电子学报 ›› 2022, Vol. 50 ›› Issue (1): 250-256.DOI: 10.12263/DZXB.20200619
刘小洋1, 刘加苗1, 刘超1, 张宜浩2
收稿日期:
2020-06-28
修回日期:
2021-02-20
出版日期:
2022-01-25
发布日期:
2022-01-25
作者简介:
基金资助:
LIU Xiao-yang1, LIU Jia-miao1, LIU Chao1, ZHANG Yi-hao2
Received:
2020-06-28
Revised:
2021-02-20
Online:
2022-01-25
Published:
2022-01-25
摘要:
本文提出了一种基于字符级滑动窗口的深度残差网络(Sliding Window-Depth Residual Network,SW-DRN),首次将轻量级深度可分离式卷积应用于僵尸网络中DGA(Domain Generation Algorithm)域名检测.SW-DRN采用深度可分离式卷积,相比标准卷积减少了约56%的参数,增强了模型检测效率.采集两种不同来源的数据,分别命名为Real-Dataset和Gen-Dataset.SW-DRN与对照组模型在两个数据集上进行实验,实验结果表明:SW-DRN模型在DGA域名二分类任务中的F-Score评估指标上分别取得了99.23%和97.81%的成绩;并且在少样本DGA域名家族以及域名字符串易混淆DGA域名情形下多分类任务中取得不错的成绩,相比目前已有的DGA域名分类模型在总体F-Score上提升了1.23%和1.01%的性能,增强了DGA域名家族之间的识别;同时还对所提出的模型在生成对抗模型产生域名进行测试,均能得到有效的识别.
中图分类号:
刘小洋, 刘加苗, 刘超, 张宜浩. 融合字符级滑动窗口和深度残差网络的僵尸网络DGA域名检测方法[J]. 电子学报, 2022, 50(1): 250-256.
LIU Xiao-yang, LIU Jia-miao, LIU Chao, ZHANG Yi-hao. Novel Botnet DGA Domain Detection Method Based on Character Level Sliding Window and Deep Residual Network[J]. Acta Electronica Sinica, 2022, 50(1): 250-256.
模型名 | Acc | precision | recall | F-score |
---|---|---|---|---|
LSTM | 99.14 | 99.14 | 99.12 | 99.13 |
GRU | 98.82 | 98.80 | 98.81 | 98.80 |
CNN-LSTM | 99.09 | 99.08 | 99.07 | 99.07 |
Shallow-CNN | 98.66 | 98.66 | 98.62 | 98.64 |
LSTM- Attention | 99.15 | 99.14 | 99.14 | 99.14 |
SW-DRN | 99.24 | 99.25 | 99.21 | 99.23 |
表2 Real-Dataset数据集二分类结果/%
模型名 | Acc | precision | recall | F-score |
---|---|---|---|---|
LSTM | 99.14 | 99.14 | 99.12 | 99.13 |
GRU | 98.82 | 98.80 | 98.81 | 98.80 |
CNN-LSTM | 99.09 | 99.08 | 99.07 | 99.07 |
Shallow-CNN | 98.66 | 98.66 | 98.62 | 98.64 |
LSTM- Attention | 99.15 | 99.14 | 99.14 | 99.14 |
SW-DRN | 99.24 | 99.25 | 99.21 | 99.23 |
模型名 | Acc | precision | recall | F-score |
---|---|---|---|---|
LSTM | 97.35 | 97.36 | 97.36 | 97.35 |
GRU | 96.14 | 96.19 | 96.17 | 96.14 |
CNN-LSTM | 97.21 | 97.21 | 97.22 | 97.21 |
Shallow-CNN | 96.92 | 96.93 | 96.93 | 96.92 |
LSTM- Attention | 92.42 | 92.45 | 92.44 | 92.42 |
SW-DRN | 97.81 | 97.81 | 97.82 | 97.81 |
表3 Gen-Dataset数据集二分类结果对比/%
模型名 | Acc | precision | recall | F-score |
---|---|---|---|---|
LSTM | 97.35 | 97.36 | 97.36 | 97.35 |
GRU | 96.14 | 96.19 | 96.17 | 96.14 |
CNN-LSTM | 97.21 | 97.21 | 97.22 | 97.21 |
Shallow-CNN | 96.92 | 96.93 | 96.93 | 96.92 |
LSTM- Attention | 92.42 | 92.45 | 92.44 | 92.42 |
SW-DRN | 97.81 | 97.81 | 97.82 | 97.81 |
模型名 | LSTM | GRU | LSTM-Attention | Shallow-CNN | CNN-LSTM | SW-DRN | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
类别 | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score |
banjori | 100 | 0.01 | 99.95 | 99.6 | 0.078 | 99.43 | 100 | 0.013 | 99.94 | 99.98 | 0.029 | 99.85 | 100 | 0.018 | 99.91 | 100 | 0.016 | 99.93 |
emotet | 100 | 0.034 | 99.84 | 99.88 | 0.029 | 99.8 | 100 | 0.031 | 99.85 | 100 | 0.026 | 99.88 | 100 | 0.029 | 99.86 | 99.98 | 0.026 | 99.86 |
rovnix | 99.8 | 0.037 | 99.73 | 97.98 | 0.243 | 97.83 | 99.68 | 0.021 | 99.74 | 99.82 | 0.013 | 99.85 | 99.7 | 0.039 | 99.66 | 99.8 | 0.013 | 99.84 |
