Detection Metbod of Trojan's Control Domain Based on Improved Neural Network Algoritbm

Aijiang Liu; Changhui Huang; Guangjun Hu

doi:10.3969/j.issn.1000-0801.2014.07.007

您当前的位置：

首页 >

文章列表页 >

Detection Metbod of Trojan's Control Domain Based on Improved Neural Network Algoritbm

Topic: Network information security | 更新时间：2024-06-05

- Detection Metbod of Trojan's Control Domain Based on Improved Neural Network Algoritbm
- Telecommunications Science Vol. 30, Issue 7, Pages: 39-42(2014)
- 作者机构：
  
  1. 公安部科技信息化局北京100741
  2. 公安部第一研究所北京100048
- 作者简介：
- 基金信息：
- DOI：10.3969/j.issn.1000-0801.2014.07.007
  CLC：
- Published Online：2014-07，
  
  Published：20 July 2014
- 稿件说明：
移动端阅览
Aijiang Liu, Changhui Huang, Guangjun Hu. Detection Metbod of Trojan's Control Domain Based on Improved Neural Network Algoritbm[J]. Telecommunications science, 2014, 30(7): 39-42.
DOI：

Aijiang Liu, Changhui Huang, Guangjun Hu. Detection Metbod of Trojan's Control Domain Based on Improved Neural Network Algoritbm[J]. Telecommunications science, 2014, 30(7): 39-42. DOI： 10.3969/j.issn.1000-0801.2014.07.007.

摘要

摘要：首先对木马利用域名进行回连控制的特点进行了分析，对采用DNS进行网络木马检测的方法进行了概述，接着基于对木马域名的静态、动态特征的分析，提取了域名使用时间、访问域名周期性、IP 地址变化速度、IP地址所属国变更、IP地址为私有地址、同域名多IP 地址分属不同国家、TTL 值、域名搜索量8个指标作为BP神经网络算法的输入，并提出了一种改进BP神经网络算法来解决大量DNS域名训练效率、平均误差值大的问题；最后用改进的神经网络算法对样本进行了实验评估测试，结果显示改进算法和传统算法的检出率相当，但检测效率大为提高。

Abstract

Firstly

the character that the Trojans use domain name to control was analyzed and the method that DNS adopted to detect Trojans was introduced. Secondly

based on the analysis of static and dynamic characters for Trojan domain name

eight indicators were obtained as the input of BP neural network algorithm

including operation time of domain name

the period to visit the domain name

the variation speed of IP address

the country change of IP address

IP address of private address

the same domain name with multiple IP address for different countries

TTL value and search times of domain name. An improved BP neural network algorithm was proposed to solve training efficiency for a great number of domain names

and large average error. Finally

the experimental evaluation of samples was tested by improved neural network algorithm. Compared with traditional neural network algorithm

the detection efficiency is better.

关键词

Keywords

references

Mockapetris P . Domain Names-Concepts and Facilities. RFC1034 ， 1987

Seifert C ， Welch I ， Komisarczuk P ， et al . Identification of malicious web pages through analysis of underlying DNS and web server relationships . Proceedings of the 33rd IEEE Conference on Local Computer Networks , Montreal, Canada ， 2008 ： 935 ～ 941

Choi H , Lee H , Lee H , et al . Botnet detection by monitoring group activities in DNS traffic . Proceedings of the 7th IEEE International Conference on Computer and Information Technology（CIT'07） , Washington, DC, USA , October 2007 ： 715 ～ 720

Foo S , Hui S C , Yip S W , et al . Approaches for resolving dynamic IP addressing . Internet Research , 1997 , 7 （ 3 ): 208 ～ 216

Ramachandran A , Feamster N , Dagon D . Revealing botnet membership using DNSBL counter-intelligence . Proceedings of the 2nd Workshop on Steps to Reducing Unwanted Traffic on the Internet（SRUTIˊ06） , San Jose, CA , 2006 : 49 ～ 54

Dagon D , Zou C , Lee W . Modeling botnet propagation using time zones . Proceedings of NDSS , San Diego, California, USA , 2006

Hirasawa K , Oka S , Sakai S , et al . Learning Petri network with route control . Proceedings of IEEE International Conference on Systems, Man, Cybernetics , Vancouver, BC, Canada , 1995 : 2706 ～ 2711

Alexa . http://www.alexa.com/topsites http://www.alexa.com/topsites , 2012

mirror2.malwaredomains.com . http://mirror2.malwaredomains.com/files/ http://mirror2.malwaredomains.com/files/ , 2012

Views

458

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Influence maximization algorithm of social networks based on Transformer model

Application on text classification of telecom user complaints based on GRW and FastText model

Antenna azimuth diagnosis based on multi-layer perceptron model

Optical fiber eavesdropping detection method based on machine learning

Polar codes decoding algorithm based on convolutional neural network

Related Author

YAN Chenxue

YAO Yao

YU Shuke

Xiaojun YANG

Jin ZHAO

Xiangrong CHEN

Huibin ZHANG

Haokun SONG

Related Institution

School of Electronics and Information, Jiangsu Vocational College of Business

Wuxi Power Supply Company,State Grid JiangSu Electric Power Co.,Ltd.

State Key Laboratory of Information Photonics and Optical Communications,Beijing University of Posts and Telecommunications

Power Information Technology Co., Ltd., Beijing , China

State Grid Energy Research Institute Co.,Ltd.

⁰