Botnet Detection via DNS Graph Mining
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current botnet detection methods rely on network traffic analysis, which requires extensive data processing and is inefficient due to high computational overhead, leading to low detection efficiency.
Innovation Solution
A botnet detection method and system that acquire and preprocess network traffic data to construct a terminal access relationship graph, mine identifiers of terminals accessing identical domain names, and screen candidate nodes using a preset rule to detect botnet nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network traffic analysis with clustering or correlation detection is used to detect botnets, then detection capability is improved, but processing load increases and detection efficiency decreases
Solution Approach 1:
The patent extracts and focuses on a specific, critical feature (DNS query behavior) from the complex network traffic data, rather than analyzing all traffic characteristics. By taking out only the DNS-related information and building detection models based solely on DNS failure graphs and query patterns, the system achieves effective botnet detection with significantly reduced processing requirements compared to comprehensive traffic analysis.
Solution Approach 2:
The patent changes the detection parameter from comprehensive network traffic characteristics to specific DNS query behavior metrics. By shifting focus to DNS-related parameters (query frequencies, failure patterns, domain name structures) and using graph-based representations of DNS interactions, the system transforms the detection approach to achieve higher efficiency while maintaining detection capability.
2Measurement precision
If comprehensive network traffic data with multiple characteristics is analyzed, then detection accuracy is improved, but computational overhead increases
Solution Approach 1:
The patent extracts and focuses on a specific, critical feature (DNS query behavior) from the complex network traffic data, rather than analyzing all traffic characteristics. By taking out only the DNS-related information and building detection models based solely on DNS failure graphs and query patterns, the system achieves effective botnet detection with significantly reduced processing requirements compared to comprehensive traffic analysis.
Solution Approach 2:
The patent changes the detection parameter from comprehensive network traffic characteristics to specific DNS query behavior metrics. By shifting focus to DNS-related parameters (query frequencies, failure patterns, domain name structures) and using graph-based representations of DNS interactions, the system transforms the detection approach to achieve higher efficiency while maintaining detection capability.
Data Source
Figure 1~2
Figure 3(a)~3(b)
Figure 4
AI summary
Disclosed are a botnet detection method and system, and a storage medium. The method comprises: obtaining original network traffic data in a monitored network and preprocessing the original network traffic data to obtain preprocessed network traffic data; constructing a terminal access relationship map on the basis of the preprocessed network traffic data; mining an identifier list of terminals accessing a plurality of the same domain names from the terminal access relationship map to obtain a candidate node combination, and on the basis of a preset screening rule, screening the candidate node combination to obtain a botnet node detection result.