Domain Name Detection Method, Device, and Storage Medium

Abstract

Embodiments of the present disclosure provide a domain name detection method, device, and storage medium. By matching a domain name to be detected with a preset domain name set, where the preset domain name set includes multiple trusted domain names; if the domain name to be detected is not in the preset domain name set, the edit distance between each level of domain name in the domain name to be detected and a preset domain name keyword in a domain name keyword set is calculated; if the edit distance between any target level domain name and any target preset domain name keyword is less than a preset distance threshold, the character pairs where the target level domain name and the target preset domain name keyword are different are obtained, and the character pairs are matched with a set of similar character pairs; if it is determined that the character pairs are in the set of similar character pairs, it is determined that the domain name to be detected has a security risk. Embodiments of the present disclosure can effectively detect counterfeit domain names, improve accuracy, reduce false alarms, and have a simple algorithm, small implementation difficulty, and small complexity and performance overhead.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer and network communication technologies, and in particular, to a domain name detection method, device, and storage medium. Background Art

[0002] Phishing domain names resemble legitimate domain names, are deceptive and misleading, and can easily make users mistake them for trustworthy legitimate domain names. Phishing domain names are often used for phishing, sending spam or phishing emails, C2 servers, etc. They are a common means of network attack with low cost and a wide range of harm.

[0003] In the prior art, the basic method for phishing domain name detection is to calculate the edit distance between the keywords of the domain name to be detected and the keywords of the target domain name. If the edit distance is less than or equal to a preset threshold, it is determined that the domain name to be detected is a phishing domain name of the target domain name.

[0004] However, the phishing domain name detection method in the prior art has low accuracy and a large number of false positives. Summary of the Invention

[0005] Embodiments of the present disclosure provide a domain name detection method, device, and storage medium to improve the accuracy of phishing domain name detection and reduce false positives in phishing domain name detection.

[0006] In a first aspect, embodiments of the present disclosure provide a domain name detection method, including:

[0007] Matching the domain name to be detected with a preset domain name set, where the preset domain name set includes multiple trusted domain names;

[0008] If the domain name to be detected is not in the preset domain name set, calculate the edit distance between each level of domain name in the domain name to be detected and the preset domain name keywords in the domain name keyword set, where the domain name keyword set is constructed based on the keywords in any trusted domain name;

[0009] If the edit distance between any target level domain name and any target preset domain name keyword is less than a preset distance threshold, obtain the character pairs where the target level domain name and the target preset domain name keyword are different, and match the character pairs with a set of similar character pairs, where the set of similar character pairs includes multiple similar character pairs, and each similar character pair consists of two visually similar characters or strings;

[0010] If it is determined that the character pair is in the set of similar character pairs, determine that the domain name to be detected has a security risk.

[0011] In a second aspect, embodiments of the present disclosure provide a domain name detection device, including:

[0012] A domain name matching unit for matching a domain name to be detected with a preset domain name set, where the preset domain name set includes a plurality of trusted domain names;

[0013] An edit distance calculation unit for calculating the edit distance between the domain names at all levels in the domain name to be detected and the preset domain name keywords in the domain name keyword set if the domain name to be detected is not in the preset domain name set, where the domain name keyword set is constructed based on the keywords in any trusted domain name;

[0014] A similar character pair matching unit for, if the edit distance between any target-level domain name and any target preset domain name keyword is less than a preset distance threshold, obtaining the character pairs in which the target-level domain name and the target preset domain name keyword are different, and matching the character pairs with a similar character pair set, where the similar character pair set includes a plurality of similar character pairs, and each similar character pair consists of two visually similar characters or character strings; if it is determined that the character pair is in the similar character pair set, it is determined that the domain name to be detected has a security risk.

[0015] In a third aspect, an embodiment of the present disclosure provides an electronic device, including: at least one processor and a memory;

[0016] The memory stores computer execution instructions;

[0017] The at least one processor executes the computer execution instructions stored in the memory, so that the at least one processor executes the domain name detection method described in the first aspect above and various possible designs of the first aspect.

[0018] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, in which computer execution instructions are stored, and when the processor executes the computer execution instructions, the domain name detection method described in the first aspect above and various possible designs of the first aspect is implemented.

[0019] In a fifth aspect, an embodiment of the present disclosure provides a computer program product, including computer execution instructions, and when the processor executes the computer execution instructions, the domain name detection method described in the first aspect above and various possible designs of the first aspect is implemented.

[0020] The domain name detection method, device, and storage medium provided by the embodiments of the present disclosure match the domain name to be detected with a preset domain name set, where the preset domain name set includes multiple trusted domain names; if the domain name to be detected is not in the preset domain name set, the edit distance between each level of domain name in the domain name to be detected and the preset domain name keywords in the domain name keyword set is calculated, where the domain name keyword set is constructed based on the keywords in any trusted domain name; if the edit distance between any target level domain name and any target preset domain name keyword is less than the preset distance threshold, the character pairs where the target level domain name and the target preset domain name keyword are different are obtained, and the character pairs are matched with the similar character pair set, where the similar character pair set includes multiple similar character pairs, and each similar character pair consists of two visually similar characters or character strings; if it is determined that the character pair is in the similar character pair set, it is determined that the domain name to be detected has a security risk. In the embodiments of the present disclosure, some trusted domain names are initially filtered out through the preset domain name set, which plays a certain noise reduction role and can reduce the data volume; for the domain names to be detected that are not filtered out, the preset domain name keywords with a relatively small difference degree from each level of domain name of the domain name to be detected can be found from the domain name keyword set based on the edit distance, and then combined with the similar character pair set to determine whether the domain name to be detected is a counterfeit from the perspective of visual features, so that counterfeit domain names can be effectively detected, the accuracy is improved, false positives are reduced, and the algorithm is simple, the implementation difficulty is small, and the complexity and performance overhead are small. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the following drawings are some embodiments of the present disclosure. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0022] Figure 1 It is a schematic diagram of an example of the domain name detection method provided by an embodiment of the present disclosure;

[0023] Figure 2 It is a schematic flowchart of the domain name detection method provided by an embodiment of the present disclosure;

[0024] Figure 3 It is a schematic flowchart of the domain name detection method provided by another embodiment of the present disclosure;

[0025] Figure 4 It is a schematic diagram of the construction process of the similar character pair set provided by an embodiment of the present disclosure;

[0026] Figure 5 It is a structural block diagram of the domain name detection device provided by an embodiment of the present disclosure;

[0027] Figure 6 Schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present disclosure. Detailed implementation manners

[0028] To make the objectives, technical solutions and advantages of the embodiments of the present disclosure clearer, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present disclosure. Apparently, the described embodiments are some but not all of the embodiments of the present disclosure. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present disclosure without creative efforts shall fall within the scope of protection of the present disclosure.

