Abstract:As sensors become more prevalent in our lives, security issues have become a major concern. In the Advanced Persistent Threat (APT) attack, the sensor has also become an important role as a transmission medium. As a relatively weak link in the network transmission process, sensor networks often become the target of attackers. Due to the characteristics of low traffic, long attack time, diverse attack methods, and real-time evolution, existing detection methods have not been able to detect them comprehensively. Current research suggests that a suspicious domain name can be obtained by analyzing the domain name resolution (DNS) request to the target network in an APT attack. In past work based on DNS log analyses, most of the work would simply calculate the characteristics of the request message or the characteristics of the response message or the feature set of the request message plus the response message, and the relationship between the response message and the request message was not considered. This may leave out the detection of some APT attacks in which the DNS resolution process is incomplete. This paper proposes a new feature that represents the relationship between a DNS request and the response message, based on a deep learning method used to analyze the DNS request records. The algorithm performs threat assessment on the DNS behavior to be detected based on the calculated suspicious value. This paper uses the data of 4, 907, 147, 146 DNS request records (376, 605, 606 records after DNS Data Pre-processing) collected in a large campus network and uses simulation attack data to verify the validity and correctness of the system. The results of the experiments show that our method achieves an average accuracy of 97.6% in detecting suspicious DNS behavior, with the orange false positive (FP) at 2.3% and the recall at 96.8%. The proposed system can effectively detect the hidden and suspicious DNS behavior in APT.

MalHunter: Performing a Timely Detection on Malicious Domains Via a Single DNS Query.

Discovering Malicious Domains through Alias-Canonical Graph

MalShoot: Shooting Malicious Domains Through Graph Embedding on Passive DNS Data.

Malicious domain detection based on multiple-dimensional features

Malicious DNS detection by combining improved transformer and CNN

A Survey on Malicious Domains Detection through DNS Data Analysis

HinDom: A Robust Malicious Domain Detection System based on Heterogeneous Information Network with Transductive Classification

Detection of Malicious Domain Names Based on Hidden Markov Model

Domainobserver: A Lightweight Solution For Detecting Malicious Domains Based On Dynamic Time Warping

HGDom: Heterogeneous Graph Convolutional Networks for Malicious Domain Detection

DNSRadar: Outsourcing Malicious Domain Detection Based on Distributed Cache-Footprints

Detecting Domain-Flux Malware Using Dns Failure Traffic

Detecting malware based on DNS graph mining

Network Detection of Malicious Domain Name Based on Adversary Model

Deepdom: Malicious Domain Detection with Scalable and Heterogeneous Graph Convolutional Networks

A Multi-feature-based Approach to Malicious Domain Name Identification from DNS Traffic

Discovering Suspicious APT Behaviors by Analyzing DNS Activities

Identifying APT Malware Domain Based on Mobile DNS Logging

A Malicious Domain Detection Model Based on Improved Deep Learning

HANDOM : Heterogeneous Attention Network Model for Malicious Domain Detection

DNS Surveillance on Backbone