CN115550021A - Method and system for accurately replicating network space in big data environment and storage medium - Google Patents

Abstract

The invention discloses a network space precise countermeasure method, system and storage medium in a big data environment, and relates to the field of network security. The present invention comprises the following steps: receiving the message to be detected and obtaining the communication data in the message to be detected; capturing DNS query according to the communication data in the message to be detected, and extracting the diagnosis target domain name; using the DGA detection process to diagnose the target domain name Diagnosis; if the diagnosis target domain name is determined to be a malicious domain name, start a countermeasure mechanism; interrupt the communication node of the malicious domain name through the countermeasure mechanism. The present invention better improves the countermeasure ability of network security attacks and guarantees the security of network space.

Description

Method, system and storage medium for precise cyberspace countermeasures in big data environment

technical field

The present invention relates to the field of network security, and more specifically relates to a method, system and storage medium for precise countermeasures in network space in a big data environment.

Background technique

The rapid development of network information technology has brought great convenience to people's life and work, but at the same time there are many security problems in the network. The network world belongs to the virtual space, criminals use the virtuality of the network to carry out illegal intrusion, thereby stealing other people's private information, resulting in serious security problems.

And with the use of attack platforms, commercial Trojan horses and open source malicious tools, the network offensive and defensive warfare is becoming more and more in-depth and sophisticated. It is urgent to introduce artificial intelligence, big data and other analysis technologies to improve the ability to counter network attacks and form a deterrent to attackers. and counter.

Contents of the invention

In view of this, the present invention provides a method, system, and storage medium for precise countermeasures in cyberspace in a big data environment, using the DGA algorithm to identify malicious domain names, locate the compromised host in time, and complete precise counterattacks.

In order to achieve the above object, the present invention adopts the following technical solutions:

On the one hand, a precise cyberspace countermeasure method in a big data environment is disclosed, including the following steps:

Receive the message to be detected and obtain the communication data in the message to be detected;

Capture the DNS query according to the communication data in the message to be detected, and extract the diagnostic target domain name;

Use the DGA detection process to diagnose the diagnosis target domain name;

If the diagnosis target domain name is determined to be a malicious domain name, start a countermeasure mechanism;

Interrupt the communication nodes of malicious domain names through the counter mechanism.

Optionally, the algorithm of the countermeasure mechanism is specifically as follows:

Establish a network connection diagram based on the average total communication traffic size, average communication data packets, and average communication connection times;

Delete the nodes that have not communicated with the abnormal domain name node in the network graph, and select any abnormal domain name node as the starting node;

Traversing the adjacent nodes from the starting node, using the ant colony algorithm to traverse the shortest path between the two abnormal domain name nodes;

Retrieve according to the shortest path, interrupt the nodes with the most occurrences and abnormal domain name nodes, and complete the countermeasure mechanism.

Optionally, the DGA detection process includes static feature detection and dynamic feature detection.

Optionally, the static feature detection specifically includes: extracting static features of the diagnosis target domain name, using a static feature classifier to make a judgment, and directly giving a conclusion for a judgment result whose reliability is higher than a preset threshold, and ending the process. And add the diagnosis target domain name to the white list; for other judgment results, it is judged as "suspicious domain name" and enters the dynamic feature detection process.

Optionally, the dynamic feature detection specifically includes: extracting the dynamic features of the diagnostic target, using a dynamic feature classifier to make a judgment, and for a judgment result with a reliability higher than a preset threshold, giving a conclusion and placing the diagnostic target For other judgment results, only conclusions are given, and the black and white lists are not modified.

Optionally, a database is also included to store the detection results of the DGA detection process, the database includes a whitelist database and a blacklist database; the whitelist database stores safe destination hosts and destination server domain names; the blacklist database stores For known malicious features, the malicious feature detection engine uses the contents of the blacklist database for matching, and the temporary computing database stores temporary data storage addresses and calculation results of each module.

