TWI524207B - Method of detecting suspicious botnet relay station domain name - Google Patents

Description

Method for detecting domain name of suspicious botnet relay station

The present invention relates to a method for detecting a domain name of a network, and more particularly to a method for detecting a domain name of a suspicious botnet relay station.

Most of the crimes in the online world are borrowed from the botnet. By establishing a botnet, hackers can steal confidential information or manipulate or attack zombies without the user's knowledge, and hackers want to increase protection. It will prevent its IP address from directly connecting to a specific host and its geographical address, so those who establish botnets will connect to the Internet with the domain name.

For enterprises with many personal data and sensitive information of enterprises, how to effectively detect the domain name of the relay station of the suspicious botnet, and achieve a kind of security protection method that prevents the hacker from using the botnet to steal sensitive or confidential information in advance is absolutely one. The technology that is urgently needed.

The existing technology method analyzes the traffic of the DNS (Domain Name System) host, analyzes the domain traffic with similar botnet behaviors such as reconnaissance, and then uses known malicious domain information, such as the ASN standard ( Abstract Syntax Notation) is based on the comparison of the Internet Search Engine and the Internet Search Engine. The result of the patent's return through the Internet search engine is compared to the website analyzed by the malicious program. Go to a website for malware analysis, or If the result of the return is empty, then the analysis domain is judged to be suspicious or malicious.

The present invention is a method for detecting a relay station domain name of a suspicious botnet, and an internet search engine will be used. The concept of the present invention is based on a general legal domain registered under the name of a well-known company, and most well-known companies will also Registering the domain of multiple products, so that the search engine can find a large number of search results or results on the product or company webpage. In contrast, the relay domain uses a private account to register, and the relay itself is not publicly available on the webpage or It is a link record, so it is quite difficult to be searched by the search engine. Therefore, the invention is based on the number of results returned by the search engine, and whether the domain name is a suspicious degree of the botnet relay station. .

The method for detecting the domain name of a relay station of a suspicious botnet in the present invention will also use the query method of WHOIS (https://who.is/), mainly because the WHOIS query can help find the relevant domain of the domain name. Registration information, including the email address of the registrant of the domain name, etc., can use the email address to look up the WHOIS database in reverse to get all the domains registered with the email address, so that these WHOIS can be accessed. Find relevant information to find the set of domain names associated with this domain name.

In the method for detecting a domain name of a relay station of a suspicious botnet, the method for querying a Domain Name System (DNS) record is also used, mainly because the DNS record query can help find the relevant network of the domain name. Domain data, which contains the name server (NS) address stored in the domain name record, and also has its own name server address registered under the domain; thus, the relevant information can be found through these DNS addresses. , Find the set of domain names associated with this domain name.

The purpose of the present invention is to detect the domain name of the relay station of the suspicious botnet. When a suspect domain name is given, the domain name of the first and second level of the suspect domain name is searched by the Internet. The engine performs the search. When the returned result is less than the first-level filter value and the second-level filter value respectively, it indicates that the domain name is a suspicious domain name that can be considered, and the number of returned results. The comparison object, that is, the first-level filter value and the second-level filter value are values that need to be defined beforehand, because this value affects the accuracy of the result of the method; and then further obtains the electronic name of the domain name registrant through the WHOIS query. The email address and the domain of the email address confirm that the email domain is the same as the email domain of the email address domain registrant. If the email domain is the same, the domain is considered for consideration. Domains, and vice versa are not considered.

Then, through the DNS (Domain Name System) query, the name server (NS) and the Start of Authority (SOA) information are also belong to the domain associated with the suspect domain name, so it is also required. In the network domain collection considered together, the next step is to analyze the content of the webpage associated with the suspect domain name in the network collection, and remove all domain name service providers (Domain Name Service Provider). The domain name of the network; the domain name registrant's email address is used to reversely query the WHOIS database, and all the domain collection results registered using the email address are obtained, and the suspect domain name associated with the email address is also considered. In the domain collection, according to the foregoing network domain set, the domain in the network domain collection is provided to the search engine for searching, and the network domain may be further judged according to the result of the number of backhaul searches by the search engine in the relevant domain. If the number of search results of related domains in the collection is less than a certain value (second level filter value), then judge It is suspicious, otherwise it is judged to be legal. This is the method for detecting the domain name of the relay station of the suspicious botnet based on the popularity of the relevant domain.

