01 Åä¾°

ÅÌËã»úÍøÂçʵÏÖÁË×ÊÔ´¹²Ïí¡¢¼´Ê±Í¨Ñ¶ºÍÂþÑÜʽÅÌËã
£¬¸øÈËÃǵÄÊÂÇéºÍÉúÑÄ´øÀ´Á˼«´óµÄ±ãµ±¡£È»¶øÕâЩÍøÂçÒ²»á±»¶ñÒâÈí¼þÀÄÓÃ
£¬½©Ê¬ÍøÂ磨botnet£©¾ÍÊǵäµä·¶×Ó¡£½©Ê¬ÍøÂçÓÉ´ó×ÚÊÜ¿ØÖ÷»ú¼´½©Ê¬£¨bot£©ºÍÒ»¸ö»ò¶à¸öÏÂÁîºÍ¿ØÖÆC2£¨Command &Control£©·þÎñÆ÷×é³É
£¬botÓëC2·þÎñÆ÷Ï໥ͨѶÒÔ±ãת´ïÏÂÁîºÍÊý¾Ý¡£Îª×èÖ¹C2·þÎñÆ÷±»·¢Ã÷
£¬¶ñÒâÈí¼þÏë·¨½ÓÄɹæ±ÜÊÖÒÕÀ´Òþ²ØbotÓëC2·þÎñÆ÷µÄͨѶÐÐΪ
£¬ÆäÖÐ
£¬ÓòÃûÌìÉúËã·¨DGA£¨Domain Generation Algorithm£©¾ÍÊÇÒ»ÖÖÊÊÓÃÊÖÒÕ¡£¼òÆÓµØ˵
£¬¹¥»÷ÕßʹÓÃDGAËã·¨ºÍÖÖ×Ó£¨Èçʱ¼ä¡¢´ÇÊéµÈ£©ÌìÉú´ó×ÚËã·¨ÌìÉúÓòÃûAGD£¨Algorithmically Generated Domain£©
£¬È»ºóÖ»ÐèҪʹÓÃÒ»¸öÓòÃûÀ´¾ÙÐÐC2ͨѶ
£¬¶ø·ÀÓùÕßΪÁË·¢Ã÷¸ÃÓòÃû
£¬ÐèÒª¶ÔËùÓÐAGDÓòÃû¾ÙÐмì²â¡£»ùÓÚÕâÖÖ¹¥·ÀË«·½ËùÐè×ÊÔ´µÄ²î³Ø³ÆÐÔ
£¬DGAÊÖÒÕ±»¹¥»÷ÕßÆÕ±éʹÓá£MITRE ATT&CK C2Õ½ÊõT1568.002ÊÖÒռͼÁËÊ®¼¸¸öʹÓÃDGAÊÖÒÕµÄAPT×éÖ¯
£¬ºÃ±ÈAPT41¡¢Aria-bodyµÈ¡£´Ó2008ÄêÎÛÃûÕÑÖøµÄKrakenºÍConficker¶ñÒâÈí¼þÒÔÀ´
£¬ÎªÁËÈƹýÈëÇÖ¼ì²âϵͳµÄ¼ì²é
£¬ÏÕЩËùÓжñÒâÈí¼þ¶¼½ÓÄÉÁËDGAÊÖÒÕ¡£×îеÄÊÖÒÕ±¨¸æÔ¤¼Æ
£¬¶ñÒâAGDÓòÃûÊýÄ¿Ô¼Õ¼ÓòÃû×ÜÊýµÄ9.9%
£¬ÆäÖÐ1/5ÊôÓÚ»ùÓÚDGAµÄ½©Ê¬ÍøÂ磨ԼռËùÓÐ×¢²áÓòÃûµÄ1.8%£©¡£

Ä¿½ñ
£¬DGAÓòÃû¼ì²âÑо¿ÊÇÇ徲ȦÌÖÂÛµÄÈÈÃÅ»°Ìâ¡£¹Å°åµÄDGAÓòÃû¼ì²âÒªÁìÊÇʹÓúÚÃûµ¥Õ½ÂÔʵÏÖ
£¬µ«ÓÉÓÚDGAÓòÃûÈÝÒ×ÌìÉúÇÒ¹æÄ£Á¿´ó
£¬Õâ¾Íµ¼ÖÂÒ»Ö±ÍøÂçºÍ¸üкÚÃûµ¥±äµÃ²»ÏÖʵ¡£»ùÓÚ»úеѧϰµÄDGAÓòÃû¼ì²âÒªÁì¿ÉÒÔ×èÖ¹Õâһȱ·¦
£¬ÊµÏÖʵʱ¼ì²â
£¬ÒѳÉΪDGAÓòÃû¼ì²âÁìÓòÑо¿Ö÷Á÷Æ«Ïò¡£

