Probability prediction model training method, non-target domain name detection method and device

Abstract

The invention provides a probability prediction model training method and device and a non-target domain name detection method and device, and relates to the technical field of information security. The probability prediction model training method comprises the following steps: acquiring domain name data, and preprocessing the domain name data to obtain an integer array with a preset length; performing word embedding on the array to obtain first domain name data; obtaining a local key feature map of the first domain name data through a convolutional neural network; obtaining context features of the local key feature map through a gating loop unit; mapping the feature space of the local key feature map and the feature space of the context feature to a one-dimensional sample marking space through a convolutional neural network; and obtaining a prediction probability of the first domain name data according to the sample marking space, and obtaining a probability that the first domain name data is a non-target domain name through the prediction probability. According to the method, the problem of high training and calculation difficulty caused by a machine learning model fusing the convolutional neural network and the long and short term memory network can be solved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method for training a probability prediction model, and a method and device for detecting non-target domain names. Background Art

[0002] The Domain Name System (DNS) is a distributed database on the Internet that maps domain names to Internet Protocol (IP) addresses. It enables users to access the Internet more conveniently without having to remember the network protocol number strings that can be directly read by machines. DNS services have penetrated into every corner of the Internet and become an indispensable key link on the Internet. It is currently the most critical infrastructure on the Internet. As a core service of the Internet, the security of DNS is of vital importance, because once DNS is attacked or has security defects, it will cause immeasurable losses to the entire network. In addition to the security of DNS, the emergence of non-benign software is also becoming more and more frequent. The Domain Generation Algorithm (DGA) is an important technology for non-benign software to evade detection. It generates a large number of pseudo-random domain names for contacting command and control servers. Because the use of fixed domains or network protocol addresses is easy to be detected and blocked, many non-benign software uses domain generation algorithms to directly switch to new domain names, thereby evading supervision without the need to regularly release new versions or redeploy.

[0003] In the prior art, a machine learning model that combines Convolutional Neural Networks (CNN) and Long Short-term Memory (LSTM) is used to detect DGA, which extracts the contextual features of the domain name while extracting the local features of the domain name. However, the LSTM has many parameters, so the training and calculation of the machine learning model is difficult. Summary of the invention

[0004] The present application provides a training method for a probability prediction model, a detection method and device for non-target domain names, which are used to solve the problem of high training and calculation difficulty caused by a machine learning model that integrates a convolutional neural network and a long short-term memory network.

[0005] A first aspect of an embodiment of the present invention provides a method for training a probability prediction model, comprising:

[0006] Acquire domain name data in domain name system traffic, and pre-process the domain name data to obtain an integer array of a preset length;

[0007] Performing word embedding on the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix;

[0008] Performing feature extraction and dimensionality reduction on the first domain name data through a convolutional neural network to obtain a local key feature graph of the first domain name data;

[0009] Obtaining context features of the local key feature map through a gated recurrent unit;

[0010] When the task is a binary classification task, the feature space of the local key feature map and the feature space of the context feature are mapped to a one-dimensional sample label space through the convolutional neural network; wherein the task is a binary classification task, which is used to indicate whether the first domain name data is a target domain name or a non-target domain name;

[0011] The predicted probability of the first domain name data is obtained according to the one-dimensional sample label space, so as to obtain the probability that the first domain name data is a non-target domain name through the predicted probability.

[0012] In a possible design, the feature extraction and dimension reduction of the first domain name data are performed by a convolutional neural network to obtain a local key feature map of the first domain name data, including:

[0013] Performing a convolution operation on the first domain name data through the convolution layer of the convolutional neural network to obtain a feature map corresponding to the first domain name data;

[0014] The feature map is downsampled through the pooling layer of the convolutional neural network to obtain a local key feature map of the first domain name data.

[0015] In one possible design, the feature map is a matrix;

[0016] The downsampling operation is performed on the feature map through the pooling layer of the convolutional neural network to obtain a local key feature map of the first domain name data, including:

[0017] Moving a pooling matrix of a preset size to each position of the feature map one by one to obtain a coverage area corresponding to each position; wherein the size of each coverage area is the same as the size of the pooling matrix;

[0018] The maximum value among the multiple values ​​of each of the coverage areas is obtained, and the local key feature map is obtained according to the maximum value in each of the coverage areas.

[0019] In a possible design, the domain name data includes a plurality of uppercase letters and a plurality of lowercase letters;

[0020] The preprocessing of the domain name data to obtain an integer array of a preset length includes:

[0021] Deleting duplicate data and irrelevant data in the domain name data to obtain second domain name data;

[0022] The second domain name data is filled with filling characters to obtain third domain name data; wherein the length of the third domain name data is a preset length;

[0023] Convert each of the uppercase letters in the third domain name data into a corresponding lowercase letter to obtain fourth domain name data;

[0024] Dictionary mapping is performed on the fourth domain name data to obtain an integer array of the preset length.

[0025] In a possible design, mapping the feature space of the local key feature map and the feature space of the context feature to a one-dimensional sample label space through the convolutional neural network includes:

[0026] The feature space of the local key feature map and the feature space of the context feature are mapped to a one-dimensional sample label space through the fully connected layer of the convolutional neural network.

[0027] A second aspect of an embodiment of the present invention provides a method for detecting a non-target domain name, including:

[0028] Acquire domain name data in domain name system traffic, and pre-process the domain name data to obtain an integer array of a preset length;

[0029] Performing word embedding on the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix;

[0030] When the first domain name data is neither in a preset blacklist nor in a preset whitelist, the first domain name data is input into a preset probability prediction model to obtain a predicted probability of the first domain name data, so as to determine whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability; wherein the probability prediction model is a model obtained by providing a training method for a probability prediction model according to the first aspect of an embodiment of the present invention.

[0031] In a possible design, determining, according to the predicted probability, whether the first domain name data is a target domain name or a non-target domain name includes:

[0032] If the predicted probability is less than a first preset value, the first domain name data is determined to be a target domain name; if the predicted probability is greater than a second preset value, the first domain name data is determined to be a non-target domain name; wherein the first preset value is less than the second preset value.

[0033] In a possible design, if the predicted probability is not less than the first preset value and not greater than the second preset value, the method further includes:

[0034] Obtaining the entropy value, the number of consonants and the domain name length of the first domain name data;

[0035] If the entropy value is greater than a third preset value, the number of consonants is greater than a fourth preset value, and the domain name length is greater than a fifth preset value, the first domain name data is determined to be a target domain name; otherwise, the first domain name data is determined to be a non-target domain name.

[0036] A third aspect of an embodiment of the present invention provides a training device for a probability prediction model, comprising:

[0037] A preprocessing module, used for acquiring domain name data in domain name system traffic, and preprocessing the domain name data to obtain an integer array of a preset length;

[0038] A word embedding module, used for embedding the integer array into words, so as to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix;

[0039] A local feature extraction module, used to perform feature extraction and dimension reduction on the first domain name data through a convolutional neural network to obtain a local key feature graph of the first domain name data;

[0040] A context feature extraction module, used for obtaining the context features of the local key feature map through a gated recurrent unit;

[0041] A mapping module, used for mapping the feature space of the local key feature map and the feature space of the context feature to a one-dimensional sample label space through the convolutional neural network when the task is a binary classification task; wherein the task is a binary classification task, used for indicating whether the first domain name data is a target domain name or a non-target domain name;

[0042] The output module is used to obtain the predicted probability of the first domain name data according to the one-dimensional sample label space, so as to obtain the probability that the first domain name data is a non-target domain name through the predicted probability.

