基於語彙分析的Botnet惡意域名辨識

蔡勇嶢

3.238.70.175，Hello！

Close
Search Quick Search Advanced Search Publication Search	Personal Service Member Login Searching History Use Bonus Card SYMSKAN
Browse Browse by University of Graduate Thesis Browse by Pinyin of Graduate Thesis Browse by Conference Proceedings Topic Browse by Conference Proceedings Publisher Browse by Pinyin of Conference Proceedings Browse by eBook Category Browse by eBook Topic Browse by eBook Publisher
Customer Services Authorize Airiti Recommend a Journal

Search Symbol (Half-width)	Description of Search Symbols
Space	"AND" indicates the intertwining of key terms used in a search
Double Quotation Marks ("") ( " " )	Double quotation marks indicate the beginning and end of a phrase, and the search will only include terms that appear in the same order of those within the quotations. Example: "image process" ： " image process "
?	Indicates a variable letter. Entering two ? will indicate two variable letters, and so on. Example: "Appl?", search results will yield apple, apply… e , appl y … ( (often used to English word searches) )
*	Indicates an unlimited number of variable letters to follow, from 1~n. Example: Enter "appl*", search results will yield apple, apples, apply, applied, application…(often used in English word searches) e , appl es , appl y , appl ied , appl ication … ( (often used to English word searches) )
AND、OR、NOT	Boolean logic combinations of key words is a skill used to expand or refine search parameters. (1) AND (1) AND: Refines search parameters (2) OR (2) OR: Expands search parameters (3) NOT: Excludes irrelevant parameters

DOI stands for Digital Object Identifier （ D igital O bject I dentifier ） ,
and is the unique identifier for objects on the internet. It can be used to create persistent link and to cite articles.

Using DOI as a persistent link

To create a persistent link, add「http://dx.doi.org/」「 http://dx.doi.org/ 」 before a DOI.
For instance, if the DOI of an article is 10.5297/ser.1201.002 , you can link persistently to the article by entering the following link in your browser: http://dx.doi.org/ 10.5297/ser.1201.002 。
The DOI link will always direct you to the most updated article page no matter how the publisher changes the document's position, avoiding errors when engaging in important research.

Cite a document with DOI

When citing references, you should also cite the DOI if the article has one. If your citation guideline does not include DOIs, you may cite the DOI link.

DOIs allow accurate citations, improve academic contents connections, and allow users to gain better experience across different platforms. Currently, there are more than 70 million DOIs registered for academic contents. If you want to understand more about DOI, please visit airiti DOI Registration （ doi.airiti.com ）。

Data Source

College of Business > Graduate School of Information Management
Social Sciences > Management

Bibliography Management Tool

Related Links

Report an Issue

Purchase Single Articles

Download PDF

基於語彙分析的Botnet惡意域名辨識

Identification of Botnet domain name base on lexical feature

蔡勇嶢 , Masters　　Advisor：曾俊元　　

繁體中文

僵屍網路；機器學習；語彙分析； Botnet ； Machine learning ； Lexical analysis

Abstract │ Reference (32) │ Altmetrics

Abstract 〈TOP〉

Parallel Abstract 〈TOP〉

Personal computer computation power and connection capability dramatically increase such that personal computers becomes malicious attack major targets instead of traditional servers. By using worms and Trojan horses infecting victim personal computers, attackers establish their Botnets, which remote control victims performing malicious activities in order to make money and thus become major Internet threats. Encryption and domain fluxing become current major evading techniques for Botnet. In order to defend Botnet, DNS black list is one of the most effective defensive strategies to hidden Botnet connections. Therefore, effectively identifying malicious domain names is a critical issue for Botnet detection. This paper presents lexical analysis approach to find domain name different patterns, and adopts decision tree models to train the best combination of malicious domain name lexical features.
We propose five major features: domain length, syllable count, vowel count, vowel ratio, character redundant. Experiment results show vowel ratio and vowel count can effectively differentiate black and white list samples while cross comparing them. While calculating false positive and negative rates, the combination of vowel ratio and vowel count provides the best results, 0.01% false positive rate and 4.3 % false negative rate, which show our approach can effectively identify malicious domain names.

Reference ( 32 ) 〈TOP〉

Alexa the web information company. (2012), from http://www.alexa.com/
連結：
Bensoussan, A., Kantarcioglu, M., & Hoe, S. C. (2010). A game-theoretical approach for finding optimal strategies in a botnet defense model. Decision and Game Theory for Security, 135-148.
連結：
Kohavi, R. (1995). A study of cross-validation and bootstrap for accuracy estimation and model selection. Paper presented at the International joint conference on Artificial intelligence (IJCAI).
連結：
Lee, J. S., Jeong, H. C., Park, J. H., Kim, M., & Noh, B. N. (2008). The activity analysis of malicious http-based botnets using degree of periodic repeatability. Paper presented at the Security Technology (SECTECH).
連結：
Li, Z., Liao, Q., & Striegel, A. (2009). Botnet economics: uncertainty matters. Managing Information Risk and the Economics of Security, 245-267.
連結：

Altmetrics

〈TOP〉

E-mail ：

When an article is available to download, a notice will be sent to your mailbox address.

E-mail ：