Method and apparatus for identifying malicious domain name on basis of dynamic heterogeneous graph

Abstract

The present invention relates to a method and apparatus for identifying a malicious domain name on the basis of a dynamic heterogeneous graph. The method comprises: building a domain-name heterogeneous graph; building a graph neural network model, which comprises an attention-mechanism-based neural network model and an RNN model; using the domain-name heterogeneous graph to acquire time-series graph data, inputting the time-series graph data into the attention-mechanism-based neural network model to obtain time-series information of nodes, and inputting the time-series information into the RNN model for training; and using the trained graph neural network model to identify a malicious domain name. In the present invention, the impact of various nodes in different connection modes on domain-name nodes can be taken into full consideration, and the interpretability of an identification result is enhanced; in addition to a heterogeneous graph, a time dimension is also introduced, such that graph information can be considered in multiple dimensions, thereby improving the accuracy of the identification result; and by means of three self-attention layers, i.e., a node type layer, a node level layer and an association-type level layer, node features can be extracted more effectively, thereby improving the accuracy of the identification result.

Description

A method and device for identifying bad domain names based on dynamic heterogeneous graph Technical Field

[0001] The present invention belongs to the field of information technology, and in particular relates to a method and device for identifying bad domain names based on a dynamic heterogeneous graph. Background Art

[0002] Bad domain names are those that leak user information and sensitive data through malicious code, cause financial harm to users through deceptive tactics, or display illegal or unhealthy content (such as phishing, pornography, and online gambling). With the rapid development of information technology, domain name registration has become increasingly simple and convenient, and the number of domain names on the Internet has also increased rapidly. The illegal use of domain names by criminals is a common occurrence, and how to quickly and accurately identify bad domain names has become a focus of attention.

[0003] Knowledge graphs can store the structure and attribute information of domain names very well, and can effectively identify bad domain names based on knowledge graphs. However, most commonly used identification methods are based on static isomorphic graphs, that is, the graph only contains nodes of one type, namely domain names, and does not consider the time of the graph. This approach easily results in the loss of a large amount of rich information, affecting the accuracy of recognition.

[0004] Summary of the Invention

[0005] In view of the above problems, the present invention provides a method and device for identifying bad domain names based on a dynamic heterogeneous graph.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] In a first aspect, the present invention provides a method for identifying bad domain names based on a dynamic heterogeneous graph, comprising the following steps:

[0008] Build a heterogeneous domain name graph;

[0009] Build graph neural network models, including neural network models based on attention mechanisms and RNN models;

[0010] Use the domain name heterogeneous graph to obtain time series graph data, input it into the neural network model based on the attention mechanism, obtain the time series information of each node, and input it into the RNN model for training;

[0011] Use the trained graph neural network model to identify bad domain names.

[0012] Furthermore, the domain name heterogeneous graph is an undirected graph, including three types of nodes: domain name, IP address, and AS code; the attributes of the domain name node include: domain name registrar code, registrar name, registrant desensitized information, and domain name registration information; the attributes of the IP address node include: IP address location and IP address type; the attributes of the AS code node include: autonomous domain organization.

[0013] Furthermore, the neural network model based on the attention mechanism includes three self-attention layers: a node type attention layer, a node-level multi-head attention layer, and an association type-level attention layer.

[0014] Furthermore, the node type attention layer is used to learn the attention weights of different node types, and the attention weight of node i with respect to node type ψ is The calculation formula is as follows:

[0015] in, is the neighborhood embedding representation of node i with respect to node type ψ, v j is the neighbor node of type ψ of node i, h′ j is the mapping eigenvector of node i’s neighbor node j, L is the symmetric normalized Laplace matrix, I represents the identity matrix, D represents the degree matrix, A is the weighted adjacency matrix, Represents node v i The attention score of the ψ-type neighborhood, σ is the activation function, is the node type attention vector, h′ i is the mapping feature vector of node i, || represents the connection operation, and H is the combination of node types.

[0016] Furthermore, the node-level multi-head attention layer is used to learn the weight coefficients of different neighbor nodes under the determined domain name association type. And the node-level embedding representation of node i The calculation formula is as follows:

[0017] Where σ is the activation function, and the domain association type is Under the premise of, K is the number of self-attention heads, is the node-level attention vector, || represents the connection operation, h' i is the mapping feature vector of node i, h' j is the mapping feature vector of node i’s neighbor node j, is the set of neighbor nodes of node i, h' k is the mapping feature vector of node k, To represent the type of ψ j The type-level attention weight of node j, To represent the type of ψ k The type-level attention weight of node k; the domain name association types are divided into three categories: domain names associated through the same IP address, domain names associated through the same AS code, and domain names associated through the same domain name.

