Abstract:

Domain Flux botnet domain names are mostly used in botnet command control channels, so detection of Domain Flux botnet domain names is very important for botnet detection. There are many problems in the detection methods of Domain Flux botnet domain names at present. For example, resource consumption is high and detection accuracy is not high. To solve these problems, this paper proposes a Domain Flux botnet domain name detection method based on weighted support vector machine. By analyzing the difference between Domain Flux botnet domain name and traditional domain name, dozens of domain name features are extracted to distinguish normal domain name and Domain Flux botnet domain name. In order to maximize the distinguishing effect of each feature, the weights of each feature are calculated by the information gain ratio and weighted by the feature. The SVM algorithm is trained on the weighted feature data set to obtain the detection model. Experiments show that this method effectively improves the detection accuracy of Domain Flux botnet domain names, and can better identify Domain Flux botnet domain names.

Key words: Domain Flux botnet, information gain ratio, feature weighting, support vector machine