基于特征多样化的恶意域名检测

Malicious domain detection based on diversified characteristics

恶意域名是威胁当前网络安全的重要因素之一,对恶意域名进行快速检测是维护网络环境安全的一个重要手段。针对现有检测方法存在开销大、检查时间较长、检测类型单一的问题,提出了一种基于特征多样化的检测方法,首先从域名词汇、域名访问量的角度提取多元特征,随后使用基于随机森林的分类检测模型来区分域名。实验结果表明:该方法在达到95%准确率的情况下,极大地降低了计算复杂度,并且具有一定的通用性。

Malicious domain names are one of the important factors threatening the current network security and a rapid detection of malicious domain names is an important means to maintain the security of the network environment.Aiming at the problems of high cost,long inspection time and single detection type in existing detection methods,a detection method based on diversified features is proposed.Firstly,from the domain name vocabulary,domain name access,extract multiple characteristics areextracte.Then,a random forest⁃based classification detection model is used to distinguish domain names.Experimental results show that the method achieves an accuracy of 95%,while greatly reducing the computational complexity and it has a certain generality.