TWI656778B - Malicious domain detection method combining network information and network traffic - Google Patents

Abstract

A malicious domain detection method combining network domain information and network traffic, which mainly uses network domain information stored in a network threat sharing system (CTISP, Cyber Threat Intelligence Sharing Platform) to match network traffic. Through the Process-Domain Behavior Graph proposed by the present invention, the Process Behavior feature of the malicious domain and the normal domain can be obtained, and the malicious degree model of the domain can be further trained by using machine learning, and the unknown degree network can be measured by using the malicious degree model of the domain. The degree of maliciousness of the domain, and finally the newly detected malicious domain and its malicious degree will be fed back to the CTISP. Because the CTISP deploys different regions (enterprises), it can collect the localized sentiment of different regions, and through the situation The exchange can continuously improve the accuracy, and at the same time, when the same malicious domain or feature appears in different regions, it can be detected to achieve the effect of regional joint defense.

Description

Malicious domain detection method combining network information and network traffic

The invention relates to a method for detecting malicious domain, in particular to using a corporate internal proxy server log with a network threat sharing platform (CTISP) to train a malicious domain behavior model, which is mainly based on a hacker. The characteristics of the network connection behavior generated by the malware are obtained through a large amount of traffic data, so no matter how the website changes, the malicious degree can be detected and detected by the network threat sharing platform (CTISP) storage. The cyber threat situation, through the mechanism of sharing and feedback, continuously improves the accuracy of the intelligence and the malicious domain detection method combining the network situation and network traffic.

When an attacker constructs a relay station, it attempts to embed the malicious program into the victim host by spam, phishing websites or other means, and then becomes a zombie computer (Bots), and the malicious program of the host computer is connected by a specific connection. Behave in communication with the relay station.

In order to avoid this, the Republic of China No. I455546 "Detection Method and Detection System for Malicious Domains Using Fast-Change Domain Technology" provides a use of router information, including router host name and network address autonomous system number. Etc., the specific part of the router host name is the same or the network packet transmission time is greater than the preset check value, and it is judged as a malicious domain. However, the patent uses the network packet transmission time as the basis for the malicious degree evaluation, which is only applicable to the popular domain. The comparison between name and malicious domain name is prone to misjudgment for the less famous benign domain name.

In addition, US Patent No. 20120198549 A1 "Method and system for detecting malicious domain names at an upper DNS hierarchy" provides a method for detecting a malicious domain name through a passive DNS log, the method steps being through an ISP and a special unit. Cooperation, for example, some units with an Authority Domain Name Server (hereinafter referred to as ADNS), in order to obtain a more abundant passive DNS log, and then parse the benign domain name and the Malicious domain name according to the RR in the passive DNS log. The difference, however, although the patent uses a lot of features (about 41), it actually extends only from the four fields of time stamp, domain name, resource recode type and return IP (excluding Time To Live). Therefore, there is still a lot of misjudgment for CDN domain name and fast flux domain name.

It can be seen that the prior art techniques and methods have their own problems, and need to be improved. In view of this, the present invention is aimed at the above needs, actively researching and improving, and researching and developing this piece to combine network domain information and network traffic. Malicious domain detection method.

In order to solve the above problems in the prior art, an object of the present invention is to provide a malicious domain detection that combines network domain intelligence and network traffic by detecting network traffic and network domain intelligence to detect the malicious degree of an unknown domain. method.

In order to solve the above problems of the prior art, another object of the present invention is to provide a Process-Domain Behavior Graph generated by the behavior of a wired domain in a network traffic, which has effectively captured the characteristics of a malicious domain connection.

Referring to FIG. 1 , in order to achieve the above object, the malicious domain detection method combining the network context and network traffic of the present invention utilizes CTISP deployed in different regions (enterprise) to help the enterprise to measure the domain. The degree of malpractice, CTISP deployment in different regions (enterprise), CTISP will share the information of the domain to achieve the effect of regional joint defense, which CTIS mainly includes a situation sharing module 101, a threat information database 102, An intelligence collection module 103, a network traffic side recording module 104, and a malicious domain detection (MD-Miner) module 105.

The emotional sharing module 101 is used to share the local domain information to other CTISPs, and the threat information database 102 is used to store the FQDN (fully qualified domain name), IP address (IP). Domain address, URL (Uniform Resource Locator, URL), file (file) and intelligence source and other network domain information, the emotional collection module 103 is used to receive different sources, such as malicious domain detection (MD-Miner, Malicious -Domain Miner) Network 105, VirusTotal, etc. Antivirus software or Bluecoat... Network access information provided by sources such as the security gateway system, network traffic side record (log) module 104 It is used to receive data generated by network traffic, such as network traffic data such as PCAP files generated by side-recorded traffic and proxy server logs. The malicious domain detection module 105 is used to generate network behavior characteristics of unknown domains. Calculate the degree of malice to measure the threat level of the unknown domain.

