DGA domain name detection method and system, electronic equipment and storage medium

Abstract

The invention provides a DGA domain name detection method and system, electronic equipment and a storage medium. The method comprises the following steps: respectively carrying out variable-length preprocessing and fixed-length preprocessing on an input full domain name character string sequence; the variable-length sequence or the fixed-length sequence is input into a first preset model, a first prediction result is output, and the first prediction result comprises N first numerical values; the fixed-length sequence is input into a second preset model, a second prediction result is output, the second prediction result comprises N second numerical values, and N is a positive integer; and selecting a DGA domain name detection result from a first prediction result and a second prediction result based on evaluation indexes of the first prediction result output by the first preset model and the second prediction result output by the second preset model. According to the DGA domain name detection method based on deep learning, the domain name character string sequence is input, the DGA domain name detection result is output through the deep learning model, and the method has the advantages of being real-time, lightweight, multi-classification detection, high in classification precision and the like.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a DGA domain name detection method and system, an electronic device and a storage medium. Background technique [0002] Malware has now become the No. 1 public enemy that threatens network security. In order to evade detection by security facilities, its production process is becoming more and more complicated. A typical method is to integrate DGA (Domain Generation Algorithm, domain name generation method) into the software. DGA is an automatic generation method of domain name strings, similar to the pseudo-random number generation method, which can continuously run to generate non-repeated domain name string sequences. The method runs simultaneously on the malicious program terminal (victim personal device, botnet terminal) and the malicious program control center in the same initial state, so that both parties obtain the same generated domain name sequence; when t...

AI Technical Summary

Problems solved by technology

The current method still has shortcomings: the training data sets of the model are all obtained from the network, and the authenticity cannot be distinguished, which affects the test accuracy; the classification model is relatively simple, and the information utilization and feature extraction capabilities of short texts such as domain names are limited, especially in In the multi-classification problem of DGA domain name, the classification accuracy still has a large room for improvement

Images