TWI777766B - System and method of malicious domain query behavior detection - Google Patents

Abstract

A system and a method of malicious domain query behavior detection are provided. The system includes a transceiver, a storage medium, and a processor. The processor is coupled to the transmitter and the storage medium, and is configured to execute a plurality of modules, and the plurality of modules include: a domain name filtering module, filtering domain name service query records in network traffic according to a preset list so as to obtain a non-existent domain (NXDomain) query record; a feature computing module, computing a similarity of an internet protocol (IP) address to be tested based on the NXDomain query record; and a detection module, in response to the similarity is greater than a threshold value, detecting whether the IP address to be tested is a host infected by malicious programs through a machine learning model to generate a detection result, and outputting the detection result through the transceiver.

Description

System and method for detecting malicious domain query behavior

The present invention relates to a network security technology, and in particular, to a system and method for detecting malicious network domain query behavior.

Due to the rise of the Internet, Domain Name Service (DNS) has become an indispensable service for surfing the Internet. However, most units or users do not pay special attention to the traffic and content of DNS queries. In order to maintain a smooth communication channel with the victim host, cybercriminals will use a host as a central control center, which is also called a Command and Control Server (C&C Server), and this host acts as a relay station. Perform command dispatch and contain the stolen private information of the victim host. Because command and control servers play an important role in the entire criminal process, cybercriminals use various methods to prolong their survival and increase their stealth to evade detection.

Domain Generation Algorithm (DGA) technology is still the main method for hackers to plan network attacks. DGA malware is often a tool for advanced persistent penetration attacks. In addition to being difficult to detect, DGA malware can also assign different functions to the domain name generated by DGA to carry out malicious activities.

In view of this, the present invention proposes a system and method for detecting malicious network domain query behavior, which can analyze DNS query to detect malicious network domain generated by DGA.

An embodiment of the present invention provides a system for detecting malicious network domain query behavior, including: a transceiver, which receives network traffic; a storage medium, which stores a plurality of modules; and a processor, which is coupled to the transceiver and the storage A medium configured to execute the plurality of modules, wherein the plurality of modules include: a domain name filtering module obtained by filtering domain name service query records in the network traffic according to a preset list There is no network domain query record; the feature calculation module calculates the similarity of the IP address to be tested according to the non-existent network domain query record; and the detection module, in response to the similarity greater than the threshold value, through the machine The learning model detects whether the IP address to be tested is a host infected with a malicious program to generate a detection result, and outputs the detection result through the transceiver.

An embodiment of the present invention provides a method for detecting malicious network domain query behavior, including: receiving network traffic; filtering domain name service query records in the network traffic according to a preset list to obtain the absence of network domain query record; calculate the similarity of the IP address to be tested according to the non-existent network domain query record; in response to the similarity being greater than the threshold value, detect whether the IP address to be tested is malicious through a machine learning model The program infects the host to generate detection results; and outputs the detection results.

Based on the above, the system and method for detecting malicious network domain query behavior provided by the present invention, combined with the analysis of abnormal behavior and the assistance of artificial intelligence technology, use the abnormal query that does not exist in the DNS query to perform behavior analysis, and Use machine learning models to detect DGA domains in anomalous behavior. In this way, the malicious relay station connected by the DGA malware can be effectively found, the harm of the DGA malware can be reduced, the intrusion of advanced persistent penetration attacks can be prevented, and sensitive data can be prevented from being stolen.

Some embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Element symbols quoted in the following description will be regarded as the same or similar elements when the same element symbols appear in different drawings. These examples are only a part of the invention and do not disclose all possible embodiments of the invention. Rather, these embodiments are merely exemplary of systems and methods within the scope of the present invention.

FIG. 1 is a block diagram of a system for detecting malicious domain query behavior according to an embodiment of the present invention. Referring to FIG. 1 , the system 10 may include a processor 100 , a transceiver 200 and a storage medium 300 . The processor 100 is coupled to the transceiver 200 and the storage medium 300 . The processor 100 may be configured to execute a plurality of modules stored by the storage medium 200 .

The processor 100 is, for example, a central processing unit (CPU), or other programmable general-purpose or special-purpose micro control unit (micro control unit, MCU), microprocessor (microprocessor), digital signal processing digital signal processor (DSP), programmable controller, application specific integrated circuit (ASIC), graphics processor (graphics processing unit, GPU), image signal processor (image signal processor, ISP) ), image processing unit (IPU), arithmetic logic unit (ALU), complex programmable logic device (CPLD), field programmable gate array (field programmable gate array) , FPGA) or other similar elements or a combination of the above. The processor 100 can access and execute various modules and various application programs stored in the storage medium 300 to perform various functions of the system 10 .

