移动DNS日志解析：APT恶意软件域识别技术

146 浏览量更新于2024-08-28 收藏 2.33MB PDF 举报

"这篇研究论文探讨了如何利用移动DNS日志来识别APT(Advanced Persistent Threat)恶意软件域，旨在提供一种更有效、更及时的威胁检测方法。文章由Weina Niu, Xiaosong Zhang, Guo Wu Yang, Jianan Zhu和Zhongwei Ren合作完成，发表于2017年，归属于电子科技大学计算机科学与工程学院和网络安全中心的研究成果。" 在当前的信息安全环境中，APT攻击是一个重大的安全挑战，它们针对敏感信息进行长期、持续的侵入，通常具有高隐蔽性和复杂性。传统的APT检测方法依赖于深度分析，这需要大量时间和计算资源，且往往在攻击发生后才能发现。因此，研究人员开始探索新的检测策略，以期能够更快地识别和应对APT威胁。该研究提出了一种基于移动DNS日志的识别机制。DNS（Domain Name System）是互联网的基础服务之一，记录了域名与IP地址的对应关系。由于所有网络通信都涉及到DNS查询，APT攻击者在实施攻击时也必然会产生相应的DNS流量。通过分析这些流量，尤其是移动设备产生的DNS日志，可以捕捉到异常行为和潜在的恶意域。论文可能详细讨论了以下几点： 1. 数据收集：描述了如何收集和处理大规模的移动DNS日志，以确保数据的准确性和代表性。 2. 特征选择：研究可能涉及到了选择能够区分正常和恶意DNS查询的关键特征，如查询频率、域名模式、解析失败率等。 3. 模型构建：可能介绍了一种机器学习或统计模型，用于从特征中识别出与APT活动相关的模式。 4. 性能评估：通过真实或模拟的数据集，评估了所提方法的检测效果，可能包括精确度、召回率和F1分数等指标。 5. 实际应用：可能探讨了这种方法在实际网络防御中的应用潜力，以及与现有安全系统的集成可能性。这篇论文对APT检测领域提供了新的视角，利用移动DNS日志作为切入点，提高了APT威胁的检测效率和及时性，有助于网络安全防护的实时性和有效性。对于理解网络威胁检测的新方法和提升网络安全防护水平具有重要的理论和实践意义。

Research Article

Identifying APT Malware Domain Based on

Mobile DNS Logging

Weina Niu,

1,2

Xiaosong Zhang,

1,2

GuoWu Yang,

Jianan Zhu,

and Zhongwei Ren

School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu,

Sichuan 611731, China

Center for Cyber Security, University of Electronic Science and Technology of China, Chengdu, Sichuan 611731, China

School of Information and Soware Engineering, University of Electronic Science and Technology of China, Chengdu,

Sichuan 610054, China

Correspondence should be addressed to Xiaosong Zhang; johnsonzxs@uestc.edu.cn

Received 25 January 2017; Accepted 7 March 2017; Published 6 April 2017

ademic Editor: Lixiang Li

which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

Advanced Persistent reat (APT) is a serious threat against sensitive information. Current detection approaches are time-

consuming since they detect APT attack by in-depth analysis of massive amounts of data aer data breaches. Specically, APT

attackers make use of DNS to locate their command and control (C&C) servers and victims’ machines. In this paper, we propose

an ecient approach to detect APT malware C&C domain with high accuracy by analyzing DNS logs. We rst extract  features

from DNS logs of mobile devices. According to Alexa ranking and the VirusTotal’s judgement result, we give each domain a score.

en, we select the most normal domains by the score metric. Finally, we utilize our anomaly detection algorithm, called Global

Abnormal Forest (GAF), to identify malware C&C domains. We conduct a performance analysis to demonstrate that our approach

is more ecient than other existing works in terms of calculation eciency and recognition accuracy. Compared with Local Outlier

Factor (LOF), 𝑘-Nearest Neighbor (KNN), and Isolation Forest (iForest), our approach obtains more than % 𝐹-𝑀and 𝑅for the

detection of C&C domains. Our approach not only can reduce data volume that needs to be recorded and analyzed but also can be

applicable to unsupervised learning.

1. Introduction

Advanced Persistent reat (APT) [, ] is an attack that is

launched by the well-funded and skilled organization to steal

high-value information for a long time. APT attackers would

install malware on the compromised machine to build com-

mand and control (C&C) channel aer inltrating into the

targeted network. Most malware makes use of Domain Name

System (DNS) to locate their domain name servers and com-

promised devices. en, APT attackers can establish long-

term connection to victims’ devices for stealing sensitive data.

us, malware C&C domain detection can help security

analysts to block essential stage of APT.

Currently, there are some works to identify C&C domain

by analyzing network trac about PC [–]. BotSnier [],

BotGAD [], and BotMiner [] made use of specic behavior

anomaly (e.g., daily similarity and short life) to detect C&C

involved in a botnet. e main reason is that bot hosts

have group similarity. Other works [–] also distinguish

between malicious domains and normal domains according

to domain-based features, such as domain name string com-

position, registration time, and active time. However, these

detection approaches cannot be applied to APT malware

since APT attackers infect a small number of machines, and

they behave normally to avoid detection. Machine learning

technology is proved to be eective in identifying malware

[]. However, there are few articially marked data of APT

malware. Moreover, normal and abnormal samples overlap

with each other.

In order to address these challenges, we propose an

approach to identifying APT malware domains based on

DNS logs. We conduct experiments to evaluate our proposed

algorithm, called Global Abnormal Forest (GAF), with three

traditional algorithms, namely, Local Outlier Factor (LOF),

Hindawi

Mathematical Problems in Engineering

Volume 2017, Article ID 4916953, 9 pages

https://doi.org/10.1155/2017/4916953

下载后可阅读完整内容，剩余9页未读，立即下载

weixin_38630571

粉丝: 8
资源: 943

移动DNS日志解析：APT恶意软件域识别技术

基于机器学习的恶意软件分类识别研究.pdf

基于开源软件的DNS查询日志分析系统.pdf

基于网络全流量及威胁情报的高级威胁检测体系建设.pptx

Mininet：Python网络模拟中的移动网络，模拟真实移动网络环境

numcodecs-0.10.0-cp39-cp39-win_amd64.whl

【BP时序预测】基于雾凇优化算法RIME-BP实现负荷数据预测单输入单输出附matlab代码.rar

【JCR一区级】Matlab实现北方苍鹰优化算法NGO-CNN-BiLSTM-Attention的故障诊断算法研究.rar

双碳数字化平台及场景应用解决方案（28页 PPT）.pptx

低级编程语言汇编的特性, 项目案例及应用场景

数学建模模板 华为杯，高教杯

最新资源

数学建模模板华为杯，高教杯