DNS domain name abnormal access identification system based on behavior characteristics

Abstract

The invention discloses a DNS domain name abnormal access identification system based on behavior characteristics, which is oriented to plaintext and encrypted DNS scenes, integrates multi-source data such as terminal / process, recursive analysis and passive DNS, and constructs a subject-domain name-IP / CNAME multi-split graph and character level, time sequence statistics, graph structure and protocol semantic four-dimensional portrait; through white / grey lists, CDN discrimination, TTL and IP quantity / similarity threshold values and DGA / Fast-Flux feature rapid convergence candidates, an unsupervised / semi-supervised / supervised hybrid model is used for scoring and evidence fusion to output an abnormal type and confidence; identifying abnormal relation evolution and gang by adopting a time sequence diagram attention network; automatic linkage and auditing trace leaving of graded alarm, DNS redirection / NXDOMAIN, current limiting, terminal isolation and boundary blocking are supported; and online incremental learning, feature / threshold recalibration and versioning management are carried out based on disposal feedback and information updating, so that high-accuracy and low-delay identification and sustainable evolution protection of DGA, Fast-Flux, domain name hijacking, DNS tunnel and abnormal equipment are realized.

Description

Technical Field

[0001] This invention relates to the field of computer network and information security technology, specifically to a DNS domain name abnormal access identification system based on behavioral characteristics. Background Technology

[0002] As one of the core infrastructures of the Internet, the Domain Name System (DNS) plays a crucial role in mapping human-readable domain names to machine-usable IP addresses, serving as the first step for all network applications. With the continuous evolution of digital transformation and cyberattack methods, DNS is no longer just a simple resolution service; it has become a vital carrier in various attack chains, including malware communication, command and control (C2) attacks, data breaches, phishing attacks, distributed denial-of-service (DDoS) attacks, and botnets. For example, malware often uses Domain Name Generation Algorithms (DGAs) to dynamically construct a large number of pseudo-random domain names to circumvent blacklist blocking; Fast-Flux technology uses frequent changes to the resolved IP address to conceal the attacker's real server location; domain hijacking and poisoning can induce legitimate users to visit malicious websites; and DNS tunneling can encode arbitrary data into DNS queries / responses for covert leakage. These DNS-based attacks are often characterized by high concealment, rapid mutation, and wide cross-platform compatibility, posing a serious challenge to traditional security protection.

[0003] Currently, the industry's methods for protecting against and detecting DNS anomalies mainly rely on the following technical means:

[0004] Static rules and blacklist matching: interception is based on signature databases of known malicious domains, IPs or specific character patterns. The advantages are simple deployment and good real-time performance, but the ability to identify unknown or modified threats (such as malicious domains in new DGA or encrypted DNS traffic) is weak and can be easily bypassed by attackers.

[0005] Single-dimensional statistical analysis: Threshold judgments on query frequency, TTL distribution, and number of responding IPs can detect some abnormal patterns, but it lacks comprehensive consideration of the context of the subject's behavior, the domain name resolution relationship graph, and protocol semantics, resulting in a high false alarm rate and difficulty in distinguishing normal burst traffic from real attacks.

[0006] Passive DNS and threat intelligence linkage: Matching historical DNS records with third-party intelligence can improve the detection rate of known threats, but it has poor observability of encrypted DNS (DoH / DoT / DoQ) traffic and is prone to missed detection when intelligence is delayed or missing.

[0007] Machine learning model detection: Existing research has introduced clustering, outlier detection, and classification models, but most of them are offline batch processing or single-modal feature modeling, which is difficult to meet the real-time detection requirements of low latency and high concurrency in massive recursive parsing scenarios. In addition, the model update cycle is long and cannot quickly adapt to the evolution of attack methods.

[0008] Overall, existing technologies generally suffer from insufficient cross-protocol observation capabilities, limited behavioral profiling dimensions, difficulty in balancing real-time performance and accuracy, and a lack of automated closed-loop processing and continuous learning mechanisms. These issues restrict the effectiveness of protection in complex network environments (such as mixed plaintext and encrypted DNS, multi-tenant cloud environments, and mobile terminal access).