tinba | 96.82 | 0.51 | 96.01 | 90.62 | 0.899 | 90.98 | 97.35 | 0.478 | 96.42 | 99.78 | 0.708 | 96.61 | 99.65 | 0.661 | 96.76 | 98.88 | 0.541 | 96.91 |
pykspa_v1 | 99.98 | 0.01 | 99.94 | 98.98 | 0.136 | 98.84 | 99.95 | 0.029 | 99.84 | 99.88 | 0.039 | 99.75 | 99.92 | 0.013 | 99.9 | 99.88 | 0.01 | 99.89 |
simda | 99.18 | 0.01 | 99.54 | 99.65 | 0.091 | 99.39 | 100 | 0.031 | 99.85 | 99.95 | 0.037 | 99.8 | 99.95 | 0.034 | 99.81 | 99.98 | 0.031 | 99.84 |
ramnit | 90.96 | 1.275 | 89.43 | 79.67 | 2.29 | 78.87 | 90.14 | 1.098 | 89.75 | 91.09 | 1.025 | 90.59 | 90.96 | 1.015 | 90.57 | 93.17 | 1.119 | 91.3 |
gameover | 99.71 | 0.003 | 99.83 | 98.54 | 0.025 | 99.06 | 99.67 | 0.018 | 99.69 | 99.71 | 0.003 | 99.83 | 99.75 | 0.03 | 99.63 | 99.71 | 0 | 99.85 |
ranbyus | 90.97 | 0.276 | 92.68 | 88.23 | 0.547 | 88.77 | 91.79 | 0.314 | 92.79 | 92.56 | 0.301 | 93.32 | 92.17 | 0.177 | 94.25 | 92.36 | 0.124 | 94.85 |
virut | 100 | 0 | 100 | 100 | 0 | 100 | 99.9 | 0.005 | 99.9 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 |
murofet | 86.62 | 0.387 | 88.48 | 80.08 | 0.833 | 80.15 | 91.82 | 0.528 | 89.88 | 90.77 | 0.427 | 90.38 | 90.48 | 0.439 | 90.08 | 91 | 0.385 | 90.95 |
necurs | 87.95 | 0.423 | 88.53 | 70.39 | 1.075 | 71.22 | 86.95 | 0.317 | 89.17 | 84.13 | 0.408 | 86.51 | 88.32 | 0.325 | 89.86 | 88.57 | 0.145 | 92.14 |
shiotob | 96.61 | 0.076 | 97.31 | 78.78 | 0.816 | 78.93 | 97.55 | 0.052 | 98.11 | 94.85 | 0.14 | 95.6 | 95.29 | 0.12 | 96.08 | 96.42 | 0.054 | 97.49 |
symmi | 100 | 0.002 | 99.94 | 99.76 | 0.012 | 99.59 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 |
shifu | 99.02 | 0.081 | 96.27 | 94.69 | 0.024 | 96.3 | 98.23 | 0.01 | 98.71 | 98.62 | 0.007 | 99.01 | 98.43 | 0.01 | 98.81 | 98.82 | 0.007 | 99.11 |
suppobox | 99.53 | 0.045 | 97.56 | 94.55 | 0.081 | 93.33 | 100 | 0.012 | 99.41 | 98.82 | 0.048 | 97.09 | 99.29 | 0.029 | 98.24 | 100 | 0.014 | 99.29 |
qadars | 98.75 | 0.021 | 98.26 | 79.25 | 0.232 | 77.89 | 99.5 | 0.002 | 99.62 | 89.5 | 0.043 | 92.27 | 96 | 0.053 | 95.29 | 99.75 | 0 | 99.87 |
locky | 54.98 | 0.207 | 57.08 | 25.11 | 0.407 | 25.22 | 56.28 | 0.169 | 60.19 | 29.87 | 0.088 | 40.95 | 39.39 | 0.086 | 50.84 | 58.87 | 0.09 | 67.16 |
chinad | 98.5 | 0.002 | 98.99 | 83.5 | 0.031 | 87.89 | 98 | 0.002 | 98.74 | 98.5 | 0.005 | 98.75 | 97.5 | 0.002 | 98.48 | 99 | 0.007 | 98.75 |
cryptolocker | 40.5 | 0.204 | 44.14 | 23 | 0.349 | 23.41 | 48 | 0.147 | 53.63 | 43 | 0.107 | 51.96 | 52.5 | 0.088 | 61.4 | 60.5 | 0.145 | 63.35 |
dyre | 100 | 0.002 | 99.75 | 99.5 | 0.005 | 99.25 | 100 | 0.005 | 99.5 | 100 | 0.002 | 99.75 | 100 | 0 | 100 | 100 | 0 | 100 |
macro | 92.38 | - | 92.53 | 84.85 | - | 85.05 | 93.09 | - | 93.55 | 90.99 | - | 91.98 | 92.34 | - | 93.3 | 94.13 | - | 94.78 |
表4 Real-Dataset 多分类结果/%
模型名 | LSTM | GRU | LSTM-Attention | Shallow-CNN | CNN-LSTM | SW-DRN | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
类别 | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score |
banjori | 100 | 0.01 | 99.95 | 99.6 | 0.078 | 99.43 | 100 | 0.013 | 99.94 | 99.98 | 0.029 | 99.85 | 100 | 0.018 | 99.91 | 100 | 0.016 | 99.93 |
emotet | 100 | 0.034 | 99.84 | 99.88 | 0.029 | 99.8 | 100 | 0.031 | 99.85 | 100 | 0.026 | 99.88 | 100 | 0.029 | 99.86 | 99.98 | 0.026 | 99.86 |
rovnix | 99.8 | 0.037 | 99.73 | 97.98 | 0.243 | 97.83 | 99.68 | 0.021 | 99.74 | 99.82 | 0.013 | 99.85 | 99.7 | 0.039 | 99.66 | 99.8 | 0.013 | 99.84 |
tinba | 96.82 | 0.51 | 96.01 | 90.62 | 0.899 | 90.98 | 97.35 | 0.478 | 96.42 | 99.78 | 0.708 | 96.61 | 99.65 | 0.661 | 96.76 | 98.88 | 0.541 | 96.91 |
pykspa_v1 | 99.98 | 0.01 | 99.94 | 98.98 | 0.136 | 98.84 | 99.95 | 0.029 | 99.84 | 99.88 | 0.039 | 99.75 | 99.92 | 0.013 | 99.9 | 99.88 | 0.01 | 99.89 |
simda | 99.18 | 0.01 | 99.54 | 99.65 | 0.091 | 99.39 | 100 | 0.031 | 99.85 | 99.95 | 0.037 | 99.8 | 99.95 | 0.034 | 99.81 | 99.98 | 0.031 | 99.84 |
ramnit | 90.96 | 1.275 | 89.43 | 79.67 | 2.29 | 78.87 | 90.14 | 1.098 | 89.75 | 91.09 | 1.025 | 90.59 | 90.96 | 1.015 | 90.57 | 93.17 | 1.119 | 91.3 |
gameover | 99.71 | 0.003 | 99.83 | 98.54 | 0.025 | 99.06 | 99.67 | 0.018 | 99.69 | 99.71 | 0.003 | 99.83 | 99.75 | 0.03 | 99.63 | 99.71 | 0 | 99.85 |
ranbyus | 90.97 | 0.276 | 92.68 | 88.23 | 0.547 | 88.77 | 91.79 | 0.314 | 92.79 | 92.56 | 0.301 | 93.32 | 92.17 | 0.177 | 94.25 | 92.36 | 0.124 | 94.85 |
virut | 100 | 0 | 100 | 100 | 0 | 100 | 99.9 | 0.005 | 99.9 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 |
murofet | 86.62 | 0.387 | 88.48 | 80.08 | 0.833 | 80.15 | 91.82 | 0.528 | 89.88 | 90.77 | 0.427 | 90.38 | 90.48 | 0.439 | 90.08 | 91 | 0.385 | 90.95 |
necurs | 87.95 | 0.423 | 88.53 | 70.39 | 1.075 | 71.22 | 86.95 | 0.317 | 89.17 | 84.13 | 0.408 | 86.51 | 88.32 | 0.325 | 89.86 | 88.57 | 0.145 | 92.14 |
shiotob | 96.61 | 0.076 | 97.31 | 78.78 | 0.816 | 78.93 | 97.55 | 0.052 | 98.11 | 94.85 | 0.14 | 95.6 | 95.29 | 0.12 | 96.08 | 96.42 | 0.054 | 97.49 |
symmi | 100 | 0.002 | 99.94 | 99.76 | 0.012 | 99.59 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 |
shifu | 99.02 | 0.081 | 96.27 | 94.69 | 0.024 | 96.3 | 98.23 | 0.01 | 98.71 | 98.62 | 0.007 | 99.01 | 98.43 | 0.01 | 98.81 | 98.82 | 0.007 | 99.11 |
suppobox | 99.53 | 0.045 | 97.56 | 94.55 | 0.081 | 93.33 | 100 | 0.012 | 99.41 | 98.82 | 0.048 | 97.09 | 99.29 | 0.029 | 98.24 | 100 | 0.014 | 99.29 |
qadars | 98.75 | 0.021 | 98.26 | 79.25 | 0.232 | 77.89 | 99.5 | 0.002 | 99.62 | 89.5 | 0.043 | 92.27 | 96 | 0.053 | 95.29 | 99.75 | 0 | 99.87 |
locky | 54.98 | 0.207 | 57.08 | 25.11 | 0.407 | 25.22 | 56.28 | 0.169 | 60.19 | 29.87 | 0.088 | 40.95 | 39.39 | 0.086 | 50.84 | 58.87 | 0.09 | 67.16 |
chinad | 98.5 | 0.002 | 98.99 | 83.5 | 0.031 | 87.89 | 98 | 0.002 | 98.74 | 98.5 | 0.005 | 98.75 | 97.5 | 0.002 | 98.48 | 99 | 0.007 | 98.75 |
cryptolocker | 40.5 | 0.204 | 44.14 | 23 | 0.349 | 23.41 | 48 | 0.147 | 53.63 | 43 | 0.107 | 51.96 | 52.5 | 0.088 | 61.4 | 60.5 | 0.145 | 63.35 |
