Training method of suspicious domain name detection model and suspicious domain name detection method and device

Abstract

The invention discloses a training method of a suspicious domain name detection model and a suspicious domain name detection method and device, and relates to the technical field of computers. The method comprises the steps of obtaining a training sample set; extracting a target feature vector of the training sample set, wherein the target feature vector is used for indicating a generation rule of the suspicious domain name; and training the classification model according to the training sample set and the target feature vector to obtain a target suspicious domain name detection model. The target feature vector is obtained according to feature analysis of the training sample and can reflect the generation rule of the suspicious domain name, so that the detection model obtained according to the target feature vector training can detect the suspicious domain name outside the training sample set, thereby eliminating the limitation of suspicious domain name detection, enabling the extracted feature to be more targeted, and improving the detection efficiency. A more accurate suspicious domain name detection model is obtained, and the suspicious domain name is identified more accurately.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a suspicious domain name detection model training method, suspicious domain name detection method and device. Background Art

[0002] Domain name attack is a means of Internet attack. By attacking the domain name resolution server or forging the domain name resolution server, the target website domain name is resolved to the wrong IP address (i.e. suspicious domain name), so as to prevent users from accessing the target website or intentionally or maliciously require users to access the specified IP address (website). Suspicious domain names refer to a type of website with malicious links. Such websites usually take advantage of loopholes in application software or browsers to implant malicious codes such as Trojans and virus programs in the website, and use disguised website service content to induce users to visit.

[0003] At present, suspicious domain names are detected by using a suspicious domain name blacklist. The suspicious domain names in the suspicious domain name blacklist can be suspicious domain names recorded after the system is attacked, or suspicious domain names collected from the Internet. However, attackers can constantly update suspicious domain names and use new suspicious domain names to attack the system. Therefore, the needs of suspicious domain name detection cannot be met based only on known suspicious domain names, making suspicious domain name detection limited and unable to accurately detect suspicious domain names. Therefore, how to improve the accuracy of suspicious domain name detection is a problem that needs to be solved urgently. Summary of the invention

[0004] In view of the above problems, the present application provides a suspicious domain name detection model training method, suspicious domain name detection method and device, which solves the problem of how to improve the accuracy of suspicious domain name detection.

[0005] In order to solve the above technical problems, this application proposes the following solutions:

[0006] In a first aspect, the present application provides a method for training a suspicious domain name detection model, the method comprising: obtaining a training sample set; extracting a target feature vector of the training sample set, the target feature vector being used to indicate a generation rule of a suspicious domain name; training a classification model according to the training sample set and the target feature vector to obtain a target suspicious domain name detection model.

[0007] The target feature vector is obtained based on the feature analysis of the training samples and can reflect the generation rules of suspicious domain names. Therefore, the detection model trained based on the target feature vector can detect suspicious domain names outside the training sample set, thereby eliminating the limitations of suspicious domain name detection, making the extracted features more targeted, and obtaining a more accurate suspicious domain name detection model, which can more accurately identify suspicious domain names.

[0008] In combination with the first aspect, in a possible implementation, the training sample set is cleaned; a first eigenvalue corresponding to a first feature of a training sample in the training sample set is extracted; and a target feature vector is constructed according to the first eigenvalue.

[0009] The training sample set includes a public normal domain name data set, a public suspicious domain name data set, normal domain names used during system maintenance, and suspicious domain names encountered. There are some duplicate sample data in the public data set that do not conform to the domain name naming specification. These sample data will affect the accuracy of the trained suspicious domain name detection model. Therefore, cleaning the training sample set can improve the accuracy of the suspicious domain name detection model and avoid interference from invalid sample data.

[0010] In combination with the first aspect, in another possible implementation, the first feature includes but is not limited to the proportion of numbers, the proportion of letters, the length of the domain name, the proportion of repeated letter occurrences, the proportion of repeated number occurrences, and the ratio of switching between numbers and letters.

[0011] The label in the domain name consists of English letters and numbers. Each label does not exceed 63 characters, and uppercase and lowercase letters are not distinguished. No other punctuation marks can be used in the label except hyphens. Therefore, by analyzing the numbers and English letters in suspicious domain names, the generation rules of suspicious domain names can be determined.

[0012] In combination with the first aspect, in another possible implementation method, the first eigenvalue is digitized and concatenated into a first eigenvector; the Word2Vec model is trained according to the text information of the training sample to obtain a second eigenvector; the first eigenvector and the second eigenvector are horizontally concatenated to obtain a target eigenvector.

[0013] The first feature value extracted by the above method includes numerical values ​​and characters. For example, the first feature includes a top-level domain category, and its corresponding first feature value may be .com. Therefore, the characters in the first feature value are digitized to facilitate model training.

[0014] Since the Word2Vec model can be used to map each character in a domain name to a vector, it can be used to represent the relationship between characters. Therefore, based on the extraction of the first feature, the Word2Vec model is trained according to the text information of the training sample to obtain the second feature vector, and the first feature vector and the second feature vector are horizontally spliced ​​to further obtain the features of the suspicious domain name.

[0015] In combination with the first aspect, in another possible implementation, before training the Word2Vec model based on the domain name text information, the text information of the training sample is converted into a one-hot encoded vector.

[0016] One-hot encoding is the process of converting categorical variables into a form that is easy to use for machine learning algorithms, that is, representing categorical variables as binary vectors. Since the input of the Word2Vec model is a two-dimensional array, the text information of the training sample is converted into a binary vector through one-hot encoding to facilitate the training of the Word2Vec model.

