Botnet Detection via DNS Graph Mining

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current botnet detection methods rely on network traffic analysis, which requires extensive data processing and is inefficient due to high computational overhead, leading to low detection efficiency.

Innovation Solution

A botnet detection method and system that acquire and preprocess network traffic data to construct a terminal access relationship graph, mine identifiers of terminals accessing identical domain names, and screen candidate nodes using a preset rule to detect botnet nodes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If network traffic analysis with clustering or correlation detection is used to detect botnets, then detection capability is improved, but processing load increases and detection efficiency decreases

Engineering Contradiction:
Improvebotnet detection capabilityVSAvoiddetection efficiency
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The patent extracts and focuses on a specific, critical feature (DNS query behavior) from the complex network traffic data, rather than analyzing all traffic characteristics. By taking out only the DNS-related information and building detection models based solely on DNS failure graphs and query patterns, the system achieves effective botnet detection with significantly reduced processing requirements compared to comprehensive traffic analysis.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent changes the detection parameter from comprehensive network traffic characteristics to specific DNS query behavior metrics. By shifting focus to DNS-related parameters (query frequencies, failure patterns, domain name structures) and using graph-based representations of DNS interactions, the system transforms the detection approach to achieve higher efficiency while maintaining detection capability.

Inventive Principle:
Principle #35Parameter changes

2Measurement precision

If comprehensive network traffic data with multiple characteristics is analyzed, then detection accuracy is improved, but computational overhead increases

Engineering Contradiction:
Improvebotnet detection accuracyVSAvoidcomputational overhead
Core Design Contradiction:
Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The patent extracts and focuses on a specific, critical feature (DNS query behavior) from the complex network traffic data, rather than analyzing all traffic characteristics. By taking out only the DNS-related information and building detection models based solely on DNS failure graphs and query patterns, the system achieves effective botnet detection with significantly reduced processing requirements compared to comprehensive traffic analysis.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent changes the detection parameter from comprehensive network traffic characteristics to specific DNS query behavior metrics. By shifting focus to DNS-related parameters (query frequencies, failure patterns, domain name structures) and using graph-based representations of DNS interactions, the system transforms the detection approach to achieve higher efficiency while maintaining detection capability.

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentEP3905622B1Botnet detection method and system, and storage medium
Publication Date: 2025.04.23 ZTE CORP
  • EP3905622B1 patent drawingFigure 1~2
  • EP3905622B1 patent drawingFigure 3(a)~3(b)
  • EP3905622B1 patent drawingFigure 4

AI summary

Disclosed are a botnet detection method and system, and a storage medium. The method comprises: obtaining original network traffic data in a monitored network and preprocessing the original network traffic data to obtain preprocessed network traffic data; constructing a terminal access relationship map on the basis of the preprocessed network traffic data; mining an identifier list of terminals accessing a plurality of the same domain names from the terminal access relationship map to obtain a candidate node combination, and on the basis of a preset screening rule, screening the candidate node combination to obtain a botnet node detection result.