基于思维进化算法优化S-Kohonen神经网络的恶意域名检测模型  

A Malicious Domain Name Detection Model Based on S-Kohonen Neural Network Optimized by Evolutionary Thinking Algorithm

作　　者：罗峥[1] 张学谦[2] LUO Zheng;ZHANG Xueqian(The Third Research Institute of The Ministry of Public Security,Shanghai 200031,China;Cyber Security Team of Sichuan Provincial Public Security Department,Chengdu 610000,China)

机构地区：[1]公安部第三研究所,上海200031 [2]四川省公安厅网络安全保卫总队,成都610000

出　　处：《信息网络安全》2020年第6期82-89,共8页Netinfo Security

摘　　要：恶意域名作为目前互联网攻击的主要手段,给用户和企业带来巨大的网络使用的风险。为了更有效地抵御恶意域名的攻击,保障网络空间的安全性,文章提出了一种基于思维进化算法优化S-Kohonen神经网络的恶意域名检测模型。该模型利用Kohonen神经网络,在隐藏层后额外添加一个输出层,将其改进为有监督的神经网络S-Kohonen,使其更好地学习恶意域名的相关特征,再利用思维进化算法进行结合,优化神经网络的初始权值和阈值,最终得出的模型可以快速、准确地检测出恶意域名。通过模型的MATLAB实验仿真,以及和思维进化算法优化的BP神经网络的对比,从混淆矩阵、分类柱状图、ROC曲线和AUC值的方式具体分析两种模型的分类情况。结果表明该分类模型对恶意域名具有高准确率、快速识别的特点,可以应用于恶意域名的网络安全防护中,并且有较高的实用价值。As one of the main means of Internet attack,malicious domain name brings huge network use risk to users and enterprises.In order to resist the attack of malicious domain names more effectively and ensure the security of cyberspace,this paper proposes a malicious domain name detection model based on thought evolution algorithm to optimize S-Kohonen neural network.This model using Kohonen neural network,and in the hidden layer after adding an additional output layer,the improvement for supervised neural network S–Kohonen,make its better learning characteristics of malicious domain name,related recycle mind evolutionary algorithm,the initial weights and threshold of neural network are optimized,finally it is concluded that the model can quickly and accurately detect the malicious domain name.Through MATLAB simulation of the model,and the mind evolutionary algorithm to optimize the BP neural network,from the confusion matrix,classification of histogram,ROC curve and AUC value in the form of specific analysis of the classification of the two models,the results show that the classification model for malicious domain with high accuracy,fast identification characteristics,can be used in the malicious domain of network security protection,and have higher practical value.

关 键 词：S-Kohonen神经网络 有监督学习 思维进化算法 恶意域名检测 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]