±¾ÎĽ«Ïò¶ÁÕßÏÈÈÝDGAÓòÃû»ù´¡ÖªÊ¶¡¢DGAÓòÃû¼ì²âÒªÁìÏÖ×´ÒÔ¼°ÎÒÃÇÌá³öµÄDGAÓòÃû¼ì²â¼Æ»®¡£

02 ¼ò½é

2.1 DGAÓòÃû¹¥»÷Ô­Àí

DGAÊÇÒ»×éËã·¨»úÖÆ
£¬±»ÖÖÖÖ¶ñÒâÈí¼þ¼Ò×åÓÃÀ´ÌìÉú´ó×ÚµÄαËæ»úÓòÃû¡£Î±Ëæ»úÒâζ×Å×Ö·û´®ÐòÁÐËƺõÊÇËæ»úµÄ
£¬µ«ÓÉÓÚÆä½á¹¹¿ÉÒÔÔ¤ÏÈÈ·¶¨
£¬Òò´Ë¿ÉÒÔÖظ´±¬·¢ºÍ¸´ÖÆ¡£

´ó´ó¶¼Ëæ»úÌìÉúµÄÓòÃûÊDz»±£´æµÄ
£¬Ö»ÓÐÆäÖÐһС²¿·ÖÓòÃû»á±»×¢²áÒÔ¹©ÊÜ¿ØÖ÷»úÓëC2·þÎñÆ÷¾ÙÐÐͨѶ
£¬´Ó¶ø»ñÊØÐÅÏ¢»ò¸ú×ÙÆäËû¶ñÒâʹÃü¡£±ðµÄ
£¬µ±Ò»¸öÓòÃû±»ÀÖ³É×èֹʱ
£¬¹¥»÷Õß»á´ÓDGAÌìÉúµÄÓòÃûÁбíÖÐ×¢²áÆäËûÓòÃû¡£Ê¹ÓÃDGAÓòÃû¾ÙÐй¥»÷µÄÔ­ÀíÈçͼ1[1]Ëùʾ¡£

¹¥»÷Õßͨ¹ýDGAËã·¨ÌìÉú´ó×Ú±¸Ñ¡ÓòÃû
£¬Êܿض˶ñÒâÈí¼þÔËÐÐͳһÌ×DGAËã·¨
£¬ÌìÉúÏàͬµÄ±¸Ñ¡ÓòÃûÁбí
£¬µ±¾ÙÐй¥»÷µÄʱ¼ä
£¬¹¥»÷ÕßÑ¡ÔñÆäÖÐÉÙÁ¿ÓòÃû¾ÙÐÐ×¢²á
£¬ÊܿضËͨ¹ýÅÌÎÊ»ñÈ¡ÒÑ×¢²áÓòÃûºó±ã¿ÉÒÔÓëC2·þÎñÆ÷½¨ÉèÅþÁ¬
£¬¾ÙÐÐÏÂÁîºÍÊý¾Ý´«Êä¡£

2.2 DGAÓòÃû·ÖÀà

2.2.1 ƾ֤ÖÖ×Ó¾ÙÐзÖÀà

ÖÖ×ÓÊǹ¥»÷ÕߺͿͻ§¶Ë¶ñÒâÈí¼þ¹²ÏíµÄDGAËã·¨µÄÊäÈë²ÎÊýÖ®Ò»
£¬²î±ðµÄÖÖ×ӵóöµÄDGAÓòÃûÊÇ·×ÆçÑùµÄ¡£

DGAʹÓõÄÖÖ×ÓÓÐÐí¶àÖÖÀà
£¬°üÀ¨ÈÕÆÚ¡¢Éç½»ÍøÂçËÑË÷ÈÈ´Ê¡¢Ëæ»úÊý»ò´ÇÊé
£¬DGAƾ֤ÖÖ×ÓÌìÉúÒ»´®×Ö·ûǰ׺
£¬Ìí¼ÓTLD£¨¶¥¼¶Óò
£¬Èçcom¡¢orgµÈ£©ºó»ñµÃ×îÖÕÌìÉúÓòÃû¡£

Ò»Ñùƽ³£À´Ëµ
£¬ÖÖ×Ó¿É°´ÈçÏ·½·¨¾ÙÐзÖÀࣺ

»ùÓÚʱ¼äµÄÖÖ×Ó£ºDGAË㷨ʹÓÃʱ¼äÐÅÏ¢×÷ΪÊäÈ루È磺ÊÜ¿ØÖ÷»úµÄϵͳʱ¼ä
£¬httpÏìÓ¦µÄʱ¼äµÈ£©£»

ÊÇ·ñ¾ßÓÐÈ·¶¨ÐÔ£ºÖ÷Á÷µÄDGAËã·¨µÄÊäÈëÊÇÈ·¶¨µÄ
£¬Òò´ËAGD¿ÉÒÔ±»ÌáÇ°ÅÌËã
£¬¿ÉÊÇÒ²ÓÐһЩDGAËã·¨µÄÊäÈëÊDz»È·¶¨µÄ£¨È磺BedepÒÔÅ·ÖÞÖÐÑëÒøÐÐÌìÌìÐû²¼µÄÍâ»ã²Î¿¼»ãÂÊ×÷ΪÖÖ×Ó
£¬TorpigÓÃTwitterµÄÒªº¦´Ê×÷ΪÖÖ×Ó
£¬Ö»ÓÐÔÚȷ׼ʱ¼ä´°¿ÚÄÚ×¢²áÓòÃû²Å»ªÉúЧ£©¡£

ƾ֤ÖÖ×ӵķÖÀàÒªÁì
£¬DGAÓòÃû¿ÉÒÔ·ÖΪÒÔÏÂ4Àࣺ

TID(time-independent and deterministic)£ºÓëʱ¼ä²»Ïà¹Ø
£¬¿ÉÈ·¶¨£»

TDD(time-dependent and deterministic)£ºÓëʱ¼äÏà¹Ø
£¬¿ÉÈ·¶¨£»

TDN(time-dependent and non-deterministic)£ºÓëʱ¼äÏà¹Ø
£¬²»¿ÉÈ·¶¨£»

TIN(time-independent and non-deterministic)£ºÓëʱ¼ä²»Ïà¹Ø
£¬²»¿ÉÈ·¶¨£»

2.2.2 ƾ֤ÌìÉúËã·¨¾ÙÐзÖÀà

ÏÖÓÐDGAÌìÉúËã·¨Ò»Ñùƽ³£¿ÉÒÔ·ÖΪÈçÏÂ4Àࣺ

»ùÓÚËãÊõ£º¸ÃÀàÐÍËã·¨»áÌìÉúÒ»×é¿ÉÓÃASCII±àÂëÌåÏÖµÄÖµ
£¬´Ó¶ø×é³ÉDGAÓòÃû
£¬Ê¢ÐжÈ×î¸ß£»

»ùÓÚ¹þÏ££ºÓùþÏ£ÖµµÄ16½øÖÆÌåÏÖ±¬·¢µÄDGAÓòÃû
£¬³£Ê¹ÓõĹþÏ£Ëã·¨ÓУºMD5
£¬SHA256£»

»ùÓÚ´ÇÊ飺¸Ã·½·¨»á´ÓרÓдÇÊéÖÐÌôÑ¡µ¥´Ê¾ÙÐÐ×éºÏ
£¬ïÔÌ­ÓòÃû×Ö·ûÉϵÄËæ»úÐÔ
£¬ÒÉ»óÐÔ¸üÇ¿
£¬´ÇÊéÄÚǶÔÚ¶ñÒâ³ÌÐòÖлòÕß´Ó¹«ÓзþÎñÖÐÌáÈ¡£»

»ùÓÚÅÅÁÐ×éºÏ£º¶ÔÒ»¸ö³õʼÓòÃû¾ÙÐÐ×Ö·ûÉϵÄÅÅÁÐ×éºÏ¡£

2.3 DGAÓòÃû¾ÙÀý

DGAµÄʹÓúÜÊÇÆÕ±é
£¬ÏÖÔÚÒÑÖªµÄDGA¼Ò×åÓÐ40¶à¸ö¡£Ï±íö¾ÙÁË4¸öDGA¼Ò×åµÄTLD£¨¶¥¼¶Óò£©¡¢SLD£¨¶þ¼¶Óò£©ºÍÑùÀý£º

±í1 ²î±ðDGA¼Ò×å¾ÙÀý

03 ÏÖ×´

3.1 ¸ÅÊö

´ó´ó¶¼DGAËã·¨¶¼¾ßÓÐʱ¼äÒÀÀµÐÔºÍÈ·¶¨ÐÔ
£¬¼´ËüÃǵÄÌìÉú²ÎÊýÊÇ¿É»ñÈ¡ºÍ¿ÉÖØÓõÄ
£¬´Ó¶øÅÌËã³öËùÓпÉÄܵÄЧ¹û¡£»ùÓÚ´ËÌصã
£¬¿ÉÒÔ¶Ôÿ¸ö¶ñÒâÈí¼þ¼°Æä±äÌå¾ÙÐÐÄæÏòÆÊÎö»ñµÃÓòÃûÌìÉúËã·¨ºÍÖÖ×Ó
£¬´Ó¶øÌáÈ¡¸ø¶¨ÈÕÆÚºÍʱ¼äµÄÓÐÓÃÓòÃûÜöÝÍ
£¬¼ÓÈëºÚÃûµ¥¾ÙÐÐDGAÓòÃû¼ì²â¡£

¿ÉÊÇ
£¬µ±Ë¼Á¿µ½ÌìÌì·¢Ã÷µÄ¶ñÒâÈí¼þ¼°±äÖÖµÄÊýĿʱ
£¬ÕâÖÖÒªÁìÊDz»¿ÉÐеÄ¡£Ôµ¹ÊÔ­ÓÉÓÐÁ½¸ö·½Ãæ
£¬ÆäÒ»ÊǺÚÃûµ¥µÄ¸üÐÂËÙÂÊÔ¶Ô¶¸Ï²»ÉÏDGAÓòÃûµÄÌìÉúËÙÂÊ£»Æä¶þÊDZØÐè×è¶ÏËùÓеÄDGAÓòÃû²Å»ª×è¶ÏÊÜ¿ØÖ÷»úÓëC2·þÎñÆ÷ͨѶ¡£¾ÝÎÄÏ×[2]ËùÑÔ
£¬¿ªÔ´ºÚÃûµ¥µÄDGAÁýÕÖÂʵÍ
£¬½ö²»µ½1.2%µÄDGA°üÀ¨ÔÚºÚÃûµ¥ÖС£Òò´Ë
£¬´Ö±©ÓÃDGA¹¹½¨ºÚÃûµ¥µÄÒªÁì²¢²»¿É½â¾ö»ù´¡ÎÊÌâ¡£

»ùÓÚ»úеѧϰµÄDGAÓòÃû¼ì²âÒªÁì´ó²¿·ÖÊÇÖ±½Ó´ÓÍêÈ«¼°¸ñÓòÃûFQDN£¨Fully Qualified Domain Name£©ÌáÈ¡ÌØÕ÷
£¬½«FQDN×÷Ϊһ¸ö×Ö·û´®
£¬ÌáÈ¡³¤¶È¡¢ìØ¡¢NGramµÈÌØÕ÷
£¬ÕâÀàÒªÁì²»ÒÀÀµÓÚÉÏÏÂÎÄÐÅÏ¢
£¬ÀýÈçʱ¼ä¡¢ÇéÐÎÉèÖõÈ
£¬Òò´Ë
£¬¿ÉÒÔʵÏÖʵʱ¼ì²â¡£

ÏÖÔڹŰå»úеѧϰËã·¨ºÍÉî¶Èѧϰ¶¼±»ÓÃÓÚDGAÓòÃû¼ì²â
£¬²¢¶¼È¡µÃÁ˲»´íµÄЧ¹û¡£¹Å°å»úеѧϰËã·¨·ÖΪ¼àÊÓѧϰºÍÎÞ¼àÊÓѧϰÁ½Àà
£¬ÕâÁ½ÀàËã·¨¶¼ÔÚDGAÓòÃû¼ì²âÖÐÓÐÓ¦Óá£

3.2 »ùÓÚ¼àÊÓѧϰµÄ¼ì²â

³£ÓõļàÊÓѧϰËã·¨ÓоöÒéÊ÷ºÍËæ»úÉ­ÁÖ
£¬ÀýÈçÎÄÏ×[3]ʹÓþöÒéÊ÷½â¾öÇø·ÖDGAÓòÃûºÍÕý³£ÓòÃûµÄ¶þ·ÖÀàÎÊÌâ
£¬Ê¹ÓõÄÌØÕ÷ÓÐÓòÃû³¤¶È¡¢×Ö·û±ÈÀý£¨°üÀ¨ÔªÒô×Öĸ¡¢×ÓÒô×Öĸ¡¢Êý×Ö£©ºÍNGramìØ£»ÎÄÏ×[4]Ò²ÊÇʹÓþöÒéÊ÷Ëã·¨¾ÙÐжþ·ÖÀà
£¬Ê¹ÓõÄÌØÕ÷ΪÓòÃû³¤¶ÈºÍ×Ô½ç˵µÄÓòÃûÆÚÍûÖµ¡£Ëæ»úÉ­ÁÖÓÐÖúÓÚ½â¾ö¾öÒéÊ÷µÄ¹ýÄâºÏÎÊÌâ
£¬ÎÄÏ×ÖÐÆÕ±éʹÓÃËæ»úÉ­ÁÖÀ´´¦Öóͷ£»ùÓÚDGAµÄ½©Ê¬ÍøÂçÎÊÌâ
£¬ÀýÈçÎÄÏ×[5]¾ÍÊÇʹÓÃËæ»úÉ­ÁÖËã·¨½â¾ö¶þ·ÖÀàÎÊÌâ
£¬Ê¹ÓõÄÌØÕ÷ÓÐËÄÀࣺÂþÑÜÌØÕ÷¡¢½á¹¹ÌØÕ÷¡¢·¢ÒôÌØÕ÷¡¢Í¨ÓÃÌØÕ÷¡£

3.3 »ùÓÚÎÞ¼àÊÓѧϰµÄ¼ì²â

»ùÓÚ¾öÒéÊ÷ºÍËæ»úÉ­ÁÖµÄÄ£×ÓÊôÓÚ¼àÊÓѧϰ
£¬¶¼ÐèÒªÌØÕ÷²Å»ªÊÂÇé¡£ÎÞ¼àÊÓѧϰÓëÓмàÊÓѧϰÏà±ÈÓÐÒ»¸öÖ÷ÒªµÄÓÅÊÆÊDz»ÐèÒª´ø±ê¼ÇµÄÊý¾Ý¼¯¡£ÖÚËùÖÜÖªµÄK-MeansËã·¨ÊÇÒ»¸ö¼òÆÓ³£ÓõÄÎÞ¼àÊÓѧϰËã·¨
£¬±»ÆÕ±éÓ¦ÓÃÔÚDGAÓòÃû¼ì²âÖÐ
£¬ÀýÈçÎÄÏ×[6]ʹÓÃKMeans¾ÙÐÐDGA¼Ò×åµÄ¶à·ÖÀà
£¬Ê¹ÓÃÁËÓòÃûµÄ³¤¶È¡¢ìغÍNGramÏà¹ØÌØÕ÷£»ÎÄÏ×[7]ʹÓÃKMeans¾ÙÐÐÇø·ÖÕý³£ºÍDGAÓòÃû
£¬Ê¹ÓÃÁ˿ɶÁÐÔ£¨NGram£©¡¢ÐÅÏ¢ìØ¡¢½á¹¹£¨³¤¶È¡¢×Ö·û±ÈÀýµÈ£©ÈýÀàÌØÕ÷¡£ÔÚÒÑÍùÊ®ÄêÖÐ
£¬Ö»ÓÐÉÙÊýÎÞ¼àÊÓËã·¨ÓÃÀ´½â¾öDGAÓòÃû¼ì²âÎÊÌâ¡£³ýÁËKMeansÉÐÓÐÁ½ÖÖ¾ÛÀàÒªÁ죺»ìÏýÄ£×Ó£¨MM£©ºÍHC
£¬µ«ËüÃǵÄʹÓúÜÊÇÓÐÏÞ
£¬Ð§¹û²»²ÇÏë¡£

3.4 »ùÓÚÉî¶ÈѧϰµÄ¼ì²â

Éî¶ÈѧϰҲÔÚDGAÓòÃû¼ì²âÖÐÓÐÆÕ±éµÄÓ¦ÓÃ
£¬Ñ­»·Éñ¾­ÍøÂ磨RNNs£©¡¢ÊÇ·ÇÆÚÓ°ÏóÍøÂ磨LSTM£©ºÍ¾í»ýÉñ¾­ÍøÂ磨CNN£©¶¼±»Ó¦Óõ½ÁËDGAÓòÃû¼ì²âÖС£ÀýÈ磺ÎÄÏ×[8]ʹÓÃLSTM½â¾öDGAÓòÃûºÍÕý³£ÓòÃû¶þ·ÖÀà¡¢DGA¼Ò×å¶à·ÖÀàÎÊÌâ£»ÎÄÏ×[9]Ñо¿²¢¿ª·¢Á˾­µäLSTMµÄ±äÌå
£¬Ò²ÓÃÀ´¾ÙÐжþ·ÖÀàºÍ¶à·ÖÀà£»ÎÄÏ×[10]½ÏÁ¿ÁËRNN¡¢LSTM¡¢CNNºÍCNN-LSTM×éºÏ¾ÙÐÐDGA¶þ·ÖÀàºÍ¶à·ÖÀàµÄЧ¹û¡£Éî¶ÈѧϰÔÚ¶þ·ÖÀàÖÐÌåÏÖ¾«²Ê
£¬µ«ÔÚ¶à·ÖÀàÖдËÀàÒªÁìÔÚ׼ȷ¶ÈºÍÕÙ»ØÂÊ·½Ã涼ȡµÃÁËÁîÈËÏÓÒɵÄЧ¹û¡£×îºóÐèҪ˵Ã÷µÄÊÇÉî¶ÈѧϰËäÈ»¿ÉÒÔÌṩºÜºÃµÄ·ÖÀàЧ¹û
£¬µ«ËüÃÇÍùÍùÊÇÌ«¹ýÄâºÏµÄ
£¬ÓÈÆäÊDz»Í¸Ã÷µÄ
£¬È±·¦Í¸Ã÷¶È×îÖÕµ¼ÖÂÎÞ·¨¶ÔËã·¨¾ÙÐÐ΢µ÷
£¬Ò²ÎÞ·¨Ú¹ÊÍЧ¹û±³ºóµÄÔµ¹ÊÔ­ÓÉ¡£

»¹ÖµµÃÒ»ÌáµÄÊÇ
£¬ÓÐÑо¿Ê¹ÓÃÉî¶ÈѧϰËã·¨¾ÙÐÐÌØÕ÷ÌáÈ¡
£¬È»ºóʹÓ÷ÖÀàËã·¨¾ÙÐзÖÀà
£¬ÀýÈçÎÄÏ×[7]ʹÓÃCNNÌìÉúÌØÕ÷
£¬ÕâЩÌØÕ÷ËæºóÓɾöÒéÊ÷ºÍËæ»úÉ­ÁÖ·ÖÀàÆ÷¾ÙÐзÖÀà¡£

04 ¼Æ»®

±¾ÎÄÌá³öÁËÒ»ÖÖ¼òÆÓ¸ßЧµÄDGAÓòÃû¼ì²â¼Æ»®¡£¸Ã¼Æ»®½öÌáÈ¡ÓòÃûµÄ×Ö·û´®ÌØÕ÷¾ÙÐÐDGAÓòÃû¼ì²â
£¬ÊµÑéÅú×¢¸Ã¼Æ»®¼òÆÓÓÐÓ᣸üƻ®µÄÏêϸ¼ì²âÄ£×ÓʾÒâͼÈçͼ2Ëùʾ¡£½ÓÏÂÀ´ÎÒÃǽ«Öصã´ÓÌØÕ÷¹¤³ÌºÍÄ£×ÓÆÀ¹ÀÁ½¸ö½Ç¶È¾ÙÐÐÏÈÈÝ¡£

4.1 ÌØÕ÷¹¤³Ì

±¾¼Æ»®Ê¹ÓÃÌØÕ÷20¶à¸ö
£¬·ÖΪÁ½ÀࣺһÀàΪ¾­µäµÄ×Ö·û´®»³±§ÌØÕ÷
£¬ÀýÈ糤¶È¡¢ìØ¡¢×Ö·û±ÈÀýµÈ
£¬ÕâÀàÌØÕ÷¼òÆÓÓÐÓÃ£»Ò»ÀàΪNLP-nGramsÏà¹ØµÄÌØÕ÷¡£ÕâЩÌØÕ÷´ó´ó¶¼·´Ó¦ÁËÓ¦ÓÃʵ¼ùÖжÔÓòÃûµÄÒªÇó
£¬ÀýÈçSEO£¨ËÑË÷ÒýÇæÓÅ»¯£©½¨ÒéÁËÓòÃûµÄÀíÏ볤¶È£¨Ô¼Äª12-13¸ö×Ö·û£©
£¬ÒÔ¼°¾ßÓÐÒ׶Á¡¢Ò׼ǡ¢Ò×Èö²¥µÈÌصã¡£

±¾¼Æ»®¶Ôÿ¸öÌØÕ÷µÄÖ±·½Í¼ºÍÏà¶ÔÂþÑܾÙÐÐÁËÆÊÎö
£¬ÏÂÃæÁÙ²¿·ÖÌØÕ÷ÂþÑÜͼ¾ÙÐоÙÀýÆÊÎö¡£

ÓòÃû³¤¶È:

ÓòÃû³¤¶ÈÊÇÇø·ÖÕý³£ºÍDGAÓòÃûµÄÒ»¸öÖ÷ÒªÌØÕ÷
£¬´Óͼ3ÓòÃû³¤¶ÈÂþÑÜͼ¿ÉÒÔ¿´³öDGAÓòÃûµÄ³¤¶È¸ü³¤¡£

ÓòÃûìØ:

ìØ·´Ó¦ÁË×Ö·û´®µÄËæ»úÐÔ
£¬DGAÓòÃûÊÇÓÉËã·¨ÌìÉúµÄαËæ»ú×Ö·û´®
£¬ÆäËæ»úÐÔ¸úÕý³£ÓòÃûÏà±È¸ü¸ß¡£Í¼4ΪÕý³£ÓòÃûºÍDGAÓòÃûµÄìØÂþÑܱÈÕÕͼ¡£

ÓòÃû×Ö·ûתÒƸÅÂÊ:

×Ö·ûתÒƸÅÂÊ¿ÉÒÔ·´Ó¦ÓòÃûµÄ¿É¶ÁÐÔ
£¬Ê¹ÓÃÕý³£ÓòÃû»òÕßÓ¢ÎÄÓïÁÏͳ¼ÆN-GramµÄתÒƸÅÂÊ
£¬ÓÉÓÚDGAÓòÃû¸üËæ»ú
£¬ÆäN-GramתÒƸÅÂÊÓëÕý³£ÓïÁϲî±ð½Ï´ó¡£

×Ö·û±ÈÀý:

×Ö·û±ÈÀýÒ²ÊÇÇø·ÖÕý³£ÓòÃûºÍDGAÓòÃûµÄ³£ÓÃÌØÕ÷
£¬ËùÊö×Ö·û°üÀ¨Êý×Ö¡¢ÔªÒô×Öĸ¡¢×ÓÒô×ÖĸµÈ¡£

nGram:

±¾¼Æ»®ÖÐÅÌËãÁËnGram·ºÆð¸ÅÂÊÅÅÃûµÄƽ¾ùÖµºÍ·½²î
£¬»ù׼ΪӢÎÄÓïÁÏ
£¬ÓÉÓÚDGAÓòÃûµÄËæ»úÐÔ
£¬ÆäÓëÓ¢ÎÄÓïÁϲî±ð½Ï´ó
£¬Òò´ËÆänGram·ºÆð¸ÅÂʵÄÅÅÃû¸ü¿¿ºó¡£

4.2 Ä£×ÓÆÀ¹À

±¾¼Æ»®Ê¹ÓõÄѵÁ·Êý¾ÝȪԴÓÚ¹ûÕæÊý¾Ý¼¯
£¬Êý¾ÝÁ¿ÔÚ°ÙÍòÒÔÉÏ
£¬Ä£×Ó¼ì²âЧ¹ûÈçϱíËùʾ£º

±í2 Ä£×Ó¼ì²âЧ¹û

´ÓÉϱíµÄÊý¾Ý¿ÉÒÔ¿´³ö²î±ðËã·¨µÄ¼ì²âЧ¹û²î±ð²»´ó
£¬¼ì²âÂʾùµÖ´ï96%ÒÔÉÏ¡£

05 ºó¼Ç

Ïà½ÏÁ¿ºÚÃûµ¥·½·¨
£¬»ùÓÚ»úеѧϰµÄDGAÓòÃû¼ì²âÒªÁì¾ßÓÐÒ»¶¨µÄÓÅÊÆ
£¬µ«ÈÔÈ»ÐèҪƾ֤ÏÖÕæÏàÐξÙÐÐÓÅ»¯¡£±¾ÎÄÌá³öµÄDGAÓòÃû¼ì²â¼Æ»®Äܹ»µÖ´ï½ÏºÃµÄ¼ì²âЧ¹û
£¬¿ÉÊǼƻ®¶Ô»ùÓÚ´ÇÊéµÄDGAÓòÃû¼ì²âЧ¹ûÉÐÓÐÓÅ»¯¿Õ¼ä
£¬Õ⽫×÷ΪºóÐøÑо¿µÄÖصã£»ÁíÍâ
£¬±¾¼Æ»®ÊÇÕë¶ÔDGAÓòÃûºÍÕý³£ÓòÃû¾ÙÐеĶþ·ÖÀàÑо¿
£¬ºóÐøÎÒÃǽ«½øÒ»²½¶ÔDGA¼Ò×å¾ÙÐжà·ÖÀàÑо¿
£¬¾´Çë¹Ø×¢¡£

²Î¿¼ÎÄÏ×

[1]Patsakis,Constantinos,and FranCasino. "Hydras and IPFS: a decentralised playground for malware."International Journal of Information Security (2019): 1-13.

[2]K¨¹hrer M, Rossow C, Holz T (2014) Paint it black: evaluating the effectiveness of malware blacklists. In: RAID 2014: research in attacks, intrusions and defenses, June, pp 1¨C21. Springer International Publishing.

[3]Ahluwalia A, Traore I, Ganame K, Agarwal N (2017) Detecting broad length algorithmically generated domains. In: Intelligent, secure, and dependable systems in distributed and cloud environments, chap. 2, pp 19¨C34. Springer International Publishing.

[4]Truong D, Cheng G (2016) Detecting domain-flux botnet based on DNS traffic features in managed network. Security Communication Networks 9(14):2338¨C2347.

[5]Luo X, Wang L, Xu Z, Yang J, Sun M, Wang J (2017) DGASensor: fast detection for DGA-based malwares. In: 5th international conference on communications and broadband networking, pp 47¨C53.

[6]Bisio F, Saeli S, Lombardo P, Bernardi D, Perotti A, Massa D (2017) Real-time behavioral DGA detection through machine learning. In: 2017 international carnahan conference on security technology, pp 1¨C6.

[7]Pu Y, Chen X, Pu Y, Shi J (2015) A clustering approach for detecting auto-generated Botnet domains. In: Applications and techniques in information security, pp 269¨C279.

[8]Woodbridge J, Anderson HS, Ahuja A, Grant D (2016) Predicting domain generation algorithms with long short-term memory networks. CoRR abs/1611.0.

[9]Tran D, Mac H, Tong V, Tran HA, Nguyen LG (2018) A LSTM based framework for handling multiclass imbalance in DGA Botnet detection. Neurocomputing 275:2401¨C2413.

[10]Vinayakumar R, Soman K, Poornachandran P, Sachin Kumar S (2018) Evaluating deep learning approaches to characterize and classify the DGAs at scale. J Intell Fuzzy Syst 34(3):1265¨C1276.

°æȨÉùÃ÷

תÔØÇëÎñ±Ø×¢Ã÷À´ÓÉ¡£

°æȨËùÓÐ
£¬Î¥Õ߱ؾ¿¡£