Low-frequency DNS covert channel detection method and system based on evidence accumulation

Abstract

The invention relates to the technical field of network security and traffic anomaly detection, and discloses a low-frequency DNS covert channel detection method and system based on evidence accumulation. The method comprises the following steps: performing continuous evidence accumulation analysis on a DNS request, and calculating the comprehensive confidence so as to judge whether the DNS request is a low-frequency DNS covert channel or not; for accidental abnormal behaviors occurring in a normal DNS service, the abnormal features of the abnormal behaviors are gradually constrained by normal samples along with continuous accumulation of evidences, so that the comprehensive confidence level is reduced, and the misjudgment risk is reduced; for abnormal scenes such as a low-frequency DNS covert channel, an uncertain detection result is difficult to judge and output due to insufficient evidence in an initial stage, but the comprehensive confidence coefficient is improved and finally exceeds a judgment threshold value tau along with the increase of the accumulated query number and the abnormal evidence is gradually enhanced, so that a determined detection judgment result is output. According to the method, in a complex network environment, the high detection rate of the low-frequency DNS covert channel can be obtained, and meanwhile the false alarm rate of normal DNS services is remarkably reduced.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network security and traffic anomaly detection, and particularly relates to a low-frequency DNS covert channel detection method and system based on evidence accumulation. BACKGROUND

[0002] With the development of the Internet, DNS (Domain Name Server) has become a key infrastructure for network communication. Since DNS traffic is usually regarded as necessary and trusted basic business, most network boundary devices adopt a lenient supervision policy, so that attackers can use DNS query fields (such as subdomain names and query types) to construct a covert channel for malicious activities such as command control and data transmission. Compared with high-frequency DNS tunnels, low-frequency DNS covert channels have stronger concealment by reducing the query frequency and prolonging the query interval (up to tens of seconds to tens of minutes) to mix a small number of queries in normal business traffic, which brings significant challenges to detection.

[0003] Existing detection technologies mainly fall into two categories. First, rule-based detection methods usually rely on fixed thresholds or blacklists, such as setting thresholds for subdomain name length, entropy value or query frequency. However, since abnormal features such as CDN (Content Delivery Network) tracking parameters and retry queries may also appear in normal business, this method is prone to false positives and can be easily bypassed by reducing the frequency and dispersing the queries. Second, statistical or machine learning-based detection methods can combine multiple features, but they are generally based on the premise that there are enough samples within a fixed time window. When the attacker deliberately reduces the frequency, the samples within the window are sparse, the feature estimation error increases, the model confidence decreases, and the risk of false positives or false negatives increases. Most methods directly output a hard decision of “normal” or “abnormal”, ignoring the rationality of outputting “uncertain” when the evidence is insufficient, thereby amplifying the false positives caused by accidental fluctuations in low-sample scenarios. SUMMARY

[0004] The purpose of the present application is to provide a low-frequency DNS covert channel detection method and system based on evidence accumulation to solve the problems raised in the background.

[0005] To achieve the above purpose, the present application provides the following technical scheme: a low-frequency DNS covert channel detection method based on evidence accumulation, comprising the following steps:

[0006] A low-frequency DNS covert channel detection method based on evidence accumulation, comprising the following steps:

[0007] S1, acquiring DNS query packets in a network to be detected;

[0008] S2. Using the combination of the source IP address and the main domain name as the session key, group the DNS query message and establish a session;

[0009] S3. Arrange DNS queries under the same session key in ascending order of timestamp to form multiple evidence accumulation units;

[0010] S4. For each evidence accumulation unit, accumulate the number of queries in chronological order to form an evidence sequence;

[0011] S5. When the cumulative number of queries in the evidence sequence reaches at least one preset threshold, a set of features is extracted from the current evidence sequence.

[0012] S6. Construct evidence quality allocation based on the aforementioned features;

[0013] S7. The Dempster combination rule is used to iteratively fuse multiple evidence quality assignments constructed based on different features to obtain a session-level comprehensive confidence score.

[0014] S8. Output the detection result based on the comprehensive confidence level: if the comprehensive confidence level is greater than or equal to the preset confidence level decision threshold, output a confirmed result; if the comprehensive confidence level is less than the confidence level decision threshold, output an uncertain result.

[0015] S9. For sessions that output uncertain detection results, continue to accumulate the number of queries in their evidence sequence until the next threshold is reached, and repeat the steps of feature extraction, evidence quality allocation construction, evidence fusion and confidence determination to achieve phased determination.

[0016] A low-frequency DNS covert channel detection system based on evidence accumulation, comprising:

[0017] Data acquisition and preprocessing module: used to acquire DNS query messages, parse and normalize them, and extract the timestamp, source IP address and query name fields;

[0018] Session grouping and evidence accumulation module: It is used to group DNS query messages and establish sessions using the combination of source IP address and main domain name as session key. Within each session, the DNS queries are arranged in ascending order by timestamp to form evidence accumulation units. The number of queries is accumulated in chronological order to form an evidence sequence, and the number of accumulated queries in the evidence sequence is monitored to see if it reaches a preset number threshold.

