Abstract:Malicious domains pose a severe threat to cybersecurity. As to improve the detection accuracy when the malicious domain variants increase, we proposed a novel malicious domain detection method named MDND‐SS‐PO that combines semi‐supervised learning and parameter optimization. The method extracts the statistical features of the IP address, TTL value, the NXDomain record, and the domain name query characteristics to discriminate Domain‐Flux and Fast‐Flux domain names simultaneously. And an improved DBSCAN based on the neighborhood division is applied semi‐supervised learning with less label efforts. Finally, Gaussian process regression is used to optimize parameter settings of machine learning algorithms. Experimental results show that the proposed method achieved a precise detection performance of 0.885 when the ratio of labeled data is 5%. Malicious domains provide malware with covert communication channels which poses a severe threat to cybersecurity. Despite the continuous progress in detecting malicious domains with various machine learning algorithms, maintaining up‐to‐date various samples with fine‐labeled data for training is difficult. To handle these issues and improve the detection accuracy, a novel malicious domain detection method named MDND‐SS‐PO is proposed that combines semi‐supervised learning and parameter optimization. The contributions of the study are as follows. First, the method extracts the statistical features of the IP address, TTL value, the NXDomain record, and the domain name query characteristics to discriminate Domain‐Flux and Fast‐Flux domain names simultaneously. Second, an improved DBSCAN based on the neighborhood division is designed to cluster labeled data and unlabeled data with low time consumption. Then, based on the clustering hypothesis, unlabeled data is tagged with pseudo‐label according to the cluster results, which aims to train a supervised classifier effectively. Finally, Gaussian process regression is used to optimize parameter settings of the algorithm. And the Silhouette index and F1 score are introduced to evaluate the optimization results. Experimental results show that the proposed method achieved a precise detection performance of 0.885 when the ratio of labeled data is 5%.

Labeling malicious communication samples based on semi-supervised deep neural network

A Method of Few-Shot Network Intrusion Detection Based on Meta-Learning Framework

A Hybrid Deep Learning Model for Malicious Behavior Detection

HTTPSmell: A Deep Learning Approach on Malicious HTTP Traffic Detection via Data Augmentation and Label Refactoring

Analysis and Detection against Network Attacks in the Overlapping Phenomenon of Behavior Attribute

A Novel Malware Traffic Classification Method Using Semi-Supervised Learning.

Research on Adversarial Sample Detection Method Based on Image Similarity

Malicious domain detection based on semi‐supervised learning and parameter optimization

A Malicious Domain Detection Model Based on Improved Deep Learning

Task-Aware Meta Learning-based Siamese Neural Network for Classifying Obfuscated Malware

A lightweight model design approach for few-shot malicious traffic classification

A Novel Wireless Network Intrusion Detection Method Based on Adaptive Synthetic Sampling and an Improved Convolutional Neural Network

Deep Learning for Malicious Flow Detection

A Hybrid Deep Network Framework for Android Malware Detection

BoAu: Malicious Traffic Detection with Noise Labels Based on Boundary Augmentation

Network Intrusion Detection Model Based on Improved BYOL Self-Supervised Learning

Semi-Fragile Neural Network Watermarking Based on Adversarial Examples

An Efficient Deep Unsupervised Domain Adaptation for Unknown Malware Detection

Not All Samples Are Born Equal: Towards Effective Clean-Label Backdoor Attacks

Few-Shot Malware Classification via Attention-Based Transductive Learning Network

LSD: Adversarial Examples Detection Based on Label Sequences Discrepancy