网络安全管理威胁情报域名与子域名关联数据

应用场景： 1.深度数据钻取：在SOC或SIEM平台上，安全分析师可以利用关联数据对特定域名及其子域名进行深入的数据钻取。通过查看域名间的解析关系、访问模式、流量特征等，分析师能够构建出攻击者的活动图谱，揭示攻击者的策略、动机及可能的后续行动。 2.犯罪取证：在涉网犯罪调查中，域名与子域名的关联数据是关键的电子证据之一。通过分析这些数据，执法机构可以追踪资金流动、识别犯罪网络结构、定位犯罪嫌疑人等。同时，这些数据还能帮助评估犯罪活动的影响范围，为制定应对策略提供有力支持。 3.自动化响应与预警：结合先进的机器学习算法和自动化工具，系统可以根据域名与子域名的关联数据自动生成预警信息，并在发现潜在威胁时自动触发应急响应措施。这大大提高了安全管理的效率和准确性，减少了人为干预的延迟和错误。 4.威胁情报:子域名扫描：定期扫描子域名可以发现未知的或未经授权的子域，这些可能是由于配置错误、遗留系统或是恶意行为造成的。例如，攻击者可能注册看起来相似的子域名进行钓鱼攻击。数据采集：通过DNS（域名系统）负责将域名解析为IP地址，通过查询DNS解析记录，获取域名及其子域名的IP地址信息，进而了解它们之间的关联关系。第三方数据服务：如网络安全扫描工具、域名信息查询平台等，这些服务通常提供丰富的域名和子域名信息，包括它们的关联关系、安全状况等。 数据清洗：去除重复数据：对于从不同来源采集到的数据，进行去重处理，确保数据的唯一性。 验证数据准确性：通过交叉验证、正则表达式匹配等方式，确保采集到的数据的准确性。 数据加工：关联关系识别算法： 基于DNS解析的关联识别：通过解析域名和子域名的DNS记录，识别它们之间的CNAME（别名记录）、NS（名称服务器记录）等关联关系。 基于WHOIS信息的关联识别：通过分析域名和子域名的WHOIS注册信息，如注册人、注册商等，识别它们之间的潜在关联。 基于第三方数据的关联识别：利用第三方数据服务提供的关联信息，如子域名列表、域名家族关系等，进一步确认域名和子域名之间的关联关系。

### Application Scenarios
1. **Deep Data Drilling**: On SOC (Security Operations Center) or SIEM (Security Information and Event Management) platforms, security analysts can perform in-depth data drilling on specific domains and their subdomains using associated datasets. By examining inter-domain resolution relationships, access patterns, traffic characteristics and other relevant attributes, analysts can construct the attacker’s activity landscape to uncover their tactics, motivations and potential follow-up actions.
2. **Cyber Forensics**: In cyber-related criminal investigations, the associated data of domains and subdomains constitutes one of the critical electronic evidences. Law enforcement agencies can leverage such data to track fund flows, identify criminal network structures, locate suspects and more. Additionally, this data can assist in evaluating the impact scope of criminal activities and provide robust support for formulating response strategies.
3. **Automated Response and Early Warning**: Integrated with advanced machine learning algorithms and automated tools, the system can automatically generate early warnings based on the associated data of domains and subdomains, and trigger emergency response measures automatically upon detecting potential threats. This significantly enhances the efficiency and accuracy of security management, minimizing delays and errors caused by human intervention.
4. **Threat Intelligence**:
- **Subdomain Scanning**: Regular subdomain scanning can uncover unknown or unauthorized subdomains, which may stem from misconfigurations, legacy systems or malicious activities. For instance, attackers may register visually similar subdomains to launch phishing attacks.
- **Data Collection**: The Domain Name System (DNS) functions to resolve domain names into IP addresses. By querying DNS resolution records, we can obtain the IP address information of domains and their subdomains, thereby gaining insights into their interrelationships.
- **Third-party Data Services**: Such as cybersecurity scanning tools, domain information query platforms and other similar services. These offerings typically provide comprehensive domain and subdomain information, including their associated relationships, security status and more.

### Data Processing
#### Data Cleaning
1. **Duplicate Removal**: Deduplicate data collected from diverse sources to ensure data uniqueness.
2. **Accuracy Verification**: Validate the accuracy of collected data through methods like cross-validation and regular expression matching.

#### Association Recognition Algorithms
1. **DNS-based Association Recognition**: Identify CNAME (Canonical Name) and NS (Name Server) records between domains and their subdomains by parsing their DNS resolution logs.
2. **WHOIS-based Association Recognition**: Analyze WHOIS registration details of domains and subdomains (e.g., registrant, registrar) to detect potential underlying associations.
3. **Third-party Data-driven Association Recognition**: Leverage association information provided by third-party data services, such as subdomain lists, domain family lineage, etc., to further confirm the interrelationships between domains and their subdomains.

搜集汇总

数据集介绍

特点

该数据集包含2000条网络安全管理威胁情报域名与子域名的关联数据，每日更新，适用于深度数据钻取、犯罪取证、自动化响应与预警以及威胁情报子域名扫描等场景。数据通过DNS解析记录和第三方数据服务采集，并经过清洗和加工处理。