基于改进神经网络算法的木马控制域名检测方法

Detection Method of Trojan's Control Domain Based on Improved Neural Network Algorithm

首先对木马利用域名进行回连控制的特点进行了分析,对采用DNS进行网络木马检测的方法进行了概述,接着基于对木马域名的静态、动态特征的分析,提取了域名使用时间、访问域名周期性、IP地址变化速度、IP地址所属国变更、IP地址为私有地址、同域名多IP地址分属不同国家、TTL值、域名搜索量8个指标作为BP神经网络算法的输入,并提出了一种改进BP神经网络算法来解决大量DNS域名训练效率、平均误差值大的问题;最后用改进的神经网络算法对样本进行了实验评估测试,结果显示改进算法和传统算法的检出率相当,但检测效率大为提高。

Firstly, the character that the Trojans use domain name to control was analyzed and the method that DNS adopted to detect Trojans was introduced. Secondly, based on the analysis of static and dynamic characters for Trojan domain name, eight indicators were obtained as the input of BP neural network algorithm, including operation time of domain name, the period to visit the domain name, the variation speed of IP address, the country change of IP address, IP address of private address, the same domain name with multiple IP address for different countries, TTL value and search times of domain name. An improved BP neural network algorithm was proposed to solve training efficiency for a great number of domain names, and large average error. Finally, the experimental evaluation of samples was tested by improved neural network algorithm. Compared with traditional neural network algorithm, the detection efficiency is better.