions to generate a threat score.

[0078] Furthermore, the semantic segmentation module is used to perform hierarchical structure parsing on the queried domain name. It splits the domain in reverse order using delimiters, extracting the last string as the top-level domain; extracts the second-to-last string as the second-level domain; merges the remaining preceding strings sequentially into subdomains, and further segments the subdomains using delimiters. External data is used to identify whether preset functional semantic tags are present. If multiple functional semantic tags exist, the first three tags are retained from right to left and set as the third-level domain, while the rest are merged into a generalized subdomain level, i.e., the fourth-level domain. The subdomains are semantically categorized based on the preset functional tags to construct a four-level structure.

[0079] Furthermore, the DGA scoring module is used to statistically analyze the character distribution of each level in the four-layer structure, calculate the character-level Shannon entropy, evaluate the sequence naturalness of the complete domain name using a language model pre-trained on a legal domain name corpus, generate a perplexity value, and input multi-dimensional features into the attention network to achieve adaptive weight allocation and output a normalized multi-granularity DGA perplexity score.

[0080] Furthermore, the mutation detection module is used to count the DNS query frequency of the main domain at the minute level to form a time series, use the STL decomposition algorithm to separate the trend term and the periodic term, generate a dynamic baseline prediction value, calculate the deviation between the observed value and the baseline and standardize it into a residual, and combine the new domain name identification signal and the sensitivity gain factor adjusted based on the residual variance change rate to comprehensively generate a mutation anomaly score.

[0081] Furthermore, the Bayesian fusion module is used to treat the DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score as three independent pieces of evidence. Based on historical malicious and normal event samples, the conditional probabilities of each piece of evidence under different categories are statistically analyzed. After setting the prior probability, the posterior probability is calculated through Bayesian inference to generate an initial score that reflects the overall threat probability.

[0082] Furthermore, the dynamic decay module is used to implement decay control on the initial comprehensive threat score over time, set a basic decay function, and generate a risk disturbance factor in combination with real-time context information. The context information includes the importance level of the source IP asset, the activity index of similar threats and the impact of such threat events, as well as the blocking response status. The decay rate is adjusted through the disturbance factor, and the threat score at the current moment is output.

[0083] Thirdly, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the DNS request-response log stream threat anomaly behavior analysis method as described in the first aspect of the present invention.

[0084] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the DNS request-response log stream threat anomaly behavior analysis method as described in the first aspect of the present invention.

[0085] The beneficial effects of this invention are as follows: By using a multi-dimensional feature extraction and dynamic adaptive analysis mechanism, the detection accuracy and response capability of hidden threat behaviors in DNS request and response log streams are improved; by performing fine-grained semantic hierarchical segmentation of domain names and fusing character distribution entropy and language model naturalness assessment, the ability to identify DGA-type malicious domain names is enhanced; by introducing a dynamic influence factor to correct propagation entropy, the mutation characteristics of abnormal connection patterns are effectively captured; by combining trend-period decomposition mutation detection and new domain name identification mechanism, the sensitivity to sudden DNS amplification or C2 communication attacks is improved; by using a Bayesian fusion model to achieve quantitative integration of multi-source evidence, the rationality of scoring is improved; and by using a context-aware dynamic decay mechanism, the attention period for high-risk events is extended, avoiding false decay leading to missed detections. To address the problem that existing methods rely on character distribution entropy or length thresholds to determine DGAs, which can easily misclassify high-entropy legitimate domains as malicious or miss naturally structured DGAs, and that traditional techniques typically treat domains as whole strings or simply split them into subdomains and main domains, lacking the ability to semantically recognize and hierarchically classify functional tags in subdomains, thus failing to effectively identify malicious subdomains constructed through legitimate tags. Attached Figure Description

[0086] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments, and the advantages of the present invention in the above and / or other aspects will become clearer.

[0087] Figure 1 is a flowchart of a method for analyzing the threat and abnormal behavior of DNS request and response log streams provided in an embodiment of this application.

[0088] Figure 2 is a schematic diagram of a DNS request and response log stream threat abnormal behavior analysis system provided in an embodiment of this application. Detailed Implementation

[0089] The embodiments of the present invention will now be described with reference to the accompanying drawings.