[0029] In the prior art, the basic method for detecting counterfeit domain names is to calculate the edit distance between the keywords of the domain name to be detected and the keywords of the target domain name. If the edit distance is less than or equal to a preset threshold, it is determined that the domain name to be detected is a counterfeit domain name of the target domain name. The edit distance is a quantitative measurement of the difference degree between two given strings. The smaller the edit distance, the more similar the two strings are. When the two strings are equal, the edit distance is 0. The measurement method is to see how many operations are required at least to transform one string into another string. Among them, the permitted transformation operations include insertion, deletion, and replacement.

[0030] However, the prior art method for detecting counterfeit domain names only measures the similarity by the edit distance to determine whether it is a counterfeit. The edit distance is difficult to fully reflect the visual similarity. Especially since domain names are non-repeating and relatively rare assets, after a large number of characteristic domain names are registered, others cannot register them anymore. It becomes very difficult to find a characteristic and non-repeating domain name when registering a domain name, which makes domain name registrants often register some domain names similar to existing domain names. This leads to a large number of normal and non-malicious similar domain names being particularly likely to appear when detecting counterfeit domain names. In addition, there are a large number of malicious counterfeit domain names that directly use the keywords of existing domain names or enterprise entities in the domain name without modification, which causes the similarity-based algorithm to fail directly, resulting in a large number of false positives. Therefore, the prior art method for detecting counterfeit domain names has low accuracy and a large number of false positives. An effective solution is needed to improve the accuracy and eliminate a large amount of noise interference in the actual scenario of detecting counterfeit domain names.

[0031] To solve the above technical problems, the present disclosure provides a domain name detection method, which introduces visual features in the process of detecting counterfeit domain names and detects counterfeit domain names from a visual perspective; and a noise reduction scheme is added to reduce the occurrence of false positives. Among them, some trusted domain names can be initially filtered out through a preset domain name set, which plays a certain role in noise reduction and can reduce the amount of data; for the domain names to be detected that are not filtered out, the preset domain name keywords with a relatively small difference in each level of domain names from the domain name to be detected can be found from the domain name keyword set based on the edit distance, and then combined with the similar character pair set to determine whether the domain name to be detected is a counterfeit from the perspective of visual features, so that counterfeit domain names can be effectively detected, the accuracy is improved, false positives are reduced, and the algorithm is simple, the implementation difficulty is small, and the complexity and performance overhead are small.

[0032] The domain name detection method of the present disclosure can be applied to electronic devices such as servers. For example, Figure 1 as shown, by matching the domain name to be detected with the preset domain name set, preliminary filtering is achieved, and the preset domain name set includes multiple trusted domain names; if the domain name to be detected is not in the preset domain name set, the edit distance between each level of domain names in the domain name to be detected and the preset domain name keywords in the domain name keyword set is calculated, where the domain name keyword set is constructed based on the keywords in any trusted domain name; if the edit distance between any target level domain name and any target preset domain name keyword is less than the preset distance threshold, the character pair with a difference between the target level domain name and the target preset domain name keyword is obtained, and the character pair is matched with the similar character pair set, where the similar character pair set includes multiple similar character pairs, and each similar character pair consists of two visually similar characters or character strings; if it is determined that the character pair is in the similar character pair set, it is determined that the domain name to be detected has a security risk.

[0033] The domain name detection method of the present disclosure will be introduced in detail below in combination with specific embodiments.

[0034] Refer to Figure 2 , Figure 2 which is a schematic flowchart of the domain name detection method provided by an embodiment of the present disclosure. The method of this embodiment can be applied to electronic devices such as terminal devices or servers. The domain name detection method includes:

[0035] S201. Match the domain name to be detected with the preset domain name set, where the preset domain name set includes multiple trusted domain names.

[0036] In this embodiment, the preset domain name set can be a domain name set constructed offline (which can also be updated in real time), and it can include multiple trusted domain names (legal domain names or non-malicious domain names). In other words, the preset domain name set can be a domain name white list. The trusted domain names in the preset domain name set can be set manually. Of course, considering that the access volume of counterfeit domain names is generally relatively low, the electronic device can also obtain some domain names with high access volume and add them to the preset domain name set.

[0037] Optionally, historical access volume data of multiple alternative domain names in the past preset time period can be obtained. For example, in a recent period of time (such as one month), the average number of accesses / frequencies of each alternative domain name in several cycles such as hours, days, weeks, and months can be obtained. If the historical access volume data of any alternative domain name in the past preset time period exceeds the preset access volume threshold, the alternative domain name can be added to the preset domain name set to construct the preset domain name set.

[0038] In this embodiment, based on the preset domain name set, the domain name to be detected is matched with the trusted domain names in the preset domain name set. If the domain name to be detected is in the preset domain name set, that is, the domain name to be detected is exactly the same as a certain trusted domain name in the preset domain name set, it can be determined that the domain name to be detected is a trusted domain name (legal domain name or non-malicious domain name), and the subsequent steps do not need to be executed. If the domain name to be detected is not in the preset domain name set, the subsequent steps need to be executed for further judgment.

[0039] In this embodiment, through the filtering of the preset domain name set, the trusted domain names belonging to the preset domain name set can be filtered out, thereby reducing the amount of data that needs to execute the subsequent steps and reducing the processing pressure of the subsequent steps. In particular, if the trusted domain names in the preset domain name set are domain names selected based on historical access volume data, when filtering the domain name to be detected based on the preset domain name set, it is equivalent to filtering the domain name to be detected based on the access volume data (access baseline), taking into account the characteristic that the access volume of counterfeit domain names is generally relatively low.

