高级持续性威胁中隐蔽可疑DNS行为的检测

发布时间：2018-03-04 19:14

本文选题：高级持续威胁　切入点：DNS请求数据　出处：《计算机研究与发展》2017年10期 　论文类型：期刊论文

【摘要】：近年来,高级持续性威胁(advanced persistent threats,APT)危害企业、组织甚至国家安全,给目标带来了巨大的经济损失,其重要特征是攻击持续时间跨度大,在目标网络内长期潜伏.现有的安全防御措施还无法有效检测APT.现有研究认为通过分析APT攻击中目标网络的DNS请求,可以帮助检测APT攻击.增加DNS流量中的时间特征结合变化向量分析和信誉评分方法来检测隐蔽可疑的DNS行为.提出一种协助检测APT的框架APDD,通过分析大量的DNS请求数据检测长时间周期下APT中隐蔽可疑的DNS行为.将收集到的DNS请求数据执行数据缩减并提取特征;利用变化向量分析方法(change vector analysis,CVA)和滑动时间窗口方法分析待检测域名访问记录与现有APT相关域名之间的相似度;建立一个信誉评分系统对相似度较高的待检测域名访问记录进行打分;APDD框架输出一个可疑域名访问记录排名列表,可用于后续人工优先分析最可疑的记录,从而提高APT攻击的检测效率;利用一个大型校园网中收集的包含1 584 225 274条DNS请求记录的数据加入仿真攻击数据来验证框架的有效性与正确性,实验结果表明:提出的框架可以有效地检测到APT中隐蔽可疑的DNS行为.
[Abstract]:In recent years, advanced persistent threats (advanced persistent threats) have jeopardized enterprises, organizations and even national security, causing huge economic losses to targets. Existing security defense measures can not effectively detect APT.existing studies believe that by analyzing the DNS requests of the target network in APT attacks, It can help detect APT attacks. Add time characteristics in DNS traffic and combine change vector analysis and reputation scoring method to detect covert suspicious DNS behavior. A framework to assist detection of APT is proposed, by analyzing a large number of DNS requests. The data is used to detect the suspicious DNS behavior in the APT over a long period of time. The collected DNS request data is reduced and the features are extracted. Change vector analysis (CVA) and sliding time window method are used to analyze the similarity between the access record of domain name to be detected and the existing APT domain name. A reputation scoring system is established to evaluate the access records of domain names to be detected with high similarity. APDD framework outputs a list of suspicious domain name access records, which can be used to analyze the most suspicious records manually. In order to improve the efficiency of APT attack detection, the data collected from a large campus network including 1 584,225,274 DNS requests are added to the simulation attack data to verify the validity and correctness of the framework. Experimental results show that the proposed framework can effectively detect the hidden suspicious DNS behavior in APT.
【作者单位】：吉林大学计算机科学与技术学院;符号计算与知识工程教育部重点实验室(吉林大学);吉林大学大数据和网络管理中心;
【基金】：国家自然科学基金项目(61472162,61772229)~~
【分类号】：TP309

【相似文献】