JP5639535B2 - Benign domain name exclusion device, benign domain name exclusion method, and program - Google Patents

Description

  The present invention relates to a technique for detecting a bot-infected terminal, and particularly relates to a technique for excluding a benign domain name included in a malignant domain list for identifying a bot-infected terminal.

  A method for monitoring DNS traffic has been proposed as a method for detecting a terminal infected with a malicious program bot. In this method, a user (user terminal) that inquires a DNS server for a domain name (malignant domain name) of a communication partner peculiar to the bot is determined as a bot-infected user terminal. In addition, a method using a honeypot has been proposed to acquire a malignant domain name. A honeypot is a terminal that simulates OS vulnerabilities, and has the function of capturing bots that perform infection activities, analyzing bot behavior, and extracting malignant domain names.

  Honeypots can efficiently catch bots and collect malignant domain lists. However, the bot may attempt to access a benign domain name other than the bot-specific communication partner to confirm network connectivity. Since DNS is also used when bots access benign domain names, benign domain names are included in the list of malignant domains collected by honeypots. If this malignant domain list is used as it is, the terminal that inquires the DNS server for the benign domain name also becomes a bot-infected person, and there is a problem that the detection accuracy is lowered.

  In order to prevent a decrease in detection accuracy, it is necessary to manually determine whether or not the domain name included in the list is benign by visual inspection etc., but depending on the size of the list, not all benign domain names can be excluded. Problems such as oversight occur.

  In addition, there exists a nonpatent literature 1 as a prior art document of this application. This document discloses a method for discovering an unknown malignant domain and expanding an existing malignant domain list based on the co-occurrence relationship of DNS queries sent by users.

  Another prior art document is Non-Patent Document 2. This document discloses a technique for detecting a benign domain name from a malignant domain list. In this technique, a domain kernel is scored using a graph kernel (Non-patent Document 3).

  Moreover, there exists a nonpatent literature 4 as another prior art literature. This document discloses a technique for discovering an unknown malignant domain name using information of an existing malignant domain name and its registrant. This technology is based on the idea that if a malicious registrant registers a domain name other than an existing malignant domain name, the domain name is also likely to be malignant.

K. Sato, K. Ishibashi, T. Toyono, and N. Miyake, "Extending Black Domain Name List by Using Co-occurrence Relation between DNS Queries," Proceedings of the 3rd USENIX Workshop on Large-Scale Exploits and Emergent Threats, 2010 Keisuke Ishibashi, Tsuyoshi Toyono, Kazumichi Sato, Makoto Iwamura, "Malignant domain name list evaluation using DNS query graph," Internet Architecture Study Group, 2009 R. L. Kondor, "Diffusion Kernels on Graphs and Other Discrete Input Spaces," Proceedings of the 19th International Conference on Machine Learning, 2002 M. Felegyhazi, C. Kreibich, and V. Paxon, "On the Potential of Proactive Domain Blacklisting," Proceedings of the 3rd USENIX Workshop on Large-Scale Exploits and Emergent Threats, 2010

  The present invention has been made in view of the above problems, and extracts and excludes benign domain names included in the malignant domain list, and improves the accuracy of detection of bot-infected terminals by increasing the accuracy of the malignant domain list. The purpose is to provide the technology that has been made possible.

In order to solve the above problems, the present invention is a benign domain name exclusion device for excluding benign domain names from a malignant domain list,
A malignant domain list storage means for storing a malignant domain list;
Score calculating means for calculating a score for determining whether or not the domain name corresponds to a benign domain name for a domain name included in the malignant domain list;
Determination means for determining whether the domain name of the score corresponds to a benign domain name based on the score calculated by the score calculation means;
A benign domain name excluding device comprising a new malignant domain list generating means for generating a new malignant domain list by excluding a domain name determined to be a benign domain name by the determining means from the malignant domain list,
The benign domain name exclusion device further includes traffic information storage means for storing traffic information related to an inquiry from a user terminal to a DNS server,
The score calculation means calculates a co-occurrence frequency in the traffic information regarding a domain name and another domain name included in the malignant domain list, and determines that the greater the co-occurrence frequency, the more benign domain name It is configured as a benign domain name exclusion device comprising first score calculation means for calculating a score of the certain domain name so as to be easily sized.