[0040] S202. If the domain name to be detected is not in the preset domain name set, calculate the edit distance between the domain names at all levels in the domain name to be detected and the preset domain name keywords in the domain name keyword set, where the domain name keyword set is constructed based on the keywords in any trusted domain name.

[0041] In this embodiment, the domain name keyword set can be constructed offline (and can also be updated in real time), which includes domain name keywords. The domain name keywords can be keywords of some trusted domain names (such as some domain names with high traffic). For example, they can be second-level domain names or third-level domain names, etc. in these domain names. For example, if a domain name is abc.xyz.com, the second-level domain name xyz in it can be added as a domain name keyword to the preset domain name set. Optionally, the third-level domain name abc can also be added as a domain name keyword to the preset domain name set. The preset domain name keywords in the preset domain name set can be set manually, or the electronic device can extract keywords based on some trusted domain names (such as some domain names with high traffic) and construct the domain name keyword set. The trusted domain names can be from the above-mentioned preset domain name set, or they can be any other trusted domain names.

[0042] In this embodiment, after determining that the domain name to be detected is not in the preset domain name set, the edit distance between each level of domain name in the domain name to be detected and the preset domain name keywords in the domain name keyword set can be calculated. Among them, the edit distance is a quantitative measurement of the difference degree between two given strings. The smaller the edit distance, the more similar the two strings are. When the two strings are equal, the edit distance is 0. The measurement method is to see how many operations are required at least to transform one string into another string. Among them, the permitted transformation operations include insertion, deletion, and replacement. In this embodiment, each level of domain name in the domain name to be detected can be calculated with the edit distance of each preset domain name keyword in the domain name keyword set respectively, and then it is judged whether the calculated edit distance is less than the preset distance threshold (such as 2 or 3) to find the preset domain name keywords with a smaller difference degree from each level of domain name in the domain name to be detected.

[0043] Among them, since the domain name keyword set does not include top-level domain names (such as.com,.net,.cn, etc.), when calculating the edit distance between each level of domain name in the domain name to be detected and the preset domain name keywords in the domain name keyword set, the top-level domain name of the domain name to be detected can be ignored. Optionally, before calculating the edit distance between each level of domain name in the domain name to be detected and the preset domain name keywords in the domain name keyword set, the domain name to be detected can be split according to the dot (".") to obtain each level of domain name in the domain name to be detected, and the top-level domain name among them can be ignored.

[0044] S203. If the edit distance between any target level domain name and any target preset domain name keyword is less than the preset distance threshold, obtain the character pairs where the target level domain name and the target preset domain name keyword are different, and match the character pairs with the similar character pair set, where the similar character pair set includes multiple similar character pairs, and each similar character pair is composed of two visually similar characters or strings.

[0045] In this embodiment, when looking for a preset domain name keyword with a relatively small degree of difference from the domain names at all levels of the domain name to be detected based on the edit distance, considering that the degree of difference between a certain level of the domain name to be detected and a certain preset domain name keyword is relatively small, it may not be an intentional imitation, but the character combination of this level of the domain name itself is relatively similar to a certain preset domain name keyword; the degree of difference between a certain level of the domain name to be detected and a certain preset domain name keyword is relatively small, and it may also be an intentional imitation. Usually, a forged domain name will purposefully modify a small number of characters of a normal domain name, especially by replacing visually similar characters, which is a common trick for forged domain names. The forged domain name generated in this way is highly similar to the original domain name and is likely to be mistaken for the normal domain name being forged. Therefore, in this embodiment, a set of similar character pairs is pre-constructed. The set of similar character pairs includes multiple visually similar similar character pairs. The similar character pairs can include visually similar single-character pairs, such as c and o, g and 9, i and l, i and 1, o and 0, etc., or can also include visually similar string pairs, such as oo and o0, oo and 0o, oo and 00, oao and oa0, obo and ob0, etc., where the number of characters included in the similar string pairs is not limited. Then, based on the set of similar character pairs, it is determined whether the domain name to be detected uses similar character pairs for forgery.

[0046] Specifically, if the edit distance between any target-level domain name of the domain name to be detected and any target preset domain name keyword is less than the preset distance threshold, then the character pair where the target-level domain name of the domain name to be detected and the target preset domain name keyword differ can be obtained (which can be determined when calculating the edit distance). For example, if a certain character (or string) in the target-level domain name and a certain character (or string) in the target preset domain name keyword differ, then these two different characters (or strings) are respectively taken out from the target-level domain name and the target preset domain name keyword to form a character pair, and then this character pair is matched with the set of similar character pairs to determine whether it is in the set of similar character pairs. If the character pair is not in the set of similar character pairs, it means that the target-level domain name does not forge the target preset domain name keyword; if the character pair is in the set of similar character pairs, it means that the target-level domain name forges the target preset domain name keyword.

[0047] S204. If it is determined that the character pair is in the set of similar character pairs, it is determined that the domain name to be detected has a security risk.

[0048] In this embodiment, based on the above steps, if the edit distance between at least one target-level domain name of the domain name to be detected and any target preset domain name keyword is less than the preset distance threshold, and the character pairs with differences between the target-level domain name and the target preset domain name keyword are in the set of similar character pairs, it is determined that the domain name to be detected has a security risk and is a counterfeit domain name imitating based on the target preset domain name keyword, and the operation is for the security risk of network attacks.

[0049] The domain name detection method provided in this embodiment matches the domain name to be detected with a preset domain name set, where the preset domain name set includes multiple trusted domain names; if the domain name to be detected is not in the preset domain name set, the edit distance between each level domain name in the domain name to be detected and the preset domain name keyword in the domain name keyword set is calculated, where the domain name keyword set is constructed based on the keywords in any trusted domain name; if the edit distance between any target-level domain name and any target preset domain name keyword is less than the preset distance threshold, the character pairs with differences between the target-level domain name and the target preset domain name keyword are obtained, and the character pairs are matched with the set of similar character pairs, where the set of similar character pairs includes multiple similar character pairs, and each similar character pair consists of two visually similar characters or character strings; if it is determined that the character pair is in the set of similar character pairs, it is determined that the domain name to be detected has a security risk. In this embodiment, some trusted domain names are initially filtered out through the preset domain name set, which plays a certain role in noise reduction and can reduce the data volume; for the domain names to be detected that are not filtered out, the preset domain name keywords with a relatively small difference degree from each level domain name of the domain name to be detected can be found from the domain name keyword set based on the edit distance, and then combined with the set of similar character pairs to judge whether the domain name to be detected is a counterfeit from the perspective of visual features, so that counterfeit domain names can be effectively detected, the accuracy is improved, false positives are reduced, and the algorithm is simple, the implementation difficulty is small, and the complexity and performance overhead are small.