[0017] In combination with the first aspect, in another possible implementation, a convolutional neural network model is trained according to a training sample set and a target feature vector to obtain a first suspicious domain name detection model, and a first accuracy of the first suspicious domain name detection model is calculated; a long short-term memory network model is trained according to the training sample set and the target feature vector to obtain a second suspicious domain name detection model, and a second accuracy of the second suspicious domain name detection model is calculated; when the first accuracy is greater than or equal to the second accuracy, the first suspicious domain name detection model is used as a target suspicious domain name detection model; or, when the first accuracy is less than the second accuracy, the second suspicious domain name detection model is used as a target suspicious domain name detection model.

[0018] The long short-term memory network model and the convolutional neural network model are both classification models. The long short-term memory network model and the convolutional neural network model are trained according to the training sample set and the target feature vector, and the accuracy of the trained models is compared to obtain a suspicious domain name detection model with higher accuracy.

[0019] In a second aspect, the present application provides a suspicious domain name detection method, the method comprising: obtaining a domain name to be detected; extracting a target feature vector of the domain name to be detected; inputting the target feature vector into a trained suspicious domain name detection model to obtain a detection result of the domain name to be detected.

[0020] In combination with the second aspect, in a possible implementation method, the domain name to be detected is cleaned; the first eigenvalue corresponding to the first feature of the domain name to be detected is extracted, the first eigenvalue is digitized, and the first eigenvalue is spliced ​​into a first eigenvector, where the first feature includes but is not limited to the proportion of numbers, the proportion of letters, the length of the domain name, the proportion of repeated letter occurrences, the proportion of repeated number occurrences, and the ratio of switching between numbers and letters; the Word2Vec model is trained according to the text information of the domain name to be detected to obtain a second eigenvector; the first eigenvector and the second eigenvector are horizontally spliced ​​to obtain a target eigenvector.

[0021] The training sample set includes a public normal domain name data set, a public suspicious domain name data set, normal domain names used during system maintenance, and suspicious domain names encountered. There are some duplicate sample data in the public data set that do not conform to the domain name naming specification. These sample data will affect the accuracy of the trained suspicious domain name detection model. Therefore, cleaning the training sample set can improve the accuracy of the suspicious domain name detection model and avoid interference from invalid sample data.

[0022] At the same time, the labels in the domain names are composed of English letters and numbers. Each label does not exceed 63 characters, and uppercase and lowercase letters are not distinguished. No other punctuation marks can be used in the labels except hyphens. Therefore, by analyzing the numbers and English letters in suspicious domain names, the generation rules of suspicious domain names can be determined.

[0023] Secondly, since the Word2Vec model can be used to map each character in a domain name to a vector, it can be used to represent the relationship between characters. Therefore, based on the extraction of the first feature, the Word2Vec model is trained according to the text information of the training sample to obtain the second feature vector, and the first feature vector and the second feature vector are horizontally spliced ​​to further obtain the features of the suspicious domain name.

[0024] In a third aspect, the present application provides a training device for a suspicious domain name detection model, and the training device for a suspicious domain name detection model includes: an acquisition module, an extraction module and a training module.

[0025] The acquisition module is used to obtain the training sample set.

[0026] The extraction module is used to extract the target feature vector of the training sample set, and the target feature vector is used to indicate the generation rule of suspicious domain names.

[0027] The training module is used to train the classification model according to the training sample set and the target feature vector to obtain the target suspicious domain name detection model.

[0028] In conjunction with the third aspect, in a possible implementation, the extraction module is specifically used to clean the training sample set; extract the first eigenvalue corresponding to the first feature of the training sample in the training sample set; and construct a target feature vector according to the first eigenvalue.

[0029] In combination with the third aspect, in another possible implementation method, the extraction module is specifically used to digitize the first eigenvalue and splice the first eigenvalue into a first eigenvector; train the Word2Vec model according to the text information of the training sample to obtain the second eigenvector; and horizontally splice the first eigenvector and the second eigenvector to obtain the target eigenvector.

[0030] In combination with the third aspect, in another possible implementation method, the first feature includes but is not limited to the proportion of numbers, the proportion of letters, the length of the domain name, the proportion of repeated letter occurrences, the proportion of repeated number occurrences, and the ratio of switching between numbers and letters.

[0031] In combination with the third aspect, in another possible implementation, the extraction module is further used to convert the text information of the training sample into a one-hot encoded vector before training the Word2Vec model based on the domain name text information.

[0032] In combination with the third aspect, in another possible implementation method, the training module is specifically used to train the convolutional neural network model according to the training sample set and the target feature vector to obtain a first suspicious domain name detection model, and calculate a first accuracy rate of the first suspicious domain name detection model; train the long short-term memory network model according to the training sample set and the target feature vector to obtain a second suspicious domain name detection model, and calculate a second accuracy rate of the second suspicious domain name detection model; when the first accuracy rate is greater than or equal to the second accuracy rate, use the first suspicious domain name detection model as the target suspicious domain name detection model; or, when the first accuracy rate is less than the second accuracy rate, use the second suspicious domain name detection model as the target suspicious domain name detection model.

[0033] In a fourth aspect, the present application provides a suspicious domain name detection device, which includes: an acquisition module, an extraction module and a detection module.

[0034] The acquisition module is used to obtain the domain name to be detected.

[0035] The extraction module is used to extract the target feature vector of the domain name to be detected.

[0036] The detection module is used to input the target feature vector into the trained suspicious domain name detection model to obtain the detection result of the domain name to be detected.