Further, the present invention is a benign domain name exclusion device for excluding benign domain names from a malignant domain list,
A malignant domain list storage means for storing a malignant domain list;
Score calculating means for calculating a score for determining whether or not the domain name corresponds to a benign domain name for a domain name included in the malignant domain list;
Determination means for determining whether the domain name of the score corresponds to a benign domain name based on the score calculated by the score calculation means;
A benign domain name excluding device comprising a new malignant domain list generating means for generating a new malignant domain list by excluding a domain name determined to be a benign domain name by the determining means from the malignant domain list,
The benign domain name excluding device further comprises DNS server information storage means for storing domain name information registered by the DNS server,
The score calculation means acquires a domain name owned by a DNS server that has registered a domain name included in the malignant domain list from the DNS server information storage means, and an organization name of the domain name The second score calculation for calculating the score of the certain domain name so that the value indicating the variation of the label representing the value is more easily determined as the value indicating the variation is smaller. You may comprise as a benign domain name exclusion apparatus provided with a means.

Further, the present invention is a benign domain name exclusion device for excluding benign domain names from a malignant domain list,
A malignant domain list storage means for storing a malignant domain list;
Score calculating means for calculating a score for determining whether or not the domain name corresponds to a benign domain name for a domain name included in the malignant domain list;
Determination means for determining whether the domain name of the score corresponds to a benign domain name based on the score calculated by the score calculation means;
A benign domain name excluding device comprising a new malignant domain list generating means for generating a new malignant domain list by excluding a domain name determined to be a benign domain name by the determining means from the malignant domain list,
The benign domain name excluding device includes a traffic information storage unit that stores traffic information related to an inquiry from a user terminal to a DNS server, and a DNS server information storage unit that stores information on a domain name registered by the DNS server. In addition,
The score calculation means includes
Calculate the co-occurrence frequency in the traffic information for a domain name and other domain names included in the malignant domain list, and the score of the certain domain name is set so that the score decreases as the co-occurrence frequency increases. First score calculating means for calculating;
A DNS server that registers a domain name included in the malignant domain list obtains another domain name owned from the DNS server information storage unit, and the variation in the label indicating the organization name of the domain name is detected. A benign domain name excluding apparatus , comprising: a second score calculating unit that calculates a score of the certain domain name so that the score decreases as the value indicating the variation decreases. You may comprise as .

  In the benign domain name exclusion device, the determination unit calculates the score calculated by the first score calculation unit and the second score calculation unit as a score of a domain name included in the malignant domain list. It is good also as calculating the score which combined the score obtained. Further, the determination means determines a benign domain name in which the score obtained by combining the score calculated by the first score calculation means and the score calculated by the second score calculation means is smaller than a predetermined value. You may make it determine with corresponding to a domain name.

  The present invention can also be configured as a program for causing a computer to function as each means of each of the benign domain name exclusion devices.

Further, the present invention is a benign domain name exclusion method executed by a benign domain name exclusion device that excludes benign domain names from a malignant domain list,
A score for calculating a score for determining whether the domain name corresponds to a benign domain name for a domain name included in the malignant domain list stored in the malignant domain list storage means storing the malignant domain list A calculation step;
A determination step of determining whether the domain name of the score corresponds to a benign domain name based on the score calculated by the score calculation step;
Wherein by excluding the domain name is determined to correspond to benign domain name from the malignant domain list by determining step, benign domain name exclusion method Ru and a new malignant domain list generation step of generating a new malignant domain list ,
The benign domain name exclusion device includes traffic information storage means for storing traffic information related to an inquiry from a user terminal to a DNS server,
The score calculating step calculates a co-occurrence frequency in the traffic information regarding a certain domain name and other domain names included in the malignant domain list, and determines that the higher the co-occurrence frequency is, the more benign domain name is. The benign domain name exclusion method may include a first score calculation step of calculating a score of the certain domain name so as to be easily sized .
Further, the present invention is a benign domain name exclusion method executed by a benign domain name exclusion device that excludes benign domain names from a malignant domain list,
A score for calculating a score for determining whether the domain name corresponds to a benign domain name for a domain name included in the malignant domain list stored in the malignant domain list storage means storing the malignant domain list A calculation step;
A determination step of determining whether the domain name of the score corresponds to a benign domain name based on the score calculated by the score calculation step;
A benign domain name exclusion method comprising a new malignant domain list generating step of generating a new malignant domain list by excluding the domain name determined to be a benign domain name by the determining step from the malignant domain list;
The benign domain name excluding device includes a DNS server information storage unit that stores information on a domain name registered by a DNS server,
In the score calculation step, a DNS server that registers a domain name included in the malignant domain list obtains another domain name owned from the DNS server information storage unit, and an organization name of the domain name The second score calculation for calculating the score of the certain domain name so that the value indicating the variation of the label representing the value is more easily determined as the value indicating the variation is smaller. It can also be configured as a benign domain name exclusion method characterized by comprising steps.

