# US 2020/0396201 A1 · C&c domain name analysis-based botnet detection method, device, apparatus and mediumc&c domain name analysis-based botnet detection method, device, apparatus and medium

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2020/0396201 A1
- Document ID: US20200396201A1
- Status: Published application
- Kind: A1
- Application number: 16/958,747
- Filed: 2018-07-18
- Published: 2020-12-17
- Earliest claimed: 2018-01-15
- Assignees: Shenzhen Leagsoft Technology Co., Ltd.
- Applicants: Shenzhen Leagsoft Technology Co., Ltd.
- Inventors: Ming Du; Dazhi Tu; Xincheng Wang
- Web page: https://patentgrep.com/patent/US20200396201A1

## CPC

- H04L 61/4511: using domain name system [DNS]
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06N 3/02: Neural networks
- G06N 3/084: Backpropagation, e.g. using gradient descent
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment}
- H04L 2463/144: Detection or countermeasures against botnets
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

The invention provides a command-and-control (C&C) domain name analysis-based botnet detection method, device, apparatus and medium. The method includes an information acquisition step where DNS logs are acquired; a domain name analysis step where C&C domain names in the DNS logs are detected and the category of each C&C domain name is determined according to a pre-built domain name analyzer; a botnet determination step where whether a botnet exists is determined according to the C&C domain name and the category of C&C domain name. In the C&C domain name analysis-based botnet detection method, device, apparatus and medium provided by the present invention, by analyzing the domain name system (DNS) logs, the C&C domain name used in the attack activity is extracted for further analysis of the types of parasitic Trojans to thereby lock down the bot that the C&C server has controlled. In addition, the botnet activity trend can be analyzed by analyzing the Poisson parameter of each type of the C&C domain name, so as to form effective suppression measures in time.

## Claims

### Claim 1

A C&C domain name analysis-based botnet detection method, comprising:
an information acquisition step, where DNS logs are acquired;
a domain name analysis step, where C&C domain names in the DNS logs are detected and the category of each C&C domain name is determined according to a pre-built domain name analyzer;
a botnet determination step, where whether a botnet exists is determined according to the C&C domain name and the category of C&C domain name;
a data statistical step, where occurrence frequency of each type of the C&C domain name is counted; and
a trend determination step, where the botnet activity trend is determined according to the occurrence frequencies of all types of the C&C domain names so as to assist in formation of effective suppression measures in time.

### Claim 2

(canceled)

### Claim 3 (depends on 1)

The method in claim 1, wherein the trend determination step includes the steps of:
substituting the occurrence frequency of each type of the C&C domain name into a Poisson distribution probability function to obtain a Poisson parameter of the corresponding category;
determining all the Poisson parameters as a measure of botnet activity; and
determining the botnet activity trend according to the measure of botnet activity.

### Claim 4 (depends on 1)

The method in claim 1, wherein training the domain name analyzer includes the steps of:
cleaning legitimate domain names published by legitimate websites to obtain a legitimate domain name set;
generating a C&C domain name set by a public domain name generation algorithm and classifying and tagging each domain name in the C&C domain name set;
statistically analyzing the structure of each domain name in the legitimate domain name set and the C&C domain name set;
establishing a character probability dictionary for each type of domain names;
randomly selecting a given number of legitimate domain names from the legitimate domain name set to obtain a legitimate domain name training sample set;
randomly selecting a given number of C&C domain names from the C&C domain name set to obtain a C&C domain name training sample set; and
training the domain name analyzer according to the legitimate domain name training sample set, the C&C domain name training sample set and the character probability dictionary.

### Claim 5 (depends on 4)

The method in claim 4, wherein:
the domain name analyzer is a neural network model based on a cumulative BP algorithm; and
the neutral network model is provided with a regularization item that comprehensively considers empirical error factors and network complexity factors.

### Claim 6 (depends on 5)

The method in claim 5, wherein calculating the neutral network model based on the cumulative BP algorithm comprises the steps of:
calculating an error target function;
describing the neutral network complexity;
estimating model parameters by a cross validation process; and
adjusting parameters by stochastic gradient descent to approximate the global minimum solution of the error function.

### Claim 7 (depends on 4)

The method in claim 4, wherein the domain name analysis step includes the steps of:
extracting a domain name from the DNS logs;
subjecting the domain name to feature extraction;
determining whether the domain name is a C&C domain name according to the character probability dictionary;
subjecting the C&C domain name to domain name feature quantification to obtain the classification number of the C&C domain name; and
determining the category of the C&C domain name according to the classification number.

### Claim 8

A C&C domain name analysis-based botnet detection device, comprising:
an information acquisition unit for acquiring DNS logs;
a domain name analysis unit for detecting C&C domain names in the DNS logs and determining the category of each C&C domain name according to a pre-built domain name analyzer; and
a botnet determination unit for determining whether a botnet exists according to the C&C domain name and the category of the C&C domain name.

### Claim 9 (depends on 1)

A computer apparatus, comprising:
at least one processor;
at least one memory; and
computer program instructions stored in the memory, wherein the method in claim 1 is implemented when the computer program instructions are executed by the processor.

### Claim 10 (depends on 1)

A computer readable storage medium for storing computer program instruction, wherein the method in claim 1 is implemented when the computer program instructions are executed by the processor.