[0019] Feature extraction module: used to extract a set of features based on the evidence sequence at the trigger time when the number of evidence items reaches the threshold;

[0020] Evidence modeling module: Based on the feature values ​​output by the feature extraction module, calculate the support of each feature for the normal and abnormal classes, assign quality values ​​to the three propositions of normal, abnormal and uncertain, and construct the evidence quality assignment for each feature;

[0021] Evidence fusion and judgment module: Iteratively fuses the evidence quality allocation of all features using Dempster's combination rule to obtain a session-level comprehensive confidence level, and outputs a judgment result of normal, abnormal or uncertain based on the comparison of the comprehensive confidence level with the preset confidence level judgment threshold.

[0022] The phased accumulation control module is used to control the corresponding evidence accumulation unit to continue accumulating the number of queries when the judgment result is uncertain, and to re-trigger the subsequent modules for processing when the next threshold is reached.

[0023] The results output module is used to record and output the detection results.

[0024] Compared with existing technologies, the beneficial effects of this invention are as follows: The phased evidence accumulation and uncertainty determination mechanism of this invention fundamentally changes the one-size-fits-all hard decision mode of traditional detection methods; by outputting uncertainty instead of forcibly determining when the number of accumulated queries reaches the first threshold m1 if the evidence is insufficient, it provides an observation period for occasional abnormal behaviors in normal business, such as network retries, cache penetration, and one-time high-entropy queries; as the accumulation continues to the thresholds m2 and m3, more normal samples dilute the occasional abnormal features, making the statistical features approach the normal distribution, thereby effectively avoiding misjudgments caused by too small a sample size and large feature estimation variance; this mechanism enables this method to maintain a high detection rate for real covert channels while significantly suppressing false alarms for normal business traffic, making it particularly suitable for deployment in real, complex and ever-changing network environments, improving the reliability and practicality of detection results;

[0025] This invention creatively replaces the fixed time window with the cumulative number of queries as the basic unit for detection triggering and analysis, solving the pain point of low-frequency DNS covert channels being difficult to detect effectively due to long query intervals and sparse samples within short time windows. By preset multiple incremental query thresholds and corresponding multi-dimensional feature extraction, including time sequence, content, and protocol features, the system can make trial judgments at multiple stages with different amounts of information. For abnormal sessions with significant behavioral patterns, a high confidence level can be reached after accumulating a small number of queries due to significant feature abnormalities and highly consistent evidence, achieving rapid alarm and ensuring timely detection. For sessions with ambiguous behavioral patterns or strong camouflage, more stable and representative statistical features are obtained by accumulating in stages using more samples, thereby making a more accurate final judgment. Attached Figure Description

[0026] Figure 1This is a flowchart of the overall process of the low-frequency DNS covert channel detection method based on evidence accumulation according to the present invention.

[0027] Figure 2 This is a flowchart for modeling evidence for the present invention.

[0028] Figure 3 This is a flowchart of the comprehensive confidence calculation based on Dempster's rule in this invention. Detailed Implementation

[0029] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0030] Example 1:

[0031] The overall flowchart of a low-frequency DNS covert channel detection method based on evidence accumulation according to an embodiment of the present invention is as follows: Figure 1 As shown, the specific steps include:

[0032] S1. Obtain DNS query messages from the network to be detected; S2. Group the DNS query messages and establish sessions using the combination of source IP address and primary domain name as the session key; S3. Sort the DNS queries under the same session key in ascending order of timestamp to form multiple evidence accumulation units; S4. For each evidence accumulation unit, accumulate the number of queries in chronological order to form an evidence sequence; S5. When the accumulated number of queries in the evidence sequence reaches at least one preset threshold, extract a set of features for the current evidence sequence; S6. Construct evidence quality allocation based on the features; S7. Use Dempster combination rules to iteratively fuse multiple evidence quality allocations constructed based on different features to obtain a session-level comprehensive confidence score; S8. Output the detection result based on the comprehensive confidence score; S9. For sessions that output uncertain detection results, continue to accumulate the number of queries in their evidence sequence until the next threshold is reached, and repeat the steps of feature extraction, evidence quality allocation construction, evidence fusion, and confidence score determination to achieve phased determination.

[0033] Example 2:

[0034] Specifically, obtaining DNS query messages in the network to be detected in S1 includes the following sub-steps:

[0035] S11. Continuously or periodically obtain raw DNS network traffic data from network mirror traffic, bypass probes, DNS server logs, or pre-captured network packet files.

[0036] S12. For each piece of DNS network data obtained, parse and extract the key fields required for detection. The key fields include at least the timestamp, source IP address, and query name.

