基于多元属性特征的恶意域名检测  

Malicious domain detection based on multiple-dimensional features

作　　者：张洋[1] 柳厅文[1] 沙泓州 时金桥[1] 

机构地区：[1]中国科学院信息工程研究所,北京100093

出　　处：《计算机应用》2016年第4期941-944,984,共5页journal of Computer Applications

基　　金：国家自然科学基金资助项目(61303260);中国科学院战略性先导科技专项(XDA06030200)~~

摘　　要：域名系统主要提供域名解析功能,完成域名到IP的转换,而恶意域名检测主要用来发现以域名系统为屏障的非法行为,来保障域名服务器的正常运行。总结了恶意域名检测的相关工作,并采用基于机器学习的方法,提出一种基于多元属性特征的恶意域名检测方法。在域名词法特征方面,提取更加细粒度的特征,比如数字字母的转换频率、连续字母的最大长度等;在网络属性特征方面,更加关注名称服务器,比如其个数、分散度等。实验结果表明,该方法的准确率、召回率、F1值均达到了99.8%,具有较好的检测效果。Domain Name System（ DNS） provides domain name resolution service,i. e.,converting domain names to IP addresses. Malicious domain detection is mainly for discovering illegal activities and ensuring the normal operation of the domain name servers. Prior work on malicious domain name detection was summarized,and a new machine learning based malicious domain detection algorithm for exploiting multiple-dimensional features was further proposed. With respect to domain name lexical features,more fine-grained features were extracted,such as the conversion frequency of the numbers and letters and the maximum length of continuous letters. As for the network attribute features,more attentions were paid to the name servers,such as the quantity,and the degree of dispersion. The experimental results show that the accuracy,recall rate,F1 value of the proposed method reaches 99. 8%,which means a better performance on malicious domain name detection.

关 键 词：恶意域名 域名系统 网络钓鱼 随机森林 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]