CN114793170A - DNS tunnel detection method, system, equipment and terminal based on open set identification - Google Patents

Abstract

The invention belongs to the technical field of network security, and discloses a detection method, a system, equipment and a terminal for identifying a DNS tunnel based on open set, wherein a captured DNS data packet is analyzed; performing feature extraction on the DNS query sub-domain name by using a neural network; dividing boundaries of a data space, respectively constructing a division forest for input DNS query domain name feature vectors, and calibrating a classification boundary by using an extreme value theory; calculating the probability that the test sample belongs to all classes including the unknown class by using a probability estimation method; and identifying the test sample into a classification label according to the maximum probability, and identifying the test sample as an unknown class when the probabilities that the test sample belongs to the known classes are all less than a threshold value epsilon. The invention applies the open set identification technology to DNS tunnel detection, and is expected to solve the judgment problem of hidden tunnels with unknown classes.

Description

DNS tunnel detection method, system, device and terminal based on open set identification

technical field

The invention belongs to the technical field of network security, and in particular relates to a method, system, device and terminal for detecting a DNS tunnel based on open set identification.

Background technique

The DNS protocol is the most important infrastructure on the Internet. Its main function is to convert host names into IP addresses, so as to ensure the smooth execution of other network applications. DNS services have become an indispensable part of the Internet. Due to the lack of data confidentiality and integrity protection in its protocol, it has become the preferred method of covert communication channels for attackers. DNS tunnels are used to bypass security control policies, realize the transmission of remote control commands or steal related sensitive data, which brings a lot to the network security environment. a serious threat.

Existing DNS covert channel detection is usually based on feature engineering based on expert knowledge for defense. It extracts relevant features of DNS data communication behavior and word frequency analysis of query records, and uses related machine learning algorithms to achieve classification and identification. Before feature extraction, the captured DNS data packets need to be reconstructed into data streams to extract more auxiliary identification information.

Through the above analysis, the existing problems and defects in the prior art are:

(1) Too much auxiliary identification information is used in the data collection process, which reduces the performance of the online system;

(2) The post-event detection method of reconstructing data packets into data streams cannot meet the needs of the intrusion detection system to respond to attack threats in a timely manner, resulting in serious consequences such as data leakage;

(3) The method of manually extracting features has certain limitations, and it is only extracted according to the known knowledge set, and the identification false alarm rate is high;

(4) When applied to online scenarios, the existing solutions cannot accurately identify DNS variant tunnels. For unknown types of data, the classification and identification algorithm needs to be improved.

SUMMARY OF THE INVENTION

Aiming at the problems existing in the prior art, the present invention provides a scheme and system for detecting DNS tunnels based on open set identification.

The present invention is implemented in this way, a method for detecting DNS tunnels based on open set identification, wherein the DNS tunnel detection method based on open set identification preprocesses DNS data, uses a deep learning network to represent the data with feature vectors, and uses an open set to perform feature vector representation on the data. The recognition algorithm divides and transforms the obtained feature vector space to clarify the boundary between the known space and the unknown space, and finally outputs the recognition result through probability evaluation.

Further, analyze the captured DNS data packets; use neural network to perform feature extraction on DNS query sub-domain names; divide the data space, construct partition forests for the input DNS query domain name feature vectors, and use extreme value theory to classify the classification boundaries Perform calibration; use the probability estimation method to calculate the probability that the test sample belongs to all categories including the unknown category; identify the test sample to the classification label according to the maximum probability, when the probability of the test sample belonging to the known category is less than the threshold ε, the The sample is identified as an unknown class.

