DGA domain name detection method based on random forest

Abstract

The invention discloses a DGA domain name detection method based on random forest, comprising steps of constructing a knowledge database which comprises a black-and-white list sample library and a word dictionary, setting a domain name characteristic template, using the domain name in the black-and-white list as a training set, filtering the noise, performing training and off-line storage on the random forest algorithm model, obtaining a domain name to be detected, loading an optimal random forest algorithm model, and using the domain name to be detected as an input to obtain the prediction result. The invention does not rely on the DNS data which is obtained on line, can not only fast finish the DGA domain name detection, but also provides prediction to the other malicious domain name detection methods. Besides, the DGA domain name detection method is based on the forest algorithm and has an obvious advantage on the noise interference, and is less in resource consumption, high in operation efficiency and good in generalization.

Description

technical field [0001] The invention relates to a random forest-based DGA domain name detection method, which belongs to the field of network security. Background technique [0002] Malicious domain names refer to website domain names that spread worms, viruses, and Trojan horses, or conduct illegal activities such as fraud and pornography. As Domain-Flux and Fast-Flux technologies are more and more widely adopted by hackers, network attacks are more concealed, malicious tracking is more difficult, and security risks are more permanent. Among them, domain names generated by domain generation algorithms (Domain Generation Algorithm, DGA) are widely used in botnets (Botnet). In a network composed of a large number of hosts (Bot) infected by bots, the attacker (BotMaster) can manipulate the Bot to launch various types of network attacks through the control server, such as distributed denial of service (DDoS), spam (Spare) , Phishing (Phishing), click fraud (ClickFraud) and st...

AI Technical Summary

Problems solved by technology

[0006] The above two types of methods have the following limitations: 1. In the method based on structural features, the existing two patents start from the similarity measurement, and obtain the threshold by calculating the sample pair to determine whether the domain name to be detected is a counterfeit domain name or an unknown linked domain name. horse website

The above method uses a relatively simple similarity measurement method, the characteristics considered are relatively single, the setting threshold is affected by the training samples, the false negative or false negative rate is high, and the generalization of the method is poor.

2. Most of the methods based on access behavior are based on an assumption: there are fundamental differences in the access behaviors of malicious domain names and legitimate domain names

This is an online method that requires the deployment of related services on the DNS server, and the cost of obtaining these records and data online is relatively high

Images