基于改进GAN的恶意域名数据增强

MALICIOUS DOMAIN NAME DATA AUGMENTATION BASED ON IMPROVED GAN

近年来以恶意域名为依托的网络攻击事件频发。针对主流检测方法识别DGA(Domain Generation Algorithm)变体域名面临的训练数据受限和时效性不足问题,提出一种基于改进WGAN模型的伪DGA域名生成方法。将skip-gram和WGAN结合,通过skip-gram完成域名有效转换,WGAN模型深度挖掘数据编码中包含的特征,学习并生成伪DGA域名。为验证模型生成数据的有效性,采用多种机器学习方法对生成的域名进行有效性评估。实验结果表明,基于此模型生成的数据具备原数据的特性,可以模拟真实域名用于扩充恶意域名数据集,缓解现有域名检测算法中缺乏DGA变体域名的问题。

In recent years,cyber-attacks based on malicious domain names occur frequently.Aiming at the problem of limited training data and timeliness of DGA variant domain names in the mainstream detection method,a pseudo-DGA domain name generation method based on improved WGAN model is proposed.It combined skip-gram and WGAN to complet the effective conversion of domain names through skip-gram,and the WGAN model deeply mined the features contained in the data encoding,learned and generated pseudo-DGA domain names.To verify the validity of the generated data,a variety of machine learning methods were used to evaluate the validity of the generated domain name.The experimental results show that the data generated by this model has the characteristics of the original data,which can simulate the real domain name to expand the malicious domain name data set,and alleviate the lack of DGA variant domain name in the existing domain name detection algorithm.