Abstract:

With widely using domain generation algorithm (DGA) to generate a large number of random domain names to avoid detection, botnet has become the primary threat to network security today. In addition, the research on DGA domain name identification methods has important practical significance for countering malicious programs, fighting botnet and ensuring information security. This paper designed a DGA domain name detection and analysed framework based on the ELK big data platform. On the basis of fully studying the existing DGA domain name identification methods such as blacklists, this paper collected the request query log of the DNS business system. By adopting the hidden Markov model to perform cluster analysis on malicious domain names, the judgment of DGA domain names could be realized, and further ideas could be provided for evidence collection and source tracing of botnet and other cyber-attacks. Experimental results show that the lightweight detection classifier used in this paper can distinguish between normal domain names and malicious domain names more clearly.

Key words: network forensics, hidden Markov model, malicious domain name detection, ELK