[0037] In combination with the fourth aspect, in a possible implementation method, the extraction module is specifically used to clean the domain name to be detected; extract the first eigenvalue corresponding to the first feature of the domain name to be detected, digitize the first eigenvalue, and splice the first eigenvalue into a first eigenvector, where the first feature includes but is not limited to the proportion of numbers, the proportion of letters, the length of the domain name, the proportion of letter repetitions, the proportion of number repetitions, and the ratio of switching between numbers and letters; train the Word2Vec model according to the text information of the domain name to be detected to obtain a second eigenvector; horizontally splice the first eigenvector and the second eigenvector to obtain a target eigenvector.

[0038] In order to achieve the above-mentioned purpose, according to the fifth aspect of the present application, a storage medium is provided, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the training method of the suspicious domain name detection model of the above-mentioned first aspect.

[0039] In order to achieve the above-mentioned purpose, according to the sixth aspect of the present application, a storage medium is provided, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the suspicious domain name detection method of the second aspect mentioned above.

[0040] In order to achieve the above-mentioned purpose, according to the seventh aspect of the present application, an electronic device is provided, which includes at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other through the bus; the processor is used to call the program instructions in the memory to execute the training method of the suspicious domain name detection model of the first aspect mentioned above.

[0041] In order to achieve the above-mentioned purpose, according to the eighth aspect of the present application, an electronic device is provided, which includes at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other through the bus; the processor is used to call the program instructions in the memory to execute the suspicious domain name detection method of the second aspect mentioned above.

[0042] By means of the above technical solution, the technical solution provided by this application has at least the following advantages:

[0043] The present application provides a training method for a suspicious domain name detection model, a suspicious domain name detection method and a device. The target feature vector of the present application is obtained based on the feature analysis of the training sample, which can reflect the generation rules of the suspicious domain name. Therefore, the detection model trained based on the target feature vector can detect suspicious domain names outside the training sample set, thereby eliminating the limitations of suspicious domain name detection, making the extracted features more targeted, obtaining a more accurate suspicious domain name detection model, and more accurately identifying suspicious domain names.

[0044] Specifically, the feature vector obtained by the Word2Vec model can determine the relationship between the characters of the suspicious domain name, and the generation rules of the suspicious domain name can be further determined by analyzing the numbers and English letters in the suspicious domain name. The target suspicious domain name detection model that can accurately detect suspicious domain names can be obtained by training the classification model according to the target feature vector used to indicate the generation rules of suspicious domain names.

[0045] Furthermore, according to the training sample set and the target feature vector, the long short-term memory network model and the convolutional neural network model are trained respectively, and the accuracy of the trained models is compared, so that a suspicious domain name detection model with higher accuracy can be obtained. In addition, cleaning the training sample set can improve the accuracy of the suspicious domain name detection model and avoid interference from invalid sample data.

[0046] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0048] Figure 1 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application is shown;

[0049] Figure 2 A flow chart of a method for training a suspicious domain name detection model provided in an embodiment of the present application is shown;

[0050] Figure 3 A schematic diagram of a process for detecting a suspicious domain name provided by an embodiment of the present application is shown;

[0051] Figure 4 A schematic diagram showing the composition of a training device for a suspicious domain name detection model provided in an embodiment of the present application is shown;

[0052] Figure 5 A schematic diagram of the composition of a suspicious domain name detection device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0053] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0054] In the embodiments of the present application, the terms "first" and "second" do not have a logical or temporal dependency, nor do they limit the quantity and execution order. It should also be understood that although the following description uses the terms first, second, etc. to describe various elements, these elements should not be limited by the terms. These terms are only used to distinguish one element from another element.

[0055] In the embodiments of the present application, the term "at least one" means one or more, and the term "plurality" means two or more.

[0056] It should also be understood that the term "if" may be interpreted as "when" or "upon" or "in response to determining" or "in response to detecting." Similarly, the phrase "if it is determined that ..." or "if [a stated condition or event] is detected" may be interpreted as "upon determining that ..." or "in response to determining that ..." or "upon detecting [a stated condition or event]" or "in response to detecting [a stated condition or event]," depending on the context.

[0057] To facilitate understanding of the solutions of the present application, a brief introduction to the relevant concepts is first given as follows.

[0058] Domain Name: Also known as a network domain, it is the name of a computer or a group of computers on the Internet consisting of a string of names separated by dots, used to locate the computer during data transmission (sometimes also refers to the geographical location).

[0059] Convolutional Neural Networks (CNN) is a type of feed-forward neural network (FFNN) that includes convolutional calculations and has a deep structure. It is one of the representative algorithms of deep learning. Convolutional neural networks can be applied to computer vision such as image classification, object recognition, action recognition, pose estimation, neural style transfer, etc., and can also be applied to natural language processing (NLP).

[0060] Generally speaking, a convolutional neural network includes an input layer, a hidden layer, and an output layer. Among them, the input layer of the convolutional neural network can process multi-dimensional data.

[0061] The hidden layer of a convolutional neural network includes one or more convolutional layers, one or more pooling layers, and one or more fully-connected layers. The function of the convolutional layer is to extract features from the input data. The pooling layer is usually connected after the convolutional layer, so that after the convolutional layer extracts features, the output data is passed to the pooling layer for selection and information filtering. Each node of the fully-connected layer is connected to all nodes of the previous layer to integrate the acquired features. The fully-connected layer plays the role of a "classifier" in the entire convolutional neural network.

[0062] The output layer of the convolutional neural network has the same structure and working principle as the output of the traditional feedforward neural network. For example, for the convolutional neural network for image classification, the output layer uses a logistic function or a normalized exponential function (Soft MaxFunction) to output the classification label.

[0063] The Long Short Term Memory (LTSM) network model is essentially a specific form of Recurrent Neural Network (RNN). The LSTM model solves the problem of RNN short-term memory by adding gates on the basis of the RNN model, so that the RNN can truly and effectively utilize long-distance time series information.