The transceiver 200 may receive network traffic. The transceiver 200 transmits and receives signals in a wireless or wired manner. Transceiver 200 may also perform operations such as low noise amplification, impedance matching, frequency mixing, up or down frequency conversion, filtering, amplification, and the like.

The storage medium 300 can store a plurality of modules. The storage medium 300 is, for example, any type of fixed or removable random access memory (random access memory, RAM), read-only memory (ROM), and flash memory (flash memory). , a hard disk drive (HDD), a solid state drive (SSD) or similar components or a combination of the above components for storing a plurality of modules or various application programs executable by the processor 100 . The plurality of modules may include a domain name filtering module 310 , a feature calculation module 320 and a detection module 330 .

The domain name filtering module 310 can filter the domain name service (Domain Name Service, DNS) query records in the network traffic according to the preset list to obtain the non-existent domain (Non-existent Domain, NXDomain) query records.

The feature calculation module 320 can calculate the similarity of the Internet Protocol (IP) address to be tested according to the absence of the network domain query record. There is no domain query record that can contain multiple user IP addresses. The feature calculation module 320 can select the IP address to be tested from a plurality of user IP addresses.

The detection module 330 can detect whether the IP address under test is a host infected by a malicious program through a machine learning model in response to the similarity being greater than a threshold value to generate a detection result, and output the detection result through the transceiver 200 .

FIG. 2 is a flowchart of a method for detecting malicious domain query behavior according to an embodiment of the present invention. Referring to FIG. 2 , the method of this embodiment is applicable to the system 10 shown in FIG. 1 , and the detailed steps of the embodiment of the present invention are described below. In step S210, network traffic is received. In step S220, the query records of the domain name service in the network traffic are filtered according to the preset list to obtain the absence of the domain name query records. In step S230, the similarity of the IP address to be tested is calculated according to the absence of the network domain query record. In step S240, in response to the similarity being greater than the threshold value, the machine learning model is used to detect whether the IP address to be tested is a host infected with a malicious program to generate a detection result. In step S250, the detection result is output.

In an embodiment of the present invention, the preset list includes a white list. The domain name filtering module 310 can reflect that the to-be-confirmed domain query in the domain name service query record is not in the whitelist, and the to-be-confirmed domain query can be included in the non-existing domain query record. In an embodiment of the present invention, the preset list includes a blacklist. The domain name filtering module 310 may include the to-be-confirmed domain query in the non-existing domain query record in response to the fact that the to-be-confirmed domain query in the domain name service query record is not in the blacklist.

For example, a whitelist stores DNS queries generated by many normal activities. The role of the whitelist is to reduce the computational burden of the system and reduce the false positive rate. The domains recorded in the whitelist may also contain NXDomain queries. If this traffic is also calculated, a large number of false positives will be generated. The domain name filtering module 310 filters the collected DNS query records, filters out the DNS queries generated by normal activities recorded in the whitelist, and only leaves the concerned NXDomain query records. Specifically, NXDomain queries in network traffic are usually generated from incorrectly entered query domains and some special-purpose services, so NXDomain traffic only accounts for less than one-tenth of the overall traffic.

In addition, NXDomain's traffic may contain a large number of queries generated by special services. The most common is the blacklist comparison in antivirus software. For example, the blacklist of antivirus software will combine the domain of the antivirus software manufacturer with the domain to be confirmed. Another common service is an email server. If a third-party blacklist provided by the same company is used, domain queries similar to the abnormal queries generated by DGA will be generated in the network traffic, resulting in misjudgment by the system. Therefore, the domain name filtering module 310 can filter out all third-party blacklisted domain queries. In this way, after the network traffic is filtered by the preset list, it only needs to process less than one-twentieth of the original network traffic. In this way, the system 10 does not need to deal with huge network traffic, which can save computing resources, effectively improve operating performance, and at the same time improve the overall detection accuracy.

In an embodiment of the present invention, the domain name service query record may include the user IP address, the query time, the query domain name or the domain resolution result. For example, the user IP address can be an IPv4 address composed of decimal digits, or an IPv6 address composed of hexadecimal digits. The query domain name can be a string composed of multiple parts, which are usually connected together and separated by dots. The English letters of the query domain name are not case-sensitive. The domain resolution result may be the resolution result of the query domain name returned by the DNS server.

In one embodiment of the present invention, the feature calculation module 320 may be configured to execute the following instructions to calculate the similarity. The feature calculation module 320 can obtain the first query domain list corresponding to the IP address to be tested and the second query domain list corresponding to the reference IP address from the domain name service query record. The feature calculation module 320 can obtain the number of intersections between the first query domain list and the second query domain list. The feature calculation module 320 can obtain the union quantity of the first query domain list and the second query domain list. The feature calculation module 320 can obtain the similarity by dividing the number of intersections by the number of unions.