[0009] Therefore, we propose a DNS domain name abnormal access identification system based on behavioral characteristics. Summary of the Invention

[0010] To achieve the above objectives, the present invention provides the following technical solution: a DNS domain name abnormal access identification system based on behavioral characteristics, comprising:

[0011] The data acquisition and normalization module is used to collect DNS logs, recursive / authoritative resolution traffic, passive DNS records and external threat intelligence from the terminal / process side, unify the time base and entity identifier, and perform correlation resolution on plaintext and encrypted DNS traffic;

[0012] The behavior profile building module is used to build subject profiles, domain profiles, and resolution relationship profiles based on the data. The profiles include character-level features, time-series statistical features, graph structure features, and protocol semantic features.

[0013] The candidate suspicious item generation module is used to generate a set of candidate suspicious items from the profile based on white / gray lists, CDN discrimination, TTL threshold, response IP quantity / similarity threshold, DGA character statistics and sequence features, and Fast-Flux pattern recognition.

[0014] An anomaly scoring and fusion module is used to perform multi-perspective anomaly scoring and evidence fusion on the candidate suspicious set using an unsupervised / semi-supervised / supervised hybrid model, and output the anomaly type and confidence level.

[0015] The graph anomaly and gang detection module is used to construct a subject-domain-IP / CNAME multi-part graph and use a temporal graph attention network to detect abnormal relationship evolution in the multi-part graph and identify abnormal subject groups;

[0016] The handling and linkage module is used to perform tiered alarms, DNS redirection / blocking, terminal isolation and firewall policy distribution according to the anomaly type and confidence level, and record handling audit information;

[0017] The continuous learning and self-optimization module is used to dynamically update profiles, thresholds, and model parameters based on handling feedback, intelligence updates, and online incremental learning.

[0018] Preferably, the character-level features in the behavior profiling module include: domain name length, entropy, n-gram / binary / triple statistics, vowel / digit / repeating segment ratio, HMM transition probability and Gibberish score; the time-series statistical features include: query frequency, burstiness, diurnal periodicity, session duration distribution, TTL distribution, CNAME chain depth and stability; the graph structure features include: subject-domain / domain-IP / CNAME edge weights, number of common neighbors, clustering coefficient, PageRank / betweenness centrality; and the protocol semantic features include: query type distribution, response code distribution, EDNS / DoH / DoT / DoQ identifiers, and DNSSEC verification results.

[0019] Preferably, the candidate suspicious generation module is also used to perform CDN discrimination, which includes: matching the second-level domain name whitelist with the known CDN ASN / prefix library, IP attribution consistency, and CNAME pointing characteristics and TTL consistency; when a domain name simultaneously meets the following conditions: not being on the whitelist, TTL being lower than the threshold, number of response IPs being higher than the threshold, and IP similarity being higher than the threshold, it is determined to be a suspicious domain name.

[0020] Preferably, the anomaly scoring and fusion module includes:

[0021] The unsupervised submodule is used to perform clustering, outlier analysis, and autoencoder reconstruction error scoring on the subject / domain / resolution results.

[0022] The supervised submodule is used to perform anomaly classification on multiple features using gradient boosting trees, random forests, deep neural networks, or Transformer sequence models.

[0023] The evidence fusion submodule is used to weight or stack the scores of multiple submodules and output the anomaly type and confidence range.

[0024] Preferably, the graph anomaly and gang detection module is further used for:

[0025] Construct multi-part graph snapshots using sliding time windows and calculate the temporal evolution characteristics of nodes and edges;

[0026] A temporal graph attention network is used to learn the representation of nodes and edges, and contrastive learning and anomaly scoring are combined to identify abnormal subject groups and anomaly parsing paths.

[0027] Preferably, the processing and linkage module is further used for:

[0028] When the confidence level is higher than the first threshold, perform a DNS redirection to a secure site or return NXDOMAIN.

[0029] When the confidence level is higher than the second threshold and there are signs of spread, perform endpoint isolation and firewall blocking;

[0030] When the confidence level is between the first and second thresholds, flow limiting and enhanced observations are performed.

[0031] Preferably, the continuous learning and self-optimization module is further used for:

[0032] Incremental training and model distillation are performed based on handling feedback and false alarm samples;

[0033] Recalibrate features and thresholds based on intelligence updates;

[0034] Perform periodic recalculation and version control on graph structure and images.

