DGA domain name detection method based on GAN and Char-CNN

Abstract

The invention provides a DGA domain name detection method based on a GAN and a Char-CNN, which is used for solving the problem of low detection recall rate of a low-randomness DGA domain name in the prior art, and comprises the implementation steps of obtaining a training sample set and a verification sample set; constructing a generative adversarial network (GAN) and a character-level convolutional neural network (Char-CNN); carrying out iterative training on the GAN; obtaining an augmented training set; carrying out iterative training on a character-level convolutional neural network Char-CNN; and detecting the domain name based on the trained character-level convolutional neural network Char-CNN '. According to the method, the GAN is used for generating the adversarial domain name to augment the data set, the richness of the training sample set is improved, the error rate of the detection model is reduced through the residual block structure, the detection recall rate of the low-randomness DGA domain name is increased. Meanwhile, hyper-parameters needing to be calculated by the Char-CNN are few, and the training time of the detection model is shortened.

Description

technical field [0001] The invention belongs to the technical field of network security, relates to a DGA domain name detection method, in particular to a DGA domain name detection method based on GAN and Char-CNN, which can be used for locating infected hosts, shutting down botnets and defending against network attacks. Background technique [0002] A DGA domain name is a domain name that is regularly generated using the domain name generation algorithm DGA (Domain Generation Algorithms) based on random seeds such as numbers, dates, and Twitter hotspots. Cyber ​​attackers register DGA domains as a medium for bots to communicate with command and control servers, and this large number of potential DGA domains makes it difficult for law enforcement to effectively shut down botnets. DGA domain names seriously threaten the security of network hosts, especially the new low-random DGA domain names are more concealed and more threatening. Effective detection of DGA domain names is ...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to address the above-mentioned deficiencies in the prior art, and propose a DGA domain name detection method based on GAN and Char-CNN, which is used to solve the problem of low recall rate of detection of low-randomness DGA domain names in the prior art

Images