For example, the feature calculation module 320 uses all the query domains collected from the DNS query records as input data, so as to count the domains queried by the first user (ie the IP address to be tested) to generate the first query domain. A domain list is generated, and the second user (that is, the reference IP address) has queried the domains to generate a second queried domain list. Next, the feature calculation module 320 can calculate the common network domain queried between the IP address to be tested and the reference IP address (that is, the first query domain list corresponding to the IP address to be tested and the IP address corresponding to the reference IP address) The ratio of query domains that are common among the second query domain list of the URL.

The same DGA malware will query the same domain name list, and will not stop until there are surviving domains. When the similarity between users is high, it is likely to be the same DGA malware, so the queried domain list will be very similar. Since abnormal query behaviors will have the same domain name list, and normal users will rarely query the entire domain name list, the query domain lists among users infected with malware will have a high degree of similarity.

其中

為相似度，其中

代表使用者，

為第一IP位址（即待測IP位址）的查詢網域清單，

為第二IP位址（即參考IP位址）的查詢網域清單，

代表

與

的交集數量，

代表

與

的聯集數量。此公式計算的是兩兩使用者的相似度，而不是針對整體的網路環境進行分析，因此即使應用在不同的網路環境中也可以精準的算出使用者之間的相似度。 Specifically, the similarity can be calculated by the following formula:

in

is the similarity, where

on behalf of the user,

is the query domain list of the first IP address (that is, the IP address to be tested),

is a list of query domains for the second IP address (i.e. the reference IP address),

represent

and

the number of intersections,

represent

and

the number of unions. This formula calculates the similarity between two users, rather than analyzing the overall network environment, so even if it is applied in different network environments, it can accurately calculate the similarity between users.

For example, when the similarity calculated by the feature calculation module 320 is higher than a threshold value (also called a design water level), the detection module 330 can detect the IP address to be tested and the corresponding query domain. In some embodiments, when the value of the design water level is in the range of 0.8 to 0.9, the detection module 330 can effectively detect whether the IP address to be tested and the corresponding query domain are domains generated by DGA.

In an embodiment of the present invention, the machine learning model is a Long Short Term Memory (Long Short Term Memory, LSTM) model. In deep learning technology, LSTM model is one of the most common variants of Recurrent Neural Network (RNN), suitable for speech recognition, language modeling, sentiment analysis, text prediction and other data with contextual characteristics , with good accuracy and ability to handle complex features. In one embodiment, the detection module 330 can use the network domain lists generated by various DGA algorithms that can be collected on the Internet as a training data set for training. In one embodiment, the detection module 330 trains the LSTM model to determine whether the string conforms to the DGA format. For example, the LSTM model can judge whether there is a string of suspected DGA or random random numbers in the domain name. Since this judgment is semantic analysis on the string, it is very suitable to use the LSTM model. When the LSTM model determines that the domain list conforms to the DGA format, the detection module 330 determines that the IP address to be tested is a host infected by a malicious program to generate a detection result, and outputs the detection result through the transceiver 200 .

It is worth mentioning that many DGA-generated domains have certain rules or strings generated using specific seeds, and this string will appear in the second level domain. Therefore, in some embodiments, the detection module 330 can use random strings and second-level domains to train a machine learning model. When the detection module 330 makes a judgment, the machine learning model can only extract the second-level domain as an input to generate a detection result.

In an embodiment of the present invention, the detection module 330 can generate multiple sets of random character strings. The detection module 330 can retrieve multiple second-level domains from the historically non-existing domain query records. The detection module 330 can use multiple sets of random character strings and multiple second-level domains as training data to train the machine learning model.

In an embodiment of the present invention, the detection module 330 may obtain a list of the network domains to be tested corresponding to the Internet Protocol to be tested from the absence of the network domain query record in response to the similarity being greater than the threshold value. The detection module 330 can retrieve a plurality of secondary domains corresponding to the plurality of query domains respectively from the list of query domains to be tested. The detection module 330 can input multiple second-level domains into the machine learning model to generate detection results.

Since the domains generated by cybercriminals using DGA are changing every day, and the list of malicious domains collected by antivirus software manufacturers may not be updated in real time, it is difficult to accurately identify malicious domains by just looking at the domain name. Behavior. Therefore, the embodiments of the present invention are combined with the deep learning algorithm from the level of user behavior to make up for the network domain generated by the malicious DGA program that may be missed by the antivirus software. DGA does generate a large number of NXDomain queries, but it is more often found that the machine's built-in domain list query causes misjudgment. The embodiment of the present invention can further analyze the composition of the network domain name in combination with artificial intelligence technology, so that the detected alarm is more accurate. The embodiments of the present invention first screen out non-human query behaviors from the NXDomain, and then use the machine learning model trained for the DGA domain to detect the domain generated by the malicious DGA program. In this way, more accurate malicious domain detection results can be achieved.

