CN102685145A - Domain name server (DNS) data packet-based bot-net domain name discovery method - Google Patents

Abstract

The invention discloses a method for discovering a botnet domain name based on DNS data packets. The DNS data packet is used as the basic data source at the network layer, and under the condition of knowing part of the botnet domain names, the group and persistence of the botnet are utilized. Key features, track and discover more botnet domains using domain co-occurrence scoring method. The present invention shows the domain name of the botnet through the local characteristics of the known botnet, discovers the unknown domain name updated or changed after it changes with time, discovers, grasps and tracks the dynamic changes of the access behavior of the given botnet, to overcome Shortcomings of Existing Botnet Detection Methods. The method of the present invention is characterized by the domain name, which can avoid the limitations of botnet protocol diversity or information encryption when using the feature code as the detection means; the observation object of the co-occurrence behavior of the domain name can make full use of the group and continuous nature of the botnet. Sexual characteristics, discover unknown botnet domains.

Description

A method for discovering botnet domain names based on DNS packets

technical field

The method relates to the field of computer network security, and relates to a method for discovering a domain name of a botnet, in particular to a method for discovering a domain name of a botnet based on DNS data packets. the

Background technique

A botnet is a collection of zombie hosts (zombie) infected by a bot program (bot) and having a command-and-control relationship. These zombie hosts are distributed in various occasions such as homes, enterprises, and government agencies, and receive instructions from the controller (botmaster). , carry out various network attacks such as DDoS, information theft, phishing, spam, advertising abuse, and illegal voting. serious security threat. One-to-many command and control (C&C) is the fundamental feature that distinguishes botnets from traditional virus, Trojan horse, backdoor and other attack technologies. feature. the

At present, the traditional method of botnet detection is to use signature codes to discover accused zombie hosts. Non-signature code detection methods mainly include: collecting and classifying network features, scoring threats and correlations between hosts, and using semantic analysis of domain name lexical Mine malicious domain names in domain names, and detect botnets through the Fast-Flux phenomenon of IP and domain names. These methods face the following problems:

1) The characteristics of the botnet such as long-term latency determine that the interaction between the controller and the zombie host is a dynamic command and control process, so the known feature information is updated quickly, and the detection method based on the feature code cannot keep up with the pace of the feature information. The failure rate will gradually increase with time. the

2) Network-based detection methods have high requirements on data sources, and are difficult to apply to large-scale networks due to complex data calculations. the

3) The detection method based on literal semantic analysis and the detection method using the Fast-Flux phenomenon have strong limitations and cannot effectively detect a wide variety of botnets. the

Contents of the invention

The purpose of this method is to provide a method for discovering botnet domain names based on DNS data packets, through known local characteristics of botnets (expressed as botnet domain names), discover unknown domain names that are updated or changed over time, Discover, grasp and track the dynamic changes of access behavior of a given botnet to overcome the shortcomings of existing botnet detection methods. The method of the present invention is characterized by the domain name, which can avoid the limitations of botnet protocol diversity or information encryption when using the feature code as the detection means; the observation object of the co-occurrence behavior of the domain name can make full use of the group and continuous nature of the botnet. Sexual characteristics, discover unknown botnet domains. Experiments show that this method can effectively and reliably discover unknown botnet domain names in a network scale of tens of thousands of hosts. the

In order to achieve the above object, the present invention adopts the following technical solutions:

A botnet domain name discovery method based on DNS packets, comprising the following steps,

Data preprocessing:

Step 1.1: Take the given network egress traffic as the data source, parse the DNS query data from the data packet, and extract the four-tuple r=(t,h,p,d) set containing DNS query characteristic information, t is the request initiation time, h is the request originating host, p is the requested resource record type, and d is the requested domain name;

Step 1.2: Filter the reduced quadruple r=(t,h,p,d) set through the domain name whitelist, and convert the quadruple containing the given domain name from the domain name whitelist from the quadruple r=(t,h,p , d) remove from the set;

