A Malicious Domain Name Detection Method Based on Knowledge Graph

Abstract

The invention discloses a method for detecting a malicious domain name based on a knowledge graph, which includes the following steps: S1. According to the characteristics of the domain name information, extract the key features used to construct the domain name reputation knowledge graph; S2. Use the obtained existing data to integrate information to provide data sources for the creation of knowledge graphs; the data amplifies domain name knowledge through the knowledge graph construction engine; the knowledge graph construction engine uses the obtained domain name data to construct domain name reputation knowledge graphs; S3. The multi-source information and multi-method judgment model gives the prediction result. The present invention has the following advantages: 1. The dimension of domain name information is richer, and the information contained is more complete; 2. It can better cope with the explosive growth of domain name data, and the construction of knowledge graph can process massive data more quickly; 3. Domain name information and behavior patterns form a relational network, and the sensitivity of the knowledge graph to the relational network is used to deeply mine the information in the relational network.

Description

technical field [0001] The present invention relates to the technical field of network security, and more specifically, to a method for detecting malicious domain names based on knowledge graphs. Background technique [0002] In recent years, network security has become a hot spot of concern, and the methods of network attacks are also developing towards diversification, scale, complexity, and persistence. The domain name system provides domain name to IP resolution services for the modern Internet, which is the key to the normal operation of the network. infrastructure. Due to the criticality and vulnerability of the domain name system, the domain name system has become an ideal attack target for many attackers and is facing very serious security threats. In particular, malicious domain names are the carrier of attackers' attacks, and the number and threats are gradually increasing. For example, phishing URLs used by phishing websites, C&C servers used by malware for commu...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the problem that the existing static blacklist strategy cannot be flexibly expanded, the present invention provides a malicious domain name detection method based on knowledge graph, which includes the following steps:

Images