基于AGD的恶意域名检测  

Detecting malicious domain names based on AGD

作　　者：臧小东 龚俭 胡晓艳[1,2,3] ZANG Xiaodong;GONG Jian;HU Xiaoyan(School of Cyber Science and Engineering,Southeast University,Nanjing 211189,China;Jiangsu Provincial Key Laboratory of Computer Network Technology,Southeast University,Nanjing 211189,China;Key Laboratory of Computer Network and Information Integration of Ministry of Education,Southeast University,Nanjing 211189,China)

机构地区：[1]东南大学网络空间安全学院,江苏南京211189 [2]东南大学江苏省计算机网络重点实验室,江苏南京211189 [3]东南大学教育部计算机网络和信息集成重点实验室,江苏南京211189

出　　处：《通信学报》2018年第7期15-25,共11页Journal on Communications

基　　金：国家自然科学基金资助项目(No.61602114)~~

摘　　要：提出了一种聚类和分类算法相结合的恶意域名检测思路,首先通过聚类关联,辨识出同一域名生成算法(DGA,domain generation algorithm)或其变体生成的域名,然后分别提取每一个聚类集合中算法生成域名(AGD,algorithmically generated domain)的TTL、解析IP分布、归属、whois的更新、完整性及域名的活动历史特征等,利用SVM分类器过滤出其中的恶意域名。实验表明,该算法在不需要客户端查询记录信息的情况下即可实现准确率为98.4%、假阳性为0.9%的恶意域名检测。A new malicious domain name detection algorithm was proposed.More specifically,the domain names in a cluster belonging to a DGA(domain generation algorithm)or its variants was identified firstly by using cluster correlation.Then,these AGD(algorithmically generated domain)names’TTL,the distribution and attribution of their resolved IP addresses,their whois features and their historical information were extracted and further applied SVM algorithm to identify the malicious domain names.Experimental results demonstrate that it achieves an accuracy rate of 98.4%and the false positive of 0.9%without any client query records.

关 键 词：网络安全监测 域名生成算法 命令与控制服务器 算法生成域名 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]