基于文本和DNS查询的非常规域名检测研究  

Research on Irregular Domain Name Detection Based on Text and DNS Querying

作　　者：李建飞 成卫青[1,2] LI Jian-fei;CHENG Wei-qing(School of Computer,Nanjing University of Posts and Telecommunications,Nanjing 210003,China;Key Laboratory of Computer Network and Information Integrationof Ministry of Education(Southeast University),Nanjing 211189,China)

机构地区：[1]南京邮电大学计算机学院,江苏南京210003 [2]计算机网络和信息集成教育部重点实验室(东南大学),江苏南京211189

出　　处：《计算机技术与发展》2020年第2期114-120,共7页Computer Technology and Development

基　　金：计算机网络和信息集成教育部重点实验室资助项目(K93-9-2014-04B);国家自然科学基金(61170322)

摘　　要：在钓鱼网站、远控木马等网络攻击中常使用大量的非常规域名。面对海量域名,已有非常规域名检测方法准确性有待提高。基于对使用非常规域名的网络攻击特征,以及对已有非常规域名检测方法的研究,提出了域名伪装特征,分隔特征域名标签被数字分割的最大单元数,DNS查询特征:单次DNS查询返回的IP个数和DNS查询返回IP集合的平均杰卡德距离;改进了发音特征域名元音字母占比。此外,提出一种基于文本特征和DNS查询特征的非常规域名检测方法,其中选取了新定义的特征,以及若干其他域名基本特征、发音特征和分隔特征,并基于机器学习方法区分常规域名和非常规域名。实验结果表明,提出的非常规域名检测方法与部分已有方法相比准确率有较大提高,可用于检测使用了非常规域名的恶意网络攻击。A large number of irregular domain names are often used in cyber attacks such as phishing websites and remote control Trojans.Faced with a large number of domain names,the accuracy of existing irregular domain name detection methods needs to be improved.Based on the research on the characteristics of network attacks using irregular domain names,and the existing irregular domain name detection methods,we propose a domain name camouflage feature,a domain name separation feature-the maximum number of units for domain labels separated by digitals,and two DNS querying features-the number of IP addresses returned by a single DNS query and the average Jaccard distance of sets of IP addresses returned by multiple DNS queries for a domain name during a period.The pronunciation feature-the proportion of vowel letters in a domain name is improved.In addition,an irregular domain name detection method based on text features and DNS querying features is then proposed,which selects the newly defined features,as well as some other basic features,pronunciation features and separation features of domain names,and distinguishes between regular domain names and irregular domain names based on machine learning method.The experiment shows that the proposed method is more accurate than some existing methods,and can be used to detect malicious network attacks with irregular domain names.

关 键 词：非常规域名检测 文本特征 恶意网络攻击 机器学习 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]