To sum up, the system and method for detecting malicious network domain query behavior provided by the present invention can achieve the following technical effects: (1) Calculate similarity for user behavior patterns, without the need for a large amount of data modeling and training in advance. It can effectively distinguish abnormal user queries. (2) Through comprehensive detection of user behavior and query domain name analysis, it can effectively avoid misjudgments in the analysis of domain names, and can also use the abnormal behavior of users to provide effective evidence for the detection results. (3) Using the feature that DNS communication cannot be encrypted, it can detect the behavior of DNS query, which can avoid affecting the detection rate of the system or making the system unable to detect due to packet encryption. (4) Using the connection behavior of user groups for detection, it is possible to detect different types of malicious DGA domains without knowing the generation method or generation time of the domain list. (5) Extracting the traffic that needs to be analyzed from a large amount of network traffic can effectively improve the operating efficiency of the system and increase the accuracy of detection.

Although the present invention has been disclosed above by the embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the technical field can make some changes and modifications without departing from the spirit and scope of the present invention. Therefore, The protection scope of the present invention shall be determined by the scope of the appended patent application.

10: System 100: Processor 200: Transceiver 300: Storage Media 310: Domain name filtering module 320: Feature calculation module 330: Detection Module S210, S220, S230, S240, S250: Steps

FIG. 1 is a block diagram of a system for detecting malicious domain query behavior according to an embodiment of the present invention. FIG. 2 is a flowchart of a method for detecting malicious domain query behavior according to an embodiment of the present invention.

10: System

100: Processor

200: Transceiver

300: Storage Media

310: Domain name filtering module

320: Feature calculation module

330: Detection Module

Claims (9)

A system for detecting malicious network domain query behavior, comprising: a transceiver for receiving network traffic; a storage medium for storing a plurality of modules; and a processor, coupled to the transceiver and the storage medium, configured to execute The plurality of modules, wherein the plurality of modules include: a domain name filtering module that filters the domain name service query records in the network traffic according to a preset list to obtain the absence of domain name query records The feature calculation module calculates the similarity of the IP address to be tested according to the described absence of network domain query records; and the detection module, in response to the similarity greater than the threshold value, detects the Whether the Internet Protocol address to be tested is a host infected with a malicious program is used to generate a detection result, and output the detection result through the transceiver. The system according to claim 1, wherein the preset list includes a white list, wherein the domain name filtering module reflects that the to-be-confirmed domain query in the domain name service query record is not in the white list In the list, the to-be-confirmed domain query is included in the non-existing domain query record. The system of claim 1, wherein the preset list includes a blacklist, wherein the domain name filtering module reflects that the to-be-confirmed domain query in the domain name service query record is not in the blacklist In the list, the to-be-confirmed domain query is included in the non-existing domain query record. The system of claim 1, wherein the domain name service query record includes the user's IP address, query time, query domain name and domain resolution result. The system of claim 1, wherein the feature calculation module is configured to perform: obtaining a first query domain list corresponding to the IP address under test from the domain name service query record; and A second query domain list corresponding to the reference IP address; obtaining the number of intersections between the first query domain list and the second query domain list; obtaining the first query domain list and the first query domain list 2. Querying the number of joins in the network domain list; and dividing the number of intersections by the number of joins to obtain the similarity. The system of claim 1, wherein the machine learning model is a long short term memory model. The system of claim 1, wherein the detection module is configured to: generate multiple sets of random strings; retrieve multiple secondary domains from historical non-existing domain query records; and A group of random character strings and the multiple secondary domains are used as training data to train the machine learning model. The system of claim 1, wherein the detection module is configured to perform: in response to the similarity being greater than the threshold value, obtaining from the non-existent network domain query record corresponding to the network under test a list of query domains to be tested for the protocol; retrieve multiple secondary domains corresponding to multiple query domains from the list of query domains to be tested; and input the multiple secondary domains into the machine learning model to generate the detection results. A method for detecting malicious network domain query behavior, comprising: receiving network traffic by a transceiver; filtering, by a processor, a domain name service query record in the network traffic according to a preset list to obtain the absence of network domain query record; the processor calculates the similarity of the IP address to be tested according to the non-existent network domain query record; the processor detects that the similarity is greater than the threshold value through a machine learning model Whether the Internet Protocol address to be tested is a host infected with a malicious program is used to generate a detection result; and the detection result is output by the transceiver.

Images