01 Åä¾°

ÅÌËã»úÍøÂçʵÏÖÁË×ÊÔ´¹²Ïí¡¢¼´Ê±Í¨Ñ¶ºÍÂþÑÜʽÅÌËã£¬¸øÈËÃǵÄÊÂÇéºÍÉúÑÄ´øÀ´Á˼«´óµÄ±ãµ±¡£È»¶øÕâЩÍøÂçÒ²»á±»¶ñÒâÈí¼þÀÄÓÃ£¬½©Ê¬ÍøÂ磨botnet£©¾ÍÊǵäµä·¶×Ó¡£½©Ê¬ÍøÂçÓÉ´ó×ÚÊÜ¿ØÖ÷»ú¼´½©Ê¬£¨bot£©ºÍÒ»¸ö»ò¶à¸öÏÂÁîºÍ¿ØÖÆC2£¨Command &Control£©·þÎñÆ÷×é³É£¬botÓëC2·þÎñÆ÷Ï໥ͨѶÒÔ±ãת´ïÏÂÁîºÍÊý¾Ý¡£Îª×èÖ¹C2·þÎñÆ÷±»·¢Ã÷£¬¶ñÒâÈí¼þÏë·¨½ÓÄɹæ±ÜÊÖÒÕÀ´Òþ²ØbotÓëC2·þÎñÆ÷µÄͨѶÐÐΪ£¬ÆäÖÐ£¬ÓòÃûÌìÉúËã·¨DGA£¨Domain Generation Algorithm£©¾ÍÊÇÒ»ÖÖÊÊÓÃÊÖÒÕ¡£¼òÆÓµØ˵£¬¹¥»÷ÕßʹÓÃDGAËã·¨ºÍÖÖ×Ó£¨Èçʱ¼ä¡¢´ÇÊéµÈ£©ÌìÉú´ó×ÚËã·¨ÌìÉúÓòÃûAGD£¨Algorithmically Generated Domain£©£¬È»ºóÖ»ÐèҪʹÓÃÒ»¸öÓòÃûÀ´¾ÙÐÐC2ͨѶ£¬¶ø·ÀÓùÕßΪÁË·¢Ã÷¸ÃÓòÃû£¬ÐèÒª¶ÔËùÓÐAGDÓòÃû¾ÙÐмì²â¡£»ùÓÚÕâÖÖ¹¥·ÀË«·½ËùÐè×ÊÔ´µÄ²î³Ø³ÆÐÔ£¬DGAÊÖÒÕ±»¹¥»÷ÕßÆÕ±éʹÓá£MITRE ATT&CK C2Õ½ÊõT1568.002ÊÖÒռͼÁËÊ®¼¸¸öʹÓÃDGAÊÖÒÕµÄAPT×éÖ¯£¬ºÃ±ÈAPT41¡¢Aria-bodyµÈ¡£´Ó2008ÄêÎÛÃûÕÑÖøµÄKrakenºÍConficker¶ñÒâÈí¼þÒÔÀ´£¬ÎªÁËÈƹýÈëÇÖ¼ì²âϵͳµÄ¼ì²é£¬ÏÕЩËùÓжñÒâÈí¼þ¶¼½ÓÄÉÁËDGAÊÖÒÕ¡£×îеÄÊÖÒÕ±¨¸æÔ¤¼Æ£¬¶ñÒâAGDÓòÃûÊýÄ¿Ô¼Õ¼ÓòÃû×ÜÊýµÄ9.9%£¬ÆäÖÐ1/5ÊôÓÚ»ùÓÚDGAµÄ½©Ê¬ÍøÂ磨ԼռËùÓÐ×¢²áÓòÃûµÄ1.8%£©¡£

Ä¿½ñ£¬DGAÓòÃû¼ì²âÑо¿ÊÇÇ徲ȦÌÖÂÛµÄÈÈÃÅ»°Ìâ¡£¹Å°åµÄDGAÓòÃû¼ì²âÒªÁìÊÇʹÓúÚÃûµ¥Õ½ÂÔʵÏÖ£¬µ«ÓÉÓÚDGAÓòÃûÈÝÒ×ÌìÉúÇÒ¹æÄ£Á¿´ó£¬Õâ¾Íµ¼ÖÂÒ»Ö±ÍøÂçºÍ¸üкÚÃûµ¥±äµÃ²»ÏÖʵ¡£»ùÓÚ»úеѧϰµÄDGAÓòÃû¼ì²âÒªÁì¿ÉÒÔ×èÖ¹Õâһȱ·¦£¬ÊµÏÖʵʱ¼ì²â£¬ÒѳÉΪDGAÓòÃû¼ì²âÁìÓòÑо¿Ö÷Á÷Æ«Ïò¡£

±¾ÎĽ«Ïò¶ÁÕßÏÈÈÝDGAÓòÃû»ù´¡ÖªÊ¶¡¢DGAÓòÃû¼ì²âÒªÁìÏÖ×´ÒÔ¼°ÎÒÃÇÌá³öµÄDGAÓòÃû¼ì²â¼Æ»®¡£

02 ¼ò½é

2.1 DGAÓòÃû¹¥»÷Ô­Àí

DGAÊÇÒ»×éËã·¨»úÖÆ£¬±»ÖÖÖÖ¶ñÒâÈí¼þ¼Ò×åÓÃÀ´ÌìÉú´ó×ÚµÄαËæ»úÓòÃû¡£Î±Ëæ»úÒâζ×Å×Ö·û´®ÐòÁÐËƺõÊÇËæ»úµÄ£¬µ«ÓÉÓÚÆä½á¹¹¿ÉÒÔÔ¤ÏÈÈ·¶¨£¬Òò´Ë¿ÉÒÔÖظ´±¬·¢ºÍ¸´ÖÆ¡£

´ó´ó¶¼Ëæ»úÌìÉúµÄÓòÃûÊDz»±£´æµÄ£¬Ö»ÓÐÆäÖÐһС²¿·ÖÓòÃû»á±»×¢²áÒÔ¹©ÊÜ¿ØÖ÷»úÓëC2·þÎñÆ÷¾ÙÐÐͨѶ£¬´Ó¶ø»ñÊØÐÅÏ¢»ò¸ú×ÙÆäËû¶ñÒâʹÃü¡£±ðµÄ£¬µ±Ò»¸öÓòÃû±»ÀÖ³É×èֹʱ£¬¹¥»÷Õß»á´ÓDGAÌìÉúµÄÓòÃûÁбíÖÐ×¢²áÆäËûÓòÃû¡£Ê¹ÓÃDGAÓòÃû¾ÙÐй¥»÷µÄÔ­ÀíÈçͼ1[1]Ëùʾ¡£

¹¥»÷Õßͨ¹ýDGAËã·¨ÌìÉú´ó×Ú±¸Ñ¡ÓòÃû£¬Êܿض˶ñÒâÈí¼þÔËÐÐͳһÌ×DGAËã·¨£¬ÌìÉúÏàͬµÄ±¸Ñ¡ÓòÃûÁбí£¬µ±¾ÙÐй¥»÷µÄʱ¼ä£¬¹¥»÷ÕßÑ¡ÔñÆäÖÐÉÙÁ¿ÓòÃû¾ÙÐÐ×¢²á£¬ÊܿضËͨ¹ýÅÌÎÊ»ñÈ¡ÒÑ×¢²áÓòÃûºó±ã¿ÉÒÔÓëC2·þÎñÆ÷½¨ÉèÅþÁ¬£¬¾ÙÐÐÏÂÁîºÍÊý¾Ý´«Êä¡£

2.2 DGAÓòÃû·ÖÀà

2.2.1 ƾ֤ÖÖ×Ó¾ÙÐзÖÀà

ÖÖ×ÓÊǹ¥»÷ÕߺͿͻ§¶Ë¶ñÒâÈí¼þ¹²ÏíµÄDGAËã·¨µÄÊäÈë²ÎÊýÖ®Ò»£¬²î±ðµÄÖÖ×ӵóöµÄDGAÓòÃûÊÇ·×ÆçÑùµÄ¡£

DGAʹÓõÄÖÖ×ÓÓÐÐí¶àÖÖÀà£¬°üÀ¨ÈÕÆÚ¡¢Éç½»ÍøÂçËÑË÷ÈÈ´Ê¡¢Ëæ»úÊý»ò´ÇÊé£¬DGAƾ֤ÖÖ×ÓÌìÉúÒ»´®×Ö·ûǰ׺£¬Ìí¼ÓTLD£¨¶¥¼¶Óò£¬Èçcom¡¢orgµÈ£©ºó»ñµÃ×îÖÕÌìÉúÓòÃû¡£

Ò»Ñùƽ³£À´Ëµ£¬ÖÖ×Ó¿É°´ÈçÏ·½·¨¾ÙÐзÖÀࣺ

»ùÓÚʱ¼äµÄÖÖ×Ó£ºDGAË㷨ʹÓÃʱ¼äÐÅÏ¢×÷ΪÊäÈ루È磺ÊÜ¿ØÖ÷»úµÄϵͳʱ¼ä£¬httpÏìÓ¦µÄʱ¼äµÈ£©£»

ÊÇ·ñ¾ßÓÐÈ·¶¨ÐÔ£ºÖ÷Á÷µÄDGAËã·¨µÄÊäÈëÊÇÈ·¶¨µÄ£¬Òò´ËAGD¿ÉÒÔ±»ÌáÇ°ÅÌËã£¬¿ÉÊÇÒ²ÓÐһЩDGAËã·¨µÄÊäÈëÊDz»È·¶¨µÄ£¨È磺BedepÒÔÅ·ÖÞÖÐÑëÒøÐÐÌìÌìÐû²¼µÄÍâ»ã²Î¿¼»ãÂÊ×÷ΪÖÖ×Ó£¬TorpigÓÃTwitterµÄÒªº¦´Ê×÷ΪÖÖ×Ó£¬Ö»ÓÐÔÚȷ׼ʱ¼ä´°¿ÚÄÚ×¢²áÓòÃû²Å»ªÉúЧ£©¡£

ƾ֤ÖÖ×ӵķÖÀàÒªÁì£¬DGAÓòÃû¿ÉÒÔ·ÖΪÒÔÏÂ4Àࣺ

TID(time-independent and deterministic)£ºÓëʱ¼ä²»Ïà¹Ø£¬¿ÉÈ·¶¨£»

TDD(time-dependent and deterministic)£ºÓëʱ¼äÏà¹Ø£¬¿ÉÈ·¶¨£»

TDN(time-dependent and non-deterministic)£ºÓëʱ¼äÏà¹Ø£¬²»¿ÉÈ·¶¨£»

TIN(time-independent and non-deterministic)£ºÓëʱ¼ä²»Ïà¹Ø£¬²»¿ÉÈ·¶¨£»

2.2.2 ƾ֤ÌìÉúËã·¨¾ÙÐзÖÀà

ÏÖÓÐDGAÌìÉúËã·¨Ò»Ñùƽ³£¿ÉÒÔ·ÖΪÈçÏÂ4Àࣺ

»ùÓÚËãÊõ£º¸ÃÀàÐÍËã·¨»áÌìÉúÒ»×é¿ÉÓÃASCII±àÂëÌåÏÖµÄÖµ£¬´Ó¶ø×é³ÉDGAÓòÃû£¬Ê¢ÐжÈ×î¸ß£»

»ùÓÚ¹þÏ££ºÓùþÏ£ÖµµÄ16½øÖÆÌåÏÖ±¬·¢µÄDGAÓòÃû£¬³£Ê¹ÓõĹþÏ£Ëã·¨ÓУºMD5£¬SHA256£»

»ùÓÚ´ÇÊ飺¸Ã·½·¨»á´ÓרÓдÇÊéÖÐÌôÑ¡µ¥´Ê¾ÙÐÐ×éºÏ£¬ïÔÌ­ÓòÃû×Ö·ûÉϵÄËæ»úÐÔ£¬ÒÉ»óÐÔ¸üÇ¿£¬´ÇÊéÄÚǶÔÚ¶ñÒâ³ÌÐòÖлòÕß´Ó¹«ÓзþÎñÖÐÌáÈ¡£»

»ùÓÚÅÅÁÐ×éºÏ£º¶ÔÒ»¸ö³õʼÓòÃû¾ÙÐÐ×Ö·ûÉϵÄÅÅÁÐ×éºÏ¡£

2.3 DGAÓòÃû¾ÙÀý

DGAµÄʹÓúÜÊÇÆÕ±é£¬ÏÖÔÚÒÑÖªµÄDGA¼Ò×åÓÐ40¶à¸ö¡£Ï±íö¾ÙÁË4¸öDGA¼Ò×åµÄTLD£¨¶¥¼¶Óò£©¡¢SLD£¨¶þ¼¶Óò£©ºÍÑùÀý£º

±í1 ²î±ðDGA¼Ò×å¾ÙÀý

03 ÏÖ×´

3.1 ¸ÅÊö

´ó´ó¶¼DGAËã·¨¶¼¾ßÓÐʱ¼äÒÀÀµÐÔºÍÈ·¶¨ÐÔ£¬¼´ËüÃǵÄÌìÉú²ÎÊýÊÇ¿É»ñÈ¡ºÍ¿ÉÖØÓõÄ£¬´Ó¶øÅÌËã³öËùÓпÉÄܵÄЧ¹û¡£»ùÓÚ´ËÌصã£¬¿ÉÒÔ¶Ôÿ¸ö¶ñÒâÈí¼þ¼°Æä±äÌå¾ÙÐÐÄæÏòÆÊÎö»ñµÃÓòÃûÌìÉúËã·¨ºÍÖÖ×Ó£¬´Ó¶øÌáÈ¡¸ø¶¨ÈÕÆÚºÍʱ¼äµÄÓÐÓÃÓòÃûÜöÝÍ£¬¼ÓÈëºÚÃûµ¥¾ÙÐÐDGAÓòÃû¼ì²â¡£

¿ÉÊÇ£¬µ±Ë¼Á¿µ½ÌìÌì·¢Ã÷µÄ¶ñÒâÈí¼þ¼°±äÖÖµÄÊýĿʱ£¬ÕâÖÖÒªÁìÊDz»¿ÉÐеÄ¡£Ôµ¹ÊÔ­ÓÉÓÐÁ½¸ö·½Ãæ£¬ÆäÒ»ÊǺÚÃûµ¥µÄ¸üÐÂËÙÂÊÔ¶Ô¶¸Ï²»ÉÏDGAÓòÃûµÄÌìÉúËÙÂÊ£»Æä¶þÊDZØÐè×è¶ÏËùÓеÄDGAÓòÃû²Å»ª×è¶ÏÊÜ¿ØÖ÷»úÓëC2·þÎñÆ÷ͨѶ¡£¾ÝÎÄÏ×[2]ËùÑÔ£¬¿ªÔ´ºÚÃûµ¥µÄDGAÁýÕÖÂʵÍ£¬½ö²»µ½1.2%µÄDGA°üÀ¨ÔÚºÚÃûµ¥ÖС£Òò´Ë£¬´Ö±©ÓÃDGA¹¹½¨ºÚÃûµ¥µÄÒªÁì²¢²»¿É½â¾ö»ù´¡ÎÊÌâ¡£

»ùÓÚ»úеѧϰµÄDGAÓòÃû¼ì²âÒªÁì´ó²¿·ÖÊÇÖ±½Ó´ÓÍêÈ«¼°¸ñÓòÃûFQDN£¨Fully Qualified Domain Name£©ÌáÈ¡ÌØÕ÷£¬½«FQDN×÷Ϊһ¸ö×Ö·û´®£¬ÌáÈ¡³¤¶È¡¢ìØ¡¢NGramµÈÌØÕ÷£¬ÕâÀàÒªÁì²»ÒÀÀµÓÚÉÏÏÂÎÄÐÅÏ¢£¬ÀýÈçʱ¼ä¡¢ÇéÐÎÉèÖõÈ£¬Òò´Ë£¬¿ÉÒÔʵÏÖʵʱ¼ì²â¡£

ÏÖÔڹŰå»úеѧϰËã·¨ºÍÉî¶Èѧϰ¶¼±»ÓÃÓÚDGAÓòÃû¼ì²â£¬²¢¶¼È¡µÃÁ˲»´íµÄЧ¹û¡£¹Å°å»úеѧϰËã·¨·ÖΪ¼àÊÓѧϰºÍÎÞ¼àÊÓѧϰÁ½Àà£¬ÕâÁ½ÀàËã·¨¶¼ÔÚDGAÓòÃû¼ì²âÖÐÓÐÓ¦Óá£

3.2 »ùÓÚ¼àÊÓѧϰµÄ¼ì²â

³£ÓõļàÊÓѧϰËã·¨ÓоöÒéÊ÷ºÍËæ»úÉ­ÁÖ£¬ÀýÈçÎÄÏ×[3]ʹÓþöÒéÊ÷½â¾öÇø·ÖDGAÓòÃûºÍÕý³£ÓòÃûµÄ¶þ·ÖÀàÎÊÌâ£¬Ê¹ÓõÄÌØÕ÷ÓÐÓòÃû³¤¶È¡¢×Ö·û±ÈÀý£¨°üÀ¨ÔªÒô×Öĸ¡¢×ÓÒô×Öĸ¡¢Êý×Ö£©ºÍNGramìØ£»ÎÄÏ×[4]Ò²ÊÇʹÓþöÒéÊ÷Ëã·¨¾ÙÐжþ·ÖÀà£¬Ê¹ÓõÄÌØÕ÷ΪÓòÃû³¤¶ÈºÍ×Ô½ç˵µÄÓòÃûÆÚÍûÖµ¡£Ëæ»úÉ­ÁÖÓÐÖúÓÚ½â¾ö¾öÒéÊ÷µÄ¹ýÄâºÏÎÊÌâ£¬ÎÄÏ×ÖÐÆÕ±éʹÓÃËæ»úÉ­ÁÖÀ´´¦Öóͷ£»ùÓÚDGAµÄ½©Ê¬ÍøÂçÎÊÌâ£¬ÀýÈçÎÄÏ×[5]¾ÍÊÇʹÓÃËæ»úÉ­ÁÖËã·¨½â¾ö¶þ·ÖÀàÎÊÌâ£¬Ê¹ÓõÄÌØÕ÷ÓÐËÄÀࣺÂþÑÜÌØÕ÷¡¢½á¹¹ÌØÕ÷¡¢·¢ÒôÌØÕ÷¡¢Í¨ÓÃÌØÕ÷¡£

3.3 »ùÓÚÎÞ¼àÊÓѧϰµÄ¼ì²â

»ùÓÚ¾öÒéÊ÷ºÍËæ»úÉ­ÁÖµÄÄ£×ÓÊôÓÚ¼àÊÓѧϰ£¬¶¼ÐèÒªÌØÕ÷²Å»ªÊÂÇé¡£ÎÞ¼àÊÓѧϰÓëÓмàÊÓѧϰÏà±ÈÓÐÒ»¸öÖ÷ÒªµÄÓÅÊÆÊDz»ÐèÒª´ø±ê¼ÇµÄÊý¾Ý¼¯¡£ÖÚËùÖÜÖªµÄK-MeansËã·¨ÊÇÒ»¸ö¼òÆÓ³£ÓõÄÎÞ¼àÊÓѧϰËã·¨£¬±»ÆÕ±éÓ¦ÓÃÔÚDGAÓòÃû¼ì²âÖÐ£¬ÀýÈçÎÄÏ×[6]ʹÓÃKMeans¾ÙÐÐDGA¼Ò×åµÄ¶à·ÖÀà£¬Ê¹ÓÃÁËÓòÃûµÄ³¤¶È¡¢ìغÍNGramÏà¹ØÌØÕ÷£»ÎÄÏ×[7]ʹÓÃKMeans¾ÙÐÐÇø·ÖÕý³£ºÍDGAÓòÃû£¬Ê¹ÓÃÁ˿ɶÁÐÔ£¨NGram£©¡¢ÐÅÏ¢ìØ¡¢½á¹¹£¨³¤¶È¡¢×Ö·û±ÈÀýµÈ£©ÈýÀàÌØÕ÷¡£ÔÚÒÑÍùÊ®ÄêÖÐ£¬Ö»ÓÐÉÙÊýÎÞ¼àÊÓËã·¨ÓÃÀ´½â¾öDGAÓòÃû¼ì²âÎÊÌâ¡£³ýÁËKMeansÉÐÓÐÁ½ÖÖ¾ÛÀàÒªÁ죺»ìÏýÄ£×Ó£¨MM£©ºÍHC£¬µ«ËüÃǵÄʹÓúÜÊÇÓÐÏÞ£¬Ð§¹û²»²ÇÏë¡£

3.4 »ùÓÚÉî¶ÈѧϰµÄ¼ì²â

Éî¶ÈѧϰҲÔÚDGAÓòÃû¼ì²âÖÐÓÐÆÕ±éµÄÓ¦ÓÃ£¬Ñ­»·Éñ¾­ÍøÂ磨RNNs£©¡¢ÊÇ·ÇÆÚÓ°ÏóÍøÂ磨LSTM£©ºÍ¾í»ýÉñ¾­ÍøÂ磨CNN£©¶¼±»Ó¦Óõ½ÁËDGAÓòÃû¼ì²âÖС£ÀýÈ磺ÎÄÏ×[8]ʹÓÃLSTM½â¾öDGAÓòÃûºÍÕý³£ÓòÃû¶þ·ÖÀà¡¢DGA¼Ò×å¶à·ÖÀàÎÊÌ⣻ÎÄÏ×[9]Ñо¿²¢¿ª·¢Á˾­µäLSTMµÄ±äÌå£¬Ò²ÓÃÀ´¾ÙÐжþ·ÖÀàºÍ¶à·ÖÀࣻÎÄÏ×[10]½ÏÁ¿ÁËRNN¡¢LSTM¡¢CNNºÍCNN-LSTM×éºÏ¾ÙÐÐDGA¶þ·ÖÀàºÍ¶à·ÖÀàµÄЧ¹û¡£Éî¶ÈѧϰÔÚ¶þ·ÖÀàÖÐÌåÏÖ¾«²Ê£¬µ«ÔÚ¶à·ÖÀàÖдËÀàÒªÁìÔÚ׼ȷ¶ÈºÍÕÙ»ØÂÊ·½Ã涼ȡµÃÁËÁîÈËÏÓÒɵÄЧ¹û¡£×îºóÐèҪ˵Ã÷µÄÊÇÉî¶ÈѧϰËäÈ»¿ÉÒÔÌṩºÜºÃµÄ·ÖÀàЧ¹û£¬µ«ËüÃÇÍùÍùÊÇÌ«¹ýÄâºÏµÄ£¬ÓÈÆäÊDz»Í¸Ã÷µÄ£¬È±·¦Í¸Ã÷¶È×îÖÕµ¼ÖÂÎÞ·¨¶ÔËã·¨¾ÙÐÐ΢µ÷£¬Ò²ÎÞ·¨Ú¹ÊÍЧ¹û±³ºóµÄÔµ¹ÊÔ­ÓÉ¡£

»¹ÖµµÃÒ»ÌáµÄÊÇ£¬ÓÐÑо¿Ê¹ÓÃÉî¶ÈѧϰËã·¨¾ÙÐÐÌØÕ÷ÌáÈ¡£¬È»ºóʹÓ÷ÖÀàËã·¨¾ÙÐзÖÀà£¬ÀýÈçÎÄÏ×[7]ʹÓÃCNNÌìÉúÌØÕ÷£¬ÕâЩÌØÕ÷ËæºóÓɾöÒéÊ÷ºÍËæ»úÉ­ÁÖ·ÖÀàÆ÷¾ÙÐзÖÀà¡£

04 ¼Æ»®

±¾ÎÄÌá³öÁËÒ»ÖÖ¼òÆÓ¸ßЧµÄDGAÓòÃû¼ì²â¼Æ»®¡£¸Ã¼Æ»®½öÌáÈ¡ÓòÃûµÄ×Ö·û´®ÌØÕ÷¾ÙÐÐDGAÓòÃû¼ì²â£¬ÊµÑéÅú×¢¸Ã¼Æ»®¼òÆÓÓÐÓ᣸üƻ®µÄÏêϸ¼ì²âÄ£×ÓʾÒâͼÈçͼ2Ëùʾ¡£½ÓÏÂÀ´ÎÒÃǽ«Öصã´ÓÌØÕ÷¹¤³ÌºÍÄ£×ÓÆÀ¹ÀÁ½¸ö½Ç¶È¾ÙÐÐÏÈÈÝ¡£

4.1 ÌØÕ÷¹¤³Ì

±¾¼Æ»®Ê¹ÓÃÌØÕ÷20¶à¸ö£¬·ÖΪÁ½ÀࣺһÀàΪ¾­µäµÄ×Ö·û´®»³±§ÌØÕ÷£¬ÀýÈ糤¶È¡¢ìØ¡¢×Ö·û±ÈÀýµÈ£¬ÕâÀàÌØÕ÷¼òÆÓÓÐÓã»Ò»ÀàΪNLP-nGramsÏà¹ØµÄÌØÕ÷¡£ÕâЩÌØÕ÷´ó´ó¶¼·´Ó¦ÁËÓ¦ÓÃʵ¼ùÖжÔÓòÃûµÄÒªÇó£¬ÀýÈçSEO£¨ËÑË÷ÒýÇæÓÅ»¯£©½¨ÒéÁËÓòÃûµÄÀíÏ볤¶È£¨Ô¼Äª12-13¸ö×Ö·û£©£¬ÒÔ¼°¾ßÓÐÒ׶Á¡¢Ò׼ǡ¢Ò×Èö²¥µÈÌصã¡£

±¾¼Æ»®¶Ôÿ¸öÌØÕ÷µÄÖ±·½Í¼ºÍÏà¶ÔÂþÑܾÙÐÐÁËÆÊÎö£¬ÏÂÃæÁÙ²¿·ÖÌØÕ÷ÂþÑÜͼ¾ÙÐоÙÀýÆÊÎö¡£

ÓòÃû³¤¶È:

ÓòÃû³¤¶ÈÊÇÇø·ÖÕý³£ºÍDGAÓòÃûµÄÒ»¸öÖ÷ÒªÌØÕ÷£¬´Óͼ3ÓòÃû³¤¶ÈÂþÑÜͼ¿ÉÒÔ¿´³öDGAÓòÃûµÄ³¤¶È¸ü³¤¡£

ÓòÃûìØ:

ìØ·´Ó¦ÁË×Ö·û´®µÄËæ»úÐÔ£¬DGAÓòÃûÊÇÓÉËã·¨ÌìÉúµÄαËæ»ú×Ö·û´®£¬ÆäËæ»úÐÔ¸úÕý³£ÓòÃûÏà±È¸ü¸ß¡£Í¼4ΪÕý³£ÓòÃûºÍDGAÓòÃûµÄìØÂþÑܱÈÕÕͼ¡£

ÓòÃû×Ö·ûתÒƸÅÂÊ:

×Ö·ûתÒƸÅÂÊ¿ÉÒÔ·´Ó¦ÓòÃûµÄ¿É¶ÁÐÔ£¬Ê¹ÓÃÕý³£ÓòÃû»òÕßÓ¢ÎÄÓïÁÏͳ¼ÆN-GramµÄתÒƸÅÂÊ£¬ÓÉÓÚDGAÓòÃû¸üËæ»ú£¬ÆäN-GramתÒƸÅÂÊÓëÕý³£ÓïÁϲî±ð½Ï´ó¡£

×Ö·û±ÈÀý:

×Ö·û±ÈÀýÒ²ÊÇÇø·ÖÕý³£ÓòÃûºÍDGAÓòÃûµÄ³£ÓÃÌØÕ÷£¬ËùÊö×Ö·û°üÀ¨Êý×Ö¡¢ÔªÒô×Öĸ¡¢×ÓÒô×ÖĸµÈ¡£

nGram:

±¾¼Æ»®ÖÐÅÌËãÁËnGram·ºÆð¸ÅÂÊÅÅÃûµÄƽ¾ùÖµºÍ·½²î£¬»ù׼ΪӢÎÄÓïÁÏ£¬ÓÉÓÚDGAÓòÃûµÄËæ»úÐÔ£¬ÆäÓëÓ¢ÎÄÓïÁϲî±ð½Ï´ó£¬Òò´ËÆänGram·ºÆð¸ÅÂʵÄÅÅÃû¸ü¿¿ºó¡£

4.2 Ä£×ÓÆÀ¹À

±¾¼Æ»®Ê¹ÓõÄѵÁ·Êý¾ÝȪԴÓÚ¹ûÕæÊý¾Ý¼¯£¬Êý¾ÝÁ¿ÔÚ°ÙÍòÒÔÉÏ£¬Ä£×Ó¼ì²âЧ¹ûÈçϱíËùʾ£º

±í2 Ä£×Ó¼ì²âЧ¹û

´ÓÉϱíµÄÊý¾Ý¿ÉÒÔ¿´³ö²î±ðËã·¨µÄ¼ì²âЧ¹û²î±ð²»´ó£¬¼ì²âÂʾùµÖ´ï96%ÒÔÉÏ¡£

05 ºó¼Ç

Ïà½ÏÁ¿ºÚÃûµ¥·½·¨£¬»ùÓÚ»úеѧϰµÄDGAÓòÃû¼ì²âÒªÁì¾ßÓÐÒ»¶¨µÄÓÅÊÆ£¬µ«ÈÔÈ»ÐèҪƾ֤ÏÖÕæÏàÐξÙÐÐÓÅ»¯¡£±¾ÎÄÌá³öµÄDGAÓòÃû¼ì²â¼Æ»®Äܹ»µÖ´ï½ÏºÃµÄ¼ì²âЧ¹û£¬¿ÉÊǼƻ®¶Ô»ùÓÚ´ÇÊéµÄDGAÓòÃû¼ì²âЧ¹ûÉÐÓÐÓÅ»¯¿Õ¼ä£¬Õ⽫×÷ΪºóÐøÑо¿µÄÖص㣻ÁíÍâ£¬±¾¼Æ»®ÊÇÕë¶ÔDGAÓòÃûºÍÕý³£ÓòÃû¾ÙÐеĶþ·ÖÀàÑо¿£¬ºóÐøÎÒÃǽ«½øÒ»²½¶ÔDGA¼Ò×å¾ÙÐжà·ÖÀàÑо¿£¬¾´Çë¹Ø×¢¡£

²Î¿¼ÎÄÏ×

[1]Patsakis,Constantinos,and FranCasino. "Hydras and IPFS: a decentralised playground for malware."International Journal of Information Security (2019): 1-13.

[2]K¨¹hrer M, Rossow C, Holz T (2014) Paint it black: evaluating the effectiveness of malware blacklists. In: RAID 2014: research in attacks, intrusions and defenses, June, pp 1¨C21. Springer International Publishing.

[3]Ahluwalia A, Traore I, Ganame K, Agarwal N (2017) Detecting broad length algorithmically generated domains. In: Intelligent, secure, and dependable systems in distributed and cloud environments, chap. 2, pp 19¨C34. Springer International Publishing.

[4]Truong D, Cheng G (2016) Detecting domain-flux botnet based on DNS traffic features in managed network. Security Communication Networks 9(14):2338¨C2347.

[5]Luo X, Wang L, Xu Z, Yang J, Sun M, Wang J (2017) DGASensor: fast detection for DGA-based malwares. In: 5th international conference on communications and broadband networking, pp 47¨C53.

[6]Bisio F, Saeli S, Lombardo P, Bernardi D, Perotti A, Massa D (2017) Real-time behavioral DGA detection through machine learning. In: 2017 international carnahan conference on security technology, pp 1¨C6.

[7]Pu Y, Chen X, Pu Y, Shi J (2015) A clustering approach for detecting auto-generated Botnet domains. In: Applications and techniques in information security, pp 269¨C279.

[8]Woodbridge J, Anderson HS, Ahuja A, Grant D (2016) Predicting domain generation algorithms with long short-term memory networks. CoRR abs/1611.0.

[9]Tran D, Mac H, Tong V, Tran HA, Nguyen LG (2018) A LSTM based framework for handling multiclass imbalance in DGA Botnet detection. Neurocomputing 275:2401¨C2413.

[10]Vinayakumar R, Soman K, Poornachandran P, Sachin Kumar S (2018) Evaluating deep learning approaches to characterize and classify the DGAs at scale. J Intell Fuzzy Syst 34(3):1265¨C1276.

°æȨÉùÃ÷

תÔØÇëÎñ±Ø×¢Ã÷À´ÓÉ¡£

°æȨËùÓÐ£¬Î¥Õ߱ؾ¿¡£