Malicious domain name detection method and system based on RNN-SPP network

Abstract

The invention relates to a malicious domain name detection method based on RNN-SPP network which comprises the following steps: carrying out data preprocessing on domain names in a training set to obtain a domain name character sequence training set D; performing equalization data synthesis on the domain name character sequence training set D by utilizing an improved SMOTE algorithm to obtain an equalization-enhanced training set D '; constructing and initializing a neural network model comprising a cyclic convolution RCNN based on spatial pyramid SPP pooling; converting the domain name in thetraining set D' into a representation vector with a fixed length; inputting the representation vector of the domain name obtained in the step D into the RCNN-SPP neural network model to obtain a feature vector of the domain name; inputting the context vector of the domain name into a full connection layer of the neural network model to obtain a trained neural network model; and converting the domain name to be judged into a character sequence, inputting the character sequence into the trained neural network model, and outputting a judgment result.

Description

technical field [0001] The invention relates to the field of network security, in particular to an RCNN-SPP network-based malicious domain name detection method and system. Background technique [0002] DGA (Domain Name Generation Algorithm) is a technical method that uses random characters to generate C&C domain names to evade domain name blacklist detection. In order to prevent C2 (Command&Control) traffic that generates DGA, security organizations must first discover the DGA algorithm through reverse engineering, and then generate a list of domains with a given seed, in order to deal with malicious domain names in a timely manner. DGA technology will greatly increase the difficulty of combating and shutting down central structure botnets (such as Conficker-A / B / C bots, Krabenbotnet, etc.): Botnets use this technology to dynamically generate domain names in order to avoid domain name blacklists. Faced with this situation, inspectors need to detect and identify the DGA fami...

AI Technical Summary

Problems solved by technology

[0004] Under the background of the rapid development of global network informatization, the existing methods mostly have problems such as low efficiency, unsatisfactory detection accuracy and passive defense in the face of a large number of DGA domain names with diverse sources.

At the same time, these domain names are very difficult to detect in the face of the way they are generated and contacted every day

Images