关键词: 可读DGA域名, 轻量级保留网络, 轻量级卷积前馈网络, 多尺度保留, 全局语义特征

Abstract: To address the limitations of existing domain name detection models in identifying readable DGA (domain generation algorithm) malicious domains, a convolutional retentive network (CRNet) for detecting such domains is proposed. Firstly, the lightweight retentive network (LRN) is introduced to capture the global semantic features of domain name strings and explore the contextual differences between readable DGA domains and legitimate domains. The multi-scale retention (MSR) mechanism captures shallow semantic information, while the lightweight convolutional feed forward network (LCFFN) is designed to extract deeper features. By incorporating depthwise separable convolution (DSC) between two linear layers in the feed forward network (FFN), feature extraction is optimized, and the Delight transformation module reduces dimensionality, addressing the issue of redundancy between adjacent layers in the FFN. Additionally, a convolutional neural network (CNN) captures character combination features within domain name strings. By combining LRN and CNN, the model effectively leverages both global semantic features and local character combinations, improving the detection of readable DGA domains. Experiments on the Majestic Million legitimate domain dataset and the 360 DGA malicious domain dataset demonstrate that CRNet enhances detection efficiency, achieving F1-Score improvements of 0.59%-3.48% for readable DGA domains and 0.32%-1.42% for random DGA domains compared to state-of-the-art models.

Key words: readable DGA domain names, lightweight retentive network, lightweight convolutional feed forward network, multi-scale retention, global semantic features