信息网络安全

信息网络安全 ›› 2022, Vol. 22 ›› Issue (4): 20-29.doi: 10.3969/j.issn.1671-1122.2022.04.003

• 技术研究 • 上一篇    下一篇

基于多模态特征融合的Fast-Flux恶意域名检测方法

郎波(), 谢冲, 陈少杰, 刘宏宇   

  1. 北京航空航天大学软件开发环境国家重点实验室,北京 100191
  • 收稿日期:2021-11-12 出版日期:2022-04-10 发布日期:2022-05-12
  • 通讯作者: 郎波 E-mail:langbo@buaa.edu.cn
  • 作者简介:郎波（1968—）,女,辽宁,教授,博士,主要研究方向为大数据分析和信息安全|谢冲（1997—）,男,河北,硕士研究生,主要研究方向为大数据分析|陈少杰（1992—）,男,山西,博士研究生,主要研究方向为深度学习、入侵检测和恶意代码检测|刘宏宇（1992—）,男,吉林,博士研究生,主要研究方向为机器学习
  • 基金资助:
    软件开发环境国家重点实验室探索性课题(SKLSDE-2020ZX-02)

Fast-Flux Malicious Domain Name Detection Method Based on Multimodal Feature Fusion

LANG Bo(), XIE Chong, CHEN Shaojie, LIU Hongyu   

  1. State Key Laboratory of Software Development Environment, Beihang University, Beijing 100191, China
  • Received:2021-11-12 Online:2022-04-10 Published:2022-05-12
  • Contact: LANG Bo E-mail:langbo@buaa.edu.cn

RichHTML

13

PDF (PC)

250

摘要：

Fast-Flux恶意域名是僵尸网络通信中的一种重要载体,通过快速变换域名解析的IP抵御检测。目前,恶意域名检测系统大多基于传统机器学习模型,需要对数据进行复杂处理和特征提取,并且需要借助大量第三方数据源,导致检测的实时性较差。域名解析是一个复杂的过程,并且具有丰富的特征,文章设计了基于多模态特征融合的Fast-Flux恶意域名检测方法。首先利用GCN模块提取空间特征,采用BiLSTM模块提取域名文本特征,然后利用MLP模块提取侧信息特征,最后利用神经网络将这3种特征进行融合。在Fast-Flux-Attack-Datasets公开数据集上进行实验,实验结果表明,该方法的精确率达99.94%、召回率达99.76%、准确率达99.69%,总体效果优于当前同类方法。文章所提方法有效融合了域名解析的多模态特征,明显提升了检测效果,对于提高僵尸网络检测能力具有重要意义。

关键词: Fast-Flux恶意域名检测, 僵尸网络, GCN, 多模态特征

Abstract:

Fast-Flux malicious domain name is an important technique in Botnet communication which aims to resist detection by quickly changing the resolved IP address of the domain. At present, most of the malicious domain name detection methods are based on the traditional machine learning models. These methods need complex data processing, feature extraction, and the help of a large amount of third-party data, which greatly reduces the efficiency of detection. Domain name resolution is a very complex process with rich features, this paper designed a Fast-Flux malicious domain name detection method based on multi-modal feature fusion using deep learning. Firstly, a GCN module was used to extract spatial features, and a BiLSTM module was used to extract text features. Secondly, an MLP module was used to extract side information features. Thirdly, the three kinds of features were fused using neural networks structure. This paper has conducted experiments on the Fast-Flux-Attack-Datasets, the experimental results show that this method achieves the accuracy of 99.94% with recall of 99.76% and precision of 99.69%, which is better than the state-of-the-art methods at present. The method effectively fuses multimodal features, and promotes the performance of Fast-Flux domain name detection, and is meaningful for enhancing the capability of Botnet detection.

Key words: Fast-Flux malicious domain name detection, Botnet, GCN, multimodal feature

中图分类号: