基于字符特征的DGA域名检测方法研究综述  

Survey of DGA Domain Name Detection Based on Character Feature

作　　者：王宇 王祖朝 潘瑞 WANG Yu;WANG Zuchao;PAN Rui(School of Science,China University of Geosciences(Beijing),Beijing 100083,China;China Academy of Information and Communications Technology,Beijing 100191,China)

机构地区：[1]中国地质大学(北京)数理学院,北京100083 [2]中国信息通信研究院,北京100191

出　　处：《计算机科学》2023年第8期251-259,共9页Computer Science

基　　金：国家自然科学基金(62071152)。

摘　　要：利用域名生成算法(Domain Generation Algorithm,DGA)可以生成大量的随机域名,近年来僵尸网络普遍使用DGA域名来增强隐蔽性。高效的检测DGA域名,对发现僵尸网络和保障网络信息安全具有重要意义。基于字符特征的DGA域名检测指仅利用域名的字符串完成检测,是一种实时检测方法,也是近年来对DGA域名检测研究的热点。对此类方法进行研究发现,使用传统机器学习和深度学习算法能够有效地检测DGA域名。但是对基于单词表的DGA域名、长度较短的DGA域名和新型DGA域名,还需要通过改进词嵌入方式、引入注意力机制或加入对抗样本等方法,来提高检测能力。最后对基于字符特征的DGA域名检测方法进行总结,分析不同检测方法的优点和存在的问题,提出了未来的研究方向和研究中需要解决的关键问题。Recent years have seen extensive adoption of domain generation algorithms(DGA)by botnets.Efficient detection of DGA domain name is of great significance for discovering botnets and ensuring cyber security.DGA domain name detection me-thod based on character feature can complete the detection only by using the domain name string.It is a real-time detection me-thod,and has become a hot spot in the research on DGA domain name detection.Research on such methods shows DGA domain name can be effectively detected by using traditional machine learning or deep learning.However,for wordlist-based DGA domain name,shorter-length DGA domain name,or new variant DGA domain name,it is still necessary to improve the detection ability by improving word embedding method,introducing attention mechanisms,or joining adversarial samples,etc.Finally,this paper summarizes the above methods,analyzes their advantages and existing problems,and proposes future research directions and key issues that need to be addressed for DGA domain name detection.

关 键 词：网络安全 DGA域名检测 机器学习 深度学习 词嵌入 注意力机制 对抗样本 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]