Botnet Domain Family Detection via Spatiotemporal Graph
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting botnet domain name families are limited by single detection dimensions, excessive reliance on virus sample collection, and poor real-time detection capabilities, leading to inefficiencies in identifying and blocking botnet communications.
Innovation Solution
A method that builds a domain name space-time correlation graph to express correlations between suspicious domain names in multiple dimensions, using graph computing to determine closely correlated domain names as part of a botnet family, without relying on virus traffic, thereby enhancing detection capability and timeliness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If detection is based on grammatical features, then domain names with similar grammatical features can be identified, but detection performance deteriorates when C&C domain names lack obvious grammatical similarity
Solution Approach 1:
The patent transitions from single-dimensional grammatical feature analysis to multi-dimensional detection by introducing spatial correlations (domain name co-occurrence, IP address associations) and temporal correlations (query timing patterns, active periods). This multi-dimensional approach enables detection of botnet families even when grammatical features are not obviously similar, resolving the contradiction between detection accuracy for grammatically similar domains and adaptability to diverse botnet families.
2Measurement precision
If detection is based on virus traffic, then C&C domain names can be clustered by family information, but detection is restricted by the number of virus samples and suffers from lag
Solution Approach 1:
The patent performs preliminary clustering of domain names based on spatial and temporal correlations before virus samples are available. By pre-processing DNS query data to identify correlated domain names and establishing family groupings in advance, the system eliminates detection lag when virus samples become available, while maintaining accurate family identification through the correlation-based clustering mechanism.
Solution Approach 2:
The patent introduces spatial-temporal correlation analysis as an intermediary mechanism that bridges the gap between DNS query data and virus sample data. This intermediary clustering approach works independently of virus samples, eliminating the restriction imposed by limited virus sample numbers while maintaining accurate family identification through correlation patterns.
3Adaptability or versatility
If multiple detection dimensions are used, then detection comprehensiveness improves, but system complexity increases
Solution Approach 1:
The patent merges spatial correlation analysis (domain name co-occurrence, IP address associations) and temporal correlation analysis (query timing, active periods) into a unified correlation graph data structure. This integration combines multiple detection dimensions without proportionally increasing system complexity, as the graph structure provides a cohesive framework for representing and processing all correlation types simultaneously.
Data Source
Figure 1
Figure 2~3
AI summary
A botnet domain name family detecting method, an apparatus, a device, and a computer-readable storage medium. Said method comprises: acquiring suspicious domain names; constructing a domain name spatiotemporal association graph on the basis of associations between various suspicious domain names in different dimensions; taking each suspicious domain name as a node in the domain name spatiotemporal association graph, two domain names having at least one association forming an edge therebetween, and the association between the two domain names serving as an attribute value of the edge; and according to determination indexes of a compactness degree between various nodes in graph calculation, determining closely associated domain names in the domain name spatiotemporal association graph, and taking a set of the corresponding domain names as a botnet domain name family. The present application shows the associations between domain names in various different dimensions uniformly in the form of an association graph, and has a stronger detection capability. Moreover, the invention is able to detect a botnet domain name family quickly, and is widely applicable.