  According to the present invention, it is possible to determine a benign domain name from domain names included in a malignant domain list, exclude it from the malignant domain list, increase the accuracy of the list, and increase the accuracy of detecting a bot-infected terminal. It becomes possible.

It is a figure for demonstrating the outline | summary of the behavior of DNS and a bot. It is a figure which shows an example in case the dispersion | variation in the organization part of the domain name registered into a DNS server is large. It is a figure which shows an example in case the dispersion | variation in the organization part of the domain name registered into a DNS server is small. It is a functional lineblock diagram of benign domain name exclusion device 10 concerning an embodiment of the invention. 4 is a flowchart showing a processing operation of the benign domain name excluding device 10. It is explanatory drawing which shows the score calculation for excluding the domain name of the major site contained in a malignant domain list. It is explanatory drawing which shows score calculation for excluding domain names, such as a company and a university, included in a malignant domain list.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention is not limited to the following embodiments.

(Outline of the embodiment, assumptions, etc.)
Before describing in detail the apparatus and processing contents according to the embodiment, first, the outline of the embodiment, the presupposed matters, and the like will be described.

<Overview>
When a bot attacks another person, it communicates with a server specific to that bot in order to receive an attack command. In order for a bot (bot-infected terminal) to communicate, it is necessary to know the IP address of the server, and it is known that the bot uses DNS. DNS is a domain name / IP address mapping service. When a DNS server receives a domain name query from a user, it returns the corresponding IP address.

  Figure 1 shows an overview of DNS and bot behavior examples. As shown in FIG. 1, in order for the bot-infected terminal to access the bot control server (evil.com), first, the DNS server is inquired about the IP address of evil.com (step 1). The bot-infected terminal acquires the IP address of the bot control server from the DNS server (step 2), accesses the bot control server using the IP address (step 3), and receives an attack command from the bot control server (step) 4).

  It is possible to identify a bot-infected terminal by collecting information (malignant domain name) of a communication partner specific to the bot and monitoring a user (user terminal) attempting to access the partner. The malignant domain list can be generated using a terminal called a honeypot. However, since the generated list includes a benign domain, it is necessary to exclude it.

  In this embodiment, paying attention to the correspondence between user terminals and domain names, and domain names and DNS authoritative servers, benign domain names are extracted from the malignant domain list. Here, in the present embodiment, it is assumed that the user terminal, domain name, DNS authoritative server information, and malignant domain list are collected in advance.

<Organization name included in domain name>
When attention is paid to the character string of the domain name, the character string representing the organization name or the like may be included therein. For example, if the domain name is “www.ntt.co.jp”, the organization name “ntt” is included. These often appear to the left of one domain such as "co.jp" or "com". Domains like com and co.jp are called public suffixes (see http://publicsuffix.org/ for example), and their lists are publicly available. In the present embodiment, the organization part of the domain name is the left part of the public suffix.

<Malignant domain name features>
As a characteristic of the malignant domain name, there is a characteristic that the domain name is frequently changed in order to prevent communication between the bot in the malignant domain list and the server that controls the bot (see, for example, Non-Patent Document 4). Therefore, bot producers often use inexpensive domain name registration services. Various domain names are registered in the DNS server that provides such a service, and the organization parts of these domain names are various, and the variation is large. Such an example is shown in FIG.