[0037] The study clarified the various sources of DNS query messages (network mirror traffic, bypass probes, DNS server logs, and pre-stored files) and their acquisition methods (continuous or periodic), and specified the key fields to be parsed and extracted from the raw data. This enhanced the system's deployment flexibility and data source compatibility, enabling it to adapt to different network monitoring environments, such as real-time traffic, log auditing, and offline analysis, thereby improving the method's practicality and applicability. The clarification of key fields ensured the consistency and reliability of the data foundation for subsequent processing.

[0038] In S2, the DNS query message is grouped and a session is established using the combination of the source IP address and the primary domain name as the session key. This process includes the following sub-steps:

[0039] S21. Domain name resolution and standardization: Standardize the query name extracted in step S12, including removing the root domain name identifier at the end, unifying character case, and resolving the second-level domain name or higher-level domain name as the main domain name.

[0040] S22. Generate a unique packet identifier for each DNS query message, which is the session key. The session key is formed by concatenating its source IP address with the main domain name obtained from step S21.

[0041] S23. Group all DNS query messages with the same session key into the same logical set, establish a session, and initialize an independent session management context for each newly appearing session key.

[0042] It achieves precise session association and isolation. By grouping by main domain name rather than complete query domain name, it can effectively aggregate all low-frequency probing behaviors of the same attacker (source IP) against the same target (main domain name), even if the attacker uses a large number of changing subdomains. This provides the correct analytical granularity for detecting covert channels and avoids the behavior being scattered into multiple invalid sessions. Standardized processing ensures the accuracy of grouping.

[0043] Specifically, S3 involves arranging DNS queries under the same session key in ascending order of timestamps to form multiple evidence accumulation units, which includes the following sub-steps:

[0044] S31. Within each independent session, based on the timestamp field extracted in step S12, sort all DNS query messages in that session according to the order in which they occurred.

[0045] S32. Define the sorted DNS query sequence as a basic processing unit for subsequent evidence accumulation and feature analysis, namely, the evidence accumulation unit.

[0046] It was clarified that within each session, all DNS queries must be sorted in ascending order based on timestamps to form ordered evidence accumulation units, ensuring the accuracy and effectiveness of time series analysis. DNS covert channel behavior typically exhibits specific temporal patterns, such as fixed intervals or pseudo-random intervals. Sorting by time is a prerequisite for calculating time interval characteristics and analyzing the temporal patterns of behavior, laying a correct temporal foundation for subsequent feature extraction.

[0047] Specifically, in S4, for each evidence accumulation unit, the number of queries is accumulated in chronological order to form an evidence sequence, which includes the following sub-steps:

[0048] S41. Maintain a query count accumulation counter for each evidence accumulation unit, with an initial value of 0.

[0049] S42. The counter increments by 1 each time a new DNS query message arrives and is sorted for the session.

[0050] S43. DNS query messages arriving in chronological order are appended to the end of the query sequence of the evidence accumulation unit in the order of their arrival, forming an evidence sequence that dynamically expands over time.

[0051] The process of maintaining a counter for each evidence accumulation unit and dynamically expanding the evidence sequence in chronological order is described, which realizes the dynamic and orderly accumulation of evidence. This design enables the system to process continuously arriving DNS queries in streaming or batch processing mode, update the state of each session in real time, and provide the possibility for subsequent real-time or near-real-time detection and phased decision-making, which is consistent with the characteristics of continuous generation of actual network traffic.

[0052] In S5, when the cumulative number of queries for the evidence sequence reaches at least one preset threshold, a set of features is extracted from the current evidence sequence.

[0053] One or more incremental thresholds for the number of records are preset, including at least a first threshold m1, a second threshold m2, and a third threshold m3.

[0054] The system monitors the cumulative query count counter for each evidence accumulation unit in real time. When the cumulative query count of any evidence accumulation unit reaches the preset threshold m1, m2, or m3 for the first time, the feature extraction process for that unit is immediately triggered.

[0055] Based on all current DNS queries within the evidence accumulation unit at the trigger time (i.e., the first m queries, where m is the trigger threshold), a set of predefined statistical features is calculated. These features include at least the coefficient of variation of the query time interval sequence, the mean of the subdomain string entropy, the subdomain repetition rate, the subdomain length entropy, the mean subdomain length, and the distribution characteristics of the response code or query type. All features are calculated based on statistical data within the current evidence sequence.

[0056] Multiple incremental thresholds for the number of records are preset (e.g., m1, m2, m3), and feature extraction is triggered when the cumulative number of records first reaches any threshold. A set of predefined statistical features is extracted, realizing phased sampling and multi-dimensional representation of detection. The multi-threshold design is the core mechanism to support phased decision-making, allowing the system to make multiple trial decisions when different amounts of information are obtained. A set of multi-dimensional features covering time sequence (query interval variation coefficient), content (subdomain string entropy, length, repetition rate), and protocol (response code / type distribution) is extracted, which can characterize session behavior from different perspectives and provide rich and complementary information sources for subsequent evidence-based fusion.

