DGA domain name detection method and system, medium, equipment and terminal

Abstract

The invention belongs to the technical field of computer networks, and discloses a DGA domain name detection method and system, a medium, equipment and a terminal. The twinborn architecture model Siam-BLA is used for fitting a domain name feature space and comprises a preprocessing layer, an embedding layer, a feature extraction layer and a similarity calculation layer, the network BLA is obtained by splitting the structure of the twinborn architecture model Siam-BLA and is used for extracting domain name features, and the module Weighted-vamp is used for carrying out exclusive similarity measurement on two domain names; d; calculating a reference vector representing each category of feature condition; and an efficient twin architecture multi-classification and unknown class identification algorithm is provided. According to the technical scheme, feature engineering and large-scale data labeling are not needed, the recognition accuracy rate reaches 98% or above, the accuracy rate of part of categories is even 100%, the classification accuracy rate in a small sample environment is improved, and the time of a twin architecture for multi-classification prediction is shortened.

Description

technical field [0001] The invention belongs to the technical field of computer networks, and in particular relates to a DGA domain name detection method, system, medium, device and terminal. Background technique [0002] At present, in cyberspace, attackers often use Trojan horse programs, worms and other malicious programs to attack or control devices such as computers and smart phones used by users. Once a user's device is under control, it becomes part of a "botnet" controlled by an attacker. The attacker then sends instructions through the Internet to steal the privacy of the user's device, or the remote control device participates in a denial-of-service attack on a specific target server. Attackers use Domain Generation Algorithm (DGA) in order to avoid detection and attack, and also to make the communication of "botnet" smooth. This method makes the attacker do not need to write the attacker's fixed domain name information or IP address in the malicious program, but...

AI Technical Summary

Problems solved by technology

[0005] (1) The current attack methods are gradually combined with new technologies such as big data and artificial intelligence, and are constantly updated and iterated. None of the existing methods can deal with the variant DGA family and those DGA domain names that are increasingly similar to legitimate domain names.

[0006] (2) In the real and complex network environment, the existing methods cannot solve the extreme inconsistency between "a large number of normal legal domain names with wide distribution of characteristics" and "domain names of DGA families with unbalanced distribution of characteristics and difficulty in obtaining samples". Balance phenomenon and small sample learning requirements

Images