Further, the method for detecting DNS tunnels based on open set identification includes the following steps:

The first step is the data preprocessing stage; parse the captured DNS packets and convert characters into integer values;

The second step, the feature vector representation stage; use the neural network to extract the features of the DNS query sub-domain name, use CNN and LSTM and different combinations to represent the DNS query domain name with feature vectors, and carry out network training. The space where the second floor is located is the characteristic space;

The third step is to build an open set recognition classification model; complete the boundary division of the data space, build a partition forest for the input DNS query domain name feature vector, calculate the average path length of each category as the category center, and use the extreme value theory to classify the classification boundaries. to calibrate;

The fourth step is the probability evaluation stage; based on the similarity between the test sample and each known category, the probability estimation method is used to calculate the probability that the test sample belongs to all categories including the unknown category;

The fifth step is to output the recognition result; according to the maximum probability, the test sample is identified as a classification label, and when the probability of the test sample belonging to a known category is less than the threshold ε, the sample is identified as an unknown category.

Further, the first step includes: extracting the DNS query domain name field for reservation, and creating two comparison tables by analyzing the DNS query domain name coding specification: one for mapping characters to numbers, and the other for mapping numbers to numbers character, each character has a corresponding integer value after processing; padding is performed after numerical encoding, and the end is padded with "0". If the data exceeds the input length, it will be truncated.

Further, after the second step of network training is completed, the activation vector of the previous layer of the classification layer is extracted as the feature vector representation of the current sample, that is, the input of the SoftMax classification layer in the network is selected as the feature vector.

Further, the third step includes: using the limit forest applied to the open set identification to perform segmentation and transformation on the obtained feature vector space, so that each class boundary that is divided contains the minimum distance boundary.

Further, the third step of training the classifier:

(1) According to all known category data, perform sub-sampling for each category, randomly select a feature as the starting node, randomly select a value within the value range of the feature, and divide the ψ samples into two parts, less than The samples of the value are divided into the left branch, and the samples larger than the value are divided into the right branch; this binary division is repeated in the left and right branches until the following conditions are met: the tree reaches the limit height; there is only one sample on the node; all samples on the node are The characteristics are the same; the division process is iteratively repeated according to the sample data capacity, and the generated division tree is formed into a binary tree forest;

(2) Calculate the average path length of each category, the number of samples ψ, and the average path length is equivalent to the average search length of the unsuccessful binary sorting tree search:

(3) Calculate the path length vector l(x) of the training samples in each category, and calculate the distance d _i (x)=l _i (x)-C _i (ψ) from the average path length to obtain the distance feature set L (x);

(4) Use extreme value theory to determine the classification boundary of each category. The extreme value model describes the distribution of abnormally high or abnormally low data, and models right-skewed data, left-skewed data, or symmetric data; D(x) is fitted to divide the known class boundaries:

β，λ和κ分别是位置、比例和形状参数。in

β, λ and κ are location, scale and shape parameters, respectively.

Further, the probability prediction specifically includes: separately calculating the probability that the sample to be tested belongs to each category, and indirectly calculating the probability of rejection through the probability; for the sample x to be tested, calculating the probability score calculation method formula of a certain known category i distribution through Weibull distribution :

The path vector L(x) is the difference between the sample x to be tested and the average distance length of each known category. The path vector is converted with the formula to apply to the category division after calibration by the extreme value model, and the probability score of each category is calculated. Method formula:

After obtaining the probability that the test sample belongs to the known category, the rejection probability of the unknown category is calculated through the inverse Weibull distribution 1-W _i , and the probability score of the sample to be tested x belonging to the unknown category is:

Among them, N+1 represents the unknown category;

Based on the obtained N+1 probability values, the sample to be tested is identified as the category with the maximum probability value; the open space risk is further limited by setting the threshold ε: if the maximum probability value P _max <ε is calculated, the sample is regarded as unknown Class rejected.

Another object of the present invention is to provide a computer device, the computer device includes a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor causes the processor to execute the program. Describe the steps of the method for detecting DNS tunnels based on open set identification.

Another object of the present invention is to provide an information data processing terminal, which is used for implementing the method for detecting a DNS tunnel based on open set identification.

