期刊
出版社
ASSOC COMPUTING MACHINERY
DOI: 10.1145/3322645.3322679
关键词
Fast-Flux service network; CDN; LSTM
资金
- National Natural Science Foundation of China [U1736218]
- National Key R&D Program of China [2018YFC0806900]
- Beijing Engineering Laboratory of Vehicle Network Security Simulation, Attack and Defense Technology, Beijing Municipal Commission of Development Reform
Fast-Flux(FF) service network is one of the common technical means for network malicious behavior (such as phishing websites, spam, botnets, etc.) to avoid attack. Through the rapid change of answered IP addresses of the required domain name, Fast-Flux can avoid being isolated by IP blacklist and improve the availability of its services. Due to the use of Content Distribution Network (CDN) and circular DNS technology, some normal network services have similar characteristics. Differentiation between FF domain name and CDN domain name is one of the key problems in FF domain name detection. For the problems that manual extraction of FF features is complex and is easy to be deliberately bypass by the FF designer, this paper proposes a method called Fast-flux and CDN Domains Recognizer (FCDR) to self-learning FF and CDN features and recognition them based on LSTM network. By learning the domain names' resolved results collected at different times in different areas, the FCDR can classify and identify Fast Flux domain name, CDN domain name, other malicious domain names and common non-CDN domain name more accurately.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据