[0043] A fourth aspect of an embodiment of the present invention provides a non-target domain name detection device, including:

[0044] A preprocessing module, used for acquiring domain name data in domain name system traffic, and preprocessing the domain name data to obtain an integer array of a preset length;

[0045] A word embedding module, used for embedding the integer array into words, so as to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix;

[0046] A probability prediction module is used to input the first domain name data into a preset probability prediction model to obtain the predicted probability of the first domain name data when the first domain name data is neither in a preset blacklist nor in a preset whitelist, so as to determine whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability; wherein the probability prediction model is a model obtained by providing a training device for a probability prediction model according to the third aspect of an embodiment of the present invention.

[0047] A fifth aspect of an embodiment of the present invention provides an electronic device, including: a processor and a memory communicatively connected to the processor;

[0048] The memory stores computer-executable instructions;

[0049] The processor executes the computer-executable instructions stored in the memory to implement the probability prediction model training method provided by the first aspect of the embodiment of the present invention or the non-target domain name detection method provided by the second aspect of the embodiment of the present invention.

[0050] The sixth aspect of the embodiments of the present invention provides a computer-readable storage medium, which stores computer execution instructions to implement the probability prediction model training method provided by the first aspect of the embodiments of the present invention or the non-target domain name detection method provided by the second aspect of the embodiments of the present invention.

[0051] A seventh aspect of an embodiment of the present invention provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the training method of the probability prediction model provided in the first aspect of the embodiment of the present invention or the detection method of the non-target domain name provided in the second aspect of the embodiment of the present invention.

[0052] The present application provides a method for training a probability prediction model, a method for detecting a non-target domain name, and a device. The method for training the probability prediction model includes: obtaining domain name data in domain name system traffic, and preprocessing the domain name data to obtain an integer array of a preset length; embedding the integer array into words to obtain first domain name data, wherein the first domain name data is a low-dimensional dense matrix; performing feature extraction and dimensionality reduction on the first domain name data through a convolutional neural network to obtain a local key feature map of the first domain name data; obtaining context features of the local key feature map through a gated recurrent unit; when the task is a binary classification task, mapping the feature space of the local key feature map and the feature space of the context features to a one-dimensional sample label space through a convolutional neural network, wherein the task is a binary classification task, which is used to indicate whether the first domain name data is a target domain name or a non-target domain name; obtaining a predicted probability of the first domain name data according to the one-dimensional sample label space, so as to obtain the probability of the first domain name data being a non-target domain name through the predicted probability. Based on the above method, the following technical effects are achieved: a convolutional neural network is used to extract local feature information from domain name data, and a gated recurrent unit is used to extract contextual information from domain name data. Based on local feature information and contextual information, a more accurate output can be obtained; by performing word embedding, the input discrete domain name data can be converted into a low-dimensional dense matrix so that the neural network can better understand the input data in subsequent tasks; by performing contextual feature extraction through a gated recurrent unit, the difficulty of model training can be reduced and it is easier to calculate. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0054] Figure 1 Schematic diagram of the training method of the probability prediction model provided in the embodiment of the present application Figure 1 ;

[0055] Figure 2 Schematic diagram of the training method of the probability prediction model provided in the embodiment of the present application Figure 2 ;

[0056] Figure 3 Schematic diagram of the process of detecting non-target domain names provided in the embodiment of the present application Figure 1 ;

[0057] Figure 4 Schematic diagram of the process of detecting non-target domain names provided in the embodiment of the present application Figure 2 ;

[0058] Figure 5 A schematic diagram of the structure of a training device for a probability prediction model provided in an embodiment of the present application;

[0059] Figure 6 A schematic diagram of the structure of a non-target domain name detection device provided in an embodiment of the present application;

[0060] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] In the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with substantially the same functions and effects. Those skilled in the art will understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference. It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in this application should not be interpreted as being more preferred or more advantageous than other embodiments or design. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way. In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more.

[0062] It should be noted that the "at..." in the embodiment of the present application can be the instant when a certain situation occurs, or it can be a period of time after a certain situation occurs, and the embodiment of the present application does not specifically limit this. In addition, a model training method provided in the embodiment of the present application is only used as an example, and the model training method can also include more or less content.

[0063] In order to clearly describe the technical solutions of the embodiments of the present application, some terms and technologies involved in the embodiments of the present application are briefly introduced below:

[0064] Convolutional neural network: It is a type of feedforward neural network and one of the most successful algorithms in the field of deep learning. It has been widely used in large-scale image processing tasks. In addition to image processing, convolutional neural networks can also be applied to text classification. Convolutional neural networks include one-dimensional, two-dimensional and three-dimensional neural networks. Among them, one-dimensional convolutional neural networks are mainly used for tasks such as sequence data processing, two-dimensional convolutional neural networks are mainly used for tasks such as text recognition, and three-dimensional neural networks are mainly used for tasks such as medical image and video data processing. The overall structure of a convolutional neural network consists of an input layer, a convolutional layer, a pooling layer, a fully connected layer and an output layer connected in sequence. The convolutional layer and the pooling layer can appear repeatedly in the hidden layer. The function of the convolutional layer is to extract features from the input data. Specifically, the convolutional layer contains multiple convolution kernels, which are similar to the neurons in the feedforward neural network. Each element of the convolution kernel corresponds to a weight coefficient and a bias. Each neuron in the convolutional layer is connected to the neuron in the previous layer. In the working state, the convolutional layer will regularly scan the input features to extract the features of the input data; the main function of the pooling layer is to select the features processed by the convolutional layer, and reduce the dimension and filter the features therein; the fully connected layer can nonlinearly integrate the features extracted by the previous layers, and then pass the integrated results to the final output layer; the main function of the output layer is to receive the data from the hidden layer and give the final classification result of the model. The output layer constrains the output result through the activation function.

[0065] Gated recurrent unit: a type of recurrent neural network. Like the long short-term memory network, it is also proposed to solve the problems of long-term memory and gradient in back propagation. Three gates are introduced in the long short-term memory network to control the network. Among them, the input gate controls the input value and is responsible for selectively updating the memory unit; the forget gate controls the memory value and can determine which information is discarded from the unit state; the output gate controls the output value and determines the hidden state of the output. Compared with the complex long short-term memory network, the gated recurrent unit has only two gates. In order to streamline the internal structure and improve the computing efficiency, the gated recurrent unit integrates the input gate, forget gate, and output gate structure in the long short-term memory network into an update gate and a reset gate. Among them, the reset gate determines how to combine the new input information with the previous memory; the update gate defines the amount of the previous memory saved to the current time step.

[0066] DNSSEC:

[0067] 1) Domain Name System Security Extensions (DNSSEC) are cryptographic signatures added to DNS records that help ensure the security of data transmitted over Internet Protocol (IP) networks. DNSSEC was created because the original architecture of DNS did not include any security measures at the protocol level, so attackers could try to direct users to fraudulent websites. The industry introduced the DNSSEC portal, which adds a layer of authenticity and integrity protection to DNS responses.

