基于集成的DNS盗用检测特征选择与分类模型
Ensemble-based Feature Selection and Classification Model for DNS Typo-squatting Detection
摘要：
域名系统（DNS）在当前基于IP的Internet体系结构中扮演着重要的角色。这是因为它执行域名到IP的解析。然而，DNS协议由于缺乏数据完整性和源认证而存在一些安全漏洞，本文重点研究了其中一个特殊的安全漏洞，即拼写抢注。抢注是指注册一个与现有流行品牌极其相似的域名，目的是将用户重定向到恶意/可疑网站。抢注的危险在于它可能导致信息威胁、企业机密泄露，并可能促进欺诈。本文在文献[1]中提出的基于多数投票的分类器的基础上，提出了一种基于集合的特征选择和装袋分类模型来检测DNS抢注攻击。实验结果表明，该框架实现了高准确性和精度在识别恶意/可疑的拼写抢注域（损失最多1.5%的准确性和5%的精度相比，使用完整的特征集的模型），同时具有较低的计算复杂性，由于较小的特征集（减少超过50%的特征集大小）。
英文摘要：
Domain Name System (DNS) plays in important role in the current IP-based Internet architecture. This is because it performs the domain name to IP resolution. However, the DNS protocol has several security vulnerabilities due to the lack of data integrity and origin authentication within it. This paper focuses on one particular security vulnerability, namely typo-squatting. Typo-squatting refers to the registration of a domain name that is extremely similar to that of an existing popular brand with the goal of redirecting users to malicious/suspicious websites. The danger of typo-squatting is that it can lead to information threat, corporate secret leakage, and can facilitate fraud. This paper builds on our previous work in [1], which only proposed majority-voting based classifier, by proposing an ensemble-based feature selection and bagging classification model to detect DNS typo-squatting attack. Experimental results show that the proposed framework achieves high accuracy and precision in identifying the malicious/suspicious typo-squatting domains (a loss of at most 1.5% in accuracy and 5% in precision when compared to the model that used the complete feature set) while having a lower computational complexity due to the smaller feature set (a reduction of more than 50% in feature set size).
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
