TITLE:
User Station Security Protection Method Based on Random Domain Name Detection and Active Defense
AUTHORS:
Hongyan Yin, Xiaokang Ren, Jinyu Liu, Shuo Zhang, Wenkun Liu
KEYWORDS:
User Station, Random Domain Name Detection, Capsule Network, Active Defense, Long Short Term Memory
JOURNAL NAME:
Journal of Information Security,
Vol.14 No.1,
January
29,
2023
ABSTRACT: The
power monitoring system is the most important production management system in
the power industry. As an important part of the power monitoring system, the
user station that lacks grid binding will become an important target of network
attacks. In order to perceive the network attack events on the user station
side in time, a method combining real-time detection and active defense of
random domain names on the user station side was proposed. Capsule network (CapsNet)
combined with long short-term memory network (LSTM) was used to classify the
domain names extracted from the traffic data. When a random domain name is
detected, it sent instructions to routers and switched to update their security
policies through the remote terminal protocol (Telnet), or shut down the service interfaces of routers and
switched to block network attacks. The experimental results showed that the use of CapsNet
combined with LSTM classification algorithm can achieve 99.16% accuracy and 98%
recall rate in random domain name detection. Through the Telnet protocol,
routers and switches can be linked to make active defense without interrupting
services.