dyre | 100 | 0.002 | 99.75 | 99.5 | 0.005 | 99.25 | 100 | 0.005 | 99.5 | 100 | 0.002 | 99.75 | 100 | 0 | 100 | 100 | 0 | 100 |
macro | 92.38 | - | 92.53 | 84.85 | - | 85.05 | 93.09 | - | 93.55 | 90.99 | - | 91.98 | 92.34 | - | 93.3 | 94.13 | - | 94.78 |
模型名 | LSTM | GRU | LSTM-Attention | Shallow-CNN | CNN-LSTM | SW-DRN | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
类别 | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score |
pitou | 100 | 0.007 | 99.9 | 99.93 | 0.006 | 99.88 | 99.98 | 0.023 | 99.67 | 100 | 0.004 | 99.94 | 99.68 | 0.013 | 99.65 | 100 | 0.005 | 99.93 |
zloader | 99.55 | 0.153 | 97.67 | 100 | 0.159 | 97.81 | 100 | 0.156 | 97.85 | 100 | 0.156 | 97.85 | 99.82 | 0.156 | 97.76 | 100 | 0.154 | 97.88 |
locky | 79.7 | 0.986 | 76.83 | 72.55 | 0.549 | 77.17 | 70.48 | 0.397 | 77.59 | 66.8 | 0.703 | 71.6 | 71.8 | 0.502 | 77.23 | 76.85 | 0.508 | 80.41 |
newgoz | 99.98 | 0.001 | 99.97 | 99.95 | 0 | 99.97 | 99.98 | 0 | 99.99 | 99.95 | 0 | 99.97 | 99.92 | 0.003 | 99.92 | 99.98 | 0 | 99.99 |
dircrypt | 69.45 | 0.839 | 71.94 | 69.58 | 0.973 | 70.63 | 76.18 | 1.064 | 73.9 | 73.88 | 1.349 | 69.73 | 72.1 | 0.885 | 73.19 | 74.82 | 0.846 | 75.33 |
padcrypt | 100 | 0.002 | 99.98 | 99.92 | 0.006 | 99.88 | 99.95 | 0 | 99.97 | 100 | 0.004 | 99.94 | 99.95 | 0.009 | 99.85 | 100 | 0.001 | 99.99 |
symmi | 99.98 | 0 | 99.99 | 100 | 0.004 | 99.94 | 99.92 | 0 | 99.96 | 100 | 0 | 100 | 100 | 0.004 | 99.95 | 100 | 0 | 100 |
murofet | 99.98 | 0 | 99.99 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 99.95 | 0.001 | 99.96 | 100 | 0 | 100 |
proslikefan | 61.4 | 0.768 | 67.09 | 55.82 | 1.01 | 60.59 | 62.6 | 0.673 | 68.95 | 51.62 | 0.721 | 60.05 | 60.85 | 0.662 | 67.8 | 66.62 | 0.821 | 70.22 |
reconyc | 95.7 | 0.068 | 96.85 | 93.6 | 0.001 | 96.68 | 96.05 | 0.05 | 97.29 | 94.7 | 0.038 | 96.74 | 95.08 | 0.039 | 96.93 | 95.52 | 0.032 | 97.26 |
ranbyus | 96.48 | 0.241 | 94.92 | 98.68 | 0.268 | 95.7 | 98.3 | 0.235 | 95.94 | 98.1 | 0.265 | 95.44 | 98.68 | 0.287 | 95.45 | 99.98 | 0.257 | 96.49 |
dnschanger | 52.42 | 2.223 | 48.76 | 68.25 | 2.834 | 55.02 | 34.98 | 1.571 | 39.03 | 48.15 | 2.004 | 47.07 | 53.42 | 2.213 | 49.52 | 40.72 | 1.681 | 43.3 |
shiotob | 92.88 | 0.132 | 94.48 | 92.42 | 0.043 | 95.46 | 92.35 | 0.018 | 95.77 | 92.7 | 0.06 | 95.37 | 92.55 | 0.116 | 94.52 | 92.3 | 0.022 | 95.68 |
fobber | 46.78 | 1.979 | 46.19 | 33.15 | 1.372 | 38.59 | 65.4 | 2.604 | 54.78 | 53.52 | 2.265 | 49.25 | 46.45 | 2.005 | 45.77 | 59.05 | 2.513 | 51.38 |
qadars | 99.98 | 0.004 | 99.93 | 99.45 | 0 | 99.72 | 99.72 | 0 | 99.86 | 99.58 | 0.021 | 99.49 | 98.22 | 0.003 | 99.07 | 100 | 0.003 | 99.96 |
ramdo | 100 | 0 | 100 | 100 | 0.002 | 99.98 | 100 | 0 | 100 | 100 | 0.002 | 99.98 | 100 | 0.002 | 99.98 | 100 | 0 | 100 |
corebot | 100 | 0.001 | 99.99 | 99.88 | 0 | 99.94 | 100 | 0.002 | 99.98 | 100 | 0 | 100 | 99.98 | 0.001 | 99.97 | 100 | 0 | 100 |
qakbot | 58.25 | 0.453 | 68.13 | 61.8 | 0.718 | 67.9 | 65.8 | 0.639 | 71.6 | 57.12 | 0.385 | 68.02 | 59.12 | 0.462 | 68.69 | 62.85 | 0.443 | 71.7 |
nymaim | 85.88 | 1.495 | 75.33 | 53 | 2.241 | 49.05 | 78.62 | 1.288 | 73.17 | 47.18 | 2.465 | 43.55 | 84.12 | 1.664 | 72.84 | 90.62 | 1.543 | 77.42 |
necurs | 81.75 | 0.211 | 87.11 | 79.25 | 0.029 | 88.02 | 80.85 | 0.055 | 88.65 | 70.25 | 0.288 | 78.77 | 79.18 | 0.203 | 85.64 | 81.05 | 0.02 | 89.26 |
simda | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 |
suppobox | 95.38 | 0.322 | 93.3 | 97.55 | 1.213 | 84.19 | 90.92 | 0.07 | 94.27 | 85.75 | 0.303 | 88.28 | 92.7 | 0.503 | 89.62 | 92.55 | 0.041 | 95.56 |
pykspa | 72.15 | 1.414 | 68.07 | 76.25 | 2.155 | 64.35 | 84.58 | 2.405 | 67.04 | 68.42 | 2.36 | 58.25 | 80.22 | 1.823 | 69.29 | 79.1 | 1.49 | 71.56 |
mydoom | 100 | 0.004 | 99.94 | 100 | 0.025 | 99.65 | 99.85 | 0.004 | 99.86 | 100 | 0.006 | 99.91 | 99.78 | 0.028 | 99.5 | 100 | 0.001 | 99.99 |
vawtrak | 99.95 | 0.006 | 99.89 | 100 | 0.036 | 99.48 | 99.97 | 0.004 | 99.92 | 100 | 0.028 | 99.6 | 99.72 | 0.027 | 99.48 | 100 | 0.003 | 99.96 |
nymaim2 | 98.03 | 0.038 | 98.45 | 95.22 | 0.041 | 96.96 | 97.64 | 0.02 | 98.51 | 95.56 | 0.124 | 95.95 | 95.98 | 0.095 | 96.58 | 98.78 | 0.024 | 99.04 |
pizd | 89.38 | 0.161 | 91.69 | 65.36 | 0.116 | 77.18 | 98.81 | 0.326 | 94.06 | 93.16 | 0.528 | 88.12 | 85.44 | 0.258 | 87.91 | 99.02 | 0.265 | 95.13 |
banjori | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 |
tinba | 98.5 | 0.337 | 92.36 | 96.35 | 0.399 | 90.12 | 97.19 | 0.332 | 91.8 | 96.93 | 0.436 | 89.73 | 97.66 | 0.41 | 90.57 | 97.85 | 0.186 | 95 |
tempedreve | 72.92 | 0.428 | 72.19 | 64.87 | 0.429 | 66.87 | 60.38 | 0.216 | 68.99 | 71.85 | 0.702 | 65.45 | 69.49 | 0.383 | 71.06 | 73.68 | 0.371 | 74.08 |
kraken | 50.71 | 0.225 | 59.94 | 49.71 | 0.145 | 61.51 | 46.21 | 0.058 | 61.21 | 49.21 | 0.153 | 60.84 | 50.21 | 0.16 | 61.45 | 49.79 | 0.118 | 62.43 |
monerodownloader | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0.001 | 99.9 | 100 | 0 | 100 |
chinad | 99.67 | 0.001 | 99.67 | 99.67 | 0.001 | 99.67 | 97.07 | 0.001 | 98.35 | 99.35 | 0.001 | 99.51 | 98.05 | 0.002 | 98.69 | 99.67 | 0.001 | 99.67 |
macro | 87.78 | - | 87.89 | 85.52 | - | 85.81 | 87.69 | - | 88.04 | 85.26 | - | 85.4 | 87.27 | - | 87.5 | 88.81 | - | 89.05 |
表5 Gen-Dataset多分类结果/%
模型名 | LSTM | GRU | LSTM-Attention | Shallow-CNN | CNN-LSTM | SW-DRN | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
类别 | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score | DR | FPR | F-score |
pitou | 100 | 0.007 | 99.9 | 99.93 | 0.006 | 99.88 | 99.98 | 0.023 | 99.67 | 100 | 0.004 | 99.94 | 99.68 | 0.013 | 99.65 | 100 | 0.005 | 99.93 |
zloader | 99.55 | 0.153 | 97.67 | 100 | 0.159 | 97.81 | 100 | 0.156 | 97.85 | 100 | 0.156 | 97.85 | 99.82 | 0.156 | 97.76 | 100 | 0.154 | 97.88 |
locky | 79.7 | 0.986 | 76.83 | 72.55 | 0.549 | 77.17 | 70.48 | 0.397 | 77.59 | 66.8 | 0.703 | 71.6 | 71.8 | 0.502 | 77.23 | 76.85 | 0.508 | 80.41 |
newgoz | 99.98 | 0.001 | 99.97 | 99.95 | 0 | 99.97 | 99.98 | 0 | 99.99 | 99.95 | 0 | 99.97 | 99.92 | 0.003 | 99.92 | 99.98 | 0 | 99.99 |
dircrypt | 69.45 | 0.839 | 71.94 | 69.58 | 0.973 | 70.63 | 76.18 | 1.064 | 73.9 | 73.88 | 1.349 | 69.73 | 72.1 | 0.885 | 73.19 | 74.82 | 0.846 | 75.33 |
padcrypt | 100 | 0.002 | 99.98 | 99.92 | 0.006 | 99.88 | 99.95 | 0 | 99.97 | 100 | 0.004 | 99.94 | 99.95 | 0.009 | 99.85 | 100 | 0.001 | 99.99 |
symmi | 99.98 | 0 | 99.99 | 100 | 0.004 | 99.94 | 99.92 | 0 | 99.96 | 100 | 0 | 100 | 100 | 0.004 | 99.95 | 100 | 0 | 100 |
murofet | 99.98 | 0 | 99.99 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 99.95 | 0.001 | 99.96 | 100 | 0 | 100 |
proslikefan | 61.4 | 0.768 | 67.09 | 55.82 | 1.01 | 60.59 | 62.6 | 0.673 | 68.95 | 51.62 | 0.721 | 60.05 | 60.85 | 0.662 | 67.8 | 66.62 | 0.821 | 70.22 |
reconyc | 95.7 | 0.068 | 96.85 | 93.6 | 0.001 | 96.68 | 96.05 | 0.05 | 97.29 | 94.7 | 0.038 | 96.74 | 95.08 | 0.039 | 96.93 | 95.52 | 0.032 | 97.26 |
ranbyus | 96.48 | 0.241 | 94.92 | 98.68 | 0.268 | 95.7 | 98.3 | 0.235 | 95.94 | 98.1 | 0.265 | 95.44 | 98.68 | 0.287 | 95.45 | 99.98 | 0.257 | 96.49 |
dnschanger | 52.42 | 2.223 | 48.76 | 68.25 | 2.834 | 55.02 | 34.98 | 1.571 | 39.03 | 48.15 | 2.004 | 47.07 | 53.42 | 2.213 | 49.52 | 40.72 | 1.681 | 43.3 |
shiotob | 92.88 | 0.132 | 94.48 | 92.42 | 0.043 | 95.46 | 92.35 | 0.018 | 95.77 | 92.7 | 0.06 | 95.37 | 92.55 | 0.116 | 94.52 | 92.3 | 0.022 | 95.68 |
fobber | 46.78 | 1.979 | 46.19 | 33.15 | 1.372 | 38.59 | 65.4 | 2.604 | 54.78 | 53.52 | 2.265 | 49.25 | 46.45 | 2.005 | 45.77 | 59.05 | 2.513 | 51.38 |
qadars | 99.98 | 0.004 | 99.93 | 99.45 | 0 | 99.72 | 99.72 | 0 | 99.86 | 99.58 | 0.021 | 99.49 | 98.22 | 0.003 | 99.07 | 100 | 0.003 | 99.96 |
ramdo | 100 | 0 | 100 | 100 | 0.002 | 99.98 | 100 | 0 | 100 | 100 | 0.002 | 99.98 | 100 | 0.002 | 99.98 | 100 | 0 | 100 |
corebot | 100 | 0.001 | 99.99 | 99.88 | 0 | 99.94 | 100 | 0.002 | 99.98 | 100 | 0 | 100 | 99.98 | 0.001 | 99.97 | 100 | 0 | 100 |
qakbot | 58.25 | 0.453 | 68.13 | 61.8 | 0.718 | 67.9 | 65.8 | 0.639 | 71.6 | 57.12 | 0.385 | 68.02 | 59.12 | 0.462 | 68.69 | 62.85 | 0.443 | 71.7 |
nymaim | 85.88 | 1.495 | 75.33 | 53 | 2.241 | 49.05 | 78.62 | 1.288 | 73.17 | 47.18 | 2.465 | 43.55 | 84.12 | 1.664 | 72.84 | 90.62 | 1.543 | 77.42 |
necurs | 81.75 | 0.211 | 87.11 | 79.25 | 0.029 | 88.02 | 80.85 | 0.055 | 88.65 | 70.25 | 0.288 | 78.77 | 79.18 | 0.203 | 85.64 | 81.05 | 0.02 | 89.26 |
simda | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 |
suppobox | 95.38 | 0.322 | 93.3 | 97.55 | 1.213 | 84.19 | 90.92 | 0.07 | 94.27 | 85.75 | 0.303 | 88.28 | 92.7 | 0.503 | 89.62 | 92.55 | 0.041 | 95.56 |
pykspa | 72.15 | 1.414 | 68.07 | 76.25 | 2.155 | 64.35 | 84.58 | 2.405 | 67.04 | 68.42 | 2.36 | 58.25 | 80.22 | 1.823 | 69.29 | 79.1 | 1.49 | 71.56 |
mydoom | 100 | 0.004 | 99.94 | 100 | 0.025 | 99.65 | 99.85 | 0.004 | 99.86 | 100 | 0.006 | 99.91 | 99.78 | 0.028 | 99.5 | 100 | 0.001 | 99.99 |
vawtrak | 99.95 | 0.006 | 99.89 | 100 | 0.036 | 99.48 | 99.97 | 0.004 | 99.92 | 100 | 0.028 | 99.6 | 99.72 | 0.027 | 99.48 | 100 | 0.003 | 99.96 |
