Lightweight malicious domain name detection model based on separable convolution

Luhui YANG; Huiwen BAI; Guangjie LIU; Yuewei DAI

doi:10.11959/j.issn.2096-109x.2020084

您当前的位置：

首页 >

文章列表页 >

Lightweight malicious domain name detection model based on separable convolution

Papers | 更新时间：2024-06-03

- Lightweight malicious domain name detection model based on separable convolution
- Chinese Journal of Network and Information Security Vol. 6, Issue 6, Pages: 112-120(2020)
- 作者机构：
  
  1. 南京理工大学自动化学院，江苏南京 210094
  2. 南京信息工程大学电子与信息工程学院，江苏南京 210044
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020084
  CLC： TP309
- Online First：2020-12，
  
  Published：15 December 2020
- 稿件说明：
移动端阅览
Luhui YANG, Huiwen BAI, Guangjie LIU, et al. Lightweight malicious domain name detection model based on separable convolution[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 112-120.
DOI：

Luhui YANG, Huiwen BAI, Guangjie LIU, et al. Lightweight malicious domain name detection model based on separable convolution[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 112-120. DOI： 10.11959/j.issn.2096-109x.2020084.

摘要

考虑到基于深度学习的恶意域名检测方法计算开销大，难以有效应用于真实网络场景域名检测实际，设计了一种基于可分离卷积的轻量级恶意域名检测算法。该模型使用可分离卷积结构，能够对卷积过程中的每一个输入通道进行深度卷积，然后对所有输出通道进行逐点卷积，在不减少卷积特征提取效果的情况下，有效减少卷积过程的参数量，实现更加快速的卷积过程并不降低模型的准确性。同时，为了减轻模型训练过程中正负样本数量不平衡与样本难易程度不平衡的情况对模型分类准确率的影响，引入了一种聚焦损失函数。所提算法在公开数据集上与 3 种典型的基于深度神经网络的检测模型进行对比，实验结果表明，算法能够达到与目前最优模型接近的检测准确率，同时能够显著提升在CPU上的模型推理速度。

Abstract

The application of artificial intelligence in the detection of malicious domain names needs to consider both accuracy and calculation speed

which can make it closer to the actual application.Based on the above considerations

a lightweight malicious domain name detection model based on separable convolution was proposed.The model uses a separable convolution structure.It first applies depthwise convolution on every input channel

and then performs pointwise convolution on all output channels.This can effectively reduce the parameters of convolution process without impacting the effectiveness of convolution feature extraction

and realize faster convolution process while keeping high accuracy.To improve the detection accuracy considering the imbalance of the number and difficulty of positive and negative samples

a focal loss function was introduced in the training process of the model.The proposed algorithm was compared with three typical deep-learning-based detection models on a public data set.Experimental results denote that the proposed algorithm achieves detection accuracy close to the state-of-the-art model

and can significantly improve model inference speed on CPU.

关键词

Keywords

references

YADAV S , REDDY A K K , REDDY A L N , et al . Detecting algorithmically generated malicious domain names [C ] // Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement 2010 . 2010 : 48 - 61 .

YADAV S , REDDY A K K , REDDY A L N , et al . Detecting algorithmically generated domain-flux attacks with DNS traffic analysis [J ] . IEEE/ACM Transactions on Networking , 2012 , 20 ( 5 ): 1663 - 1677 .

BILGE L , SEN S , BALZAROTTI D , et al . EXPOSURE:a passive DNS analysis service to detect and report malicious domains [J ] . ACM Transactions on Information and System Security (TISSEC) , 2014 , 16 ( 4 ): 1 - 28 .

YANG L , ZHAI J , LIU W , et al . Detecting word-based algorithmically generated domains using semantic analysis [J ] . Symmetry , 2019 , 11 ( 2 ):176.

SCHIAVONI S , MAGGI F , CAVALLARO L , et al . Tracking and characterizing botnets using automatically generated domains [J ] . Computer Science , 2013 ( 2 ): 217 - 248 .

SCHIAVONI S , MAGGI F , CAVALLARO L , et al . Phoenix:DGA-based botnet tracking and intelligence [C ] // International Conference on Detection of Intrusions and Malware,and Vulnerability Assessment . 2014 : 192 - 211 .

WOODBRIDGE J , ANDERSON H S , AHUJA A , et al . Predicting domain generation algorithms with long short-term memory networks [J ] . arXiv preprint arXiv:1611.00791 , 2016

YU B , GRAY D L , PAN J , et al . Inline DGA detection with deep networks [C ] // 2017 IEEE International Conference on Data Mining Workshops (ICDMW) . 2017 .

YU B , PAN J , HU J , et al . Character level based detection of DGA domain names [C ] // 2018 International Joint Conference on Neural Networks (IJCNN) . 2018 : 1 - 8 .

TRAN D , MAC H , TONG V , et al . A LSTM based framework for handling multiclass imbalance in DGA botnet detection [J ] . Neurocomputing , 2018 , 275 : 2401 - 2413 .

QIAO Y , ZHANG B , ZHANG W , et al . DGA domain name classification method based on long short term memory with attention mechanism [J ] . Applied Sciences , 2019 9 :4205.

LECUN Y , BOSER B , DENKER J S , et al . Backpropagation applied to handwritten zip code recognition [J ] . Neural Computation , 1989 , 1 ( 4 ): 541 - 551 .

KIM Y . Convolutional neural networks for sentence classification [J ] . arXiv preprint arXiv:1408.5882 , 2014

ZHANG X , ZHAO J , LECUN Y . Character-level convolutional networks for text classification [C ] // Advances in Neural Information Processing Systems . 2015 : 649 - 657 .

HOWARD A G , ZHU M , CHEN B , et al . Mobilenets:efficient convolutional neural networks for mobile vision applications [J ] . arXiv:1704.04861 , 2017

LIN T Y , GOYAL P , GIRSHICK R , et al . Focal loss for dense object detection [J ] . IEEE Transactions on Pattern Analysis ＆ Machine Intelligence , 2017 ,( 99 ): 2999 - 3007 .

Views

723

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Phishing website detection based on two-way feature extraction and adaptive fusion

Anomaly detection in DNS: an empirical study

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Multi-task adversarial attribution method based on hierarchical structure

Cyber ranges: survey and perspective

Related Author

Guo Kai

Wang Heng

Ma Ziqiang

HOU Ronghao

HE Ming

KONG Kaichuan

CHEN Yong

ZUO Peng

Related Institution

School of Information Engineering, Ningxia University

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Beijing Unionpay Card Technology Co., Ltd., Shenzhen Branch

School of Computer Science, Nanjing University of Posts and Telecommunications

⁰