受APT攻击的网络实验室域名智能检测仿真

Simulation of Domain Name Intelligent Detection in Network Laboratory Attacked by APT

网络实验室本身具有网络系统攻击测试、安全性检测以及安全应急响应训练等功能,但是仍无法检测出APT(高级可持续威胁)攻击的域名。为此提出一种网络实验室受APT攻击的域名检测方法。通过白名单过滤全部域名,根据网络特征和词汇属性提取网络实验室受APT攻击的域名特征。利用域名特征获取域名的二级域名长度分布阈值,通过阈值检测待检测的网络实验室受APT攻击的域名,最终得到准确的APT攻击域名检测结果。仿真结果表明,所提方法能够获取比较准确的域名检测结果,同时还能够提升测试时间。

The network laboratory inherently has the functions of network system attack test, security detection and emergency response training, but it is still unable to detect the domain name attacked by Advanced Persistent threat(APT). Therefore, a method to detect the domain name of network laboratory attacked by APT was proposed. All domain names were filtered through the white list at first. According to network characteristics and vocabulary attributes, the characteristics of the domain name of network laboratory attacked by APT were extracted. Then, domain name characteristics were used to obtain the threshold of subdomain length distribution. After that, the threshold was used to detect the domain name of network laboratory attacked by APT. Finally, the accurate detection result was obtained. Simulation results show that the proposed method can not only obtain more accurate results of domain name detection, but also reduce the test time.