The method comprises the following steps: firstly, collecting flow information of an
algorithm generated
domain name (DGA
domain name) and a benign
domain name of a known classification
label, wherein the flow information comprises an analysis
IP address and Flow data of the domain name; performing primary
processing on the collected flow data, counting the occurrence frequency of each resolution IP of
a domain name, and screening out information such as a
source address, a destination address and time from the Flow data; calculating eight characteristic values of the domain name according to the flow information, wherein the eight characteristic values comprise the user IP access number, the active frequency, the standard variance mean value ratio of the number of times of occurrence of each analysis IP and the like; putting the
feature data into a C4.5 supervised classification model for training to obtain a classification model with classification capability; and finally, collecting flow information of to-be-classified domain names, calculating
feature data, and putting the
feature data into the trained classification model for classification. According to the method, the difference between the flow behavior expression and the benign domain name when the domain name is generated by an
algorithm to carry out malicious activities is utilized, the two types of domain names are effectively distinguished, the antagonistic
attack is resisted, and the security of the network is maintained.