基于fastText的恶意域名分类方法

A fastText based classification method for malicious domain names

对于使用域名生成算法生成的恶意域名,传统方法依靠机器学习模型,通过分析字符的统计特征来达到分类和识别恶意域名的目的。然而,机器学习算法通常需要复杂的特征工程,其中特征构建的结果决定了最终模型的性能,因此传统方法难以实现恶意域名的准确检测。鉴于此,提出一种基于fastText模型的恶意域名识别方法,通过预处理和词嵌入将构成域名的独立字符转化为多维词向量,经过隐藏层对词向量进行叠加平均,通过输出层输出特定的目标类别。实验结果表明,该方法能够实现恶意域名的准确分类与检测。

In order to precisely identify the malicious domain names created by domain generation algorithm,traditional methods use machine learning models that analyze the statistical characteristics of characters.However,machine learning algorithms often require complex feature engineering,where the results of feature construction determine the performance of the final model,thus the above mentioned methods are inefficient for precise detection of malicious domain names.A fastText based classification method is proposed.In the method,the independent characters making up the domain name are transformed into multidimensional word vectors through preprocessing and word embedding.The word vectors are superimposed and averaged through a hidden layer to generate a specific target category.Experimental results demonstrate that the proposed method can support accurate classification and detection of malicious domain names.