摘要
随着互联网技术的快速发展,网络服务于各类行业,域名数量与日俱增的同时恶意域名的检测也变得愈来愈困难且更加重要。恶意服务常利用域名生成算法(DGA)逃避域名检测,DGA域名常见于一些僵尸网络和APT攻击中,针对DGA域名可以轻易地绕过传统防火墙和入侵检测设备、现有方法检测速度慢、实用性不强等问题,采用深度学习技术,基于LSTM设计了DGA域名检测方法,从海量域名样本中分辨出异常域名,借助机器代替人力完成这样重复性的工作。经实验结果证明,该方法检测准确率高达99.1%以上,是有效可行的。同时结合流量探针构建实时监测系统,实时准确地监测流量中的DGA域名,提高网络空间安全性。
With the rapid development of Internet technology,the network had served various industries,While the number of domain names is increasing day by day,the detection of malicious domain names has become more and more difficult and more important.Domain Generate Algorithm(DGA)was used by malicious services to evade domain detection.DGA was common in some botnets and APT attacks,aiming at the problem of DGA domain can easily bypass traditional firewalls and intrusion detection devices,slow detection speed and poor real-time performance in existing detection methods.a DGA domain detection algorithm based on Long Short-Term Memory(LSTM)model was designed by using deep learning,which candistinguish abnormal domain names from a large number of domain name samples,and use machines to replace humans to complete such repetitive tasks.The experimental results prove that the detection accuracy of this method is as high as 99.1%,which is effective and feasible.Meanwhile,a Real time Monitoring System for DGA Domain based on LSTM was proposed in combination with flow probe to monitor network traffic in real time and improve cyberspace protection capabilities.
作者
查伟金
ZHA Wei-jin(Government and Enterprise Client Department,China Telecom Corporation LimitedJiujiang Branch,Jiujiang 332000,China)
出处
《电脑知识与技术》
2021年第22期121-124,共4页
Computer Knowledge and Technology
