基于Counting Bloom Filter的DNS异常检测  

DNS anomaly detection based on Counting Bloom Filter

作　　者：胡蓓蓓[1] 彭艳兵[2] 程光[3] 

机构地区：[1]武汉邮电科学研究院,武汉430074 [2]烽火通信科技股份有限公司,南京210019 [3]东南大学计算机科学与工程系,南京211189

出　　处：《计算机工程与应用》2014年第15期82-86,共5页Computer Engineering and Applications

基　　金：国家重点基础研究发展规划(973)(No.2009CB320505);江苏省科技支撑计划(No.BE2011173)

摘　　要：鉴于失败的DNS查询(failed DNS query)能提供恶意网络活动的证据,以DNS查询失败的数据为切入口,提出一种轻量级的基于Counting Bloom Filter的DNS异常检测方法。该方法使用带语义特征的可逆哈希函数对被查询的域名及发起查询的IP进行快速的聚类和还原。实验结果证明该方法能以较少的空间占用和较快的计算速度有效识别出DNS流量中的异常,适用于僵尸网络、分布式拒绝服务(DDoS)攻击等异常检测的前期筛选和后期验证。Considering that DNS query failure can serve as communication evidence for activities of malware, this paper provides a DNS anomaly detection method based on Counting Bloom Filter with failure data as its entry point. This method conducts clustering towards domain names queried and IP which initiates the query, using revertible hash function with semantic features. After the clustering, the few Top N hash strings will be worked backwards to get the dominating shorting strings, which will be spliced according to the results of homology judgment. Experimental results prove that this method can effectively identify the anomaly in DNS flow, thus can be applied to early screening and later validation of anomaly detections, such as botnet and DDoS attack.

关 键 词：域名系统(DNS)查询失败 计数型布隆过滤器 异常检测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]