Step 1.3: Identify NAT (IP Network Address Translator/IP Network Address Translator) hosts, filter the access records of NAT hosts to domain names in the NAT network, and remove step 1.2 from the quaternion r=(t,h,p,d) set Eliminate from the quadruple set after the given domain name quadruple in the domain name whitelist; get the reduced quadruple set after elimination;

Step 1.4: On the reduced set of quadruples obtained in step 3, the domain name is used as the subject to make statistics according to the time window, and the number of times each domain name is queried by each host in each time window is counted, which is defined as a quadruple s =(T _i ,h,d,n _all ); T _i represents the time range from t _i to t _i+1 , t _i+1 = t _i +T, h is the requesting host, d is the domain name of the request, n _all is the number of times each domain name is queried by each host in the time window, where the size of the time window is T;

Preferably, the process of identifying the NAT host in step 1.3 comprises the following steps:

Step a: Divide the time period, record the observed value x _ij of the number of domain names accessed by each host i in each time period j; j=1,2,3,...N, N is a natural number;

Step b: Calculate the average number of domain names accessed by host i in n time periods as

Step c: Calculate the threshold M _k , so that M _k is the upper k quantile of the random variable X _ij , that is, P{X _ij >M _k }=k, k∈(0,1), where the random variable X _ij Indicates the number of domain name queries of host i in time period j; experiments show that k is 0.05 to have the best effect;

则认为该主机为NAT主机。  Step d: Judging if

The host is considered to be a NAT host.

Preferably, the botnet domain name discovery method based on DNS packets also includes the step of domain name co-occurrence scoring:

Step 2.1: For a given botnet, determine the set of domain names to be tested in the quadruple s=(T _i ,h,d,n _all ) according to the set of domain names of the given botnet; The hosts that have sent DNS query requests for the domain names in are zombie hosts, and the unknown domain names in the dataset visited by all zombie hosts are the set of domain names to be tested;

Step 2.2: Divide the time window, and for each time window T _i , calculate the co-occurrence score of each domain name in the domain name set to be tested and a given botnet domain name:

其中，D(h,T_i)为该时间窗口T_i内主机h访问过的域名集合，d_i为该时间窗口内待测域名，d_j为该时间窗口内给定僵尸网络的域名集合中给定域名；  1) Calculate the similarity coefficient between the domain name to be tested and each domain name in the domain name set of a given botnet within the time window T _i . The similarity coefficient is:

Among them, D(h, T _i ) is the set of domain names visited by host h in this time window T _i , d _i is the domain name to be tested in this time window, and d _j is the domain name set of a given botnet in this time window given domain name;

2) Calculate the sum of similarity coefficients between the domain name d to be tested and the known domain name set Z _b in all given botnets within the time window T _i

其中，H(d,T_i)表示在时间窗口T_i内访问过域名d的主机集合；  3) Calculate the correction coefficient W(d,T _i ) of the domain name d under test within the time window T _i , the correction coefficient is the number of zombie hosts that have visited the domain name divided by the number of all hosts that have visited the domain name, that is

Among them, H(d, T _i ) represents the set of hosts that have visited the domain name d within the time window T _i ;

4) Calculate the co-occurrence score S _b (d,T _i ) of the domain name under test and a given botnet domain name set within the time window T _i , $S_b(d,T_i)=\left({\mathrm{\Σ}}_{d_b\∈Z_b}C(d_b,{d,T}_i)\right)*W(d,T_i);$

Step 2.3: Calculate the domain name co-occurrence score S _b (d) of multiple time windows;

1) For x consecutive time windows, calculate the average co-occurrence score of domain name d and botnet B _b ${\stackrel{\‾}{S}}_b\left(d\right)=(S_b(d,T_1)+S_b(d,T_2)+\&Center\; Dot;\&Center\; Dot;\·+S_b(d,T_x))/x;$