nymaim2 | 98.03 | 0.038 | 98.45 | 95.22 | 0.041 | 96.96 | 97.64 | 0.02 | 98.51 | 95.56 | 0.124 | 95.95 | 95.98 | 0.095 | 96.58 | 98.78 | 0.024 | 99.04 |
pizd | 89.38 | 0.161 | 91.69 | 65.36 | 0.116 | 77.18 | 98.81 | 0.326 | 94.06 | 93.16 | 0.528 | 88.12 | 85.44 | 0.258 | 87.91 | 99.02 | 0.265 | 95.13 |
banjori | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 |
tinba | 98.5 | 0.337 | 92.36 | 96.35 | 0.399 | 90.12 | 97.19 | 0.332 | 91.8 | 96.93 | 0.436 | 89.73 | 97.66 | 0.41 | 90.57 | 97.85 | 0.186 | 95 |
tempedreve | 72.92 | 0.428 | 72.19 | 64.87 | 0.429 | 66.87 | 60.38 | 0.216 | 68.99 | 71.85 | 0.702 | 65.45 | 69.49 | 0.383 | 71.06 | 73.68 | 0.371 | 74.08 |
kraken | 50.71 | 0.225 | 59.94 | 49.71 | 0.145 | 61.51 | 46.21 | 0.058 | 61.21 | 49.21 | 0.153 | 60.84 | 50.21 | 0.16 | 61.45 | 49.79 | 0.118 | 62.43 |
monerodownloader | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0 | 100 | 100 | 0.001 | 99.9 | 100 | 0 | 100 |
chinad | 99.67 | 0.001 | 99.67 | 99.67 | 0.001 | 99.67 | 97.07 | 0.001 | 98.35 | 99.35 | 0.001 | 99.51 | 98.05 | 0.002 | 98.69 | 99.67 | 0.001 | 99.67 |
macro | 87.78 | - | 87.89 | 85.52 | - | 85.81 | 87.69 | - | 88.04 | 85.26 | - | 85.4 | 87.27 | - | 87.5 | 88.81 | - | 89.05 |
模型名 | Acc | precision | recall | F-score |
---|---|---|---|---|
DeepDGA | 99.97 | 99.97 | 99.98 | 99.97 |
CharBot | 96.86 | 96.88 | 96.87 | 96.87 |
MaskDGA | 98.19 | 97.51 | 98.50 | 97.98 |
表6 SW-DRN模型在生成域名上测试结果/%
模型名 | Acc | precision | recall | F-score |
---|---|---|---|---|
DeepDGA | 99.97 | 99.97 | 99.98 | 99.97 |
CharBot | 96.86 | 96.88 | 96.87 | 96.87 |
MaskDGA | 98.19 | 97.51 | 98.50 | 97.98 |
模型名 | SW-DRN (标准卷积) | SW-DRN (深度可分离式卷积) |
---|---|---|
参数量 | 1.85 | 0.81 |
表7 SW-DRN可训练参数量对比/百万
模型名 | SW-DRN (标准卷积) | SW-DRN (深度可分离式卷积) |
---|---|---|
参数量 | 1.85 | 0.81 |
1 | ANTONAKAKIS M, PERDISCI R, LEE W, et al. Detecting malware domains at the upper dns hierarchy. USENIX security symposium[C]//Proceedings of the 20th USENIX conference on Security. San Francisco, USA: ACM, 2011: 1-16. |
2 | YADAV S, REDDY A K K, REDDY A L N, et al. Detecting algorithmically generated domain-flux attacks with DNS traffic analysis[J]. IEEE/ACM Transactions on Networking, 2012, 20(5): 1663-1677. |
3 | ANTONAKAKIS M, PERDISCI R, NADJI Y, et al. From throw-away traffic to bots: Detecting the rise of DGA-based malware[C]//Proceedings of the 21st USENIX Conference on Security Symposium. Washington, USA: ACM, 2012: 491-506. |
4 | WOODBRIDGE J, ANDERSON H S, AHUJA A, et al. Predicting domain generation algorithms with long short-term memory networks[J]. [2020]. . |
5 | VINAYAKUMAR R, SOMAN K P, POORNACHANDRAN P, et al. Evaluating deep learning approaches to characterize and classify the DGAs at scale[J]. Journal of Intelligent & Fuzzy Systems, 2018, 34(3): 1265-1276. |
6 | 吕品, 李全刚, 柳厅文, 等. 基于双向LSTM的误植域名滥用检测方法[J]. 电子学报, 2018, 46(9): 2081-2086. |