[0035] Methods for identifying abnormal DNS domain name access based on behavioral characteristics include:

[0036] Collect and normalize endpoint / process-side DNS logs, recursive / authoritative resolution traffic, passive DNS, and external intelligence;

[0037] Construct a multi-dimensional behavioral profile of the entity, domain name, and resolution relationship;

[0038] A candidate suspicious set is generated based on white / gray lists, CDN discrimination, TTL and IP quantity / similarity thresholds, DGA and Fast-Flux features;

[0039] A hybrid model is used to perform multi-perspective anomaly scoring and evidence fusion on the candidate set, and output the anomaly type and confidence level.

[0040] Construct a multi-part graph of subject-domain-IP / CNAME and perform time-series graph anomaly detection to identify abnormal subject groups;

[0041] Implement tiered alerting, DNS redirection / blocking, endpoint isolation, and firewall policy distribution, and conduct audits of the handling processes;

[0042] Online incremental learning and parameter updates based on feedback and intelligence.

[0043] Preferably, the DGA detection includes: character-level statistical feature extraction, n-gram / binary / triple ranking features, HMM transition probability and Gibberish score, and combined with sequence model for binary or multi-class classification. The Fast-Flux detection includes: joint discrimination of the number of responding IPs, TTL distribution, IP attribution and ASN diversity, and CNAME chain change frequency for the same domain name within a short time window. The domain hijacking detection includes: resolution results deviating from historical baseline, abnormal CNAME chain jumps, inconsistent authoritative / recursive responses, and association scores with threat intelligence entities exceeding a threshold.

[0044] Compared with existing technologies, this invention provides a DNS domain name abnormal access identification system based on behavioral characteristics, which has the following beneficial effects:

[0045] 1. This DNS domain name anomaly access identification system based on behavioral features achieves high accuracy in identifying DNS anomaly access and low false alarm rate control through multi-dimensional behavioral profiling and multi-perspective anomaly scoring fusion. On the one hand, the system extracts fine-grained features in four dimensions: character level, time-series statistical level, graph structure level, and protocol semantic level. This accurately depicts the dynamic behavioral patterns of the subject (terminal / process / account), domain name, and resolution results, avoiding the shortcomings of traditional single-dimensional features that are easily bypassed by attackers. On the other hand, the candidate suspicious generation module first uses white / grey lists, CDN discrimination, TTL and IP quantity / similarity thresholds, DGA and Fast-Flux features to quickly converge the highly suspicious set. Then, a hybrid unsupervised / semi-supervised / supervised model performs multi-perspective scoring and evidence fusion to ensure that reliable confidence outputs are obtained for different anomaly types (such as DGA, Fast-Flux, domain hijacking, DNS tunneling, and abnormal devices). Experiments show that this architecture maintains a high detection rate (Recall ≥ 95%) while keeping the false positive rate (FPR) at ≤ 1%, which is significantly better than existing solutions that rely solely on rules or a single statistical model. This reduces the judgment burden on security operations personnel and improves the credibility of threat response.

[0046] 2. This DNS domain name anomaly access identification system based on behavioral characteristics employs a streaming processing and online incremental learning framework, enabling low-latency detection and dynamic adaptation in large-scale recursive resolution and carrier / enterprise-level deployment environments. The data acquisition and normalization module supports unified access and content association for plaintext DNS and encrypted DNS (DoH / DoT / DoQ), solving the blind spot problem of traditional solutions in encrypted traffic supervision. The detection engine filters first using lightweight rules and statistical thresholds, then uses a deep model for fine-grained scoring, balancing throughput and accuracy. Furthermore, the graph anomaly and gang detection module uses Temporal Graph Attention Network (TAT) to perform evolutionary analysis on the "subject-domain-IP / CNAME" multi-part graph, identifying botnets and coordinated anomalies within a minute-level window, meeting the needs of real-time threat hunting and automated blocking. The system architecture supports horizontal scaling and modular deployment, flexibly adapting to network environments of different sizes (from SMEs to carrier-level recursive clusters), ensuring stable performance and low-latency response (MTTD / MTTR ≤ 10 minutes) even in high-concurrency scenarios.