[0090] The first embodiment of this application provides a method for analyzing the threat and abnormal behavior of DNS request and response log streams, as shown in Figure 1, including the following steps:

[0091] Step S1: Obtain the raw DNS request and response log stream in the network environment, extract the queried domain name, source IP, destination IP, timestamp, and list of resolved IPs, and perform semantic hierarchical segmentation on the domain name to obtain a four-level structure, specifically including:

[0092] The query domain names in each DNS request and response log stream are reversed and resolved using a delimiter. The last field is extracted as the top-level domain level; the second-to-last field is extracted as the second-level domain level; the remaining preceding fields are merged in order into subdomains; the subdomains are then separated again using a delimiter, and it is identified whether they contain preset functional semantic tags, including api, cdn, mail, www, svc, dev, and test.

[0093] If there are multiple functional semantic tags, the first three tag levels are retained from right to left and set as the third-level domain level; the rest are merged into a generalized subdomain level, i.e., the fourth-level domain level.

[0094] By semantically segmenting domain names, their structural composition can be effectively restored, laying the foundation for subsequent multi-dimensional feature extraction. This hierarchical structure not only preserves the syntactic information of the domain names, but also enhances semantic understanding capabilities through functional tag recognition, which helps to distinguish normal business domain names from disguised malicious domain names and improves the accuracy of perceiving abnormal domain-level behavior.

[0095] Step S2: Based on the character distribution features of each hierarchical structure and the naturalness evaluation results of the pre-trained language model, a multi-granularity DGA suspicion score is generated by fusing them through an attention mechanism, specifically including:

[0096] For each level in the four-level structure, count the frequency of each character in the string of that level, and denot it as... Calculate the character-level Shannon entropy of this layer based on character frequency. The expression is:

[0097] ;

[0098] in, Character-level Shannon entropy measures the uncertainty of character distribution within a domain name string at a specific level. This represents the probability of a certain character appearing in this level. Iterate through and sum all the characters that appear in this level.

[0099] The complete query domain name is input into a pre-trained language model based on a corpus of valid domain names. The average log-likelihood score of the model for the complete query domain name is obtained and denoted as . ; The character-level Shannon entropy at each level Convert to perplexity value using the Shannon-McMillan theorem. ; The character-level Shannon entropy at each level With confusion value The input feature vector is fed into the attention network; the attention network calculates... , , Weighting coefficients for each feature; weighted fusion , , All features are used to output a normalized multi-granularity DGA suspicion score.

[0100] The multi-granularity DGA suspiciousness scoring mechanism integrates character-level statistical features with the naturalness assessment of sequence language models, taking into account both local randomness and overall readability. It adaptively weights entropy and perplexity at different levels through an attention mechanism, avoiding the subjectivity of manually setting weights and enhancing the model's ability to generalize and identify new or variant DGA domain names.

[0101] Step S3: Construct a dynamic heterogeneous graph with domain name, IP address, and AS as nodes, and resolution, attribution, and subdomain relationships as edges. Use a graph attention network to learn node embeddings and calculate the basic propagation entropy based on the connection frequency distribution within a sliding time window. Specifically, this includes:

[0102] Three types of nodes are defined, including domain name nodes, IP address nodes, and autonomous system (AS) nodes. Domain name nodes represent the complete or hierarchical domain name being queried, IP address nodes represent the source and destination IP addresses returned in the resolution response, and AS nodes represent the autonomous system number to which the IP address belongs. AS affiliation mapping is performed through an IP geodatabase or a BGP (Border Gateway Protocol) routing table.

[0103] Three edge types are defined, including resolution edges, home edges, and subdomain edges. Resolution edges connect domain name nodes to their corresponding IP name nodes, with the direction from the domain name to the IP name. The edge weight is initialized to the number of times the domain name resolves to the IP name within a specified time window. Home edges connect IP name nodes to their respective AS nodes, are undirected, and are used to express network topology affiliation. Subdomain edges connect subdomain name nodes to their parent domain name nodes, with the direction from the subdomain to the parent domain, and are used to characterize the domain name hierarchy.