2) For x consecutive time windows, calculate the maximum co-occurrence score S _bmax (d)=max(S _b (d,T _i )) between the domain name d and the botnet B _b ;

3) Do normalization and calculate the domain name co-occurrence score S _b (d) of multiple time windows:

$S_b\left(d\right)={\stackrel{\‾}{S}}_b\left(d\right)/\max \left({\stackrel{\‾}{S}}_b\left(d_i\right)\right)\&Center\; Dot;\mathrm{\α}+S_{b\max }\left(d\right)/\max \left(S_{b\max }\left(d_i\right)\right)\·(1-\mathrm{\α}),$ α∈(0,1)

in, is the maximum value of the average co-occurrence score of all domain names to be tested in botnet B _b , max(S _bmax (d _i )) is the maximum value of the maximum co-occurrence score of all domain names to be tested in botnet B _b , and α is the maximum value reflecting the co-occurrence score of domain names in the network The scale factor of the ratio of the average value of the score to the maximum value; the experiment shows that the accuracy of the result is the highest when the value of α is 0.8.

Preferably, the botnet domain name discovery method based on DNS packets also includes a botnet domain name screening step:

Sorting the domain name co-occurrence scores of all domain names to be tested in a given botnet, screening the domain names to be tested with a score > 0.2; using domain name malicious judgment rules to judge the maliciousness of the domain names to be tested with a score > 0.2 and recommending them. the

Preferably, the domain name malicious judgment rule satisfies any one or more of the following:

(1) The security vendor announces that the domain name is a malicious domain name or there is a malicious URL under the domain name;

(2) It has the same second-level domain name as the known malicious domain name, and the second-level domain name is not a dynamic domain name provider;

(3) have the same prefix as the known malicious domain name;

(4) Through the search engine, it is found that there is no information about the domain name at all, but it does exist, and the resolved IP address is the same as the IP address resolved by the known malicious domain name. the

Preferably, the domain names in the white list of domain names in step 1.2 are one or more of commonly used domain names, misconfigured domain names, and frequently used program domain names.

Compared with the prior art, the present invention has the following beneficial effects: the method of the present invention does not need host layer data support, uses DNS packets as the basic data source at the network layer, and uses the group of botnets under the condition of known part of botnet domain names. The two key characteristics of botnet and persistence, using the domain name co-occurrence scoring method to track and discover more botnet domains. The method is divided into three parts: data preprocessing, domain name co-occurrence score calculation and botnet domain name screening. This method eliminates the interference of NAT hosts in the network in the data preprocessing part; in the domain name co-occurrence score calculation part, the score analysis is carried out from the space dimension and time dimension, so that the domain name co-occurrence behavior exhibited by the botnet can be significantly different from other normal domain name co-occurrence behaviors. The domain name co-occurrence behavior exhibited by the application; finally, by sorting the domain name co-occurrence scores, the domain names with the highest correlation with known botnet domain names are screened. the

Description of drawings

Fig. 1 is a schematic diagram of the co-occurrence behavior of the botnet described in this method. the

Fig. 2 is a detailed flowchart of the discovery of the botnet domain name described in the method. the

Detailed ways

In order to understand the method more clearly, the method will be further described in detail below through specific implementation manners in conjunction with the accompanying drawings. the

Figure 1 is a schematic diagram of the co-occurrence behavior of botnets. the

Regardless of the centralized or distributed structure of the botnet, whether it is IRC or HTTP protocol, they all have the following common features: (1) Spatial groupness. Be controlled by the same hacker or hacker organization, receive the same or coordinated attack commands, and have the same network access rules; (2) Time continuity. Zombie hosts continue to access relevant target servers (including control servers, update servers, etc.) in time, and always keep in touch with the zombie controller. Botnets usually use multiple different domain names in the process of command and control, and bot hosts will continue to access these specific domain names during their life cycle to maintain and receive the attacker's command and control, and ensure their own security. Stealth and reliability. In a typical botnet control case, the bot host’s access process to various domain names is as follows: first access the domain name of the command control server to complete the reception of control commands; Control commands; finally access the victim server domain name to conduct network attacks, etc. Because they are controlled by the same bot controller, the bot hosts in the same botnet must have the same or similar access behaviors when accessing the server domain name. the