[0018] Furthermore, the association type level attention layer is used to learn the domain name association type Importance weight And the final embedding representation Z of node i i , the calculation formula is as follows:

[0019] Where V is the node set, |V| represents the number of nodes, q is the semantic level attention vector, tanh is the hyperbolic tangent function, W is the weight matrix, b is the bias coefficient, is the node-level embedding representation of node i obtained by the node-level multi-head attention layer.

[0020] Furthermore, the acquisition of time series graph data includes: acquiring graph information once at regular intervals to obtain a graph sequence in the time dimension; and passing the graph at each time point through three self-attention layers to obtain a final node embedding representation at each time point.

[0021] In a second aspect, the present invention provides a device for identifying bad domain names based on a dynamic heterogeneous graph, comprising:

[0022] Domain name heterogeneous graph building module, used to build domain name heterogeneous graph;

[0023] A graph neural network model building module, used to build graph neural network models, including attention-based neural network models and RNN models;

[0024] The graph neural network model training module is used to obtain time series graph data using domain name heterogeneous graphs, input it into a neural network model based on the attention mechanism, obtain the time series information of each node, and input it into the RNN model for training;

[0025] The bad domain name identification module is used to identify bad domain names using the trained graph neural network model.

[0026] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing each step in the method of the present invention.

[0027] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the various steps of the method of the present invention are implemented.

[0028] The advantages and beneficial effects of the present invention are as follows:

[0029] 1) It can fully consider the impact of different types of nodes on domain name nodes through different connection methods, increasing the interpretability of recognition results. Introducing the time dimension based on heterogeneous graphs can consider graph information from multiple dimensions, further improving the accuracy of recognition results. Compared with homogeneous graphs, heterogeneous graphs contain richer information and can fully explore the impact of different types of nodes and connection paths on nodes, better extract node features, and thus improve the accuracy of identifying bad domain names. Introducing the time dimension on this basis can more comprehensively grasp node features, making recognition results more accurate.

[0030] 2) By using three self-attention layers at the node type, node level, and association type level, node features can be extracted more effectively, improving the accuracy of recognition results. By introducing an attention mechanism based on domain name association types into the graph neural network, this method enables the graph neural network to focus more on useful node information when extracting features, fully considering the different connection methods between domain names, improving efficiency, and enhancing the interpretability of recognition results. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] FIG1 is a flowchart of a method for identifying bad domain names based on a dynamic heterogeneous graph according to an embodiment of the present invention;

[0032] FIG2 is a block diagram of a bad domain name identification device based on a dynamic heterogeneous graph according to an embodiment of the present invention. DETAILED DESCRIPTION

[0033] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to specific embodiments and accompanying drawings.

[0034] The present invention mainly includes the following contents:

[0035] 1) Construction of a heterogeneous domain name graph. The graph includes three node types: domain name, IP address, and AS code. The graph is an undirected graph.

[0036] 2) Build a graph neural network model and train it using historical graph data.

[0037] 3) In order to enable the model to pay more attention to useful information when extracting features and fully consider the impact of different connection relationships on nodes, an attention mechanism based on domain name association type is introduced.

[0038] 4) The graph neural network is generally divided into two parts. The first part is used to extract the graph structure information at each time point, and the second part is the RNN model that introduces the time dimension.

[0039] In one embodiment of the present invention, a method for identifying bad domain names based on a dynamic heterogeneous graph is provided. The overall process of the method is shown in FIG1 and includes the following steps:

[0040] S101: Build a heterogeneous domain name graph.

[0041] S102: Build a graph neural network model, including a neural network model based on the attention mechanism and an RNN model.

[0042] S103: Use the domain name heterogeneous graph to obtain time series graph data, input it into the neural network model based on the attention mechanism, obtain the time series information of each node, and input it into the RNN model for training.

[0043] S104: Use the trained graph neural network model to identify bad domain names.

[0044] For example, the domain name heterogeneous graph includes three node types: domain name, IP address, and AS code.

[0045] Exemplarily, the graph neural network model is divided into two parts. The first part is an attention mechanism neural network model for extracting graph structure information at each time point, and the second part is an RNN model that introduces the time dimension.

[0046] Exemplarily, the above method further includes: determining a domain name association type.

[0047] Exemplarily, the above method further includes: defining a mapping matrix M for each type of node in the graph i , so that each type of node is projected into the same feature space.