[0057] Specifically, S6, which involves constructing evidence quality allocation based on features, includes the following sub-steps:

[0058] S61. For each feature, a probability distribution model is pre-established based on historical training data under normal network traffic scenarios and low-frequency DNS covert channel anomaly scenarios.

[0059] S62. For each feature value of the evidence sequence to be detected, substitute it into the two distribution models of the corresponding feature established in step S61.

[0060] S63. Calculate the likelihood or probability density value of the feature value belonging to the normal class and the likelihood or probability density value belonging to the abnormal class, respectively.

[0061] S64. For each feature, based on the calculated normal class and abnormal similarity probability, and a preset intensity coefficient reflecting the feature's discriminative ability, generate a basic probability assignment function for that feature.

[0062] S65. The generated function assigns three specific quality values ​​to the three propositions: "the session is normal", "the session is abnormal", and "it cannot be determined". The sum of the three values ​​is 1.

[0063] The feature values ​​are transformed into soft evidence that conforms to the evidence theory, and the proposition of uncertainty is explicitly introduced. This quantifies the uncertainty of single feature judgment and is more realistic than hard threshold binary classification. The feature intensity coefficient reflects the difference in the discriminative ability of different features in distinguishing between normal and abnormal, and makes the weight of important features higher. The output basic probability allocation function is the standard input of Dempster's combination rule, which prepares the data for multi-feature evidence fusion.

[0064] In S7, the Dempster combination rule is used to iteratively fuse multiple evidence quality assignments constructed based on different features to obtain a session-level comprehensive confidence score. This process includes the following sub-steps:

[0065] S71. Treat the basic probability assignment function generated for each feature in step S65 as an independent source of evidence.

[0066] S72. Apply the Dempster combination rule in the Dempster-Shafer evidence theory to perform pairwise iterative synthesis operations on the basic probability assignments provided by multiple evidence sources corresponding to all features.

[0067] S73. Through the fusion in step S72, a comprehensive basic probability allocation for the current session is finally obtained.

[0068] S74. The comprehensive basic probability assignment includes three comprehensive quality values: the comprehensive quality value m(N) supporting normal propositions, the comprehensive quality value m(A) supporting abnormal propositions, and the comprehensive quality value m(U) representing uncertainty.

[0069] S75. From the integrated quality values ​​after fusion, take the maximum value that supports the definite proposition as the integrated confidence of the current session under the current cumulative number of messages, that is, integrated confidence = max(m(N), m(A)).

[0070] By integrating evidence from all features, false positives or false negatives from a single feature can be effectively reduced, allowing the final judgment to be based on more comprehensive information. The Dempster rule effectively handles conflicts between features, resolving them mathematically to arrive at a more reasonable comprehensive judgment. The output comprehensive confidence score provides a clear and measurable basis for subsequent threshold decisions. The flowchart for calculating the comprehensive confidence score based on the Dempster rule is shown below. Figure 3 As shown.

[0071] Specifically, S8, which outputs the detection result based on the overall confidence level, includes the following sub-steps:

[0072] S81. Preset a confidence threshold τ.

[0073] S82. Compare the overall confidence level calculated in step S75 with the preset confidence level decision threshold τ.

[0074] S83. If the overall confidence level is greater than or equal to the confidence level decision threshold τ, then output a definite detection result: when m(A)>m(N), the session is determined to be abnormal; otherwise, the session is determined to be normal.

[0075] S84. If the overall confidence level is less than the confidence level decision threshold τ, then the current evidence is deemed insufficient, and uncertainty is output as the current detection result.

[0076] For sessions in S9 that output uncertain detection results, the number of queries in their evidence sequence continues to accumulate until the second threshold m2 or the third threshold m3 is reached. The feature extraction, evidence quality allocation and construction, evidence fusion, and confidence determination steps are then repeated to achieve phased determination. Specifically, this includes the following sub-steps:

[0077] S91. For sessions that are determined to be indeterminate when the cumulative number of records reaches m1, maintain the session's active state and continue to receive new DNS query messages belonging to that session.

[0078] S92. When the cumulative number of queries in the session continues to increase and reaches the preset threshold for the next higher number of queries, the system automatically repeats the complete process of steps S5 to S8.

[0079] S93. Based on the longer evidence sequence at this time, features are re-extracted, a new evidence quality allocation is constructed, evidence is fused and a new comprehensive confidence level is calculated, and then a decision is made again based on the confidence level decision threshold τ.

[0080] S94. If the decision result at m2 is still uncertain, then choose to continue accumulating to a higher threshold of the number of entries, such as m3, and repeat the above decision process again.

[0081] S95. In the phased cumulative judgment process, as the cumulative number of queries increases from m1 to m2 and m3, the sample size used to calculate the features gradually increases, and the estimated variance of the feature statistics decreases accordingly. The transient abnormal feature performance caused by occasional business behaviors in normal sessions, such as retries and cache penetration, will be diluted and averaged by more subsequent normal samples.

