Classification of Malicious DGA Domain Name Families Based on BiGRU and Attention Mechanisms

With the rapid development of the Internet, network security has become an important issue in the field of information technology. Malicious domain generation algorithms (DGA) are a key component in cyberattacks, and their dynamic domain names can be used to bypass traditional security measures and pose a threat to network security. To address this challenge, this dissertation proposes a new approach based on the Bidirectional Gate Recurrent Unit (BiGRU) model combined with an attention mechanism for categorizing malicious DGA domain name families. First, we use the BiGRU model to capture the sequence information in a domain name, which can effectively capture the dependencies between domain characters. Then, we introduce an attention mechanism so that the model can automatically focus on the key information relevant to the classification task. This mechanism not only improves the model's classification performance but also makes it more interpretive and able to highlight characters that play a key role in classification. To validate the effectiveness of our approach, we use an extensive dataset containing multiple malicious DGA domain families and normal domains. Experimental results show that our proposed method performs well in the malicious DGA domain name family classification task, with higher accuracy and robustness relative to traditional methods.