一种分阶段的恶意域名检测算法  

Staged Malicious Domain Names Detection Algorithm

作　　者：王甜甜[1] 刘雄飞[1] WANG Tian-tian;LIU Xiong-fei(College of Information Engineering,China University of Mining and Technology Yinchuan College,Yinchuan 750000,China)

机构地区：[1]中国矿业大学银川学院信息工程学院,银川750000

出　　处：《小型微型计算机系统》2022年第10期2046-2050,共5页Journal of Chinese Computer Systems

基　　金：2019年宁夏自然科学基金项目(NZ12117)资助.

摘　　要：针对现有基于域名字符特征的恶意域名检测方法在检测精度和范围等方面表现不佳的问题,提出一种分阶段的恶意域名检测算法.首先,利用域名黑名单和域名白名单技术实现待测域名的快速过滤与响应,并构造潜在待测域名集合;然后,构建双向长短时记忆神经网络(Bi-Directional Long Short Term Memory,BiLSTM)和卷积神经网络(Convolutional Neural Networks,CNN)的混合模型BiLSTM-CNN,并使用Softmax实现潜在待测域名集合中合法域名与恶意域名的分类;最后,通过在Alexa、DGA Domain List和Malware Domain List等标准数据集上进行测试,并与当前主流恶意域名检测算法进行对比.实验结果表明,本文算法在保持检测精度较高的基础上,具有更广的检测范围.In view of the poor performance of the existing malicious domain name detection methods based on the character characteristics of domain names in terms of detection accuracy and range,a staged malicious domain name detection algorithm was proposed.Firstly,the domain name blacklist and domain name white list technology were used to filter and respond the domain names to be tested quickly,and the set of potential domain names to be tested was constructed.Then,a hybrid modelof bi-directional long-term and short-term memory neural network BiLSTM and convolutional neural network CNN was constructed,and Softmax was used to realize the classification of legitimate domain names and malicious domain names in the set of potential domain names to be tested.Finally,the algorithm was tested on standard data sets such as Alexa,DGA Domain List,and Malware Domain List,and compared with the current mainstream malicious domain detection algorithms.The experimental results showed that the algorithm has wider detection range and better application value on the basis of keeping the higher detection accuracy.

关 键 词：域名白名单 域名黑名单 双向长短时记忆神经网络 卷积神经网络 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]