文献类型：期刊文献

英文题名：Detecting domain generation algorithms based on reinforcement learning

作者：Cheng, Hua[1]; Fang, Yiquan[1]; Chen, Lihuang[1]; Cai, Jing[1]

机构：[1] School of Information Science and Engineering, East China University of Science and Technology, Shanghai, China

年份：2019

起止页码：261

外文期刊名：Proceedings - 2019 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery, CyberC 2019

收录：EI(收录号：20200608122286)

语种：英文

外文关键词：Sampling - Statistical tests - Chemical detection - Long short-term memory - Malware

摘要：Ransomwares spread rapidly over the past two years, which poses great security threats to users. DGA domain name detection is one of the key technologies in detecting ransomwares. Existing detection methods are usually based on machine learning, which needs large amounts of training data. However, it is difficult to collect enough training samples for a specific DGA family in a short time, and few training samples would lead to overfitting of the detection model. A LSTM DGA generation model can obtain a lot of new data learned from few real DGA samples. Reinforcement Learning guides this LSTM generation model to be improved by evaluating its generated domain name, which is proposed as RL-LSTM DGA generation model. In experiments, a DGA domain name detection model (ATT-GRU model) trained by the generated DGAs, is used to compute accuracies of real DGAs (as test dataset) to assess the validity of generated domain names. Experiments show that the distribution of generated DGAs is sufficiently close to real DGAs, and can play an alternative role of real DGAs in detection model training. ? 2019 IEEE.