TW202008749A - Domain name filtering method - Google Patents

Abstract

A domain name filtering method is implemented by a computer host and includes: detecting a plurality of packets to be transmitted and externally connected and acquiring corresponding a plurality of domain names; determining whether one of the domain names belongs to a malicious domain name based on a LSTM model; when it is determined that one of the domain names belongs to the malicious domain name and does not belong to a cname list based on the cname list, blocking the corresponding packet from being transmitted. The method can instantly find the abnormal domain name generated by the suspected domain generation algorithm(DGA), and immediately block the devices infected by the malicious program from externally connecting to avoid the enterprise suffering from larger loss and damage.

Description

Screen name filtering method

The invention relates to a filtering method, in particular to a filtering method for net names.

In an ever-changing network attack, a method of domain fluctuation (Domain Fluxing) is that malicious programs use the technology of Domain Generation Algorithm (DGA) to generate a large number of domain names (Domain Names) to the C&C server (Command-and-Control Servers) A way to establish malicious connections.

It is a common practice to establish a blacklist to prevent malicious connections among the conventional security defense methods. However, when facing malicious programs that use domain generation algorithm (DGA) technology, they will face the following problems: First, the update of the blacklist is not real-time enough; second, when the number of blacklists is large, it will affect the internal and external network performance of the enterprise. Because the existing analysis technology is based on behavior statistics when analyzing the characteristics of network messages, to calculate the probability of the user being infected by the malicious program, or the probability that the behavior pattern comes from the malicious program, and then infer the device invaded by the malicious program. However, no matter how long or short the characteristics of behavior analysis are, it takes a period of time for data collection to create enough feature data to identify malicious connections, and it cannot meet the real-time requirements for emerging attack methods. What is more serious is that when malicious programs use domain generation algorithm (DGA) technology to dynamically generate domain names continuously, it will invalidate the blacklist mechanism that uses domain names as anti-blocking foundations. Therefore, whether there are other solutions becomes a problem to be solved.

Therefore, the object of the present invention is to provide a method for filtering net names that improves conventional problems.

Therefore, the screen name filtering method of the present invention is applicable to a computer host and implemented by the computer host. The screen name filtering method includes steps (a) to (c).

In step (a), multiple packets to be transmitted and connected to the outside are detected, and multiple corresponding domain names are obtained.

In step (b), according to a long-short-term memory model, it is determined whether one of the domain names belongs to a malicious domain name.

In step (c), according to a list of Canonical names (CNAME), when it is judged that one of the domain names belongs to the malicious domain name and does not belong to the list of regular names, the computer host blocks the corresponding The packet is transmitted.

In some embodiments, in step (c), the computer host determines that at least one of the domain names belongs to a first malicious domain name, ... an i-th malicious domain name, i Is a positive integer, and it is also determined that each Internet protocol address (IP address) corresponding to the first malicious domain name to the i-th malicious domain name is the same, and the first malicious domain name When the name of the i-th malicious domain does not belong to the regular name list, the computer host blocks the corresponding packet for transmission.

In other embodiments, wherein in step (c), the computer host also determines that one of the domain names belongs to the malicious domain name and does not belong to the regular name list according to a white list If it does not belong to the white list, the computer host blocks the corresponding packet for transmission.

In some other implementations, wherein in step (b), the computer host is based on multiple second-level domain names and multiple third-level domain names of multiple domain names belonging to a whitelist, and those belonging to a blacklist Multiple second-level domain names and multiple third-level domain names of multiple domain names establish the long-short-term memory model.

In some implementation aspects, wherein the method for filtering the network name further includes step (d), the computer host updates at least one of the white list and the black list according to the judgment result of each of the domain names, to Update the long and short-term memory model.

The effect of the present invention lies in: by detecting whether each packet domain name belongs to a malicious domain name according to the long-short-term memory model, and then making a second judgment based on the regular name list, not only can it be blocked in real time The equipment infected by the malicious program can be connected to the outside to avoid loss and harm to the enterprise. It can further track the infected device and eradicate the malicious program on the infected device.

Before the present invention is described in detail, it should be noted that in the following description, similar elements are denoted by the same numbers.

Referring to FIG. 1, the screen name filtering method of the present invention is applicable to a computer host and includes steps S1 to S12.

In step S1, the computer host obtains a plurality of normal domain names (Domain Name) and assigns the normal domain names to a white list. For example, the computer host obtains the first plurality of domain names on the Alexa website ranking as these normal domain names, such as google.com, esunbank.com, yahoo.com, etc., but not limited to this.

In step S2, the computer host obtains abnormal domain names generated by multiple domain generation algorithms (DGA), and assigns the abnormal domain names to a blacklist. Such abnormal domain names such as xyafilk.com, uiteeraab.com, etc., but not limited to this.

In step S3, the computer host creates a Long Short-Term Memory (LSTM) model related to the domain name (Domain Name). Long- and short-term memory is a Recurrent Neural Network (RNN). By establishing a model with a "memory and forget" mechanism, it analyzes the relevance of vocabulary before and after the text to make a semantic analysis.