[0082] S96. The abnormal patterns of real low-frequency covert channel behavior are persistent, and their characteristics are not easily diluted, thereby reducing the probability of misjudging normal sessions as abnormal.

[0083] For sessions that exhibit slight abnormal characteristics due to occasional fluctuations in normal business operations with a small number of queries (m1), an observation period is given. As the number of queries increases (m2, m3), more normal samples will dilute the occasional anomalies, and the characteristics will tend to be normal, thus avoiding misjudgment. True covert channel behavior has pattern persistence, and its characteristic anomalies will not be diluted by the increase of samples, so it will still be detected in subsequent stages. Sessions that show strong abnormal signals in the early stage (high confidence) are allowed to be quickly judged, while sessions with low suspicion are judged after collecting more evidence, achieving an optimal balance between detection timeliness and accuracy.

[0084] Example 3:

[0085] A low-frequency DNS covert channel detection system based on evidence accumulation includes a data acquisition and preprocessing module, a session grouping and evidence accumulation module, a feature extraction module, an evidence modeling module, an evidence fusion and judgment module, a phased accumulation control module, and a result output module.

[0086] The data acquisition and preprocessing module is used to acquire DNS query messages through network mirror port, bypass probe, DNS log, and network packet files, and to parse and normalize the messages to extract the timestamp, source IP address, and query name fields.

[0087] The data acquisition and preprocessing module includes a traffic capture unit, a packet parsing unit, and a domain name processing unit. The traffic capture unit captures raw DNS traffic data from network links or log files. The packet parsing unit parses DNS packets and extracts key fields. The domain name processing unit normalizes the query names, including removing trailing dotted roots, standardizing case, and resolving the primary domain name.

[0088] The session grouping and evidence accumulation module is used to group the resolved DNS query messages and establish sessions using the combination of source IP address and main domain name as the session key. Within each session, the DNS queries are arranged in ascending order by timestamp to form evidence accumulation units. For each evidence accumulation unit, the number of queries is accumulated in chronological order to form a dynamically growing evidence sequence. The module monitors the number of accumulated queries in the evidence sequence and triggers downstream modules to process the data when it reaches at least one preset threshold.

[0089] The session grouping and evidence accumulation module includes a group management unit, a time-series sorting unit, and an incremental statistics unit. The group management unit creates and maintains multiple independent session contexts using source IP addresses and primary domain names as keys. The time-series sorting unit sorts all DNS queries based on timestamps within each session context. The incremental statistics unit maintains intermediate statistics for each session context, including counts, sums, sums of squares, and summaries of unique value sets. It incrementally updates the underlying data required for feature calculation, and when the accumulated number of records reaches a threshold, it quickly calculates the required feature values ​​based on these intermediate statistics.

[0090] The feature extraction module is used to extract a set of features based on the evidence sequence at the trigger time in response to the trigger signal. The features include at least the coefficient of variation of the query interval sequence, the mean of the subdomain string entropy, the subdomain repetition rate, the subdomain length entropy, the mean of the subdomain length, and the distribution features of the response code or query type.

[0091] The evidence modeling module stores the probability distribution models of each feature in normal and abnormal scenarios. Based on the feature values ​​output by the feature extraction module, it calculates the support of each feature for the normal and abnormal classes. Then, according to the discriminative strength of each feature, it assigns quality values ​​to the three propositions: normal, abnormal, and uncertain, thus constructing an evidence quality assignment for each feature. The evidence modeling flowchart is shown below. Figure 2 As shown.

[0092] The evidence fusion and judgment module is used to iteratively fuse multiple evidence quality assignments generated by the evidence modeling module for all features using the Dempster combination rule to obtain the session-level comprehensive quality values ​​m(N), m(A), and m(U); calculate the comprehensive confidence level conf=max(m(N),m(A)); compare the comprehensive confidence level conf with the preset confidence level decision threshold τ. If conf≥τ, the judgment result is output as normal or abnormal; if conf<τ, the judgment result is output as uncertain.

[0093] The phased accumulation control module is used to control the corresponding evidence accumulation unit to continue accumulating the number of queries when the evidence fusion and judgment module outputs an uncertain judgment result. When the accumulated number of queries reaches the next higher preset number threshold, the feature extraction module, evidence modeling module, and evidence fusion and judgment module are re-triggered to carry out a new round of feature extraction, modeling, fusion, and judgment, so as to realize phased accumulation and judgment.

[0094] The results output module is used to record and output the final or interim detection results, confidence level, cumulative number of trigger judgments, and key feature information.

[0095] Modular design ensures clear responsibilities and facilitates system development, maintenance, and expansion. The design of incremental statistical units allows the system to incrementally update intermediate statistics, such as counts, sums, and unique value sets, in a streaming manner during cumulative queries. This avoids having to re-traverse all historical data every time feature extraction is triggered, thereby significantly improving feature calculation efficiency and reducing system computation and storage overhead. This enables the method to cope with high-traffic network environments and has good engineering practicality and real-time processing potential.

