Domain name graph embedding representation analysis method and device based on analytic relationship

Abstract

The invention relates to a domain name graph embedding representation analysis method and device based on an analytic relationship. The method comprises the following steps: acquiring DNS resolution data, and obtaining a domain name resolution relationship; mapping the domain name-IP-AS network graph data to a weighted undirected domain name relation graph reflecting the association strength between domain names by using a domain name resolution relation; traversing domain name vertexes in the domain name relation graph, and marking domain name labels hitting a blacklist as malicious domain names; and training and obtaining the embedding representation of each node in the domain name relation graph by utilizing a domain name graph embedding algorithm based on the domain name resolution relation and the label information of the malicious domain name. According to the domain name graph embedding representation analysis method, a domain name graph embedding algorithm based on an analytic relationship is adopted, and the adjustment effect of malicious domain name label information on the random walk direction is introduced, so that a more effective node sequence is provided for training node embedding, a more accurate domain name graph embedding expression result is obtained, the complexity of a downstream algorithm is reduced, and the calculation efficiency is improved.

Description

technical field [0001] The invention belongs to the fields of information technology and network technology, and in particular relates to a domain name graph embedded representation analysis method and device based on analytic relations. Background technique [0002] With the rapid popularization of the Internet, Internet basic resource data centered on domain names, IPs, and autonomous systems (AS (Autonomous System)) has shown explosive growth. Mining and analyzing the potential associations between domain names in the domain name network is the key to detecting malicious domain names and discovering zombies. Network, identify network security threats and other related work, and the graph embedding representation learning technology can effectively express the network relationship numerically, and use it as the input feature of the graph neural network, which is beneficial to improve the downstream tasks (such as node classification, link prediction, etc.) accuracy and eff...

AI Technical Summary

Problems solved by technology

However, the existing community discovery methods only consider the neighbor association of vertices, ignoring the potential neighbor relationship. At the same time, the complexity of community discovery is high, which is not suitable for large-scale graph analysis.

Images