A method and device for detecting malicious domain name clusters based on word vectors
A technology of cluster detection and word embedding, which is applied in security communication devices, neural learning methods, unstructured text data retrieval, etc., can solve problems such as difficult data acquisition, many resources, and ignoring associations, and achieve fewer data fields and improve detection Efficiency, the effect of less computing resources
Active Publication Date: 2022-05-10
INST OF INFORMATION ENG CHINESE ACAD OF SCI
View PDF13 Cites 0 Cited by
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
These works focus on the detection of a single malicious domain name, ignoring the collaborative completion of the association between domain names in the same malicious activity, lack of analysis of the malicious domain name clusters that work together, and cannot provide a panoramic perspective for observing malicious activities
In addition, some work that focuses on domain name association requires complex data sets, such as redirection chains, bearer files, domain name registration information, etc. The data is not easy to obtain and requires more resources
Method used
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View moreImage
Smart Image Click on the blue labels to locate them in the text.
Smart ImageViewing Examples
Examples
Experimental program
Comparison scheme
Effect test
Embodiment Construction
[0036] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts belong to the protection scope of the present invention.
[0037] The invention proposes a method for detecting malicious domain name clusters based on word vectors. Considering that malicious domain names belonging to the same malicious activity are naturally clustered, the present invention first mines domain name clusters belonging to the same activity from the original DNS log. Secondly, considering the assumption that domain names with similar contextual relations have similar attributes, the domain names are vectorized by using the word vector algorithm, so that domain names with similar functional attributes have similar positions i...
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More PUM
Login to View More Abstract
The invention discloses a method and device for detecting malicious domain name clusters based on word vectors, including: generating the access sequence of each client through the original data in the server log; clustering the access sequence from the time dimension and the space dimension to generate the domain name Access sequence; de-duplicate access domain names for each domain name access sequence to generate domain name clusters; generate domain name semantic vectors for each access domain name; generate domain name semantic vector matrix through domain name clusters and domain name semantic vectors; analyze domain name clusters based on domain name semantic vector matrix Classify and obtain malicious domain name cluster detection results. The present invention can effectively identify domain name clusters that carry out the same malicious activity, provide a more comprehensive perspective for analyzing malicious activities, use less data fields, use less computing resources, improve detection efficiency, and can be effectively deployed in various enterprises or service providers In the network, there is no need for security personnel to manually adjust parameters, and the pre-trained model can run stably and effectively.
Description
technical field [0001] The invention belongs to the field of computer network space security, and in particular relates to a method and device for detecting malicious domain name clusters based on word vectors. Background technique [0002] Malicious domain names are the basis for attackers to carry out malicious activities. At present, there are many studies aimed at discovering malicious domain names in the network from various angles. There are two main detection methods: 1) object-based methods; 2) association-based methods. [0003] (1) Object-based detection method: This method mainly extracts features for identifying malicious domain names from multiple perspectives based on prior knowledge, and then builds a classifier to identify malicious domain names. This type of method collects relevant information from various types of data, such as DNS traffic, whois information, passiveDNS information, geographic location information, etc. Commonly used related features inclu...
Claims
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More Application Information
Patent Timeline
Login to View More Patent Type & AuthorityPatents(China)
IPC IPC(8): H04L9/40H04L61/4511G06F16/33G06F16/35G06F40/30G06K9/62G06N3/04G06N3/08
CPCH04L63/1416H04L63/1483G06F16/35G06F16/3344G06F40/30G06N3/08H04L61/4511G06N3/047G06N3/048G06N3/045G06F18/23G06F18/2415G06F18/241
Inventor李依馨王利明杨婧
OwnerINST OF INFORMATION ENG CHINESE ACAD OF SCI