基于Char-RNN改进模型的恶意域名训练数据生成技术  

Generation of Malicious Domain Training Data Based on Improved Char-RNN Model

作　　者：吴警 芦天亮[1] 杜彦辉[1] WU Jing;LU Tianliang;DU Yanhui(College of Information and Cyber Security,People’s Public Security University of China,Beijing 100038,China)

机构地区：[1]中国人民公安大学信息网络安全学院,北京100038

出　　处：《信息网络安全》2020年第9期6-11,共6页Netinfo Security

基　　金：国家自然科学基金[61602489];“十三五”国家密码发展基金密码理论研究重点课题[MMJJ20180108]。

摘　　要：近年来,新型僵尸网络开始使用域名生成算法(DGA)和命令与控制(C&C)服务器通信。针对基于深度学习的检测模型缺少对新出现的DGA变体域名的识别能力等问题,结合文本生成的思想,文章对原始Char-RNN模型进行改进,使用长短期记忆网络(LSTM)构建模型并引入注意力机制,从而生成用于模拟未知变体算法的恶意域名。实验证明,基于该方法生成的域名数据与真实数据在字符组成结构和频率方面具有高度相似性,且以生成数据作为训练集的检测模型保持了较好的性能,验证了基于文本生成模型的数据有效性以及将其作为训练数据集来预测未知DGA变体的可行性。In recent years,new botnets have begun to use DGA(Domain Generation Algorithm)to communicate with C&C(Command and Control)servers.Aiming at the problem that the detection models based on deep learning lack the ability to recognize new DGA variants,combined with the idea of text generation,this paper improved the original character-level recurrent neural network(Char-RNN)by using LSTM and attention mechanism,which can generate malicious domain names for simulating unknown DGA variants.Experiment results showed that the domain names generated by this method is highly similar to the real data in character composition structure and frequency.Also,the detection models using the generated data as the training set maintains good performance.This verified the validity of generated data and the feasibility of using it as the training data to predict unknown DGA variants.

关 键 词：恶意域名 DGA 文本生成 深度学习 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]