On the other hand, it also discloses a precise countermeasure system in cyberspace under the big data environment, including:

Data to be detected receiving and obtaining module: used to receive the message to be detected and obtain the communication data in the message to be detected;

Diagnostic target domain name extraction module: used to capture DNS queries according to the communication data in the message to be detected, and extract the diagnostic target domain name;

DGA diagnosis module: used for diagnosing the diagnosis target domain name by using the DGA detection process;

Malicious domain name interruption module: used to start a countermeasure mechanism if the diagnosis target domain name is determined to be a malicious domain name, and interrupt the communication node of the malicious domain name through the countermeasure mechanism.

Finally, a computer storage medium is disclosed, which is characterized in that a computer program is stored on the computer storage medium, and when the computer program is executed by a processor, the network space under any one of the big data environments can be realized. The steps of the precision counter method.

It can be seen from the above-mentioned technical solutions that, compared with the prior art, the present invention discloses a method, system and storage medium for accurate cyberspace countermeasures in a big data environment, which have the following beneficial effects:

1. Capable of capturing traffic for subsequent process analysis without interfering with normal communication traffic;

2. It can better improve the ability to counter cyber security attacks and ensure cyberspace security.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can also obtain other drawings according to the provided drawings without creative work.

Fig. 1 is a schematic flow sheet of the present invention;

Fig. 2 is a structural schematic diagram of the present invention.

detailed description

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The embodiment of the present invention discloses a network space precise countermeasure method in a big data environment, as shown in Figure 1, including the following steps:

Receive the message to be detected and obtain the communication data in the message to be detected;

Capture the DNS query according to the communication data in the message to be detected, and extract the diagnostic target domain name;

Use the DGA detection process to diagnose the diagnosis target domain name;

If the diagnosis target domain name is determined to be a malicious domain name, a countermeasure mechanism will be activated;

Interrupt the communication nodes of malicious domain names through the counter mechanism.

In this embodiment, the algorithm of the countermeasure mechanism is as follows:

Establish a network connection diagram based on the average total communication traffic size, average communication data packets, and average communication connection times;

Delete the nodes that have not communicated with the abnormal domain name node in the network graph, and select any abnormal domain name node as the starting node;

Traverse the adjacent nodes from the starting node, and use the ant colony algorithm to traverse the shortest path between two abnormal domain name nodes;

Retrieve according to the shortest path, interrupt the nodes with the most occurrences and abnormal domain name nodes, and complete the countermeasure mechanism.

The DGA detection process includes static feature detection and dynamic feature detection.

Static feature detection is specifically: extracting the static features of the diagnosis target domain name, using the static feature classifier to make a judgment, and directly giving a conclusion for the judgment result whose reliability is higher than the preset threshold, ending the process, and adding the diagnosis target domain name to the white list; for other judgment results, it is judged as a "suspicious domain name" and enters the dynamic feature detection process.

The dynamic feature detection is specifically: extracting the dynamic features of the diagnostic target, using a dynamic feature classifier to make a judgment, and for the judgment result with a reliability higher than the preset threshold, giving a conclusion and putting the diagnostic target into the corresponding blacklist or In the white list, for other judgment results, only conclusions are given, and the black and white lists are not modified.

Specifically, the detection process is triggered by the DNS query capture event in the protection target network. A diagnostic target first passes through the whitelist filter and blacklist filter. If it is hit, it will immediately give a conclusion and end the process, otherwise it will go backward; the diagnostic target The static features will be extracted, and then the static feature classifier will be used to make a judgment. For the judgment results with high reliability, a conclusion will be given directly, and the process will end. For other judgment results, it will be judged as a 'suspicious domain name' and enter the subsequent process; The dynamic features of the diagnostic target will be extracted, and then the dynamic feature classifier will be used to make a judgment. For high-confidence judgment results, a conclusion will be given and the diagnostic target will be put into the corresponding black or white list. For other judgment results , only the conclusion is given, and the black and white lists are not modified.

In the entire detection process, up to four judgments are made, namely whitelist filter, blacklist filter, static feature classifier and dynamic feature classifier.

The black-and-white list database is self-maintaining. During the research process, the high-confidence results diagnosed by the dynamic feature classifier will be imported into the black-and-white list database to improve detection efficiency.

