01 Åä¾°

ÅÌËã»úÍøÂçʵÏÖÁË×ÊÔ´¹²Ïí¡¢¼´Ê±Í¨Ñ¶ºÍÂþÑÜʽÅÌË㣬£¬£¬£¬£¬¸øÈËÃǵÄÊÂÇéºÍÉúÑÄ´øÀ´Á˼«´óµÄ±ãµ±¡£¡£¡£¡£¡£È»¶øÕâЩÍøÂçÒ²»á±»¶ñÒâÈí¼þÀÄÓã¬£¬£¬£¬£¬½©Ê¬ÍøÂ磨botnet£©¾ÍÊǵäµä·¶×Ó¡£¡£¡£¡£¡£½©Ê¬ÍøÂçÓÉ´ó×ÚÊÜ¿ØÖ÷»ú¼´½©Ê¬£¨bot£©ºÍÒ»¸ö»ò¶à¸öÏÂÁîºÍ¿ØÖÆC2£¨Command &Control£©·þÎñÆ÷×é³É£¬£¬£¬£¬£¬botÓëC2·þÎñÆ÷Ï໥ͨѶÒÔ±ãת´ïÏÂÁîºÍÊý¾Ý¡£¡£¡£¡£¡£Îª×èÖ¹C2·þÎñÆ÷±»·¢Ã÷£¬£¬£¬£¬£¬¶ñÒâÈí¼þÏë·¨½ÓÄɹæ±ÜÊÖÒÕÀ´Òþ²ØbotÓëC2·þÎñÆ÷µÄͨѶÐÐΪ£¬£¬£¬£¬£¬ÆäÖУ¬£¬£¬£¬£¬ÓòÃûÌìÉúËã·¨DGA£¨Domain Generation Algorithm£©¾ÍÊÇÒ»ÖÖÊÊÓÃÊÖÒÕ¡£¡£¡£¡£¡£¼òÆÓµØ˵£¬£¬£¬£¬£¬¹¥»÷ÕßʹÓÃDGAËã·¨ºÍÖÖ×Ó£¨Èçʱ¼ä¡¢´ÇÊéµÈ£©ÌìÉú´ó×ÚËã·¨ÌìÉúÓòÃûAGD£¨Algorithmically Generated Domain£©£¬£¬£¬£¬£¬È»ºóÖ»ÐèҪʹÓÃÒ»¸öÓòÃûÀ´¾ÙÐÐC2ͨѶ£¬£¬£¬£¬£¬¶ø·ÀÓùÕßΪÁË·¢Ã÷¸ÃÓòÃû£¬£¬£¬£¬£¬ÐèÒª¶ÔËùÓÐAGDÓòÃû¾ÙÐмì²â¡£¡£¡£¡£¡£»£»£»£»£»ùÓÚÕâÖÖ¹¥·ÀË«·½ËùÐè×ÊÔ´µÄ²î³Ø³ÆÐÔ£¬£¬£¬£¬£¬DGAÊÖÒÕ±»¹¥»÷ÕßÆÕ±éʹÓᣡ£¡£¡£¡£MITRE ATT&CK C2Õ½ÊõT1568.002ÊÖÒռͼÁËÊ®¼¸¸öʹÓÃDGAÊÖÒÕµÄAPT×éÖ¯£¬£¬£¬£¬£¬ºÃ±ÈAPT41¡¢Aria-bodyµÈ¡£¡£¡£¡£¡£´Ó2008ÄêÎÛÃûÕÑÖøµÄKrakenºÍConficker¶ñÒâÈí¼þÒÔÀ´£¬£¬£¬£¬£¬ÎªÁËÈƹýÈëÇÖ¼ì²âϵͳµÄ¼ì²é£¬£¬£¬£¬£¬ÏÕЩËùÓжñÒâÈí¼þ¶¼½ÓÄÉÁËDGAÊÖÒÕ¡£¡£¡£¡£¡£×îеÄÊÖÒÕ±¨¸æÔ¤¼Æ£¬£¬£¬£¬£¬¶ñÒâAGDÓòÃûÊýÄ¿Ô¼Õ¼ÓòÃû×ÜÊýµÄ9.9%£¬£¬£¬£¬£¬ÆäÖÐ1/5ÊôÓÚ»ùÓÚDGAµÄ½©Ê¬ÍøÂ磨ԼռËùÓÐ×¢²áÓòÃûµÄ1.8%£©¡£¡£¡£¡£¡£

Ä¿½ñ£¬£¬£¬£¬£¬DGAÓòÃû¼ì²âÑо¿ÊÇÇ徲ȦÌÖÂÛµÄÈÈÃÅ»°Ìâ¡£¡£¡£¡£¡£¹Å°åµÄDGAÓòÃû¼ì²âÒªÁìÊÇʹÓúÚÃûµ¥Õ½ÂÔʵÏÖ£¬£¬£¬£¬£¬µ«ÓÉÓÚDGAÓòÃûÈÝÒ×ÌìÉúÇÒ¹æÄ£Á¿´ó£¬£¬£¬£¬£¬Õâ¾Íµ¼ÖÂÒ»Ö±ÍøÂçºÍ¸üкÚÃûµ¥±äµÃ²»ÏÖʵ¡£¡£¡£¡£¡£»£»£»£»£»ùÓÚ»úеѧϰµÄDGAÓòÃû¼ì²âÒªÁì¿ÉÒÔ×èÖ¹Õâһȱ·¦£¬£¬£¬£¬£¬ÊµÏÖʵʱ¼ì²â£¬£¬£¬£¬£¬ÒѳÉΪDGAÓòÃû¼ì²âÁìÓòÑо¿Ö÷Á÷Æ«Ïò¡£¡£¡£¡£¡£

±¾ÎĽ«Ïò¶ÁÕßÏÈÈÝDGAÓòÃû»ù´¡ÖªÊ¶¡¢DGAÓòÃû¼ì²âÒªÁìÏÖ×´ÒÔ¼°ÎÒÃÇÌá³öµÄDGAÓòÃû¼ì²â¼Æ»®¡£¡£¡£¡£¡£

02 ¼ò½é

2.1 DGAÓòÃû¹¥»÷Ô­Àí

DGAÊÇÒ»×éËã·¨»úÖÆ£¬£¬£¬£¬£¬±»ÖÖÖÖ¶ñÒâÈí¼þ¼Ò×åÓÃÀ´ÌìÉú´ó×ÚµÄαËæ»úÓòÃû¡£¡£¡£¡£¡£Î±Ëæ»úÒâζ×Å×Ö·û´®ÐòÁÐËƺõÊÇËæ»úµÄ£¬£¬£¬£¬£¬µ«ÓÉÓÚÆä½á¹¹¿ÉÒÔÔ¤ÏÈÈ·¶¨£¬£¬£¬£¬£¬Òò´Ë¿ÉÒÔÖظ´±¬·¢ºÍ¸´ÖÆ¡£¡£¡£¡£¡£

´ó´ó¶¼Ëæ»úÌìÉúµÄÓòÃûÊDz»±£´æµÄ£¬£¬£¬£¬£¬Ö»ÓÐÆäÖÐһС²¿·ÖÓòÃû»á±»×¢²áÒÔ¹©ÊÜ¿ØÖ÷»úÓëC2·þÎñÆ÷¾ÙÐÐͨѶ£¬£¬£¬£¬£¬´Ó¶ø»ñÊØÐÅÏ¢»ò¸ú×ÙÆäËû¶ñÒâʹÃü¡£¡£¡£¡£¡£±ðµÄ£¬£¬£¬£¬£¬µ±Ò»¸öÓòÃû±»ÀÖ³É×èֹʱ£¬£¬£¬£¬£¬¹¥»÷Õß»á´ÓDGAÌìÉúµÄÓòÃûÁбíÖÐ×¢²áÆäËûÓòÃû¡£¡£¡£¡£¡£Ê¹ÓÃDGAÓòÃû¾ÙÐй¥»÷µÄÔ­ÀíÈçͼ1[1]Ëùʾ¡£¡£¡£¡£¡£

¹¥»÷Õßͨ¹ýDGAËã·¨ÌìÉú´ó×Ú±¸Ñ¡ÓòÃû£¬£¬£¬£¬£¬Êܿض˶ñÒâÈí¼þÔËÐÐͳһÌ×DGAËã·¨£¬£¬£¬£¬£¬ÌìÉúÏàͬµÄ±¸Ñ¡ÓòÃûÁÐ±í£¬£¬£¬£¬£¬µ±¾ÙÐй¥»÷µÄʱ¼ä£¬£¬£¬£¬£¬¹¥»÷ÕßÑ¡ÔñÆäÖÐÉÙÁ¿ÓòÃû¾ÙÐÐ×¢²á£¬£¬£¬£¬£¬ÊܿضËͨ¹ýÅÌÎÊ»ñÈ¡ÒÑ×¢²áÓòÃûºó±ã¿ÉÒÔÓëC2·þÎñÆ÷½¨ÉèÅþÁ¬£¬£¬£¬£¬£¬¾ÙÐÐÏÂÁîºÍÊý¾Ý´«Êä¡£¡£¡£¡£¡£

2.2 DGAÓòÃû·ÖÀà

2.2.1 ƾ֤ÖÖ×Ó¾ÙÐзÖÀà

ÖÖ×ÓÊǹ¥»÷ÕߺͿͻ§¶Ë¶ñÒâÈí¼þ¹²ÏíµÄDGAËã·¨µÄÊäÈë²ÎÊýÖ®Ò»£¬£¬£¬£¬£¬²î±ðµÄÖÖ×ӵóöµÄDGAÓòÃûÊÇ·×ÆçÑùµÄ¡£¡£¡£¡£¡£

DGAʹÓõÄÖÖ×ÓÓÐÐí¶àÖÖÀ࣬£¬£¬£¬£¬°üÀ¨ÈÕÆÚ¡¢Éç½»ÍøÂçËÑË÷ÈÈ´Ê¡¢Ëæ»úÊý»ò´ÇÊ飬£¬£¬£¬£¬DGAƾ֤ÖÖ×ÓÌìÉúÒ»´®×Ö·ûǰ׺£¬£¬£¬£¬£¬Ìí¼ÓTLD£¨¶¥¼¶Óò£¬£¬£¬£¬£¬Èçcom¡¢orgµÈ£©ºó»ñµÃ×îÖÕÌìÉúÓòÃû¡£¡£¡£¡£¡£

Ò»Ñùƽ³£À´Ëµ£¬£¬£¬£¬£¬ÖÖ×Ó¿É°´ÈçÏ·½·¨¾ÙÐзÖÀࣺ

»ùÓÚʱ¼äµÄÖÖ×Ó£ºDGAË㷨ʹÓÃʱ¼äÐÅÏ¢×÷ΪÊäÈ루È磺ÊÜ¿ØÖ÷»úµÄϵͳʱ¼ä£¬£¬£¬£¬£¬httpÏìÓ¦µÄʱ¼äµÈ£©£»£»£»£»£»

ÊÇ·ñ¾ßÓÐÈ·¶¨ÐÔ£ºÖ÷Á÷µÄDGAËã·¨µÄÊäÈëÊÇÈ·¶¨µÄ£¬£¬£¬£¬£¬Òò´ËAGD¿ÉÒÔ±»ÌáÇ°ÅÌË㣬£¬£¬£¬£¬¿ÉÊÇÒ²ÓÐһЩDGAËã·¨µÄÊäÈëÊDz»È·¶¨µÄ£¨È磺BedepÒÔÅ·ÖÞÖÐÑëÒøÐÐÌìÌìÐû²¼µÄÍâ»ã²Î¿¼»ãÂÊ×÷ΪÖÖ×Ó£¬£¬£¬£¬£¬TorpigÓÃTwitterµÄÒªº¦´Ê×÷ΪÖÖ×Ó£¬£¬£¬£¬£¬Ö»ÓÐÔÚȷ׼ʱ¼ä´°¿ÚÄÚ×¢²áÓòÃû²Å»ªÉúЧ£©¡£¡£¡£¡£¡£

ƾ֤ÖÖ×ӵķÖÀàÒªÁ죬£¬£¬£¬£¬DGAÓòÃû¿ÉÒÔ·ÖΪÒÔÏÂ4Àࣺ

TID(time-independent and deterministic)£ºÓëʱ¼ä²»Ïà¹Ø£¬£¬£¬£¬£¬¿ÉÈ·¶¨£»£»£»£»£»

TDD(time-dependent and deterministic)£ºÓëʱ¼äÏà¹Ø£¬£¬£¬£¬£¬¿ÉÈ·¶¨£»£»£»£»£»

TDN(time-dependent and non-deterministic)£ºÓëʱ¼äÏà¹Ø£¬£¬£¬£¬£¬²»¿ÉÈ·¶¨£»£»£»£»£»

TIN(time-independent and non-deterministic)£ºÓëʱ¼ä²»Ïà¹Ø£¬£¬£¬£¬£¬²»¿ÉÈ·¶¨£»£»£»£»£»

2.2.2 ƾ֤ÌìÉúËã·¨¾ÙÐзÖÀà

ÏÖÓÐDGAÌìÉúËã·¨Ò»Ñùƽ³£¿ÉÒÔ·ÖΪÈçÏÂ4Àࣺ

»ùÓÚËãÊõ£º¸ÃÀàÐÍËã·¨»áÌìÉúÒ»×é¿ÉÓÃASCII±àÂëÌåÏÖµÄÖµ£¬£¬£¬£¬£¬´Ó¶ø×é³ÉDGAÓòÃû£¬£¬£¬£¬£¬Ê¢ÐжÈ×î¸ß£»£»£»£»£»

»ùÓÚ¹þÏ££ºÓùþÏ£ÖµµÄ16½øÖÆÌåÏÖ±¬·¢µÄDGAÓòÃû£¬£¬£¬£¬£¬³£Ê¹ÓõĹþÏ£Ëã·¨ÓУºMD5£¬£¬£¬£¬£¬SHA256£»£»£»£»£»

»ùÓÚ´ÇÊ飺¸Ã·½·¨»á´ÓרÓдÇÊéÖÐÌôÑ¡µ¥´Ê¾ÙÐÐ×éºÏ£¬£¬£¬£¬£¬ïÔÌ­ÓòÃû×Ö·ûÉϵÄËæ»úÐÔ£¬£¬£¬£¬£¬ÒÉ»óÐÔ¸üÇ¿£¬£¬£¬£¬£¬´ÇÊéÄÚǶÔÚ¶ñÒâ³ÌÐòÖлòÕß´Ó¹«ÓзþÎñÖÐÌáÈ¡£¡£¡£¡£¡£»£»£»£»£»

»ùÓÚÅÅÁÐ×éºÏ£º¶ÔÒ»¸ö³õʼÓòÃû¾ÙÐÐ×Ö·ûÉϵÄÅÅÁÐ×éºÏ¡£¡£¡£¡£¡£

2.3 DGAÓòÃû¾ÙÀý

DGAµÄʹÓúÜÊÇÆձ飬£¬£¬£¬£¬ÏÖÔÚÒÑÖªµÄDGA¼Ò×åÓÐ40¶à¸ö¡£¡£¡£¡£¡£Ï±íö¾ÙÁË4¸öDGA¼Ò×åµÄTLD£¨¶¥¼¶Óò£©¡¢SLD£¨¶þ¼¶Óò£©ºÍÑùÀý£º

±í1 ²î±ðDGA¼Ò×å¾ÙÀý

03 ÏÖ×´

3.1 ¸ÅÊö

´ó´ó¶¼DGAËã·¨¶¼¾ßÓÐʱ¼äÒÀÀµÐÔºÍÈ·¶¨ÐÔ£¬£¬£¬£¬£¬¼´ËüÃǵÄÌìÉú²ÎÊýÊÇ¿É»ñÈ¡ºÍ¿ÉÖØÓõģ¬£¬£¬£¬£¬´Ó¶øÅÌËã³öËùÓпÉÄܵÄЧ¹û¡£¡£¡£¡£¡£»£»£»£»£»ùÓÚ´ËÌص㣬£¬£¬£¬£¬¿ÉÒÔ¶Ôÿ¸ö¶ñÒâÈí¼þ¼°Æä±äÌå¾ÙÐÐÄæÏòÆÊÎö»ñµÃÓòÃûÌìÉúËã·¨ºÍÖÖ×Ó£¬£¬£¬£¬£¬´Ó¶øÌáÈ¡¸ø¶¨ÈÕÆÚºÍʱ¼äµÄÓÐÓÃÓòÃûÜöÝÍ£¬£¬£¬£¬£¬¼ÓÈëºÚÃûµ¥¾ÙÐÐDGAÓòÃû¼ì²â¡£¡£¡£¡£¡£

¿ÉÊÇ£¬£¬£¬£¬£¬µ±Ë¼Á¿µ½ÌìÌì·¢Ã÷µÄ¶ñÒâÈí¼þ¼°±äÖÖµÄÊýĿʱ£¬£¬£¬£¬£¬ÕâÖÖÒªÁìÊDz»¿ÉÐеġ£¡£¡£¡£¡£Ôµ¹ÊÔ­ÓÉÓÐÁ½¸ö·½Ã棬£¬£¬£¬£¬ÆäÒ»ÊǺÚÃûµ¥µÄ¸üÐÂËÙÂÊÔ¶Ô¶¸Ï²»ÉÏDGAÓòÃûµÄÌìÉúËÙÂÊ£»£»£»£»£»Æä¶þÊDZØÐè×è¶ÏËùÓеÄDGAÓòÃû²Å»ª×è¶ÏÊÜ¿ØÖ÷»úÓëC2·þÎñÆ÷ͨѶ¡£¡£¡£¡£¡£¾ÝÎÄÏ×[2]ËùÑÔ£¬£¬£¬£¬£¬¿ªÔ´ºÚÃûµ¥µÄDGAÁýÕÖÂʵͣ¬£¬£¬£¬£¬½ö²»µ½1.2%µÄDGA°üÀ¨ÔÚºÚÃûµ¥ÖС£¡£¡£¡£¡£Òò´Ë£¬£¬£¬£¬£¬´Ö±©ÓÃDGA¹¹½¨ºÚÃûµ¥µÄÒªÁì²¢²»¿É½â¾ö»ù´¡ÎÊÌâ¡£¡£¡£¡£¡£

»ùÓÚ»úеѧϰµÄDGAÓòÃû¼ì²âÒªÁì´ó²¿·ÖÊÇÖ±½Ó´ÓÍêÈ«¼°¸ñÓòÃûFQDN£¨Fully Qualified Domain Name£©ÌáÈ¡ÌØÕ÷£¬£¬£¬£¬£¬½«FQDN×÷Ϊһ¸ö×Ö·û´®£¬£¬£¬£¬£¬ÌáÈ¡³¤¶È¡¢ìØ¡¢NGramµÈÌØÕ÷£¬£¬£¬£¬£¬ÕâÀàÒªÁì²»ÒÀÀµÓÚÉÏÏÂÎÄÐÅÏ¢£¬£¬£¬£¬£¬ÀýÈçʱ¼ä¡¢ÇéÐÎÉèÖõȣ¬£¬£¬£¬£¬Òò´Ë£¬£¬£¬£¬£¬¿ÉÒÔʵÏÖʵʱ¼ì²â¡£¡£¡£¡£¡£

ÏÖÔڹŰå»úеѧϰËã·¨ºÍÉî¶Èѧϰ¶¼±»ÓÃÓÚDGAÓòÃû¼ì²â£¬£¬£¬£¬£¬²¢¶¼È¡µÃÁ˲»´íµÄЧ¹û¡£¡£¡£¡£¡£¹Å°å»úеѧϰËã·¨·ÖΪ¼àÊÓѧϰºÍÎÞ¼àÊÓѧϰÁ½À࣬£¬£¬£¬£¬ÕâÁ½ÀàËã·¨¶¼ÔÚDGAÓòÃû¼ì²âÖÐÓÐÓ¦Óᣡ£¡£¡£¡£

3.2 »ùÓÚ¼àÊÓѧϰµÄ¼ì²â

³£ÓõļàÊÓѧϰËã·¨ÓоöÒéÊ÷ºÍËæ»úÉ­ÁÖ£¬£¬£¬£¬£¬ÀýÈçÎÄÏ×[3]ʹÓþöÒéÊ÷½â¾öÇø·ÖDGAÓòÃûºÍÕý³£ÓòÃûµÄ¶þ·ÖÀàÎÊÌ⣬£¬£¬£¬£¬Ê¹ÓõÄÌØÕ÷ÓÐÓòÃû³¤¶È¡¢×Ö·û±ÈÀý£¨°üÀ¨ÔªÒô×Öĸ¡¢×ÓÒô×Öĸ¡¢Êý×Ö£©ºÍNGramìØ£»£»£»£»£»ÎÄÏ×[4]Ò²ÊÇʹÓþöÒéÊ÷Ëã·¨¾ÙÐжþ·ÖÀ࣬£¬£¬£¬£¬Ê¹ÓõÄÌØÕ÷ΪÓòÃû³¤¶ÈºÍ×Ô½ç˵µÄÓòÃûÆÚÍûÖµ¡£¡£¡£¡£¡£Ëæ»úÉ­ÁÖÓÐÖúÓÚ½â¾ö¾öÒéÊ÷µÄ¹ýÄâºÏÎÊÌ⣬£¬£¬£¬£¬ÎÄÏ×ÖÐÆÕ±éʹÓÃËæ»úÉ­ÁÖÀ´´¦Öóͷ£»ùÓÚDGAµÄ½©Ê¬ÍøÂçÎÊÌ⣬£¬£¬£¬£¬ÀýÈçÎÄÏ×[5]¾ÍÊÇʹÓÃËæ»úÉ­ÁÖËã·¨½â¾ö¶þ·ÖÀàÎÊÌ⣬£¬£¬£¬£¬Ê¹ÓõÄÌØÕ÷ÓÐËÄÀࣺÂþÑÜÌØÕ÷¡¢½á¹¹ÌØÕ÷¡¢·¢ÒôÌØÕ÷¡¢Í¨ÓÃÌØÕ÷¡£¡£¡£¡£¡£

3.3 »ùÓÚÎÞ¼àÊÓѧϰµÄ¼ì²â

»ùÓÚ¾öÒéÊ÷ºÍËæ»úÉ­ÁÖµÄÄ£×ÓÊôÓÚ¼àÊÓѧϰ£¬£¬£¬£¬£¬¶¼ÐèÒªÌØÕ÷²Å»ªÊÂÇé¡£¡£¡£¡£¡£ÎÞ¼àÊÓѧϰÓëÓмàÊÓѧϰÏà±ÈÓÐÒ»¸öÖ÷ÒªµÄÓÅÊÆÊDz»ÐèÒª´ø±ê¼ÇµÄÊý¾Ý¼¯¡£¡£¡£¡£¡£ÖÚËùÖÜÖªµÄK-MeansËã·¨ÊÇÒ»¸ö¼òÆÓ³£ÓõÄÎÞ¼àÊÓѧϰËã·¨£¬£¬£¬£¬£¬±»ÆÕ±éÓ¦ÓÃÔÚDGAÓòÃû¼ì²âÖУ¬£¬£¬£¬£¬ÀýÈçÎÄÏ×[6]ʹÓÃKMeans¾ÙÐÐDGA¼Ò×åµÄ¶à·ÖÀ࣬£¬£¬£¬£¬Ê¹ÓÃÁËÓòÃûµÄ³¤¶È¡¢ìغÍNGramÏà¹ØÌØÕ÷£»£»£»£»£»ÎÄÏ×[7]ʹÓÃKMeans¾ÙÐÐÇø·ÖÕý³£ºÍDGAÓòÃû£¬£¬£¬£¬£¬Ê¹ÓÃÁ˿ɶÁÐÔ£¨NGram£©¡¢ÐÅÏ¢ìØ¡¢½á¹¹£¨³¤¶È¡¢×Ö·û±ÈÀýµÈ£©ÈýÀàÌØÕ÷¡£¡£¡£¡£¡£ÔÚÒÑÍùÊ®ÄêÖУ¬£¬£¬£¬£¬Ö»ÓÐÉÙÊýÎÞ¼àÊÓËã·¨ÓÃÀ´½â¾öDGAÓòÃû¼ì²âÎÊÌâ¡£¡£¡£¡£¡£³ýÁËKMeansÉÐÓÐÁ½ÖÖ¾ÛÀàÒªÁ죺»ìÏýÄ£×Ó£¨MM£©ºÍHC£¬£¬£¬£¬£¬µ«ËüÃǵÄʹÓúÜÊÇÓÐÏÞ£¬£¬£¬£¬£¬Ð§¹û²»²ÇÏë¡£¡£¡£¡£¡£

3.4 »ùÓÚÉî¶ÈѧϰµÄ¼ì²â

Éî¶ÈѧϰҲÔÚDGAÓòÃû¼ì²âÖÐÓÐÆÕ±éµÄÓ¦Óã¬£¬£¬£¬£¬Ñ­»·Éñ¾­ÍøÂ磨RNNs£©¡¢ÊÇ·ÇÆÚÓ°ÏóÍøÂ磨LSTM£©ºÍ¾í»ýÉñ¾­ÍøÂ磨CNN£©¶¼±»Ó¦Óõ½ÁËDGAÓòÃû¼ì²âÖС£¡£¡£¡£¡£ÀýÈ磺ÎÄÏ×[8]ʹÓÃLSTM½â¾öDGAÓòÃûºÍÕý³£ÓòÃû¶þ·ÖÀà¡¢DGA¼Ò×å¶à·ÖÀàÎÊÌ⣻£»£»£»£»ÎÄÏ×[9]Ñо¿²¢¿ª·¢Á˾­µäLSTMµÄ±äÌ壬£¬£¬£¬£¬Ò²ÓÃÀ´¾ÙÐжþ·ÖÀàºÍ¶à·ÖÀࣻ£»£»£»£»ÎÄÏ×[10]½ÏÁ¿ÁËRNN¡¢LSTM¡¢CNNºÍCNN-LSTM×éºÏ¾ÙÐÐDGA¶þ·ÖÀàºÍ¶à·ÖÀàµÄЧ¹û¡£¡£¡£¡£¡£Éî¶ÈѧϰÔÚ¶þ·ÖÀàÖÐÌåÏÖ¾«²Ê£¬£¬£¬£¬£¬µ«ÔÚ¶à·ÖÀàÖдËÀàÒªÁìÔÚ׼ȷ¶ÈºÍÕÙ»ØÂÊ·½Ã涼ȡµÃÁËÁîÈËÏÓÒɵÄЧ¹û¡£¡£¡£¡£¡£×îºóÐèҪ˵Ã÷µÄÊÇÉî¶ÈѧϰËäÈ»¿ÉÒÔÌṩºÜºÃµÄ·ÖÀàЧ¹û£¬£¬£¬£¬£¬µ«ËüÃÇÍùÍùÊÇÌ«¹ýÄâºÏµÄ£¬£¬£¬£¬£¬ÓÈÆäÊDz»Í¸Ã÷µÄ£¬£¬£¬£¬£¬È±·¦Í¸Ã÷¶È×îÖÕµ¼ÖÂÎÞ·¨¶ÔËã·¨¾ÙÐÐ΢µ÷£¬£¬£¬£¬£¬Ò²ÎÞ·¨Ú¹ÊÍЧ¹û±³ºóµÄÔµ¹ÊÔ­ÓÉ¡£¡£¡£¡£¡£

»¹ÖµµÃÒ»ÌáµÄÊÇ£¬£¬£¬£¬£¬ÓÐÑо¿Ê¹ÓÃÉî¶ÈѧϰËã·¨¾ÙÐÐÌØÕ÷ÌáÈ¡£¡£¡£¡£¡£¬£¬£¬£¬£¬È»ºóʹÓ÷ÖÀàËã·¨¾ÙÐзÖÀ࣬£¬£¬£¬£¬ÀýÈçÎÄÏ×[7]ʹÓÃCNNÌìÉúÌØÕ÷£¬£¬£¬£¬£¬ÕâЩÌØÕ÷ËæºóÓɾöÒéÊ÷ºÍËæ»úÉ­ÁÖ·ÖÀàÆ÷¾ÙÐзÖÀà¡£¡£¡£¡£¡£

04 ¼Æ»®

±¾ÎÄÌá³öÁËÒ»ÖÖ¼òÆÓ¸ßЧµÄDGAÓòÃû¼ì²â¼Æ»®¡£¡£¡£¡£¡£¸Ã¼Æ»®½öÌáÈ¡ÓòÃûµÄ×Ö·û´®ÌØÕ÷¾ÙÐÐDGAÓòÃû¼ì²â£¬£¬£¬£¬£¬ÊµÑéÅú×¢¸Ã¼Æ»®¼òÆÓÓÐÓᣡ£¡£¡£¡£¸Ã¼Æ»®µÄÏêϸ¼ì²âÄ£×ÓʾÒâͼÈçͼ2Ëùʾ¡£¡£¡£¡£¡£½ÓÏÂÀ´ÎÒÃǽ«Öصã´ÓÌØÕ÷¹¤³ÌºÍÄ£×ÓÆÀ¹ÀÁ½¸ö½Ç¶È¾ÙÐÐÏÈÈÝ¡£¡£¡£¡£¡£

4.1 ÌØÕ÷¹¤³Ì

±¾¼Æ»®Ê¹ÓÃÌØÕ÷20¶à¸ö£¬£¬£¬£¬£¬·ÖΪÁ½ÀࣺһÀàΪ¾­µäµÄ×Ö·û´®»³±§ÌØÕ÷£¬£¬£¬£¬£¬ÀýÈ糤¶È¡¢ìØ¡¢×Ö·û±ÈÀýµÈ£¬£¬£¬£¬£¬ÕâÀàÌØÕ÷¼òÆÓÓÐÓ㻣»£»£»£»Ò»ÀàΪNLP-nGramsÏà¹ØµÄÌØÕ÷¡£¡£¡£¡£¡£ÕâЩÌØÕ÷´ó´ó¶¼·´Ó¦ÁËÓ¦ÓÃʵ¼ùÖжÔÓòÃûµÄÒªÇó£¬£¬£¬£¬£¬ÀýÈçSEO£¨ËÑË÷ÒýÇæÓÅ»¯£©½¨ÒéÁËÓòÃûµÄÀíÏ볤¶È£¨Ô¼Äª12-13¸ö×Ö·û£©£¬£¬£¬£¬£¬ÒÔ¼°¾ßÓÐÒ׶Á¡¢Ò׼ǡ¢Ò×Èö²¥µÈÌص㡣¡£¡£¡£¡£

±¾¼Æ»®¶Ôÿ¸öÌØÕ÷µÄÖ±·½Í¼ºÍÏà¶ÔÂþÑܾÙÐÐÁËÆÊÎö£¬£¬£¬£¬£¬ÏÂÃæÁÙ²¿·ÖÌØÕ÷ÂþÑÜͼ¾ÙÐоÙÀýÆÊÎö¡£¡£¡£¡£¡£

ÓòÃû³¤¶È:

ÓòÃû³¤¶ÈÊÇÇø·ÖÕý³£ºÍDGAÓòÃûµÄÒ»¸öÖ÷ÒªÌØÕ÷£¬£¬£¬£¬£¬´Óͼ3ÓòÃû³¤¶ÈÂþÑÜͼ¿ÉÒÔ¿´³öDGAÓòÃûµÄ³¤¶È¸ü³¤¡£¡£¡£¡£¡£

ÓòÃûìØ:

ìØ·´Ó¦ÁË×Ö·û´®µÄËæ»úÐÔ£¬£¬£¬£¬£¬DGAÓòÃûÊÇÓÉËã·¨ÌìÉúµÄαËæ»ú×Ö·û´®£¬£¬£¬£¬£¬ÆäËæ»úÐÔ¸úÕý³£ÓòÃûÏà±È¸ü¸ß¡£¡£¡£¡£¡£Í¼4ΪÕý³£ÓòÃûºÍDGAÓòÃûµÄìØÂþÑܱÈÕÕͼ¡£¡£¡£¡£¡£

ÓòÃû×Ö·ûתÒƸÅÂÊ:

×Ö·ûתÒƸÅÂÊ¿ÉÒÔ·´Ó¦ÓòÃûµÄ¿É¶ÁÐÔ£¬£¬£¬£¬£¬Ê¹ÓÃÕý³£ÓòÃû»òÕßÓ¢ÎÄÓïÁÏͳ¼ÆN-GramµÄתÒƸÅÂÊ£¬£¬£¬£¬£¬ÓÉÓÚDGAÓòÃû¸üËæ»ú£¬£¬£¬£¬£¬ÆäN-GramתÒƸÅÂÊÓëÕý³£ÓïÁϲî±ð½Ï´ó¡£¡£¡£¡£¡£

×Ö·û±ÈÀý:

×Ö·û±ÈÀýÒ²ÊÇÇø·ÖÕý³£ÓòÃûºÍDGAÓòÃûµÄ³£ÓÃÌØÕ÷£¬£¬£¬£¬£¬ËùÊö×Ö·û°üÀ¨Êý×Ö¡¢ÔªÒô×Öĸ¡¢×ÓÒô×ÖĸµÈ¡£¡£¡£¡£¡£

nGram:

±¾¼Æ»®ÖÐÅÌËãÁËnGram·ºÆð¸ÅÂÊÅÅÃûµÄƽ¾ùÖµºÍ·½²î£¬£¬£¬£¬£¬»ù׼ΪӢÎÄÓïÁÏ£¬£¬£¬£¬£¬ÓÉÓÚDGAÓòÃûµÄËæ»úÐÔ£¬£¬£¬£¬£¬ÆäÓëÓ¢ÎÄÓïÁϲî±ð½Ï´ó£¬£¬£¬£¬£¬Òò´ËÆänGram·ºÆð¸ÅÂʵÄÅÅÃû¸ü¿¿ºó¡£¡£¡£¡£¡£

4.2 Ä£×ÓÆÀ¹À

±¾¼Æ»®Ê¹ÓõÄѵÁ·Êý¾ÝȪԴÓÚ¹ûÕæÊý¾Ý¼¯£¬£¬£¬£¬£¬Êý¾ÝÁ¿ÔÚ°ÙÍòÒÔÉÏ£¬£¬£¬£¬£¬Ä£×Ó¼ì²âЧ¹ûÈçϱíËùʾ£º

±í2 Ä£×Ó¼ì²âЧ¹û

´ÓÉϱíµÄÊý¾Ý¿ÉÒÔ¿´³ö²î±ðËã·¨µÄ¼ì²âЧ¹û²î±ð²»´ó£¬£¬£¬£¬£¬¼ì²âÂʾùµÖ´ï96%ÒÔÉÏ¡£¡£¡£¡£¡£

05 ºó¼Ç

Ïà½ÏÁ¿ºÚÃûµ¥·½·¨£¬£¬£¬£¬£¬»ùÓÚ»úеѧϰµÄDGAÓòÃû¼ì²âÒªÁì¾ßÓÐÒ»¶¨µÄÓÅÊÆ£¬£¬£¬£¬£¬µ«ÈÔÈ»ÐèҪƾ֤ÏÖÕæÏàÐξÙÐÐÓÅ»¯¡£¡£¡£¡£¡£±¾ÎÄÌá³öµÄDGAÓòÃû¼ì²â¼Æ»®Äܹ»µÖ´ï½ÏºÃµÄ¼ì²âЧ¹û£¬£¬£¬£¬£¬¿ÉÊǼƻ®¶Ô»ùÓÚ´ÇÊéµÄDGAÓòÃû¼ì²âЧ¹ûÉÐÓÐÓÅ»¯¿Õ¼ä£¬£¬£¬£¬£¬Õ⽫×÷ΪºóÐøÑо¿µÄÖص㣻£»£»£»£»ÁíÍ⣬£¬£¬£¬£¬±¾¼Æ»®ÊÇÕë¶ÔDGAÓòÃûºÍÕý³£ÓòÃû¾ÙÐеĶþ·ÖÀàÑо¿£¬£¬£¬£¬£¬ºóÐøÎÒÃǽ«½øÒ»²½¶ÔDGA¼Ò×å¾ÙÐжà·ÖÀàÑо¿£¬£¬£¬£¬£¬¾´Çë¹Ø×¢¡£¡£¡£¡£¡£

²Î¿¼ÎÄÏ×

[1]Patsakis,Constantinos,and FranCasino. "Hydras and IPFS: a decentralised playground for malware."International Journal of Information Security (2019): 1-13.

[2]K¨¹hrer M, Rossow C, Holz T (2014) Paint it black: evaluating the effectiveness of malware blacklists. In: RAID 2014: research in attacks, intrusions and defenses, June, pp 1¨C21. Springer International Publishing.

[3]Ahluwalia A, Traore I, Ganame K, Agarwal N (2017) Detecting broad length algorithmically generated domains. In: Intelligent, secure, and dependable systems in distributed and cloud environments, chap. 2, pp 19¨C34. Springer International Publishing.

[4]Truong D, Cheng G (2016) Detecting domain-flux botnet based on DNS traffic features in managed network. Security Communication Networks 9(14):2338¨C2347.

[5]Luo X, Wang L, Xu Z, Yang J, Sun M, Wang J (2017) DGASensor: fast detection for DGA-based malwares. In: 5th international conference on communications and broadband networking, pp 47¨C53.

[6]Bisio F, Saeli S, Lombardo P, Bernardi D, Perotti A, Massa D (2017) Real-time behavioral DGA detection through machine learning. In: 2017 international carnahan conference on security technology, pp 1¨C6.

[7]Pu Y, Chen X, Pu Y, Shi J (2015) A clustering approach for detecting auto-generated Botnet domains. In: Applications and techniques in information security, pp 269¨C279.

[8]Woodbridge J, Anderson HS, Ahuja A, Grant D (2016) Predicting domain generation algorithms with long short-term memory networks. CoRR abs/1611.0.

[9]Tran D, Mac H, Tong V, Tran HA, Nguyen LG (2018) A LSTM based framework for handling multiclass imbalance in DGA Botnet detection. Neurocomputing 275:2401¨C2413.

[10]Vinayakumar R, Soman K, Poornachandran P, Sachin Kumar S (2018) Evaluating deep learning approaches to characterize and classify the DGAs at scale. J Intell Fuzzy Syst 34(3):1265¨C1276.

°æȨÉùÃ÷

תÔØÇëÎñ±Ø×¢Ã÷À´ÓÉ¡£¡£¡£¡£¡£

°æȨËùÓУ¬£¬£¬£¬£¬Î¥Õ߱ؾ¿¡£¡£¡£¡£¡£