[0064] LSTM adds three logical control units, namely input gate, output gate, and forget gate, to the basic structure of RNN, and each of them is connected to a multiplication element. It controls the input and output of the information flow and the state of the cell (memory cell) by setting the weights at the edges where the memory unit of the neural network is connected to other parts.

[0065] The above is an introduction to the technical terms involved in the embodiments of the present application, which will not be repeated below.

[0066] As described in the background art, the need for suspicious domain name detection cannot be met only based on a known suspicious domain name sample set, so that suspicious domain name detection has limitations and cannot accurately detect suspicious domain names.

[0067] In view of this, the embodiment of the present application provides a training method for a suspicious domain name detection model, and the specific method includes: obtaining a training sample set; extracting a target feature vector of the training sample set, the target feature vector is used to indicate the generation rule of the suspicious domain name; training the classification model according to the training sample set and the target feature vector to obtain a target suspicious domain name detection model. The target feature vector is obtained based on the feature analysis of the training sample, and can reflect the generation rule of the suspicious domain name. Therefore, the detection model trained according to the target feature vector can detect suspicious domain names outside the training sample set, thereby eliminating the limitations of suspicious domain name detection, making the extracted features more targeted, obtaining a more accurate suspicious domain name detection model, and more accurately identifying suspicious domain names.

[0068] The embodiment of the present application also provides a training device for a suspicious domain name detection model, which can be used to execute the training method for the suspicious domain name detection model. Optionally, the training device for the suspicious domain name detection model can be an electronic device with data processing capabilities, or a functional module in the electronic device, which is not limited to this.

[0069] For example, the electronic device may be a server, which may be a single server, or a server cluster consisting of multiple servers. For another example, the electronic device may be a mobile phone, a tablet computer, a desktop, a laptop, a handheld computer, a notebook computer, an ultra-mobile personal computer (UMPC), a netbook, and a cellular phone, a personal digital assistant (PDA), an augmented reality (AR), a virtual reality (VR) device and other terminal devices. For another example, the electronic device may also be a recording device, a video surveillance device and other devices. The present application does not impose any special restrictions on the specific form of the electronic device.

[0070] The following example uses an electronic device as the training device for the suspicious domain name detection model. Figure 1 As shown, Figure 1 The present application provides a hardware structure of an electronic device 100.

[0071] like Figure 1 As shown, the electronic device 100 includes a processor 110 , a communication circuit 120 and a communication interface 130 .

[0072] Optionally, the electronic device 100 may further include a memory 140 . The processor 110 , the memory 140 and the communication interface 130 may be connected via a communication line 120 .

[0073] The processor 110 may be a central processing unit (CPU), a general-purpose processor, a network processor (NP), a digital signal processor (DSP), a microprocessor, a microcontroller, a programmable logic device (PLD), or any combination thereof. The processor 101 may also be any other device having a processing function, such as a circuit, a device, or a software module, without limitation.

[0074] In one example, the processor 110 may include one or more CPUs, such as Figure 1 CPU0 and CPU1 in.

[0075] As an optional implementation, the electronic device 100 includes multiple processors, for example, in addition to the processor 110, it may also include a processor 170. The communication line 120 is used to transmit information between the components included in the electronic device 100.

[0076] The communication interface 130 is used to communicate with other devices or other communication networks. The other communication networks may be Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), etc. The communication interface 130 may be a module, a circuit, a transceiver or any device capable of achieving communication.

[0077] The memory 140 is used to store instructions, where the instructions may be computer programs.

[0078] Among them, the memory 140 can be a read-only memory (ROM) or other types of static storage devices that can store static information and / or instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and / or instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), magnetic disk storage medium or other magnetic storage devices, etc., without limitation.

[0079] It should be noted that the memory 140 may exist independently of the processor 110 or may be integrated with the processor 110. The memory 140 may be used to store instructions or program codes or some data, etc. The memory 140 may be located inside the electronic device 100 or outside the electronic device 100, without limitation.

[0080] The processor 110 is used to execute the instructions stored in the memory 140 to implement the communication method provided in the following embodiments of the present application. For example, when the electronic device 100 is a terminal or a chip in a terminal, the processor 110 can execute the instructions stored in the memory 140 to implement the steps performed by the transmitting end in the following embodiments of the present application.

[0081] As an optional implementation, the electronic device 100 further includes an output device 150 and an input device 160. The output device 150 may be a device such as a display screen, a speaker, etc. that can output data of the electronic device 100 to a user. The input device 160 may be a device such as a keyboard, a mouse, a microphone, or a joystick that can input data to the electronic device 100.

[0082] It should be pointed out that Figure 1 The structure shown in the figure does not constitute a limitation on the computing device, except Figure 1 In addition to the components shown, the computing device may include more or fewer components than shown, or combine certain components, or arrange the components differently.

[0083] In addition, the embodiment of the present application also provides a suspicious domain name detection device, which can be used for the use of the trained suspicious domain name detection model. Moreover, the suspicious domain name detection device can also be an electronic device module with data processing capabilities, or a functional module in the electronic device, which is not limited. Optionally, the hardware structure of the use device can also be as follows Figure 1 shown.

[0084] In some embodiments, the training device for the suspicious domain name detection model and the suspicious domain name detection device may be integrated into one device; or, the training device for the suspicious domain name detection model and the suspicious domain name detection device may be two independent devices.

[0085] The training device for the suspicious domain name detection model, the suspicious domain name detection device, and the application scenario described in the embodiments of the present application are intended to more clearly illustrate the technical solution of the embodiments of the present application, and do not constitute a limitation on the technical solution provided in the embodiments of the present application. A person of ordinary skill in the art can appreciate that with the evolution of the training device for the suspicious domain name detection model and the emergence of new business scenarios, the technical solution provided in the embodiments of the present application is also applicable to similar technical problems.