[0104] A fixed-length sliding time window is divided on a continuous time axis. All DNS resolution records for that period are collected within each sliding time window, and the dynamic heterogeneous graph structure is dynamically updated accordingly. At the same time, the sliding window changes according to the domain name creation time and the current time difference: newly added nodes and edges are added, the connection frequency of existing edges is accumulated, and old connections that exceed the time window range are aged out and removed, forming a dynamic heterogeneous graph that evolves over time.

[0105] The original features of each node are vectorized. The features of the domain name node include length, character entropy, whether it contains sensitive tags and DGA suspicion score. The features of the IP node include geographical location, whether it is a CDN (Content Delivery Network) node and historical resolution frequency. The features of the AS node include country of origin, organization type and historical activity.

[0106] Using the above features as input, the graph attention network (GAT) aggregates neighbor information through a multi-layer attention mechanism to learn low-dimensional dense node embedding vectors. During the embedding process, a heterogeneous attention mechanism is used to distinguish the influence weights of different edge types, enabling the GAT model to capture the semantic associations between cross-type nodes.

[0107] Based on the node embedding, for each domain name node, the propagation behavior vector consisting of the frequency of connections to each resolved IP within the current time window is extracted and normalized into a probability distribution.

[0108] Based on this probability distribution, its Shannon entropy is calculated and used as the basic propagation entropy of this node. The entropy value reflects the dispersion and uncertainty of the resolution target. The higher the entropy value, the more dispersed the resolution target, corresponding to DGA or load balancing behavior. The lower the entropy value, the more fixed the resolution of a certain IP in the long term.

[0109] Dynamic heterogeneous graph modeling enables a structured representation of complex relationships between DNS entities. Graph attention networks fully capture the association patterns between cross-type nodes during the learning node embedding process. The basic propagation entropy calculated based on sliding windows quantifies the distribution dispersion of domain name resolution targets, providing an effective criterion for identifying abnormal propagation behaviors such as C2 communication and wildcard domain name resolution.

[0110] Step S4: Introduce a dynamic influence factor to correct the basic propagation entropy. The dynamic influence factor is adaptively adjusted according to the difference and surge ratio of the connection patterns between adjacent time windows, specifically including:

[0111] In a dynamic heterogeneous graph, the connection behavior of each node within a sliding time window is defined, where the length of the sliding time window is the difference between the domain name creation time and the current time. Negative correlation; count the number of connections from this node to each of its neighboring nodes to form a propagation behavior vector; normalize the propagation behavior vector into a probability distribution, denoted as . ,in Indicates the first Calculate the KL (Kullback-Leibler) divergence between the probability distributions of the current window and the previous window, using it as the connectivity pattern dissimilarity. The expression is:

[0112] ;

[0113] in, This represents the KL divergence, used to quantify the difference in the probability distribution of node connection behavior between the current time window and the previous window. This indicates that the node in the current window points to the first... The connection probability of each neighbor. This represents the connection probability of the corresponding neighbor in the previous window. The sum is obtained by iterating through all possible neighbor nodes.

[0114] Calculate the growth rate of the current total number of window connections relative to the historical average, as the burst rate. ;Will and After weighting, a dynamic impact factor is generated using the Sigmoid function. The expression is:

[0115] ;

[0116] in, This represents a dynamic influencing factor, used to enhance sensitivity to short-term burst behaviors. and The adjustable weighting coefficients control the contribution of the degree of difference and the rate of increase to the final influencing factor.

[0117] The basic propagation entropy and Multiply by this to obtain the corrected propagation entropy. .

[0118] The introduction of a dynamic influencing factor to correct the basic propagation entropy significantly improves the sensitivity to short-term abrupt changes. This mechanism measures the drift of connectivity patterns through KL divergence and reflects the characteristics of traffic bursts by combining the burst ratio. The dynamic influencing factor generated by the fusion of the two can adaptively enhance the entropy response during abnormal periods and effectively suppress misjudgments caused by normal periodic fluctuations.

[0119] Step S5: Construct a time series of query frequencies for the main domain, generate a dynamic baseline using trend and periodic decomposition models, and generate abrupt change anomaly scores by combining residual analysis and new domain name identifiers. Specifically, this includes:

[0120] The number of DNS queries for each primary domain within a continuous time period is counted in minutes to construct a time series. The STL (Seasonal and Trend decomposition using Loess) decomposition algorithm is used to decompose the time series into trend items and periodic items.