Whitelist initialization method—take the top-ranked domain names of Alexa, and the list can be obtained through crawlers from top.chinaz.com, www.alexa.cn and other websites. How to initialize the blacklist - there are two ways: First, obtain the domain name of the Trojan horse from the trojan report platform through crawlers, such as www.anva.org.cn/virusAddress/listBlack, untroubled.org/spam/, etc. ; Second, using the public spam database to extract the domain names in it, hanging horses and spam are the main purposes of botnets, so it covers a large number of malicious domain names.

The static feature classifier is mainly aimed at real-time detection of malicious domain names related to Domain Flux technology. Its detection principle is based on the assumption that a good (or normal) domain name construction method has certain statistical rules, such as the length should not be too long , even if there are numbers, there are not too many, and the number and letters alternate generally do not exceed twice. These structural rules essentially ensure that the domain name can be easily remembered by people, impressive, and beneficial to the promotion of the website. It is worth noting Yes, this kind of domain name is often squatted or even hyped very early, so the registration cost is very high; on the contrary, the purpose of using domain names by botnets is not for people to remember, but for the connection between computers, combined with the consideration of registration costs , will not consider the above structure rules at all, so starting from these rules, the statistical features for distinguishing malicious/normal domain names can be effectively established.

This embodiment mainly carries out research from the following static features:

Domain name length: For example, the length of www.163.com is 11.

Digit ratio: DigitRatio=DigitNum/length, where DigitNum is the number of digits in the FQDN.

Number and letter switching ratio: two adjacent characters are called an "adjacent character pair", if there is only one number in an adjacent character pair, it is a "number and letter switching", this feature is a number and letter switching The ratio of the total to the total number of pairs of adjacent characters.

The ratio of the length of the site name to the main domain name: SiteRatio=SiteLength/MainDomainLength. Among them, SiteLength is the length of the site name in the FQDN, and MainDomainLength is the length of the main domain name. For example: the site name of www.163.com is www, SiteLength=3, the main domain name is 163, MainDomainLength=3.

Number of connectors: the number of connectors "-" in the FQDN.

Maximum word length: Use the decimal point "." as the separator to divide the FQDN into multiple strings, and the length of the longest string among them.

The type of country top-level domain name: such as "cn", "jp", etc.

The type of international top-level domain name: such as "com", "net" and so on.

The type of the second-level international top-level domain name: such as "edu", "gov", etc.

The training samples of the static feature classifier come from the existing black and white lists. For each FQDN, the above static features can be directly calculated to form training samples. The samples are marked into two categories according to the black and white lists—normal domain names and malicious domain names. Aiming at these samples, a classifier model is established by using the SVM algorithm, and the classifier model supports output probability in addition to distinguishing categories.

The dynamic feature classifier is mainly aimed at real-time detection of malicious domain names related to FFSN technology. Its detection principle is based on the assumption that normal domain names are generally divided into two categories, one domain name corresponds to one ip, TTL (domain name cache time) Generally larger, this is the most common situation; a domain name corresponds to a set of fixed IPs, these IPs are basically fixed, and the physical location is basically fixed, this situation generally occurs in sites with a lot of visits, these sites use CDN technology to achieve load balancing.

For other cases, it is likely that the botnet is using malicious domain names to maintain the communication of the entire network. For example, due to the vulnerability of botnets, the C&C proxy host often fails. At this time, the IP corresponding to a malicious domain name needs to be replaced with a new C&C proxy host. Therefore, frequent changes in IP and changes in geographical location distribution are some obvious problems. Phenomenon. Based on these phenomena, statistical characteristics can be established. For the same diagnostic target (domain name), the results returned by DNS requests are collected N times (experience value 20 times, with an interval of 3 hours).

In this embodiment, a database is also included to store the detection results of the DGA detection process, and the database includes a whitelist database and a blacklist database; the whitelist database stores safe destination hosts and destination server domain names; the blacklist database stores known malicious Features, the malicious feature detection engine uses the contents of the blacklist database for matching, and the temporary calculation database stores the temporary data storage address and the calculation results of each module.