Namely, the domain name access of the botnet has a clear domain name co-occurrence behavior: a given domain name set is acted by known zombie domain names, such as captured command and control domain names; while the co-occurrence domain name set covers various unknown zombie domain names, such as related domain names and victim domain names, etc. Therefore, this method scores and discovers unknown botnet domain names based on the co-occurrence behavior of botnet domain names. the

Fig. 2 is a detailed flowchart of discovering botnet domain names by using the method. the

The data source of this method is the traffic data of a given network, which can use the traffic mirroring of the network egress, or the ingress traffic of the DNS server of the regional network, and analyze the data packet through winpcap to extract the DNS query characteristic information contained in the DNS query traffic , and store it in the database as metadata. This step needs to be carried out for a long time to obtain long-term data. In the steps of whitelist filtering, NAT host filtering and data statistics, the operation data are these metadata. the

When the data preprocessing part is over, the domain name feature quadruples obtained by filtering and the statistical feature quadruples obtained by statistics are used as the input of the domain name co-occurrence score calculation part. Now the collection of domain names, the domain name to be tested is a host that has sent a DNS query request to any known domain name of a given botnet as a zombie host. Then divide the time window, and calculate the domain name co-occurrence score of each domain name to be tested in a single time window according to the steps described in the summary of the invention, and then calculate the domain name co-occurrence score of each domain name to be tested in multiple time windows according to the steps described in the summary of the invention Rate now. the

When the domain name co-occurrence score calculation part is over, a list of domain name co-occurrence scores to be tested will be obtained, and these domain name scores are sorted by score, and the domain names with the highest correlation with known botnet domain names are screened. Malicious judgments and recommendations are made for domain names with a score >0.2. the

The method of the invention is divided into three parts: data preprocessing, domain name co-occurrence score calculation and botnet domain name screening. Each of these sections includes the following steps:

Data preprocessing part:

Step 1: Take the given network egress traffic as the data source, parse the DNS query data from the data packet, and extract the quaternion r=(t,h,p,d) containing the DNS query feature information (t is the request initiation time , h is the originating host of the request, p is the requested resource record type, d is the requested domain name) set, and a series of data preparations are done for the subsequent steps. the

Step 2: Filter the reduced quadruple r=(t,h,p,d) set through the "domain name white list", and convert the quadruple containing the given domain name from the quadruple r=(t,h,p, d) Eliminate from the set. The domain names in the whitelist mainly include the following types: commonly used domain names, misconfigured domain names, and frequently used program domain names. the

Step 3: Identify NAT (IP Network Address Translator) hosts, based on the statistical characteristics of network domain name access, without hardware support, filter the access records of NAT hosts to domain names in the NAT network, and obtain the quaternion from step 2 Eliminate the reduced set of quadruples from the set. the

The identification steps of the NAT host are:

1) Divide the time period and record the observed value x _ij of the number of domain names accessed by each host i in each time period j (j=1,2,3,…).

2) Calculate the average number of domain names accessed by host i in n time periods as

3) Calculate the threshold M _k so that M _k is the upper k quantile of the random variable X _ij , that is, P{X _ij >M _k }=k, k∈(0,1), where the random variable X _ij represents The number of domain name queries of host i in the time period j. Experiments show that k takes 0.05 to have the best effect.

4) Judging if The host is considered to be a NAT host.

