Malicious domain name detection method based on comparative learning under limited training samples

Abstract

The invention provides a malicious domain name detection method based on comparative learning under a limited training sample, and the method specifically comprises the steps: introducing a comparative learning thought to design a neural feature extractor based on a twin network, constructing similar / heterogeneous label coding domain name pairs, and carrying out training; inputting the obtained domain name neural feature vector set into a machine learning algorithm model, and conducting training to obtain a domain name classifier; and sequentially inputting the domain name to be detected into the feature extractor and the domain name classifier to obtain a discrimination result. According to the method, the problem of insufficient samples is relieved from the perspective of data, the features can be automatically extracted, and the features have high distinction degree, so that further detection is facilitated, malicious domain name samples can be more effectively detected, communication in malicious activities can be intercepted, further propagation of the communication is avoided, and therefore, the security defense and supervision capability on common hostile attack modes such as botnets and the like is improved.

Description

technical field [0001] The invention belongs to the technical field of cyberspace security, and relates to a method for detecting malicious domain names based on comparative learning under limited training samples. Background technique [0002] Some common malicious attack modes, such as botnets, phishing websites, and ransomware, pose a huge threat to normal network activities and become a research hotspot in the security field. Domain names play a pivotal role in these malicious activities. Attackers use Domain Generation Algorithms (DGA) to generate a large number of alternative malicious domain names (called Algorithmically-Generated Domains, AGD) and select a small number for registration. Due to the large number of such malicious domain names, rapid changes, and short life cycle, traditional blacklist security detection methods are ineffective against these attack modes. The zombie host can establish a connection with a remote command and control server (Command&Cont...

AI Technical Summary

Problems solved by technology

In existing studies, both ML and DL methods are based on sufficient samples (multiple million levels), and only use category weights to alleviate the problem of sample imbalance, which cannot be well adapted to the situation of limited training samples.

Images