[0050] Based on the above embodiments, if the edit distance between at least one target top-level domain name of the domain name to be detected and any target preset domain name keyword is less than the preset distance threshold, and all character pairs with differences between the target top-level domain names and the target preset domain name keyword are not in the set of similar character pairs, it cannot be directly determined that the domain name to be detected is not a counterfeit domain name at this time. Because the similarity between the target top-level domain name and the target preset domain name keyword is relatively high, it is also possible that the target top-level domain name is obtained by swapping some characters of the target preset domain name keyword. For example, the target top-level domain name cbad is a counterfeit by only swapping the positions of a and c relative to the target preset domain name keyword abcd. Therefore, after determining that the edit distance between any target top-level domain name of the domain name to be detected and any target preset domain name keyword is less than the preset distance threshold, and the character pairs with differences between the target top-level domain name and the target preset domain name keyword are not in the set of similar character pairs, it can be judged whether the target top-level domain name is obtained by swapping some characters of the target preset domain name keyword; if it is determined that the target top-level domain name is obtained by swapping some characters of the target preset domain name keyword, it is determined that the domain name to be detected has a security risk.

[0051] Optionally, considering that when the target top-level domain name is short, only some characters are swapped between the target top-level domain name and the target preset domain name keyword, which is relatively easy to distinguish visually, and the probability of not being a counterfeit situation is also relatively high; only when the target top-level domain name is long enough, swapping characters has a certain degree of confusion and is more likely to be a counterfeit of the target preset domain name keyword. Therefore, in the above embodiments, when determining that the character pair is not in the set of similar character pairs and judging whether the target top-level domain name is obtained by swapping some characters of the target preset domain name keyword, it includes:

[0052] If it is determined that the character pair is not in the set of similar character pairs, then judge whether the length of the target top-level domain name exceeds the preset length; if it is determined that the length of the target top-level domain name exceeds the preset length, then judge whether the target top-level domain name is obtained by swapping some characters of the target preset domain name keyword.

[0053] That is to say, judging whether the target top-level domain name is obtained by swapping some characters of the target preset domain name keyword is only performed on the target top-level domain names whose lengths exceed the preset length, while ignoring the target top-level domain names whose lengths do not exceed the preset length. If the target top-level domain name does not exceed the preset length, there is no need to judge whether the target top-level domain name is obtained by swapping some characters of the target preset domain name keyword, and it is directly determined that the target top-level domain name is not a counterfeit of the target preset domain name keyword.

[0054] Based on the above embodiments, considering that there may still be noise interference in the above domain name detection method, further noise reduction can be performed on the basis of the above domain name detection method. Specifically, as Figure 3 shown, before finally determining that the domain name to be detected has a security risk, noise reduction can also be performed through the following steps to finally determine whether the domain name to be detected is a counterfeit domain name:

[0055] S301. Obtain the historical access volume data of the domain name to be detected in the past preset time period, and determine whether the historical access volume data of the domain name to be detected in the past preset time period exceeds a preset access volume threshold;

[0056] S302. If the historical access volume data of the domain name to be detected in the past preset time period does not exceed the preset access volume threshold, determine that the domain name to be detected has a security risk; or

[0057] S303. If the historical access volume data of the domain name to be detected in the past preset time period exceeds the preset access volume threshold, determine that the domain name to be detected is a trusted domain name.

[0058] In this embodiment, considering that in order to reduce the probability of being discovered, the access volume of malicious counterfeit domain names is usually much smaller than that of normal domain names. Therefore, the counterfeit domain names determined in the previous steps are filtered again through the access volume data, so as to filter out the domain names with relatively high access volume data, achieve noise reduction, and greatly reduce the false alarm rate of detection. The historical access volume data of the domain name to be detected in the past preset time period may include, but is not limited to, the number of accesses in the most recent hour, the number of access hours in the most recent day, the number of access days in the most recent week, etc.

[0059] Based on the above embodiments, the steps of the domain name detection method are as follows:

[0060] Match the domain name to be detected with a preset domain name set; if the domain name to be detected is in the preset domain name set, determine that the domain name to be detected is a trusted domain name; otherwise, if the domain name to be detected is not in the preset domain name set, obtain the domain names at all levels in the domain name to be detected (ignoring the top-level domain name), calculate the edit distance between each level of domain name and the preset domain name keywords in the domain name keyword set. For example, for a target-level domain name (such as a second-level domain name), a preset domain name keyword can be taken from the domain name keyword set, and then calculate the edit distance between the preset domain name keyword and the target-level domain name. If the edit distance is not less than the preset distance threshold, take the next preset domain name keyword from the domain name keyword set; if the edit distance is less than the preset distance threshold, obtain the characters where the preset domain name keyword and the target-level domain name are different, form character pairs, and match them with the similar character pair set. If it is determined that the character pair is in the similar character pair set, determine that the target-level domain name imitates the preset domain name keyword, and it can be determined that the domain name to be detected is a counterfeit domain name; if it is determined that the character pair is not in the similar character pair set, it can be judged whether the length of the target-level domain name exceeds the preset length. If the length of the target-level domain name does not exceed the preset length, take the next preset domain name keyword from the domain name keyword set and re-execute the above process; if the length of the target-level domain name exceeds the preset length, judge whether the target-level domain name is obtained by swapping some characters based on the preset domain name keyword. If so, determine that the domain name to be detected is a counterfeit domain name; if not, take the next preset domain name keyword from the domain name keyword set and re-execute the above process.

[0061] Further, after determining that the domain name to be detected is a counterfeit domain name through the above process, the historical access volume data of the domain name to be detected in the past preset time period can also be obtained, and then finally judge whether the domain name to be detected is a counterfeit domain name based on the historical access volume data of the domain name to be detected in the past preset time period. Among them, if the historical access volume data of the domain name to be detected in the past preset time period does not exceed the preset access volume threshold, it is finally determined that the domain name to be detected has a security risk; if the historical access volume data of the domain name to be detected in the past preset time period exceeds the preset access volume threshold, it is determined that the domain name to be detected is a trusted domain name, that is, the above process is misjudged.

