计算机工程 ›› 2020, Vol. 46 ›› Issue (5): 174-180.doi: 10.19678/j.issn.1000-3428.0055037

• 网络空间安全 • 上一篇    下一篇

基于域名关联的恶意移动应用检测研究

蔡荣彦1, 王鹤2, 姚启桂2, 何高峰3,4   

  1. 1. 国网福建省电力有限公司, 福州 350003;
    2. 全球能源互联网研究院有限公司, 南京 210003;
    3. 南京邮电大学 物联网学院, 南京 210023;
    4. 东南大学 计算机网络和信息集成教育部重点实验室, 南京 211189
  • 收稿日期:2019-05-27 修回日期:2019-08-07 发布日期:2019-08-14
  • 作者简介:蔡荣彦(1984-),女,高级工程师,主研方向为信息安全、数据挖掘与分析;王鹤,工程师、硕士;姚启桂,硕士;何高峰(通信作者),讲师、博士。
  • 基金项目:
    国家自然科学基金青年基金项目"面向网络加密流量的恶意移动应用检测研究"(61702282);江苏省高等学校自然科学研究面上项目"面向移动应用加密流量的恶意攻击检测研究"(17KJB520023)。

Research on Malicious Mobile Application Detection Based on Domain Name Association

CAI Rongyan1, WANG He2, YAO Qigui2, HE Gaofeng3,4   

  1. 1. State Grid Fujian Electric Power Co., Ltd., Fuzhou 350003, China;
    2. Global Energy Internet Research Institute Co., Ltd., Nanjing 210003, China;
    3. College of Internet of Things, Nanjing University of Posts and Telecommunications, Nanjing 210023, China;
    4. Key Laboratory of Computer Network and Information Integration of Ministry of Education, Southeast University, Nanjing 211189, China
  • Received:2019-05-27 Revised:2019-08-07 Published:2019-08-14

摘要: 为实现对恶意移动应用的准确检测以保障移动设备安全,提出一种基于域名关联的恶意移动应用检测方法。以DNS域名为检测分析对象识别网络流量中的恶意域名,利用DNS请求流量的时间特征寻找恶意域名的相关联域名,并将关联域名与文本分类样本库进行比对,确定恶意移动应用名称。实验结果表明,该方法可有效用于移动设备的安全防护,其在公开测试数据集中的检测率达到97.1%,在实际网络的部署运行中共检测出13款恶意移动应用,且误报数量为0。

关键词: 恶意域名, 时间特征, 域名关联, 文本检索, 分类

Abstract: In order to realize the accurate detection of malicious mobile applications and ensure the security of mobile devices,a malicious mobile application detection method based on DNS is proposed.DNS domain name is used as the analysis object of detection to identify the malicious domain name in the network traffic,the time characteristics of DNS request traffic are used to find the associated domain name of the malicious domain name,and the associated domain name is compared with the text classification sample library to determine the name of the malicious mobile application.The experimental results show that this method can be effectively applied to the security protection of mobile devices.The detection rate of this method in the public test data set is 97.1%,and a total of thirteen malicious mobile applications are detected in the actual network deployment,and the number of false positives is 0.

Key words: malicious domain name, time characteristic, domain name association, text retrieval, classification

中图分类号: