基于群卷积神经网络的恶意域名检验方法

针对恶意域名检测中存在的随机性大、现实样本少的缺陷，导致深度学习模型训练易出现过拟合的问题，提出了一种基于群卷积神经网络的恶意域名检测方法。首先将域名转换为嵌入词向量表示，然后通过随机维度组合生成随机数据集并构建卷积神经网络组，鉴于Inception结构优势将其加入到网络中，最后针对数据集易出现的类间样本失衡问题，引入了类间平衡系数以抑制模型训练过拟合，提高模型泛化能力。实验结果表明，在采集的域名检测数据集上，所构建的模型能够有效实现恶意域名检测；经过参数优化，相比于浅层模型组合分类器与典型深度神经网络模型LSTM-CNN，群卷积神经网络对所构建的域名检测集检测准确率分别提升了4%、1%，达到98.9%。

Design of malicious domain name inspection method based on group convolutional neural network

The defects of large randomness and few actual samples in the detection of malicious domain names would lead to the overfitting in deep learning model training. A malicious domain name detection method based on group convolutional neural network is proposed. Firstly, the domain name is converted into embedded word vector representation; secondly, a random data set is generated through a combination of random dimensions and convolutional neural network groups are constructed. The Inception structure is added to the network due to its advantages. For the imbalance problem of the inter-class samples, the inter-class balance coefficient is introduced to suppress the model training overfitting and improve the model generalization ability. The experimental results show that the constructed model can effectively detect malicious domain names on the collected domain name detection data set; after parameter optimization, the group convolutional neural network improves the detection accuracy of the constructed domain name detection set by 4% and 1% respectively compared with the shallow model combination classifier and the typical deep neural network model Long Short-Term Memory Convolutional Neural Network(LSTM-CNN), which reaches 98.9%.