Malicious DNS traffic detection based neural networks - SHAN Kangkang; YUAN Shuhong; CHEN Wenzhi; WANG Zhibo (Tongxin xuebao)
To solve the problems of low detection accuracy and speed caused by low efficiency in extracting traffic features using machine learning to detect malicious DNS traffic, a malicious DNS traffic detection method FDS-DL was proposed, which combines frequency domain feature aggregation analysis and neural networks algorithms. Firstly, DNS traffic was converted from time-domain space to frequency-domain space through discrete Fourier transform, which could significantly compress the data scale while retaining key log information. Then, convolutional neural network was used to classify the processed frequency domain sequence data. The experimental results show that compared with several mainstream detection methods, FDS-DL has a higher accuracy in identifying malicious DNS traffic and F1_score is optimal.