DGA domain name detection model construction method, device, server and storage medium

Abstract

The application discloses a DGA domain name detection model construction method and device, a server and a storage medium. The method includes the following steps of: acquiring a training data set, wherein the training data set includes DGA domain names and legal domain names; dividing the training data set into a plurality of training data sub-sets, wherein each training data sub-set includes atleast one DGA domain name and at least one legal domain name; training each training data sub-set by using a classification algorithm to obtain a plurality of detection sub-models; sequentially inputting test samples into each detection sub-model to obtain a prediction label set of the test samples; and fusing the prediction label set according to a decision strategy to obtain a final label of thetest samples. According to the DGA domain name detection model construction method provided by the embodiment of the application, the plurality of detection sub-models are obtained by grouping the training data set, the complete learning of the training data set can be realized, and the characteristics of actual DGA domain names can be embodied.

Description

Technical field [0001] This application generally relates to the field of computer technology, and specifically relates to a method, device, server and storage medium for constructing a DGA domain name detection model. Background technique [0002] Domain generation algorithm (Domain generation algorihms, DGA) domain name is a kind of random domain name automatically generated by algorithm. Malware or latent attack programs often establish a network connection with an external control server through the DGA domain name, and execute network attacks such as data theft according to instructions issued by the attacker. Therefore, DGA domain name detection is of great significance for detecting latent attacks. [0003] At present, in DGA domain name detection, machine learning algorithms are usually used to train the structural features of the acquired domain name to obtain a DGA detection model, and then the DGA detection model is obtained through training to detect the DGA domain nam...

AI Technical Summary

Problems solved by technology

[0005] In view of the above defects or deficiencies in the prior art, it is expected to provide a DGA domain name detection model construction method, device, server and storage medium to solve the problem that a single DGA domain name detection model cannot fully reflect the characteristics of the actual DGA domain name

Images