用深度学习和NLP识别恶意域名生成算法，准确率达97.2%
Command & Control (C2) Traffic Detection Via Algorithm Generated Domain (Dga) Classification Using Deep Learning And Natural Language Processing
- 通过提取词法特征并训练LSTM模型识别域名模式
- 在复杂样本上达97.2%准确率，误报率显著降低
- 适合网络安全防护、威胁检测人员阅读
现代恶意软件与命令控制（C2）服务器的通信日趋复杂，传统基于黑名单的防御已失效。域生成算法（DGA）使攻击者每日生成数千个动态域名，难以被传统防火墙拦截。本文提出并评估一种基于深度学习与自然语言处理（NLP）的DGA域名检测方法。研究构建了包含5万条合法域名与5万条恶意域名的混合数据库，提取词法特征后训练循环神经网络（LSTM）。结果表明，尽管统计熵分析对简单DGA有效，但神经网络在复杂模式识别上表现更优，准确率达97.2%，且在模糊合法流量场景中显著降低误报率。
原文摘要 · Abstract (English)
The sophistication of modern malware, specifically regarding communication with Command and Control (C2) servers, has rendered static blacklist-based defenses obsolete. The use of Domain Generation Algorithms (DGA) allows attackers to generate thousands of dynamic addresses daily, hindering blocking by traditional firewalls. This paper aims to propose and evaluate a method for detecting DGA domains using Deep Learning and Natural Language Processing (NLP) techniques. The methodology consisted of collecting a hybrid database containing 50,000 legitimate and 50,000 malicious domains, followed by the extraction of lexical features and the training of a Recurrent Neural Network (LSTM). Results demonstrated that while statistical entropy analysis is effective for simple DGAs, the Neural Network approach presents superiority in detecting complex patterns, reaching 97.2% accuracy and reducing the false positive rate in ambiguous lawful traffic scenarios.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。