In more detail, the long-short-term memory (LSTM) model is a known technique that uses a binary classification model created by a neural network-like framework. The process of its creation will be briefly explained as follows. The computer host will mark the normal domain names as samples of normal domain names according to the white list in step S1. The computer host also marks the abnormal domain names as samples of abnormal domain names according to the blacklist in step S2.

In this embodiment, the computer host will first exclude the top-level domain (TLD) of the full domain name in each domain name of the white list and the black list, and retain its second-level domain name (Second-level domain, SLD) and third-level domain (Third-level domain) string. For example, if the full domain name is www.google.com.tw, the top-level domain name is tw, the second-level domain name is com, and the third-level domain name is google. The reserved strings are google and com.

Furthermore, the computer host extracts the first eight characters in each string, and converts each extracted string into a vector, that is, each character corresponds to a predetermined value, and When the character length of the extracted string is less than eight, it is padded with the value 0, for example, a, b, c, ..., z, ..., -, _ are converted into the values 1, 2, 3, ... , 26, ..., 36, 37, etc. For example, the strings google, esunbank, yahoo, xyafilk, uiteeraaa will first be extracted as the strings google, esunbank, yahoo, xyafilk, uiteeraa, respectively. Then convert to vectors [7,15, 15,7,12,5,0,0], [5,19,21,14,2,1,14,11], [25,1,8,15, 15,0,0, 0], [24,25,1,6,9,12, 11,0], [21,9,20,5,5,18,1,1].

The long and short-term memory model uses multiple strings converted from multiple normal strings belonging to the whitelist and multiple strings belonging to the abnormal domain names from the blacklist as two types of samples as input data to train the model How to distinguish whether the domain name is normal, and use forward recursion (Forward Propagation) and back propagation (Back Propagation), and then modify the model through the given optimization algorithm. In addition, during the establishment of the model, the model is used to determine the accuracy rate of the model through commonly used mathematical evaluation indicators such as precision, recall, and parameter (F1-value) of the domain name.

In step S4, the computer host detects multiple packets to be transmitted and connects to the outside world, and obtains multiple domain names corresponding to the multiple packets, that is, each packet will include a domain to be transferred to name.

In step S5, the computer host determines whether one of the domain names belongs to a malicious domain name according to the long-short-term memory model. When it is determined that one of the domain names does not belong to a malicious domain name, step S6 is executed. When it is determined that one of the domain names belongs to a malicious domain name, step S7 is executed. More specifically, the host computer retrieves the longest string in the domain name of each detected packet, and when the longest string is greater than eight characters, it is reduced to eight characters. Then it is numerically converted to obtain a vector. The long-term and short-term memory model receives the vector and judges whether it belongs to a malicious domain name (that is, abnormal domain name), and outputs a number between 0 and 1 as a judgment value, such as 0.4, 0.98, etc. Wait. The long-term and short-term memory model has a preset threshold value, for example, 0.9. When the judgment value is less than the threshold value, for example, 0.4 <0.9, it is judged that the domain name does not belong to a malicious domain name. Conversely, when the judgment value is greater than the threshold value, such as 0.98>0.9, it is judged that the domain name belongs to a malicious domain name.

In addition, in other embodiments, the computer host determines that at least one of the domain names belongs to a first malicious domain name, ... an i-th malicious domain name, i is a positive integer, and also determines the When each Internet Protocol Address (IP Address) corresponding to the first malicious domain name to the i-th malicious domain name is the same, the computer host executes step S7.

For example, the host computer detects nine packets to be transmitted, which are the first packet to the ninth packet, and determines that the first domain name to the ninth network corresponding to the first packet to the ninth packet, respectively. The domain names are determined to belong to the first malicious domain name to the ninth malicious domain name, respectively. The computer host also judges that the first malicious domain name to the ninth malicious domain name correspond to the first internet protocol address to the ninth internet protocol address respectively, assuming that the third malicious domain name to the eighth malicious domain name The third Internet protocol address to the eighth Internet protocol address corresponding to the domain names are the same, and the computer host continues the step S7 from the third domain name to the eighth domain name. In other words, the third malicious domain name to the eighth malicious domain name are not only judged to be an abnormal domain name (that is, belong to a malicious domain name), but also the source device (that is, the Internet Protocol address) corresponds to Multiple connections (that is, multiple domain names) indicate that the device that sent these packets to the computer host has a high probability of being hacked, and attempts to connect to the C&C servo through domain fluctuation (Domain Fluxing) Device.

Similarly, assume that the first malicious domain name, the second malicious domain name, and the ninth malicious domain name correspond to the first Internet protocol address, the second Internet protocol address, and the If the ninth Internet protocol address is different, the computer host continues to perform step S6, that is, the computer host will not block the transmission of the first packet, the second packet, and the ninth packet. In other words, although the first malicious domain name, the second malicious domain name, and the ninth malicious domain name are judged to be an abnormal domain name (that is, belong to a malicious domain name), but if the source The device (that is, the Internet Protocol address) does not correspond to multiple connections (that is, multiple domain names), and there is a higher probability that the user's non-malicious input errors are caused.

