• 中国计算机学会会刊
  • 中国科技核心期刊
  • 中文核心期刊

Computer Engineering & Science

Previous Articles     Next Articles

A DGA domain name detection method based on Transformer

ZHANG Xin,CHENG Hua,FANG Yi-quan   

  1. (School of Information Science and Engineering,East China University of Science and Technology,Shanghai 200237,China)
     
  • Received:2019-04-30 Revised:2019-10-12 Online:2020-03-25 Published:2020-03-25

Abstract:

Existing DGA detection methods have achieved high detection accuracy, but there is a problem of high false alarm rate in abbreviated domain names. The main reason is that the abbreviated domain names have high randomness among characters and it is difficult for the existing detection methods to distinguish abbreviated domain names from DGA domain names. After analyzing the character characteristics of the abbreviated domain names, the detection of domain name character dependence is realized based on self-attention mechanism. Then, LSTM is used to improve the encoding way of Transformer model to better capture the location information of characters in domain names. A DGA domain name detection method (MHA) is constructed based on Transformer model. Experimental results show that the algorithm can effectively distinguish DGA domain names from abbreviated domain names, and get higher accuracy and lower false alarm rate.

 

 

 
 

Key words: abbreviated domain name, transformer model, self-attention mechanism, character dependence