The present invention excludes legitimate domains through an internet search engine and finds suspicious relay stations. For the domain with few or no results, collect the domain data, and actively query the DNS records of the domain, including the domain of SOA, NS and registrant email addresses, and analyze the WHOIS database to find Other related domains that have the same registrant email. Finally find out the company domain behind it and the relevant domain registered. Based on these extended domain and company information, determine whether the domain is a domain registered by a well-known company, and exclude the domain registered under a well-known company to improve accuracy.

Compared with the prior art, by collecting passive DNS query information, a model is established for known malicious domain features and legitimate domain features, and then this model is used to legally or illegally domain a new domain. Judging that the quality of the training data of the model will directly affect the accuracy of the new domain judgment, so it is necessary to frequently obtain a large amount of training data to update the model. At this time, the maintenance and screening process of the data will generate a large amount of Additional cost.

The present invention provides an instant way to judge and detect a new network domain according to the current situation through the backhaul result of the current network search engine, and does not need to establish a model in advance, so it is not necessary to collect and maintain a large amount of training materials. .

Compared with the prior art, the present invention has the following effects:

1. The present invention can determine the popularity of the domain name, given a domain name, through the relevant process steps of the present invention, can generate the relevant domain collection hierarchy relationship and the number of respective search returns, thereby judging Domain name The degree of popularity.

2. The present invention can associate a collection of other related network domains of the domain name and identify the relevant network domain set. Through the related process steps of the present invention, the relationship between the network domain names can be identified.

3. The present invention can detect the relay station domain name of the suspicious botnet. The invention does not need to obtain relevant connection packet information in advance, and in the case that the botnet exchange message cannot be obtained, the related process steps of the present invention can be used to generate the relevant domain association relationship only through the domain name itself. Detects the relay domain name of the suspicious botnet.

S101~S117‧‧‧Step procedure

S201~S215‧‧‧Step procedure

1 is a flow chart showing the steps of a method for detecting a domain name of a relay station of a suspicious botnet according to the present invention.

FIG. 2 is a schematic flowchart of an embodiment of a method for detecting a domain name of a relay station of a suspicious botnet according to the present invention.

The present invention is described below in conjunction with the drawings. As shown in FIG. 1, the purpose of the present invention is to detect a relay station domain name of a suspicious botnet. When a suspect domain d is given, step S101 is performed to search the Internet search engine. The suspect domain d, that is, the search for the first-level domain name, enters a judgment, that is, the search result of the suspected domain d in step S102 is smaller than the first-level filter value N1, and if it is smaller than the first-level filter value N1, the execution step S103 searches for the second-order network domain name of the suspected domain d on the Internet. If not, it is determined that step S117 is suspected that the domain d is a legal domain.

Step S103 is performed after the Internet searches for the second-order network domain name of the suspected domain d, and then proceeds to the judgment. Step S104 suspects the second-order of the domain d. If the domain name search result is smaller than the second-level filter value N2, if it is smaller than the second-level filter value N2, step S105 is performed to search for the email registrant domain of the suspect domain d by the WHOIS to obtain the mail result w1, and if not, the process proceeds to step S117. The suspected domain d is a legal domain; after step S105, the email registrant domain of the WHOIS search mail result w1 is obtained by the WHOIS in step S106 to obtain the mail result w2, and then the judgment result S1 is determined whether the mail result w1 and the mail result w2 are equal. If yes, step S108 is performed to add the mail result w1 to the data pool. If not, the process goes to step S109 to add the DNS, NS, and SOA search results of the second-level domain name of the suspect domain d to the data pool, and obtain the name server through the DNS query ( Information such as the Name Server, the name server, and the Start Of Authority (SOA) also belong to the domain associated with the suspect domain name, so it must also be included in the set of domains considered.