[0121] The trend term and the periodic term are added together to generate the dynamic baseline prediction value; the deviation between the current observation value and the dynamic baseline is calculated; the deviation is standardized to obtain the standardized residual; if the current main domain or its subdomain appears in the system for the first time, the new domain name identification signal is activated; otherwise, it remains inactive.

[0122] The sensitivity gain factor is adjusted based on the rate of change of local variance of the residual sequence; the standardized residual, the new domain name identifier signal, and the sensitivity gain factor are multiplied to generate a mutation anomaly score.

[0123] The construction of mutation anomaly scores fully considers the trend and periodicity of time series, uses STL decomposition to generate dynamic baselines, avoids the high false alarm problem of static threshold detection in complex network environments, and combines new domain name identification and adaptive sensitivity adjustment to enable the system to respond quickly when facing the first appearance of malicious domain or sudden query flooding attacks.

[0124] Step S6: Input the DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score into the Bayesian fusion model to generate the initial comprehensive threat score.

[0125] The multi-granularity DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score are input as three independent pieces of evidence into the Bayesian inference framework.

[0126] Based on historically confirmed malicious event datasets, statistical analysis is performed on each piece of evidence. The conditional probability of a malicious attack M occurring is denoted as . At the same time, various pieces of evidence were compiled. The conditional probability of occurrence in normal behavior N is denoted as . .

[0127] Set prior probabilities and This represents the initial estimate of whether the event is malicious or normal; the posterior probability is calculated using Bayes' theorem as the initial comprehensive threat score, expressed as:

[0128] ;

[0129] in, This indicates the initial overall threat score. This represents the product of the conditional probabilities of the three pieces of evidence, reflecting the combined probability that the event was malicious given the evidence.

[0130] The Bayesian fusion model achieves the quantitative integration of multi-source heterogeneous evidence, unifying DGA scores, propagation entropy, and mutation scores into a probabilistic framework for reasoning. The method learns conditional probabilities based on historical data, possesses clear interpretability, and can reasonably assess the comprehensive threat level in uncertain environments, reducing the impact of misjudgments by a single indicator on the overall results.

[0131] Step S7: Implement dynamic attenuation processing on the initial comprehensive threat score based on risk probability perturbation. Adjust the score attenuation rate dynamically according to the current network security situation, asset importance, and contextual information of DNS response actions to generate a threat score. Specifically, this includes:

[0132] Set initial comprehensive threat score The fundamental decay function that decays naturally over time .

[0133] Real-time collection of contextual information, including the importance level of the asset to which the source IP belongs, the current activity index of similar threats in the network, and whether the IP or domain associated with the event has been blocked by security devices.

[0134] Threat scoring is performed on the subjects and objects accessing DNS based on their historical behavior. The access time is evaluated based on behavioral dimensions such as abnormal time and frequency to obtain a behavioral score. Then, after linear combination normalization, the risk disturbance factor is generated. Risk disturbance factors With the basic decay function Add them together to form the dynamic attenuation coefficient. The initial comprehensive threat score will be used to determine the threat level. With dynamic attenuation coefficient Multiply them to get the final threat score at the current moment. The expression is:

[0135]

[0136] ;

[0137] in, This indicates the final threat score. This indicates the time interval since the event occurred. The score decays as asset importance increases, threat activity rises, or response actions are not taken.

[0138] Based on the current threat score, a corresponding level of alert can also be triggered.

[0139] The dynamic decay mechanism based on risk probability perturbation enables lifecycle management of threat scores. By introducing contextual information such as asset importance, threat activity, and response status to adjust the decay rate, it ensures that high-value target-related events or unaddressed threats maintain a sufficiently long window of attention, preventing important alerts from disappearing prematurely and improving the continuity and effectiveness of security operations.

[0140] The second embodiment of this application provides a DNS request and response log stream threat abnormal behavior analysis system, as shown in Figure 2, including a log parsing module, a semantic segmentation module, a DGA scoring module, a graph entropy correction module, a mutation detection module, a Bayesian fusion module, and a dynamic decay module.

