Method for evaluating domain name and server thereof

A server and name technology, applied in neural learning methods, network data retrieval, other database retrieval, etc., can solve problems such as hidden features that are difficult to judge with human eyes, too long domain names, and large DNS traffic.

Pending Publication Date: 2020-05-08
ACER CYBER SECURITY INC
View PDF5 Cites 0 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

Even if the relevant network administrators can still use some subtle clues to speculate which domain names may be generated by DGA (for example, domain names are mostly meaningless strings, domain names are too long, etc.), due to DNS The traffic is usually very large, and it is difficult to check item by item
Moreover, there are many types of DGA, and the recessive features produced by some of them are even more difficult to judge by human eyes.

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Method for evaluating domain name and server thereof
  • Method for evaluating domain name and server thereof
  • Method for evaluating domain name and server thereof

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0039] Generally speaking, the method proposed by the present invention can first train the LSTM model with a large amount of training data based on deep learning technology, and then input the unknown domain name into the LSTM model to predict the unknown domain name using the LSTM model is the probability generated by DGA.

[0040] Deep learning (Deep learning) is one of the branches of machine learning, which is constructed from a multi-layer neural network (Neural network). Please refer to figure 1 , which is a schematic diagram of a neural network and a deep learning neural network. Such as figure 1 As shown, the above-mentioned neural network is a mathematical model imitating the biological nervous system, which usually has several layers, and each layer contains a plurality of neurons (neurons). Each neuron first multiplies the input value of the neuron in the previous layer by the weight and sums it up, and after being transformed by the activation function, it outp...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

PUM

No PUM Login to View More

Abstract

The invention provides a method for evaluating a domain name and a server thereof. The method comprises the following steps: obtaining an original network domain name, and dividing the original network domain name into a plurality of parts; taking out a specific part in the foregoing parts, wherein the specific part comprises a character; encoding the character into encoded data; filling the codeddata to a specific length; projecting the filled coded data to a plurality of embedded vectors; sequentially inputting the embedded vectors into a plurality of units in a long-term and short-term storage model to generate result vectors; and converting the result vector into a prediction probability through a full connection layer and a specific function.

Description

technical field [0001] The present invention relates to a method for evaluating a domain name and its server, in particular to a method for evaluating whether a domain name is a probability generated by a domain generation algorithm (Domain Generation Algorithm, DGA) and its server. Background technique [0002] When a hacker intends to attack certain devices, he will try various possible ways to implant viruses (eg, Bot virus) into the victim's device, and then infect the victim's device. When hackers control multiple infected devices, they can form a botnet and launch attacks on the target when needed (for example, distributed denial-of-service attack (DDos) attack). During the incubation period, the Bot virus needs to keep in touch with the command and control (Command and Control, C2) server to update the latest version of the instructions and allow hackers to accurately grasp the quantity and status of the Bot virus. In order to improve the Bot virus To increase the su...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More

Application Information

Patent Timeline
no application Login to View More
IPC IPC(8): G06F16/955G06N3/04G06N3/08
CPCG06N3/084G06N3/044G06N3/045
Inventor林品铨吴君勉吴侑峻孙明功张宗铨曾奕中黄琼莹
OwnerACER CYBER SECURITY INC