<Characteristics of benign domain names>
A typical benign domain name is the domain name of a company or university server. These companies and universities often operate their own DNS servers and register domain names. In that case, the domain names registered in the DNS server are only those of the own organization, and there is little variation in the organization part of those domain names. Such an example is shown in FIG. In this example, the domain name owned by the DNS server of a certain organization xxx is www.xxx.jp, mail.xxx.jp, smtp.xxx.jp, dhcp.xxx.jp, etc. Are the same.

<Benign domain included in malignant domain list>
In the present embodiment, the benign domains to be excluded included in the malignant domain list are the following types.

(1) Domain name of major site As described above, a bot may communicate with a terminal other than the bot-specific communication partner to confirm connectivity with the Internet. In order to efficiently check the connectivity, it is only necessary to check the connectivity with the server that seems to be operating at all times. Therefore, the bot accesses famous websites such as google (registered trademark) and microsoft (registered trademark). Thus, the malignant domain list generated by the honeypot includes these domain names. Such domain names are frequently accessed by many users who are not infected with bots, and therefore need to be removed from the malignant domain list.

(2) Domain names of companies, universities, etc. In addition to using a cheap domain name registration service to create a control server, bot producers may hijack existing servers with vulnerabilities and establish control servers. . Such servers include servers owned by companies and universities. Although these are malignant domain names, general users who are not infected with the bot are also accessing the bot-specific communication partner, so it is necessary to remove them from the malignant domain list.

  In the present embodiment, the above two types of benign domain names are removed from the malignant domain list.

(Device configuration)
FIG. 4 shows a functional configuration diagram of the benign domain name excluding apparatus 10 according to the present embodiment. As shown in FIG. 4, the benign domain name exclusion device 10 according to the present embodiment includes a score calculation unit 11, a benign domain name determination unit 12, a new malignant domain list generation unit 13, a DNS traffic information storage unit 14, a DNS authority. It has a server information storage unit 15, a malignant domain list storage unit 16, and a new malignant domain list storage unit 17.

  The score calculation unit 11 includes a first score calculation unit 111 and a second score calculation unit 112. The first score calculation unit 111 is a functional unit that calculates a score from the co-occurrence relationship of malignant domain names, and the second score calculation unit 112 is a functional unit that calculates a score from the correspondence relationship between the domain name and the DNS authority server. is there. A detailed example of score calculation will be described later.

  The benign domain name determination unit 12 is a functional unit that determines whether each domain name in the malignant domain list is a benign domain name based on the score calculated by the score calculation unit 11. The new malignant domain list generation unit 13 is a functional unit that generates a new malignant domain list by excluding the domain names determined to be benign by the benign domain name determination unit 12 from the malignant domain list.

  The DNS traffic information storage unit 14 stores DNS traffic information collected by monitoring traffic in an IP network (Internet) to which many user terminals are connected. For example, the DNS traffic information storage unit 14 is associated with identification information (such as an IP address) of a user terminal, a domain name that the user terminal has inquired about (accessed), identification information of a DNS authority server that is the inquiry destination, and the like. Stored.

  In the present embodiment, the DNS traffic collection method is not limited to a specific method. Any method may be used as long as the information necessary for calculating the score described in this embodiment can be collected. In addition, the DNS traffic may be collected by the benign domain name excluding device 10 or may be collected by a network monitoring device outside the benign domain name excluding device 10 and the collected information may be stored in a DNS traffic information storage unit. 14 may be stored.

  In the DNS authoritative server information storage unit 15, for example, identification information of a DNS authoritative server and a list of domain names managed by the DNS authoritative server are stored in association with each other. The DNS authoritative server information stored in the DNS authoritative server information storage unit 15 may be information extracted from the DNS traffic information, or may be information obtained by other methods. The method is not limited to a specific method. Any method may be used as long as the information necessary for calculating the score described in this embodiment can be collected.

