Research on DGA Domain Name Detection Under The Condition of Unbalanced Sample Ratio

In view of the fact that the existing malicious domain name detection methods do not fully consider the imbalance between the positive and negative samples of DGA (Domain Generation Algorith, DGA) domain names and legitimate domain name data in actual network traffic, in this paper, a loss-sensitive attention BiLSTM classification model is designed based on the Bidirectional Long Short-Term Memory (BiLSTM) network, use the cost-sensitive class function Focal Loss function as the model loss function to make the model more focused on a small number of difficult-to-classify samples during training and optimization. At the same time, a self-attention mechanism is introduced to calculate the similarity between different characters to mine the internal correlation features of the sequence and improve the performance of the model on long-distance dependency problems. Experiments show that compared with the comparison model, the recall rate, precision rate, F1 value and other evaluation indicators on different scale data sets have improved by 2%-23%, and can effectively identify DGA domain names under the condition of different proportions of positive and negative samples.