Trojan horse virus detection method based on DNS

Abstract

The invention relates to the technical field of network security and discloses a DNS-based Trojan horse virus detection method. The method comprises a data packet acquisition and integration module, aDNS session recombination module, a random forest classification training module, a DNS tunnel Trojan horse traffic monitoring module and a user management interface. The Trojan horse virus detectionmethod based on the DNS comprises steps that the first sample information is acquired, and the first sample information comprises the domain name information of the DNS and flow behaviors of the DNS;a characteristic value of the first sample information is extracted; weighted summation is conducted on feature values to obtain a score value; the DNS suspicious model is established according to the score value, so that weighted summation is performed on the feature value, the DNS suspicious model is established according to the score value after the score value is obtained, and the DNS suspicious model can be used for subsequent suspicious judgment on DNS information, namely, multi-dimensional recognition is performed on the feature value, so many problems such as misinformation generatedby a conventional algorithm are reduced; and DNS information detection and identification accuracy is improved.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a DNS-based Trojan horse virus detection method. Background technique [0002] In the background of continuous updating and upgrading of network technology, the harmfulness and aggressiveness of Trojan horse virus are also increasing continuously. Trojan horse virus refers to a piece of malicious code with special functions hidden in a normal program. An executable program, the hacker controls the computer remotely, parasitizes the control program in the controlled computer system, cooperates with the outside, waits for an opportunity to steal passwords and important files in the computer infected with the Trojan horse virus, and can also monitor and control the controlled computer. Illegal operations such as data modification. [0003] At present, in order to deal with the Trojan horse virus problem, a variety of covert communication methods have been developed. For ex...

AI Technical Summary

Problems solved by technology

However, the DNS communication fields may have the same format rules. The domain name fields of each request have a large similarity, which leads to a certain underreporting of information entropy, and the current popular virus Trojan horse technology is changing with each passing day. Simply relying on feature detection has been unable to identify new ones. Sample feature, for this reason the present invention will provide a kind of Trojan horse virus detection method based on DNS

Images