[0096] Example 4:

[0097] Configure a mirror port on the network boundary switch to mirror DNS traffic to the server where the detection system is deployed. The detection system obtains DNS query packets in real time from the mirrored traffic. For each captured DNS packet, it parses and extracts fields such as timestamp, source IP address, query name, query type, and response code. The query name is normalized: the trailing root domain identifier "." is removed and converted to lowercase, resolving to the main domain name. For example, data.sub.example.com resolves to example.com as the main domain name. The combination of the source IP address and the main domain name is used as the session key to group DNS queries; for example, if the source IP is 192.168.1.100 and the main domain name is example.com, then the session key is "192.168.1.100:example".Each newly created session key creates an independent session management context, including the session key, last active time, cumulative query count, query sequence, and incremental statistics status. For each session, a DNS query sequence is maintained in ascending order by time. When a new query arrives, it is inserted into the correct position according to the timestamp to maintain the sequence order. The cumulative query count is incremented by 1, and the incremental statistics are updated, including the subdomain length sum, subdomain character entropy sum, query interval sum and sum of squares, and unique subdomain set. Query count thresholds are set to m1=6, m2=9, and m3=12. Feature extraction is triggered when the cumulative query count first reaches any of these thresholds. Taking a cumulative query count of m1=6 as an example, based on the first 6 DNS queries, the following calculations are performed: The following features are considered: Query time interval coefficient of variation (CV_t), calculated as the ratio of the standard deviation to the mean of adjacent query intervals; low-frequency covert channels typically have a lower coefficient of variation. Subdomain string entropy mean (H_sub), calculated by taking the mean of six Shannon entropy values ​​for each subdomain string; encoded subdomains typically have higher entropy values. Subdomain repetition rate (R_dup), the proportion of repeated occurrences among six subdomains. Subdomain length entropy (H_len), the normalized entropy of the subdomain length sequence. Subdomain length mean (L_sub). Response code distribution characteristics, statistically analyzing the proportion distribution of different response codes. For each feature, support is calculated based on the probability distribution model established during the training phase. During the training phase, a large amount of normal DNS traffic and known data are collected. For low-frequency covert channel samples, the probability density functions for the normal and abnormal classes are estimated for each feature. Then, the likelihood of each feature at the current feature value is calculated, including the normal likelihood L_N = p_normal(x) and the abnormal likelihood L_A = p_abnormal(x). Next, the support is calculated: the support for normal is S_N = L_N / (L_N + L_A), and the support for abnormal is S_A = L_A / (L_N + L_A). Finally, the basic probability mass is assigned based on the feature strength coefficient r: m_N = r × S_N, m_A = r × S_A, m_U = 1 - r, where m_N, m_A, and m_U represent the support for normal, abnormal, and uncertain classes, respectively, and m_N + m_A = 1 - r. A+m_U=1; the feature strength coefficient r reflects the discriminative power of the feature, calculated from the training data. Features with strong discriminative power are assigned larger r values; the Dempster combination rule is used to fuse the evidence quality allocation corresponding to the 6 features; each feature is regarded as an independent source of evidence, and the Dempster combination rule is applied pairwise to iteratively fuse all evidence to obtain the overall quality value at the session level: overall support for normality M(N), overall support for anomalies M(A), and overall uncertainty M(U). Then, the overall confidence conf=max(M(N),M(A)) is calculated; the confidence decision threshold τ=0.7 is set, and the overall confidence conf is compared with τ: if conf≥0.7. When M(A) > M(N), it is judged as abnormal; otherwise, it is judged as normal. If conf < 0.7, the output is uncertain. For sessions judged as uncertain at m1=6, they remain active. When the cumulative number of queries reaches m2=9, the features are recalculated based on the first 9 DNS queries, the evidence quality allocation is reconstructed, and the evidence is re-fused to obtain a new comprehensive confidence level. This is then compared with the confidence level decision threshold τ=0.7. If it is still uncertain at m2=9, it continues to accumulate until m3=12 for another judgment. The maximum cumulative number of queries is set to 12. If the confidence level decision threshold is not reached after exceeding 12 queries, the judgment result is forcibly output.

[0098] Example 5:

[0099] This embodiment illustrates the detection effect of the present invention through three practical scenarios.

[0100] Scenario 1 is normal business traffic detection; an employee of a company accesses an internal application, generating 6 DNS queries with evenly spaced time intervals. The subdomains are app1.company.com, api.company.com, auth.company.com, cdn.company.com, monitor.company.com, and log.company.com. After accumulating 6 queries, the m1 threshold detection is triggered. Feature calculation shows a query interval variation coefficient of 0.2 (normal), a subdomain entropy mean of 3.1 (normal), and a subdomain duplication rate of 0.0 (normal). Evidence fusion yields m_N=0.85, m_A=0.05, m_U=0.10, and the overall confidence level conf=0.85>τ=0.7. The result is judged as normal, the session is terminated, and no alarm is triggered.