[0086] Next, the training method of the suspicious domain name detection model is described in detail with reference to the accompanying drawings. Figure 2 A flowchart of a training method for a suspicious domain name detection model provided in this application. The method is applied to Figure 1 The training device of the suspicious domain name detection model of the hardware structure shown (hereinafter referred to as the training device for simple description) specifically includes the following steps:

[0087] Step 210: The training device obtains a training sample set.

[0088] The training sample set includes a public normal domain name set and a public suspicious domain name set. In addition, the training sample set also includes normal domain names used during system maintenance and suspicious domain names encountered. Adding normal domain names used during system maintenance and suspicious domain names encountered to the training sample set can make the trained classification model more suitable for the current system.

[0089] Step 220: The training device extracts the target feature vector of the training sample set.

[0090] Since there are some duplicate sample data that do not conform to domain name naming specifications in the public data set, these sample data will affect the accuracy of the trained suspicious domain name detection model. Therefore, the training sample set is cleaned.

[0091] Specifically, duplicate training samples in the training sample set and training samples that do not conform to the domain name naming rules are filtered out.

[0092] Taking the naming rules of English domain names as an example, English domain names are composed of English letters, numbers and hyphens. English domain names must comply with the following naming rules: (1) The maximum length of an English domain name cannot exceed 63 characters; (2) Domain names must not use spaces or special characters such as %, &, and *; (3) Hyphens cannot be registered alone or appear consecutively, and cannot be placed at the beginning or end of a domain name; (4) Some domain names do not support Chinese prefixes, such as ".com.cn", ".net.cn", ".org.cn", etc.

[0093] Further, extract the first feature value corresponding to the first feature of the training sample in the cleaned training sample set. The first feature includes but is not limited to the percentage of numbers, the percentage of letters, the length of the domain name, the percentage of repeated letters, the percentage of repeated numbers, and the ratio of switching between numbers and letters.

[0094] Since the labels in domain names are composed of English letters and numbers, each label is no more than 63 characters, and uppercase and lowercase letters are not distinguished. Except for hyphens, other punctuation marks cannot be used in labels. Therefore, by analyzing the numbers and English letters in suspicious domain names, the generation rules of suspicious domain names can be determined.

[0095] Specifically, the digit ratio is the ratio of digits to all characters in the domain name. The letter ratio is the ratio of letters to all characters in the domain name. The letter repetition ratio is the ratio of repeated letters to all characters in the domain name. The digit repetition ratio is the ratio of repeated digits to all characters in the domain name. The digit-letter switching ratio is the ratio of the number of adjacent characters in the domain name where one is a digit and the other is a letter to the total number of adjacent characters in the domain name.

[0096] Taking the domain name hao123.com as an example, the proportion of numbers in this domain name is 1 / 3, the proportion of letters is 2 / 3, the domain name length is 9, the number of repeated letters accounts for 2 / 9, the number of repeated numbers accounts for 0, and the switching ratio between numbers and letters is 2 / 8.

[0097] Secondly, extract the first characteristic values ​​of different domain name levels respectively. Domain name level is a standard for website classification, including top-level domain name, second-level domain name, etc. A complete domain name consists of two or more parts, each of which is separated by an English period. The right part of the last . is called the top-level domain name, and the left part of the top-level domain name is called the second-level domain name until the next .. The left part of the second-level domain name is called the third-level domain name, and so on. The domain name of each level controls the allocation of the next-level domain name. In the embodiment of the present application, the top-level domain name of the domain name is com, and the second-level domain name is hao123. The proportion of numbers in the second-level domain name is 1 / 2, the proportion of letters is 1 / 2, the domain name length is 6, the proportion of repeated occurrences of letters is 0, the proportion of repeated occurrences of numbers is 0, and the ratio of switching between numbers and letters is 1 / 5. The method for extracting the first characteristic value of the top-level domain name is the same as the method for extracting the first characteristic value of the second-level domain name, which will not be repeated here.

[0098] Furthermore, the first feature also includes the top-level domain category of the domain name, for example, the top-level domain category of the domain name can be .com, .org, .net, .cn. Since the classification model cannot directly process and calculate non-numeric features, it is necessary to digitize the non-numeric features in the first feature, that is, convert the non-numeric features into digital features that can be used in the model, and concatenate the digitized first features into a first feature vector.

[0099] In one embodiment, non-numeric features can be converted into one-hot encoding vectors or sequence values. One-hot encoding is the representation of categorical variables as binary vectors. Specifically, the feature values ​​are first mapped to integer values, and then each integer value is represented as a binary vector. One-hot encoding can solve the problem that the classification model cannot handle non-numeric features, and can also play a role in expanding features to a certain extent.

[0100] In one embodiment, the second feature vector is generated using a Word2Vec model. The Word2Vec model is a model used to generate word vectors. The model is a shallow, two-layer neural network. The Word2Vec model can be used to map each domain name to a numerical vector, which contains the relationship and difference between domain names.

[0101] For example, the text information of the domain name hao123.com is used as the input of the Word2Vec model, and the reduced-dimensional text feature vector, i.e., the second feature vector, is obtained after the Word2Vec model is trained. Since the feature vector output by the Word2Vec model contains the characteristics of the domain name itself as well as the relationship and difference between domain names, the Word2Vec model is trained based on the text information of the training sample on the basis of extracting the first feature to obtain the second feature vector, and the first feature vector and the second feature vector are horizontally spliced, and the target feature vector obtained can more accurately describe the characteristics of the suspicious domain name.

[0102] In the embodiment of the present application, due to the limitations of the Word2Vec model, it is necessary to convert the text information of the domain name into a one-hot encoding vector. The specific explanation of the one-hot encoding vector is as mentioned above and will not be repeated here.

[0103] Step 230: The training device trains the classification model according to the training sample set and the target feature vector to obtain a suspicious domain name detection model.

[0104] In one embodiment, a convolutional neural network model is trained according to a training sample set and a target feature vector to obtain a first suspicious domain name detection model, and a first accuracy rate of the first suspicious domain name detection model is calculated; a long short-term memory network model is trained according to a training sample set and a target feature vector to obtain a second suspicious domain name detection model, and a second accuracy rate of the second suspicious domain name detection model is calculated. When the first accuracy rate is greater than or equal to the second accuracy rate, the first suspicious domain name detection model is used as a target suspicious domain name detection model; or when the first accuracy rate is less than the second accuracy rate, the second suspicious domain name detection model is used as a target suspicious domain name detection model.

[0105] For example, the domain name data set is randomly divided into a domain name training set, a domain name verification set, and a domain name test set in a ratio of 6:2:2. The long short-term memory network model and the convolutional neural network model are trained on the domain name according to the domain name training set and the target feature vector, respectively, to obtain the first suspicious domain name detection model and the second suspicious domain name detection model. The domain name verification set is used to adjust the parameters of the first suspicious domain name detection model and the second suspicious domain name detection model, respectively, so that the model's prediction of whether the domain name is a suspicious domain name or a normal domain name is closer and closer to the actual result. Finally, the domain name test set is used to test the first suspicious domain name detection model and the second suspicious domain name detection model, respectively, to obtain the first accuracy rate and the second accuracy rate. The model with the high accuracy rate is used as the target suspicious domain name detection model.

[0106] In summary, the target feature vector is obtained based on the feature analysis of the training samples, which can reflect the generation rules of suspicious domain names. Therefore, the detection model trained based on the target feature vector can detect suspicious domain names outside the training sample set, thereby eliminating the limitations of suspicious domain name detection, making the extracted features more targeted, and obtaining a more accurate suspicious domain name detection model, which can more accurately identify suspicious domain names.

[0107] That is, the feature vector obtained by the Word2Vec model can determine the relationship between the characters of the suspicious domain name, and the generation rules of the suspicious domain name can be further determined by analyzing the numbers and English letters in the suspicious domain name. The target suspicious domain name detection model that can accurately detect suspicious domain names can be obtained by training the classification model according to the target feature vector used to indicate the generation rules of suspicious domain names.

[0108] Furthermore, according to the training sample set and the target feature vector, the long short-term memory network model and the convolutional neural network model are trained respectively, and the accuracy of the trained models is compared, so that a suspicious domain name detection model with higher accuracy can be obtained. In addition, cleaning the training sample set can improve the accuracy of the suspicious domain name detection model and avoid interference from invalid sample data.

[0109] In some embodiments, the present application also provides a suspicious domain name detection method, which is applied to the above-mentioned suspicious domain name detection device, such as Figure 3 As shown, the method includes:

[0110] Step 310: The suspicious domain name detection device obtains the domain name to be detected.

[0111] Step 320: The suspicious domain name detection device extracts a target feature vector of the domain name to be detected.

[0112] Specifically, the domain name to be detected is cleaned; the first eigenvalue corresponding to the first feature of the domain name to be detected is extracted, the first eigenvalue is digitized, and the first eigenvalue is spliced ​​into a first eigenvector, where the first feature includes but is not limited to the proportion of numbers, the proportion of letters, the length of the domain name, the proportion of repeated letter occurrences, the proportion of repeated number occurrences, and the ratio of switching between numbers and letters; the Word2Vec model is trained according to the text information of the domain name to be detected to obtain the second eigenvector; the first eigenvector and the second eigenvector are horizontally spliced ​​to obtain the target eigenvector.

[0113] The training sample set includes a public normal domain name data set, a public suspicious domain name data set, normal domain names used during system maintenance, and suspicious domain names encountered. There are some duplicate sample data in the public data set that do not conform to the domain name naming specification. These sample data will affect the accuracy of the trained suspicious domain name detection model. Therefore, cleaning the training sample set can improve the accuracy of the suspicious domain name detection model and avoid interference from invalid sample data.

[0114] At the same time, the labels in the domain names are composed of English letters and numbers. Each label does not exceed 63 characters, and uppercase and lowercase letters are not distinguished. No other punctuation marks can be used in the labels except hyphens. Therefore, by analyzing the numbers and English letters in suspicious domain names, the generation rules of suspicious domain names can be determined.

[0115] Secondly, since the Word2Vec model can be used to map each character in a domain name to a vector, it can be used to represent the relationship between characters. Therefore, based on the extraction of the first feature, the Word2Vec model is trained according to the text information of the training sample to obtain the second feature vector, and the first feature vector and the second feature vector are horizontally spliced ​​to further obtain the features of the suspicious domain name.

[0116] Step 330: The suspicious domain name detection device inputs the target feature vector into the trained suspicious domain name detection model to obtain the detection result of the domain name to be detected.

[0117] The detection result of the domain name to be detected can be normal or suspicious. When the detection result of the domain name to be detected is suspicious, the domain name to be detected is reported for processing.

[0118] It is understandable that in order to implement the functions in the above embodiments, the computer device includes hardware structures and / or software modules corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and method steps of each example described in the embodiments disclosed in this application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application scenario and design constraints of the technical solution.