[0048] For example, the neural network model based on the attention mechanism consists of three self-attention layers, of which the first layer is the node type attention layer, which is used to learn the attention weights of different node types. The second layer is the node-level multi-head attention layer, which can learn to determine the weight coefficients of different neighbor nodes under the domain name association type. And the node-level embedding representation of the original node i The third layer is the association type level attention layer, which can be learned to measure the domain name association type. Importance weight And the final embedding representation Z of the original node i i .

[0049] Exemplarily, the above method further includes: determining the time node division, and performing a graph G of each time node t After the above three self-attention layers, the node embedding representation of each time node is obtained Then the above obtained The combined data is used as time series information and fed into the RNN model for classification training. The cross-entropy loss function is selected as the loss function. After training, the trained graph neural network (including the attention-based neural network model and the RNN model) is used to identify bad domain names.

[0050] In a more specific embodiment of the present invention, a method for identifying bad domain names based on a dynamic heterogeneous graph is provided. The specific implementation process of the method includes the following steps:

[0051] (1) Construction of domain name heterogeneous graph. The domain name heterogeneous graph is an undirected graph, which includes three types of nodes: domain name ψ1, IP address ψ2, and AS code ψ3. The attributes of the domain name include: domain name registrar code, registrar name, registrant anonymized information, domain name registration information, etc. The attributes of the IP address include: IP address location, IP address type (IPv4, IPv6), and the attributes of the AS code include: autonomous domain organization.

[0052] (2) Build a graph neural network model. The graph neural network model is divided into two parts. The first part is used to extract the graph structure information at each time point and build an attention mechanism graph neural network model. The second part is an RNN model that introduces the time dimension.

[0053] (3) Determine the domain name association type. Domain name association types are divided into three categories: They are: domain name-IP address-domain name Domain name-AS code-Domain name Domain name-domain name-domain name, that is, domain names associated with the same IP address, domain names associated with the same AS code, and domain names associated with the same domain name.

[0054] (4) Define a mapping matrix for each type of node in the domain name heterogeneous graph Project each type of node into the same feature space. Specifically: the mapping feature vector of the domain name type node is The mapping feature vector of IP address type node is The mapping feature vector of the AS encoding type node is Among them, h1, h2, and h3 represent the original feature vectors of three types of nodes.

[0055] (5) Three self-attention layers are used to build a graph neural network model based on the attention mechanism. The first layer is the node type attention layer, which is used to learn the attention weights of different node types and the attention weight of node i with respect to node type ψ. The calculation formula is as follows:

[0056] in, is the neighborhood embedding representation of node i with respect to node type ψ, v j is the neighbor node of type ψ of node i, h′ j is the mapping feature vector of node i’s neighbor node j, L is the symmetric normalized Laplace matrix, L ij is an element in the matrix L, I represents the identity matrix, D represents the degree matrix, and A is the weighted adjacency matrix (the weight of the edge directly connecting two domain names is set to 2, the weight of the other connecting edges is 1, and the weight of the unconnected edge is 1). Represents node v i The attention score of the ψ-type neighborhood, σ is the activation function, is the node type attention vector, all nodes share this attention vector, h′ i is the mapping feature vector of node i, || represents the connection operation, H is the combination of node types, H = {ψ1, ψ2, ψ3}.

[0057] (6) The second layer is a node-level multi-head attention layer, which is used to learn: the weight coefficients of different neighbor nodes under a certain domain name association type And the node-level embedding representation of the original node i The corresponding calculation formula is as follows:

[0058] Among them, σ is the activation function, when the domain name association type is Under the premise of , K is the number of self-attention heads (multi-head attention is to ensure the stability of training, for example, K = 8 in this embodiment), is the node-level attention vector, || represents the connection operation, h′ i is the mapping feature vector of node i, h′ j is the mapping feature vector of node i’s neighbor node j, is the set of neighbor nodes of node i, h′ k is the mapping feature vector of node k, To represent the type of ψ jThe type-level attention weight of node j, To represent the type of ψ k The type-level attention weight of node k.

[0059] (7) The third layer is the association type level attention layer, which is used to learn: measure the domain name association type Importance weight And the final embedding representation Z of the original node i i The corresponding calculation formula is as follows:

[0060] in is a node set, represents the number of nodes, q is the semantic level attention vector, tanh is the hyperbolic tangent function, W is the weight matrix, b is the bias coefficient, is the node-level embedding representation of the original node i obtained by the node-level multi-head attention layer.