[0068] 2) DNSSEC is a security extension based on the DNS protocol. The main idea is to add cryptographic signatures to DNS records to provide source authentication and data integrity for the DNS resolution process. In terms of specific implementation, DNSSEC uses public key infrastructure ( , PKI) to verify the integrity and authenticity of data. The owner or administrator of the domain name generates a public-private key pair, the public key is stored in the DNS record, and the private key is kept by himself. When responding to a DNS request, the domain name server calculates the summary of the response content and encrypts it with the private key to generate a signature. After the inquirer receives the response content and signature, he only needs to use the public key to decrypt the summary value, and then compare the corresponding content calculation summary. This process ensures the integrity of the DNS request and the identity authentication of the data source.

[0069] 3) DNSSEC provides a security enhancement method for the domain name system, providing a verification mechanism for the source identity, integrity and whether the domain name has been tampered with during transmission, but it does not guarantee the encryption and availability of DNS data. At the same time, although DNSSEC provides reliable and secure DNS communication, DNSSEC is still not fully supported by the entire domain name system. The main reason is that the domain name system is too large, from the root to the top-level domain (TLD), and then to the subdomain, it cannot be guaranteed that all nodes support DNSSEC. Therefore, DNSSEC is compatible with the existing domain name system, and DNSSEC requests and verifications will be automatically skipped when DNS does not support DNSSEC.

[0070] DoT protocol: DoT protocol (DNS over TLS, DoT) is based on the Transport Layer Security Protocol ( , TLS), a standard for encrypting DNS queries and ensuring their privacy and security. The TLS protocol is a widely used security encryption protocol. Compared with the traditional DNS protocol, the TLS protocol itself has achieved confidentiality and integrity. Compared with the DNSSEC protocol, DoT has confidentiality. In addition, compared with DNS encryption tools such as DNSCrypt, DoT has formed a request for comment ( , RFC) standardization document. However, the application of DoT requires the support of the client, and most mainstream browsers do not support DNS over TLS.

[0071] DoH protocol: DoH protocol (DNS over HTTPS, DoH) refers to encapsulating DNS queries in secure hypertext transfer ( , HTTPS) protocol, by using an encrypted HTTPS connection to perform DNS queries. The purpose of this practice is to improve user privacy and security, while also helping to prevent DNS hijacking and snooping. Unlike DoT, DoH uses HTTPS instead of TLS to encrypt DNS queries, which means that DNS queries will be encapsulated in HTTPS requests, using HTTPS's encryption mechanism to protect the data transmission process. By combining DNS queries with HTTPS communications, DoH can leverage existing Web infrastructure, making it easier to deploy and use in various network environments. In actual applications, the DoH client uses the HTTPS GET or POST method to encode a single DNS query as an HTTPS request. When the HTTPS method is GET, the request parameter "dns" is the content of the DNS request, encoded using base64; when the HTTPS method is POST, the DNS query is included in the message body of the HTTPS request, and the request header Content-Type indicates the type of request.

[0072] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0073] The technical solution of the present invention is described in detail with specific embodiments below. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present invention will be described below in conjunction with the accompanying drawings.

[0074] In order to clearly understand the technical solution of the present application, the solution of the prior art is first introduced in detail.

[0075] In the prior art, a machine learning model that integrates convolutional neural networks and long short-term memory networks is used to perform DGA detection, which extracts the contextual features of domain name data while extracting the local features of domain name data. However, the long short-term memory network has many parameters, so the training and calculation of the machine learning model are difficult.

[0076] Therefore, in order to solve the problem of the difficulty in training and calculating the machine learning model caused by the fusion of convolutional neural network and long short-term memory network for DGA detection, the study found that ① input domain name data and preprocess it; ② extract the local key feature map of the domain name data through the convolutional neural network; ③ extract the contextual features of the local key features through the gated recurrent unit; ④ output the results based on the local key feature map and the contextual features of the local key features.

[0077] Specifically, domain name data in domain name system traffic is obtained, and the domain name data is preprocessed to obtain an integer array of a preset length;

[0078] Perform word embedding on the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix;

[0079] Perform feature extraction and dimension reduction on the first domain name data through a convolutional neural network to obtain a local key feature graph of the first domain name data;

[0080] Through the gated recurrent unit, the context features of the local key feature map are obtained;

[0081] When the task is a binary classification task, the feature space of the local key feature map and the feature space of the context feature are mapped to a one-dimensional sample label space through a convolutional neural network; wherein the task is a binary classification task, which is used to indicate whether the first domain name data is a target domain name or a non-target domain name;

[0082] According to the one-dimensional sample label space, the predicted probability of the first domain name data is obtained, so as to obtain the probability that the first domain name data is a non-target domain name through the predicted probability.

[0083] The training method of the probability prediction model of the embodiment of the present invention is based on the principle of the above-mentioned working condition preset conditions. The present invention combines a convolutional neural network with a gated recurrent unit, uses the convolutional neural network to extract local key feature maps, uses the gated recurrent unit to extract context features, and then obtains the final result output based on the local key feature maps and context features. Using a machine learning model that integrates a convolutional neural network and a gated recurrent unit, the gated recurrent unit has fewer parameters than a long short-term memory network, thereby avoiding the problem of greater training and computational difficulty caused by the machine learning model that integrates a convolutional neural network and a long short-term memory network.

[0084] Based on the above creative findings, the technical solution of the present application is proposed.

[0085] The following introduces the application scenarios of the training method of the probability prediction model provided by the embodiment of the present invention.

[0086] The training method of the probability prediction model of this solution is applicable to a variety of scenarios: in enterprise network security, it can be used to protect the internal enterprise network from non-benign websites and phishing attacks, and prevent sensitive data leakage; in network traffic filtering, it can block access to non-benign or inappropriate content by intercepting and analyzing DNS requests, thereby improving network security and compliance; in preventing non-benign software infection, it can block non-benign software from communicating or downloading through DNS requests, reducing infection; in data protection and privacy, it can ensure the privacy of users when accessing the Internet and prevent data from being stolen or tracked; in network traffic monitoring, it can analyze and monitor network traffic to identify abnormal activities and potential security threats.

[0087] The embodiments of the present application are introduced below in conjunction with the drawings in the specification.

[0088] Figure 1 Schematic diagram of the training method of the probability prediction model provided in the embodiment of the present application Figure 1 , the model training method provided in this embodiment includes the following steps:

[0089] S101, obtaining domain name data in domain name system traffic, and preprocessing the domain name data to obtain an integer array of a preset length.

[0090] In this embodiment, the input layer of the model is used to obtain domain name data. After obtaining the domain name data, the first step of machine learning modeling is data preprocessing, which is an important step to improve data quality and adaptability. Converting domain name data into an integer array of a preset length can simplify the input processing and training process of the model. At the same time, fixed-length input can speed up data loading and processing.

[0091] S102: Perform word embedding on the integer array to obtain first domain name data.

[0092] In this embodiment, the first domain name data is a low-dimensional dense matrix. The word embedding process is completed by the embedding layer of the model. Converting the integer array of preset length obtained after preprocessing into an integer array of preset length can facilitate the operation of the neural network.

[0093] The principle of the embedding layer is to map each integer index into a dense, continuous vector space through learning. This mapping makes similar words closer in the vector space, so as to better capture the semantic relationship between words. During the training process of the model, these embedded vectors will be optimized along with the network weights so that the model can better understand the input data in subsequent tasks.

[0094] In this model, the length of the embedding layer input sequence is 75, and the input vocabulary size is 41. Through the embedding layer function provided by the keras network library in the tensorflow platform, each word is embedded into a 128-dimensional vector space, and the obtained character embedding vector sequence is output to the convolutional neural network for feature extraction.

[0095] S103: Perform feature extraction and dimension reduction on the first domain name data through a convolutional neural network to obtain a local key feature map of the first domain name data.

[0096] In this embodiment, the function of the convolutional neural network is to extract local key features in the domain name data.

[0097] S104: Obtain context features of the local key feature graph through a gated recurrent unit.

[0098] In this embodiment, the gated recurrent unit is a type of recurrent neural network that can be used to extract contextual features of data and has good performance in processing and predicting sequence data. The gated recurrent unit is similar to the long short-term memory network. In solving the long-distance dependency problem of the recurrent neural network, it can also achieve the same effect as the long short-term memory network. The update gate of the gated recurrent unit can be regarded as the result of the combination of the input gate and the forget gate of the long short-term memory network. The update gate controls the degree of control introduced at the previous moment, and the reset gate controls the degree to which the state at the previous moment is replaced to the candidate set.

[0099] After using the convolutional neural network to extract features and reduce the dimension of the vector sequence, a gated recurrent unit with 128 neurons performs more in-depth context feature extraction on the data. Finally, the results obtained by the gated recurrent unit layer are output to the output layer.

[0100] S105. When the task is a binary classification task, the feature space of the local key feature map and the feature space of the context feature are mapped to a one-dimensional sample label space through a convolutional neural network.

[0101] In this embodiment, it is achieved through the fully connected layer of the convolutional neural network. The fully connected layer is generally located at the end of the entire convolutional neural network, responsible for expanding the feature map (matrix) obtained by the last layer of convolution into a one-dimensional vector and providing input for the classifier, thereby realizing an end-to-end learning process. Each node of the fully connected layer is connected to all the nodes of the previous layer, so it is called a fully connected layer. Due to its fully connected characteristics, the fully connected layer generally has the most parameters.

[0102] The role of the fully connected layer is to integrate local key feature maps and context features into a global representation and perform final classification or regression. It helps the model capture higher abstract features and achieve the final decision by flattening the feature map and performing linear transformation.

[0103] Specifically, the fully connected layer integrates the feature space of the local key feature map and the feature space of the context feature to obtain an integrated feature vector, and then maps the feature vector to the target task label space, and inputs the target task label space to the output layer for final classification. Among them, the task is a binary classification task, which is used to indicate whether the first domain name data is a target domain name or a non-target domain name. The target domain name here is the DGA domain name; the non-target domain name is a non-DGA domain name, that is, a benign domain name.

[0104] In the algorithm designed in this application, in the fully connected layer, tanh is used as the activation function to map the feature space calculated by the previous layers to the target task label space, and input it to the output layer for final classification.

[0105] While mapping the feature space calculated by the previous layer to the sample label space, the convolutional layer can also reduce the influence of the feature position on the classification results, thereby improving the robustness of the entire network.

[0106] S106: Obtain a predicted probability of the first domain name data according to the one-dimensional sample label space, so as to obtain a probability that the first domain name data is a non-target domain name through the predicted probability.

[0107] In this embodiment, the output layer is the last layer in the neural network model and is responsible for generating the final output of the model. It maps the feature representations of the previous layers into the final prediction results or decisions. In different tasks and network structures, the form of the output layer will be different.

[0108] In a binary classification task, the output layer usually has only one node, the activation function is sigmoid, and the output is a predicted probability between 0 and 1, which is used to indicate the probability that the first domain name data is a non-target domain name.

[0109] The present application provides a method for training a probability prediction model, a method for detecting a non-target domain name, and a device. The method for training the probability prediction model includes: obtaining domain name data in domain name system traffic, and preprocessing the domain name data to obtain an integer array of a preset length; embedding the integer array into words to obtain first domain name data, wherein the first domain name data is a low-dimensional dense matrix; performing feature extraction and dimensionality reduction on the first domain name data through a convolutional neural network to obtain a local key feature map of the first domain name data; obtaining context features of the local key feature map through a gated recurrent unit; when the task is a binary classification task, mapping the feature space of the local key feature map and the feature space of the context features to a one-dimensional sample label space through a convolutional neural network, wherein the task is a binary classification task, which is used to indicate whether the first domain name data is a target domain name or a non-target domain name; obtaining a predicted probability of the first domain name data according to the one-dimensional sample label space, so as to obtain the probability of the first domain name data being a non-target domain name through the predicted probability. Based on the above method, the following technical effects are achieved: a convolutional neural network is used to extract local feature information from domain name data, and a gated recurrent unit is used to extract contextual information from domain name data. Based on local feature information and contextual information, a more accurate output can be obtained; by performing word embedding, the input discrete domain name data can be converted into a low-dimensional dense matrix so that the neural network can better understand the input data in subsequent tasks; by performing contextual feature extraction through a gated recurrent unit, the difficulty of model training can be reduced and it is easier to calculate.

[0110] Figure 2 Schematic diagram of the training method of the probability prediction model provided in the embodiment of the present application Figure 2 .like Figure 2 As shown, the training method of the probability prediction model provided in this embodiment is further refined on the basis of the training method of the probability prediction model provided in the previous embodiment of the present invention. The training method of the probability prediction model provided in this embodiment includes the following steps:

[0111] S201. After acquiring domain name data in domain name system traffic, delete duplicate data and irrelevant data in the domain name data to obtain second domain name data.

[0112] In this embodiment, the second domain name data is the domain name data after deleting duplicate data and irrelevant data. The function of S201 is to clean the acquired domain name data to prevent duplicate data and irrelevant data from affecting the output result.

[0113] S202: Fill the second domain name data with filling characters to obtain third domain name data.

[0114] In this embodiment, the length of the third domain name data is a preset length. For the domain name data after deleting duplicate data and irrelevant data, characters are padded to reach the preset length. The domain name data of the preset length can simplify the input processing and training process of the model, and at the same time, it can also speed up the data loading and processing speed. Specifically, in this embodiment, the domain name data is a character string, and the preset length is 75, that is, the third domain name data is a character string with a length of 75.

[0115] S203: Convert each uppercase letter in the third domain name data into a corresponding lowercase letter to obtain fourth domain name data.

[0116] In this embodiment, the domain name data is a string including a plurality of uppercase letters and a plurality of lowercase letters. All uppercase letters in the string are converted into lowercase letters to obtain the fourth domain name data, that is, the fourth domain name data is a string with a length of 75 and all lowercase letters.

[0117] S204: Perform dictionary mapping on the fourth domain name data to obtain an integer array of a preset length.

[0118] In this embodiment, the character string is converted into an integer array because an integer array is usually easier to be processed by a computer than a character string. Therefore, this processing method can simplify the input of the model and thus improve the calculation efficiency.

[0119] S205: Perform word embedding on the integer array to obtain first domain name data.

[0120] In this embodiment, the first domain name data is a low-dimensional dense matrix. The effect and method of S205 are similar to the effect and method of 102 in the previous embodiment of the present invention, and will not be repeated here.

[0121] S206. Perform a convolution operation on the first domain name data through a convolution layer of a convolutional neural network to obtain a feature map corresponding to the first domain name data.

[0122] In this embodiment, the convolution layer is a very important hierarchical structure in the convolutional neural network. The basic idea is to extract local features of the input data through the convolution operation, and use these features for the next step of processing and analysis. The convolution operation usually uses a filter or convolution kernel to scan the input data and generate a corresponding feature map.

[0123] S207, moving a pooling matrix of a preset size to each position of the feature map one by one, obtaining the coverage area corresponding to each position, obtaining the maximum value of multiple values ​​in each coverage area, and obtaining a local key feature map based on the maximum value in each coverage area.

[0124] In this embodiment, the size of each coverage area is the same as the size of the pooling matrix, and this part of the processing is completed by the pooling layer in the convolutional neural network.

[0125] The pooling layer is another important layer in the convolutional neural network. Its main function is to downsample the input feature map, reduce the dimension of the feature map, reduce the number of parameters, and prevent overfitting. Common pooling methods include maximum pooling and average pooling, which respectively select the maximum value or average value in each small window on the feature map as the output of the small window, thereby obtaining a new pooled feature. Downsample the input feature map to half its original size. The pooling operation usually reduces the size of the feature map, thereby further reducing the amount of calculation. The pooling method adopted in this application is maximum pooling.

[0126] In the algorithm designed in this paper, the convolutional neural network consists of a convolutional layer with a convolution kernel size of 3 and a filter size of 128, and a maximum pooling layer with a maximum pooling window size of 2. This convolutional neural network extracts and reduces the dimension of the low-dimensional dense matrix processed by the embedding layer, and outputs the obtained feature map to the gated recurrent unit layer.

[0127] S208. Obtain context features of the local key feature graph through a gated recurrent unit.

[0128] In this embodiment, the effect and method of the gated cycle unit in S208 are similar to the effect and method of the gated cycle unit in S104 in the previous embodiment of the present invention, and will not be repeated here.

[0129] S209: When the task is a binary classification task, the feature space of the local key feature map and the feature space of the context feature are mapped to a one-dimensional sample label space through a convolutional neural network.

[0130] In this embodiment, the effect and method of S209 are similar to the effect and method of S105 in the previous embodiment of the present invention, and will not be repeated here.

[0131] S210: Obtain a predicted probability of the first domain name data according to the one-dimensional sample label space, so as to obtain a probability that the first domain name data is a non-target domain name through the predicted probability.

[0132] In this embodiment, the effect and method of S210 are similar to the effect and method of S106 in the previous embodiment of the present invention, and will not be repeated here.

[0133] In this embodiment, system-related data will be recorded, mainly recording the key content of non-benign DNS requests, blacklists and other information, and responsible for the reading, writing and management of the database. Specifically, the relevant information is stored through the SQLite database. SQLite is a powerful lightweight embedded relational database management system. Compared with other databases, SQLite does not require excessive configuration, installation and management. The database mainly contains three tables: non-benign DNS log, blacklist and whitelist. Among them, the dns_log table field format is shown in Table 1.

[0134] Table 1

[0135]

[0136] The white_list table field format is shown in Table 2.

[0137] Table 2

[0138]

[0139] The black_list table field format is shown in Table 3.

[0140] Table 3

[0141]

[0142] In terms of DGA algorithm detection, a control experiment was conducted between a deep learning model based on CNN-GRU and a machine learning model based on manually extracted features. The experimental results show that the DGA detection technology combining CNN and GRU designed and implemented in this application is significantly better than other algorithms in the control experiment in terms of accuracy, precision, recall rate, F1 value and other indicators, and has better performance.

[0143] From the perspective of model design, the deep learning model that combines CNN and GRU can automatically learn the effective features of input data and perform automatic feature extraction without manual feature extraction. The multiple hidden layers of the deep learning model enable it to learn more abstract and higher-level features and handle more complex problems. The GRU layer in the algorithm performs well in processing and predicting sequence data, and can better extract the contextual features of domain name data, thereby improving the detection performance of the model.

[0144] In terms of system design and implementation, this application builds a secure DNS gateway system that can detect and intercept potential threats. The secure DNS gateway supports the use of machine learning algorithms to detect DNS response messages and detect whether the device is under DGA domain name attack. If a DGA domain name is detected, the system will record relevant threat logs and intercept the detected DGA domain name according to the configuration of the defense rules. In terms of privacy protection, the DNS security gateway can proxy DNS requests and issue secure DNS queries to upstream DNS servers to enhance the security and privacy of DNS requests. In summary, the design and implementation of a secure DNS gateway based on machine learning has important research significance for improving network security, protecting user privacy, responding to non-benign software threats, improving network management efficiency, and promoting the application of machine learning in network security.

[0145] The present application provides a training method for a probability prediction model, a detection method and device for non-target domain names. Based on the training method for the probability prediction model, the following technical effects are achieved: a convolutional neural network is used to extract local feature information in domain name data, and a gated recurrent unit is used to extract context information in the domain name data. Based on the local feature information and context information, a more accurate output can be obtained; by performing word embedding, the input discrete domain name data can be converted into a low-dimensional dense matrix, so that the neural network can better understand the input data in subsequent tasks; by performing context feature extraction through a gated recurrent unit, the training difficulty of the model can be reduced and it is easier to calculate; by obtaining the predicted probability that the domain name data is a DGA domain name, and performing potential DGA interception based on the predicted probability, it plays an important role in improving network security, protecting user privacy, responding to non-benign software threats, improving network management efficiency, and promoting the application of machine learning in network security; through the training and use of the model, the effective features of the input data can be automatically learned, and automatic feature extraction can be performed, thereby avoiding the problem of manual feature extraction.

[0146] Figure 3 Schematic diagram of the process of detecting non-target domain names provided in the embodiment of the present application Figure 1 ,like Figure 3 As shown, the method for detecting a non-target domain name provided in this embodiment includes the following steps:

[0147] S301, obtaining domain name data in domain name system traffic, and preprocessing the domain name data to obtain an integer array of a preset length.

[0148] In this embodiment, the effect and method of S301 are similar to the effect and method of S101 in the first embodiment of the present invention, and will not be described in detail here.

[0149] S302: Perform word embedding on the integer array to obtain first domain name data.

[0150] In this embodiment, the first domain name data is a low-dimensional dense matrix. The effect and method of S302 are similar to the effect and method of S102 in the first embodiment of the present invention, and will not be repeated here.

[0151] S303. When the first domain name data is neither in a preset blacklist nor in a preset whitelist, the first domain name data is input into a preset probability prediction model to obtain a predicted probability of the first domain name data, so as to determine whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability.

[0152] In this embodiment, the blacklist and whitelist detection is the first domain name detection. When the domain name system security gateway system is initialized, the blacklist and whitelist in the database are converted into regular expressions and loaded into the memory. When the first domain name data is detected, it is first determined whether the first domain name data is in the blacklist. If so, it is immediately subjected to DGA domain name disposal; otherwise, it is determined whether the first domain name data is in the whitelist. If so, no subsequent detection is performed.

[0153] The blacklist is dynamically updated by the target domain name, and the whitelist is composed of preset domain names. Specifically, the initial whitelist is composed of domain names with relatively high Alexa rankings, and the blacklist is dynamically updated by the detected DGA domain names. In addition, the system supports users to add, delete, modify and check the blacklist and whitelist.

[0154] When the first domain name data is neither in the blacklist nor in the whitelist, the first domain name data is input into a preset probability prediction model to obtain the prediction probability of the first domain name data, so as to determine whether the first domain name data is a target domain name or a non-target domain name according to the prediction probability. In this embodiment, the probability prediction model is a model obtained by the training method of the probability prediction model of the above-mentioned embodiment 1 or embodiment 2.

[0155] When the domain name data is neither in the blacklist nor in the whitelist, the probability prediction model is used to perform probability detection on the domain name data. The model is trained using the function provided by the Tensorflow2 framework. The trained model and its parameters are saved on disk in the format of SaveModel for easy use by the monitoring module. After the domain name system gateway service is started, the model is loaded into memory using the load_model method in the Tensorflow framework. Each time the domain name data probability detection is performed, the domain name data is preprocessed and then input into the model for prediction. The prediction result of the model is a value between 0 and 1, which represents the probability that the domain name predicted by the model is a non-target domain name. When this value is less than 0.1, the domain name data can be regarded as a domain name generated by the algorithm and corresponding treatment can be made.

[0156] When the input domain name data is detected as the target domain name, that is, when the detection result shows that the domain name data in the traffic is a DGA domain name, the domain name data will be intercepted or redirected. When intercepting, a domain name system response packet with a response status code of "REFUSED" will be constructed and returned to the client; when redirecting, a response packet will be constructed, and the IP address in the response packet is the IP address pre-configured by the customer, and this response packet will be returned to the client. In this scenario, if the user accesses the DGA domain name in the form of the Web, the user will be redirected to the specified website to achieve the effect of an alarm.

[0157] The DNS traffic interception function is mainly implemented based on the Python socket library. The socket library is a basic library for network programming, providing functions such as sending and receiving data. By controlling port 53 of the host where the gateway is deployed, the DNS traffic to the gateway can be intercepted. After receiving the DNS traffic from the client on port 53, the traffic proxy module creates a new thread to call process_request() to detect and filter the traffic, and make a request to the upstream DNS server. Finally, the response traffic is sent back to the client to complete a DNS response.

[0158] If the detection result shows that the domain name data in the traffic is a non-target domain name, the traffic will not be filtered, but ordinary domain name system traffic proxy or secure domain name system traffic proxy will be performed according to the pre-configuration.

[0159] Ordinary DNS traffic proxy: After the DNS traffic passes the detection, the resolve() function in the dns.resolver library is called to perform a DNS query to the pre-configured upstream DNS server. After obtaining the response from the upstream server, the result is encapsulated into a DNS response packet and then returned to the client.

[0160] Secure DNS traffic proxy: After configuring the secure DNS traffic proxy mode, the domain name data is detected and the domain name and record type in the DNS traffic are extracted to construct a uniform resource locator pointing to the upstream DoH server ( , URL), and perform a DoH query, repackage the query result into a DNS response packet, and then return it to the client.

[0161] The technical effect of the embodiment of the present application is: through the trained fusion convolutional neural network and the gated recurrent unit machine learning model, it is possible to automatically learn the effective features of the input data and perform automatic feature extraction, thereby avoiding the problem of manual feature extraction.

[0162] Figure 4 Schematic diagram of the process of detecting non-target domain names provided in the embodiment of the present application Figure 2 .like Figure 4 As shown, the non-target domain name detection method provided in this embodiment is further refined on the basis of the non-target domain name detection method provided in the previous embodiment of the present invention. The non-target domain name detection method provided in this embodiment includes the following steps:

[0163] S401, obtaining domain name data in domain name system traffic, and preprocessing the domain name data to obtain an integer array of a preset length.

[0164] In this embodiment, the effect and method of S401 are similar to the effect and method of S301 in the previous embodiment of the present invention, and will not be described in detail here.

[0165] S402: Perform word embedding on the integer array to obtain first domain name data.

[0166] In this embodiment, the first domain name data is a low-dimensional dense matrix. The effect and method of S402 are similar to the effect and method of S302 in the previous embodiment of the present invention, and will not be repeated here.

[0167] S403: When the first domain name data is neither in the preset blacklist nor in the preset whitelist, input the first domain name data into a preset probability prediction model to obtain a predicted probability of the first domain name data.

[0168] In this embodiment, the training and implementation of the probability prediction model in S403 are similar to the effects and methods of S303 in the previous embodiment of the present invention, and will not be repeated here.

[0169] S404: If the predicted probability is less than a first preset value, determine the first domain name data as a target domain name; if the predicted probability is greater than a second preset value, determine the first domain name data as a non-target domain name.

[0170] Specifically, in this embodiment, the first preset value is 0.1, and the second preset value is 0.2. If the obtained prediction probability is less than 0.1, the first domain name data is a DGA domain name; if the obtained prediction probability is greater than 0.2, the first domain name data is a non-DGA domain name.

[0171] S405: If the predicted probability is not less than the first preset value and not greater than the second preset value, obtain the entropy value, the number of consonants and the domain name length of the first domain name data.

[0172] In this embodiment, if the predicted probability is not less than 0.1 and not greater than 0.2, the traditional DGA detection method is used as an auxiliary means of the other two detection methods. The traditional DGA detection method mainly detects the domain name by analyzing the characteristics of the domain name. This method mainly detects the domain name through three indicators: the entropy value of the domain name, the number of consonants, and the length of the domain name.

[0173] S406: If the entropy value is greater than the third preset value, the number of consonants is greater than the fourth preset value, and the domain name length is greater than the fifth preset value, the first domain name data is determined to be a target domain name; otherwise, the first domain name data is determined to be a non-target domain name.

[0174] Specifically, in this embodiment, the third preset value is 3.8, the fourth preset value is 7, and the fifth preset value is 12. When the entropy value of the first domain name data is greater than 3.8, the number of consonants is greater than 7, and the domain name length is greater than 12, the first domain name data can be regarded as a DGA domain name and corresponding treatment is made.

[0175] The technical effect of the embodiment of the present application is: when DGA domain name detection is performed through a machine learning model that integrates a trained convolutional neural network and a gated recurrent unit, the predicted probability of the domain name data is used to determine whether the domain name data is a target domain name or a non-target domain name, and the calculation efficiency is high.

[0176] Figure 5 A schematic diagram of the structure of a training device for a probability prediction model provided in an embodiment of the present application. Figure 5 As shown, in this embodiment, the probability prediction model training device 500 can be located in an electronic device. The probability prediction model training device 500 includes:

[0177] The preprocessing module 501 is used to obtain the domain name data in the domain name system traffic and preprocess the domain name data to obtain an integer array of a preset length;

[0178] A word embedding module 502 is used to embed words into the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix;

[0179] A local feature extraction module 503 is used to perform feature extraction and dimension reduction on the first domain name data through a convolutional neural network to obtain a local key feature graph of the first domain name data;

[0180] A context feature extraction module 504 is used to obtain context features of a local key feature map through a gated recurrent unit;

[0181] A mapping module 505 is used to map the feature space of the local key feature map and the feature space of the context feature to a one-dimensional sample label space through a convolutional neural network when the task is a binary classification task; wherein the task is a binary classification task, and is used to indicate whether the first domain name data is a target domain name or a non-target domain name;

[0182] The output module 506 is used to obtain the predicted probability of the first domain name data according to the one-dimensional sample label space, so as to obtain the probability that the first domain name data is a non-target domain name through the predicted probability.

[0183] The training device of the probability prediction model provided in this embodiment can execute Figure 1 The technical solution of the training method embodiment of the probability prediction model shown in the figure has the same implementation principle and technical effect as Figure 1 The training method embodiments of the probability prediction model shown are similar and will not be described in detail here.

[0184] At the same time, the probability prediction model training device provided by the present invention further refines the probability prediction model training device 500 based on the probability prediction model training device provided by the previous embodiment.

[0185] Optionally, in this embodiment, the preprocessing module 501 is specifically used for:

[0186] The domain name data includes a plurality of uppercase letters and a plurality of lowercase letters, and duplicate data and irrelevant data in the domain name data are deleted to obtain second domain name data;

[0187] The second domain name data is filled with filling characters to obtain third domain name data; wherein the length of the third domain name data is a preset length;

[0188] Convert each uppercase letter in the third domain name data into a corresponding lowercase letter to obtain fourth domain name data;

[0189] Dictionary mapping is performed on the fourth domain name data to obtain an integer array of a preset length.

[0190] Optionally, in this embodiment, the local feature extraction module 503 is specifically used for:

[0191] Performing a convolution operation on the first domain name data through a convolution layer of a convolutional neural network to obtain a feature map corresponding to the first domain name data;

[0192] The feature map is downsampled through the pooling layer of the convolutional neural network to obtain a local key feature map of the first domain name data.

[0193] Optionally, when the local feature extraction module 503 performs a downsampling operation on the feature map through a pooling layer of a convolutional neural network to obtain a local key feature map of the first domain name data, the feature map is a matrix;

[0194] A pooling matrix of a preset size is moved to each position of the feature map one by one to obtain a coverage area corresponding to each position; wherein the size of each coverage area is the same as the size of the pooling matrix;

[0195] The maximum value among multiple values ​​of each coverage area is obtained, and a local key feature map is obtained according to the maximum value in each coverage area.

[0196] Optionally, in this embodiment, the mapping module 505 is specifically used for:

[0197] Through the fully connected layer of the convolutional neural network, the feature space of the local key feature map and the feature space of the context feature are mapped to the one-dimensional sample label space.

[0198] The training device of the probability prediction model provided in this embodiment can execute Figure 1 and Figure 2 The technical solution of the training method embodiment of the probability prediction model shown in the figure has the same implementation principle and technical effect as Figure 1 and Figure 2 The training method embodiment of the probability prediction model shown is similar and will not be described in detail here.

[0199] Figure 6 This is a schematic diagram of the structure of a non-target domain name detection device provided in an embodiment of the present application. Figure 6 As shown, in this embodiment, the non-target domain name detection device 600 can be located in an electronic device. The non-target domain name detection device 600 includes:

[0200] A preprocessing module 601 is used to obtain domain name data in domain name system traffic and preprocess the domain name data to obtain an integer array of a preset length;

[0201] A word embedding module 602 is used to embed words into the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix;

[0202] The probability prediction module 603 is used to input the first domain name data into a preset probability prediction model to obtain the predicted probability of the first domain name data when the first domain name data is neither in the preset blacklist nor in the preset whitelist, so as to determine whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability; wherein the probability prediction model is a model obtained by a training device of the probability prediction model.

[0203] The non-target domain name detection device provided in this embodiment can execute Figure 3 The technical solution of the non-target domain name detection method shown in the figure has the same implementation principle and technical effect as Figure 3 The detection method embodiments of the non-target domain names shown are similar and will not be described in detail here.

[0204] Meanwhile, the non-target domain name detection device provided by the present invention further refines the non-target domain name detection device 600 based on the non-target domain name detection device provided by the previous embodiment.

[0205] Optionally, in this embodiment, when the probability prediction module 603 determines whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability, if the predicted probability is less than a first preset value, the first domain name data is determined to be a target domain name; if the predicted probability is greater than a second preset value, the first domain name data is determined to be a non-target domain name; wherein the first preset value is less than the second preset value.

[0206] Optionally, in this embodiment, if the predicted probability is not less than the first preset value and not greater than the second preset value, the method further includes:

[0207] Obtaining the entropy value, the number of consonants and the domain name length of the first domain name data;

[0208] If the entropy value is greater than the third preset value, the number of consonants is greater than the fourth preset value, and the domain name length is greater than the fifth preset value, the first domain name data is determined to be the target domain name; otherwise, the first domain name data is determined to be a non-target domain name.

[0209] The non-target domain name detection device provided in this embodiment can execute Figure 3 and Figure 4 The technical solution of the non-target domain name detection method embodiment shown in the figure has the same implementation principle and technical effect as Figure 3 and Figure 4 The detection method embodiments of the non-target domain names shown are similar and will not be described in detail here.

[0210] Figure 7A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device is intended to be used in various electronic devices that can perform a training method for a probability prediction model or a detection method for a non-target domain name, such as a microcomputer, a single-chip microcomputer, and other suitable computers. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0211] like Figure 7 As shown, the electronic device 70 includes: at least one processor 701 and a memory 702. The electronic device 70 also includes a communication component 703. The processor 701, the memory 702 and the communication component 703 are connected via a bus 704.

[0212] In the specific implementation process, at least one processor 701 executes the computer execution instructions stored in the memory 702, so that at least one processor 701 executes the probability prediction model training method or non-target domain name detection method executed by the electronic device side as above.

[0213] The specific implementation process of the processor 701 can refer to the above-mentioned probability prediction model training method embodiment or the non-target domain name detection method embodiment, and the implementation principles and technical effects are similar, which will not be repeated in this embodiment.

[0214] In the above embodiments, it should be understood that the processor 701 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor 701 may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the invention may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0215] The memory 702 may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk storage.

[0216] The bus 704 may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus 704 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus 704 in the drawings of the present application is not limited to only one bus or one type of bus.

[0217] The above-mentioned functions implemented by the electronic device and the main control device introduce the scheme provided by the embodiment of the present invention. It can be understood that in order to implement the above-mentioned functions, the electronic device or the main control device includes a hardware structure and / or software module corresponding to the execution of each function. In combination with the units and algorithm steps of each example described in the embodiment disclosed in the embodiment of the present invention, the embodiment of the present invention can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the technical solution of the embodiment of the present invention.

[0218] The present application also provides a computer-readable storage medium, which stores computer-executable instructions. When a processor executes the computer-executable instructions, the above-mentioned probability prediction model training method or non-target domain name detection method is implemented.

[0219] The computer-readable storage medium mentioned above may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The readable storage medium may be any available medium that can be accessed by a general or special-purpose computer.

