| 本文已被：浏览 4921次 下载 7830次 |
码上扫一扫！ |
|
|
| 基于词素特征的轻量级域名检测算法 |
|
张维维1,2, 龚俭1,2, 刘茜1,2, 刘尚东1,2, 胡晓艳1,2
|
|
1.东南大学 计算机科学与工程学院, 江苏 南京 210096;2.江苏省计算机网络重点实验室, 江苏 南京 210096
|
|
| 摘要: |
| 对网络中DNS交互报文进行检测以发现恶意服务，是网络安全监测的一个重要手段，这种检测往往要求系统能够实时或准实时地发现监测域名中的可疑对象.面对庞大的域名集合，若对所有域名使用同样强度的监测通常开销过大.通过挖掘域名字面蕴含的词素（词根、词缀、拼音及缩写）特征，提出一种轻量级检测算法，能够快速锁定可疑域名，以便后续有针对性地进行DPI检测.实验结果表明：基于词素特征的检测算法比统计n元组频率分布的方法虽然略微增加了58.3%的内存开销，但却具备抗逃避能力以及更高的准确率（相对提高35.2%）；与基于单词特征的方法相比，极大地降低了计算复杂度（相对降低64.8%），并减少了2.6%的内存开销，而准确率仅下降2.5%. |
| 关键词: 网络安全监测 域名检测 词素 字符串切分 C4.5分类器 |
| DOI：10.13328/j.cnki.jos.004913 |
| 分类号: |
| 基金项目:国家自然科学基金（60973123）；国家科技支撑计划（2008BAH37B04）；国家重点基础研究发展计划（973）（2009CB320505）； |
|
| Lightweight Domain Name Detection Algorithm Based on Morpheme Features |
|
ZHANG Wei-Wei1,2, GONG Jian1,2, LIU Qian1,2, LIU Shang-Dong1,2, HU Xiao-Yan1,2
|
|
1.School of Computer Science and Engineering, Southeast University, Nanjing 210096, China;2.Jiangsu Provincial Key Laboratory of Computer Network Technology, Nanjing 210096, China
|
| Abstract: |
| Detecting malicious services via inspecting the content of DNS packets is a common way to network security monitoring. Such a work often requires quasi real time ability to find suspects among the huge collected domain names, which is costly in processing resources. This work proposes a lightweight algorithm based on the morpheme features (root, affix, Chinese spelling and special noun abbreviation) of domain names to quickly identify the suspects for targeted DPI detection. Compared with algorithms based on n-tuple frequency distribution measurement, the proposed one is proved to have stronger anti-interference ability and better detection accuracy by 35.2% higher while only 58.3% memory overhead increasing. While compared with the methods based on word features, this lightweight algorithm can cut 64.8% of computation complexity and 2.6% memory overhead down with only 2.5% accuracy reduction. |
| Key words: network security monitoring domain name detection morphemes string segmentation C4.5 classifier |
