基于对抗训练和自注意力机制的恶意域名检测  

Malicious domain name detection based on adversarial training and self-attention mechanism

作　　者：刘心怡 郭树育 赵沁泽 LIU Xinyi;GUO Shuyu;ZHAO Qinze(School of Digital and Intelligent Industry,Inner Mongolia University of Science&Technology,Baotou 014100,China;Inner Mongolia First Machinery Group Co.,Ltd,Baotou 014100,China)

机构地区：[1]内蒙古科技大学数智产业学院,内蒙古包头014100 [2]内蒙古第一机械有限集团,内蒙古包头014100

出　　处：《内蒙古科技大学学报》2024年第4期359-364,共6页Journal of Inner Mongolia University of Science and Technology

基　　金：内蒙古自治区直属高校基本科研业务费项目(2024QNJS081)。

摘　　要：针对已有的恶意域名检测方法特征工程复杂、效率低,提出一种融合对抗训练和自注意力机制的恶意域名检测方法。首先将域名序列进行字符级的表征;然后,使用双向长短期记忆网络自动的从输入中提取最佳的特征表示,并通过自注意力机制捕获域名文本中重要的信息;最后,将提取的关键信息送入分类器进行分类。另一方面,通过在输入层添加扰动来生成对抗样本扩充训练数据集,从而提高模型的鲁棒性和分类效果。实验结果表明:与现有的方法比,所提模型在各项指标上都取得了较好的效果。The current methods for malicious domain name detection are very complex from the engineering prospect and also not very efficient in its detection rate.A malicious domain detection method combined adversarial training and self-attention was proposed.First,the domain name sequence was characterized at the character level;then,the bidirectional long short-term memory network(bilstm)was used to automatically extract the best feature representation from the input,and the important information in the domain name was captured by the self-attention mechanism;finally,the extracted key information was sent to the classifier for classification.On the other hand,the training dataset was expanded by adding perturbations to the input layer to generate adversarial samples,thus improving the robustness and classification effectiveness of the model.The experimental results show that the proposed model achieves better performance than the existing methods in all indicators.

关 键 词：恶意域名 双向长短期记忆网络 自注意力机制 对抗训练 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]