Step 4: On the reduced set of quadruples obtained in step 3, the domain name is used as the subject to make statistics according to the time window, and each domain name is counted by each host in each time window (the time window is preferably 1 natural day). The number of queries, defined as a quadruple quadruple s=(T _i ,h,d,n _all ) (T _i represents the time range from t _i to t _i+1 , t _i+1 = t _i +T , h is the requesting host, d is the requested domain name, n _all is the number of times each domain name is queried by each host in the time window, where the time window size is T). It highlights the statistical characteristics of domain names and reduces the data set without losing effective information.

Domain name co-occurrence score calculation part:

Step 1: For a given botnet, determine the domain name set to be tested in the quadruple s=(T _i ,h,d,n _all ) according to the domain name set of the given botnet. _A host that has sent a DNS query request to a domain name in any known botnet is a zombie host, and all unknown _domain names (except Domain names outside the domain name set of a given botnet) is the domain name set to be tested.

Step 2: Divide the time window, and for each time window T _i , calculate the co-occurrence score of each domain name in the domain name set to be tested and a given botnet domain name:

1) Calculate the similarity coefficient between the domain name to be tested and each domain name in the domain name set of a given botnet within the time window T _i , and the coefficient is based on the Jacobian similarity coefficient and modified. D(h, T _i ) is the set of domain names visited by host h in this time window T _i , d _i is the domain name to be tested in this time window, and d _j is given in the domain name set of a given botnet in this time window domain name, the similarity coefficient is:

2) Calculate the sum of similarity coefficients between the domain name d to be tested and the known domain name set Z _b in all given botnets within the time window T _i

其中，H(d,T_i)表示在时间窗口T_i内访问过域名d的主机集合。  3) Calculate the correction coefficient of the domain name d to be tested within the time window T _i . The correction coefficient is the number of zombie hosts that have visited the domain name to be tested divided by the number of all hosts that have visited the domain name to be tested, that is

Wherein, H(d, T _i ) represents the set of hosts that have visited the domain name d within the time window T _i .

4) Calculate the co-occurrence score S _b (d,T _i ) of the domain name under test and a given botnet domain name set within the time window T _i , $S_b(d,T_i)=\left({\mathrm{\Σ}}_{d_b\∈Z_b}C(d_b,{d,T}_i)\right)*W(d,T_i).$

Step 3: Calculate the domain name co-occurrence score S _b (d) of multiple time windows.

1) For x consecutive time windows, calculate the average co-occurrence score of domain name d and botnet B _b ${\stackrel{\‾}{S}}_b\left(d\right)=(S_b(d,T_1)+S_b(d,T_2)+\·\·\·+S_b(d,T_x))/x.$

2) For x consecutive time windows, calculate the maximum co-occurrence score S _bmax (d)=max(S _b (d,T _i )) between domain name d and botnet B _b .

3) Do normalization and calculate the domain name co-occurrence score S _b (d) of multiple time windows:

$S_b\left(d\right)={\stackrel{\‾}{S}}_b\left(d\right)/\max \left({\stackrel{\‾}{S}}_b\left(d_i\right)\right)\&Center\; Dot;\mathrm{\α}+S_{b\max }\left(d\right)/\max \left(S_{b\max }\left(d_i\right)\right)\·(1-\mathrm{\α}),$ α∈(0,1)

为僵尸网络B_b所有待测域名平均共现评分的最大值，max(S_bmax(d_i))为僵尸网络B_b所有待测域名最大共现评分的最大值，α为反映网络中域名共现评分平均值与最大值比例的比例因子。实验表明，α取值0.8时结果准确率最高。  in,

is the maximum value of the average co-occurrence score of all domain names to be tested in botnet B _b , max(S _bmax (d _i )) is the maximum value of the maximum co-occurrence score of all domain names to be tested in botnet B _b , and α is the maximum value reflecting the co-occurrence score of domain names in the network Scale factor for the ratio of the average value of the current rating to the maximum value. Experiments show that the accuracy of the results is the highest when the value of α is 0.8.

