基于DNS查询行为的Bot检测

Bot detection based on DNS query activities

提出一种基于DNS查询行为的检测方法。根据Bot的自动运行特性,从DNS查询的角度对主机中的进程进行初步过滤,缩小检测范围;分析Bot与其他进程的DNS反应行为模式的异同,构建Bot-DNS检测模型,在此基础上判断可疑进程是否为Bot。实验结果表明,该方法能够检测出处于生命周期早期阶段的Bot,且检测过程与Bot采用的协议结构无关,具有较好的检测效果。

This paper proposes a new method of identifying Bot based on DNS query activities. Firstly, as Bots usually run automatically, detection rage is narrowed down from the point of view of DNS query. Secondly, a Bot-DNS detection model is created on differences of DNS reaction behavior between Bots and normal processes, to judge whether the suspi- cious process is Bot. The experimental results show that the method can detect Bots in the early stage. It is independent of protocol and structure, and has a better detection effect.