An Algorithm-Generated Domain Name Detection Method Based on Natural Language-like Features

Abstract

The invention discloses a domain name detection method based on an algorithm-generated natural language feature, comprising the following steps: Step 1: Select a domain name corpus, and use a feature extraction module to perform feature extraction on the domain name corpus; Step 2: Carry out parameter learning on the domain name corpus , to obtain the system parameters of each feature, and obtain a detection model based on the corpus; Step 3: Obtain the requested domain name information of the DNS server through the packet sniffing module; Step 4: Use the feature extraction module to perform feature extraction according to the requested domain name information; Step 5 : Detect the domain name according to the detection model in the real environment. The invention can detect the domain names generated by novel algorithms emerging one after another, classify the domain names and extract the features of each domain name respectively, thereby improving the accuracy of detection.

Description

technical field [0001] The invention relates to the field of algorithm-generated domain name detection, in particular to an algorithm-generated domain name detection method based on natural language-like features. Background technique [0002] The domain name system is a bridge connecting users and the Internet in the Internet, but due to the vulnerability of its own protocol design, a large number of malicious behaviors are controlled and attacked through the domain name system, such as botnets, Trojan horse viruses and advanced persistent threats (Advanced Persistent Threat, APT ) attack etc. At the same time, domain name generation technologies such as DNS positioning technology and fast domain name conversion technology are widely used in network attacks, so it is particularly important to detect generated domain names. At present, the detection of algorithm-generated domain names can be mainly divided into the following two categories: 1) Real-time or quasi-real-time D...

AI Technical Summary

Problems solved by technology

[0006] The technical problem to be solved by the present invention is to provide an algorithm-generated domain name detection method based on natural language-like features, which solves the problem of poor versatility for specific attacks or specific environments, and can detect endlessly emerging new algorithm-generated domain names. Carry out hierarchical feature extraction for each domain name to improve the accuracy of detection

Images