  The malignant domain list storage unit 16 stores a malignant domain list (a list of domain names) collected using the honeypot described above. The new malignant domain list storage unit 17 stores a new malignant domain list in which benign domain names are excluded from the malignant domain list by the method of the present embodiment. In addition, it is good also as a new malignant domain list | wrist by deleting a benign domain name from the malignant domain list | wrist initially stored in the malignant domain list storage part 16, without providing the new malignant domain list storage part 17. FIG.

  The benign domain name excluding apparatus 10 according to the present embodiment realizes the functions of the functional units of the benign domain name excluding apparatus 10 in a computer (including a communication apparatus having a computer function) including a CPU, a storage device, and the like. This can be realized by executing a program for executing the program. The program may be installed in a computer from a recording medium such as a portable memory, or may be downloaded from a server on the network. In addition, an embodiment in which the score calculation unit 11, the benign domain name determination unit 12, and the new malignant domain list generation unit 13 of the benign domain name exclusion device 10 are configured as hardware circuits and incorporated in other devices is possible.

  Note that, in the benign domain name exclusion device 10, the second score calculation unit such as a case where the benign domain name can be appropriately determined even if the benign domain name is determined only by the score calculated by the first score calculation unit 111. 112 and the DNS authoritative server information storage unit 15 may not be provided. As such a case, for example, a case where it is assumed that a domain name such as a company or a university is not included in the original malignant domain list may be considered.

  Further, in the benign domain name exclusion device 10, the first score calculation unit, such as when the benign domain name can be appropriately determined even if the benign domain name is determined only by the score calculated by the second score calculation unit 112. 111 and the DNS traffic information storage unit 14 may not be provided. As such a case, for example, it may be assumed that the domain name of a company or university is included in the original malignant domain list but the domain name of a major site is not included. It is done.

  However, in the present embodiment, both the first score calculation unit 111 and the second score calculation unit 112 are included.

(Device operation)
Next, benign domain name exclusion processing executed by the benign domain name excluding apparatus 10 will be described along the procedure of the flowchart shown in FIG. The outline of the processing is as follows.

  Step 11) The user who tried to access the domain name included in the existing malignant domain list by using the information stored in the DNS traffic information storage unit 14 and the malignant domain list storage unit 16 by the first score calculation unit 111 The terminal is extracted, and the score is calculated from the co-occurrence relationship of the malignant domain name (removal of the domain name of the major site).

  Step 12) The second score calculation unit 112 uses the information stored in the DNS authoritative server information storage unit 15 and the malignant domain list storage unit 16 based on the correspondence between the domain name and the DNS authoritative server. Extracts other domain names of the DNS authoritative server where the malicious domain name is registered. The score is calculated from the organization information included in those domain names (removal of domain names of servers such as companies and universities).

  Step 13) The benign domain name determination unit 12 calculates a score obtained by combining the two scores calculated in Steps 11 and 12, determines that a domain name having a low score is a benign domain name, and a new malignant domain list generation unit 13 generates a new malignant domain list by excluding benign domain names from the malignant domain list.

  Hereinafter, the processing of each step will be described in detail.

<Details of step 11>
In step 11, access is made to the malignant domain name included in the malignant domain list based on the user terminal, domain name, and malignant domain list information stored in the DNS traffic information storage unit 14 and the malignant domain list storage unit 16. Extract the attempted user terminal. Hereinafter, these extracted user terminals are referred to as infected user terminals.

  Next, paying attention to the co-occurrence relationship of malignant domain names that the infected user terminal attempted to access, the score of the malignant domain name is calculated. The purpose of this score calculation is to exclude domain names of major sites included in the malignant domain list.

  First, the co-occurrence relationship of domain names used for calculating a score is defined as follows.

  Domain name co-occurrence relationship: When a user terminal attempts to access two domain names, the relationship between the domain names is called a co-occurrence relationship.

  As an example, when a user terminal accesses three domain names "www.ntt.co.jp", "www.goo.co.jp", and "www.ntt-east.co.jp" , Www.ntt.co.jp and www.goo.co.jp have a co-occurrence relationship, and www.goo.co.jp co-occurs with www.ntt.co.jp (and vice versa) Call it.

  In step 11, using the above-mentioned co-occurrence relationship, a score C (d) is calculated by the following equation 1 as an example of adding a score of the domain name d included in the malignant domain list.