[0047] 3. This DNS domain name anomaly access identification system based on behavioral characteristics constructs a complete closed loop of detection, analysis, handling, review, and optimization, significantly improving the automation and intelligence level of security operations. The handling and linkage module can automatically execute tiered responses based on the anomaly type and confidence level: high confidence levels result in direct DNS redirection or return to NXDOMAIN; medium confidence levels implement rate limiting and enhanced monitoring; and when there is a risk of propagation, it links to terminal isolation and firewall blocking. It also fully records alarms, evidence collection, and policy distribution audit information to ensure traceability and verifiability. The continuous learning and self-optimization module performs incremental training, model distillation, and feature / threshold recalibration based on handling feedback, false alarm sample reinjection, and threat intelligence updates. Simultaneously, it periodically recalculates and versions the graph structure and behavioral profiles, enabling the system to evolve with attack methods and maintain long-term, high-efficiency defense capabilities. This closed-loop mechanism not only shortens the threat handling cycle and reduces the cost of manual intervention, but also provides security operations personnel with intuitive decision-making support through interpretable outputs (feature contribution, path tracing, and gang view), thereby achieving sustainable, interpretable, and scalable DNS security protection in complex and ever-changing network environments. Detailed Implementation

[0048] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0049] Example

[0050] Implementation Examples of DNS Domain Name Abnormal Access Identification Systems Based on Behavioral Characteristics

[0051] A DNS domain name anomaly access identification system based on behavioral characteristics includes:

[0052] The data acquisition and normalization module is used to collect DNS logs, recursive / authoritative resolution traffic, passive DNS records and external threat intelligence from the terminal / process side, unify the time base and entity identifier, and perform correlation resolution on plaintext and encrypted DNS traffic;

[0053] The behavioral profiling module is used to build subject profiles, domain profiles, and resolution relationship profiles based on data. The profiles include character-level features, time-series statistical features, graph structure features, and protocol semantic features.

[0054] The candidate suspicious item generation module is used to generate a set of candidate suspicious items from the profile based on white / gray lists, CDN discrimination, TTL threshold, response IP quantity / similarity threshold, DGA character statistics and sequence features, and Fast-Flux pattern recognition.

[0055] The anomaly scoring and fusion module is used to perform multi-perspective anomaly scoring and evidence fusion on candidate suspicious sets using a hybrid unsupervised / semi-supervised / supervised model, and outputs anomaly type and confidence level.

[0056] The graph anomaly and gang detection module is used to construct a subject-domain-IP / CNAME multi-part graph and use a temporal graph attention network to detect abnormal relationship evolution in the multi-part graph and identify abnormal subject groups;

[0057] The handling and linkage module is used to execute tiered alerts, DNS redirection / blocking, endpoint isolation, and firewall policy distribution based on the anomaly type and confidence level, and to record handling audit information;

[0058] The continuous learning and self-optimization module is used to dynamically update profiles, thresholds, and model parameters based on handling feedback, intelligence updates, and online incremental learning.

[0059] Specifically, the character-level features in the behavioral profiling module include: domain name length, entropy, n-gram / binary / triple statistics, vowel / digit / repeating segment ratio, HMM transition probability and Gibberish score; time-series statistical features include: query frequency, burstiness, diurnal periodicity, session duration distribution, TTL distribution, CNAME chain depth and stability; graph structure features include: subject-domain / domain-IP / CNAME edge weights, number of common neighbors, clustering coefficient, PageRank / betweenness centrality; and protocol semantic features include: query type distribution, response code distribution, EDNS / DoH / DoT / DoQ identifiers, and DNSSEC verification results.

[0060] Specifically, the candidate suspicious generation module is also used to perform CDN discrimination, which includes: matching the second-level domain name whitelist with the known CDN ASN / prefix library, IP attribution consistency, and CNAME pointing characteristics and TTL consistency; when a domain name simultaneously meets the following conditions, it is judged as a suspicious domain name: not on the whitelist, TTL is lower than the threshold, the number of responding IPs is higher than the threshold, and the IP similarity is higher than the threshold.