Referring to FIG. 2~5, the malicious domain detection module 105 generates the itinerary-domain behavior map by using Domain (Domain), Client-IP (Client IP), and UserAgent (User Agent) information in the network traffic. (Process-Domain Behavior Graph) is a step 201, a specific individual Client-IP, UserAgent as a Process, assuming that the list of Process is combined into P , relatively, a list of a specific individual Domain combination is assumed to be D , a Process p _i P node (node) connected to a domain d _j The D node (node) will generate a connection, so it can form a bipartite graph of Process and Domain, called Process-Domain Behavior Graph; mark all the Domain and Process in the Process-Domain Behavior Graph as step 202. Use the black and white list in the Threat Intelligence Database of the Network Threat Sharing Platform (CTISP) to mark all Domains appearing in the Process-Domain Behavior Graph as malicious\benign or unknown; when a Process node has a query tag For a malicious Domain, the Process will also be marked as malicious, as shown in Process1 and Process2 in Figure 4; the feature of the Domain is taken as Step 203, and the Feature value of the Domain is retrieved through the Process-Domain Behavior Graph. The characteristics are: the collection of Process, the percentage of the process being processed, the percentage of the unknown process, etc. are all obtained from the Process-Domain Behavior Graph; the machine learning algorithm is step 204, the malicious and benign domain that has been marked By inputting the machine learning algorithm with its individual feature values for training, the process shown in step 205 can be generated. The domain malware degree model is calculated. In step 206, the network domain marked as unknown in the threat information database of the CTISP and the feature value calculated in step 203 are input into the network generated in step 205. The domain malicious degree model can get the degree of maliciousness of the domain.

Finally, CTISP will normalize the newly detected malicious domain information including malicious level information through the emotional sharing module for all CTISP clusters. Through the exchange of network domain information between CTISP clusters, a positive feedback of joint prevention of the shared area of interest can be formed. When the scope of deployment is larger, the easier it is to achieve the defense effect, it can effectively resist the attacker's cross-regional attack on the enterprise.

101‧‧‧Emotion sharing module

102‧‧‧ Threat Intelligence Database

103‧‧‧Emotional collection module

104‧‧‧Network Traffic Recording (Log) Module

105‧‧‧Malicious Domain Detection (MD-Miner) Module

201~206‧‧‧ Process steps

S601~S610‧‧‧ Process steps

FIG. 1 is a usage scenario diagram of a malicious domain detection method combining network domain intelligence and network traffic according to the present invention; FIG. 2 is a flowchart of operation of a malicious detection module; FIG. 3 is a Process-Domain Behavior Graph Schematic; Figure 4 is a schematic diagram of the malicious/benign or unknown Domain label in the Process-Domain Behavior Graph; FIG. 5 is a schematic diagram of a Process-Domain Behavior Graph capture feature; FIG. 6 is a flowchart of a malicious domain detection method combining network domain intelligence and network traffic according to the present invention.

The specific embodiments are described below to illustrate the embodiments of the present invention, but are not intended to limit the scope of the invention to be protected: when the enterprise wants to identify the malicious degree of the internal connection domain of the enterprise by using CTISP with internal network traffic. When the CTISP is set up in the enterprise's internal network gateway, the network traffic side-recording (log) module receives the network data generated by the traffic or the log data generated by the proxy server, and imports the data into MD-Miner. The analysis of the degree of maliciousness of the domain will begin.

The process of the malicious domain detection method combining the network context and network traffic of the present invention is shown in FIG. 6. S601 represents the long-term network traffic data of an enterprise, and the content of the network traffic is shown in Table 1. After inputting MD-Miner, a Process-Domain Behavior Graph is formed via S602, and Client-IP and User Agent are treated as a Process when the Process-Domain Behavior Graph is formed. The concept is extended from the digital forensic experience, which identifies C&C relay stations to further discover other infected machines that are also connected to the C & C relay. As shown in Table 2, the User Agent string is stored in a malware in a hard-code manner in a malicious binary. Each C & C http connection record contains the User Agent string. Based on the above actual phenomenon, we will regard Client-IP and User Agent in the network traffic as a Process. For example, Item1, 2, and 3 in Table 1 are connected to UA1 using 10.10.10.1, so Domain1, 2, and 3 are all connected by the same Process, so the network traffic example in Table 1 will form the Process-Domain Behavior Graph as shown in Figure 3.