Another object of the present invention is to provide a system for detecting open-set-based DNS tunnels that implements the method for detecting open-set-based DNS tunnels. The open-set-based DNS tunnel detection system includes:

The data preprocessing module is used to parse the captured DNS packets and convert characters into integer values;

The feature extraction module is used to extract the features of DNS query sub-domain names by using neural network, and use CNN and LSTM and different combinations to represent DNS query domain names as feature vectors, and perform network training. After training, the penultimate layer of the network is located The space is the feature space;

Train the classifier module to complete the boundary division of the data space, construct a partition forest for the input DNS query domain name feature vector, calculate the average path length of each category as the category center, and use the extreme value theory to calibrate the classification boundary;

The output prediction probability module is used to calculate the probability that the test sample belongs to all categories including the unknown category based on the similarity between the test sample and each known category, using the probability estimation method; classify the test sample identification according to the maximum probability label, when the probability of a test sample belonging to a known class is less than the threshold ε, the sample is identified as an unknown class.

In combination with the above-mentioned technical solutions and the technical problems solved, please analyze the advantages and positive effects of the technical solutions to be protected by the present invention from the following aspects:

First, in view of the technical problems existing in the above-mentioned prior art and the difficulty of solving the problems, closely combine the technical solutions to be protected of the present invention and the results and data in the research and development process, etc., and analyze in detail and profoundly how to solve the technical solutions of the present invention. Technical problems, some creative technical effects brought about by solving problems. The specific description is as follows: the present invention applies the open set identification technology to DNS tunnel detection, which is expected to solve the problem of judging hidden tunnels of unknown categories, and the open set identification is a solution to the open category classification faced in the real world. DNS data, as text-like data, can use deep learning technology to extract semantic features of DNS data by migrating some methods in natural language processing, avoiding the limitations of manual feature extraction. Therefore, it is of great significance to combine the feature extraction method of deep learning and the open set recognition algorithm for the detection of existing DNS covert channels.

Second, considering the technical solution as a whole or from the product point of view, the technical effects and advantages of the technical solution to be protected by the present invention are specifically described as follows:

Aiming at the characteristics of DNS data, the present invention proposes a new open set identification algorithm based on the compact decreasing probability model combined with the limit forest design, which is used to divide and transform the DNS data feature vector space extracted by the neural network, so as to achieve division The purpose of known space and unknown space is to achieve the purpose of real-time and high-accuracy DNS tunnel detection of unknown types. Third, as an auxiliary evidence of inventive step for the claims of the present invention, it is also reflected in the following important aspects:

(1) the technical scheme of the present invention has filled the technical gap in the industry at home and abroad:

Since there is still a lack of detection methods for unknown DNS tunnel identification, the present invention introduces open set identification into the field of DNS tunnel detection. Based on the proposed open set identification model, the boundary between known data space and unknown data space is further clarified, filling the Blank for DNS tunnel detection of unknown class.

(2) Whether the technical solution of the present invention has solved the technical problem that people have been eager to solve, but have not been able to achieve success:

Aiming at the massive and complex DNS data in the existing network environment, the present invention provides an effective solution for unknown types of DNS tunnel detection in combination with the need for real-time detection of an online intrusion detection system.

Description of drawings

1 is a flowchart of a method for detecting a DNS tunnel based on open set identification provided by an embodiment of the present invention;

2 is a schematic structural diagram of a system for detecting DNS tunnels based on open set identification provided by an embodiment of the present invention;

Fig. 3 is the realization flow chart of the DNS tunnel detection method based on open set identification provided by the embodiment of the present invention;

In the figure: 1. Data preprocessing module; 2. Feature extraction module; 3. Training classifier module; 4. Output prediction probability module.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

1. Explain the embodiment. In order for those skilled in the art to fully understand how the present invention is specifically implemented, this part is an explanatory embodiment for explaining the technical solutions of the claims.

