一种改进的卷积神经网络恶意域名检测算法

doi:10.19665/j.issn1001-2400.2020.01.006

摘要/Abstract

摘要：

针对现有检测方法对算法生成的恶意域名检测效率不高,尤其对几种难检测的恶意域名类型检测率低的问题,提出了一种改进的基于卷积神经网络的恶意域名检测算法。该算法在现有的卷积神经网络模型的基础上,增加了提取更深层字符级特征的卷积分支,从而同时提取恶意域名的浅层和深层字符级特征并融合; 引入一种聚焦损失函数以解决样本难易程度和数量的双重不平衡导致检测率低的问题,可提高对难样本的检测准确率。改进后的算法对20种恶意域名的平均检测准确率为97.62%,与原算法相比提高了0.94%; 对4种较难检测域名的检测准确率分别提高了3.71%、4.6%、11.18%和17.8%。实验结果表明,改进的算法能够提高对恶意域名的检测准确率,尤其能够显著提升对部分难检测域名的检测准确率。

关键词: 卷积神经网络, 域名生成算法, 深度学习, 信息安全

Abstract:

Aiming at the problem that the existing detection methods are not efficient in detecting the malicious domain name generated by the algorithm, especially the detection rate of several types of malicious domain names that are difficult to detect is low, an improved algorithm for detection of the malicious domain name based on the convolutional neural network is proposed. Based on the existing convolutional neural network model, this algorithm adds convolutional branches to extract deeper character-level features, so that both shallow and deep character-level features of malicious domain names could be extracted and fused simultaneously. A focal loss function is introduced as a loss function to solve the problem of sample imbalance caused by difficulty and quantity, which is used to improve the detection accuracy of hard-to-detect samples. The average detection accuracy of the improved algorithm for 20 types of malicious domain names is 97.62%, that is, 0.94% higher than that of the original algorithm, and the detection accuracy of four hard-to-detect domain names is increased by 3.71%, 4.6%, 11.18% and 17.8%, respectively. Experimental results show that the improved algorithm can effectively improve the detection accuracy of malicious domain names, especially for some hard-to-detect domain names.

Key words: convolutional neural network, domain generation algorithms, deep learning, information security

中图分类号:

TP309

杨路辉,刘光杰,翟江涛,刘伟伟,白惠文,戴跃伟. 一种改进的卷积神经网络恶意域名检测算法[J]. 西安电子科技大学学报, 2020, 47(1): 37-43.

YANG Luhui,LIU Guangjie,ZHAI Jiangtao,LIU Weiwei,BAI Huiwen,DAI Yuewei. Improved algorithm for detection of the malicious domain name based on the convolutional neural network[J]. Journal of Xidian University, 2020, 47(1): 37-43.

