基于子域上下文关系的DNS隐蔽信道检测方法  

Toward DNS-Based Covert Channel Detection Using Subdomain Context Relation

作　　者：王杉杉 杜飞 

机构地区：[1]中国联合网络通信有限公司河南省分公司,河南 郑州 [2]北京锐驰信安技术有限公司,北京

出　　处：《计算机科学与应用》2021年第6期1823-1833,共11页Computer Science and Application

摘　　要：目前,攻击者进行私密信息传输、信息泄露、恶意信息传播等活动的主要手段之一是使用DNS协议作为隐蔽信道,特别是在僵尸网络和匿名通信网络中。为此,提出一种基于子域上下文关系的DNS隐蔽信道检测方法,该方法不仅提取了请求应答时间间隔、请求/应答报文大小、子域熵值以及资源记录类型频率等基础异常流量统计特征,同时对子域内容本身及其上下文关系进行了特征学习和提取。实验结果表明,该方法获得了99%以上的精度和召回率,具有很好的检测性能。At present, one of the main means for attackers to conduct private information transmission, information leakage, malicious information dissemination and other activities is to use the DNS protocol as a covert channel, especially in botnets and anonymous communication networks. To this end, a DNS covert channel detection method based on sub-domain context is proposed. This method not only extracts the basic anomaly traffic statistics such as request response time interval, request/response message size, sub-domain entropy value and resource record type frequency. At the same time, the sub-domain content itself and its context relationship are characterized and extracted. The experimental results show that the method achieves more than 99% accuracy and recall rate, and has good detection performance.

关 键 词：DNS隐蔽信道 流量特征分析 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]