As shown in FIG. 1 , the method for detecting a DNS tunnel based on open set identification provided by an embodiment of the present invention includes the following steps:

S101: Parse the captured DNS data packets, and convert characters into integer values;

S102: Use neural network to perform feature extraction on DNS query sub-domain name, use CNN convolutional neural network and LSTM long short-term memory neural network and different combinations to represent DNS query domain name with feature vector, perform network training, and use the trained network The space where the penultimate layer is located is the feature space;

S103: Complete the boundary division of the data space, construct a partition forest for the input DNS query domain name feature vector respectively, calculate the average path length of each category as the category center, and use the extreme value theory to calibrate the classification boundary;

S104: Based on the similarity between the test sample and each known category, use a probability estimation method to calculate the probability that the test sample belongs to all categories including the unknown category;

S105: The test sample is identified as a classification label according to the maximum probability, and when the probability of the test sample belonging to a known category is less than the threshold ε, the sample is identified as an unknown category.

As shown in FIG. 2 , the system for detecting DNS tunnels based on open set identification provided by an embodiment of the present invention includes:

Data preprocessing module 1, which is used to parse the captured DNS data packets and convert characters into integer values;

The feature extraction module 2 is used to extract features of DNS query sub-domain names using neural network, and use CNN and LSTM and different combination methods to represent DNS query domain names as feature vectors, and perform network training. The space where it is located is the feature space;

The training classifier module 3 is used to complete the boundary division of the data space, construct a partition forest for the input DNS query domain name feature vector, calculate the average path length of each category as the category center, and use the extreme value theory to calibrate the classification boundary;

The output prediction probability module 4 is used to calculate the probability that the test sample belongs to all categories including the unknown category by using the probability estimation method based on the similarity between the test sample and each known category; the test sample is identified according to the maximum probability Classification label, when the probability of a test sample belonging to a known class is less than the threshold ε, the sample is identified as an unknown class.

As shown in FIG. 3 , the method for detecting a DNS tunnel based on open set identification provided by an embodiment of the present invention specifically includes the following steps:

Step 1: Data preprocessing. First, the captured DNS data packets are parsed, and only the domain name field of the DNS query is extracted for reservation. In addition, because the neural network is used for automatic feature extraction in the scheme to avoid the defects of manual feature extraction, in order to meet the input requirements of the neural network model, it is necessary to convert characters into integer values. Through the analysis of the DNS query domain name encoding specification, there are 68 characters including "A-z", "0-9", "-", ".", etc., and two comparison tables are created: one is used to map characters to numbers, and the other is used to map characters to numbers. One is used to map numbers to characters, each character has a corresponding integer value after processing. After numerical encoding, padding is performed, and the end is filled with "0". If the data exceeds the input length, it will be truncated.

Step 2: Feature extraction. In order to obtain the feature vector representation of the DNS query domain name, the neural network is used to extract the features of the DNS query sub-domain name. The main design uses CNN and LSTM and different combinations to represent the DNS query domain name vector. The activation vector of one layer is used as the feature vector representation of the current sample, that is, the input of the SoftMax classification layer in the network is selected as the feature vector, that is, the space where the penultimate layer of the trained network is located is the feature space.

Step 3: Train the classifier. Use the limit forest applied to open set recognition to divide and transform the obtained feature vector space, so that each category boundary can contain the minimum distance boundary, complete the boundary division of the data space, and construct the input DNS query domain name feature vector separately. The forest is divided, the average path length of each class is calculated as the class center, and the class boundaries are calibrated using extreme value theory.

Step 4: Output the predicted probability. In the prediction stage, based on the similarity between the test sample and each known class, a probability estimation method is used to calculate the probability that the test sample belongs to all classes including the unknown class. Finally, according to the maximum probability, the test sample is identified as a classification label. When the probability of the test sample belonging to a known category is less than the threshold ε, the sample is identified as an unknown category.

In the embodiment of the present invention, the step 3 training classifier is described in detail as follows:

(1) According to all known category data, perform sub-sampling for each category, randomly select a feature as the starting node, randomly select a value within the value range of the feature, and divide the ψ samples into two parts, The samples smaller than this value are divided into the left branch, and the samples larger than this value are divided into the right branch. Repeat this binary division in the left and right branches until the following conditions are met:

a. The tree has reached the height limit;

b. There is only one sample on the node;

c. All features of the samples on the node are the same.

Then the division process is iteratively repeated according to the sample data capacity, and the generated division tree is formed into a binary tree forest.

(2) Calculate the average path length of each category, assuming the number of samples ψ, the average path length is equivalent to the average search length of the unsuccessful binary sorting tree search:

(3) Calculate the path length vector l(x) of the training samples in each category, and calculate the distance d _i (x)=l _i (x)-C _i (ψ:) from the average path length to obtain the distance feature set L(x).

(4) Using extreme value theory to determine the classification boundaries of each category, Equation 2 describes the probability density of the Weibull distribution. Extreme value models describe the distribution of data with abnormally high or low values and can model right-skewed, left-skewed, or symmetric data. Since there is no auxiliary identification information about unknown categories in the training set, the data path length distribution has a long-tailed distribution phenomenon, and it is obviously inappropriate to use only the central trend metric model to model the path length vector. Using the Weibull distribution to fit D(x) separately, the known class boundaries can be divided.

β，λ和κ分别是位置、比例和形状参数。in

β, λ and κ are location, scale and shape parameters, respectively.

In the embodiment of the present invention, the probability prediction is described in detail as follows:

The goal of the prediction stage is to obtain the probability that the sample belongs to each category. The main task is to calculate the rejection probability of an unknown sample. However, for open set recognition, there is no prior knowledge of the unknown category, so it is difficult to directly calculate the rejection probability. First, the probability that the sample to be tested belongs to each category is calculated separately, and the rejection probability is indirectly calculated through these probabilities.

For the sample x to be tested, the Weibull distribution is used to calculate the probability score that belongs to a known class i distribution, as shown in formula (3):

The path vector L(x) is the difference between the sample x to be tested and the average distance length of each known category. Combined with formula 3, the path vector is converted to apply to the category division after calibration by the extreme value model, and the probability score of each category is The calculation method is as formula (4):

After obtaining the probability that the test sample belongs to the known category, the rejection probability of the unknown category is calculated by the inverse Weibull distribution 1-W _i , that is, the probability score of the sample to be tested x belonging to the unknown category is:

Among them, N+1 represents the unknown category.

Finally, based on the obtained N+1 probability values, the sample to be tested is identified as the category where the maximum probability value is located. The open space risk is further limited by setting a threshold ε: if the maximum probability value R _max <ε is calculated, the sample is rejected as an unknown class.

2. Application Examples. In order to prove the creativity and technical value of the technical solution of the present invention, this part is an application example of the technical solution in the claims on specific products or related technologies.

The DNS tunnel detection method based on open set identification provided by the example of the present invention includes the whole process is mainly divided into four parts, namely data preprocessing, deep feature extraction, open set identification model construction and probability evaluation. First, after preprocessing the collected DNS data, it is input into the neural network for deep feature extraction. Since the original untrained network weights are only initialized, the domain name data cannot be represented by an effective feature vector. First, the method of closed set recognition is adopted, and the feature extraction network is added to the SoftMax layer to perform multi-classification task training of known categories, and the training of the weight of the feature extraction backbone network is completed.

After the training of the feature extraction network is completed, the output of the penultimate fully connected layer is extracted as the feature vector representation of the DNS query domain name and input to the open set recognition algorithm. After the extracted feature vector is obtained, the open set recognition model is trained to complete the boundary division between the open space and the unknown space. The partition forest is constructed for the input DNS query domain name feature vector, and the average path length of each category is calculated as the category center.

Finally, it is judged by the probability output by the identification algorithm that the sample is a normal request or an attack category and an unknown category in the known category.

It should be noted that the embodiments of the present invention may be implemented by hardware, software, or a combination of software and hardware. The hardware portion may be implemented using special purpose logic; the software portion may be stored in memory and executed by a suitable instruction execution system, such as a microprocessor or specially designed hardware. Those of ordinary skill in the art will appreciate that the apparatus and methods described above may be implemented using computer-executable instructions and/or embodied in processor control code, for example on a carrier medium such as a disk, CD or DVD-ROM, such as a read-only memory Such code is provided on a programmable memory (firmware) or a data carrier such as an optical or electronic signal carrier. The device and its modules of the present invention can be implemented by hardware circuits such as very large scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, etc., or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., It can also be implemented by software executed by various types of processors, or by a combination of the above-mentioned hardware circuits and software, such as firmware.

