Abstract:

At present, malicious domains as the main attack vector are widely abused in a variety of network attack activities. To address the problems of complex design of detection features in malicious domain detection, the need for empirical knowledge assistance and the ease of targeted bypassing by attackers, the paper proposed a malicious domain detection method based on multivariate temporal features. The method uses a deep learning model based on fused long and short-term memory networks and full convolutional neural networks to automatically extract multivariate temporal embedding features from client requests and domain resolution traffic, respectively, and learn low-dimensional temporal representations of malicious domain behaviors. Compared with traditional time-statistical feature schemes or time-series local pattern discrimination schemes, this method can establish long-term domain activity patterns and distinguish the behavior sequences of malicious domains from normal domains, which has more powerful malicious domain detection capability. Meanwhile, the method supports the fusion of multivariate time-series embedding features and generic malicious domain detection features to characterize malicious behavior information in multiple dimensions, improving detection performance as well as model robustness and scalability.

Key words: malicious domain, long short-term memory, fully convolutional network, multivariate time-series feature, feature fusion