Malicious domain name detection method and system based on deep network with adversarial training

Abstract

The invention discloses a malicious domain name detection method and system based on a deep network with adversarial training. The method includes the following steps: (1) obtaining malicious domain name samples; (2) preprocessing malicious domain name samples; (3) network model training, selecting C‑RNN‑GAN generative adversarial network model; (4) obtaining samples of suspicious domain names; (5) discriminating output; (6) judging suspicious domain names. The method and system for detecting malicious domain names based on a deep network with adversarial training disclosed by the invention utilizes the characteristics of a generative adversarial network to obtain a discriminator for calculating the authenticity of domain names through adversarial training. The discriminator makes robust judgments based on the multi-dimensional features behind the domain name samples, and can be used as a classifier for malicious domain name detection. The invention adopts the method of generating confrontation network to learn the data features behind malicious domain name samples, which is fully suitable for the actual situation of network security attack and defense confrontation, and can realize self-learning and self-improvement. Effectively improve the accuracy of domain name classification.

Description

technical field [0001] The invention relates to the technical field of artificial intelligence and control, in particular to a malicious domain name detection method and system based on a deep network with confrontation training. Background technique [0002] Domain Name System (DNS) is a part of the entire Internet, which completes the mutual mapping between IP addresses and domain names, and is used to resolve domain names into IP addresses during network communication, which is convenient for memory and use. If the DNS configuration is unreasonable, it may lead to slow network speed, the website cannot be opened, and malicious DNS may even cause malicious behaviors such as advertisement pop-ups, fraud, monitoring and hijacking modification. [0003] In recent years, DNS security problems have occurred frequently. As the largest and most complex distributed database in the world, DNS is difficult to cope with the increasingly complex modern communication network due to it...

AI Technical Summary

Problems solved by technology

Although this method has high detection accuracy, it requires a lot of expert knowledge. Due to the limitation of insufficient expert knowledge, the detection recall rate cannot meet the requirements, and malicious domain names are missed; the method based on traditional machine learning requires a large amount of expert knowledge. Sample labeled data, using algorithms such as clustering, support vector machines, and decision trees to calculate and classify. This method requires a large amount of manually labeled data and the cooperation of algorithms, and is often difficult to apply to large-scale application examples

Images