3. Evidence of the relevant effects of the embodiment. The embodiments of the present invention have achieved some positive effects in the process of research and development or use, and indeed have great advantages compared with the prior art.

None of the existing deep learning-based DNS tunnel detection schemes have realized the judgment of unknown categories, and cannot be directly used as a benchmark model for experimental comparison. To train the LSTM-CNN neural network structure for feature extraction, the hyperparameter settings are: the output vector dimension of the Embedding embedding layer is 128 dimensions, the LSTM layer in the structure selects 128 units, and the convolution layer window size is set to 3. At the end of the four network structures, the SoftMax layer is added to complete the learning of network weights. The learning rate is set to 0.001, the optimization strategy AdamOptimizer is selected, and the batch_size is selected as 100, and a total of 20 epochs are trained. The output of the penultimate fully connected layer is extracted as the feature vector representation of the DNS query domain name, and input to the set identification algorithm for DNS tunnel identification. Data sets with different openness are set, and the overall recognition accuracy is compared with the method in the present invention by using the existing open set recognition algorithm OpenMax and W-SVM algorithm.

Experiments show that the method of the present invention shows significant advantages over the other two methods even when the data set is more open.

The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited to this. Any person skilled in the art is within the technical scope disclosed by the present invention, and all within the spirit and principle of the present invention Any modifications, equivalent replacements and improvements made within the scope of the present invention should be included within the protection scope of the present invention.

Claims (10)

1. a DNS tunnel detection method based on open set identification, is characterized in that, after DNS data preprocessing, use deep learning network to carry out feature vector representation to data, use open set identification algorithm to carry out segmentation transformation to the feature vector space that obtains In order to clarify the boundary between the known space and the unknown space, and finally output the recognition result through probability evaluation. 2. the detection method based on open set identification DNS tunnel as claimed in claim 1, is characterized in that, described method further comprises: the DNS data packet that captures is analyzed; Use neural network to carry out feature extraction to DNS query subdomain name; The boundary of the data space is divided, and the input DNS query domain name feature vector is divided into a partition forest, and the classification boundary is calibrated using the extreme value theory; the probability estimation method is used to calculate the probability that the test sample belongs to all categories including unknown categories; according to the maximum The probability of identifying the test sample as a classification label, and when the probability of the test sample belonging to a known category is less than the threshold ε, the sample is identified as an unknown category. 3. the method for detecting DNS tunnel based on open set identification as claimed in claim 2, is characterized in that, the described method for detecting DNS tunnel based on open set identification comprises the following steps: The first step is to parse the captured DNS packets and convert the characters to integer values; The second step is to use neural network to perform feature extraction on DNS query sub-domain names, use CNN, LSTM and different combinations to represent DNS query domain names as feature vectors, and perform network training. The space where the penultimate layer of the trained network is located is feature space; The third step is to complete the boundary division of the data space, construct a partition forest for the input DNS query domain name feature vector, calculate the average path length of each category as the category center, and use the extreme value theory to calibrate the classification boundary; The fourth step, based on the similarity between the test sample and each known category, use the probability estimation method to calculate the probability that the test sample belongs to all categories including the unknown category; In the fifth step, the test sample is identified with a classification label according to the maximum probability. When the probability of the test sample belonging to a known category is less than the threshold ε, the sample is identified as an unknown category. 4. the method for detecting a DNS tunnel based on open set identification as claimed in claim 3, wherein the first step comprises: extracting the DNS query domain name field to retain, and by analyzing the DNS query domain name coding specification, create two Comparison table: one is used to map characters to numbers, and the other is used to map numbers to characters. After processing, each character has a corresponding integer value; after numerical encoding, padding is performed, and the end is filled with "0" , if the data exceeds the input length, it will be truncated; After the second step of network training is completed, the activation vector of the previous layer of the classification layer is extracted as the feature vector representation of the current sample, that is, the input of the SoftMax classification layer in the network is selected as the feature vector. 5. the DNS tunnel detection method based on open set identification as claimed in claim 3, is characterized in that, described 3rd step comprises: use the limit forest that is applied to open set identification to carry out segmentation transformation to the eigenvector space that obtains, make division. Each class bound out contains the minimum distance bound. 6. based on the open set identification DNS tunnel detection method as claimed in claim 4, it is characterized in that, the training classifier of the 3rd step: (1) According to all known category data, perform sub-sampling for each category, randomly select a feature as the starting node, randomly select a value within the value range of the feature, and divide the ψ samples into two parts, less than The samples of the value are divided into the left branch, and the samples larger than the value are divided into the right branch; this binary division is repeated in the left and right branches until the following conditions are met: the tree reaches the limit height; there is only one sample on the node; all samples on the node are The characteristics are the same; the division process is iteratively repeated according to the sample data capacity, and the generated division tree is formed into a binary tree forest; (2) Calculate the average path length of each category, the number of samples ψ, and the average path length is equivalent to the average search length of the unsuccessful binary sorting tree search:

