Research On DGA Domain Detection And Generation Methods Based On Deep Learning

Botnets are one of the major cybersecurity threats facing society today.Botnets can actively exploit security vulnerabilities to infect other computer endpoints in the network through controlled computer terminals,so the infected network is usually very large.Botnets have strong computing and storage capabilities and network bandwidth advantages,and can launch various large-scale network security attacks,such as distributed denial attacks,virtual currency "mining",spam distribution,data theft and extortion attacks.Botnet has become one of the major network security risks,and botnet detection has become an important research topic with practical application value in the field of network security.A typical botnet establishes a communication channel with the controlled terminal through the command and control server for malicious code updates and instruction issuance,and the main goal of botnet detection research is to discover the command and control server,and then it can be taken offline and blacklisted to disintegrate the entire botnet.In order to prevent the IP address of the command and control server from being directly exposed,botnets usually use domain names to access the command and control server.Botnets widely use Domain Generation Algorithms(DGA)to generate malicious domain names,hiding the real domain names used by command and control servers in a large number of pseudo-random domain names,which enhances the concealment of the botnet and increases the difficulty of detecting botnet domain names.DGA domain name detection is a popular and important DGA botnet detection technology,which can directly locate the command and control server of the botnet by detecting the DGA domain name.The domain name-based detection method only needs to pay attention to the domain name character itself,does not need other additional information,and can be conveniently deployed at all levels of terminals and network exit locations.In order to reduce the possibility of discovery,more and more DGA algorithms generate spellable domain names,which have similar character distribution to legal domain names,while traditional domain name detection methods based on manual extraction features are difficult to obtain the differences between the two,and DGA domain name detection research faces new challenges.In recent years,deep learning has achieved remarkable results in many fields such as computational vision and natural language processing,and the use of deep learning classification model to achieve DGA domain name detection has become the mainstream research direction.This paper fully understands and compares the main DGA domain name detection methods,and faces three key challenges in DGA domain name detection:1)domain name feature extraction;2)The similarity of the character distribution between the spellable DGA domain name and the legal domain name;3)The scarcity of some DGA family domain name samples,based on deep learning,the researches on DGA domain name detection and generation method are carried out.First of all,the traditional detection methods mainly use manual feature extraction,which may need to mine different features for different DGA family domain names,and the detection ability for spellable DGA domain names is also weak.Aiming at the problem of feature extraction of DGA domain names,this paper analyzes the differences of n-gram model tuples in legal domain names and multiple DGA domain names,and proposes a detection method for n-gram-based DGA domain names.Compared with the traditional detection methods of manually extracted features,the input of the model only requires domain name characters,and the use of n-gram tuples avoids manual selection of features and reduces the difficulty of obtaining other feature information,while the tuple information contains the interrelationship between domain name characters.The experimental results show that the F1 score of the ngram-based DGA domain name classification detection method on the public dataset reaches 97.21%,and the accuracy and recall rate are 97.23%and 96.7%,respectively,which are higher than the comparison algorithm using manual feature selection.These verify that the algorithm can achieve better detection results without manual feature selection.Then,aiming at the problem that the character distribution of readable DGA domain names and legal domain names is similar,this paper focuses on the long-term dependence of domain name characters and the same layer features of neural networks,and implements DGA domain name detection based on long short-term memory(LSTM)and multi-head self-attention mechanism,combined with one-dimensional convolutional neural networks.In order to overcome the problem that LSTM multi-sequences cannot be computed in parallel,this paper proposes a DGA detection algorithm based on the combination of convolutional neural network and LSTM to splice input sequence vectors into a single vector,which solves the limitation of computing dependence before and after multiple sequences and improves the detection speed.This method makes full use of the efficient hidden feature information extraction of convolutional neural networks and the long-distance dependency acquisition capabilities of LSTM networks,and can more effectively detect the spellable DGA domain name.Another detection method proposed in this paper is based on multi-head self-attention convolutional neural network detection model,in order to obtain more subspace information,the model uses multi-input multi-head self-attention,that is,multiple self-attention calculations in parallel,self-attention can directly obtain the relationship between features and features on the same layer,and the feature extraction and context relationship acquisition process are uniformly processed,and the dependence between long-distance features can be obtained.Through experimental verification,the F1 score of the classification detection on the public dataset based on the LSTM model proposed in this paper can reach 98.32%,and the F1 score of the model based on hyperactive attention can reach 98.63%,which enhance the detection ability of spellable DGA domain names on the basis of ensuring the accuracy of pseudo-random DGA domain name detection,which are greatly improved compared with the comparative research methods.Moreover,the relevant research results have been deployed in the environment of the university campus network,which can detect known and unknown malicious DGA domain names online in real time,and further confirm the infected hosts.It has high practical application value.Finally,aiming at the scarcity of some DGA family domain name samples,this paper proposes two DGA domain name generation methods for small sample DGA domain name data enhancement.Some DGA family domain names,such as the newly discovered DGA family,usually have a small sample size,while deep learning-based classification tasks require a large amount of training data to better take advantage of the large capacity of the model.Based on the self-attention mechanism and the Lipschitz normalization method of WGAN(Wasserstein Generative Adversarial Network),this paper proposes a domain name enhancement adversarial network technology,which ensures that the generative model can stably converge to generate domain names similar to the target,and the mixed domain names of the generated domain names and the original domain names can enhance the quality of the training set of small samples of DGA family domain names.This paper also proposes a lightweight domain name generation model based on bidirectional cluster search,which minimizes the character distribution variation of the generated domain name by concatenating the target domain name or word splicing,and then fine-tuning the n-gram tuple in it.Experiments show that the domain names generated by the proposed two generation algorithms have strong similarity with the target domain names,and the use of small sample family data augmentation can improve the training quality of the detection models and improve the detection rate of the detection models for the data enhanced DGA family domain names.