Large-scale malicious domain detection system and method based on self-feedback learning

Abstract

The invention discloses a large-scale malicious domain detection system and method based on self-feedback learning and relates to the technical field of computer network security. For the deficiency of an existing detection technology on mass data processing and detection model updating, a malicious domain real-time detection system applicable to large-scale data is designed and realized. A methodof extracting a small data set for verification and updating is provided innovatively. The online learning efficiency is improved. Core algorithms comprise an algorithm of detecting malicious domainsbased on a support vector machine (SVM) in mass real-time domain detection, an online learning algorithm fSVM based on the self-feedback learning and an automatic calibration algorithm. Through theoretical demonstration and experimental verification, according to the algorithms provided by the invention, when the newly-presented malicious domains are copied with, the response can be carried out timely, and the excellent operation efficiency is achieved. According to the system and the method, the further analysis of the detected malicious domains is also realized. The system and the method play an enlightening role in perceiving malicious domain related threat intelligence.

Description

technical field [0001] The invention relates to the technical field of computer network security, in particular to a large-scale malicious domain name detection system and method based on self-feedback learning. Background technique [0002] A DDoS attack is a common attack launched by a controlled botnet. A botnet is a collection of infected systems. Attackers need to use DNS to resolve the address of the control server. At the same time, technologies such as Fast Flux hide the source of the attack, linking a collection of multiple IP addresses to a specific domain name. And swap new addresses in and out of DNS records to avoid detection. DNS communication as a covert channel has also begun to be widely used by attackers. Random Domain Name Generation Algorithm (DGA) is a domain name generation algorithm used by hackers to evade detection. Traditional detection methods use blacklist databases to detect malicious domain names, but they are helpless in the face of this new...

AI Technical Summary

Problems solved by technology

Such a malicious domain name has a short survival time. When the blacklist is updated, the attack is likely to be over or the domain name is no longer available. A detection system that can respond quickly and in time is needed to deal with this attack.

Images