Botnet domain name filtering section:

Step 1: Rank the domain co-occurrence scores of all domains under test for a given botnet. the

Step 2: Screen the domain names to be tested with a score >0.2 (the domain names to be tested with a score >0.2 are highly correlated with known botnet domain names). the

Step 3: Make a malicious judgment on the screened domain names to be tested, and the judgment rules meet any one or more of the following descriptions:

1) The security vendor announces that the domain name is a malicious domain name or there is a malicious URL under the domain name. the

2) It has the same second-level domain name as the known malicious domain name, and the second-level domain name is not a dynamic domain name provider. the

3) It has the same prefix as the known malicious domain name. the

4) Through the search engine, it is found that there is no information about the domain name at all, but it does exist, and the resolved IP address is the same as the IP address resolved by the known malicious domain name. the

Claims (6)

1. A method for discovering a botnet domain name based on DNS packets, characterized in that, comprising a data preprocessing step: Step 1.1: Take the given network egress traffic as the data source, parse the DNS query data from the data packet, and extract the four-tuple r=(t,h,p,d) set containing DNS query characteristic information, t is the request initiation time, h is the request originating host, p is the requested resource record type, and d is the requested domain name; Step 1.2: Filter the reduced quadruple r=(t,h,p,d) set through the domain name whitelist, and convert the quadruple containing the given domain name from the domain name whitelist from the quadruple r=(t,h,p , d) remove from the set; Step 1.3: Identify the NAT host, filter the access records of the NAT host to the domain name in the NAT network, and remove the four-tuple after the given domain name quadruple in the step 1.2 domain name whitelist from the quaternion r=(t,h,p,d) set Eliminate from the tuple set; get the reduced quadruple set after elimination; Step 1.4: On the reduced set of quadruples obtained in step 3, the domain name is used as the subject to make statistics according to the time window, and the number of times each domain name is queried by each host in each time window T _i is counted, which is defined as a quadruple Group s=(T _i ,h,d,n _all ); T _i represents the time range from t _i to t _i+1 , t _i+1 = t _i +T, h is the requesting host, d is the requested Domain name, n _all is the number of times each domain name is queried by each host in the time window, where the size of the time window is T. 2. the botnet domain name discovery method based on DNS packet as claimed in right 1, it is characterized in that, the process of identifying NAT host among the step 1.3 comprises the following steps: Step a: Divide the time period, record the observed value x _ij of the number of domain names accessed by each host i in each time period j; j=1,2,3,...N, N is a natural number; Step b: Calculate the average number of domain names accessed by host i in n time periods as

Step c: Calculate the threshold M _k , so that M _k is the upper k quantile of the random variable X _ij , that is, P{X _ij >M _k }=k, k∈(0,1), where the random variable X _ij Indicates the number of domain name queries of host i in time period j; k=0.05; Step d: Judging if

The host is considered to be a NAT host. 3. the botnet domain name discovery method based on DNS packet as claimed in right 1, is characterized in that, the botnet domain name discovery method based on DNS packet also includes the step of domain name co-occurrence scoring: Step 2.1: For a given botnet, determine the set of domain names to be tested in the quadruple s=(T _i ,h,d,n _all ) according to the set of domain names of the given botnet; The hosts that have sent DNS query requests for the domain names in are zombie hosts, and the unknown domain names in the dataset visited by all zombie hosts are the set of domain names to be tested; Step 2.2: Divide the time window, and for each time window T _i , calculate the co-occurrence score of each domain name in the domain name set to be tested and a given botnet domain name: 1) Calculate the similarity coefficient between the domain name to be tested and each domain name in the domain name set of a given botnet within the time window T _i . The similarity coefficient is:

