Detection of malicious domain name based on a classifier combination

Jiantao SHENG; Maofei CHEN; Dongxin LIU; Laifu WANG; Guoshui SHI; Huamin JIN

doi:10.11959/j.issn.1000-0801.2020150

您当前的位置：

首页 >

文章列表页 >

Detection of malicious domain name based on a classifier combination

Topic: Intelligent and Highly Confrontational Development of Network Security | 更新时间：2024-06-05

- Detection of malicious domain name based on a classifier combination
- Telecommunications Science Vol. 36, Issue 5, Pages: 47-55(2020)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.1000-0801.2020150
  CLC： TP393
- Published Online：2020-05，
  
  Published：20 May 2020
- 稿件说明：
移动端阅览
Jiantao SHENG, Maofei CHEN, Dongxin LIU, et al. Detection of malicious domain name based on a classifier combination[J]. Telecommunications science, 2020, 36(5): 47-55.
DOI：

Jiantao SHENG, Maofei CHEN, Dongxin LIU, et al. Detection of malicious domain name based on a classifier combination[J]. Telecommunications science, 2020, 36(5): 47-55. DOI： 10.11959/j.issn.1000-0801.2020150.

摘要

域名系统是互联网中不可或缺的关键基础服务，难以避免遭到不法分子的滥用。在研究僵尸网络和DGA恶意域名应用的基础上，比较了当前主流的恶意域名检测技术，提出了基于组合分类器的恶意域名检测技术框架。该技术框架以支持向量机为主分类器，融合了朴素贝叶斯分类器模型和其他统计特征。实验数据表明，该技术框架在离线训练时长、对未知DGA恶意域名家族的检测能力方面表现优秀，可以较好地满足运营商大网环境下对恶意域名的检测分析要求。

Abstract

As a fundamental service on the internet

domain name system (DNS) can inevitably be abused by malicious activities.Based on the studies of Botnets and other malwares which made use of the domain generation algorithm (DGA)

and researches on current major techniques of malicious domain detection

a malicious domain detection framework based on a classifier combination was proposed.The framework applied the support vector machine (SVM) as its main classifier and combined the naive Bayes classifier (NBC) supportively with some statistical characteristics.Experiment result demonstrates that the framework outperformes current techniques in the offline-training time and the capability of detecting unknow malicious domain families

which satisfies the requirement of internet service provider (ISP) to detect and analyze malicious domainson the internet.

关键词

Keywords

references

安天安全研究与应急处理中心 . 安天针对勒索蠕虫“魔窟”(WANNACRY) 的深度分析报告 [R ] . 2017 .

Antiy CERT . An in-depth analysis report on the blackmail worm WANNACRY [R ] . 2017 .

SkyEye 天眼实验室 . APT OceanLotus 数字海洋的游猎 [R ] . 2015 .

SkyEye Laboratory . APT OceanLotus digital ocean safari [R ] . 2015 .

臧小东 , 龚俭 , 胡晓艳 . 基于AGD的恶意域名检测 [J ] . 通信学报 , 2018 , 39 ( 7 ): 15 - 25 .

ZANG X D , GONG J , HU X Y . Detecting malicious domain names based on AGD [J ] . Journal on Communications , 2018 , 39 ( 7 ): 15 - 25 .

蒋鸿玲 , 戴俊伟 . DGA恶意域名检测方法 [J ] . 北京信息科技大学学报(自然科学版) , 2019 , 34 ( 5 ): 45 - 50 .

JIANG H L , DAI J W . DGA malicious domain name detection method [J ] . Journal of Beijing Information Science ＆ Technology University , 2019 , 34 ( 5 ): 45 - 50 .

王震 . 基于SVM的DGA域名检测方法研究 [D ] . 山东:济南大学 , 2018 .

WANG Z . Research on DGA domain name detection method based on SVM [D ] . Shandong:Jinan University , 2018 .

王志宏 , 杨震 . 人工智能技术的哲学及系统性思考 [J ] . 电信科学 , 2018 , 34 ( 4 ): 12 - 21 .

WANG Z H , YANG Z . Philosophy and systematic thinking of artificial intelligence technology [J ] . Telecommunications Science , 2018 , 34 ( 4 ): 12 - 21 .

YU B , GRAY D L , PAN J , et al . Inline DGA Detection with Deep Networks [C ] // Proceedings of IEEE International Conference on Data Mining Workshops (ICDMW) . Piscataway:IEEE Press , 2017 : 683 - 692 .

绿盟科技 . 2019年BOTNET趋势报告 [R ] . 2020 .

NSFOCUS . BOTNET trends report 2019 [R ] . 2020 .

Views

635

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

GMTBLC: a deep learning-based bi-modal network traffic classification method

Research on antenna dip angle recognition method based on improved YOLOv5

Mixed signal modulation recognition method based on temporal depth residual shrinkage network

Research on fault prediction of computer network nodes driven by log information

Research on telecom industry customer churn prediction based on explainable machine learning models

Related Author

WEI Debin

JIANG Qinlong

WEN Jinglong

WANG Xinrui

ZHANG Ning

PAN Feng

GENG Lujing

CHEN Zuhao

Related Institution

School of Information Engineering, Dalian University

China Mobile Group Design Institute Co., Ltd.

China Mobile Group Co., Ltd.

The 63rd Research Institute, National University of Defense Technology

School of Electronic and Information Engineering, Nanjing University of Information Science and Technology

⁰