微信服务号

微信订阅号

2025年3月24日 10:15 星期一
首页 > 过刊浏览>2017年第28卷第9期 >2370-2387. DOI:10.13328/j.cnki.jos.005186
PDF HTML阅读 XML下载 导出引用 引用提醒
面向主干网的DNS流量监测
作者:
基金项目:

国家科技支撑计划（2008BAH37B04）；国家基础研究发展计划（973）（2009CB320505）；国家自然科学基金（60973123）


DNS Surveillance on Backbone
Author:
  • ZHANG Wei-Wei

    ZHANG Wei-Wei

    School of Computer Science and Engineering, Southeast University, Nanjing 210096, China;Jiangsu Provincial Key Laboratory of Computer Network Technology, Nanjing 210096, China;Key Laboratory of Computer Network and Information Integration of Ministry of Education(Southeast University), Nanjing 210096, China
    在期刊界中查找
    在百度中查找
    在本站中查找
  • GONG Jian

    GONG Jian

    School of Computer Science and Engineering, Southeast University, Nanjing 210096, China;Jiangsu Provincial Key Laboratory of Computer Network Technology, Nanjing 210096, China;Key Laboratory of Computer Network and Information Integration of Ministry of Education(Southeast University), Nanjing 210096, China
    在期刊界中查找
    在百度中查找
    在本站中查找
  • LIU Shang-Dong

    LIU Shang-Dong

    School of Computer Science and Engineering, Southeast University, Nanjing 210096, China;Jiangsu Provincial Key Laboratory of Computer Network Technology, Nanjing 210096, China;Key Laboratory of Computer Network and Information Integration of Ministry of Education(Southeast University), Nanjing 210096, China
    在期刊界中查找
    在百度中查找
    在本站中查找
  • HU Xiao-Yan

    HU Xiao-Yan

    School of Computer Science and Engineering, Southeast University, Nanjing 210096, China;Jiangsu Provincial Key Laboratory of Computer Network Technology, Nanjing 210096, China;Key Laboratory of Computer Network and Information Integration of Ministry of Education(Southeast University), Nanjing 210096, China
    在期刊界中查找
    在百度中查找
    在本站中查找
Fund Project:

National Key Technology Research and Development Program of the Ministry of Science and Technology of China (2008BAH37B04); National Program on Key Basic Research Program of China (973) (2009CB320505); National Natural Science Foundation of China (60973123)

  • 摘要
    • | |
  • 访问统计
    • |
  • 参考文献
    • |
  • 相似文献
    • |
  • 引证文献
    • | |
  • 文章评论
    摘要:

    面对ISP主干网，为了检测威胁其管理域内用户安全的僵尸网络、钓鱼网站以及垃圾邮件等恶意活动，实时监测流经主干网边界的DNS交互报文，并从域名的依赖性和使用位置两个方面刻画DNS活动行为模式，而后，基于有监督的多分类器模型，提出面向ISP主干网的上层DNS活动监测算法DAOS （binary classifier for DNS activityobservation system）.其中，依赖性从用户角度观察域名的外在使用情况，而使用位置则关注区域文件中记录的域名内部资源配置.实验结果表明：该算法在不依赖先验知识的前提下，经过两小时的DNS活动观测，可以达到90.5%的检测准确率，以及2.9%的假阳性和6.6%的假阴性.若持续观察1周，准确率可以上升到93.9%，假阳性和假阴性也可以下降到1.3%和4.8%.

    Abstract:

    Focusing on ISP backbone, this paper presents a method to detect malicious activities such as botnets, phishing and spam that threaten user security in the domain by monitoring DNS interaction messages through the network boundary in real time. The method depicts DNS behavior patterns based on dependency and position attribute. Then, the paper proposes a supervised classifier based DNS activity detecting algorithm DAOS (binary classifier for DNS activity observation system). Dependency attribute is used to describe external usage of the domain name from perspective of DNS customer, while position attribute is used to describe resource allocation of records in the zone file. Experimental results show that the algorithm, with a DNS data source in 2 hours, can achieve 90.5% of accuracy, 2.9% of false positive, and 6.6% of false negative without prior knowledge. If the observation is kept for a week, accuracy rises up to 93.9%, false positive and false negative can descend to 1.3% and 4.8%.

    参考文献
    相似文献
    引证文献
引用本文

张维维,龚俭,刘尚东,胡晓艳.面向主干网的DNS流量监测.软件学报,2017,28(9):2370-2387

复制
分享
文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2016-07-11
  • 最后修改日期:2017-01-06
  • 在线发布日期: 2017-09-02
文章二维码
友情链接:中国科学院软件研究所中国计算机学会中国科学院国家自然科学基金委员会CCF数字图书馆Int'l J of Softw Info计算机系统应用
您是第19727500位访问者
版权所有：中国科学院软件研究所 京ICP备05046678号-3
地址：北京市海淀区中关村南四街4号,邮政编码：100190
电话：010-62562563 传真：010-62562533 Email：jos@iscas.ac.cn
技术支持：北京勤云科技发展有限公司

京公网安备 11040202500063号