Credibility-Based Internet Malicious Domain Name Detection Method

Abstract

A credibility-based detection method for Internet malicious domain names is applied in the field of cyberspace security. Including: 1. Use XGBoost, LSTM, Bagging and other machine learning to learn from a large number of malicious domain name samples and normal domain name samples, and establish a malicious domain name detection model with various heterogeneous algorithms; 2. Calculate through statistical learning algorithms The credibility of XGBoost, LSTM, Bagging and other detection models for the prediction results of suspicious domain names; third, use the credibility of the calculated model prediction results to fuse the prediction results of multiple models to realize the collaborative defense of heterogeneous models. The present invention selects 13 domain name feature values, uses various machine learning models to analyze domain names to obtain credibility, and adopts a simple voting method to fuse models on the basis of credibility, thereby improving the accuracy of domain name analysis.

Description

technical field [0001] The invention belongs to the field of computer network space security. Background technique [0002] With the development of the network, cyberspace security has received attention from all aspects, and the emerging cyberspace security threats have become new challenges that people have to face. The rapid growth of targeted network attacks has directly spawned domain name services; and domain name analysis has always been a hot issue in the field of cyberspace security, which can make threats more visible, respond to targeted attacks more quickly, strengthen strategic planning and investment, and effectively mitigate At present, the problem of offense and defense asymmetry in combating network attacks also provides technical support for real-time awareness of network situations. In recent years, the number of cyberspace security threats in my country has surged. However, in our country's analysis of malicious domain names, there are still problems su...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the present invention is to solve the problem that traditional analysis methods are difficult to resist new domain names and the degree of model degradation is obvious in the case of increasing number of domain names, resulting in the inability to obtain comprehensive and accurate results for domain name predictions, and to provide a credibility-based Internet Malicious domain name detection method

Images