基于命名及解析行为特征的异常域名检测方法  

Anomaly domain name detection method based on characteristics of name and resolution behavior

作　　者：周勇林[1] 由林麟[2,3] 张永铮[2] 

机构地区：[1]国家计算机网络应急技术处理协调中心,北京100029 [2]中国科学院计算技术研究所,北京100190 [3]哈尔滨工业大学软件学院,哈尔滨150001

出　　处：《计算机工程与应用》2011年第20期50-52,共3页Computer Engineering and Applications

基　　金：国家自然科学基金(No.60703021);国家高技术研究发展计划(863)(No.2007AA01Z444;No.2007AA010501)~~

摘　　要：设计了DNS解析统计向量和检测特征向量,提出了一种基于命名及解析行为特征的异常域名检测方法,通过应用真实DNS解析数据的实验验证了该方法的有效性和可行性。实验表明,该方法较现有方法能够发现更多的异常域名,且具有较低的误报率。该方法是对现有方法检测能力的补充和提高,为僵尸网络等安全事件的检测与控制提供有效的信息支持和技术手段。A statistical vector of domain name resolution and a characteristic vector of detection are designed in this paper. An anomaly domain name detection method based on the characteristics of name and resolution behavior is proposed.An experiment using the real resolution traffic of Domain Name System（DNS） is designed to validate the effectiveness and feasibility of this method.Experimental results show that compared with the existing methods,this method can find more anomaly domain names and has a relatively lower false of the existing methods, and moreover provides ty events such as botnets. positive rate.This method can be used to complement and enhance the ability effective information and technical support for detection and control of security events such as botnets.

关 键 词：网络安全 异常域名 检测 解析行为 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]