Step S110 is to obtain the webpage of the data in the data pool, and the next step is to analyze the webpage content associated with the suspected domain name in the network collection, and remove all the domain name service providers (Domain Name). The service Provider) domain name, that is, S111, if the webpage is the domain service provider, the data is deleted; and the domain name registrant's email address is used to reversely query the WHOIS database, that is, the reverse search in step S112. All the data in the data pool will get the results of all the domain collections registered with the email address, and all of them will be included in the set of domain names associated with the suspected domain name, which is the reverse search result in step S113 in the figure. The domain registered with the email address is added to the data pool.

Step S114 searches the Internet search engine for all the data in the data pool, and provides the search engine to the search engine according to the related network domain according to the above-mentioned domain collection. The number of return passes is further judged; again, the final judgment step If the search result of the S115 is smaller than the second-level screening value N2, if the number of search results of the related domain in the network set is smaller than the second-level screening value N2, it is determined that the suspected domain d is a suspicious domain, and vice versa. In step S117, the suspected domain d is a legal domain; the above is a process method for detecting whether the domain name of the relay station is a suspicious botnet based on the visibility of the related domain.

Referring now to FIG. 2, to illustrate a preferred embodiment of the present invention, if a domain name tom.tecpolicy.com is to be tested as a suspicious botnet relay domain name, steps are performed in accordance with the method of the present invention. S201 searches the network domain name tosis.tecpolicy.com in the Internet search engine, that is, firstly searches for the domain name of the first-level domain name using the Internet search engine, and determines whether the search result in step S202 is smaller than the first level. The screening value N1, the number of the search results is indeed smaller than the first level filter value N1, then step S203 is performed on the Internet to search for the second-order domain name www.tecpolicy.com, and it is determined whether the second-order domain name search result in step S204 is smaller than the second-level filter value. N2, the number of search results is lower than the second-level screening value N2, and the domain name WHOIS query determination step S205 of the next step is performed by the WHOIS search email registrant domain to obtain qq.com, the first-level screening value N1 value Slightly greater than zero, the first level filter value N1 and the second level filter value N2 must be defined in the system in advance, and the value will affect the detection of suspicious botnets. Following the station domain method to determine accuracy.

In order to find the relevant domain with the domain name tosis.tecpolicy.com, the WHOIS query will get the email address of the domain registrant. In the embodiment, the email address of the domain registrant is 68972312@qq .com, and can know that the email domain name of the email address is qq.com, and after obtaining the email of the domain registrant after step S205 The domain qq.com, step S206 is performed by WHOIS to search for the qq.com email registrant domain to get tencent.com, because the obtained information shows that the domain registrant email address of the domain qq.com is dns@tencent.com The domain name of dns@tencent.com is tencent.com. Then, it is judged whether step S207 qq.com is equal to tencent.com, the email domain of the domain registrant qq.com and the registrant of the domain registrant's email domain belong to the tencent domain of the email domain After the .com comparison, the results are not equal, so according to the method of the present invention, it is determined that the domain registrant's email domain qq.com does not join the domain collection of the associated domain of the domain name tosis.tecpolicy.com in.

According to the method for detecting the domain name of the suspicious botnet relay station, the domain name of the second layer is queried by using a DNS record. In this embodiment, the domain of the second layer is tecpolicy.com. Thus, the domain that contains the name server, the name server, and the Start Of Authority (SOA) is located, which is hichina.com (the result of the direct query is dns29.hichina.com) And dns30.hichina.com), these domains (tecpolicy.com, hichina.com) are added to the domain collection of the associated domain of the domain name tosis.tecpolicy.com, the above action is step S208 will be The second-order domain name DNS, NS, SOA search results hichina.com join the data pool.

Step S209 is performed to obtain the webpage of the data hichina.com in the data pool, in order to exclude the domain of the domain name service provider (Domain Name Service Provider), the associated domain of the domain name toosis.tecpolicy.com All the domains in the domain collection implement web content analysis. In this embodiment, it is found that the webpage content of www.hichina.com is the domain name service provider, and step S210 hichina.com is used as the domain service according to the rules. The provider deletes the data and removes the domain hichina.com from the domain collection data pool of the associated domain of the domain name tosis.tecpolicy.com.