LU P, LI Q G, LIU T W, et al. Towards typosquatting abuse detection using bi-directional LSTM[J]. Acta Electronica Sinica, 2018, 46(9): 2081-2086. (in Chinese) | |
7 | TRAN D, MAC H, TONG V, et al. A LSTM based framework for handling multiclass imbalance in DGA botnet detection[J]. Neurocomputing, 2018, 275: 2401-2413. |
8 | HIGHNAM K, PUZIO D, LUO S, et al. Real-time detection of dictionary DGA network traffic using deep learning[J]. SN Computer Science, 2021, 2(2): 1-17. |
9 | 杜鹏, 丁世飞. 基于混合词向量深度学习模型的DGA域名检测方法[J]. 计算机研究与发展, 2020, 57(2): 433-446. |
DU P, DING S F. A DGA domain name detection method based on deep learning models with mixed word embedding[J]. Journal of Computer Research and Development, 2020, 57(2): 433-446. (in Chinese) | |
10 | HE K M, ZHANG X Y, REN S Q, et al. Deep residual learning for image recognition[C]//2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). Las Vegas, USA: IEEE, 2016: 770-778. |
11 | HOWARD A G, ZHU M L, CHEN B, et al. MobileNets: Efficient convolutional neural networks for mobile vision applications[EB/OL]. (2017)[2020]. . |
12 | TRAN D, MAC H, TONG V, et al. A LSTM based framework for handling multiclass imbalance in DGA botnet detection[J]. Neurocomputing, 2018, 275: 2401-2413. |
13 | VINAYAKUMAR R, SOMAN K P, POORNACHANDRAN P, et al. DBD: Deep Learning DGA-based Botnet Detection[M]//Deep Learning Applications for Cyber Security. Cham: Springer International Publishing, 2019: 127-149. |
14 | YU B, PAN J, HU J M, et al. Character level based detection of DGA domain names[C]//2018 International Joint Conference on Neural Networks (IJCNN). Rio, Brazil: IEEE, 2018: 1-8. |
15 | QIAO Y C, ZHANG B, ZHANG W Z, et al. DGA domain name classification method based on long short-term memory with attention mechanism[J]. Applied Sciences, 2019, 9(20): 4205. |
16 | ANDERSON H S, WOODBRIDGE J, FILAR B. DeepDGA: Adversarially-tuned domain generation and detection[C]//Proceedings of the 2016 ACM Workshop on Artificial Intelligence and Security. New York, USA: ACM, 2016: 13-21. |
17 | SIDI L, NADLER A, SHABTAI A. MaskDGA: A black-box evasion technique against DGA classifiers and adversarial defenses[EB/OL]. (2019)[2020]. . |
18 | PECK J, NIE C, SIVAGURU R, et al. CharBot: A simple and effective method for evading DGA classifiers[J]. IEEE Access, 2019, 7: 91759-91771. |
[1] | 胡向东, 李之涵. 基于胶囊网络的工业互联网入侵检测方法[J]. 电子学报, 2022, 50(6): 1457-1465. |
[2] | 廖勇, 李玉杰. 一种轻量化低复杂度的FDD大规模MIMO系统CSI反馈方法[J]. 电子学报, 2022, 50(5): 1211-1217. |
[3] | 张聿远, 张立民, 闫文君. 基于深度多级残差网络的低信噪比下空频分组码识别方法[J]. 电子学报, 2022, 50(1): 79-88. |
[4] | 秦鑫, 黄洁, 查雄, 骆丽萍, 胡德秀. 基于扩张残差网络的雷达辐射源信号识别[J]. 电子学报, 2020, 48(3): 456-462. |
[5] | 罗会兰, 敖阳, 袁璞. 一种生成对抗网络用于图像修复的方法[J]. 电子学报, 2020, 48(10): 1891-1898. |
[6] | 郑兴华, 孙喜庆, 吕嘉欣, 鲜征征, 李磊. 基于深度学习和智能规划的行为识别[J]. 电子学报, 2019, 47(8): 1661-1668. |
[7] | 查雄, 许漫坤, 彭华, 秦鑫, 李天昀. 基于深度残差网络的特定协议信号识别[J]. 电子学报, 2019, 47(7): 1532-1537. |
[8] | 江泽涛, 简雄, 刘小艳, 曾聪文. 一种改进的二进制哈希编码方法[J]. 电子学报, 2019, 47(2): 462-469. |
阅读次数 | ||||||
全文 |
|
|||||
摘要 |
|
|||||