Analysis And Research On Users' Access Behavior Based On DNS Traffic

Most domestic researches on DNS(Domain Name System)traffic focus on how to identify malicious behaviors in DNS traffic,such as malicious domain name identification,DNS covert channel identification and so on.There are also a few studies that analyze the multiple domain names or the quality of service of servers through DNS traffic,while few people analyze the activities of normal Internet users and early warning of illegal websites according to DNS traffic.According to the traffic of DNS recursive resolver in each region,we can analyze the access behavior of Internet users in each region and observe the websites frequently visited by users in each region.Such analysis results are helpful to understand the access habits and preferences of users in each region.This thesis analyzes the user access behavior based on DNS traffic.By obtaining the content of the websites,extracting the characteristics of the websites,using machine learning to identify the types of websites,and finally analyzing the access behavior of users in DNS traffic,we can understand the online activities of Internet users,and realize the early warning of illegal websites.The main research contents are as follows:(1)Research on the classification of Chinese websites.In order to understand the access behavior preferences of Chinese Internet users,it is necessary to classify the types of websites visited by users.In view of the imperfect classification of Chinese websites at present,this thesis designed a set of website classification rules,and sorted out a website classification data set through the defined website classification rules for subsequent website classification algorithm research.(2)This thesis proposes a multi model fusion website classification algorithm based on Bi LSTM(Bi-directional Long Short-Term Memory).In order to automatically distinguish website categories,an efficient website classification algorithm is needed.Manual classification obviously can not meet the needs of a large number of website classification in the Internet.Therefore,This thesis proposes a multi model fusion website classification algorithm based on Bi LSTM.Experiments are carried out on the data set sorted out in this work,and the accuracy rate is 88%.Compared with similar classification algorithms,the accuracy rate of the method proposed in this paper is higher.(3)Analysis and Research on user access behavior and early warning of illegal websites.After implementing the website classification algorithm,this thesis analyzes the real DNS traffic,obtains the number of websites of each type in the data and the types of websites users prefer to visit,and finds some illegal websites from the DNS traffic.