On the other hand, a precise cyberspace countermeasure system in a big data environment is also disclosed, as shown in Figure 2, including:

Data to be detected receiving and obtaining module: used to receive the message to be detected and obtain the communication data in the message to be detected;

Diagnostic target domain name extraction module: used to capture DNS queries according to the communication data in the message to be detected, and extract the diagnostic target domain name;

DGA diagnosis module: used for diagnosing the diagnosis target domain name by using the DGA detection process;

Malicious domain name interruption module: used to start the countermeasure mechanism if the diagnosis target domain name is determined to be a malicious domain name, and interrupt the communication node of the malicious domain name through the countermeasure mechanism.

Finally, a computer storage medium is disclosed, which is characterized in that a computer program is stored on the computer storage medium, and when the computer program is executed by a processor, any one of the steps of a method for accurately countering cyberspace in a big data environment is realized .

Each embodiment in this specification is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and for the related information, please refer to the description of the method part.

The above description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the present invention will not be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (8)

1. A method for precise countermeasures in cyberspace under a big data environment, characterized in that it comprises the following steps: Receive the message to be detected and obtain the communication data in the message to be detected; Capture the DNS query according to the communication data in the message to be detected, and extract the diagnostic target domain name; Use the DGA detection process to diagnose the diagnosis target domain name; If the diagnosis target domain name is determined to be a malicious domain name, start a countermeasure mechanism; Interrupt the communication nodes of malicious domain names through the counter mechanism. 2. The method for precise countermeasures in cyberspace under a big data environment according to claim 1, wherein the algorithm of the countermeasure mechanism is specifically as follows: Establish a network connection diagram based on the average total communication traffic size, average communication data packets, and average communication connection times; Delete the nodes that have not communicated with the abnormal domain name node in the network graph, and select any abnormal domain name node as the starting node; Traversing the adjacent nodes from the starting node, using the ant colony algorithm to traverse the shortest path between the two abnormal domain name nodes; Retrieve according to the shortest path, interrupt the nodes with the most occurrences and abnormal domain name nodes, and complete the countermeasure mechanism. 3. A method for precise cyberspace countermeasures in a big data environment according to claim 1, wherein the DGA detection process includes static feature detection and dynamic feature detection. 4. The method for precise cyberspace countermeasures in a big data environment according to claim 3, wherein the static feature detection is specifically: extracting the static features of the diagnostic target domain name, and using a static feature classifier to make a judgment , for the judgment results whose credibility is higher than the preset threshold, a conclusion is given directly, the process ends, and the diagnosis target domain name is added to the white list; for other judgment results, it is judged as "suspicious domain name" and enters the dynamic feature detection process. 5. A method for precise cyberspace countermeasures in a big data environment according to claim 4, wherein the dynamic feature detection is specifically: extracting the dynamic features of the diagnostic target, and using a dynamic feature classifier to make a judgment , for the judgment result whose reliability is higher than the preset threshold, a conclusion is given and the diagnostic target is put into the corresponding blacklist or whitelist; for other judgment results, only the conclusion is given without modifying the blacklist or whitelist. 6. The method for accurately countering cyberspace in a big data environment according to claim 1, further comprising a database storing the detection results of the DGA detection process, the database comprising a whitelist database and a blacklist database The whitelist database stores safe destination hosts and destination server domain names; the blacklist database stores known malicious features, and the malicious feature detection engine uses the blacklist database content to match, and the temporary computing database stores temporary data storage addresses Computational results with each module. 7. A precise cyberspace countermeasure system in a big data environment, characterized in that it includes: Data to be detected receiving and obtaining module: used to receive the message to be detected and obtain the communication data in the message to be detected; Diagnostic target domain name extraction module: used to capture DNS queries according to the communication data in the message to be detected, and extract the diagnostic target domain name; DGA diagnosis module: used for diagnosing the diagnosis target domain name by using the DGA detection process; Malicious domain name interruption module: used to start a countermeasure mechanism if the diagnosis target domain name is determined to be a malicious domain name, and interrupt the communication node of the malicious domain name through the countermeasure mechanism. 8. A computer storage medium, characterized in that a computer program is stored on the computer storage medium, and when the computer program is executed by a processor, a kind of big data as described in any one of claims 1-6 is realized The steps of precise countermeasures in cyberspace under the environment.

Images