基于CNN改进模型的恶意域名训练数据生成技术  

Malicious Domain Name Training Data Generation Technology Based on Improved CNN Model

作　　者：马骁[1] 蔡满春[1] 芦天亮[1] MA Xiao;CAI Manchun;LU Tianliang(College of Information Network Security,People’s Public Security University of China,Beijing 100038,China)

机构地区：[1]中国人民公安大学信息网络安全学院,北京100038

出　　处：《信息网络安全》2021年第10期69-75,共7页Netinfo Security

基　　金：“十三五”国家密码发展基金密码理论研究重点课题[MMJJ20180108];中国人民公安大学2019年基本科研业务费重大项目[2019JKF108]。

摘　　要：近年来,新型僵尸网络开始攻击命令与控制(C&C)服务器,并利用域名生成算法(DGA)来躲避检测。传统的域名生成算法存在寻址效率不高、域名相应代码流量太大导致通信容易被检测发现等弊端。文章通过改进传统的CNN模型,结合文本生成的相关思想,利用Bi-LSTM的自注意力机制来生成恶意域名。最终结果表明,该方法生成的域名数据在对比实验中表现良好,可以模拟真实的域名数据,提高了恶意域名检测效率。In recent years,new botnets have begun to use command and control(C&C)server communication to attack and use domain name generation algorithms(DGA)to avoid detection.The traditional algorithm of domain name generation has some disadvantages,such as low addressing efficiency and easy detection due to the corresponding code traffic of a large number of domains.In this paper,we use the self-attention mechanism of BI-LSTM to generate malicious domain name by improving the traditional CNN model and combining with the related ideas of text generation.The final results show that the domain name data generated by this method can be used as real domain name data in the comparative experiment,which improves the efficiency of detecting malicious domain name.

关 键 词：恶意域名 卷积神经网络 僵尸网络 机器学习 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]