[0062] Based on any of the above embodiments, before matching the character pair with the similar character pair set, it is also necessary to obtain the similar character pair set in advance. The construction of the similar character pair set can be manually constructed, or it can also be constructed by the following process:

[0063] S401. Obtain images of different single characters and images of different strings, where the string includes at least two characters;

[0064] S402. Obtain the similarity between each image, determine similar character pairs based on the similarity between each image, and add the similar character pairs to the set of similar character pairs to construct the set of similar character pairs.

[0065] In this embodiment, the set of similar character pairs may include visually similar single-character pairs, such as c and o, g and 9, i and l, i and 1, o and 0, etc., and may also include visually similar string pairs, such as oo and o0, oo and 0o, oo and 00, oao and oa0, obo and ob0, etc. The number of characters included in the similar string pairs may not be limited.

[0066] Therefore, first, for the set of alphabetic and numeric characters used in domain names, a-z, 0-9, obtain images of all possible character and string pairs, including:

[0067] 1) Save each character as an image;

[0068] 2) Combine characters in pairs, such as aa, ab, 00, 01, a1, a2, etc., and save them as images;

[0069] 3) Combine characters in triples or even more combinations, such as aaa, abc, aaaa, aaab, etc., and save them as images;

[0070] Furthermore, as Figure 4 shown, use the graph similarity algorithm to find similar images from the above images, and then determine the characters or strings corresponding to the similar images as a group of similar character pairs, thereby constructing a set of similar character pairs. The graph similarity algorithm can adopt any algorithm, such as the cosine similarity algorithm, the hash algorithm, the histogram algorithm, the deep learning algorithm, etc., and is not limited here.

[0071] Among them, when obtaining the similarity between each image and determining similar character pairs based on the similarity between each image, the similarity between images of different single characters can be obtained. If the similarity between images of any two single characters is greater than the preset similarity threshold, then the two single characters are determined as a pair of similar character pairs; and / or, the similarity between images of different strings can be obtained. If the similarity between images of any two strings is greater than the preset similarity threshold, then the two strings are determined as a pair of similar character pairs.

[0072] In this embodiment, by pre-constructing a set of similar character pairs based on visual features (picture similarity), similar character pairs that are easily confused can be better found, providing a basis for the judgment of counterfeit domain names.

[0073] Corresponding to the domain name detection method in the above embodiment, Figure 5The block diagram of the domain name detection device provided by the embodiments of the present disclosure. For ease of illustration, only parts related to the embodiments of the present disclosure are shown. Refer to Figure 5 The domain name detection device 500 includes: a domain name matching unit 501, an edit distance calculation unit 502, and a similar character pair matching unit 503.

[0074] Among them, the domain name matching unit 501 is used to match the domain name to be detected with a preset domain name set, where the preset domain name set includes a plurality of trusted domain names;

[0075] The edit distance calculation unit 502 is used to calculate the edit distance between the domain names at each level in the domain name to be detected and the preset domain name keywords in the domain name keyword set if the domain name to be detected is not in the preset domain name set, where the domain name keyword set is constructed based on the keywords in any trusted domain name;

[0076] The similar character pair matching unit 503 is used to obtain the character pairs where the target level domain name and the target preset domain name keyword are different and match the character pairs with a similar character pair set if the edit distance between any target level domain name and any target preset domain name keyword is less than a preset distance threshold, where the similar character pair set includes a plurality of similar character pairs, and each similar character pair consists of two visually similar characters or character strings; if it is determined that the character pair is in the similar character pair set, it is determined that the domain name to be detected has a security risk.

[0077] In one or more embodiments of the present disclosure, the device further includes a character swapping judgment module, which is used for:

[0078] If it is determined that the character pair is not in the similar character pair set, it is judged whether the target level domain name is obtained by swapping the positions of some characters in the target preset domain name keyword;

[0079] If it is determined that the target level domain name is obtained by swapping the positions of some characters in the target preset domain name keyword, it is determined that the domain name to be detected has a security risk.

[0080] In one or more embodiments of the present disclosure, when the character swapping judgment module judges whether the target level domain name is obtained by swapping the positions of some characters in the target preset domain name keyword if it is determined that the character pair is not in the similar character pair set, it is used for:

[0081] If it is determined that the character pair is not in the similar character pair set, it is judged whether the length of the target level domain name exceeds a preset length;

[0082] If it is determined that the length of the target top-level domain name exceeds the preset length, it is determined whether the target top-level domain name is obtained by swapping the positions of some characters based on the target preset domain name keyword.

[0083] In one or more embodiments of the present disclosure, the device further includes a noise reduction module, configured to:

[0084] Obtain the historical access volume data of the domain name to be detected in the past preset period, and determine whether the historical access volume data of the domain name to be detected in the past preset period exceeds the preset access volume threshold;

[0085] If the historical access volume data of the domain name to be detected in the past preset period does not exceed the preset access volume threshold, it is determined that the domain name to be detected has a security risk; or

[0086] If the historical access volume data of the domain name to be detected in the past preset period exceeds the preset access volume threshold, it is determined that the domain name to be detected is a trusted domain name.

[0087] In one or more embodiments of the present disclosure, the device further includes an offline processing module, configured to:

[0088] Obtain the historical access volume data of multiple alternative domain names in the past preset period;

[0089] If the historical access volume data of any alternative domain name in the past preset period exceeds the preset access volume threshold, add the alternative domain name to the preset domain name set to construct the preset domain name set.

[0090] In one or more embodiments of the present disclosure, the offline processing module is further configured to:

[0091] Obtain images of different single characters and images of different strings, where the string includes at least two characters;

[0092] Obtain the similarity between each image, determine similar character pairs based on the similarity between each image, and add the similar character pairs to the set of similar character pairs to construct the set of similar character pairs.

