DGA-Based Botnet Detection Toward Imbalanced Multiclass Learning

查看全文 作　　者：Yijing [1]Chen;Bo [1]Pang;Guolin [2]Shao;Guozhu [1]Wen;Xingshu [1]Chen

机构地区：[1]College of Cybersecurity,Sichuan University,Chengdu 610065,China;[2]Cybersecurity Research Institute,Sichuan University,Chengdu 610065,China

出　　处：《Tsinghua Science and Technology》索引2021年第26卷第4期,共16页

基　　金：partially funded by the National Natural Science Foundation of China (No. 61272447);the National Entrepreneurship&Innovation Demonstration Base of China (No. C700011);the Key Research&Development Project of Sichuan Province of China (No.2018G20100)。 摘　　要：Botnets based on the Domain Generation Algorithm(DGA) mechanism pose great challenges to the main current detection methods because of their strong concealment and robustness. However, the complexity of the DGA family and the imbalance of samples continue to impede research on DGA detection. In the existing work, the sample size of each DGA family is regarded as the most important determinant of the resampling proportion;thus,differences in the characteristics of various samples are ignored, and the optimal resampling effect is not achieved.In this paper, a Long Short-Term Memory-based Property and Quantity Dependent Optimization(LSTM.PQDO)method is proposed. This method takes advantage of LSTM to automatically mine the comprehensive features of DGA domain names. It iterates the resampling proportion with the optimal solution based on a comprehensive consideration of the original number and characteristics of the samples to heuristically search for a better solution around the initial solution in the right direction;thus, dynamic optimization of the resampling proportion is realized.The experimental results show that the LSTM.PQDO method can achieve better performance compared with existing models to overcome the difficulties of unbalanced datasets;moreover, it can function as a reference for sample resampling tasks in similar scenarios. 关键词：BOTNET Domain Generation Algorithm(DGA) multiclass imbalance RESAMPLING

相关文献

参考文献（21）
引证文献（7）
耦合文献（15）

参考文献(21)

引证文献(7)

耦合文献(15)

互联网出版许可证新出网证(渝)字10号全国400电话 - 免长途话费

DGA-Based Botnet Detection Toward Imbalanced Multiclass Learning

参考文献(21)

引证文献(7)

耦合文献(15)

用户提示