[0141] The log parsing module is used to obtain the original DNS request and response log stream in the network environment, extract the queried domain name, source IP, destination IP, timestamp and resolution IP list, and pass the data to the subsequent processing unit;

[0142] The semantic segmentation module is used to perform semantic hierarchical division of the query domain name, constructing a four-level structure. Specifically, it parses the query domain name hierarchically, splits it in reverse order using delimiters, extracts the last string as the top-level domain, extracts the second-to-last string as the second-level domain, merges the remaining preceding strings in order into subdomains, further splits the subdomains by delimiters, and identifies whether they contain preset functional semantic tags through external data. If multiple functional semantic tags exist, the first three tag levels are retained from right to left and set as the third-level domain, while the rest are merged into generalized subdomain levels, i.e., the fourth-level domain. The subdomains are then semantically categorized based on the preset functional tags to construct the four-level structure.

[0143] The DGA scoring module is used to evaluate the naturalness of character distribution features at each level and the pre-trained language model. It generates multi-granularity DGA suspicion scores by fusing them through an attention mechanism. Specifically, it performs statistical analysis on the character distribution at each level of the four-layer structure, calculates character-level Shannon entropy, evaluates the sequence naturalness of complete domain names using a language model pre-trained on a legal domain name corpus, generates perplexity values, and inputs multi-dimensional features into the attention network to achieve adaptive weight allocation and output normalized multi-granularity DGA suspicion scores.

[0144] The graph entropy correction module is used to construct a dynamic heterogeneous graph with domain name, IP, and AS as nodes and resolution relationship, attribution relationship and subdomain relationship as edges. It calculates the basic propagation entropy by statistically analyzing the node connection frequency through a sliding time window and introduces a dynamic influence factor to correct the entropy value. This factor is generated by weighting the KL divergence of the connection probability distribution between adjacent windows and the sudden increase ratio of the total number of connections, thereby improving the sensitivity to the identification of abnormal propagation behavior.

[0145] The mutation detection module is used to construct a time series of query frequencies of the main domain, generate a dynamic baseline using trend and periodic decomposition models, and generate a mutation anomaly score by combining residual analysis and new domain name identifiers. Specifically, it counts the DNS query frequency of the main domain at the minute level to form a time series, uses the STL decomposition algorithm to separate the trend term and periodic term, generates a dynamic baseline prediction value, calculates the deviation between the observed value and the baseline and standardizes it into a residual, and combines the new domain name identifier signal and a sensitivity gain factor adjusted based on the residual variance change rate to comprehensively generate a mutation anomaly score.

[0146] The Bayesian fusion module is used to treat the DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score as three independent pieces of evidence. Based on historical malicious and normal event samples, the conditional probabilities of each piece of evidence under different categories are statistically analyzed. After setting the prior probability, the posterior probability is calculated through Bayesian inference to generate an initial score that reflects the overall threat probability.

[0147] The dynamic attenuation module is used to dynamically attenuate the initial comprehensive threat score based on risk probability perturbations. It dynamically adjusts the score attenuation rate according to the current network security situation, asset importance, and contextual information of response actions to generate a threat score. Specifically, it implements time-evolving attenuation control on the initial comprehensive threat score, sets a basic attenuation function, and generates risk perturbation factors based on real-time context information. Contextual information includes the importance level of the source IP asset, the activity index of similar threats, and the blocking response status. The attenuation rate is adjusted through the perturbation factor to output the threat score at the current moment. Based on the threat score at the current moment, corresponding alerts can also be triggered.

[0148] The third embodiment of this application provides a computer device, including a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the DNS request-response log stream threat abnormal behavior analysis method proposed in the first embodiment.

[0149] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals. Wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0150] The fourth embodiment of this application provides a storage medium on which a computer program is stored. When executed by a processor, the program implements a DNS request-response log stream threat abnormal behavior analysis method proposed in the first embodiment. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0151] This invention provides a method and system for analyzing the threat and abnormal behavior of DNS request and response log streams. Many methods and approaches exist for implementing this technical solution; the above description is merely a preferred embodiment of the invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention. All components not explicitly stated in this embodiment can be implemented using existing technologies.

