Malicious domain name detection method and detection system based on multi-dimensional features and fuzzy rough set

Abstract

The invention discloses a malicious domain name detection method and detection system based on multi-dimensional features and a fuzzy rough set, and provides a new scheme for solving the problems that an existing Android malicious software detection scheme based on domain name features cannot effectively detect malicious domain names and DNS domain name feature extraction is not comprehensive enough. According to the method, DNS domain name information is deeply analyzed from the angles of structure, language and statistics, totally 26 features are extracted, multi-dimensional features of domain name detection are expanded, the weight of a clustering center is dynamically adjusted by using an online incremental fuzzy rough vector machine algorithm, and finally the detection precision is improved.

Description

technical field [0001] The invention relates to the technical field of malicious domain name detection, in particular to a malicious domain name detection method and detection system based on multi-dimensional features and fuzzy rough sets. Background technique [0002] With the development of the Internet of Everything, network traffic has also become one of the important ways to detect malware. Most traditional methods extract statistical features from the network, such as average packet size, number of bytes uploaded / downloaded, etc. However, these features cannot detect all types of malware well, resulting in low classification accuracy. Therefore, later researchers began to extract features from the network traffic itself, such as domain name strings, timestamps, etc. based on the HTTP protocol at the application layer. The current Android malware detection scheme based on domain name features has the problems that it cannot effectively detect malicious domain names an...

AI Technical Summary

Problems solved by technology

Traditional methods mostly extract statistical features from the network, such as average packet size, uploaded / downloaded bytes, etc. However, these features cannot detect all types of malware well, resulting in low classification accuracy. Therefore, later researchers began to extract features from the network traffic itself, such as extracting domain name strings, timestamps, etc. from the HTTP protocol based on the application layer.

The current Android malware detection scheme based on domain name features cannot effectively detect malicious domain names and the extraction of DNS domain name features is not comprehensive enough, resulting in low generalization of the detection model, which is easily evaded by new malware

Images