Among them, D(h, T _i ) is the set of domain names visited by host h in this time window T _i , d _i is the domain name to be tested in this time window, and d _j is the domain name set of a given botnet in this time window given domain name; 2) Calculate the sum of similarity coefficients between the domain name d to be tested and the known domain name set Z _b in all given botnets within the time window T _i 3) Calculate the correction coefficient W(d,T _i ) of the domain name d under test within the time window T _i , the correction coefficient is the number of zombie hosts that have visited the domain name divided by the number of all hosts that have visited the domain name, that is

Among them, H(d, T _i ) represents the set of hosts that have visited the domain name d within the time window T _i ; 4) Calculate the co-occurrence score S _b (d,T _i ) of the domain name under test and a given botnet domain name set within the time window T _i , $S_b(d,T_i)=\left({\mathrm{\&Sigma;}}_{d_b\&Element;Z_b}C(d_b,{d,T}_i)\right)*W(d,T_i);$ Step 2.3: Calculate the domain name co-occurrence score S _b (d) of multiple time windows; 1) For x consecutive time windows, calculate the average co-occurrence score of domain name d and botnet B _b ${\stackrel{\&OverBar;}{S}}_b\left(d\right)=(S_b(d,T_1)+S_b(d,T_2)+\&Center\; Dot;\&CenterDot;\&CenterDot;+S_b(d,T_x))/x;$ 2) For x consecutive time windows, calculate the maximum co-occurrence score S _bmax (d)=max(S _b (d,T _i )) between the domain name d and the botnet B _b ; 3) Do normalization and calculate the domain name co-occurrence score S _b (d) of multiple time windows: ${\mathrm{<span\; class="notranslate">\; S</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; d</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>{\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; S</span>}}}_{\mathrm{<span\; class="notranslate">\; b</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; d</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; /</span>\mathrm{<span\; class="notranslate">\; max</span>}<span\; class="notranslate">\; (</span>{\stackrel{<span\; class="notranslate">\; \&OverBar;</span>}{\mathrm{<span\; class="notranslate">\; S</span>}}}_{\mathrm{<span\; class="notranslate">\; b</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; S</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}\mathrm{<span\; class="notranslate">\; max</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; d</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; /</span>\mathrm{<span\; class="notranslate">\; max</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; S</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}\mathrm{<span\; class="notranslate">\; max</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span><span\; class="notranslate">\; \&Center\; Dot;</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; \&alpha;</span>}<span\; class="notranslate">\; \&Element;</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 0,1</span>}<span\; class="notranslate">\; )</span>$ in,

is the maximum value of the average co-occurrence score of all domain names to be tested in botnet B _b , max(S _bmax (d _i )) is the maximum value of the maximum co-occurrence score of all domain names to be tested in botnet B _b , and α is the maximum value reflecting the co-occurrence score of domain names in the network Scale factor for the ratio of the mean value to the maximum value of the current score; α = 0.8. 4. the botnet domain name discovery method based on DNS packet as claimed in right 3, is characterized in that, the botnet domain name discovery method based on DNS packet also includes botnet domain name screening step: Sorting the domain name co-occurrence scores of all domain names to be tested in a given botnet, screening the domain names to be tested with a score > 0.2; using domain name malicious judgment rules to judge the maliciousness of the domain names to be tested with a score > 0.2 and recommending them. 5. the botnet domain name discovery method based on DNS data packet as described in right 4, it is characterized in that, domain name malicious judgment rule is to satisfy following any one or more: (1) The security vendor announces that the domain name is a malicious domain name or there is a malicious URL under the domain name; (2) It has the same second-level domain name as the known malicious domain name, and the second-level domain name is not a dynamic domain name provider; (3) have the same prefix as the known malicious domain name; (4) Through the search engine, it is found that there is no information about the domain name at all, but it does exist, and the resolved IP address is the same as the IP address resolved by the known malicious domain name. 6. The method for discovering botnet domain names based on DNS data packets as claimed in right 1, wherein the domain names in the domain name whitelist in step 1.2 are one or more of common domain names, misconfigured domain names, and program-frequent domain names .

Images