[0093] In one or more embodiments of the present disclosure, when the offline processing module obtains the similarity between each image and determines similar character pairs based on the similarity between each image, it is configured to:

[0094] Obtain the similarity between images of different single characters. If the similarity between images of any two single characters is greater than the preset similarity threshold, determine the any two single characters as a pair of similar character pairs; and / or

[0095] Obtain the similarity between images of different strings. If the similarity between the images of any two strings is greater than a preset similarity threshold, then determine the any two strings as a pair of similar character pairs.

[0096] In one or more embodiments of the present disclosure, before calculating the edit distance between each level domain name in the domain name to be detected and the preset domain name keywords in the domain name keyword set, the edit distance calculation unit 502 is further configured to:

[0097] Split the domain name to be detected according to the dot, obtain each level domain name in the domain name to be detected, and ignore the top-level domain name therein.

[0098] The device provided in this embodiment can be used to execute the technical solutions of the above method embodiments. The implementation principles and technical effects are similar, and will not be elaborated here.

[0099] Reference Figure 6 , which shows a schematic structural diagram of an electronic device 600 suitable for implementing the embodiments of the present disclosure. The electronic device 600 can be a terminal device or a server. Among them, the terminal device can include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, personal digital assistants (Personal Digital Assistant, abbreviated as PDA), tablet computers (Portable Android Device, abbreviated as PAD), portable multimedia players (Portable MediaPlayer, abbreviated as PMP), in-vehicle terminals (such as in-vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and usage scope of the embodiments of the present disclosure.

[0100] As Figure 6 shown, the electronic device 600 may include a processing device (such as a central processing unit, a graphics processing unit, etc.) 601, which can execute various appropriate actions and processes according to the program stored in the read-only memory (Read Only Memory, abbreviated as ROM) 602 or the program loaded from the storage device 608 into the random access memory (Random Access Memory, abbreviated as RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other through a bus 604. The input / output (I / O) interface 605 is also connected to the bus 604.

[0101] Typically, the following devices can be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 can allow the electronic device 600 to communicate with other devices wirelessly or wiredly to exchange data. Although Figure 6 the electronic device 600 with various devices is shown, it should be understood that it is not required to implement or have all the shown devices. Instead, more or fewer devices can be implemented or had.

[0102] In particular, according to an embodiment of the present disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, an embodiment of the present disclosure includes a computer program product that includes a computer program carried on a computer-readable medium, and the computer program includes program codes for performing the methods shown in the flowcharts. In such an embodiment, the computer program can be downloaded and installed from a network through the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above functions defined in the methods of the embodiments of the present disclosure are executed.

[0103] It should be noted that the above-mentioned computer-readable medium in the present disclosure can be a computer-readable signal medium, a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the above. More specific examples of a computer-readable storage medium can include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium can be any tangible medium that contains or stores a program, which can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present disclosure, a computer-readable signal medium can include a data signal propagated in a baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on a computer-readable medium can be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0104] The above-mentioned computer-readable medium can be included in the above-mentioned electronic device; it can also exist separately without being assembled into the electronic device.

[0105] The above-mentioned computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device is caused to execute the method shown in the above-mentioned embodiments.

[0106] Computer program code for performing the operations of this disclosure may be written in one or more programming languages or combinations thereof. The programming languages include object-oriented programming languages such as Java, Smalltalk, C++, and also include conventional procedural programming languages such as the "C" language or similar programming languages. The program code may execute entirely on the user's computer, partially on the user's computer, execute as a stand-alone software package, execute partially on the user's computer and partially on a remote computer, or execute entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0107] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in the flowchart or block diagram may represent a module, a segment of a program, or a part of code that contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions noted in the blocks may occur in a different order than noted in the accompanying drawings. For example, two consecutive blocks shown may actually be executed substantially in parallel, or they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, and combinations of blocks in the block diagram and / or flowchart, may be implemented by a dedicated hardware-based system for performing the specified functions or operations, or may be implemented by a combination of dedicated hardware and computer instructions.

[0108] The units involved in the embodiments described in this disclosure may be implemented in software or in hardware. Among them, the name of the unit does not constitute a limitation to the unit itself in some cases. For example, the first acquisition unit may also be described as "the unit for acquiring at least two Internet protocol addresses".

[0109] The functions described above in this document may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGA), application specific integrated circuits (ASIC), application specific standard products (ASSP), system on a chip (SOC), complex programmable logic devices (CPLD), and so on.

[0110] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. The machine-readable medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium would include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0111] In a first aspect, according to one or more embodiments of the present disclosure, there is provided a domain name detection method, including:

[0112] Matching the domain name to be detected with a preset domain name set, where the preset domain name set includes a plurality of trusted domain names;

[0113] If the domain name to be detected is not in the preset domain name set, calculate the edit distance between each level domain name in the domain name to be detected and a preset domain name keyword in a domain name keyword set, where the domain name keyword set is constructed based on keywords in any trusted domain name;

[0114] If the edit distance between any target level domain name and any target preset domain name keyword is less than a preset distance threshold, obtain the character pair in which the target level domain name and the target preset domain name keyword are different, and match the character pair with a set of similar character pairs, where the set of similar character pairs includes a plurality of similar character pairs, and each similar character pair is composed of two visually similar characters or character strings;

[0115] If it is determined that the character pair is in the set of similar character pairs, determine that the domain name to be detected has a security risk.

[0116] According to one or more embodiments of the present disclosure, the method further includes:

[0117] If it is determined that the character pair is not in the set of similar character pairs, determine whether the target level domain name is obtained by swapping some characters of the target preset domain name keyword;

[0118] If it is determined that the target level domain name is obtained by swapping some characters of the target preset domain name keyword, determine that the domain name to be detected has a security risk.

[0119] According to one or more embodiments of the present disclosure, if it is determined that the character pair is not in the set of similar character pairs, determining whether the target top-level domain name is obtained by swapping some characters of the target preset domain name keyword includes:

[0120] If it is determined that the character pair is not in the set of similar character pairs, determine whether the length of the target top-level domain name exceeds a preset length;

[0121] If it is determined that the length of the target top-level domain name exceeds the preset length, determine whether the target top-level domain name is obtained by swapping some characters of the target preset domain name keyword.

