CN110912910A - DNS network data filtering method and device - Google Patents

Abstract

The invention discloses a method and device for filtering DNS network data, comprising the following steps: (1) collecting network data in a DNS server through a measurement collector; (2) extracting characteristic values of the DNS data; (3) performing data processing, Label each piece of data collected according to the selected eigenvalues, obtain relevant eigenvectors, and form a corresponding feature matrix; (4) Simultaneously classify data through multiple classifiers; (5) Vote according to the weights of the classifiers Determine the final classification; (6) filter malicious network activities according to the classification results.

Description

A kind of DNS network data filtering method and device

technical field

The present invention relates to the technical field of network communication, and in particular, the present invention relates to a method and device for filtering DNS network data.

Background technique

The DNS network is a network system that translates domain names and corresponding IP addresses. A table of domain names and corresponding IP addresses (IP addresses) is stored in the DNS to resolve the domain names of messages. After you have registered the domain name and purchased the hosting service, you need to resolve the domain name to the purchased hosting before you can see the website content. At present, there is a problem of domain name resolution security in the DNS network.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a DNS network data filtering device and method in order to solve the security problem of the domain name resolution system, through which the DNS network data can be classified, malicious network data can be filtered out, and the security of the domain name resolution system can be further improved. .

A method for filtering DNS network data, comprising the following steps:

Collect network data in DNS server through measurement collector;

Extract characteristic values of DNS data, calculate characteristic influence weights, and configure parameters;

Process data according to eigenvalues;

Simultaneous data classification by multiple classifiers;

The final classification is determined by voting according to the weight of the classifier;

Filter malicious web activity based on classification results.

Preferably, the network data includes: timestamp, DNS client IP, client port number, DNS server IP, DNS packet header ID, resource record type, request URL, request type, response IP, TTL, hop number.

Preferably, constructing the plurality of classifiers includes:

When training multiple classifiers, non-replacement sampling is used. If there is replacement, p samples are extracted from the training set, and if there is no replacement, k features are extracted from the feature set, and multiple different classifications are generated according to the calculation of the influence weight of the feature value. device.

Preferably, processing the data according to the eigenvalues includes:

According to the selected eigenvalues, each piece of data collected is processed to obtain the relevant eigenvectors and form the corresponding eigenmatrix.

As an option, data classification is performed at the same time, and the calculation of the classifier weight allocation ratio is to calculate the posterior probability of the classification result of each classifier through an algorithm to obtain the weight allocation ratio of each classifier. In principle, weights are assigned to each classifier.

Preferably, the result obtained by voting is used to intercept malicious results in the data, and add the malicious results to the blacklist.

A DNS network data filtering device, comprising a data acquisition module, a data processing module, a parameter configuration module, a classification module and a decision-making module; wherein,

The data processing module includes a preset blacklist comparison, and processes the data according to the selection of the characteristic value; the parameter configuration module includes the extraction of the characteristic value, the calculation of the influence weight of the characteristic value, and the configuration of parameters; The classification module is composed of a plurality of parallel classifiers, and classifies the data at the same time; the decision-making module includes the calculation of the weight allocation ratio of the classifiers, and the final result of the classifier voting decision according to the weight allocation ratio.

Preferably, the preset blacklist is composed of some malicious network activity data collected in advance by the system and judged by running the filtering system. Malicious network activity data judged by the filtering system will be added to the blacklist.

Preferably, the decision-making module includes the calculation of the weight allocation ratio of the classifiers by calculating the posterior probability of the classification result of each classifier through an algorithm to obtain the weight allocation ratio of each classifier, and the degree of accuracy is given priority and fairness is considered. The principle of weight allocation for each classifier.

Preferably, the selection of the feature value includes the extraction of static features and dynamic features of the data, and the static features include the length of the second-level domain name, the structure of Chinese characters in the domain name, the number of numbers in the domain name, the number of letters in the domain name, etc.; Extract the time included in querying each querier.

Through the present invention, a DNS network data filtering system is proposed, through which the DNS network data can be classified, malicious network data can be filtered out, and the security of the domain name resolution system can be further improved. .

Description of drawings

1 shows a flowchart of a DNS data filtering method according to an embodiment of the present invention;

2 shows a structural diagram of a DNS data filtering apparatus according to an embodiment of the present invention;

FIG. 3 shows an organizational flowchart of a DNS data filtering method according to an embodiment of the present invention.

Detailed ways

The following is a detailed description of the embodiments of the present invention, which are labeled in the accompanying drawings, and the same or similar reference numerals are used throughout the drawings to denote the same or similar components or components having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary, and are only used to explain the present invention, but not to be construed as a limitation of the present invention.