[0061] Specifically, the anomaly scoring and fusion module includes:

[0062] The unsupervised submodule is used to perform clustering, outlier analysis, and autoencoder reconstruction error scoring on the subject / domain / resolution results.

[0063] The supervised submodule is used to perform anomaly classification on multiple features using gradient boosting trees, random forests, deep neural networks, or Transformer sequence models.

[0064] The evidence fusion submodule is used to weight or stack the scores of multiple submodules and output the anomaly type and confidence range.

[0065] Specifically, the graph anomaly and gang detection module is also used for:

[0066] Construct multi-part graph snapshots using sliding time windows and calculate the temporal evolution characteristics of nodes and edges;

[0067] A temporal graph attention network is used to learn the representation of nodes and edges, and contrastive learning and anomaly scoring are combined to identify abnormal subject groups and anomaly parsing paths.

[0068] Specifically, the handling and linkage module is also used for:

[0069] When the confidence level is higher than the first threshold, perform a DNS redirection to a secure site or return NXDOMAIN.

[0070] When the confidence level is higher than the second threshold and there are signs of spread, perform endpoint isolation and firewall blocking;

[0071] When the confidence level is between the first and second thresholds, flow limiting and enhanced observations are performed.

[0072] Specifically, the continuous learning and self-optimization module is also used for:

[0073] Incremental training and model distillation are performed based on handling feedback and false alarm samples;

[0074] Recalibrate features and thresholds based on intelligence updates;

[0075] Perform periodic recalculation and version control on graph structure and images.

[0076] Methods for identifying abnormal DNS domain name access based on behavioral characteristics include:

[0077] Collect and normalize endpoint / process-side DNS logs, recursive / authoritative resolution traffic, passive DNS, and external intelligence;

[0078] Construct a multi-dimensional behavioral profile of the entity, domain name, and resolution relationship;

[0079] A candidate suspicious set is generated based on white / gray lists, CDN discrimination, TTL and IP quantity / similarity thresholds, DGA and Fast-Flux features;

[0080] A hybrid model is used to perform multi-perspective anomaly scoring and evidence fusion on the candidate set, and output the anomaly type and confidence level.

[0081] Construct a multi-part graph of subject-domain-IP / CNAME and perform time-series graph anomaly detection to identify abnormal subject groups;

[0082] Implement tiered alerting, DNS redirection / blocking, endpoint isolation, and firewall policy distribution, and conduct audits of the handling processes;

[0083] Online incremental learning and parameter updates based on feedback and intelligence.

[0084] Specifically, DGA detection includes: character-level statistical feature extraction, n-gram / binary / triple ranking features, HMM transition probability and gibberish score, and combined with sequence model for binary or multi-class classification. Fast-Flux detection includes: joint discrimination of the number of responding IPs, TTL distribution, IP attribution and ASN diversity, and CNAME chain change frequency for the same domain within a short time window. Domain hijacking detection includes: resolution results deviating from historical baseline, abnormal CNAME chain jumps, inconsistent authoritative / recursive responses, and association scores with threat intelligence entities exceeding thresholds.

