基于CNN-BiGRU的恶意域名检测方法

MALICIOUS DOMAIN DETECTION METHOD BASED ON CNN-BIGRU

  • 摘要: 恶意域名检测对于防范僵尸网络等网络攻击具有重要意义。该文提出一种基于CNN和BiGRU的恶意域名检测方法CNN-BiGRU-Focal,利用卷积神经网络和双向门控循环单元网络来进行特征的融合学习,并引入改进的Focal Loss函数用以解决数据不平衡问题。与LSTM、CNN、GRU、ATT-CNN-BiLSTM方法的对比实验表明,文章方法在多分类实验中检测准确率分别提高1.43百分点、2.89百分点、1.27百分点、2.43百分点,在二分类实验中检测准确率分别提高0.19百分点、0.12百分点、1.41百分点、0.3百分点。实验表明CNN-BiGRU-Focal方法在恶意域名的检测上有着更好的性能。

     

    Abstract: Malicious domain name detection is of great significance to prevent botnet and other network attacks. This paper proposes a malicious domain name detection method called CNN-BiGRU-Focal. Convolutional neural network and bidirectional gated cyclic unit network were used for feature fusion learning, and an improved focal loss function was introduced to solve the problem of data imbalance. Compared with LSTM, CNN, GRU and ATT-CNN-BiLSTM method, the detection accuracy of the proposed method is improved by 1.43, 2.89, 1.27 and 2.43 percentage points in multi-classification experiments, and 0.19, 0.12, 1.41 and 0.3 percentage points in binary classification experiments. Experiments show that CNN-BiGRU-Focal method has better performance in the detection of malicious domain names.

     

/

返回文章
返回