关键词: Domain-Flux, 僵尸网络, TF-IDF, 卷积神经网络, 双向长短期记忆网络

Abstract: Domain-Flux is a technique for keeping a malicious botnet in operation by constantly changing the domain name of the botnet owner's command and control(C&C) server,which can effectively evade the detection of network security devices.Aming at the problem that the information extraction of Domain-Flux domain names is not comprehensive and the key classification features cannot be effectively captured in the existing detection methods,this paper proposes a detection model based on fusion cha-racter and word dual-channel.It extracts local features and global features by using convolutional neural network(CNN) and bidirectional long short-term memory network(BiLSTM) on the two channels respectively,which enriches the feature information of input domain names and improves the classification performance.In the character vector channel,the local spatial features are extracted for random character domain names.In the root vector channel,based on the TF-IDF algorithm,Intra-class factor is introduced to weight the root importance into the word vector,and then the temporal features before and after the combination sequence of domain names are extracted.Experimental results show that the detection accuracy of the model based on fusion character and word dual-channel is improved by 7.12% and 5.86% compared with the model of single TextCNN or BiLSTM.It also has higher precision for dictionary-based Domain-Flux detection.

Key words: Domain-Flux, Botnet, Term frequency-inverse document frequency, Convolutional neural network, Bidirectional long-term and short-term memory network