[0085] Through the above technical solution, this invention achieves high-accuracy identification and low false alarm rate control of abnormal DNS access by constructing multi-dimensional behavioral profiles and fusing multi-perspective anomaly scoring. On the one hand, the system extracts fine-grained features in four dimensions: character level, time-series statistical level, graph structure level, and protocol semantic level. This can accurately depict the dynamic behavioral patterns of the subject (terminal / process / account), domain name, and resolution results, avoiding the shortcomings of traditional single-dimensional features that are easily bypassed by attackers. On the other hand, the candidate suspicious generation module first uses white / gray lists, CDN discrimination, TTL and IP quantity / similarity thresholds, DGA and Fast-Flux features to quickly converge the highly suspicious set. Then, a hybrid unsupervised / semi-supervised / supervised model is used for multi-perspective scoring and evidence fusion to ensure that different anomaly types (such as DGA, Fast-Flux, domain hijacking, DNS tunneling, and abnormal devices) can all obtain reliable confidence outputs. Experiments show that this architecture maintains a high detection rate (Recall ≥ 95%) while keeping the false positive rate (FPR) ≤ 1%, significantly outperforming existing solutions that rely solely on rules or single statistical models. This reduces the assessment burden on security operations personnel and improves the reliability of threat response. Employing a streaming processing and online incremental learning framework, it achieves low-latency detection and dynamic adaptation in large-scale recursive resolution and carrier / enterprise-level deployment environments. The data acquisition and normalization module supports unified access and content association for plaintext DNS and encrypted DNS (DoH / DoT / DoQ), solving the blind spot problem of encrypted traffic supervision in traditional solutions. The detection engine filters first using lightweight rules and statistical thresholds before entering a deep model for fine-grained scoring, balancing throughput and accuracy. Furthermore, the graph anomaly and gang detection module uses Temporal Graph Attention Network (TAT) to perform evolutionary analysis on the "subject-domain-IP / CNAME" multi-part graph, identifying botnets and coordinated anomalies within a minute-level window, meeting the needs of real-time threat hunting and automated blocking. The system architecture supports horizontal scaling and modular deployment, flexibly adapting to network environments of different sizes (from SMEs to carrier-grade recursive clusters), ensuring stable performance and low-latency response (MTTD / MTTR ≤ 10 minutes) even under high-concurrency scenarios. This invention constructs a complete closed loop of detection, analysis, handling, review, and optimization, significantly improving the automation and intelligence of security operations. The handling and linkage module can automatically execute tiered responses based on anomaly type and confidence level: high confidence levels result in direct DNS redirection or return to NXDOMAIN; medium confidence levels implement rate limiting and enhanced monitoring; and when there is a risk of propagation, it links to terminal isolation and firewall blocking, while fully recording alarms, evidence collection, and policy distribution audit information to ensure traceability and verifiability.The continuous learning and self-optimization module, based on response feedback, false positive sample reinjection, and threat intelligence updates, performs incremental training, model distillation, and feature / threshold recalibration. Simultaneously, it periodically recalculates and versions the graph structure and behavioral profiles, enabling the system to evolve with changing attack methods and maintain long-term, high-efficiency defense capabilities. This closed-loop mechanism not only shortens the threat response cycle and reduces manual intervention costs but also provides security operations personnel with intuitive decision-making support through interpretable outputs (feature contributions, path tracing, and group views), thereby achieving sustainable, interpretable, and scalable DNS security protection in complex and ever-changing network environments.

[0086] System Architecture and Module Implementation

[0087] Collection Layer: Deploys host / process probes (supporting eBPF / Audit / kernel Hook), recursive resolver bypass mirror, authoritative / passive DNS interfaces, and intelligence collectors; unified entity identifiers (host ID, process path hash, account, container ID), and time synchronization uses NTP / PTP.

[0088] Normalization layer: parses DNS packets and sessions, extracts query / response fields, EDNS / DoH / DoT / DoQ identifiers, TTL, RCODE, CNAME chain, and IP list; performs TLS SNI / HTTP / 2 header resolution and domain name association on DoH traffic; and performs deduplication and time-limited windowing on passive DNS.

[0089] Image layer: Offline / near real-time calculation of character-level, time-series statistical, graph structure-level and protocol semantic-level features; construction of subject-domain-IP / CNAME multi-part graph and index.

[0090] Detection layer: Candidate suspicious list generation (white / gray list, CDN discrimination, TTL and IP thresholds, DGA / Fast-Flux features); Hybrid scoring (unsupervised / semi-supervised / supervised); Graph anomaly (temporal GAT).

[0091] Processing layer: Works with DNS redirection / blocking, endpoint EDR, and border firewall; supports tiered policies and fallback mechanisms.

[0092] Learning layer: Handling feedback and intelligence-driven incremental learning and parameter calibration; model versioning and A / B evaluation.

[0093] Key Algorithms and Processes

[0094] Candidate Suspicious Generation

[0095] CDN Judgment: If a subdomain is not on the whitelist and simultaneously meets the following conditions: TTL < θ_ttl, number of response IPs > θ_ip, and IP similarity > θ_sim, it is marked as suspicious; Example thresholds: θ_ttl=30s, θ_ip=3, θ_sim=20 (can be adjusted according to business needs).

[0096] DGA detection: Extract character-level statistics and n-gram / binary / triple ranking features, and combine them with HMM / gibberish and sequence models (such as LSTM / CNN) for classification.

