基于顶级域解析日志的递归DNS识别方法  

A recursive DNS identification method based on top-level domain resolution log

作　　者：胡安磊 谢高岗[3,4] 苑卫国[2] 魏金侠 付豪 HU Anlei;XIE Gaogang;YUAN Weiguo;WEI Jinxia;FU Hao(Institute of Computing Technology,Chinese Academy of Sciences,Beijing 100190;China Internet Network Information Center,Beijing 100190;Computer Network Information Center,Chinese Academy of Sciences,Beijing 100083;University of Chinese Academy of Sciences,Beijing 100049)

机构地区：[1]中国科学院计算技术研究所,北京100190 [2]中国互联网络信息中心,北京100190 [3]中国科学院计算机网络信息中心,北京100083 [4]中国科学院大学,北京100049

出　　处：《高技术通讯》2023年第9期916-926,共11页Chinese High Technology Letters

基　　金：国家自然科学基金(62072437);国家自然科学区域联合重点基金(U20A20180)资助项目。

摘　　要：递归域名系统(DNS)根据其服务的开放性、进行递归查询的目的等可分为不同的类型,递归DNS类型的准确识别,对于对根、顶级和各级权威DNS的分析与运行具有重要意义。针对递归DNS的准确识别问题,本文通过分析.CN国家顶级域名系统的解析日志,提出基于递归查询的行为特征识别递归DNS类型的方法。该方法从多个维度信息来筛选甄别表征全量日志信息,基于无监督特征选择方法选择重要特征,实现同类型递归DNS的准确聚类。实验结果表明,该方法能高效准确识别出递归DNS类型。Recursive domain name system(DNS)can be categoraized into different types according to the characteristics in terms of the resolution service openness and the purpose of recursive queries.The accurate identification of recursive DNS types has an important impact on the analysis and operation of root,top-level and all levels of authoritative DNS.The accuracy of traditional method based on the character features needs to be further improved.Aiming at the accurate identification of the types of each recursive DNS,this paper first analyzes the query log data from.CN national top-level DNS,and then proposes a recursive DNS type identification method based on the observed behavioral characteristics of recursive query.Specifically,this method distills the full amount of log information from multiple dimensions and selects important features based on unsupervised feature selection,in order to realizes accurate clustering of recursive DNS.Experimental results show that this method can identify recursive DNS types efficiently and accurately.

关 键 词：递归域名系统(DNS) 特征识别 无监督特征选择 聚类算法 

分 类 号：TP393.04[自动化与计算机技术—计算机应用技术]