马尔科夫链在域名信息探测中的应用  

APPLICATION OF MARKOV CHAIN IN DOMAIN NAME SYSTEM INFORMATION DETECTION

作　　者：胡荣贵[1] 许成喜[1] 汪永益[1] 张亮[1] 

机构地区：[1]电子工程学院网络系,安徽合肥230037

出　　处：《计算机应用与软件》2015年第6期152-155,共4页Computer Applications and Software

基　　金：安徽省自然科学基金项目(1208085QF107)

摘　　要：域名信息探测是企业网络安全评估和渗透测试的重要内容。针对当前蛮力扫描和DNSenum等基于字典的探测方法普遍存在获取信息不全、过度依赖数据字典的问题,建立了基于Markov链的域名结构模型,提取出域名起始字符集合与分布、状态转移矩阵等域名统计与分布特征,提出了一种新域名的生成算法。对.com、.net和.org三类通用域名进行抽样探测,实验结果表明,该算法在探测域名数量、探测域名集的区分度和探测效率上优于现有方法 DNSenum。Domain name system （DNS）information detection is an important issue of network security assessment and penetration testing for enterprises.As current brute force scanning and the dictionary-based detection methods such as DNSenum,etc.commonly have the prob-lems of incomplete information acquisition and being over-dependent on data dictionaries,we build the Markov chain-based domains structure model,extract the statistics and distribution features of domain names such as its starting character sets and state transition matrix,and pro-pose a new domains generation algorithm.At last,sampling survey is conducted on three common domain names of .com,.net and .org,ex-perimental result demonstrates that our algorithm performs better than the existing method of DNSenum in terms of the number of domain names detected,the differentiation of detected domain name sets and the detection efficiency.

关 键 词：域名信息探测 MARKOV 链 域名结构模型 域名生成算法 

分 类 号：TP393.4[自动化与计算机技术—计算机应用技术]