论文标题
使用GCNN-LSTM混合神经网络检测算法生成的域
Detecting Algorithmically Generated Domains Using a GCNN-LSTM Hybrid Neural Network
论文作者
论文摘要
僵尸网络使用域生成算法（DGA）来构建C＆C服务器和机器人之间的隐身命令和控制（C＆C）通信通道。 DGA可以定期生成大量的伪随机算法生成的域（AGD）。 AGD检测算法为现有的DGA技术提供了一种轻巧，有希望的解决方案。在本文中，提出了用于AGD检测的GCNN（封闭式卷积神经网络）-LSTM（长期记忆）混合神经网络（GLHNN）。在GLHNN中，应用GCNN用于从LSTM顶部的域名中提取信息特征，从而进一步处理特征序列。 GLHNN使用涵盖六类DGA的代表性AGD对实验验证。将GLHNN与最先进的检测模型进行了比较，并证明了这些测试模型中最佳的总体检测性能。
Domain generation algorithm (DGA) is used by botnets to build a stealthy command and control (C&C) communication channel between the C&C server and the bots. A DGA can periodically produce a large number of pseudo-random algorithmically generated domains (AGDs). AGD detection algorithms provide a lightweight, promising solution in response to the existing DGA techniques. In this paper, a GCNN (gated convolutional neural network)-LSTM (long short-term memory) Hybrid Neural Network (GLHNN) for AGD detection is proposed. In GLHNN, GCNN is applied to extract the informative features from domain names on top of LSTM which further processes the feature sequence. GLHNN is experimentally validated using representative AGDs covering six classes of DGAs. GLHNN is compared with the state-of-the-art detection models and demonstrates the best overall detection performance among these tested models.