Claims

1. A method for analyzing the threat and abnormal behavior of DNS request and response log streams, characterized in that, include: Obtain the original DNS request and response log stream in the network environment, extract the queried domain name, source IP, destination IP, timestamp, and resolution IP list from the log stream, and perform semantic hierarchical segmentation on the queried domain name to obtain a four-level structure; Based on the character distribution features of each level of structure and the naturalness evaluation results of the pre-trained language model, a multi-granularity DGA suspicion score is generated by fusion through an attention mechanism. A dynamic heterogeneous graph is constructed with domain names, IP addresses, and AS addresses as nodes, and resolution, attribution, and subdomain relationships as edges. A graph attention network is used to learn node embeddings, and the basic propagation entropy is calculated based on the connection frequency distribution within a sliding time window. A dynamic influence factor is introduced to correct the basic propagation entropy; this dynamic influence factor is adaptively adjusted according to the difference in connection patterns and the burst ratio between adjacent sliding time windows. A time series of query frequencies for the main domain is constructed, and a dynamic baseline is generated using trend and periodic decomposition models. A mutation anomaly score is generated by combining residual analysis and new domain name identifiers. The DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score are input into a Bayesian fusion model to generate an initial comprehensive threat score. The initial comprehensive threat score is dynamically attenuated based on risk probability perturbation. The score attenuation rate is dynamically adjusted according to the current network security situation, asset importance, and contextual information of DNS response actions to generate a threat score.

2. The method for analyzing threat and abnormal behavior of DNS request and response log streams according to claim 1, characterized in that, The queried domain name is semantically segmented to obtain a four-level structure, including: resolving the queried domain name in each DNS request response log stream in reverse order using a delimiter, and extracting the last string as the top-level domain level; extracting the second-to-last string as the second-level domain level; merging the remaining preceding strings into subdomain parts in order, further dividing the subdomain parts by a delimiter, and identifying whether they contain preset functional semantic tags through external data. If multiple functional semantic tags exist, the first three tag levels are retained from right to left and set as the third-level domain level, while the rest are merged into a generalized subdomain level, i.e., the fourth-level domain level.

3. The method for analyzing threat and abnormal behavior in DNS request and response log streams according to claim 2, characterized in that, The character distribution features based on each level of the structure and the naturalness evaluation results of the pre-trained language model are fused through an attention mechanism to generate a multi-granularity DGA suspicion score, including: for each level in the four-level structure, counting the frequency of occurrence of each character in the string of that level; and calculating the character-level Shannon entropy of that level based on the frequency of occurrence of each character. Input the complete query domain name into a pre-trained language model based on a corpus of valid domain names, and obtain the model's average log-likelihood score for the complete query domain name, denoted as . ; The character-level Shannon entropy at each level Convert to perplexity value ; The character-level Shannon entropy at each level With confusion value The input feature vector is fed into the attention network; the attention network calculates... 、 、 The weighting coefficients for each feature are assigned; all features are weighted and fused to output a normalized multi-granularity DGA suspicion score.

4. The method for analyzing threat and abnormal behavior in DNS request and response log streams according to claim 3, characterized in that, The introduction of dynamic influencing factors to correct the basic propagation entropy includes: defining the connection behavior of each node within a sliding time window in the dynamic heterogeneous graph; counting the number of connections from the node to its neighboring nodes to form a propagation behavior vector; normalizing the propagation behavior vector into a probability distribution; and calculating the KL divergence between the probability distributions of the current window and the previous window as the degree of difference in connection patterns. Calculate the growth rate of the current total number of window connections relative to the historical average, as the burst rate. ; Connectivity differences With the increase ratio After weighting, a dynamic influence factor is generated using the Sigmoid function; the base propagation entropy is multiplied by the dynamic influence factor to obtain the corrected propagation entropy.

5. The method for analyzing threat and abnormal behavior of DNS request and response log streams according to claim 4, characterized in that, The process involves constructing a time series of query frequencies for the primary domain, generating a dynamic baseline using trend and periodic decomposition models, and combining residual analysis and new domain name identifiers to generate a mutation anomaly scores. This includes: counting the number of DNS queries for each primary domain within a continuous time period, on a minute-by-minute basis, to construct a time series; using the STL decomposition algorithm to decompose the time series into trend and periodic components; adding the trend and periodic components to obtain the dynamic baseline prediction; calculating the deviation between the current observation and the dynamic baseline prediction; standardizing the deviation to obtain standardized residuals; activating the new domain name identifier signal if the current primary domain or its subdomains appear for the first time, otherwise remaining inactive; adjusting the sensitivity gain factor based on the local variance change rate of the residual series; and multiplying the standardized residuals, the new domain name identifier signal, and the sensitivity gain factor to generate a mutation anomaly scores.