It will be understood by those skilled in the art that the singular forms "a", "an", "the" and "the" as used herein can include the plural forms as well, unless expressly stated otherwise. It should be further understood that the word "comprising" used in the description of the present invention refers to the presence of stated features, integers, steps, operations, elements and/or components, but does not exclude the presence or addition of one or more other features, Integers, steps, operations, elements, components and/or groups thereof. It will be understood that when we refer to an element as being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element or intervening elements may also be present. Furthermore, "connected" or "coupled" as used herein may include wirelessly connected or "coupled." As used herein, the term "and/or" includes any and all combinations of one or more of the associated listed items.

It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with their meanings in the context of the prior art and, unless defined as herein, are not to be taken in an idealized or overly formal sense. explain.

As shown in Figure 1, a DNS data filtering method according to an embodiment of the present invention includes the following steps:

101. Collect network data in the DNS server through a measurement collector.

102. Extract characteristic values of DNS data, calculate characteristic influence weights, and configure parameters.

103. Process the data according to the characteristic value.

104. Perform data classification by multiple classifiers at the same time.

105. Vote to determine the final classification according to the weights of the classifiers.

106. Filter malicious network activities according to the classification result.

In step 101, the network data collected in the DNS network includes:

The network data mainly comes from the DNS request data cached in the DNS server;

Network data includes but is not limited to timestamp, DNS client IP, client port number, DNS server IP, DNS packet header ID, resource record type, request URL, request type, response IP, TTL, hop count, etc.

In step 102, the selection of the feature value includes:

The selection of feature values includes but is not limited to the extraction of static features and dynamic features of data. Static features include but are not limited to the length of the second-level domain name, the structure of Chinese characters in the domain name, the number of numbers in the domain name, the number of letters in the domain name, etc.; dynamic features The extraction includes, but is not limited to, the time to query each querier.

In step 103, processing the data according to the characteristic value includes:

According to the selected eigenvalues, each piece of data collected is processed to obtain the relevant eigenvectors and form the corresponding eigenmatrix.

In step 104, the plurality of classifiers include:

A number of different classifiers are generated according to the calculation of the eigenvalues affecting the weights.

In step 105, the decision-making module includes:

The calculation of the weight allocation ratio of the classifier is to calculate the posterior probability of the classification result of each classifier through the algorithm to obtain the weight allocation ratio of each classifier, and follow the principle of correctness and fairness. weight ratio.

FIG. 2 is a structural diagram of an apparatus for filtering DNS data according to an embodiment of the present invention. The method is suitable for the network data analysis scene of the domain name resolution system. First, the measurement collector is used to collect data on the server of the domain name resolution system, that is, the collecting DNS server data module in the figure. In the parameter configuration module, the eigenvalues of the data are extracted, the influence weights of the eigenvalues are calculated, and the relevant parameters are configured. The data is sent to the data processing module. After the data processing module obtains the DNS network data, it first compares according to the blacklist preset in the system, filters the same as the blacklist, and then processes the data according to the characteristic value. Pass the processed feature vector to the classification module. In the classification module, a number of different classifiers are generated according to the calculation of the influence weight of the feature value. Each classifier classifies the data at the same time, and transmits the classification result to the decision-making module. The posterior probability is calculated to obtain the weight allocation ratio of each classifier, and the weight allocation ratio of each classifier is carried out according to the principle of giving priority to the correctness and fairness, and then voting on the results of each classifier according to the weight produces the final result, Malicious network data in the classification results are filtered and added to the preset blacklist.

FIG. 3 is an organizational flowchart of a method for filtering DNS data according to an embodiment of the present invention.

First, use the measurement collector to collect the data on the server of the domain name resolution system, extract the eigenvalues of the collected data, calculate the influence weight of the eigenvalues, process the data according to the extracted eigenvalues, and obtain the relevant eigenvectors , forming the corresponding feature matrix. The parameters are then configured according to the influence weights of the eigenvalues. According to the calculation of the influence weight of the feature value, a number of different classifiers are generated, the data is input into the classifier, each classifier simultaneously classifies the data, and then the posterior probability of the classification result of each classifier is calculated by an algorithm, Obtain the weight allocation ratio of each classifier, follow the principle of correctness priority and fairness, and then perform a weight allocation ratio for each classifier, and then vote on the results of each classifier according to the weight to generate the final result, and classify the malicious network in the result. The data is filtered and added to the preset blacklist.