(3) Calculate the path length vector l(x) of the training samples in each category, and calculate the distance d _i (x)=l _i (x)-C _i (ψ) from the average path length to obtain the distance feature set L (x); (4) Use extreme value theory to determine the classification boundary of each category. The extreme value model describes the distribution of abnormally high or abnormally low data, and models right-skewed data, left-skewed data, or symmetric data; D(x) is fitted to divide the known class boundaries:

in

β, λ and k are the position, scale and shape parameters, respectively. 7. based on the open set identification DNS tunnel detection method as claimed in claim 3, it is characterized in that, probability prediction specifically comprises: calculate respectively the probability that sample to be tested belongs to each category, indirectly calculate rejection probability by probability; x, through Weibull distribution to calculate the probability score calculation method that belongs to a known class i distribution formula:

The path vector L(x) is the difference between the sample x to be tested and the average distance length of each known category. The path vector is converted with the formula to apply to the category division after calibration by the extreme value model, and the probability score of each category is calculated. Method formula:

After obtaining the probability that the test sample belongs to the known category, the rejection probability of the unknown category is calculated through the inverse Weibull distribution 1-W _i , and the probability score of the sample to be tested x belonging to the unknown category is:

Among them, N+1 represents the unknown category; Based on the obtained N+1 probability values, the sample to be tested is identified as the category with the maximum probability value; the open space risk is further limited by setting the threshold ε: if the maximum probability value P _max <ε is calculated, the sample is regarded as unknown Class rejected. 8. A computer device, characterized in that the computer device comprises a memory and a processor, the memory stores a computer program, and when the computer program is executed by the processor, the processor is made to execute claim 1 Step 7 of any one of the steps of the method for detecting DNS tunnels based on open set identification. 9 . An information data processing terminal, wherein the information data processing terminal is configured to implement the method for detecting a DNS tunnel based on open set identification according to any one of claims 1 to 7 . 10. A system for detecting open-set-based DNS tunnels according to any one of claims 1 to 7, wherein the open-set-based DNS tunnel detection system comprises: The data preprocessing module is used to parse the captured DNS packets and convert characters into integer values; The feature extraction module is used to extract the features of DNS query sub-domain names by using neural network, and use CNN and LSTM and different combinations to represent DNS query domain names as feature vectors, and perform network training. After training, the penultimate layer of the network is located The space is the feature space; Train the classifier module to complete the boundary division of the data space, construct a partition forest for the input DNS query domain name feature vector, calculate the average path length of each category as the category center, and use the extreme value theory to calibrate the classification boundary; The output prediction probability module is used to calculate the probability that the test sample belongs to all categories including the unknown category based on the similarity between the test sample and each known category, using the probability estimation method; classify the test sample identification according to the maximum probability label, when the probability of the test sample belonging to a known class is less than the threshold ε, the sample is identified as an unknown class.

Images