基于可分离卷积的轻量级恶意域名检测模型

杨路辉; 白惠文; 刘光杰; 戴跃伟

doi:10.11959/j.issn.2096-109x.2020084

您当前的位置：

首页 >

文章列表页 >

基于可分离卷积的轻量级恶意域名检测模型

学术论文 | 更新时间：2024-06-03

- 基于可分离卷积的轻量级恶意域名检测模型
- Lightweight malicious domain name detection model based on separable convolution
- 网络与信息安全学报 2020年6卷第6期页码：112-120
- 作者机构：
  
  1. 南京理工大学自动化学院，江苏南京 210094
  2. 南京信息工程大学电子与信息工程学院，江苏南京 210044
- 作者简介：
  
  [ "杨路辉（1992- ），男，江西黎川人，南京理工大学博士生，主要研究方向为网络与信息安全" ]
  [ "白惠文（1992- ），男，吉林白山人，南京理工大学博士生，主要研究方向为网络流量分析" ]
  [ "刘光杰（1980- ），男，江苏徐州人，博士，南京信息工程大学教授、博士生导师，主要研究方向为信息安全、多媒体系统、深度学习" ]
  [ "戴跃伟（1962- ），男，江苏镇江人，博士，南京信息工程大学教授、博士生导师，主要研究方向为网络与多媒体信息安全" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(U1836104)
- DOI：10.11959/j.issn.2096-109x.2020084
  中图分类号： TP309
- 网络首发：2020-12，
  
  纸质出版：2020-12-15
- 稿件说明：
移动端阅览
杨路辉, 白惠文, 刘光杰, 等. 基于可分离卷积的轻量级恶意域名检测模型[J]. 网络与信息安全学报, 2020,6(6):112-120.

Luhui YANG, Huiwen BAI, Guangjie LIU, et al. Lightweight malicious domain name detection model based on separable convolution[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 112-120.
杨路辉, 白惠文, 刘光杰, 等. 基于可分离卷积的轻量级恶意域名检测模型[J]. 网络与信息安全学报, 2020,6(6):112-120. DOI： 10.11959/j.issn.2096-109x.2020084.

Luhui YANG, Huiwen BAI, Guangjie LIU, et al. Lightweight malicious domain name detection model based on separable convolution[J]. Chinese Journal of Network and Information Security, 2020, 6(6): 112-120. DOI： 10.11959/j.issn.2096-109x.2020084.

摘要

考虑到基于深度学习的恶意域名检测方法计算开销大，难以有效应用于真实网络场景域名检测实际，设计了一种基于可分离卷积的轻量级恶意域名检测算法。该模型使用可分离卷积结构，能够对卷积过程中的每一个输入通道进行深度卷积，然后对所有输出通道进行逐点卷积，在不减少卷积特征提取效果的情况下，有效减少卷积过程的参数量，实现更加快速的卷积过程并不降低模型的准确性。同时，为了减轻模型训练过程中正负样本数量不平衡与样本难易程度不平衡的情况对模型分类准确率的影响，引入了一种聚焦损失函数。所提算法在公开数据集上与 3 种典型的基于深度神经网络的检测模型进行对比，实验结果表明，算法能够达到与目前最优模型接近的检测准确率，同时能够显著提升在CPU上的模型推理速度。

Abstract

The application of artificial intelligence in the detection of malicious domain names needs to consider both accuracy and calculation speed

which can make it closer to the actual application.Based on the above considerations

a lightweight malicious domain name detection model based on separable convolution was proposed.The model uses a separable convolution structure.It first applies depthwise convolution on every input channel

and then performs pointwise convolution on all output channels.This can effectively reduce the parameters of convolution process without impacting the effectiveness of convolution feature extraction

and realize faster convolution process while keeping high accuracy.To improve the detection accuracy considering the imbalance of the number and difficulty of positive and negative samples

a focal loss function was introduced in the training process of the model.The proposed algorithm was compared with three typical deep-learning-based detection models on a public data set.Experimental results denote that the proposed algorithm achieves detection accuracy close to the state-of-the-art model

and can significantly improve model inference speed on CPU.

关键词

Keywords

references

YADAV S , REDDY A K K , REDDY A L N , et al . Detecting algorithmically generated malicious domain names [C ] // Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement 2010 . 2010 : 48 - 61 .

YADAV S , REDDY A K K , REDDY A L N , et al . Detecting algorithmically generated domain-flux attacks with DNS traffic analysis [J ] . IEEE/ACM Transactions on Networking , 2012 , 20 ( 5 ): 1663 - 1677 .

BILGE L , SEN S , BALZAROTTI D , et al . EXPOSURE:a passive DNS analysis service to detect and report malicious domains [J ] . ACM Transactions on Information and System Security (TISSEC) , 2014 , 16 ( 4 ): 1 - 28 .

YANG L , ZHAI J , LIU W , et al . Detecting word-based algorithmically generated domains using semantic analysis [J ] . Symmetry , 2019 , 11 ( 2 ):176.

SCHIAVONI S , MAGGI F , CAVALLARO L , et al . Tracking and characterizing botnets using automatically generated domains [J ] . Computer Science , 2013 ( 2 ): 217 - 248 .

SCHIAVONI S , MAGGI F , CAVALLARO L , et al . Phoenix:DGA-based botnet tracking and intelligence [C ] // International Conference on Detection of Intrusions and Malware,and Vulnerability Assessment . 2014 : 192 - 211 .

WOODBRIDGE J , ANDERSON H S , AHUJA A , et al . Predicting domain generation algorithms with long short-term memory networks [J ] . arXiv preprint arXiv:1611.00791 , 2016

YU B , GRAY D L , PAN J , et al . Inline DGA detection with deep networks [C ] // 2017 IEEE International Conference on Data Mining Workshops (ICDMW) . 2017 .

YU B , PAN J , HU J , et al . Character level based detection of DGA domain names [C ] // 2018 International Joint Conference on Neural Networks (IJCNN) . 2018 : 1 - 8 .

TRAN D , MAC H , TONG V , et al . A LSTM based framework for handling multiclass imbalance in DGA botnet detection [J ] . Neurocomputing , 2018 , 275 : 2401 - 2413 .

QIAO Y , ZHANG B , ZHANG W , et al . DGA domain name classification method based on long short term memory with attention mechanism [J ] . Applied Sciences , 2019 9 :4205.

LECUN Y , BOSER B , DENKER J S , et al . Backpropagation applied to handwritten zip code recognition [J ] . Neural Computation , 1989 , 1 ( 4 ): 541 - 551 .

KIM Y . Convolutional neural networks for sentence classification [J ] . arXiv preprint arXiv:1408.5882 , 2014

ZHANG X , ZHAO J , LECUN Y . Character-level convolutional networks for text classification [C ] // Advances in Neural Information Processing Systems . 2015 : 649 - 657 .

HOWARD A G , ZHU M , CHEN B , et al . Mobilenets:efficient convolutional neural networks for mobile vision applications [J ] . arXiv:1704.04861 , 2017

LIN T Y , GOYAL P , GIRSHICK R , et al . Focal loss for dense object detection [J ] . IEEE Transactions on Pattern Analysis ＆ Machine Intelligence , 2017 ,( 99 ): 2999 - 3007 .

浏览量

723

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于双路特征提取和自适应融合的钓鱼网站检测

DNS异常检测：大规模实验分析

FL-IoV：基于联邦学习的综合车联网入侵检测方法

基于分层结构的多任务对抗样本归因方法

网络靶场研究现状与展望