[0097] Fast-Flux detection: A large number of IPs within a short time window, low TTL and scattered distribution, diverse ASN / attribution, and frequent CNAME changes.

[0098] Anomaly scoring and fusion

[0099] Unsupervised: Reconstruction errors in Isolation Forest / LOF / AutoEncoder;

[0100] Supervised learning: GBDT / RF / DNN / Transformer;

[0101] Fusion: Weighted summation or stacking, outputting the exception type (DGA, Fast-Flux, hijacking, tunneling, anomalous device) and confidence level.

[0102] Image anomalies and gang detection

[0103] A multipart graph G=(V,E), where V contains the subject / domain / IP / CNAME, and the edges contain query / resolution / CNAME relationships;

[0104] A sliding window is used to build a snapshot, and temporal GAT is used to learn node / edge representations, calculate anomaly scores, and identify anomaly groups and paths.

[0105] Response and Coordination

[0106] Confidence level ≥ 0.9: DNS redirection / NXDOMAIN;

[0107] 0.7 ≤ confidence level < 0.9: Current limiting and enhanced observation;

[0108] Confidence level ≥ 0.7 and diffusion: endpoint isolation and firewall blocking;

[0109] Record alarms, collect evidence, and audit policy distribution.

[0110] Continuous learning

[0111] Incremental training is conducted by reinjecting false alarm samples; intelligence updates trigger feature / threshold recalibration; and graphs and profiles are periodically recalculated and released in grayscale.

[0112] Examples of Implementation and Parameters

[0113] Deployed in enterprise recursive DNS clusters and linked with perimeter protection; host-side eBPF collects process DNS logs, and resolver bypass mirroring collects DoH / DoT / DoQ metadata; passive DNS and threat intelligence are updated daily.

[0114] The training set includes 30 days of labeled samples and unsupervised anomalies; the online inference latency target is <100ms; the graph anomaly detection window is 5–15 minutes; the model is updated on a rolling basis every 7 days.

[0115] Evaluation metrics: Recall rate ≥ 95%, False positive rate (FPR) ≤ 1%, Mean time to process (MTTR) ≤ 10 minutes.

[0116] Safety and Compliance

[0117] Data collection follows the principle of minimum necessity and de-identification strategies; log retention and access control comply with information security and privacy regulations; encrypted DNS resolution content is only analyzed within the authorized scope.

[0118] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A DNS domain name abnormal access identification system based on behavioral characteristics, characterized in that: include: The data acquisition and normalization module is used to collect DNS logs, recursive / authoritative resolution traffic, passive DNS records and external threat intelligence from the terminal / process side, unify the time base and entity identifier, and perform correlation resolution on plaintext and encrypted DNS traffic; The behavior profile building module is used to build subject profiles, domain profiles, and resolution relationship profiles based on the data. The profiles include character-level features, time-series statistical features, graph structure features, and protocol semantic features. The candidate suspicious item generation module is used to generate a set of candidate suspicious items from the profile based on white / gray lists, CDN discrimination, TTL threshold, response IP quantity / similarity threshold, DGA character statistics and sequence features, and Fast-Flux pattern recognition. An anomaly scoring and fusion module is used to perform multi-perspective anomaly scoring and evidence fusion on the candidate suspicious set using an unsupervised / semi-supervised / supervised hybrid model, and output the anomaly type and confidence level. The graph anomaly and gang detection module is used to construct a subject-domain-IP / CNAME multi-part graph and use a temporal graph attention network to detect abnormal relationship evolution in the multi-part graph and identify abnormal subject groups; The handling and linkage module is used to perform tiered alarms, DNS redirection / blocking, terminal isolation and firewall policy distribution according to the anomaly type and confidence level, and record handling audit information; The continuous learning and self-optimization module is used to dynamically update profiles, thresholds, and model parameters based on handling feedback, intelligence updates, and online incremental learning.

