| Data leaks happen all around us and pose a great threat to us.The network black production sells corporate and personal information.In 2017,the information of the Pentagon was leaked,and 1.8 billion personal information was stolen.The DNS covert channel is a covert channel built by the DNS.The DNS covert channel is one of the most common cause of data leakage.It is common and difficult to detect,and seriously threatens network information security.The network security infrastructure of the grassroots government mainly relies on conventional firewalls,and the safety awareness of employees is weak,and the data leakage prevention such as covert channels is insufficient.Based on the structural characteristics of DNS packets,this paper constructs a data processing module and a static detection module,and analyzes the network environment of the grassroots government by using existing conditions,thereby improving security and reducing costs.The detection nature of the DNS covert channel is classification or prediction.Based on the environmental conditions of the grassroots government,this paper comprehensively considers the research results of the predecessors,and proposes a static method to detect the covert channels of DNS using Random forests and conduct experiments.And the DNS packet size,the number of subdomains,the length of the subdomain name string,the percentage of binary data in the domain name,the domain name character entropy,the length of the response segment resource record,the length of all resource records,the minimum TTL,and the maximum TTL,a total of 4 class or 8 elements extracted from common DNS flow and the DNS covert channel flow generated by the experiment,are used for static feature test analysis.The specific processes and steps include: 1)Using Map Reduce parallel computing method to form data preprocessing module for data vectorization,filling null value,and normalizing vectors,forming feature vector set,and then generating training set and test set with random seed.After the data preprocessing is completed,the decision tree sample subspace is generated by Bagging method,then the decision tree is constructed based on Map Reduce parallel computing and the random forest classifier is constructed and trained to form a detection algorithm.Then the detection algorithm is tuned to form the detection module from the number of characteristic variables,the number of decision trees and the generation algorithm of the decision tree.The performance of the detection module on the test set is96.49%,and the recall is 95.39%.In order to verify the effectiveness of the detection module,the paper analyzes the feasibility and effect of Intrusion detection(IDS)system,Decision tree method,Convolutional neural network,Random forest,Bayesian classification and Logisticregression.Bayesian classification algorithm and logistic regression algorithm are used to compare the datasets.The innovation of this paper lies in: The previous research on DNS covert channel detection is mainly in the laboratory.The environment of the laboratory mainly considers the effect of classification or prediction.The hardware conditions of the actual application,the quality of personnel,the cost of the operating environment,and the use of promotion are less considered.This paper is the first to use the Random forest method to detect the DNS covert channel in the grassroots government network environment.The experimental results show that the random forest method is excellent in detecting the classification performance of DNS covert channels and compatible with the grassroots government network environment.In order to use the detection module for practice,the author extracted more than 2000 DNS records from the working department network.Finally,112 suspected DNS covert channel records were checked out and submitted to the network administrator for processing.The static detection method and related algorithms of DNS covert channel based on Random forest in this paper have good reference value for related research and application. |
