基于域名关联的恶意移动应用检测研究  

Research on Malicious Mobile Application Detection Based on Domain Name Association

作　　者：蔡荣彦 王鹤 姚启桂 何高峰 CAI Rongyan;WANG He;YAO Qigui;HE Gaofeng(State Grid Fujian Electric Power Co.,Ltd.,Fuzhou 350003,China;Global Energy Internet Research Institute Co.,Ltd.,Nanjing 210003,China;College of Internet of Things,Nanjing University of Posts and Telecommunications,Nanjing 210023,China;Key Laboratory of Computer Network and Information Integration of Ministry of Education,Southeast University,Nanjing 211189,China)

机构地区：[1]国网福建省电力有限公司,福州350003 [2]全球能源互联网研究院有限公司,南京210003 [3]南京邮电大学物联网学院,南京210023 [4]东南大学计算机网络和信息集成教育部重点实验室,南京211189

出　　处：《计算机工程》2020年第5期174-180,共7页Computer Engineering

基　　金：国家自然科学基金青年基金项目“面向网络加密流量的恶意移动应用检测研究”(61702282);江苏省高等学校自然科学研究面上项目“面向移动应用加密流量的恶意攻击检测研究”(17KJB520023)。

摘　　要：为实现对恶意移动应用的准确检测以保障移动设备安全,提出一种基于域名关联的恶意移动应用检测方法。以DNS域名为检测分析对象识别网络流量中的恶意域名,利用DNS请求流量的时间特征寻找恶意域名的相关联域名,并将关联域名与文本分类样本库进行比对,确定恶意移动应用名称。实验结果表明,该方法可有效用于移动设备的安全防护,其在公开测试数据集中的检测率达到97.1%,在实际网络的部署运行中共检测出13款恶意移动应用,且误报数量为0。In order to realize the accurate detection of malicious mobile applications and ensure the security of mobile devices,a malicious mobile application detection method based on DNS is proposed.DNS domain name is used as the analysis object of detection to identify the malicious domain name in the network traffic,the time characteristics of DNS request traffic are used to find the associated domain name of the malicious domain name,and the associated domain name is compared with the text classification sample library to determine the name of the malicious mobile application.The experimental results show that this method can be effectively applied to the security protection of mobile devices.The detection rate of this method in the public test data set is 97.1%,and a total of thirteen malicious mobile applications are detected in the actual network deployment,and the number of false positives is 0.

关 键 词：恶意域名 时间特征 域名关联 文本检索 分类 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]