Step S211 searches for all the data in the data pool in reverse, and searches for the WHOIS database by using the email address 68972312@qq.com according to the email address of the tecpolicy.com domain queried by the WHOIS search method. The collection of all the domains of the email address registrant, comqap.com, erickstar.com, is also added to the domain collection of the associated domain of the domain name toosis.tecpolicy.com. In step S212, the domain comqap.com and erickstar.com registered in the reverse lookup email address are added to the data pool.

At this time, the data pool contains all the considered domain names in the domain collection of the associated domain of the domain name tosis.tecpolicy.com, and step S213 is performed to search all the data in the data pool by the Internet search engine. And judging by the number of results obtained, that is, whether the search result in step S214 is smaller than the second-level screening value N2, and if the search result of the domain name considered includes only a very small amount of return information, That is, the number of pens lower than the defined second-level filter value N2 is performed according to the method of the present invention. Step S215 tosis.tecpolicy.com is suspicious because in this embodiment, this step finds all associated domains. The number of results including comqap.com and erickstar.com in the search engine is less than the second-level screening value N2.

In summary, all the domain names considered in the domain collection of the associated domain that is listed in the domain name tosis.tecpolicy.com are searched by the method for detecting the domain name of the suspicious botnet relay station of the present invention. The number of results is less than the second-level screening value N2, and the diagnosis of tosis.tecpolicy.com is the suspicious botnet relay domain name.

The detailed description of the preferred embodiments of the present invention is intended to be construed as the The patent scope of this case.

In summary, the case is innovative in terms of technical ideas, and also has multiple functions that are not in the prior art. It has fully complied with the statutory invention patent requirements of novelty and progressiveness, and has filed a patent application according to law. You are requested to approve the invention patent. The application is to invent the invention, and it is a matter of feeling.

S101~S117‧‧‧Step procedure

Claims (3)

A method for detecting a domain name of a suspicious botnet relay station, the method comprising: setting a search engine module in a suspect network search system, wherein the search engine module is provided with a first level filter value; and the suspect network An associated search module is disposed in the search system, and the associated search module is coupled to the search engine module, and a second-level filter value is set in the associated search module; an analysis module is set in the suspect network search system. a group, the analysis module is coupled to the search engine module and the associated search module; the search engine module searches for a suspect domain name through an internet search engine, if the number of matching results is less than the first level Filtering the value, generating a first-level screening information and transmitting the information to the analysis module and the associated search module; the associated search module generates a second-level suspect domain name according to the first-level screening information, and according to the second The suspected domain name is searched, and if the matching result is less than the second-level screening value in the associated search module, the association judgment rule is adopted. Information associated with a green filter and transmitted to the analysis module; and a first filter information and the hierarchy information associated with the screening analysis module analyzes and generates a determination result. The method for detecting a domain name of a suspicious botnet relay station according to the scope of claim 1, wherein the association judgment rule comprises the following steps: the association search module obtains a domain registrant of the second-level suspect domain name through WHOIS query. The domain to which the email address belongs and the domain to which the registrant of the domain to which the domain registrant email address belongs; The association search module queries the domain of the domain registrant of the domain to which the domain registrant email address belongs by WHOIS, and the domain to which the registrant of the domain to which the domain registrant email address belongs belongs and the domain The registrant email address belongs to the same domain, and generates a mail address domain result information according to the domain to which the domain registrant email address belongs; and the associated search module queries the second through a DNS (Domain Name System) record. The hierarchical suspect domain name derives information such as the name server, the name server system, and the authorization start record, and combines with the email address domain result information to generate the association screening information. The method for detecting a domain name of a suspicious botnet relay station according to claim 2, wherein the analyzing module analyzes the first-level screening information and the associated screening information and generates the determination result, and further comprises the following steps: the analyzing module Include a data pool, the data pool is used to receive the association screening information; the analysis module performs webpage analysis on the first-level screening information and the association screening information, and filters and removes the domain name of the domain name service provider Adding the remaining information to the data pool; the analysis module performs reverse lookup through the associated search module according to the email result information of the email address in the association filtering information, and adds all the domains registered by the email address to the data pool; And the analysis module searches all the information in the data pool through the search engine module on the Internet. If the number of matching results is less than the second-level screening value, the suspect domain name is determined to be suspicious, if the search result is If the number of matches is less than the filter value of the second level, the suspect domain name is determined to be legal.