Controlled host detection method and device based on knowledge graph

Abstract

The invention provides a controlled host detection method and device based on a knowledge graph, and the method comprises the steps: filtering extracted feature data by adopting data, in a response state of NXDOMAIN, in DNS flow, describing the data based on a knowledge graph construction framework, constructing an NXDOMAINIP knowledge graph; and finally, analyzing the knowledge graph by utilizinga community discovery algorithm and a community judgment algorithm to obtain a controlled host list and mark a suspected malicious code family. Based on a distributed data flow processing framework,real-time DNS request flow is analyzed on a large scale, and the analysis efficiency is greatly improved through a multi-stage data preprocessing process; and through NXDOMAINIP knowledge graph construction, community discovery and community judgment, word list splicing DGA domain names are detected, controlled hosts and related malicious code families are determined, victims are reminded in timeto carry out AV upgrading and full-disk scanning on the hosts, and host vulnerabilities are reinforced.

Description

technical field [0001] The invention belongs to the technical field of controlled host detection, and in particular relates to a controlled host detection method and device based on a knowledge map. Background technique [0002] In highly sophisticated cyberattacks, the command and control (C&C) server consistently uses a Domain Generation Algorithm (DGA) to dynamically generate multiple candidate domain names, rather than static IP addresses or hard-coded lists of domain names. Distinguishing domain names generated by DGA from legitimate domain names is crucial for discovering controlled hosts or further locating hidden attackers. Compared with the traditional character-based DGA domain names, the word-based DGA domain names disclosed in the recent cyber attack incidents show significantly stronger stealth and adversarial resistance. In word-based DGA domain names, two or more words are randomly selected from one or more specific dictionaries to form dynamic domain names, ...

AI Technical Summary

Problems solved by technology

[0006] In order to solve the above technical problems, the present invention provides a controlled host detection method and device based on knowledge graph, which solves the performance, precision and engineering problems existing in the detection of vocabulary splicing DGA domain names in the prior art, and can further More accurate discovery of controlled hosts, reducing the risk of user assets

Images