图/表 6

图1

图2

图3

图4

表1

表2

参考文献 16

[1]	杨宏宇, 那玉琢 . 一种Android恶意软件检测模型[J]. 西安电子科技大学学报, 2019,46(3):45-51.
	YANG Hongyu, NA Yuzhuo . Android Malware Detection Model[J]. Journal of Xidian University, 2019,46(3):45-51.
[2]	CHANTHAKOUMMANE Y, SAIYOD S, BENJAMAS N , et al. Improving Intrusion Detection on Snort Rules for Botnets Detection[C]//Lecture Notes in Electrical Engineering: 376. Heidelberg: Springer Verlag, 2016: 765-779.
[3]	YADAV S, REDDY A K K, REDDY A L N , et al. Detecting Algorithmically Generated Malicious Domain Names[C]// Proceedings of the ACM SIGCOMM Internet Measurement Conference. New York: ACM, 2010: 48-61.
[4]	YADAV S, REDDY A K K, NARASIMHA REDDY A L , et al. Detecting Algorithmically Generated Domain-flux Attacks with DNS Traffic Analysis[J]. IEEE/ACM Transactions on Networking, 2012,20(5):1663-1677.
[5]	SCHIAVONI S, MAGGI F, CAVALLARO L , et al. Tracking and Characterizing Botnets Using Automatically Generated Domains[J/OL]. Computer Science, 2013.[2019-8-22].
[6]	SCHIAVONI S, MAGGI F, CAVALLARO L , et al. Phoenix: DGA-based Botnet Tracking and Intelligence[C]//Lecture Notes in Computer Science: 8550. Heidelberg: Springer Verlag, 2014: 192-211.
[7]	BILGE L, SEN S, BALZAROTTI D , et al. EXPOSURE: A Passive DNS Analysis Service to Detect and Report Malicious Domains[J]. ACM Transactions on Information and System Security, 2014,16(4):14.
[8]	RAGHURAM J, MILLER D J, KESIDIS G . Unsupervised,Low Latency Anomaly Detection of Algorithmically Generated Domain Names by Generative Probabilistic Modeling[J]. Journal of Advanced Research, 2014,5(4):423-433.
[9]	YANG L H, ZHAI J T, LIU W W , et al. Detecting Word-based Algorithmically Generated Domains Using Semantic Analysis[J]. Symmetry, 2019,11(176):1-20.
[10]	WOODBRIDGE J, ANDERSON H S, AHUJA A , et al. Predicting Domain Generation Algorithms with Long Short-term Memory Networks[J]. Computer Science, 2016. [2019-8-22].
[11]	ANDERSON H S, WOODBRIDGE J, FILAR B . DeepDGA: Adversarially-tuned Domain Generation and Detection[C]//Proceedings of the 2016 ACM Workshop on Artificial Intelligence and Security. New York: ACM, 2016: 13-21.
[12]	赵科军, 葛连升, 秦丰林 , 等. 基于word-hashing的DGA僵尸网络深度检测模型[J]. 东南大学学报(自然科学版), 2017,47(S1):34-37.
	ZHAO Kejun, GE Liansheng, QIN Fenglin , et al. Deep Model for DGA Botnet Detection Based on Word-hashing[J]. Journal of Southeast University(Natural Science Edition), 2017,47(S1):34-37.
[13]	YU B, PAN J, HU J , et al. Character Level Based Detection of DGA Domain Names[C]//Proceedings of the 2018 International Joint Conference on Neural Networks. Piscataway: IEEE, 2018: 8489147.
[14]	BERMAN D S . DGA CapsNet: 1D Application of Capsule Networks to DGA Detection[J]. Information, 2019,10(5):157.
[15]	TRAN D, MAC H, TONG V , et al. A LSTM Based Framework for Handling Multiclass Imbalance in DGA Botnet Detection[J]. Neurocomputing, 2018,275:2401-2413.
[16]	LIN T Y, GOYAL P, GIRSHICK R , et al. Focal Loss for Dense Object Detection[C]//Proceedings of the 2017 IEEE International Conference on Computer Vision. Piscataway: IEEE, 2017: 2999-3007.

检测算法	平均准确率/%	召回率/%	曲线下面积	训练时间/s
长短期记忆网络	97.23	95.30	0.9969	720
Invincea-CNN	96.68	94.29	0.9964	20
Invincea-CNN + Focalloss	97.10	95.31	0.9968	20
改进的Invincea-CNN + Focalloss	97.62	96.77	0.9974	52

DGA类型	LSTM	Invincea-CNN	Invincea-CNN + Focalloss	改进的Invincea-CNN + Focalloss
Gameover	100.00	100.00	100.00	100.00
Murofet	99.61	99.79	100.00	100.00
Dircrypt	97.83	97.90	98.64	97.86
Tinba	98.53	99.42	99.38	98.80
Necurs	93.73	95.64	96.69	97.25
Ramdo	98.26	98.78	99.27	98.77
Ranbyus	99.61	99.60	99.80	99.61
Cryptolocker	99.80	99.20	99.03	99.78
Emotet	98.80	99.80	99.38	99.78
Corebot	99.80	100.00	99.81	99.80
Banjori	99.45	98.04	96.98	99.03
Qakbot	97.51	97.50	98.02	98.25
Rovnix	99.79	99.80	99.80	99.81
Kraken	96.60	95.43	97.62	99.60
Ramnit	96.45	97.08	97.09	98.65
Locky	92.70	95.49	95.22	97.04
Pykspa	92.14	92.52	93.76	96.23
Simda	94.39	90.84	94.96	95.44
Symmi	80.09	70.85	77.54	82.03
Virut	69.40	59.17	59.40	76.97