[0119] Furthermore, as a response to the above Figure 2 The implementation of the method embodiment shown in the figure, the embodiment of the present application provides a training device for a suspicious domain name detection model. The embodiment of the device corresponds to the aforementioned method embodiment. For ease of reading, this embodiment will not repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. Figure 4As shown, the training device 400 for the suspicious domain name detection model includes: an acquisition module 410 , an extraction module 420 and a training module 430 .

[0120] The acquisition module 410 is used to acquire a training sample set.

[0121] The extraction module 420 is used to extract the target feature vector of the training sample set, and the target feature vector is used to indicate the generation rule of the suspicious domain name.

[0122] The training module 430 is used to train the classification model according to the training sample set and the target feature vector to obtain a target suspicious domain name detection model.

[0123] Further, such as Figure 4 As shown, the extraction module 420 is specifically used to clean the training sample set; extract the first eigenvalue corresponding to the first feature of the training sample in the training sample set; and construct a target feature vector according to the first eigenvalue. The first feature includes but is not limited to the proportion of numbers, the proportion of letters, the length of the domain name, the proportion of repeated occurrences of letters, the proportion of repeated occurrences of numbers, and the ratio of switching between numbers and letters.

[0124] Further, such as Figure 4 As shown, the extraction module 420 is specifically used to digitize the first eigenvalue and splice the first eigenvalue into a first eigenvector; train the Word2Vec model according to the text information of the training sample to obtain the second eigenvector; and horizontally splice the first eigenvector and the second eigenvector to obtain the target eigenvector.

[0125] Further, such as Figure 4 As shown, the extraction module 420 is also used to convert the text information of the training sample into a one-hot encoding vector before training the Word2Vec model according to the domain name text information.

[0126] Further, such as Figure 4 As shown, the training module 420 is specifically used to train the convolutional neural network model according to the training sample set and the target feature vector to obtain a first suspicious domain name detection model, and calculate a first accuracy rate of the first suspicious domain name detection model; train the long short-term memory network model according to the training sample set and the target feature vector to obtain a second suspicious domain name detection model, and calculate a second accuracy rate of the second suspicious domain name detection model; when the first accuracy rate is greater than or equal to the second accuracy rate, use the first suspicious domain name detection model as the target suspicious domain name detection model; or, when the first accuracy rate is less than the second accuracy rate, use the second suspicious domain name detection model as the target suspicious domain name detection model.

[0127] Furthermore, as a response to the above Figure 3The implementation of the method embodiment shown in the figure, the embodiment of the present application provides a suspicious domain name detection device, which is used to detect suspicious domain names. The embodiment of the device corresponds to the aforementioned method embodiment. For ease of reading, this embodiment will no longer repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. Specifically, Figure 5 As shown, the suspicious domain name detection device 500 includes: an acquisition module 510, an extraction module 520 and a detection module 530.

[0128] The acquisition module 510 is used to acquire the domain name to be detected.

[0129] The extraction module 520 is used to extract the target feature vector of the domain name to be detected.

[0130] The detection module 530 is used to input the target feature vector into the trained suspicious domain name detection model to obtain the detection result of the domain name to be detected.

[0131] Further, such as Figure 5 As shown, the extraction module 520 is specifically used to clean the domain name to be detected; extract the first eigenvalue corresponding to the first feature of the domain name to be detected, digitize the first eigenvalue, and splice the first eigenvalue into a first eigenvector, where the first feature includes but is not limited to the proportion of numbers, the proportion of letters, the length of the domain name, the proportion of repeated letter occurrences, the proportion of repeated number occurrences, and the ratio of switching between numbers and letters; train the Word2Vec model according to the text information of the domain name to be detected to obtain a second eigenvector; horizontally splice the first eigenvector and the second eigenvector to obtain a target eigenvector.

[0132] Furthermore, an embodiment of the present application also provides an electronic device, the electronic device includes a processor and a memory, the acquisition module 410, the extraction module 420 and the training module 430 are all stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions. The processor includes a kernel, and the kernel retrieves the corresponding program unit from the memory.

[0133] Furthermore, an embodiment of the present application also provides an electronic device, the electronic device includes a processor and a memory, the acquisition module 510, the extraction module 520 and the detection module 530 are all stored in the memory as program units, and the processor executes the program units stored in the memory to implement corresponding functions. The processor includes a kernel, and the kernel retrieves the corresponding program unit from the memory.

[0134] An embodiment of the present application provides a storage medium on which a program is stored. When the program is executed by a processor, the training method of the suspicious domain name detection model is implemented.

[0135] An embodiment of the present application provides another storage medium on which a program is stored. When the program is executed by a processor, the suspicious domain name detection method is implemented.

[0136] An embodiment of the present application provides a processor, which is used to run a program, wherein the training method of the suspicious domain name detection model is executed when the program is running.

[0137] An embodiment of the present application provides another processor, which is used to run a program, wherein the suspicious domain name detection method is executed when the program is running.

[0138] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that initializes the following method steps: obtaining a training sample set; extracting a target feature vector of the training sample set, the target feature vector being used to indicate a generation rule of a suspicious domain name; training a classification model based on the training sample set and the target feature vector to obtain a target suspicious domain name detection model.

[0139] Furthermore, the training sample set is cleaned; the first eigenvalue corresponding to the first feature of the training sample in the training sample set is extracted; and the target feature vector is constructed according to the first eigenvalue.

[0140] Furthermore, the first eigenvalue is digitized and concatenated into a first eigenvector; the Word2Vec model is trained according to the text information of the training sample to obtain a second eigenvector; the first eigenvector and the second eigenvector are concatenated horizontally to obtain a target eigenvector.

[0141] Furthermore, the first feature includes but is not limited to the proportion of numbers, the proportion of letters, the length of the domain name, the proportion of repeated letter occurrences, the proportion of repeated number occurrences, and the ratio of switching between numbers and letters.