Through the technical scheme proposed by the present invention, the DNS network data can be classified through the system, malicious network data can be filtered out, and the security of the domain name resolution system can be further improved.

As will be appreciated by those skilled in the art, the present invention may relate to apparatus for performing one or more of the operations described in this application. The apparatus may be specially designed and manufactured for the required purposes, or it may comprise known apparatuses in a general-purpose computer selectively activated or reconfigured with a program stored therein.

Those skilled in the art will understand that computer program instructions can be used to implement each block of these structural diagrams and/or block diagrams and/or flow diagrams, and combinations of blocks in these structural diagrams and/or block diagrams and/or flow diagrams . These computer program instructions may be provided to a processor of a general purpose computer, specialized computer or other programmable data processing method to create a machine whereby the instructions executed by the processor of the computer or other programmable data processing method create a structure for implementing A method specified in a block or blocks of a diagram and/or block diagram and/or flow diagram.

Those skilled in the art can understand that the various operations, methods, steps, measures, and solutions discussed in the present invention may be alternated, modified, combined or deleted. Further, other steps, measures, and solutions in the various operations, methods, and processes that have been discussed in the present invention may also be alternated, modified, rearranged, decomposed, combined, or deleted. Further, steps, measures and solutions in the prior art with various operations, methods, and processes disclosed in the present invention may also be alternated, modified, rearranged, decomposed, combined or deleted.

The above are only some embodiments of the present invention. It should be pointed out that for those skilled in the art, without departing from the principles of the present invention, several improvements and modifications can be made. It should be regarded as the protection scope of the present invention.

Claims (10)

1. a DNS network data filtering method, is characterized in that, comprises the following steps: Collect network data in DNS server through measurement collector; Extract characteristic values of DNS data, calculate characteristic influence weights, and configure parameters; Process data according to eigenvalues; Simultaneous data classification by multiple classifiers; The final classification is determined by voting according to the weight of the classifier; Filter malicious web activity based on classification results. 2. method according to claim 1 is characterized in that, described network data comprises: time stamp, DNS client IP, client port number, DNS server IP, DNS message header ID, resource record type, request URL, request type, response IP, TTL, hop count. 3. The method according to claim 1, wherein constructing a plurality of classifiers comprises: When training multiple classifiers, non-replacement sampling is used. If there is replacement, p samples are extracted from the training set, and if there is no replacement, k features are extracted from the feature set, and multiple different classifications are generated according to the calculation of the influence weight of the feature value. device. 4. The method according to claim 1, wherein processing the data according to the characteristic value comprises: According to the selected eigenvalues, each piece of data collected is processed to obtain the relevant eigenvectors and form the corresponding eigenmatrix. 5. method according to claim 1, is characterized in that, carry out data classification simultaneously, and the calculation of classifier weight allocation ratio is to calculate the posterior probability of the classification result of each classifier by algorithm, obtain each classifier's posterior probability. Weight allocation ratio, follow the principle of correctness and fairness to carry out weight allocation ratio for each classifier. 6 . The method according to claim 1 , wherein the results obtained by voting are used to intercept malicious results in the data, and add the malicious results to the blacklist. 7 . 7. A DNS network data filtering device, comprising a data acquisition module, a data processing module, a parameter configuration module, a classification module and a decision-making module; wherein, The data processing module includes a preset blacklist comparison, and processes the data according to the selection of the characteristic value; the parameter configuration module includes the extraction of the characteristic value, the calculation of the influence weight of the characteristic value, and the configuration of parameters; The classification module is composed of a plurality of parallel classifiers, and classifies the data at the same time; the decision-making module includes the calculation of the weight allocation ratio of the classifiers, and the final result of the classifier voting decision according to the weight allocation ratio. 8. a kind of DNS network data filtering device according to claim 7, is characterized in that: The preset blacklist is composed of some malicious network activity data collected in advance by the system and judged by running the filtering system. Malicious network activity data judged by the filtering system will be added to the blacklist. 9. a kind of DNS network data filtering device according to claim 7, is characterized in that: The decision-making module includes the calculation of the weight allocation ratio of the classifier, which is to calculate the posterior probability of the classification result of each classifier through an algorithm, and obtain the weight allocation ratio of each classifier. Each classifier is weighted. 10. a kind of DNS network data filtering device according to claim 7, is characterized in that: The selection of the feature value includes the extraction of static features and dynamic features of the data, and the static features include the length of the second-level domain name, the structure of Chinese characters in the domain name, the number of numbers in the domain name, the number of letters in the domain name, etc.; the extraction of dynamic features includes: The time to query each querier.

Images