基于属性基加密的恶意域名训练异常数据检测  

Abnormal data detection of malicious domain name training based on attribute based encryption

作　　者：张晓琴 汪云飞 ZHANG Xiao-qin;WANG Yun-fei(Chongqing Communication Design Institute Co.,Ltd.,Chongqing 400041,China;Aerospace Unary(Nan Jing)Data Technology Co.,Ltd.,Nanjing 210000,China)

机构地区：[1]重庆市信息通信咨询设计院有限公司,重庆400041 [2]航天壹进制(南京)数据科技有限公司,南京210000

出　　处：《信息技术》2022年第3期90-95,共6页Information Technology

基　　金：2020年度科技型技术企业创新与应用发展专项项目(593)。

摘　　要：传统的恶意域名训练异常数据检测耗时过长,检测准确率较低,为此提出基于属性基加密的恶意域名训练异常数据检测。分析域名长度、域名访问周期、突发的域名系统请求查询以及域名查询失败记录四大行为,通过提取IP地址、域名的共享地址数目、域名查询返回的终极地址以及对抗网络四个特征,转换攻击的数据信息。设置数据加密器,根据访问权限所涉及的属性向可信中心申请公钥对文件加密,形成最终的密文。实验结果表明,所提方法能够有效缩短检测时间,提高检测准确率。The time of abnormal data detection of traditional malicious domain name training is too long,and the detection accuracy is low.Therefore,this paper proposes a malicious domain name training abnormal data detection method based on attribute based encryption.This method analyzes the four behaviors,including domain name length,domain name access cycle,sudden domain name system request query and domain name query failure record.By extracting the IP address,the number of shared addresses of domain name,the final address returned by domain name query and the network resistance,the data information of the attack is converted.The data encryptor is set up,and the public key is applied to the trusted center to encrypt the file according to the attributes involved in the access rights to form the final cipher text.The experiment results show that the proposed method can effectively shorten the detection time and improve the detection accuracy.

关 键 词：属性基加密 恶意域名 域名训练 异常数据 数据检测 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]