[0220] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. The readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (ASIC). The processor and the readable storage medium can also exist as discrete components in an electronic device or a main control device.

[0221] The memory 702 is a non-transient computer-readable storage medium provided by the present invention. The non-transient computer-readable storage medium of the present invention stores computer instructions, which are used to enable a computer to execute the probability prediction model training method or non-target domain name detection method provided by the present invention.

[0222] The memory 702 is a non-transient computer-readable storage medium that can be used to store non-transient software programs, non-transient computer executable programs and modules, such as program instructions / modules corresponding to the model training method or the domain name detection method in the embodiment of the present invention (for example, Figure 5 The preprocessing module 501, the word embedding module 502, the local feature extraction module 503, the context feature extraction module 504, the mapping module 505, the output module 506 or Figure 6 The processor 701 executes various functional applications and data processing by running the non-transient software programs, instructions and modules stored in the memory 702, that is, the training method of the probability prediction model or the detection method of the non-target domain name in the above method embodiment is implemented.

[0223] At the same time, this embodiment also provides a computer program product. When the instructions in the computer program product are executed by a processor, the probability prediction model training method or the non-target domain name detection method of the above-mentioned embodiment can be executed.

[0224] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses, or adaptations of the embodiments of the present invention that follow the general principles of the embodiments of the present invention and include common knowledge or customary technical means in the art that are not disclosed in the embodiments of the present invention. The specification and examples are to be regarded as exemplary only, and the true scope and spirit of the embodiments of the present invention are indicated by the claims.

[0225] It should be understood that the embodiments of the present invention are not limited to the precise structures described above and shown in the drawings, and various modifications and changes may be made without departing from the scope thereof. The scope of the embodiments of the present invention is limited only by the appended claims.

Claims

1. A method for training a probability prediction model, characterized in that: include: Acquire domain name data in domain name system traffic, and pre-process the domain name data to obtain an integer array of a preset length; Performing word embedding on the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix; Performing feature extraction and dimensionality reduction on the first domain name data through a convolutional neural network to obtain a local key feature graph of the first domain name data; Obtaining context features of the local key feature map through a gated recurrent unit; When the task is a binary classification task, the feature space of the local key feature map and the feature space of the context feature are mapped to a one-dimensional sample label space through the convolutional neural network; wherein the task is a binary classification task, which is used to indicate whether the first domain name data is a target domain name or a non-target domain name; The predicted probability of the first domain name data is obtained according to the one-dimensional sample label space, so as to obtain the probability that the first domain name data is a non-target domain name through the predicted probability.

2. The method for training a probability prediction model according to claim 1, characterized in that: The method of performing feature extraction and dimensionality reduction on the first domain name data by using a convolutional neural network to obtain a local key feature graph of the first domain name data includes: Performing a convolution operation on the first domain name data through the convolution layer of the convolutional neural network to obtain a feature map corresponding to the first domain name data; The feature map is downsampled through the pooling layer of the convolutional neural network to obtain a local key feature map of the first domain name data.

3. The method for training a probability prediction model according to claim 2, characterized in that: The feature map is a matrix; The downsampling operation is performed on the feature map through the pooling layer of the convolutional neural network to obtain a local key feature map of the first domain name data, including: Moving a pooling matrix of a preset size to each position of the feature map one by one to obtain a coverage area corresponding to each position; wherein the size of each coverage area is the same as the size of the pooling matrix; The maximum value among the multiple values ​​of each of the coverage areas is obtained, and the local key feature map is obtained according to the maximum value in each of the coverage areas.

4. The method for training a probability prediction model according to claim 1, characterized in that: The domain name data includes a number of uppercase letters and a number of lowercase letters; The preprocessing of the domain name data to obtain an integer array of a preset length includes: Deleting duplicate data and irrelevant data in the domain name data to obtain second domain name data; The second domain name data is filled with filling characters to obtain third domain name data; wherein the length of the third domain name data is a preset length; Convert each of the uppercase letters in the third domain name data into a corresponding lowercase letter to obtain fourth domain name data; Dictionary mapping is performed on the fourth domain name data to obtain an integer array of the preset length.

5. The method for training a probability prediction model according to claim 1, characterized in that: Mapping the feature space of the local key feature map and the feature space of the context feature to a one-dimensional sample label space through the convolutional neural network includes: The feature space of the local key feature map and the feature space of the context feature are mapped to a one-dimensional sample label space through the fully connected layer of the convolutional neural network.

6. A method for detecting a non-target domain name, characterized in that: include: Acquire domain name data in domain name system traffic, and pre-process the domain name data to obtain an integer array of a preset length; Performing word embedding on the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix; When the first domain name data is neither in a preset blacklist nor in a preset whitelist, the first domain name data is input into a preset probability prediction model to obtain a predicted probability of the first domain name data, so as to determine whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability; wherein the probability prediction model is a model obtained by the training method of the probability prediction model described in any one of claims 1 to 5.

7. The method for detecting a non-target domain name according to claim 6, characterized in that: The determining, according to the predicted probability, whether the first domain name data is a target domain name or a non-target domain name includes: If the predicted probability is less than a first preset value, the first domain name data is determined to be a target domain name; if the predicted probability is greater than a second preset value, the first domain name data is determined to be a non-target domain name; wherein the first preset value is less than the second preset value.

8. The method for detecting a non-target domain name according to claim 7, characterized in that: If the predicted probability is not less than the first preset value and not greater than the second preset value, the method further includes: Obtaining the entropy value, the number of consonants and the domain name length of the first domain name data; If the entropy value is greater than a third preset value, the number of consonants is greater than a fourth preset value, and the domain name length is greater than a fifth preset value, the first domain name data is determined to be a target domain name; otherwise, the first domain name data is determined to be a non-target domain name.

9. A training device for a probability prediction model, characterized in that: include: A preprocessing module, used for acquiring domain name data in domain name system traffic, and preprocessing the domain name data to obtain an integer array of a preset length; A word embedding module, used for embedding the integer array into words, so as to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix; A local feature extraction module, used to perform feature extraction and dimension reduction on the first domain name data through a convolutional neural network to obtain a local key feature map of the first domain name data; A context feature extraction module, used for obtaining the context features of the local key feature map through a gated recurrent unit; A mapping module, used for mapping the feature space of the local key feature map and the feature space of the context feature to a one-dimensional sample label space through the convolutional neural network when the task is a binary classification task; wherein the task is a binary classification task, and is used for indicating whether the first domain name data is a target domain name or a non-target domain name; The output module is used to obtain the predicted probability of the first domain name data according to the one-dimensional sample label space, so as to obtain the probability that the first domain name data is a non-target domain name through the predicted probability.

10. A non-target domain name detection device, characterized in that: include: A preprocessing module, used for acquiring domain name data in domain name system traffic, and preprocessing the domain name data to obtain an integer array of a preset length; A word embedding module, used for embedding the integer array into words, so as to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix; A probability prediction module, used for inputting the first domain name data into a preset probability prediction model to obtain the predicted probability of the first domain name data when the first domain name data is neither in a preset blacklist nor in a preset whitelist, so as to determine whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability; wherein the probability prediction model is a model obtained by the training device of the probability prediction model described in claim 9.

Images