In step S6, the computer host allows the corresponding packet to continue to be transmitted.

In step S7, the computer host determines whether the domain name belonging to the malicious domain name belongs to a list of regular names (Canonical Name, Cname). When it is determined that the domain name belongs to the regular name list, step S8 is executed. When it is determined that the domain name does not belong to the regular name list, step S9 is executed. In addition, it should be particularly noted that when the computer host detects each packet to be transmitted and connected to the outside world, when any one of the packets has a formal name record (or alias record) (Canonical Name record, Cname record ), the computer host will store each domain name in each regular name record as a storage to become the regular name list.

In step S8, the computer host allows the corresponding packet to continue to be transmitted.

In step S9, the computer host determines whether the domain name that belongs to the malicious domain name and does not belong to the regular name list belongs to a white list. When it is determined that the domain name belongs to the white list, step S10 is executed. When it is determined that the domain name does not belong to the white list, step S11 is executed. More specifically, the white list is, for example, the top one million domain names ranked by the Alexa website. In addition, the content of the white list in step S9 and the white list in step S1 need not be the same, for example, both Has different numbers of domain names. In addition, in other embodiments, step S9 may also be omitted.

In step S10, the computer host allows the corresponding packet to continue to be transmitted.

In step S11, the computer host blocks the corresponding packet for transmission. In this embodiment, the computer host detects the domain name of each packet one by one, and when the computer host determines that the domain name of one of the packets belongs to a malicious domain name, it will take the packet as real-time Block without transmitting. When the computer host determines that the domain name of another packet belongs to another malicious domain name, it also blocks the other packet in real time and does not transmit it.

In step S12, the computer host periodically updates at least one of the white list and the black list according to the judgment result of each domain name to update the long-short-term memory model. For example: updated every month, but not limited to this.

It should be particularly added that in this embodiment, steps S1~S12 are implemented by the same computer host (such as a server), while in other embodiments, steps S1~S12 can also be implemented by different computer hosts To implement. For example, steps S1~S4 are implemented by one computer host, and steps S5~S12 are implemented by multiple computer hosts, such as a proxy server (Proxy Server) or a domain name system (DNS) in network devices within the enterprise ) Server etc.

In summary, the data characteristics required by the method of filtering the network name are simple, only the domain name of the packet needs to be analyzed, and the domain name generated by the suspected domain generation algorithm (DGA) can be analyzed without collecting the interval data. Based on the regular name list or the regular name list and the white list, further judgment and confirmation are made to block malicious connections in real time. In addition, the long-short-term memory model does not require excessively complicated stacking of hidden layers by most neural networks, and the calculation speed is fast, which can realize real-time detection of abnormal domain names. In addition, through the real-time detection of anomalous domain names, the source of malicious domain names can be obtained, and devices that have been compromised can be detected earlier, so it can indeed achieve the purpose of costing the invention.

However, the above are only examples of the present invention, and the scope of implementation of the present invention cannot be limited by this, any simple equivalent changes and modifications made according to the scope of the patent application of the present invention and the content of the patent specification are still classified as Within the scope of the invention patent.

S1~S12‧‧‧Step

Other features and functions of the present invention will be clearly presented in the embodiments with reference to the drawings, in which: FIG. 1 is a flowchart illustrating an embodiment of the screen name filtering method of the present invention.

S1~S12‧‧‧Step

Claims (5)

A screen name filtering method suitable for a computer host and implemented by the computer host. The screen name filtering method includes the following steps: (a) Detecting multiple packets to be transmitted and connecting to the outside world, and obtaining corresponding corresponding Multiple domain names; (b) according to a long-term and short-term memory model, determine whether one of these domain names belongs to a malicious domain name; and (c) based on a list of regular names (Canonical name, CNAME), When it is determined that one of the domain names belongs to the malicious domain name and does not belong to the regular name list, the computer host blocks the corresponding packet for transmission. The method for filtering a network name according to claim 1, wherein in step (c), the computer host determines that at least one of the domain names belongs to a first malicious domain name, ... an i-th malicious The domain name, i is a positive integer, and it is also determined that each Internet protocol address (IP address) corresponding to the first malicious domain name to the i-th malicious domain name is the same, and the first 1 When the malicious domain name to the i-th malicious domain name do not belong to the regular name list, the computer host blocks the corresponding packet for transmission. The method for filtering a network name according to claim 1, wherein, in step (c), the computer host further determines that one of the domain names belongs to the malicious domain name and does not belong to a white list When the regular name list does not belong to the white list, the computer host blocks the corresponding packet for transmission. The method for filtering a network name according to claim 1, wherein in step (b), the computer host is based on multiple second-level domain names and multiple third-level domain names of multiple domain names belonging to a whitelist, and belongs to Multiple black domain names and multiple second-level domain names and multiple third-level domain names establish the long-term and short-term memory model. The method for filtering a network name according to claim 4, further comprising step (d), the computer host updates at least one of the white list and the black list according to the judgment result of each domain name to update the Long and short-term memory model.

Images