大规模网络中基于集成学习的恶意域名检测

Malicious Domain Name Detection in Large-scale Network Based on Ensemble Learning

现有的恶意域名检测方案在处理大规模数据和多种类型的恶意域名时存在不足。为此,根据时间性、相关域名集合和对应IP三方面特征提出新的检测方案。使用并行化随机森林算法建立组合的域名检测分类器,以提高检测精确度及容错能力。实验结果表明,组合分类器的精确度和准确率均高于决策树分类器,新方案能够更有效地检测大规模网络中的恶意域名。

Existing domain name detection schemes face difficulties in dealing with large-scale data and various malicious domains.Aiming at this problem,this paper designs a malicious domain detection scheme based on the features of the timeliness,relevant domain set and the corresponding IP.It uses parallelized random forests algorithm to build the classifier and process large-scale data,which improves classification precision and fault tolerance.Experimental result shows that,compared with decision tree classifier,the combined classifier has better performance in precision and accuracy,which can solve the problem of malicious domain detection in large-scale network environment more efficiently.