In recent years

APT defense has gradually become the key focus of network security. APT attack has strong concealment

while its early detection is less harmful. The proposed method is based on DNS logs

starting from multiple functional dimensions such as DNS log in-depth resolution

DGA domain name AI detection and DNS tunnel detection

putting forward a new idea of apt defense from the perspective of DNS. Transformer and GRU neural network algorithm is used to detect malicious DGA domains and ML to detect the DNS tunnel of APT attack

which makes up for the lack of attention of the domain names generated by algorithms

and the vulnerability that DNS is easy to be latent exploited by APT. Through the in-depth test in the experimental environment

the results show that the proposed method can better deal with the increasingly severe Internet APT security threat.