式１において、D_Bは悪性ドメインリスト、H_d∩dmはドメイン名dとdm（悪性ドメインリストの要素）の両方にアクセスしたユーザ端末の集合とする。式1の右辺分母はドメイン名dと悪性ドメインリストに含まれる他のドメイン名との総共起回数を表現するものである。

In Equation 1, D _B malignant domain _list, H d∩dm is a set of user terminal access to both the domain name d and dm (elements of malignant domain list). The right-hand side denominator of Equation 1 represents the total number of co-occurrence of the domain name d and other domain names included in the malignant domain list.

  As described above, the domain name of the major site is accessed by many users and can be considered to be accessed by most infected user terminals. Therefore, when d is the domain name of the major site in the above formula 1, the number of co-occurrence with other domain names is increased. This increases the denominator on the right side and decreases the score. On the other hand, since a truly malignant domain name is a bot-specific communication partner, only a user terminal infected with a specific bot tries to access a certain malignant domain name. For this reason, a truly malignant domain name has less co-occurrence with other domain names, and its score increases.

  A schematic explanatory diagram of this score calculation is shown in FIG. As shown in FIG. 6, for example, only a specific user terminal (user terminal A in FIG. 6) inquires about the domain name black.com included in the malignant domain list. In the case of FIG. 6, the occurrence frequency is as low as 2 times, and the score is high. On the other hand, for example, google.com included in the malignant domain list is accessed by many user terminals, so the frequency of co-occurrence with other domain names is high (9 times in FIG. 6), and the score is low.

  In this example, the score is calculated such that the smaller the score is, the easier it is to determine that it corresponds to a benign domain name. However, when the score is small, the score is calculated to be large. A method may be adopted.

<Details of Step 12>
As described above, there are domain names of companies, universities, etc. as benign domain names that should be excluded from the malignant domain list. Since some of these domain names are not popular, there is a possibility that they cannot be extracted as exclusion targets only by the score calculation method in step 11.

  Therefore, in step 12, in order to exclude these benign domain names from the malignant domain list, the score calculation is performed by paying attention to the correspondence relationship between the domain names and the DNS authority server.

  As described in the characteristics of the malignant and benign domain names, the organization part (label) of other domain names (obtained from the DNS authoritative server information storage unit 15) owned by the DNS authoritative server in which the malignant domain name is registered varies. When it is large and benign, the variation is small. Paying attention to this, as an example of scoring for a certain domain name d, the score I (d) is calculated by the following equation 2.

式２において、D_dはdの情報を持つDNS権威サーバが他に所有するドメイン名の集合、Dorgを同じ組織部を持つドメイン名の集合とする。式2の右辺は組織部の情報量を表しており、ドメイン名dが登録されているDNS権威サーバが、多くの組織のドメイン名を持つとき値が大きくなる。すなわち、企業や大学等の自組織でDNS権威サーバを運用している場合はそのドメイン名のスコアは小さくなり、真に悪性のドメイン名の場合はスコアが大きくなる。

In Expression 2, D _d is a set of domain names owned by other DNS authoritative servers having the information of d, and Dorg is a set of domain names having the same organizational unit. The right side of Equation 2 represents the amount of information in the organizational unit. The value increases when the DNS authoritative server in which the domain name d is registered has domain names of many organizations. That is, if a DNS authoritative server is operated by a company or university, the domain name score is small, and if it is a truly malignant domain name, the score is large.

  An outline explanatory diagram of this score calculation is shown in FIGS. As shown in FIG. 7A, since various domain names are registered in a DNS server that provides a service that allows domain names to be registered at low cost, there is a large variation in the organization names of the domain names. Therefore, the score calculated in step 12 increases.

  On the other hand, as shown in FIG. 7B, in a DNS server prepared by a company or university in its own organization, there are many cases in which only the domain name of the organization is registered, and the variation of the organization name of the domain name is small. Therefore, the score calculated in step 12 is small.

  In this example, the score is such that the smaller the score is, the easier it is to be determined that it corresponds to a benign domain name. It may be adopted.

<Details of Step 13>
In step 13, based on the scores calculated in steps 11 and 12, the score S (d) is calculated according to the following equation 3 as an example of the final scoring of the domain name d.

S (d) = C (d) × I (d) (Formula 3)
In Equation 3, d is a domain name included in the malignant domain list. Domain names whose score is smaller than a predetermined value are excluded from the original malignant domain list, and a new malignant domain list is generated. Of course, when a score calculation method that increases the score in a situation corresponding to a benign domain name is adopted, a domain name having a score larger than a predetermined value is excluded from the original malignant domain list. The generated malignant domain list may be output to the new malignant domain list storage unit 17 or may be output to the outside of the benign domain name exclusion device 10 (such as another device connected to the network).

  In addition, it is good also as performing the process of steps 11-13 sequentially for every domain name included in a malignant domain list, or step 11 is performed with respect to all the domain names included in a malignant domain list. Next, step 12 may be performed for all domain names included in the malignant domain list, and finally, step 13 may be performed for all domain names included in the malignant domain list. . Moreover, the order of processes other than this may be sufficient. As a result, a benign domain name is determined for each domain name included in the malignant domain list. If it is benign, it is excluded, and if a new malignant domain list is generated, what is the order of processing? But you can.

(Effect of embodiment)
As described above, according to the technique according to the present embodiment, the accuracy of the malignant domain list is improved, and the bot-infected terminal can be correctly detected. In addition, it is possible to automate the removal of benign domain names that have been performed manually, and to detect benign domain names that have been manually missed.

  As described above, Non-Patent Document 1 discloses a technique for discovering an unknown malignant domain and expanding an existing malignant domain list based on the co-occurrence relationship of DNS queries sent by the user. This embodiment removes a benign domain name from an existing malignant domain list, and differs from the technique of Non-Patent Document 1 in that it is not an expansion of the list but a reduction.

  Non-Patent Document 2 discloses a technique for detecting a benign domain name from a malignant domain list, but assigns a domain name score using a graph kernel. At least in this respect, the present embodiment is different from the technique of the present embodiment in which the score is calculated based on the co-occurrence relationship of the user query domain name and the domain name registration information.

  The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.

10 benign domain name exclusion device 11 score calculation unit 111 first score calculation unit 112 second score calculation unit 12 benign domain name determination unit 13 new malignant domain list generation unit 14 DNS traffic information storage unit 15 DNS authoritative server information storage unit 16 malignant Domain list storage unit 17 New malignant domain list storage unit

Claims (8)

A benign domain name exclusion device for excluding benign domain names from a malignant domain list,
A malignant domain list storage means for storing a malignant domain list;
Score calculating means for calculating a score for determining whether or not the domain name corresponds to a benign domain name for a domain name included in the malignant domain list;
Determination means for determining whether the domain name of the score corresponds to a benign domain name based on the score calculated by the score calculation means;
A benign domain name excluding device comprising a new malignant domain list generating means for generating a new malignant domain list by excluding a domain name determined to be a benign domain name by the determining means from the malignant domain list,
The benign domain name exclusion device further includes traffic information storage means for storing traffic information related to an inquiry from a user terminal to a DNS server,
The score calculation means calculates a co-occurrence frequency in the traffic information regarding a domain name and another domain name included in the malignant domain list, and determines that the greater the co-occurrence frequency, the more benign domain name A benign domain name excluding device, comprising: first score calculating means for calculating a score of the certain domain name so as to be easily sized. A benign domain name exclusion device for excluding benign domain names from a malignant domain list,
A malignant domain list storage means for storing a malignant domain list;
Score calculating means for calculating a score for determining whether or not the domain name corresponds to a benign domain name for a domain name included in the malignant domain list;
Determination means for determining whether the domain name of the score corresponds to a benign domain name based on the score calculated by the score calculation means;
A benign domain name excluding device comprising a new malignant domain list generating means for generating a new malignant domain list by excluding a domain name determined to be a benign domain name by the determining means from the malignant domain list,
The benign domain name excluding device further comprises DNS server information storage means for storing domain name information registered by the DNS server,
The score calculation means acquires a domain name owned by a DNS server that has registered a domain name included in the malignant domain list from the DNS server information storage means, and an organization name of the domain name The second score calculation for calculating the score of the certain domain name so that the value indicating the variation of the label representing the value is more easily determined as the value indicating the variation is smaller. A benign domain name exclusion device comprising means. A benign domain name exclusion device for excluding benign domain names from a malignant domain list,
A malignant domain list storage means for storing a malignant domain list;
Score calculating means for calculating a score for determining whether or not the domain name corresponds to a benign domain name for a domain name included in the malignant domain list;
Determination means for determining whether the domain name of the score corresponds to a benign domain name based on the score calculated by the score calculation means;
A benign domain name excluding device comprising a new malignant domain list generating means for generating a new malignant domain list by excluding a domain name determined to be a benign domain name by the determining means from the malignant domain list,
The benign domain name excluding device includes a traffic information storage unit that stores traffic information related to an inquiry from a user terminal to a DNS server, and a DNS server information storage unit that stores information on a domain name registered by the DNS server. In addition,
The score calculation means includes
Calculate the co-occurrence frequency in the traffic information for a domain name and other domain names included in the malignant domain list, and the score of the certain domain name is set so that the score decreases as the co-occurrence frequency increases. First score calculating means for calculating;
A DNS server that registers a domain name included in the malignant domain list obtains another domain name owned from the DNS server information storage unit, and the variation in the label indicating the organization name of the domain name is detected. A benign domain name excluding device, comprising: a second score calculating unit that calculates a score of the certain domain name so that the score decreases as the value indicating the variation decreases. . The determination unit calculates a score obtained by combining the score calculated by the first score calculation unit and the score calculated by the second score calculation unit as a score of a domain name included in the malignant domain list. The benign domain name exclusion device according to claim 3 , wherein: The determination means uses a benign domain name as a domain name in which the score obtained by combining the score calculated by the first score calculation means and the score calculated by the second score calculation means is smaller than a predetermined value. The benign domain name excluding device according to claim 4 , wherein the benign domain name excluding device is determined. The program for functioning a computer as each means in the benign domain name exclusion apparatus of any one of Claims 1 thru | or 5 . A benign domain name exclusion method executed by a benign domain name exclusion device that excludes benign domain names from a malignant domain list,
A score for calculating a score for determining whether the domain name corresponds to a benign domain name for a domain name included in the malignant domain list stored in the malignant domain list storage means storing the malignant domain list A calculation step;
A determination step of determining whether the domain name of the score corresponds to a benign domain name based on the score calculated by the score calculation step;
Wherein by excluding the domain name is determined to correspond to benign domain name from the malignant domain list by determining step, benign domain name exclusion method Ru and a new malignant domain list generation step of generating a new malignant domain list ,
The benign domain name exclusion device includes traffic information storage means for storing traffic information related to an inquiry from a user terminal to a DNS server,
The score calculating step calculates a co-occurrence frequency in the traffic information regarding a certain domain name and other domain names included in the malignant domain list, and determines that the higher the co-occurrence frequency is, the more benign domain name is. A benign domain name exclusion method comprising a first score calculation step of calculating a score of the certain domain name so as to be easily sized . A benign domain name exclusion method executed by a benign domain name exclusion device that excludes benign domain names from a malignant domain list,
  A score for calculating a score for determining whether the domain name corresponds to a benign domain name for a domain name included in the malignant domain list stored in the malignant domain list storage means storing the malignant domain list A calculation step;
  A determination step of determining whether the domain name of the score corresponds to a benign domain name based on the score calculated by the score calculation step;
  A benign domain name exclusion method comprising a new malignant domain list generating step of generating a new malignant domain list by excluding the domain name determined to be a benign domain name by the determining step from the malignant domain list;
  The benign domain name excluding device includes a DNS server information storage unit that stores information on a domain name registered by a DNS server,
  In the score calculation step, a DNS server that registers a domain name included in the malignant domain list obtains another domain name owned from the DNS server information storage unit, and an organization name of the domain name The second score calculation for calculating the score of the certain domain name so that the value indicating the variation of the label representing the value is more easily determined as the value indicating the variation is smaller. With steps
  A benign domain name exclusion method characterized by

Images