DGA-Based Botnet Detection Toward Imbalanced Multiclass Learning

作     者：Yijing Chen Bo Pang Guolin Shao Guozhu Wen Xingshu Chen Yijing Chen;Bo Pang;Guolin Shao;Guozhu Wen;Xingshu Chen

作者机构：College of CybersecuritySichuan UniversityChengdu 610065China Cybersecurity Research InstituteSichuan UniversityChengdu 610065China 

出 版 物：《Tsinghua Science and Technology》 (清华大学学报（自然科学版（英文版）)

年 卷 期：2021年第26卷第4期

页      面：387-402页

核心收录：

学科分类：12[管理学] 1201[管理学-管理科学与工程(可授管理学、工学学位)] 081104[工学-模式识别与智能系统] 0839[工学-网络空间安全] 08[工学] 0835[工学-软件工程] 0811[工学-控制科学与工程] 0812[工学-计算机科学与技术（可授工学、理学学位）] 

基　　金：partially funded by the National Natural Science Foundation of China (No. 61272447) the National Entrepreneurship&Innovation Demonstration Base of China (No. C700011) the Key Research&Development Project of Sichuan Province of China (No.2018G20100) 

主　　题：botnet Domain Generation Algorithm(DGA) multiclass imbalance resampling 

摘      要：Botnets based on the Domain Generation Algorithm(DGA) mechanism pose great challenges to the main current detection methods because of their strong concealment and robustness. However, the complexity of the DGA family and the imbalance of samples continue to impede research on DGA detection. In the existing work, the sample size of each DGA family is regarded as the most important determinant of the resampling proportion;thus,differences in the characteristics of various samples are ignored, and the optimal resampling effect is not *** this paper, a Long Short-Term Memory-based Property and Quantity Dependent Optimization(***)method is proposed. This method takes advantage of LSTM to automatically mine the comprehensive features of DGA domain names. It iterates the resampling proportion with the optimal solution based on a comprehensive consideration of the original number and characteristics of the samples to heuristically search for a better solution around the initial solution in the right direction;thus, dynamic optimization of the resampling proportion is *** experimental results show that the *** method can achieve better performance compared with existing models to overcome the difficulties of unbalanced datasets;moreover, it can function as a reference for sample resampling tasks in similar scenarios.