[0101] Scenario 2 involves low-frequency covert channel detection. The attacker uses a DNS tunnel to transmit data, generating 6 queries with a highly regular time interval (once every 30 seconds). The subdomains are all high-entropy random strings. After accumulating 6 queries, m1 detection is triggered. Feature calculation shows that the query interval variation coefficient is 0.05 (abnormal), the average subdomain entropy is 4.6 (abnormal), and the subdomain repetition rate is 0.0 (normal). Evidence fusion yields m_N=0.15, m_A=0.78, m_U=0.07, and the overall confidence level conf=0.78>τ=0.7. The result is determined to be abnormal, and an alarm is immediately triggered.

[0102] Scenario 3 illustrates the phased determination of fuzzy cases. A monitoring system periodically checks service status, generating 6 queries with relatively regular time intervals and a certain pattern in subdomains. During m1 detection, the query interval variation coefficient is 0.08 (close to anomaly), and the mean subdomain entropy is 3.8 (slightly high), indicating feature conflict. Evidence fusion yields m_N=0.45, m_A=0.40, m_U=0.15, with a comprehensive confidence level conf=0.45<τ=0.7, resulting in an uncertain determination. Accumulation continues until m2=9 queries are reached. Features are recalculated, and the query interval variation coefficient is 0.12 (approaching normal), and the mean subdomain entropy is 3.5 (approaching normal). Evidence fusion yields m_N=0.72, m_A=0.18, m_U=0.10, with a comprehensive confidence level conf=0.72>τ=0.7, resulting in a normal determination. This example demonstrates that phased accumulation can effectively reduce false alarms. Normal business operations may exhibit anomalies with a small number of queries, but the features revert to normal after a larger sample size.

Claims

1. A method for detecting low-frequency DNS covert channels based on evidence accumulation, characterized in that, Includes the following steps: S1. Obtain DNS query messages from the network to be detected; S2. Using the combination of the source IP address and the main domain name as the session key, group the DNS query message and establish a session; S3. Arrange DNS queries under the same session key in ascending order of timestamp to form multiple evidence accumulation units; S4. For each evidence accumulation unit, accumulate the number of queries in chronological order to form an evidence sequence; S5. When the cumulative number of queries in the evidence sequence reaches at least one preset threshold, a set of features is extracted from the current evidence sequence. S6. Construct evidence quality allocation based on the aforementioned features; S7. The Dempster combination rule is used to iteratively fuse multiple evidence quality assignments constructed based on different features to obtain a session-level comprehensive confidence score. S8. Output the detection result based on the comprehensive confidence level: If the comprehensive confidence level is greater than or equal to the preset confidence level decision threshold, then output the determination result; If the overall confidence level is less than the confidence level decision threshold, then the output is uncertain; S9. For sessions that output uncertain detection results, continue to accumulate the number of queries in their evidence sequence until the next threshold is reached, and repeat the steps of feature extraction, evidence quality allocation construction, evidence fusion and confidence determination to achieve phased determination.

2. The low-frequency DNS covert channel detection method based on evidence accumulation according to claim 1, characterized in that, S1 specifically includes: S11. Continuously or periodically obtain raw DNS network traffic data from network mirror traffic, bypass probes, DNS server logs, or pre-captured network packet files. S12. For each piece of DNS network data obtained, parse and extract the key fields required for detection. The key fields include at least the timestamp, source IP address, and query name.

3. The low-frequency DNS covert channel detection method based on evidence accumulation according to claim 2, characterized in that, S2 specifically includes: S21. Standardize the query name extracted in step S12, including removing the tail root domain name identifier, unifying the case of characters, and resolving the second-level domain name or higher-level domain name as the main domain name. S22. The session key is formed by concatenating the source IP address with the main domain name resolved in step S21. S23. Group all DNS query messages with the same session key into the same logical set, establish a session, and initialize an independent session management context for each newly appearing session key.

4. The low-frequency DNS covert channel detection method based on evidence accumulation according to claim 3, characterized in that, S3 specifically includes: S31. Within each independent session, based on the timestamp field extracted in step S12, sort all DNS query messages in the current session according to the order in which they occurred. S32. Define the sorted DNS query sequence as a basic processing unit for subsequent evidence accumulation and feature analysis, namely, the evidence accumulation unit. S4 specifically includes: S41. Maintain a query count accumulation counter for each evidence accumulation unit, with an initial value of 0; S42. This counter increments by 1 each time a new DNS query message arrives and is sorted for the session; S43. DNS query messages arriving in chronological order are appended to the end of the query sequence of the evidence accumulation unit in the order of their arrival, forming an evidence sequence that dynamically expands over time.

