Malicious domain name community mining method based on graph structure

Abstract

The invention relates to a malicious domain name community mining method based on a graph structure, which comprises the following steps: carrying out cleaning and rule filtering on an input DNS (Domain Name Server) log, and constructing a dependency graph among domain names according to data of three basic fields (a client, a timestamp and a server); on the basis of the constructed graph structure, discovering domain names with high dependency from the graph by using sequence similarity and jump probability of nodes, and mining domain name communities; and selecting a specific feature to carry out training learning on whether the community is malicious or not to obtain a classifier which is finally used for judging and screening out the malicious domain name community. Through adoption of the method, expansion detection of malicious domain name detection in an Internet security system can be met, the effect of malicious domain name cluster mining is achieved, the cost of network criminals is improved, and the method and the device are more suitable for increasingly complex Internet scenes in the future.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method for mining malicious domain name communities based on graph structures. Background technique [0002] With the development of the network, in order to carry out a large number of malicious activities, cybercriminals usually arrange a group of domain names or servers to build malicious infrastructure, improve the resistance and flexibility of malicious activities, and support the launch of large-scale DDoS attacks, spread Ransomware, stealing sensitive data, carrying out APT persistent threat attacks, etc. Moreover, the development of new network technologies, such as the Internet of Things (IoT), Cyber-Physical Systems, and Cognitive Radio Networks, have also brought various new security vulnerabilities, which have significantly increased the threat to the information security of Internet users. Security experts have made great efforts to mitigate cybercrim...

AI Technical Summary

Problems solved by technology

These detection methods are not very effective in effectively preventing further attacks

Images