01 Åä¾°

ÅÌËã»úÍøÂçʵÏÖÁË×ÊÔ´¹²Ïí¡¢¼´Ê±Í¨Ñ¶ºÍÂþÑÜʽÅÌË㣬£¬£¬£¬£¬¸øÈËÃǵÄÊÂÇéºÍÉúÑÄ´øÀ´Á˼«´óµÄ±ãµ±¡£¡£¡£È»¶øÕâЩÍøÂçÒ²»á±»¶ñÒâÈí¼þÀÄÓ㬣¬£¬£¬£¬½©Ê¬ÍøÂ磨botnet£©¾ÍÊǵäµä·¶×Ó¡£¡£¡£½©Ê¬ÍøÂçÓÉ´ó×ÚÊÜ¿ØÖ÷»ú¼´½©Ê¬£¨bot£©ºÍÒ»¸ö»ò¶à¸öÏÂÁîºÍ¿ØÖÆC2£¨Command &Control£©Ð§ÀÍÆ÷×é³É£¬£¬£¬£¬£¬botÓëC2ЧÀÍÆ÷Ï໥ͨѶÒÔ±ãת´ïÏÂÁîºÍÊý¾Ý¡£¡£¡£Îª×èÖ¹C2ЧÀÍÆ÷±»·¢Ã÷£¬£¬£¬£¬£¬¶ñÒâÈí¼þÏë·¨½ÓÄɹæ±ÜÊÖÒÕÀ´Òþ²ØbotÓëC2ЧÀÍÆ÷µÄͨѶÐÐΪ£¬£¬£¬£¬£¬ÆäÖУ¬£¬£¬£¬£¬ÓòÃûÌìÉúËã·¨DGA£¨Domain Generation Algorithm£©¾ÍÊÇÒ»ÖÖÊÊÓÃÊÖÒÕ¡£¡£¡£¼òÆÓµØ˵£¬£¬£¬£¬£¬¹¥»÷ÕßʹÓÃDGAËã·¨ºÍÖÖ×Ó£¨Èçʱ¼ä¡¢´ÇÊéµÈ£©ÌìÉú´ó×ÚËã·¨ÌìÉúÓòÃûAGD£¨Algorithmically Generated Domain£©£¬£¬£¬£¬£¬È»ºóÖ»ÐèҪʹÓÃÒ»¸öÓòÃûÀ´¾ÙÐÐC2ͨѶ£¬£¬£¬£¬£¬¶ø·ÀÓùÕßΪÁË·¢Ã÷¸ÃÓòÃû£¬£¬£¬£¬£¬ÐèÒª¶ÔËùÓÐAGDÓòÃû¾ÙÐмì²â¡£¡£¡£»£»£»£»£»ùÓÚÕâÖÖ¹¥·ÀË«·½ËùÐè×ÊÔ´µÄ²î³Ø³ÆÐÔ£¬£¬£¬£¬£¬DGAÊÖÒÕ±»¹¥»÷ÕßÆÕ±éʹÓá£¡£¡£MITRE ATT&CK C2Õ½ÊõT1568.002ÊÖÒռͼÁËÊ®¼¸¸öʹÓÃDGAÊÖÒÕµÄAPT×éÖ¯£¬£¬£¬£¬£¬ºÃ±ÈAPT41¡¢Aria-bodyµÈ¡£¡£¡£´Ó2008ÄêÎÛÃûÕÑÖøµÄKrakenºÍConficker¶ñÒâÈí¼þÒÔÀ´£¬£¬£¬£¬£¬ÎªÁËÈƹýÈëÇÖ¼ì²âϵͳµÄ¼ì²é£¬£¬£¬£¬£¬ÏÕЩËùÓжñÒâÈí¼þ¶¼½ÓÄÉÁËDGAÊÖÒÕ¡£¡£¡£×îеÄÊÖÒÕ±¨¸æÔ¤¼Æ£¬£¬£¬£¬£¬¶ñÒâAGDÓòÃûÊýÄ¿Ô¼Õ¼ÓòÃû×ÜÊýµÄ9.9%£¬£¬£¬£¬£¬ÆäÖÐ1/5ÊôÓÚ»ùÓÚDGAµÄ½©Ê¬ÍøÂ磨ԼռËùÓÐ×¢²áÓòÃûµÄ1.8%£©¡£¡£¡£

Ä¿½ñ£¬£¬£¬£¬£¬DGAÓòÃû¼ì²âÑо¿ÊÇÇ徲ȦÌÖÂÛµÄÈÈÃÅ»°Ìâ¡£¡£¡£¹Å°åµÄDGAÓòÃû¼ì²âÒªÁìÊÇʹÓúÚÃûµ¥Õ½ÂÔʵÏÖ£¬£¬£¬£¬£¬µ«ÓÉÓÚDGAÓòÃûÈÝÒ×ÌìÉúÇÒ¹æÄ£Á¿´ó£¬£¬£¬£¬£¬Õâ¾Íµ¼ÖÂÒ»Ö±ÍøÂçºÍ¸üкÚÃûµ¥±äµÃ²»ÏÖʵ¡£¡£¡£»£»£»£»£»ùÓÚ»úеѧϰµÄDGAÓòÃû¼ì²âÒªÁì¿ÉÒÔ×èÖ¹Õâһȱ·¦£¬£¬£¬£¬£¬ÊµÏÖʵʱ¼ì²â£¬£¬£¬£¬£¬ÒѳÉΪDGAÓòÃû¼ì²âÁìÓòÑо¿Ö÷Á÷Æ«Ïò¡£¡£¡£

±¾ÎĽ«Ïò¶ÁÕßÏÈÈÝDGAÓòÃû»ù´¡ÖªÊ¶¡¢DGAÓòÃû¼ì²âÒªÁìÏÖ×´ÒÔ¼°ÎÒÃÇÌá³öµÄDGAÓòÃû¼ì²â¼Æ»®¡£¡£¡£

02 ¼ò½é

2.1 DGAÓòÃû¹¥»÷Ô­Àí

DGAÊÇÒ»×éËã·¨»úÖÆ£¬£¬£¬£¬£¬±»ÖÖÖÖ¶ñÒâÈí¼þ¼Ò×åÓÃÀ´ÌìÉú´ó×ÚµÄαËæ»úÓòÃû¡£¡£¡£Î±Ëæ»úÒâζ×Å×Ö·û´®ÐòÁÐËƺõÊÇËæ»úµÄ£¬£¬£¬£¬£¬µ«ÓÉÓÚÆä½á¹¹¿ÉÒÔÔ¤ÏÈÈ·¶¨£¬£¬£¬£¬£¬Òò´Ë¿ÉÒÔÖظ´±¬·¢ºÍ¸´ÖÆ¡£¡£¡£

´ó´ó¶¼Ëæ»úÌìÉúµÄÓòÃûÊDz»±£´æµÄ£¬£¬£¬£¬£¬Ö»ÓÐÆäÖÐһС²¿·ÖÓòÃû»á±»×¢²áÒÔ¹©ÊÜ¿ØÖ÷»úÓëC2ЧÀÍÆ÷¾ÙÐÐͨѶ£¬£¬£¬£¬£¬´Ó¶ø»ñÊØÐÅÏ¢»ò¸ú×ÙÆäËû¶ñÒâʹÃü¡£¡£¡£±ðµÄ£¬£¬£¬£¬£¬µ±Ò»¸öÓòÃû±»ÀÖ³É×èֹʱ£¬£¬£¬£¬£¬¹¥»÷Õß»á´ÓDGAÌìÉúµÄÓòÃûÁбíÖÐ×¢²áÆäËûÓòÃû¡£¡£¡£Ê¹ÓÃDGAÓòÃû¾ÙÐй¥»÷µÄÔ­ÀíÈçͼ1[1]Ëùʾ¡£¡£¡£

¹¥»÷Õßͨ¹ýDGAËã·¨ÌìÉú´ó×Ú±¸Ñ¡ÓòÃû£¬£¬£¬£¬£¬Êܿض˶ñÒâÈí¼þÔËÐÐͳһÌ×DGAËã·¨£¬£¬£¬£¬£¬ÌìÉúÏàͬµÄ±¸Ñ¡ÓòÃûÁÐ±í£¬£¬£¬£¬£¬µ±¾ÙÐй¥»÷µÄʱ¼ä£¬£¬£¬£¬£¬¹¥»÷ÕßÑ¡ÔñÆäÖÐÉÙÁ¿ÓòÃû¾ÙÐÐ×¢²á£¬£¬£¬£¬£¬ÊܿضËͨ¹ýÅÌÎÊ»ñÈ¡ÒÑ×¢²áÓòÃûºó±ã¿ÉÒÔÓëC2ЧÀÍÆ÷½¨ÉèÅþÁ¬£¬£¬£¬£¬£¬¾ÙÐÐÏÂÁîºÍÊý¾Ý´«Êä¡£¡£¡£

2.2 DGAÓòÃû·ÖÀà

2.2.1 ƾ֤ÖÖ×Ó¾ÙÐзÖÀà

ÖÖ×ÓÊǹ¥»÷ÕߺͿͻ§¶Ë¶ñÒâÈí¼þ¹²ÏíµÄDGAËã·¨µÄÊäÈë²ÎÊýÖ®Ò»£¬£¬£¬£¬£¬²î±ðµÄÖÖ×ӵóöµÄDGAÓòÃûÊÇ·×ÆçÑùµÄ¡£¡£¡£

DGAʹÓõÄÖÖ×ÓÓÐÐí¶àÖÖÀ࣬£¬£¬£¬£¬°üÀ¨ÈÕÆÚ¡¢Éç½»ÍøÂçËÑË÷ÈÈ´Ê¡¢Ëæ»úÊý»ò´ÇÊ飬£¬£¬£¬£¬DGAƾ֤ÖÖ×ÓÌìÉúÒ»´®×Ö·ûǰ׺£¬£¬£¬£¬£¬Ìí¼ÓTLD£¨¶¥¼¶Óò£¬£¬£¬£¬£¬Èçcom¡¢orgµÈ£©ºó»ñµÃ×îÖÕÌìÉúÓòÃû¡£¡£¡£

Ò»Ñùƽ³£À´Ëµ£¬£¬£¬£¬£¬ÖÖ×Ó¿É°´ÈçÏ·½·¨¾ÙÐзÖÀࣺ

»ùÓÚʱ¼äµÄÖÖ×Ó£ºDGAË㷨ʹÓÃʱ¼äÐÅÏ¢×÷ΪÊäÈ루È磺ÊÜ¿ØÖ÷»úµÄϵͳʱ¼ä£¬£¬£¬£¬£¬httpÏìÓ¦µÄʱ¼äµÈ£©£»£»£»£»£»

ÊÇ·ñ¾ßÓÐÈ·¶¨ÐÔ£ºÖ÷Á÷µÄDGAËã·¨µÄÊäÈëÊÇÈ·¶¨µÄ£¬£¬£¬£¬£¬Òò´ËAGD¿ÉÒÔ±»ÌáÇ°ÅÌË㣬£¬£¬£¬£¬¿ÉÊÇÒ²ÓÐһЩDGAËã·¨µÄÊäÈëÊDz»È·¶¨µÄ£¨È磺BedepÒÔÅ·ÖÞÖÐÑëÒøÐÐÌìÌìÐû²¼µÄÍâ»ã²Î¿¼»ãÂÊ×÷ΪÖÖ×Ó£¬£¬£¬£¬£¬TorpigÓÃTwitterµÄÒªº¦´Ê×÷ΪÖÖ×Ó£¬£¬£¬£¬£¬Ö»ÓÐÔÚȷ׼ʱ¼ä´°¿ÚÄÚ×¢²áÓòÃû²Å»ªÉúЧ£©¡£¡£¡£

ƾ֤ÖÖ×ӵķÖÀàÒªÁ죬£¬£¬£¬£¬DGAÓòÃû¿ÉÒÔ·ÖΪÒÔÏÂ4Àࣺ

TID(time-independent and deterministic)£ºÓëʱ¼ä²»Ïà¹Ø£¬£¬£¬£¬£¬¿ÉÈ·¶¨£»£»£»£»£»

TDD(time-dependent and deterministic)£ºÓëʱ¼äÏà¹Ø£¬£¬£¬£¬£¬¿ÉÈ·¶¨£»£»£»£»£»

TDN(time-dependent and non-deterministic)£ºÓëʱ¼äÏà¹Ø£¬£¬£¬£¬£¬²»¿ÉÈ·¶¨£»£»£»£»£»

TIN(time-independent and non-deterministic)£ºÓëʱ¼ä²»Ïà¹Ø£¬£¬£¬£¬£¬²»¿ÉÈ·¶¨£»£»£»£»£»

2.2.2 ƾ֤ÌìÉúËã·¨¾ÙÐзÖÀà

ÏÖÓÐDGAÌìÉúËã·¨Ò»Ñùƽ³£¿ÉÒÔ·ÖΪÈçÏÂ4Àࣺ

»ùÓÚËãÊõ£º¸ÃÀàÐÍËã·¨»áÌìÉúÒ»×é¿ÉÓÃASCII±àÂëÌåÏÖµÄÖµ£¬£¬£¬£¬£¬´Ó¶ø×é³ÉDGAÓòÃû£¬£¬£¬£¬£¬Ê¢ÐжÈ×î¸ß£»£»£»£»£»

»ùÓÚ¹þÏ££ºÓùþÏ£ÖµµÄ16½øÖÆÌåÏÖ±¬·¢µÄDGAÓòÃû£¬£¬£¬£¬£¬³£Ê¹ÓõĹþÏ£Ëã·¨ÓУºMD5£¬£¬£¬£¬£¬SHA256£»£»£»£»£»

»ùÓÚ´ÇÊ飺¸Ã·½·¨»á´ÓרÓдÇÊéÖÐÌôÑ¡µ¥´Ê¾ÙÐÐ×éºÏ£¬£¬£¬£¬£¬ïÔÌ­ÓòÃû×Ö·ûÉϵÄËæ»úÐÔ£¬£¬£¬£¬£¬ÒÉ»óÐÔ¸üÇ¿£¬£¬£¬£¬£¬´ÇÊéÄÚǶÔÚ¶ñÒâ³ÌÐòÖлòÕß´Ó¹«ÓÐЧÀÍÖÐÌáÈ¡£¡£¡£»£»£»£»£»

»ùÓÚÅÅÁÐ×éºÏ£º¶ÔÒ»¸ö³õʼÓòÃû¾ÙÐÐ×Ö·ûÉϵÄÅÅÁÐ×éºÏ¡£¡£¡£

2.3 DGAÓòÃû¾ÙÀý

DGAµÄʹÓúÜÊÇÆձ飬£¬£¬£¬£¬ÏÖÔÚÒÑÖªµÄDGA¼Ò×åÓÐ40¶à¸ö¡£¡£¡£Ï±íö¾ÙÁË4¸öDGA¼Ò×åµÄTLD£¨¶¥¼¶Óò£©¡¢SLD£¨¶þ¼¶Óò£©ºÍÑùÀý£º

±í1 ²î±ðDGA¼Ò×å¾ÙÀý

03 ÏÖ×´

3.1 ¸ÅÊö

´ó´ó¶¼DGAËã·¨¶¼¾ßÓÐʱ¼äÒÀÀµÐÔºÍÈ·¶¨ÐÔ£¬£¬£¬£¬£¬¼´ËüÃǵÄÌìÉú²ÎÊýÊÇ¿É»ñÈ¡ºÍ¿ÉÖØÓõģ¬£¬£¬£¬£¬´Ó¶øÅÌËã³öËùÓпÉÄܵÄЧ¹û¡£¡£¡£»£»£»£»£»ùÓÚ´ËÌص㣬£¬£¬£¬£¬¿ÉÒÔ¶Ôÿ¸ö¶ñÒâÈí¼þ¼°Æä±äÌå¾ÙÐÐÄæÏòÆÊÎö»ñµÃÓòÃûÌìÉúËã·¨ºÍÖÖ×Ó£¬£¬£¬£¬£¬´Ó¶øÌáÈ¡¸ø¶¨ÈÕÆÚºÍʱ¼äµÄÓÐÓÃÓòÃûÜöÝÍ£¬£¬£¬£¬£¬¼ÓÈëºÚÃûµ¥¾ÙÐÐDGAÓòÃû¼ì²â¡£¡£¡£

¿ÉÊÇ£¬£¬£¬£¬£¬µ±Ë¼Á¿µ½ÌìÌì·¢Ã÷µÄ¶ñÒâÈí¼þ¼°±äÖÖµÄÊýĿʱ£¬£¬£¬£¬£¬ÕâÖÖÒªÁìÊDz»¿ÉÐеÄ¡£¡£¡£Ôµ¹ÊÔ­ÓÉÓÐÁ½¸ö·½Ã棬£¬£¬£¬£¬ÆäÒ»ÊǺÚÃûµ¥µÄ¸üÐÂËÙÂÊÔ¶Ô¶¸Ï²»ÉÏDGAÓòÃûµÄÌìÉúËÙÂÊ£»£»£»£»£»Æä¶þÊDZØÐè×è¶ÏËùÓеÄDGAÓòÃû²Å»ª×è¶ÏÊÜ¿ØÖ÷»úÓëC2ЧÀÍÆ÷ͨѶ¡£¡£¡£¾ÝÎÄÏ×[2]ËùÑÔ£¬£¬£¬£¬£¬¿ªÔ´ºÚÃûµ¥µÄDGAÁýÕÖÂʵͣ¬£¬£¬£¬£¬½ö²»µ½1.2%µÄDGA°üÀ¨ÔÚºÚÃûµ¥ÖС£¡£¡£Òò´Ë£¬£¬£¬£¬£¬´Ö±©ÓÃDGA¹¹½¨ºÚÃûµ¥µÄÒªÁì²¢²»¿É½â¾ö»ù´¡ÎÊÌâ¡£¡£¡£

»ùÓÚ»úеѧϰµÄDGAÓòÃû¼ì²âÒªÁì´ó²¿·ÖÊÇÖ±½Ó´ÓÍêÈ«¼°¸ñÓòÃûFQDN£¨Fully Qualified Domain Name£©ÌáÈ¡ÌØÕ÷£¬£¬£¬£¬£¬½«FQDN×÷Ϊһ¸ö×Ö·û´®£¬£¬£¬£¬£¬ÌáÈ¡³¤¶È¡¢ìØ¡¢NGramµÈÌØÕ÷£¬£¬£¬£¬£¬ÕâÀàÒªÁì²»ÒÀÀµÓÚÉÏÏÂÎÄÐÅÏ¢£¬£¬£¬£¬£¬ÀýÈçʱ¼ä¡¢ÇéÐÎÉèÖõȣ¬£¬£¬£¬£¬Òò´Ë£¬£¬£¬£¬£¬¿ÉÒÔʵÏÖʵʱ¼ì²â¡£¡£¡£

ÏÖÔڹŰå»úеѧϰËã·¨ºÍÉî¶Èѧϰ¶¼±»ÓÃÓÚDGAÓòÃû¼ì²â£¬£¬£¬£¬£¬²¢¶¼È¡µÃÁ˲»´íµÄЧ¹û¡£¡£¡£¹Å°å»úеѧϰËã·¨·ÖΪ¼àÊÓѧϰºÍÎÞ¼àÊÓѧϰÁ½À࣬£¬£¬£¬£¬ÕâÁ½ÀàËã·¨¶¼ÔÚDGAÓòÃû¼ì²âÖÐÓÐÓ¦Óá£¡£¡£

3.2 »ùÓÚ¼àÊÓѧϰµÄ¼ì²â

³£ÓõļàÊÓѧϰËã·¨ÓоöÒéÊ÷ºÍËæ»úÉ­ÁÖ£¬£¬£¬£¬£¬ÀýÈçÎÄÏ×[3]ʹÓþöÒéÊ÷½â¾öÇø·ÖDGAÓòÃûºÍÕý³£ÓòÃûµÄ¶þ·ÖÀàÎÊÌ⣬£¬£¬£¬£¬Ê¹ÓõÄÌØÕ÷ÓÐÓòÃû³¤¶È¡¢×Ö·û±ÈÀý£¨°üÀ¨ÔªÒô×Öĸ¡¢×ÓÒô×Öĸ¡¢Êý×Ö£©ºÍNGramìØ£»£»£»£»£»ÎÄÏ×[4]Ò²ÊÇʹÓþöÒéÊ÷Ëã·¨¾ÙÐжþ·ÖÀ࣬£¬£¬£¬£¬Ê¹ÓõÄÌØÕ÷ΪÓòÃû³¤¶ÈºÍ×Ô½ç˵µÄÓòÃûÆÚÍûÖµ¡£¡£¡£Ëæ»úÉ­ÁÖÓÐÖúÓÚ½â¾ö¾öÒéÊ÷µÄ¹ýÄâºÏÎÊÌ⣬£¬£¬£¬£¬ÎÄÏ×ÖÐÆÕ±éʹÓÃËæ»úÉ­ÁÖÀ´´¦Öóͷ£»ùÓÚDGAµÄ½©Ê¬ÍøÂçÎÊÌ⣬£¬£¬£¬£¬ÀýÈçÎÄÏ×[5]¾ÍÊÇʹÓÃËæ»úÉ­ÁÖËã·¨½â¾ö¶þ·ÖÀàÎÊÌ⣬£¬£¬£¬£¬Ê¹ÓõÄÌØÕ÷ÓÐËÄÀࣺÂþÑÜÌØÕ÷¡¢½á¹¹ÌØÕ÷¡¢·¢ÒôÌØÕ÷¡¢Í¨ÓÃÌØÕ÷¡£¡£¡£

3.3 »ùÓÚÎÞ¼àÊÓѧϰµÄ¼ì²â

»ùÓÚ¾öÒéÊ÷ºÍËæ»úÉ­ÁÖµÄÄ£×ÓÊôÓÚ¼àÊÓѧϰ£¬£¬£¬£¬£¬¶¼ÐèÒªÌØÕ÷²Å»ªÊÂÇé¡£¡£¡£ÎÞ¼àÊÓѧϰÓëÓмàÊÓѧϰÏà±ÈÓÐÒ»¸öÖ÷ÒªµÄÓÅÊÆÊDz»ÐèÒª´ø±ê¼ÇµÄÊý¾Ý¼¯¡£¡£¡£ÖÚËùÖÜÖªµÄK-MeansËã·¨ÊÇÒ»¸ö¼òÆÓ³£ÓõÄÎÞ¼àÊÓѧϰËã·¨£¬£¬£¬£¬£¬±»ÆÕ±éÓ¦ÓÃÔÚDGAÓòÃû¼ì²âÖУ¬£¬£¬£¬£¬ÀýÈçÎÄÏ×[6]ʹÓÃKMeans¾ÙÐÐDGA¼Ò×åµÄ¶à·ÖÀ࣬£¬£¬£¬£¬Ê¹ÓÃÁËÓòÃûµÄ³¤¶È¡¢ìغÍNGramÏà¹ØÌØÕ÷£»£»£»£»£»ÎÄÏ×[7]ʹÓÃKMeans¾ÙÐÐÇø·ÖÕý³£ºÍDGAÓòÃû£¬£¬£¬£¬£¬Ê¹ÓÃÁ˿ɶÁÐÔ£¨NGram£©¡¢ÐÅÏ¢ìØ¡¢½á¹¹£¨³¤¶È¡¢×Ö·û±ÈÀýµÈ£©ÈýÀàÌØÕ÷¡£¡£¡£ÔÚÒÑÍùÊ®ÄêÖУ¬£¬£¬£¬£¬Ö»ÓÐÉÙÊýÎÞ¼àÊÓËã·¨ÓÃÀ´½â¾öDGAÓòÃû¼ì²âÎÊÌâ¡£¡£¡£³ýÁËKMeansÉÐÓÐÁ½ÖÖ¾ÛÀàÒªÁ죺»ìÏýÄ£×Ó£¨MM£©ºÍHC£¬£¬£¬£¬£¬µ«ËüÃǵÄʹÓúÜÊÇÓÐÏÞ£¬£¬£¬£¬£¬Ð§¹û²»²ÇÏë¡£¡£¡£

3.4 »ùÓÚÉî¶ÈѧϰµÄ¼ì²â

Éî¶ÈѧϰҲÔÚDGAÓòÃû¼ì²âÖÐÓÐÆÕ±éµÄÓ¦Ó㬣¬£¬£¬£¬Ñ­»·Éñ¾­ÍøÂ磨RNNs£©¡¢ÊÇ·ÇÆÚÓ°ÏóÍøÂ磨LSTM£©ºÍ¾í»ýÉñ¾­ÍøÂ磨CNN£©¶¼±»Ó¦Óõ½ÁËDGAÓòÃû¼ì²âÖС£¡£¡£ÀýÈ磺ÎÄÏ×[8]ʹÓÃLSTM½â¾öDGAÓòÃûºÍÕý³£ÓòÃû¶þ·ÖÀà¡¢DGA¼Ò×å¶à·ÖÀàÎÊÌâ£»£»£»£»£»ÎÄÏ×[9]Ñо¿²¢¿ª·¢Á˾­µäLSTMµÄ±äÌ壬£¬£¬£¬£¬Ò²ÓÃÀ´¾ÙÐжþ·ÖÀàºÍ¶à·ÖÀà£»£»£»£»£»ÎÄÏ×[10]½ÏÁ¿ÁËRNN¡¢LSTM¡¢CNNºÍCNN-LSTM×éºÏ¾ÙÐÐDGA¶þ·ÖÀàºÍ¶à·ÖÀàµÄЧ¹û¡£¡£¡£Éî¶ÈѧϰÔÚ¶þ·ÖÀàÖÐÌåÏÖ¾«²Ê£¬£¬£¬£¬£¬µ«ÔÚ¶à·ÖÀàÖдËÀàÒªÁìÔÚ׼ȷ¶ÈºÍÕÙ»ØÂÊ·½Ã涼ȡµÃÁËÁîÈËÏÓÒɵÄЧ¹û¡£¡£¡£×îºóÐèҪ˵Ã÷µÄÊÇÉî¶ÈѧϰËäÈ»¿ÉÒÔÌṩºÜºÃµÄ·ÖÀàЧ¹û£¬£¬£¬£¬£¬µ«ËüÃÇÍùÍùÊÇÌ«¹ýÄâºÏµÄ£¬£¬£¬£¬£¬ÓÈÆäÊDz»Í¸Ã÷µÄ£¬£¬£¬£¬£¬È±·¦Í¸Ã÷¶È×îÖÕµ¼ÖÂÎÞ·¨¶ÔËã·¨¾ÙÐÐ΢µ÷£¬£¬£¬£¬£¬Ò²ÎÞ·¨Ú¹ÊÍЧ¹û±³ºóµÄÔµ¹ÊÔ­ÓÉ¡£¡£¡£

»¹ÖµµÃÒ»ÌáµÄÊÇ£¬£¬£¬£¬£¬ÓÐÑо¿Ê¹ÓÃÉî¶ÈѧϰËã·¨¾ÙÐÐÌØÕ÷ÌáÈ¡£¡£¡£¬£¬£¬£¬£¬È»ºóʹÓ÷ÖÀàËã·¨¾ÙÐзÖÀ࣬£¬£¬£¬£¬ÀýÈçÎÄÏ×[7]ʹÓÃCNNÌìÉúÌØÕ÷£¬£¬£¬£¬£¬ÕâЩÌØÕ÷ËæºóÓɾöÒéÊ÷ºÍËæ»úÉ­ÁÖ·ÖÀàÆ÷¾ÙÐзÖÀà¡£¡£¡£

04 ¼Æ»®

±¾ÎÄÌá³öÁËÒ»ÖÖ¼òÆÓ¸ßЧµÄDGAÓòÃû¼ì²â¼Æ»®¡£¡£¡£¸Ã¼Æ»®½öÌáÈ¡ÓòÃûµÄ×Ö·û´®ÌØÕ÷¾ÙÐÐDGAÓòÃû¼ì²â£¬£¬£¬£¬£¬ÊµÑéÅú×¢¸Ã¼Æ»®¼òÆÓÓÐÓá£¡£¡£¸Ã¼Æ»®µÄÏêϸ¼ì²âÄ£×ÓʾÒâͼÈçͼ2Ëùʾ¡£¡£¡£½ÓÏÂÀ´ÎÒÃǽ«Öصã´ÓÌØÕ÷¹¤³ÌºÍÄ£×ÓÆÀ¹ÀÁ½¸ö½Ç¶È¾ÙÐÐÏÈÈÝ¡£¡£¡£

4.1 ÌØÕ÷¹¤³Ì

±¾¼Æ»®Ê¹ÓÃÌØÕ÷20¶à¸ö£¬£¬£¬£¬£¬·ÖΪÁ½ÀࣺһÀàΪ¾­µäµÄ×Ö·û´®»³±§ÌØÕ÷£¬£¬£¬£¬£¬ÀýÈ糤¶È¡¢ìØ¡¢×Ö·û±ÈÀýµÈ£¬£¬£¬£¬£¬ÕâÀàÌØÕ÷¼òÆÓÓÐÓÃ£»£»£»£»£»Ò»ÀàΪNLP-nGramsÏà¹ØµÄÌØÕ÷¡£¡£¡£ÕâЩÌØÕ÷´ó´ó¶¼·´Ó¦ÁËÓ¦ÓÃʵ¼ùÖжÔÓòÃûµÄÒªÇ󣬣¬£¬£¬£¬ÀýÈçSEO£¨ËÑË÷ÒýÇæÓÅ»¯£©½¨ÒéÁËÓòÃûµÄÀíÏ볤¶È£¨Ô¼Äª12-13¸ö×Ö·û£©£¬£¬£¬£¬£¬ÒÔ¼°¾ßÓÐÒ׶Á¡¢Ò׼ǡ¢Ò×Èö²¥µÈÌصã¡£¡£¡£

±¾¼Æ»®¶Ôÿ¸öÌØÕ÷µÄÖ±·½Í¼ºÍÏà¶ÔÂþÑܾÙÐÐÁËÆÊÎö£¬£¬£¬£¬£¬ÏÂÃæÁÙ²¿·ÖÌØÕ÷ÂþÑÜͼ¾ÙÐоÙÀýÆÊÎö¡£¡£¡£

ÓòÃû³¤¶È:

ÓòÃû³¤¶ÈÊÇÇø·ÖÕý³£ºÍDGAÓòÃûµÄÒ»¸öÖ÷ÒªÌØÕ÷£¬£¬£¬£¬£¬´Óͼ3ÓòÃû³¤¶ÈÂþÑÜͼ¿ÉÒÔ¿´³öDGAÓòÃûµÄ³¤¶È¸ü³¤¡£¡£¡£

ÓòÃûìØ:

ìØ·´Ó¦ÁË×Ö·û´®µÄËæ»úÐÔ£¬£¬£¬£¬£¬DGAÓòÃûÊÇÓÉËã·¨ÌìÉúµÄαËæ»ú×Ö·û´®£¬£¬£¬£¬£¬ÆäËæ»úÐÔ¸úÕý³£ÓòÃûÏà±È¸ü¸ß¡£¡£¡£Í¼4ΪÕý³£ÓòÃûºÍDGAÓòÃûµÄìØÂþÑܱÈÕÕͼ¡£¡£¡£

ÓòÃû×Ö·ûתÒƸÅÂÊ:

×Ö·ûתÒƸÅÂÊ¿ÉÒÔ·´Ó¦ÓòÃûµÄ¿É¶ÁÐÔ£¬£¬£¬£¬£¬Ê¹ÓÃÕý³£ÓòÃû»òÕßÓ¢ÎÄÓïÁÏͳ¼ÆN-GramµÄתÒƸÅÂÊ£¬£¬£¬£¬£¬ÓÉÓÚDGAÓòÃû¸üËæ»ú£¬£¬£¬£¬£¬ÆäN-GramתÒƸÅÂÊÓëÕý³£ÓïÁϲî±ð½Ï´ó¡£¡£¡£

×Ö·û±ÈÀý:

×Ö·û±ÈÀýÒ²ÊÇÇø·ÖÕý³£ÓòÃûºÍDGAÓòÃûµÄ³£ÓÃÌØÕ÷£¬£¬£¬£¬£¬ËùÊö×Ö·û°üÀ¨Êý×Ö¡¢ÔªÒô×Öĸ¡¢×ÓÒô×ÖĸµÈ¡£¡£¡£

nGram:

±¾¼Æ»®ÖÐÅÌËãÁËnGram·ºÆð¸ÅÂÊÅÅÃûµÄƽ¾ùÖµºÍ·½²î£¬£¬£¬£¬£¬»ù׼ΪӢÎÄÓïÁÏ£¬£¬£¬£¬£¬ÓÉÓÚDGAÓòÃûµÄËæ»úÐÔ£¬£¬£¬£¬£¬ÆäÓëÓ¢ÎÄÓïÁϲî±ð½Ï´ó£¬£¬£¬£¬£¬Òò´ËÆänGram·ºÆð¸ÅÂʵÄÅÅÃû¸ü¿¿ºó¡£¡£¡£

4.2 Ä£×ÓÆÀ¹À

±¾¼Æ»®Ê¹ÓõÄѵÁ·Êý¾ÝȪԴÓÚ¹ûÕæÊý¾Ý¼¯£¬£¬£¬£¬£¬Êý¾ÝÁ¿ÔÚ°ÙÍòÒÔÉÏ£¬£¬£¬£¬£¬Ä£×Ó¼ì²âЧ¹ûÈçϱíËùʾ£º

±í2 Ä£×Ó¼ì²âЧ¹û

´ÓÉϱíµÄÊý¾Ý¿ÉÒÔ¿´³ö²î±ðËã·¨µÄ¼ì²âЧ¹û²î±ð²»´ó£¬£¬£¬£¬£¬¼ì²âÂʾùµÖ´ï96%ÒÔÉÏ¡£¡£¡£

05 ºó¼Ç

Ïà½ÏÁ¿ºÚÃûµ¥·½·¨£¬£¬£¬£¬£¬»ùÓÚ»úеѧϰµÄDGAÓòÃû¼ì²âÒªÁì¾ßÓÐÒ»¶¨µÄÓÅÊÆ£¬£¬£¬£¬£¬µ«ÈÔÈ»ÐèҪƾ֤ÏÖÕæÏàÐξÙÐÐÓÅ»¯¡£¡£¡£±¾ÎÄÌá³öµÄDGAÓòÃû¼ì²â¼Æ»®Äܹ»µÖ´ï½ÏºÃµÄ¼ì²âЧ¹û£¬£¬£¬£¬£¬¿ÉÊǼƻ®¶Ô»ùÓÚ´ÇÊéµÄDGAÓòÃû¼ì²âЧ¹ûÉÐÓÐÓÅ»¯¿Õ¼ä£¬£¬£¬£¬£¬Õ⽫×÷ΪºóÐøÑо¿µÄÖصã£»£»£»£»£»ÁíÍ⣬£¬£¬£¬£¬±¾¼Æ»®ÊÇÕë¶ÔDGAÓòÃûºÍÕý³£ÓòÃû¾ÙÐеĶþ·ÖÀàÑо¿£¬£¬£¬£¬£¬ºóÐøÎÒÃǽ«½øÒ»²½¶ÔDGA¼Ò×å¾ÙÐжà·ÖÀàÑо¿£¬£¬£¬£¬£¬¾´Çë¹Ø×¢¡£¡£¡£

²Î¿¼ÎÄÏ×

[1]Patsakis,Constantinos,and FranCasino. "Hydras and IPFS: a decentralised playground for malware."International Journal of Information Security (2019): 1-13.

[2]K¨¹hrer M, Rossow C, Holz T (2014) Paint it black: evaluating the effectiveness of malware blacklists. In: RAID 2014: research in attacks, intrusions and defenses, June, pp 1¨C21. Springer International Publishing.

[3]Ahluwalia A, Traore I, Ganame K, Agarwal N (2017) Detecting broad length algorithmically generated domains. In: Intelligent, secure, and dependable systems in distributed and cloud environments, chap. 2, pp 19¨C34. Springer International Publishing.

[4]Truong D, Cheng G (2016) Detecting domain-flux botnet based on DNS traffic features in managed network. Security Communication Networks 9(14):2338¨C2347.

[5]Luo X, Wang L, Xu Z, Yang J, Sun M, Wang J (2017) DGASensor: fast detection for DGA-based malwares. In: 5th international conference on communications and broadband networking, pp 47¨C53.

[6]Bisio F, Saeli S, Lombardo P, Bernardi D, Perotti A, Massa D (2017) Real-time behavioral DGA detection through machine learning. In: 2017 international carnahan conference on security technology, pp 1¨C6.

[7]Pu Y, Chen X, Pu Y, Shi J (2015) A clustering approach for detecting auto-generated Botnet domains. In: Applications and techniques in information security, pp 269¨C279.

[8]Woodbridge J, Anderson HS, Ahuja A, Grant D (2016) Predicting domain generation algorithms with long short-term memory networks. CoRR abs/1611.0.

[9]Tran D, Mac H, Tong V, Tran HA, Nguyen LG (2018) A LSTM based framework for handling multiclass imbalance in DGA Botnet detection. Neurocomputing 275:2401¨C2413.

[10]Vinayakumar R, Soman K, Poornachandran P, Sachin Kumar S (2018) Evaluating deep learning approaches to characterize and classify the DGAs at scale. J Intell Fuzzy Syst 34(3):1265¨C1276.

°æȨÉùÃ÷

תÔØÇëÎñ±Ø×¢Ã÷À´ÓÉ¡£¡£¡£

°æȨËùÓУ¬£¬£¬£¬£¬Î¥Õ߱ؾ¿¡£¡£¡£