A malicious domain name processing method, apparatus, device and machine-readable storage medium

Abstract

The present disclosure provides a malicious domain name processing method, device, device and machine-readable storage medium. The method includes: acquiring training samples that meet preset requirements, extracting sample features from the training samples according to preset dimensions; and according to the extracted sample features , perform sample clustering on the training samples, and use BiLstm to train and generate a classifier; use the classifier to process the features extracted according to the domain name to be determined, and determine whether the domain name to be determined belongs to the DGA domain name; the preset dimensions include : Domain name length, initial proportion, numerical proportion, domain name entropy. Through the technical solution of the present disclosure, the initials of pinyin are used as one of the dimensions of the training model, and the algorithm model obtained can effectively reduce the false alarm rate of domestic websites. At the same time, the training method provided by the present disclosure has simple and efficient feature extraction, and can determine the DGA domain name. High accuracy and low resource consumption.

Description

technical field [0001] The present disclosure relates to the field of communication technologies, and in particular, to a malicious domain name processing method, apparatus, device, and machine-readable storage medium. Background technique [0002] Malware has now developed into the number one public enemy that threatens network security. In order to evade detection by security facilities, its production process has become more and more complicated. One of the typical methods is to integrate the DGA (Domain Generation Algorithm) algorithm in the software to generate rapidly changing domain names. As a backup or main means of communicating with the C2 server, this method can construct a more robust botnet and achieve continuous control of infected broilers. Correspondingly, the research on DGA algorithm is also a hot topic of discussion in the security circle. There are also a lot of DGA domain name detection work in academia and industry, but there are too many false positiv...

AI Technical Summary

Problems solved by technology

[0004] In view of this, the present disclosure provides a malicious domain name processing method, device, electronic equipment, and machine-readable storage medium to improve the above-mentioned technical problem of high false positive rate

Images