基于ISSA-FLightGBM算法的恶意域名检测方法研究

Research on Malicious Domain Detection Basedon ISSA-FLightGBM Algorithm

针对基于机器学习的恶意域名检测效率低、模型难以优化的问题,提出一种基于改进麻雀搜索算法(Improved Sparrow Search Algorithm,ISSA)优化焦点轻量级梯度提升机(Focal Loss LightGBM,FLightGBM)的恶意域名检测模型.首先,应用Tent混沌映射与螺旋曲线策略改进麻雀搜索算法,改善算法优化能力不足的问题;其次,针对样本分类不均问题,将焦点损失函数引入LightGBM算法,构建FLightGBM算法的分类模型,并使用ISSA进行模型参数优化;最后,收集真实互联网中域名信息构建样本库,提取多种域名特征后构建数据特征库,通过对比多种分类模型识别精度等指标评判算法性能.结果表明,本文模型能更高效地检测恶意域名.

Aiming at the problem of low efficiency and difficult optimization of malicious domain name detection model based on machine learning,this paper proposes a malicious domain name detection model based on Improved Sparrow Search Algorithm(ISSA)optimized Focal Loss Light Gradient Boosting Machine(FLightGBM).Firstly,the Tent chaos mapping and spiral curve strategy are used to improve the sparrow search algorithm to solve the problem of insufficient optimization ability.Secondly,to solve the problem of uneven sample classification,the focus loss function is introduced into LightGBM algorithm to build the classification model of LightGBM algorithm,and ISSA is used to optimize the model parameters.Finally,the domain name information in the real Internet is collected to build a sample database,and a variety of domain name features are extracted to build a data feature database.The performance of the algorithm is evaluated by comparing the recognition accuracy of various classification models.The results show that the proposed model can detect malicious domain names more efficiently.