Domain name detection method and device, equipment and storage medium

Abstract

The invention relates to a domain name detection method and apparatus, a device and a storage medium. The method comprises the steps of obtaining a to-be-detected domain name; inputting the domain name to be detected into a pre-trained recurrent neural network, and extracting a feature vector of the domain name to be detected by the recurrent neural network; and inputting the feature vector into a trained RF model, and performing normal domain name or abnormal domain name detection on the domain name to be detected by the RF model according to the feature vector. According to the method, a recurrent neural network model and an RF (RandomForest) model based on Parallel multi-dimension LSTM are introduced, and the two network models are matched with each other, so that the purpose of fully extracting domain name distribution characteristics based on an unsupervised learning process is achieved, the model recognition capability is also improved, and the recognition efficiency is improved. And when domain name detection is carried out, detection and judgment of the domain name can be carried out in combination with the LSTM recurrent neural network and the RF model, and finally, the accuracy of a domain name detection result is effectively improved.

Description

technical field [0001] The present application relates to the technical field of computer network security, and in particular, to a domain name detection method and apparatus, device, and storage medium. Background technique [0002] At present, with the rapid development and application of technologies such as the Internet, the Internet of Things, big data, cloud computing and artificial intelligence, more and more economic and social value has been generated in the cyberspace, and even related to national security, and cyberattacks are becoming more and more frequent. The more frequent, the more sophisticated the attack techniques. In the process of network attacks, domain names are usually required to complete activities such as remote control or data theft. In order to evade the detection of security measures, the typical method is to integrate the malicious domain name generation algorithm DGA (Domain Generation Algorithm) in the software to generate rapidly changing do...

AI Technical Summary

Problems solved by technology

In order to solve this problem, many detection methods of malicious domain names have appeared. These methods can play a certain role in screening. However, as the generation pattern of malicious domain names becomes more and more complicated, the characteristics become more and more blurred, and the detection difficulty becomes more and more difficult.

In related technologies, the detection ability of machine learning-based detection methods depends on feature vectors. The generation of feature vectors is a process of information compression and screening. When the malicious domain name generation method changes, the existing feature vectors may become invalid, thereby affecting the domain name. The ability to detect the domain name eventually leads to inaccurate domain name detection results

Images