[0122] According to one or more embodiments of the present disclosure, before determining that the domain name to be detected has a security risk, it further includes:

[0123] Obtain the historical access volume data of the domain name to be detected in the past preset period, and determine whether the historical access volume data of the domain name to be detected in the past preset period exceeds a preset access volume threshold;

[0124] If the historical access volume data of the domain name to be detected in the past preset period does not exceed the preset access volume threshold, determine that the domain name to be detected has a security risk; or

[0125] If the historical access volume data of the domain name to be detected in the past preset period exceeds the preset access volume threshold, determine that the domain name to be detected is a trusted domain name.

[0126] According to one or more embodiments of the present disclosure, before matching the domain name to be detected with the preset domain name set, it further includes:

[0127] Obtain the historical access volume data of multiple alternative domain names in the past preset period;

[0128] If the historical access volume data of any alternative domain name in the past preset period exceeds the preset access volume threshold, add the alternative domain name to the preset domain name set to construct the preset domain name set.

[0129] According to one or more embodiments of the present disclosure, before matching the character pair with the set of similar character pairs, it further includes:

[0130] Obtain images of different single characters and images of different strings, where the string includes at least two characters;

[0131] Obtain the similarity between each image, determine similar character pairs based on the similarity between each image, and add the similar character pairs to the set of similar character pairs to construct the set of similar character pairs.

[0132] According to one or more embodiments of the present disclosure, obtaining the similarity between each image and determining similar character pairs based on the similarity between each image includes:

[0133] Obtaining the similarity between images of different single characters, and if the similarity between images of any two single characters is greater than a preset similarity threshold, determining the any two single characters as a pair of similar character pairs; and / or

[0134] Obtaining the similarity between images of different strings, and if the similarity between images of any two strings is greater than a preset similarity threshold, determining the any two strings as a pair of similar character pairs.

[0135] According to one or more embodiments of the present disclosure, before calculating the edit distance between each level domain name in the domain name to be detected and a preset domain name keyword in the domain name keyword set, it further includes:

[0136] Splitting the domain name to be detected according to dots to obtain each level domain name in the domain name to be detected, and ignoring the top-level domain name therein.

[0137] In a second aspect, according to one or more embodiments of the present disclosure, a domain name detection device is provided, including:

[0138] A domain name matching unit for matching the domain name to be detected with a preset domain name set, where the preset domain name set includes a plurality of trusted domain names;

[0139] An edit distance calculation unit for calculating the edit distance between each level domain name in the domain name to be detected and a preset domain name keyword in the domain name keyword set if the domain name to be detected is not in the preset domain name set, where the domain name keyword set is constructed based on keywords in any trusted domain name;

[0140] A similar character pair matching unit for, if the edit distance between any target level domain name and any target preset domain name keyword is less than a preset distance threshold, obtaining the character pair where the target level domain name and the target preset domain name keyword are different, and matching the character pair with a similar character pair set, where the similar character pair set includes a plurality of similar character pairs, and each similar character pair consists of two visually similar characters or strings; if it is determined that the character pair is in the similar character pair set, determining that the domain name to be detected has a security risk.

[0141] According to one or more embodiments of the present disclosure, the device further includes a character swapping judgment module for:

[0142] If it is determined that the character pair is not in the set of similar character pairs, then determine whether the target top-level domain name is obtained by swapping some characters in the target preset domain name keyword;

[0143] If it is determined that the target top-level domain name is obtained by swapping some characters in the target preset domain name keyword, then determine that there is a security risk for the domain name to be detected.

[0144] According to one or more embodiments of the present disclosure, when the character swapping judgment module determines that the character pair is not in the set of similar character pairs and then determines whether the target top-level domain name is obtained by swapping some characters in the target preset domain name keyword, it is configured to:

[0145] If it is determined that the character pair is not in the set of similar character pairs, then determine whether the length of the target top-level domain name exceeds a preset length;

[0146] If it is determined that the length of the target top-level domain name exceeds the preset length, then determine whether the target top-level domain name is obtained by swapping some characters in the target preset domain name keyword.

[0147] According to one or more embodiments of the present disclosure, the device further includes a noise reduction module, which is configured to:

[0148] Obtain the historical access volume data of the domain name to be detected in the past preset time period, and determine whether the historical access volume data of the domain name to be detected in the past preset time period exceeds a preset access volume threshold;

[0149] If the historical access volume data of the domain name to be detected in the past preset time period does not exceed the preset access volume threshold, then determine that there is a security risk for the domain name to be detected; or

[0150] If the historical access volume data of the domain name to be detected in the past preset time period exceeds the preset access volume threshold, then determine that the domain name to be detected is a trusted domain name.

[0151] According to one or more embodiments of the present disclosure, the device further includes an offline processing module, which is configured to:

[0152] Obtain the historical access volume data of multiple alternative domain names in the past preset time period;

[0153] If the historical access volume data of any alternative domain name in the past preset time period exceeds the preset access volume threshold, then add the alternative domain name to the preset domain name set to construct the preset domain name set.

[0154] According to one or more embodiments of the present disclosure, the offline processing module is further configured to:

[0155] Obtain images of different single characters and images of different strings, where the strings include at least two characters;

[0156] Obtain the similarity between each pair of images, determine similar character pairs based on the similarity between each pair of images, and add the similar character pairs to the set of similar character pairs to construct the set of similar character pairs.

[0157] According to one or more embodiments of the present disclosure, when the offline processing module obtains the similarity between each pair of images and determines similar character pairs based on the similarity between each pair of images, it is configured to:

[0158] Obtain the similarity between images of different single characters. If the similarity between the images of any two single characters is greater than a preset similarity threshold, then determine the any two single characters as a pair of similar character pairs; and / or

[0159] Obtain the similarity between images of different strings. If the similarity between the images of any two strings is greater than a preset similarity threshold, then determine the any two strings as a pair of similar character pairs.

[0160] According to one or more embodiments of the present disclosure, before the edit distance calculation unit calculates the edit distance between each level domain name in the domain name to be detected and the preset domain name keywords in the domain name keyword set, it is further configured to:

[0161] Split the domain name to be detected by dots to obtain each level domain name in the domain name to be detected, and ignore the top-level domain name therein.

[0162] In a third aspect, according to one or more embodiments of the present disclosure, there is provided an electronic device, including: at least one processor and a memory;

[0163] The memory stores computer-executable instructions;

[0164] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the domain name detection method as described in the first aspect above and various possible designs of the first aspect.

