信息网络安全

信息网络安全 ›› 2021, Vol. 21 ›› Issue (3): 87-95.doi: 10.3969/j.issn.1671-1122.2021.03.011

• 理论研究 • 上一篇    下一篇

一种基于被动DNS数据分析的DNS重绑定攻击检测技术

郭烜臻1,2(), 潘祖烈1,2, 沈毅1,2, 陈远超1,2   

  1. 1.国防科技大学电子对抗学院,合肥 230037
    2.网络空间安全态势感知与评估安徽省重点实验室,合肥 230037
  • 收稿日期:2020-06-18 出版日期:2021-03-10 发布日期:2021-03-16
  • 通讯作者: 郭烜臻 E-mail:guoxuanzhen@nudt.edu.cn
  • 作者简介:郭烜臻（1996—）,男,江西,硕士研究生,主要研究方向为网络空间安全|潘祖烈（1976—）,男,安徽,副教授,博士,主要研究方向为网络空间安全|沈毅（1986—）,男,重庆,讲师,硕士,主要研究方向为网络空间安全|陈远超（1996—）,男,福建,硕士研究生,主要研究方向为网络空间安全
  • 基金资助:
    国家重点研发计划(2017YFB0802900)

DNS Rebinding Detection Technology Based on Passive DNS Data Analysis

GUO Xuanzhen1,2(), PAN Zulie1,2, SHEN Yi1,2, CHEN Yuanchao1,2   

  1. 1. College of Electronic Engineering, National University of Defense Technology, Hefei 230037, China
    2. Anhui Province Key Laboratory of Cyberspace Security Situation Awareness and Evaluation, Hefei 230037, China
  • Received:2020-06-18 Online:2021-03-10 Published:2021-03-16
  • Contact: GUO Xuanzhen E-mail:guoxuanzhen@nudt.edu.cn

RichHTML

18

PDF (PC)

406

摘要：

基于域名系统（DNS）的DNS重绑定攻击能够有效绕过同源策略、防火墙,窃取敏感信息,控制内网设备,危害巨大。DNS重绑定需要通过设置恶意域名才能实现。针对DNS重绑定相关恶意域名的检测问题,文章提出一种基于被动DNS数据分析的DNS重绑定攻击检测模型（DNS Rebinding Classifier,DRC）。通过引入被动DNS数据,从域名名称、时间、异常通信及恶意行为等4个测度集刻画DNS重绑定相关域名;基于C4.5决策树、KNN、SVM及朴素贝叶斯等分类方法对数据进行混合分类、组合训练及加权求值。交叉验证实验表明,DRC模型对相关恶意域名的识别能够达到95%以上的精确率;与恶意域名检测工具FluxBuster进行对比,DRC模型能够更准确地识别相关恶意域名。

关键词: DNS重绑定, 被动DNS, 恶意域名检测, 混合分类

Abstract:

DNS rebinding attack based on the domain name system (DNS) can effectively bypass the homologous strategy and firewall, steal sensitive information, and control intranet devices, causing great harm to the Internet community. DNS rebinding can only be realized by setting malicious domain name. Aiming at the detection of malicious domain names related to DNS rebinding, this paper proposes a DNS rebinding classifier (DRC) based on passive DNS data analysis. By introducing passive DNS data, the domain names related to DNS rebinding are characterized from the four measure sets of domain name, time, abnormal communication and malicious behavior. Based on C4.5 decision tree, KNN, SVM and naive Bayes classification methods, the data are classified, trained and weighted. Cross validation experiments show that the accuracy of DRC model for identifying related malicious domain names can reach more than 95%. Compared with the malicious domain name detection tool FluxBuster, DRC model can identify related malicious domain names more accurately.

Key words: DNS rebinding, passive DNS, malware domain name detection, mixed classification

中图分类号: