一种基于图分析的不良网络应用快速发现算法  

A FAST DETECTION ALGORITHM FOR MALICIOUS NETWORK APPLICATION BASED ON GRAPH DATA ANALYSIS

作　　者：刘冰[1] 杨学[1] 杨琪 李雪妮[1] 马永征[1] Liu Bing;Yang Xue;Yang Qi;Li Xueni;Ma Yongzheng(China Internet Network Information Center,Beijing 100190,China)

机构地区：[1]中国互联网络信息中心,北京100190

出　　处：《计算机应用与软件》2022年第11期329-336,共8页Computer Applications and Software

基　　金：中国互联网络信息中心“国家互联网基础资源大数据(服务)平台一期”项目(1805004)。

摘　　要：基于主动探测的域名解析数据和从公开来源获取的有效数据,通过分析域名(Domain Name)、IP与自治系统号码(Autonomous System Number,ASN)之间的全局关联关系,提出一种基于图数据路径分析的不良网络应用快速发现优化算法。在域名之间建立反映其关联强度的关系图谱,并通过调整不同参数配置计算真阳率和假阳率来评估算法的实用性和有效性。实验证明,该算法在保持较低假阳率的同时可以获得较高的真阳率,同时利用少量的已知不良种子域名可以快速发现大量的潜在不良域名,从而具有较好的大规模工程化应用前景。Based on the active probing domain name resolution data and the effective data from open source,we present a fast detection algorithm for malicious network application based on path analysis of graph data by analyzing the global relationship between the domain name,IP and autonomous system number(ASN).We established the relationship graph between domains that reflected the association strength,and calculated true positive and false positive by adjusting the different parameters to evaluate the practicability and validity of the algorithm.Experiments show that this algorithm can obtain a high true positive rate while maintaining a low false positive rate,and can quickly find a large number of potential malicious domain names by using a small number of known malicious seeds.Therefore,it has a good prospect of large-scale engineering application.

关 键 词：域名解析 图数据分析 关系图谱 不良网络应用 路径 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]