信息网络安全

信息网络安全 ›› 2021, Vol. 21 ›› Issue (12): 1-8.doi: 10.3969/j.issn.1671-1122.2021.12.001

• 入选论文 •    下一篇

基于HMM的Domain-Flux恶意域名检测及分析

郭向民1,2,3, 梁广俊1,2,3(), 夏玲玲1,2,3   

  1. 1.江苏警官学院计算机信息与网络安全系,南京 210031
    2.江苏省电子数据取证分析工程研究中心,南京 210031
    3.江苏省公安厅数字取证重点实验室,南京 210031
  • 收稿日期:2021-08-28 出版日期:2021-12-10 发布日期:2022-01-11
  • 通讯作者: 梁广俊 E-mail:liangguangjun@jspi.cn
  • 作者简介:郭向民（1989—）,男,讲师,硕士,主要研究方向为网络空间安全、电子数据取证|梁广俊（1983—）,男,讲师,博士,主要研究方向为物联网取证、电子数据取证|夏玲玲（1988—）,女,讲师,博士,主要研究方向为网络空间安全、社交网络分析
  • 基金资助:
    国家自然科学基金(61802155);江苏省高等学校自然科学基金(21KJD520003);江苏省公安厅科技研究项目(2020KX008);国家地方联合工程实验室开放课题(KFJJ20200201);江苏警官学院教育教学改革研究项目(2020A05)

Domain-Flux Malicious Domain Name Detection and Analysis Based on HMM

GUO Xiangmin1,2,3, LIANG Guangjun1,2,3(), XIA Lingling1,2,3   

  1. 1. Department of Computer Information and Cyber Security, Jiangsu Police Institute, Nanjing 210031, China
    2. Jiangsu Electronic Data Forensics and Analysis Engineering Research Center, Nanjing 210031, China
    3. Jiangsu Provincial Public Security Department Key Laboratory of Digital Forensics, Nanjing 210031, China
  • Received:2021-08-28 Online:2021-12-10 Published:2022-01-11
  • Contact: LIANG Guangjun E-mail:liangguangjun@jspi.cn

RichHTML

41

PDF (PC)

224

摘要：

目前,僵尸网络广泛采用域名生成算法（Domain Generation Algorithm,DGA）生成大量随机域名躲避检测,这种躲避检测的方法已经成为破坏网络安全的主要威胁。因此,研究DGA域名识别方法对于检测恶意程序、打击僵尸网络、保障信息安全具有重要的现实意义。文章设计了基于ELK大数据平台的DGA域名检测分析框架,在充分研究黑名单等现有DGA域名识别方法的基础上,收集域名解析（Domain Name Server,DNS）业务系统的请求查询日志,以DGA域名为识别对象,基于隐式马尔可夫模型（Hidden Markov Model,HMM）对恶意域名进行聚类分析,从而实现对DGA域名的判定,进一步为僵尸网络等网络攻击行为的取证、溯源提供思路。实验结果表明,文章采用的轻量级检测分类器对正常域名和恶意域名的区分效果较好。

关键词: 网络取证, 隐式马尔可夫模型, 恶意域名检测, ELK

Abstract:

With widely using domain generation algorithm (DGA) to generate a large number of random domain names to avoid detection, botnet has become the primary threat to network security today. In addition, the research on DGA domain name identification methods has important practical significance for countering malicious programs, fighting botnet and ensuring information security. This paper designed a DGA domain name detection and analysed framework based on the ELK big data platform. On the basis of fully studying the existing DGA domain name identification methods such as blacklists, this paper collected the request query log of the DNS business system. By adopting the hidden Markov model to perform cluster analysis on malicious domain names, the judgment of DGA domain names could be realized, and further ideas could be provided for evidence collection and source tracing of botnet and other cyber-attacks. Experimental results show that the lightweight detection classifier used in this paper can distinguish between normal domain names and malicious domain names more clearly.

Key words: network forensics, hidden Markov model, malicious domain name detection, ELK

中图分类号: