本文已被：浏览 2656次 下载 1194次
投稿时间：2017-08-05 修订日期：2018-06-06
投稿时间：2017-08-05 修订日期：2018-06-06
中文摘要: 针对现有DNS流量分析方法受大规模网络中大数据量限制的问题，及可视分析方法还未应用到DNS流量分析中的现状，提出了一种TDRI（trend to domain and request information）DNS流量分析模型，并采用DNS流量分析模型和网络安全及大数据可视分析方法相结合的方式，设计并实现了基于TDRI DNS流量分析模型的多视图关联DNS流量可视分析系统。首先，对复杂大规模真实网络中长期、大量DNS流量数据进行观测和描述性分析。然后，从DNS服务中域名请求者、域名及域名访问3个基本要素的角度抽象并提出一种包含DNS流量特征值时序变化趋势、请求域名及域名访问情况的DNS流量分析模型。最后，以提出的DNS流量分析模型为指导，设计了包括数据选择和关联交互视图的DNS流量可视分析系统，支撑问题分析为驱动的DNS流量数据分析过程。将基于TDRI的多视图关联DNS流量可视分析系统应用于校园网真实环境，帮助分析者从DNS流量中发现了网络中的恶意访问行为以及针对DNS的恶意行为。实验结果表明，本文提出的分析方法可提高大规模网络环境下DNS流量分析效率，分析出DNS流量中表现出的恶意行为，为DNS安全稳定运行提供了保障。
Abstract:In order to solve the problems that the existing DNS traffic analysis is limited by large data in complex large-scale networks, and the current visual analysis is not yet applied to DNS traffic analysis, a DNS traffic analysis model based on trend to domain and request information(TDRI) is proposed. The combined with network security and visual analysis method of big data, a multi view association DNS traffic visual analysis system based on TDRI DNS traffic analysis model is designed and implemented. First, the long-term and massive DNS traffic data of complex large-scale real networks are observed and analyzed. Then, a DNS traffic analysis model that includes DNS traffic eigenvalue time-series trend, request domain, and domain request information is abstracted and presented from three perspectives of requester, domain and request. Finally, based on the proposed DNS flow analysis model, the DNS traffic visual analysis system, which includes data selection and interrelated interactive view, is designed to support the analysis process of DNS traffic data driven by the problem analysis. The multi-view associated DNS traffic visual analysis system based on TDRI is applied to the real environment of campus network, which helps analysts find malicious access behavior in the network from DNS traffic and maliciousbehavior for DNS.The experimental results show that the proposed analysis method can improve the efficiency of DNS traffic analysis in the large-scale network environment and analyze the malicious behavior in the DNS traffic, which provides a guarantee for the safe and stable operation of the campus network DNS.
文章编号：201700632 中图分类号：TP393.0 文献标志码：
基金项目:国家自然科学基金资助项目（61272447）；国家“双创”示范基地之变革性技术国际研发转化平台资助项目（C700011）；四川省重点研发项目资金资助项目（2018G20100）；四川省科技支撑计划资助项目（2016GZ0038）；中央高校基本科研业务费专项资金资助项目（2017SCU11059；2017SCU11065；SCU2016D009）
作者简介:陈兴蜀(1968-),女,教授,博士生导师,博士.研究方向:云计算、信息安全.E-mail:chenxsh@scu.edu.cn
引用文本：
陈兴蜀,陈敬涵,曾雪梅,韩珍辉,朱毅,邵国林.基于TDRI的多视图关联DNS流量可视分析[J].工程科学与技术,2018,50(4):123-129.
CHEN Xingshu,CHEN Jinghan,ZENG Xuemei,HAN Zhenhui,ZHU Yi,SHAO Guolin.Correlative Visual Analytics for DNS Traffic with Multiple Views Based on TDRI[J].Advanced Engineering Sciences,2018,50(4):123-129.
引用文本：
陈兴蜀,陈敬涵,曾雪梅,韩珍辉,朱毅,邵国林.基于TDRI的多视图关联DNS流量可视分析[J].工程科学与技术,2018,50(4):123-129.
CHEN Xingshu,CHEN Jinghan,ZENG Xuemei,HAN Zhenhui,ZHU Yi,SHAO Guolin.Correlative Visual Analytics for DNS Traffic with Multiple Views Based on TDRI[J].Advanced Engineering Sciences,2018,50(4):123-129.