Machine learning-based domain generation algorithm (DGA) domain name rapid determining method and device

Abstract

The invention provides a machine learning-based domain generation algorithm (DGA) domain name rapid determining method and device, relating to the technical field of network security. The machine learning-based DGA domain name rapid determining method comprises the steps of building a training set comprising multiple DGA domain names and normal domain names; extracting a domain name characteristicof each domain name in the training set; normalizing the domain name characteristics so as to obtain a characteristic data set; and building a domain name classifier model according to the characteristic data set. According to the method and device, richer, more representative domain name characteristics are extracted by researching the domain names; the characteristic data is normalized so as tospeed up training and tests to improve calculation efficiency; and finally, the characteristic data set is trained by using a machine learning algorithm so as to obtain the domain name classifier model, so that determining accuracy is improved, further, generalization capability is improved.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a method and device for quickly identifying DGA domain names based on machine learning. Background technique [0002] DGA domain name refers to a series of random domain names generated by Domain Generation Algorithm. This method is common in botnets (Botnet), such as conficker, zeus, etc., they will use a private random string generation algorithm to generate some random string domain names every day according to dates or other random seeds, and then modify some of the domain names Register to commit fraud, spread malware, distribute pornographic content and other illegal activities. [0003] As technologies such as Domain-Flux and Fast-Flux are more and more widely used by hackers, cyber attacks using DGA domain names are more concealed and difficult to track. As long as the infected machines in the botnet try to generate these random domain names according t...

AI Technical Summary

Problems solved by technology

[0004] The traditional method mainly relies on the experience of white hats for detection. This method consumes a lot of manpower and is difficult to meet today's huge task requirements.

Another type of method is based on feature construction, triggered by similarity measurement, and obtains the threshold by calculating sample pairs, so as to determine whether the domain name to be detected is a DGA domain name. It uses a relatively simple similarity measurement method, considers a single feature, and has relatively low generalization performance. Poor, the accuracy rate is not high

Images