Use of subword tokenization for domain generation algorithm classification  

作　　者：Sea Ran Cleon Liew Ngai Fong Law 

机构地区：[1]University of Waterloo,Waterloo,Canada [2]Department of Electrical and Electronic Engineering,The Hong Kong Polytechnic University,Kowloon,Hong Kong

出　　处：《Cybersecurity》2024年第2期1-12,共12页网络空间安全科学与技术（英文）

摘　　要：Domain name generation algorithm(DGA)classification is an essential but challenging problem.Both feature-extract-ing machine learning(ML)methods and deep learning(DL)models such as convolutional neural networks and long short-term memory have been developed.However,the performance of these approaches varies with different types of DGAs.Most features in the ML methods can characterize random-looking DGAs better than Word-looking DGAs.To improve the classification performance on word-looking DGAs,subword tokenization is employed for the DL mod-els.Our experimental results proved that the subword tokenization can provide excellent classification performance on the word-looking DGAs.We then propose an integrated scheme that chooses an appropriate method for DGA classification depending on the nature of the DGAs.Results show that the integrated scheme outperformed existing ML and DL methods,and also the subword DL methods.

关 键 词：Botnet detection Domain names Network security Machine learning-based botnet detection 

分 类 号：TN915[电子电信—通信与信息系统]