5. The low-frequency DNS covert channel detection method based on evidence accumulation according to claim 4, characterized in that, The preset number of records threshold in S5 includes at least one incremental number of records threshold; when the cumulative number of queries in any evidence accumulation unit reaches any of the aforementioned number of records thresholds for the first time, a feature extraction process based on all DNS queries within the current evidence sequence is triggered. The extracted set of features includes at least: the coefficient of variation of the query time interval sequence, the mean of the subdomain string entropy, the subdomain repetition rate, the subdomain length entropy, the mean subdomain length, and the distribution characteristics of the response code or query type.

6. The method for detecting low-frequency DNS covert channels based on evidence accumulation according to claim 5, characterized in that, S6 specifically includes: S61. For each feature, establish its probability distribution model under normal scenarios and low-frequency DNS covert channel anomaly scenarios based on historical training data. S62. For each feature value of the evidence sequence to be detected, calculate its likelihood of belonging to the normal class and its likelihood of belonging to the abnormal class. S63. For each feature, a basic probability assignment function is generated based on the calculated normal class and abnormal similarity probability, and a preset strength coefficient reflecting the distinguishing ability of the feature. The basic probability assignment function assigns quality values ​​to the three propositions: the current session is normal, the current session is abnormal, and it cannot be determined.

7. The method for detecting low-frequency DNS covert channels based on evidence accumulation according to claim 6, characterized in that, Specifically, S7 includes: S71. Treat the basic probability assignment function generated for each feature as an independent source of evidence; S72. Using the Dempster combination rule, the basic probability assignments provided by multiple evidence sources corresponding to all features are iteratively synthesized in pairs. S73. Obtain the comprehensive basic probability assignment for the current session, which includes the comprehensive quality value supporting normal propositions. Overall quality score supporting anomalous propositions and the comprehensive quality value that characterizes uncertainty ; S74. Calculate the overall confidence level according to the following formula: Overall confidence level = .

8. The method for detecting low-frequency DNS covert channels based on evidence accumulation according to claim 7, characterized in that, The specific output determination result in S8 is as follows: If If so, the session is considered abnormal; Otherwise, the session is considered normal; In step S9, if the decision result is still uncertain at a higher number of items threshold, the process continues to accumulate to an even higher number of items threshold for further determination.

9. A low-frequency DNS covert channel detection system based on evidence accumulation, characterized in that, include: Data acquisition and preprocessing module: used to acquire DNS query messages, parse and normalize them, and extract the timestamp, source IP address and query name fields; Session grouping and evidence accumulation module: It is used to group DNS query messages and establish sessions using the combination of source IP address and main domain name as session key. Within each session, the DNS queries are arranged in ascending order by timestamp to form evidence accumulation units. The number of queries is accumulated in chronological order to form an evidence sequence, and the number of accumulated queries in the evidence sequence is monitored to see if it reaches a preset number threshold. Feature extraction module: used to extract a set of features based on the evidence sequence at the trigger time when the number of evidence items reaches the threshold; Evidence modeling module: Based on the feature values ​​output by the feature extraction module, calculate the support of each feature for the normal and abnormal classes, assign quality values ​​to the three propositions of normal, abnormal and uncertain, and construct the evidence quality assignment for each feature; Evidence fusion and judgment module: Iteratively fuses the evidence quality allocation of all features using Dempster's combination rule to obtain a session-level comprehensive confidence level, and outputs a judgment result of normal, abnormal or uncertain based on the comparison of the comprehensive confidence level with the preset confidence level judgment threshold. The phased accumulation control module is used to control the corresponding evidence accumulation unit to continue accumulating the number of queries when the judgment result is uncertain, and to re-trigger the subsequent modules for processing when the next threshold is reached. The results output module is used to record and output the detection results.

10. The low-frequency DNS covert channel detection system based on evidence accumulation as described in claim 9, characterized in that, It also includes a data acquisition and preprocessing module, a session grouping and evidence accumulation module, and a result output module; The data acquisition and preprocessing module includes a traffic capture unit, a packet parsing unit, and a domain name processing unit; the traffic capture unit is used to capture raw DNS traffic data from network links or log files. The message parsing unit is used to parse DNS messages and extract key fields; the domain name processing unit is used to normalize the query name, including removing the trailing root domain name dot, unifying the case, and parsing out the main domain name. The session grouping and evidence accumulation module includes a group management unit, a time-series sorting unit, and an incremental statistics unit; the group management unit is used to create and maintain multiple independent session contexts using the source IP address and the main domain name as keys. The temporal sorting unit is used to sort all DNS queries according to timestamps within each session context; the incremental statistics unit is used to maintain intermediate statistics such as count, sum, sum of squares, and unique value set summary for each session context, and to update the basic data required for feature calculation in an incremental manner. When the cumulative number of records reaches the record threshold, the required feature values ​​are quickly calculated based on these intermediate statistics. The result output module is used to record and output the final or interim detection results, confidence level, cumulative number of trigger judgments, and key feature information.

Images