Domain name recognition method and device, domain name recognition model generation method and device and storage medium

Abstract

The embodiment of the invention discloses a domain name recognition method and device, a domain name recognition model generation method and device and a storage medium, relates to the technical fieldof networks, the method comprises the following steps of: obtaining a one-dimensional ordered vector corresponding to the domain name to be classified, wherein the one-dimensional ordered vector comprises a number obtained by performing character-number conversion on the domain name to be classified; according to the one-dimensional ordered vector and a preset neural network model, determining adetection value of the to-be-classified domain name, the neural network model comprising a neural network model which is trained according to a preset loss function and an optimization algorithm and satisfies a preset condition, comparing the detection value with a specified intermediate value, and determining a detection result of the to-be-classified domain name according to a comparison result.Through the embodiment of the invention, the recognition accuracy can be improved.

Description

technical field [0001] This specification relates to the field of network technologies, and in particular, to a method, device and storage medium for domain name identification and domain name identification model generation. Background technique [0002] Domain Name Generation Algorithm, or DGA for short, is a technical method that uses random characters to generate C&C domain names, thereby evading domain name blacklist detection. Attackers usually choose efficient domain name generation algorithms, and can generate a large number of C&C domain names in one day. However, the existing blacklist technology can only exclude existing illegal domain names, but cannot exclude newly generated illegal domain names, so the identification accuracy rate is low and cannot meet the existing domain name detection requirements. [0003] At present, the traditional manual identification method is based on the observation and summary of people with certain professional knowledge and exper...

AI Technical Summary

Problems solved by technology

However, the existing blacklist technology can only exclude existing illegal domain names, but cannot exclude newly generated illegal domain names, so the recognition accuracy is low and cannot meet the existing domain name detection requirements

[0003] At present, the traditional manual identification method is based on the observation and summary of people with certain professional knowledge and experience in the security field. However, the DGA algorithm used by hackers can be any kind of transcoding, encryption or random rule algorithm, and such There are many types of algorithms. If the characteristics are summarized only through the result samples of the existing DGA algorithm, there are great limitations, the recognition effect is not ideal, and the recognition accuracy is low.

[0004] Existing non-neural network methods often first need to segment the domain name sample set according to the word segmentation rules to obtain the word segmentation set, and then obtain the recognition result based on the word segmentation set. However, the method of establishing the word segmentation set according to the word segmentation rules has a certain impact on subsequent recognition effects , leading to low recognition accuracy

[0005] The existing fully connected neural network does not have short-term memory characteristics and cannot predict data sequences, resulting in low recognition accuracy

[0006] It can be seen from the above that none of the existing domain name recognition methods can achieve high recognition accuracy

Images