基于DNS查询行为的Bot检测

提出一种基于DNS查询行为的检测方法。根据Bot的自动运行特性，从DNS查询的角度对主机中的进程进行初步过滤，缩小检测范围；分析Bot与其他进程的DNS反应行为模式的异同，构建Bot-DNS检测模型，在此基础上判断可疑进程是否为Bot。实验结果表明，该方法能够检测出处于生命周期早期阶段的Bot，且检测过程与Bot采用的协议结构无关，具有较好的检测效果。

Bot detection based on DNS query activities

This paper proposes a new method of identifying Bot based on DNS query activities. Firstly, as Bots usually run automatically, detection rage is narrowed down from the point of view of DNS query. Secondly, a Bot-DNS detection model is created on differences of DNS reaction behavior between Bots and normal processes, to judge whether the suspicious process is Bot. The experimental results show that the method can detect Bots in the early stage. It is independent of protocol and structure, and has a better detection effect.