2. The DNS domain name abnormal access identification system based on behavioral characteristics according to claim 1, characterized in that: The character-level features in the behavioral profiling module include: domain name length, entropy, n-gram / binary / triple statistics, vowel / digit / repeating segment ratio, HMM transition probability, and Gibberish score; the temporal statistical features include: query frequency, burstiness, diurnal periodicity, session duration distribution, TTL distribution, and CNAME chain depth and stability; the graph structure features include: subject-domain / domain-IP / CNAME edge weights, number of common neighbors, clustering coefficient, and PageRank / betweenness centrality; and the protocol semantic features include: query type distribution, response code distribution, EDNS / DoH / DoT / DoQ identifiers, and DNSSEC verification results.

3. The DNS domain name abnormal access identification system based on behavioral characteristics according to claim 1, characterized in that: The candidate suspicious generation module is also used to perform CDN discrimination, which includes: matching the second-level domain name whitelist with the known CDN ASN / prefix library, IP attribution consistency, and CNAME pointing characteristics and TTL consistency; when a domain name simultaneously meets the following conditions, it is determined to be a suspicious domain name: it is not on the whitelist, the TTL is lower than the threshold, the number of responding IPs is higher than the threshold, and the IP similarity is higher than the threshold.

4. The DNS domain name abnormal access identification system based on behavioral characteristics according to claim 1, characterized in that: The anomaly scoring and fusion module includes: The unsupervised submodule is used to perform clustering, outlier analysis, and autoencoder reconstruction error scoring on the subject / domain / resolution results. The supervised submodule is used to perform anomaly classification on multiple features using gradient boosting trees, random forests, deep neural networks, or Transformer sequence models. The evidence fusion submodule is used to weight or stack the scores of multiple submodules and output the anomaly type and confidence range.

5. The DNS domain name abnormal access identification system based on behavioral characteristics according to claim 1, characterized in that: The graph anomaly and gang detection module is also used for: Construct multi-part graph snapshots using sliding time windows and calculate the temporal evolution characteristics of nodes and edges; A temporal graph attention network is used to learn the representation of nodes and edges, and contrastive learning and anomaly scoring are combined to identify abnormal subject groups and anomaly parsing paths.

6. The DNS domain name abnormal access identification system based on behavioral characteristics according to claim 1, characterized in that: The processing and linkage module is also used for: When the confidence level is higher than the first threshold, perform a DNS redirection to a secure site or return NXDOMAIN. When the confidence level is higher than the second threshold and there are signs of spread, perform endpoint isolation and firewall blocking; When the confidence level is between the first and second thresholds, flow limiting and enhanced observations are performed.

7. The DNS domain name abnormal access identification system based on behavioral characteristics according to claim 1, characterized in that: The continuous learning and self-optimization module is also used for: Incremental training and model distillation are performed based on handling feedback and false alarm samples; Recalibrate features and thresholds based on intelligence updates; Perform periodic recalculation and version control on graph structure and images.

8. A method for identifying abnormal DNS domain name access based on behavioral characteristics, characterized in that: include: Collect and normalize endpoint / process-side DNS logs, recursive / authoritative resolution traffic, passive DNS, and external intelligence; Construct a multi-dimensional behavioral profile of the entity, domain name, and resolution relationship; A candidate suspicious set is generated based on white / gray lists, CDN discrimination, TTL and IP quantity / similarity thresholds, DGA and Fast-Flux features; A hybrid model is used to perform multi-perspective anomaly scoring and evidence fusion on the candidate set, and output the anomaly type and confidence level. Construct a multi-part graph of subject-domain-IP / CNAME and perform time-series graph anomaly detection to identify abnormal subject groups; Implement tiered alerting, DNS redirection / blocking, endpoint isolation, and firewall policy distribution, and conduct audits of the handling processes; Online incremental learning and parameter updates are performed based on feedback and intelligence.

9. The DNS domain name abnormal access identification method based on behavioral characteristics according to claim 8, characterized in that: The DGA detection includes: character-level statistical feature extraction, n-gram / binary / triple ranking features, HMM transition probability and Gibberish score, and combined with sequence model for binary or multi-class classification. The Fast-Flux detection includes: joint discrimination of the number of responding IPs, TTL distribution, IP attribution and ASN diversity, and CNAME chain change frequency for the same domain within a short time window. The domain hijacking detection includes: resolution results deviating from the historical baseline, abnormal CNAME chain jumps, inconsistent authoritative / recursive responses, and association scores with threat intelligence entities exceeding the threshold.