[0165] In a fourth aspect, according to one or more embodiments of the present disclosure, there is provided a computer-readable storage medium, in which computer-executable instructions are stored, and when the processor executes the computer-executable instructions, the domain name detection method as described in the first aspect above and various possible designs of the first aspect is implemented.

[0166] Fifth aspect, according to one or more embodiments of the present disclosure, there is provided a computer program product including computer-executable instructions, which, when executed by a processor, implement the domain name detection method described in the first aspect above and various possible designs of the first aspect.

[0167] The above description is only a preferred embodiment of the present disclosure and an explanation of the applied technical principles. Those skilled in the art should understand that the scope of the disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above technical features, and should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosure concept. For example, the technical solutions formed by mutually replacing the above features with the technical features (but not limited to) having similar functions disclosed in the present disclosure.

[0168] In addition, although the operations are depicted in a particular order, this should not be construed as requiring that the operations be performed in the particular order shown or in sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, although several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of the present disclosure. Certain features described in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, the various features described in the context of a single embodiment may also be implemented separately or in any suitable sub-combination in multiple embodiments.

[0169] Although the subject matter has been described in language specific to structural features and / or methodological act logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. On the contrary, the specific features and acts described above are merely example forms for implementing the claims.

Claims

1. A domain name detection method, characterized in that, Including: Match the domain name to be detected with a preset domain name set, where the preset domain name set includes multiple trusted domain names; If the domain name to be detected is not in the preset domain name set, calculate the edit distance between each level domain name in the domain name to be detected and the preset domain name keywords in the domain name keyword set, where the domain name keyword set is constructed based on the keywords in any trusted domain name; If the edit distance between any target level domain name and any target preset domain name keyword is less than the preset distance threshold, obtain the character pairs where the target level domain name and the target preset domain name keyword are different, and match the character pairs with the similar character pair set, where the similar character pair set includes multiple similar character pairs, and each similar character pair consists of two visually similar characters or character strings; If it is determined that the character pair is in the similar character pair set, determine that the domain name to be detected has a security risk; If it is determined that the character pair is not in the similar character pair set, determine whether the length of the target level domain name exceeds the preset length; If it is determined that the length of the target level domain name exceeds the preset length, determine whether the target level domain name is obtained by swapping the positions of some characters based on the target preset domain name keyword; if it is determined that the target level domain name is obtained by swapping the positions of some characters based on the target preset domain name keyword, determine that the domain name to be detected has a security risk.

2. The method according to claim 1, wherein Before determining that the domain name to be detected has a security risk, it further includes: Obtain the historical access volume data of the domain name to be detected in the past preset period, and determine whether the historical access volume data of the domain name to be detected in the past preset period exceeds the preset access volume threshold; If the historical access volume data of the domain name to be detected in the past preset period does not exceed the preset access volume threshold, determine that the domain name to be detected has a security risk; or If the historical access volume data of the domain name to be detected in the past preset period exceeds the preset access volume threshold, determine that the domain name to be detected is a trusted domain name.

3. The method according to claim 1, wherein Before matching the domain name to be detected with the preset domain name set, it further includes: Obtain the historical access volume data of multiple alternative domain names in the past preset period; If the historical access volume data of any alternative domain name in the past preset period exceeds the preset access volume threshold, add the alternative domain name to the preset domain name set to construct the preset domain name set.

4. The method according to claim 1, wherein Before matching the character pair with the preset similar character pair set, it further includes: Obtain the images of different single characters and the images of different character strings, where the character string includes at least two characters; Obtain the similarity between each image, determine the similar character pairs based on the similarity between each image, and add the similar character pairs to the similar character pair set to construct the similar character pair set.

5. The method according to claim 4, characterized in that, The obtaining the similarity between each image and determining the similar character pairs based on the similarity between each image includes: Obtain the similarity between the images of different single characters, if the similarity between the images of any two single characters is greater than the preset similarity threshold, determine the any two single characters as a pair of similar character pairs; and / or Obtain the similarity between the images of different strings. If the similarity between the images of any two strings is greater than a preset similarity threshold, then determine the any two strings as a pair of similar character pairs.

6. The method according to claim 1, characterized in that Before calculating the edit distance between each level domain name in the domain name to be detected and the preset domain name keywords in the domain name keyword set, it further includes: Split the domain name to be detected according to the dot, obtain each level domain name in the domain name to be detected, and ignore the top-level domain name among them.

7. A domain name detection device, characterized in that, It includes: A domain name matching unit, configured to match the domain name to be detected with a preset domain name set, where the preset domain name set includes multiple trusted domain names; An edit distance calculation unit, configured to calculate the edit distance between each level domain name in the domain name to be detected and the preset domain name keywords in the domain name keyword set if the domain name to be detected is not in the preset domain name set, where the domain name keyword set is constructed based on the keywords in any trusted domain name; A similar character pair matching unit, configured to obtain the character pairs where the target level domain name and the target preset domain name keyword are different if the edit distance between any target level domain name and any target preset domain name keyword is less than a preset distance threshold, and match the character pairs with a similar character pair set, where the similar character pair set includes multiple similar character pairs, and each similar character pair consists of two visually similar characters or strings; if it is determined that the character pair is in the similar character pair set, then determine that the domain name to be detected has a security risk; A character swapping judgment module, configured to judge whether the length of the target level domain name exceeds a preset length if it is determined that the character pair is not in the similar character pair set; If it is determined that the length of the target level domain name exceeds the preset length, then judge whether the target level domain name is obtained by swapping the positions of some characters of the target preset domain name keyword; if it is determined that the target level domain name is obtained by swapping the positions of some characters of the target preset domain name keyword, then determine that the domain name to be detected has a security risk.

8. An electronic device, characterized in that, It includes: At least one processor and a memory; The memory stores computer execution instructions; The at least one processor executes the computer execution instructions stored in the memory, so that the at least one processor executes the method according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, Computer execution instructions are stored in the computer-readable storage medium. When the processor executes the computer execution instructions, the method according to any one of claims 1-6 is implemented.

10. A computer program product, characterized in that, It includes computer execution instructions. When the processor executes the computer execution instructions, the method according to any one of claims 1-6 is implemented.

Images