[0142] Furthermore, before training the Word2Vec model based on the domain name text information, the text information of the training samples is converted into a one-hot encoded vector.

[0143] Further, the convolutional neural network model is trained according to the training sample set and the target feature vector to obtain a first suspicious domain name detection model, and a first accuracy of the first suspicious domain name detection model is calculated; the long short-term memory network model is trained according to the training sample set and the target feature vector to obtain a second suspicious domain name detection model, and a second accuracy of the second suspicious domain name detection model is calculated; when the first accuracy is greater than or equal to the second accuracy, the first suspicious domain name detection model is used as the target suspicious domain name detection model; or, when the first accuracy is less than the second accuracy, the second suspicious domain name detection model is used as the target suspicious domain name detection model.

[0144] The present application also provides another computer program product, which, when executed on a data processing device, is suitable for executing a program that initializes the following method steps: obtaining a domain name to be detected; extracting a target feature vector of the domain name to be detected; inputting the target feature vector into a trained suspicious domain name detection model to obtain a detection result of the domain name to be detected.

[0145] Furthermore, the domain name to be detected is cleaned; the first eigenvalue corresponding to the first feature of the domain name to be detected is extracted, the first eigenvalue is digitized, and the first eigenvalue is spliced ​​into a first eigenvector, where the first feature includes but is not limited to the proportion of numbers, the proportion of letters, the length of the domain name, the proportion of repeated letter occurrences, the proportion of repeated number occurrences, and the ratio of switching between numbers and letters; the Word2Vec model is trained according to the text information of the domain name to be detected to obtain a second eigenvector; the first eigenvector and the second eigenvector are horizontally spliced ​​to obtain a target eigenvector.

[0146] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0147] In a typical configuration, the device includes one or more processors (CPU), memory and bus. The device may also include input / output interface, network interface and the like.

[0148] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip. The memory is an example of a computer-readable medium.

[0149] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0150] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0151] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0152] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A training method for a suspicious domain name detection model, characterized in that: The method comprises: Obtain a training sample set; Extracting a target feature vector of the training sample set, wherein the target feature vector is used to indicate a generation rule of a suspicious domain name; The classification model is trained according to the training sample set and the target feature vector to obtain a target suspicious domain name detection model.

2. The method according to claim 1, characterized in that Extracting the target feature vector of the training sample set includes: Cleaning the training sample set; Extracting a first feature value corresponding to a first feature of a training sample in the training sample set; The target feature vector is constructed according to the first feature value.

3. The method according to claim 2, characterized in that Constructing the target feature vector according to the first feature value includes: digitizing the first eigenvalues ​​and concatenating the first eigenvalues ​​into a first eigenvector; Training the Word2Vec model according to the text information of the training sample to obtain a second eigenvector; The first feature vector and the second feature vector are horizontally spliced ​​to obtain the target feature vector.

4. The method according to any one of claims 2 to 3, characterized in that: The first feature includes but is not limited to the proportion of numbers, the proportion of letters, the length of the domain name, the proportion of repeated letter occurrences, the proportion of repeated number occurrences, and the ratio of switching between numbers and letters.

5. The method according to claim 3, characterized in that: Before training the Word2Vec model according to the domain name text information, the method further includes: The text information of the training sample is converted into a one-hot encoded vector.

6. The method according to claim 1, characterized in that The classification model is trained according to the training sample set and the target feature vector to obtain a target suspicious domain name detection model, including: Training a convolutional neural network model according to the training sample set and the target feature vector to obtain a first suspicious domain name detection model, and calculating a first accuracy rate of the first suspicious domain name detection model; Training a long short-term memory network model according to the training sample set and the target feature vector to obtain a second suspicious domain name detection model, and calculating a second accuracy rate of the second suspicious domain name detection model; When the first accuracy rate is greater than or equal to the second accuracy rate, using the first suspicious domain name detection model as the target suspicious domain name detection model; or, When the first accuracy rate is lower than the second accuracy rate, the second suspicious domain name detection model is used as the target suspicious domain name detection model.

7. A suspicious domain name detection method, characterized in that: The method comprises: Get the domain name to be tested; Extracting a target feature vector of the domain name to be detected; The target feature vector is input into the trained suspicious domain name detection model to obtain the detection result of the domain name to be detected.

8. The method according to claim 7, characterized in that Extracting the feature vector of the domain name to be detected includes: Cleaning the domain name to be detected; Extracting a first feature value corresponding to the first feature of the domain name to be detected, digitizing the first feature value, and splicing the first feature value into a first feature vector, wherein the first feature is not limited to a percentage of digits, a percentage of letters, a length of the domain name, a percentage of repeated occurrences of letters, a percentage of repeated occurrences of digits, and a switching ratio between digits and letters; The Word2Vec model is trained according to the text information of the domain name to be detected to obtain a second feature vector; The first feature vector and the second feature vector are horizontally spliced ​​to obtain the target feature vector.

9. A training device for a suspicious domain name detection model, characterized in that: The device comprises: An acquisition module is used to acquire a training sample set; An extraction module, used to extract a target feature vector of the training sample set, wherein the target feature vector is used to indicate a generation rule of a suspicious domain name; The training module is used to train the classification model according to the training sample set and the target feature vector to obtain a suspicious domain name detection model.

10. A suspicious domain name detection device, characterized in that: The device comprises: An acquisition module is used to obtain the domain name to be detected; An extraction module, used to extract a target feature vector of the domain name to be detected; The detection module is used to input the target feature vector into the trained suspicious domain name detection model to obtain the detection result of the domain name to be detected.

Images