关键词: 恶意域名检测, 交互感知网络, 卷积神经网络, 门控循环神经网络, 元学习训练策略

Abstract: Quickly locating and accurately detecting malicious access requests in the domain name system has significant research value for ensuring network information security and economic security. A fewshot malicious domain name detection method based on an interlayer interaction perception attention network is proposed. First, a dualbranch network support branch and query branch are established using a metalearning training strategy. In the support branch, convolutional neural networks Vgg16 and GRU (gated recurrent unit) are used to extract the encoding features of domain names in temporal and spatial dimensions, respectively. Then, to promote information interaction between features of different dimensions, crossattention with temporal features is established at each layer in the spatial dimension. Finally, by calculating the similarity metric between query encoding features and interaction features, the legitimacy of the domain name to be tested can be quickly determined. Through testing on opensource malicious domain name datasets and fewshot family malicious domain name datasets, the results show that the proposed method can achieve 0.9895 detection precision in the binary classification task of normal domain names and malicious domain names, and 0.9682 average detection precision on 20 fewshot family malicious domain name datasets, which is superior to current classical malicious domain name detection methods.

Key words: malicious domain name detection, interaction perception, convolutional neural network, gated recurrent neural network, metalearning training strategy