Then, in S603, all the Domains in the Process-Domain Behavior Graph are marked as malicious\benign\unknown by the CTISP, and the marked output is S604. The three characteristic values of the Process Behavior can be calculated by the result of the marking, and the feature values are The calculation is as follows: If S is a collection of all Processes, I means to connect to the Process collection marked as a malicious domain, and U means to connect to the Process collection marked as an unknown domain, then the three eigenvalue formulas are: The known process score, m =| I |/| S ; the unknown process score u =| U |/| S |; and the total number of processes t =| S |. S605 will use the above three mathematical formulas to perform eigenvalue operations on all domains. The malicious\benign domain and its characteristics are shown in Table 3. The unknown domain and its characteristics are shown in Table 4. Finally, In S606, the known malicious \ benign domain can be machine learning with its three unique feature values, and the domain malicious degree model of S607 can be modeled.

S608 is to match the unknown domain with its three individual feature values (obtained at S605). As shown in Table 5, enter the domain malicious degree model of S609 (obtained in S607), and the domain malicious model will evaluate the input. The domain is also obtained to the extent that the unknown domain is similar to the malicious/benign domain. As shown in Table 5, in Table 5, the domain originally marked as unknown can be seen. After S609, it will follow the "probability". Classified into Malicious, the information of the record probability can make MD-Miner more flexible when using the domain information. MD-Miner deployed in different enterprises can choose whether to use the qualification of a certain domain by probability. The S610 stores the probability together with other information through the emotional collection module S103 shown in Figure 1 and integrates the information from other sources into the threat information database shown in Figure 1, when the number of marked domains is increased. It means that the more the domain information that MD-Miner can obtain when modeling the malicious degree model of the domain, the more accurate the model will be when training. Table 6 shows that we have verified the availability of the MD-Miner output on the S710 in VirusTotal. The availability of the invention has been confirmed. It can be found that the MD-Miner is maliciously marked from unknown to malicious, and the real name can be provided on behalf of the real name. Malicious domain.

The detailed description of the preferred embodiments of the present invention is intended to be limited to the scope of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

Claims (2)

A malicious domain detection method combining network domain intelligence and network traffic, the steps comprising: a. inputting network traffic data into a malicious domain detection module to generate a process-Domain Behavior Graph The travel-domain behavior map is a malicious domain detection module that uses Client-IP (client IP) and UserAgent (user agent) information in the network traffic data as a process, and assumes the itinerary. The list is combined into P , and the list of other domain combinations is assumed to be D , one trip p _i P node (node) connected to a domain d _j The D node (node) will generate a connection, so it can form a bipartite graph of the itinerary and the domain; b. use the threat information of the Cyber Threat Intelligence Sharing Platform (CTISP). The black and white list in the library marks all the domains (Domains) appearing in the itinerary-domain behavior map as malicious domains, benign domains or unknown domains; c. The malicious domain detection module uses the labeled results to calculate malicious The eigenvalues of the domain, the benign domain, and the unknown domain; d. The malicious domain and the benign domain are matched with the eigenvalues of the malicious domain and the benign domain, and the machine learning algorithm is trained to generate the domain. Maliciousness model; e. Enter the unknown domain and the unknown domain into the domain malicious degree model to obtain the malicious degree of the unknown domain; f. Add the malicious degree of the unknown domain to the network threat sharing system The Emotional Collection Module is integrated for the Emotional Collection Module and added to the black and white list of the Threat Intelligence Database. A malicious domain detection method combining network domain intelligence and network traffic, the steps thereof include: a. inputting network traffic data into a malicious domain detection module to generate a process-Domain Behavior Graph b) Use the black and white list in the Threat Intelligence Database of the Cyber Threat Intelligence Sharing Platform (CTISP) to mark all domains that appear in the itinerary-domain behavior map The malicious domain, the benign domain or the unknown domain; c. The malicious domain detection module uses the marking result to calculate the eigenvalues of the malicious domain, the benign domain and the unknown domain, wherein the malicious domain, the benign domain and the unknown The eigenvalues of the domain include the set of all the processes, the percentage of the trips, and the percentage of the unknown trips. The calculation method is that if S is a set of all trips, I means that the trip is set to the set of trips marked as malicious domains. And U means to connect to the set of trips marked as unknown domain, then the three eigenvalue formulas are: the fraction of the known stroke percentage is m =| I |/| S |, the percentage of the unknown trip The score is u =| U |/| S |, the total number of sets of all the itineraries is t =| S |; d. The flagged value of the malicious domain and the benign domain with the malicious domain and the benign domain are entered. The machine learning algorithm is trained to generate a domain malicious degree model; e. input the unknown domain and the unknown domain eigenvalue into the domain malicious degree model to obtain the malicious degree of the unknown domain; f. the unknown domain malicious The level of participation in the network threat sharing system's emotional collection module for the integration of the emotional collection module and added to the black and white list of threat information database.