6. The method for analyzing threat and abnormal behavior of DNS request and response log streams according to claim 5, characterized in that, The process of inputting the DGA suspicion score, corrected propagation entropy, and mutation anomaly score into the Bayesian fusion model to generate an initial comprehensive threat score includes: inputting the multi-granularity DGA suspicion score, corrected propagation entropy, and mutation anomaly score as three independent pieces of evidence into the Bayesian inference framework; and statistically analyzing each piece of evidence based on a historically confirmed malicious event dataset. The conditional probability of occurrence in a malicious attack M is denoted as . ， At the same time, various pieces of evidence were compiled. The conditional probability of occurrence in normal behavior N is denoted as . Set prior probabilities and The initial estimate indicates whether the event is malicious or normal; the posterior probability is calculated using Bayes' theorem and used as the initial comprehensive threat score. The expression is: ;in, This represents the product of the conditional probabilities of the three pieces of evidence, reflecting the combined probability that the event was malicious given the evidence.

7. The method for analyzing threat and abnormal behavior of DNS request and response log streams according to claim 6, characterized in that, The process of applying dynamic attenuation processing to the initial comprehensive threat score based on risk probability perturbations, dynamically adjusting the score attenuation rate according to the current network security situation, asset importance, and contextual information of DNS response actions, to generate a threat score includes: setting the initial comprehensive threat score. The decay function decays naturally over time; real-time collection of contextual information, including the importance level of the asset to which the source IP belongs, the current activity index of similar threats in the network and the impact of such threat events, and whether the IP or domain associated with the event has been blocked by security devices; Generate risk disturbance factors based on contextual information; The dynamic attenuation coefficient is obtained by adding the risk disturbance factor to the basic attenuation function; Initial comprehensive threat score Multiplying the result by the dynamic decay coefficient yields the final threat score for the current moment.

8. A DNS request-response log stream threat anomaly behavior analysis system, characterized in that, It includes a log parsing module, a semantic segmentation module, a DGA scoring module, a graph entropy correction module, a mutation detection module, a Bayesian fusion module, and a dynamic decay module; the log parsing module is used to obtain the original DNS request and response log stream in the network environment and extract the query domain name, source IP, destination IP, timestamp, and resolution IP list; The semantic segmentation module is used to divide the query domain name into semantic levels and construct a four-level structure; the DGA scoring module is used to generate a multi-granularity DGA suspicion score by fusing the character distribution features of each level structure and the naturalness evaluation results of the pre-trained language model through an attention mechanism. The graph entropy correction module is used to construct a dynamic heterogeneous graph with domain names, IPs, and ASs as nodes, and resolution relationships, attribution relationships, and subdomain relationships as edges. It calculates the basic propagation entropy by statistically analyzing the node connection frequency through a sliding time window. A dynamic influence factor is introduced to correct the entropy value. The dynamic influence factor is generated by weighting the KL divergence of the connection probability distribution between adjacent windows and the sudden increase ratio of the total number of connections. The mutation detection module is used to construct a time series of the query frequency of the main domain, generate a dynamic baseline using trend and periodic decomposition models, and generate a mutation anomaly score by combining residual analysis and new domain name identifiers. The Bayesian fusion module is used to calculate the posterior probability of the DGA suspicion score, the corrected propagation entropy, and the mutation anomaly score through Bayesian inference to generate an initial comprehensive threat score. The dynamic decay module is used to perform dynamic decay processing on the initial comprehensive threat score based on risk probability perturbation. According to the current network security situation, asset importance, and context information of response actions, the score decay rate is dynamically adjusted to generate a threat score.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the DNS request response log stream threat abnormal behavior analysis method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the DNS request response log stream threat abnormal behavior analysis method according to any one of claims 1 to 7.

Images