arXiv:2409.09143cs.CRcs.CL2024-09被引 22

用预训练BERT检测恶意域名和网址,效果优于现有方法。

DomURLs_BERT: Pre-trained BERT-based Model for Malicious Domains and URLs Detection and Classification

  • 基于大规模多语言域名和网址数据预训练BERT模型
  • 在钓鱼、恶意软件等任务中均超越现有顶尖模型
  • 适合网络安全研究者与威胁检测系统开发者使用

检测和分类可疑或恶意域名及网址是网络安全的基础任务。尽管安全厂商常维护黑名单以应对已知威胁,但黑名单难以发现新兴和伪装的攻击。近年来,机器学习模型被广泛用于自动识别恶意域名与网址,弥补人工维护的不足。本文提出DomURLs_BERT,一种针对域名和网址优化的预训练BERT编码器,通过掩码语言建模(MLM)在大规模多语言域名、网址及域生成算法(DGA)数据集上进行预训练。我们在多个二分类与多分类任务上评估该模型,涵盖钓鱼、恶意软件、DGA和DNS隧道等场景。实验结果表明,该模型在多项任务和数据集上均优于当前最先进的字符级深度学习模型及专用网络安全BERT模型。预训练数据集、模型权重及代码均已公开。

原文摘要 · Abstract (English)

Detecting and classifying suspicious or malicious domain names and URLs is fundamental task in cybersecurity. To leverage such indicators of compromise, cybersecurity vendors and practitioners often maintain and update blacklists of known malicious domains and URLs. However, blacklists frequently fail to identify emerging and obfuscated threats. Over the past few decades, there has been significant interest in developing machine learning models that automatically detect malicious domains and URLs, addressing the limitations of blacklists maintenance and updates. In this paper, we introduce DomURLs_BERT, a pre-trained BERT-based encoder adapted for detecting and classifying suspicious/malicious domains and URLs. DomURLs_BERT is pre-trained using the Masked Language Modeling (MLM) objective on a large multilingual corpus of URLs, domain names, and Domain Generation Algorithms (DGA) dataset. In order to assess the performance of DomURLs_BERT, we have conducted experiments on several binary and multi-class classification tasks involving domain names and URLs, covering phishing, malware, DGA, and DNS tunneling. The evaluations results show that the proposed encoder outperforms state-of-the-art character-based deep learning models and cybersecurity-focused BERT models across multiple tasks and datasets. The pre-training dataset, the pre-trained DomURLs_BERT encoder, and the experiments source code are publicly available.

恶意检测BERT网络安全预训练

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。