Abstract:

Fast-Flux malicious domain name is an important technique in Botnet communication which aims to resist detection by quickly changing the resolved IP address of the domain. At present, most of the malicious domain name detection methods are based on the traditional machine learning models. These methods need complex data processing, feature extraction, and the help of a large amount of third-party data, which greatly reduces the efficiency of detection. Domain name resolution is a very complex process with rich features, this paper designed a Fast-Flux malicious domain name detection method based on multi-modal feature fusion using deep learning. Firstly, a GCN module was used to extract spatial features, and a BiLSTM module was used to extract text features. Secondly, an MLP module was used to extract side information features. Thirdly, the three kinds of features were fused using neural networks structure. This paper has conducted experiments on the Fast-Flux-Attack-Datasets, the experimental results show that this method achieves the accuracy of 99.94% with recall of 99.76% and precision of 99.69%, which is better than the state-of-the-art methods at present. The method effectively fuses multimodal features, and promotes the performance of Fast-Flux domain name detection, and is meaningful for enhancing the capability of Botnet detection.

Key words: Fast-Flux malicious domain name detection, Botnet, GCN, multimodal feature