Journal of Software:2016.27(9):2348-2364

(东南大学 计算机科学与工程学院, 江苏 南京 210096;江苏省计算机网络重点实验室, 江苏 南京 210096)
Lightweight Domain Name Detection Algorithm Based on Morpheme Features
ZHANG Wei-Wei,GONG Jian,LIU Qian,LIU Shang-Dong,HU Xiao-Yan
(School of Computer Science and Engineering, Southeast University, Nanjing 210096, China;Jiangsu Provincial Key Laboratory of Computer Network Technology, Nanjing 210096, China)
Chart / table
Similar Articles
Article :Browse 1609   Download 2817
Received:October 11, 2014    Revised:March 02, 2015
> 中文摘要: 对网络中DNS交互报文进行检测以发现恶意服务,是网络安全监测的一个重要手段,这种检测往往要求系统能够实时或准实时地发现监测域名中的可疑对象.面对庞大的域名集合,若对所有域名使用同样强度的监测通常开销过大.通过挖掘域名字面蕴含的词素(词根、词缀、拼音及缩写)特征,提出一种轻量级检测算法,能够快速锁定可疑域名,以便后续有针对性地进行DPI检测.实验结果表明:基于词素特征的检测算法比统计n元组频率分布的方法虽然略微增加了58.3%的内存开销,但却具备抗逃避能力以及更高的准确率(相对提高35.2%);与基于单词特征的方法相比,极大地降低了计算复杂度(相对降低64.8%),并减少了2.6%的内存开销,而准确率仅下降2.5%.
Abstract:Detecting malicious services via inspecting the content of DNS packets is a common way to network security monitoring. Such a work often requires quasi real time ability to find suspects among the huge collected domain names, which is costly in processing resources. This work proposes a lightweight algorithm based on the morpheme features (root, affix, Chinese spelling and special noun abbreviation) of domain names to quickly identify the suspects for targeted DPI detection. Compared with algorithms based on n-tuple frequency distribution measurement, the proposed one is proved to have stronger anti-interference ability and better detection accuracy by 35.2% higher while only 58.3% memory overhead increasing. While compared with the methods based on word features, this lightweight algorithm can cut 64.8% of computation complexity and 2.6% memory overhead down with only 2.5% accuracy reduction.
文章编号:     中图分类号:    文献标志码:
基金项目:国家自然科学基金(60973123);国家科技支撑计划(2008BAH37B04);国家重点基础研究发展计划(973)(2009CB320505); 国家自然科学基金(60973123);国家科技支撑计划(2008BAH37B04);国家重点基础研究发展计划(973)(2009CB320505);
Foundation items:National Natural Science Foundation of China (60973123); State Scientific and Technological Support Plan Project of China (2008BAH37B04); National Basic Research Program of China (973) (2009CB320505)
Reference text:


ZHANG Wei-Wei,GONG Jian,LIU Qian,LIU Shang-Dong,HU Xiao-Yan.Lightweight Domain Name Detection Algorithm Based on Morpheme Features.Journal of Software,2016,27(9):2348-2364