Method and device for detecting algorithm generation domain name

Abstract

The invention discloses a method and device for detecting an algorithm generation domain name, and the method comprises the steps: generating an algorithm through a probability model; building a random model and a normal model through an algorithm generation domain name set and a normal domain name set, and detecting the algorithm generation domain name through the above models, thereby achievingthe quick detection of the algorithm generation domain name, and effectively solving a problem that the quick detection of the algorithm generation domain name cannot be achieved in the prior art.

Description

technical field [0001] The invention relates to the field of communication technology, in particular to a method and device for detecting domain names generated by algorithms. Background technique [0002] Compared with uncontrolled malware such as worms and viruses in the early days, most current attackers control their malware through a command and control (C&C) channel to implement more targeted attacks. At the same time, due to the convenience brought by the Domain Name System (DNS), using DNS to locate the C&C server has become a mainstream method. [0003] In order to evade detection, attackers will use Domain Generation Algorithm (DGA) to generate a large number of random domain names at regular intervals for access. These domain names are also called algorithm-generated domain names to determine the real C&C domain names. Taking the well-known botnet conficker as an example, it generates 250 domain names per hour and randomly selects 32 of them for connection attemp...

AI Technical Summary

Problems solved by technology

[0006] The present invention provides a method and device for detecting algorithm-generated domain names to solve the problem that the prior art cannot quickly detect algorithm-generated domain names

Images