Malicious domain name detection method based on SMOTE and BI-LSTM network

Abstract

The invention relates to a malicious domain name detection method based on SMOTE and BI-LSTM. The method comprises the following steps of carrying out data preprocessing on domain names in a trainingset in order to obtain a domain name character sequence training set D; carrying out equalized data synthesis on the domain name character sequence training set D by utilizing an improved SMOTE algorithm in order to obtain an enhanced and equalized training set D'; constructing and initializing a neural network model comprising a BI-LSTM layer and a full-connection layer; converting the domain names in the training set D' into representation vectors with the fixed length; inputting the representation vectors of the domain names obtained in the step D into the BI-LSTM layer of the neural network model in order to obtain context vectors of the domain names; inputting he context vectors of the domain names into the full-connection layer of the neural network model in order to obtain a trainedneural network model; and converting the domain names to be judged into a character sequence, inputting the trained neural network model, and outputting a judgment result.

Description

technical field [0001] The invention relates to the field of network security, in particular to a method for detecting malicious domain names based on SMOTE and BI-LSTM. . Background technique [0002] DGA (Domain Name Generation Algorithm) is a technical method that uses random characters to generate C&C domain names to evade domain name blacklist detection. In order to prevent C2 (Command&Control) traffic that generates DGA, security organizations must first discover the DGA algorithm through reverse engineering, and then generate a list of domains with a given seed, in order to deal with malicious domain names in a timely manner. DGA technology will greatly increase the difficulty of combating and shutting down central structure botnets (such as Conficker-A / B / C botnets, Kraben botnets, etc.): Botnets use this technology to dynamically generate domain names in order to avoid domain name blacklists. Faced with this situation, inspectors need to detect and identify the DGA...

AI Technical Summary

Problems solved by technology

[0004] Under the background of the rapid development of global network informatization, the existing methods mostly have problems such as low efficiency, unsatisfactory detection accuracy and passive defense in the face of a large number of DGA domain names with diverse sources.

At the same time, these domain names are very difficult to detect in the face of the way they are generated and contacted every day

Images