Botnet detection method based on DNS (Domain Name System) flow characteristics

Abstract

The invention discloses a botnet detection method based on DNS (Domain Name System) flow characteristics. The method of the invention comprises a Domain-Flux botnet detection method based on DNS flow characteristics. The method comprises steps: legal main domain names and illegal main domain names are combined to form a target set; a domain name whose length is larger than 6 is extracted and processed as a research target; the domain name entropy, word formation characteristics, phonetic characteristics and grouped characteristics are calculated respectively; and the above is put in a random forest classifier to obtain a training model. A Fast-Flux botnet detection method based on the Domain-Flux botnet detection method comprises steps: the original data of a DNS server are processed; the training model obtained before is used for evaluating a to-be-processed domain name, and a score for a DGA condition is acquired; a white list, a black list and a grey list are used for scoring the domain name and an IP; time characteristics of the IP address are calculated; the stability of the IP address is calculated; and the above is put in the random forest classifier to obtain a training model SFF. The experiment accuracy is high.

Description

technical field [0001] The invention relates to a DNS domain name technology and a machine learning system classification algorithm. In particular, it relates to a botnet detection method based on DNS traffic characteristics. Background technique [0002] Among the current domain name generation technologies, there are mainly: [0003] (1) Domain-Flux technology: Domain-Flux refers to the behavior of continuously changing and assigning multiple domain names to one or more IPs. [0004] (2) Fast-Flux technology: There are two types of this technology: Single-Flux domain name technology and Double-Flux domain name technology. [0005] The Single-Flux domain name technology can be compared to the Tor network. In the botnet based on the Single-Flux domain name technology, each zombie host is a redirection node, so that the optimal addressing process can be realized based on the redirection of different zombie hosts. , on the one hand to avoid the impact of a single node on th...

AI Technical Summary

Problems solved by technology

[0011] In recent years, foreign researchers have proposed a new technical detection method for botnets——DNS data flow analysis and detection technology. The current botnet detection methods based on DNS data flow mostly simulate botnets. Validated, not tested in real network traffic

In addition, the amount of data used by these methods in the test is relatively small, which cannot represent the real characteristics of the traffic in the actual network

Images