关键词: 僵尸网络, 远控木马, 威胁情报, 感染主机, 恶意域名

Abstract: Based on the principle of DNS technology, this paper deploys a DNS node monitoring system to monitor and analyze the DNS response data of each node to analyze the target domain name of the control terminal, tries to detect and model the data several times, and finally obtains the distribution of the infected hosts and the types of Trojan virus. And through the optimized node management scheduling scheme, without the help of thirdparty means to grasp the outbreak of a virus, which can play an important role in the prevention and traceability of virus attack, and further form a worldwide monitoring situation of the virus infection risk.

Key words: Botnet, remote control Trojan, threat intelligence, infected host, malicious domain name