Internet malicious domain name detection method based on credibility

Abstract

The invention discloses an Internet malicious domain name detection method based on credibility. The method is applied to the field of network space safety. The method comprises the following steps: 1, learning massive malicious domain name samples and normal domain name samples by using various machine learning such as XGBoost, LSTM and Bagging, and establishing malicious domain name detection models of various heterogeneous algorithms; 2, calculating the credibility of a plurality of detection models such as XGBoost, LSTM and Bagging to the suspicious domain name prediction result through astatistical learning algorithm; and 3, fusing the multi-model prediction results by utilizing the credibility of the model prediction results obtained by calculation to realize collaborative defense of the heterogeneous model. According to the method, 13 domain name feature values are selected, multiple machine learning models are utilized to analyze the domain names to obtain credibility, a simple voting method is adopted to fuse the models on the basis of the credibility, and domain name analysis accuracy is improved.

Description

Technical field [0001] The invention belongs to the field of computer network space security. Background technique [0002] With the development of the network, cyberspace security has received attention from all aspects, and the endless threats to cyberspace security have also become new challenges that people have to face. The rapid growth of targeted cyber attacks directly gave birth to domain name services; and domain name analysis has always been a hot issue in the field of cyberspace security, which can make threats more visible, respond to targeted attacks more quickly, strengthen strategic planning and investment, and effectively mitigate them. The current imbalance between offense and defense in the fight against network attacks also provides technical support for real-time awareness of the network situation. In recent years, the number of cyberspace security threats in my country has surged. However, the analysis of malicious domain names in my country still has probl...

AI Technical Summary

Problems solved by technology

[0003] The purpose of the present invention is to solve the problem that traditional analysis methods are difficult to resist new domain names and the degree of model degradation is obvious in the case of increasing number of domain names, resulting in the inability to obtain comprehensive and accurate results for domain name predictions, and to provide a credibility-based Internet Malicious domain name detection method

Images