.png){kind=icon}
返回
A Game-Based Adversarial DGA Detection Scheme Using Multi-Level Incremental Random Forest
.png){kind=icon}
PRE
AI
DOI：10.1109/TNSE.2023.3308126.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Security vendors can take down botnets by detecting the malicious domain names crafted by attackers. However, the adversarial Domain Generation Algorithms (DGAs) greatly challenge the existing domain detection schemes, in particular, adversarial DGAs can actively compromise arbitrarily specified domain detection systems by crafting the adversarial domain names. To resist adversarial DGAs, we propose a game theory-based defending strategy, which launches adversarial DGA and trains an incremental domain detector alternately. While we find the game-based strategy cannot achieve the expected detection accuracy due to two problems: the failure of incremental training and the problem of the catastrophic forgetting. To this end, we propose a multi-level incremental random forest model, which settles the above problems by splitting the leaf nodes of the decision trees and increasing the levels of the original random forest. The experimental results on the real-life dataset demonstrate the proposed detection method significantly outperforms the competing schemes when detecting adversarial DGAs (improves the detection AUC by 42%) and presents comparable performance when defending against non-adversarial DGAs.
Keyword:
Detectors
Games
Training
Reliability
Chatbots
Servers
Radio frequency
Malicious domain name detection
incremental learning
adversarial domain generation algorithm
期刊
I
IF:
7.9
论文数:
2.5K
被引数:
10.0K
机构
引用论文
THE MEANING AND USE OF THE AREA UNDER A RECEIVER OPERATING CHARACTERISTIC (ROC) CURVE受试者工作特征 (ROC) 曲线下面积的含义和用途.png)
RADIOLOGY
RADIOLOGYIF15.2
PREAI
分享收藏
Detecting Algorithmically Generated Domain-Flux Attacks With DNS Traffic Analysis通过DNS流量分析检测算法生成的域流量攻击
PREAI
分享收藏
查看更多内容