关键词: DGA域名检测, 特征融合, 端到端, 长短记忆神经网络, 卷积神经网络

Abstract: Statistical feature-based DGA domain name detection methods relies on complex feature engineering， while the existing end-to-end deep learning methods perform poorly in the multi-classification tasks. To address these problems， a DGA domain name detection method combining attention mechanisms and parallel hybrid networks is proposed. Firstly, deep pyramid convolutional neural networks is introduced to extract deep semantic information of domain names, and DPCNN-SE is proposed by improving DPCNN using the channel attention block called SENet, which can learn inter-channel relationships adaptively and suppress the transmission of useless features. Meanwhile, the self-attention mechanism and the bidirectional long short-term memory network are combined to construct the BiLSTM-SA network to capture the most representative global temporal features in domain name data. Finally, the features extracted by the two networks are fused and fed into the softmax layer to output the classification results. The experimental results show that the method increases the F1-score by 10.30 percentage points and 10.18 percentage points in the multi-classification task of domain name family compared with the single model of CNN and LSTM， respectively; the F1-score increases by 5.97 percentage points and 4.87 percentage points， respectively， compared with the existing hybrid model method Bilbo and BiGRU-MCNN， and has lower computational complexity.

Key words: DGA domain name detection, feature fusion, end-to-end, long short-term memory neural network, convolutional neural network