[0061] (8) Obtain the atlas information once every half month, and the time length is selected as half a year, and the atlas sequence G in the time dimension can be obtained t ={G0,…,G 11}, for each time point graph G t Execute steps (5)-(7) respectively, that is, after three self-attention layers, obtain the final node embedding representation at each time point

[0062] (9) The above obtained The information is put together as time series and input into the RNN model for training. The loss function is the cross entropy loss function, which is as follows:

[0063] Among them, y L is a set of nodes with labels, Y l is the original node with label, Z l is the prediction node representation of RNN, and C is the classifier parameter.

[0064] (10) Use the trained graph neural network (including the neural network model based on the attention mechanism and the RNN model) to identify bad domain names. This step inputs the graph information over a period of time: adjacency matrix, degree matrix, node feature matrix (the time length is preferably more than 5 months, and the graph information is obtained every half month) into the trained graph neural network to identify potential bad domain names and output domain name nodes that may be bad domain names.

[0065] The key points of the present invention include:

[0066] 1) The bad domain name identification method based on dynamic heterogeneous graphs can incorporate richer graph information into heterogeneous graph data. On the one hand, by introducing a multi-head attention mechanism, the network model focuses on node information with more data value, and at the same time uses the advantages of multi-head attention to achieve a smooth training process; on the other hand, by introducing the time dimension, the model can obtain graph change information more comprehensively and dynamically, and perform multi-dimensional graph data feature representation from the overall perspective, thereby improving the accuracy of model training and the accuracy of recognition results.

[0067] 2) Based on three self-attention layers with different purposes (node ​​type attention layer, node-level multi-head attention layer, and association type level attention layer), the node-level features and association relationship-level features of nodes are extracted respectively, and a graph neural network model based on the attention mechanism is constructed, which can not only improve the accuracy of the recognition results, but also enhance the interpretability of the recognition results.

[0068] Another embodiment of the present invention provides a device for identifying bad domain names based on a dynamic heterogeneous graph, as shown in FIG2 . The device includes:

[0069] A domain name heterogeneous graph building module 201 is used to build a domain name heterogeneous graph;

[0070] A graph neural network model building module 202 is used to build a graph neural network model, including a neural network model based on an attention mechanism and an RNN model;

[0071] The graph neural network model training module 203 is used to obtain time series graph data using the domain name heterogeneous graph, input it into the neural network model based on the attention mechanism, obtain the time series information of each node, and input it into the RNN model for training;

[0072] The bad domain name identification module 204 is used to identify bad domain names using the trained graph neural network model.

[0073] The specific implementation process of each module refers to the above description of the method of the present invention.

[0074] Another embodiment of the present invention provides a computer device (computer, server, smart phone, etc.), which includes a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing each step in the method of the present invention.

[0075] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, magnetic disk, optical disk), wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the steps of the method of the present invention are implemented.

Claims

1. A method for identifying bad domain names based on dynamic heterogeneous graph, characterized in that: The following steps are involved: Build a heterogeneous domain name graph; Build graph neural network models, including neural network models and RNN models based on attention mechanisms; Use the domain name heterogeneous graph to obtain time series graph data, input it into the neural network model based on the attention mechanism, obtain the time series information of each node, and input it into the RNN model for training; Use the trained graph neural network model to identify bad domain names.

2. The method according to claim 1, characterized in that The domain name heterogeneous graph is an undirected graph, including three node types: domain name, IP address, and AS code; The attributes of the domain name node include: domain name registrar code, registrar name, registrant anonymized information, domain name registration information; the attributes of the IP address node include: IP address location, IP address type; the attributes of the AS code node include: autonomous domain organization.

3. The method according to claim 1, characterized in that The neural network model based on the attention mechanism includes three self-attention layers: a node type attention layer, a node-level multi-head attention layer, and an association type-level attention layer.

4. The method according to claim 3, characterized in that The node type attention layer is used to learn the attention weights of different node types, and the attention weight of node i about node type ψ The calculation formula is as follows: in, is the neighborhood embedding representation of node i with respect to node type ψ, v j is the neighbor node of type ψ of node i, h′ j is the mapping feature vector of node i’s neighbor node j, L is the symmetric normalized Laplace matrix, I represents the identity matrix, D represents the degree matrix, A is the weighted adjacency matrix, Represents node v i The attention score of the ψ-type neighborhood, σ is the activation function, is the node type attention vector, h′ i is the mapping feature vector of node i, || represents the connection operation, and H is the combination of node types.

5. The method according to claim 4, characterized in that The node-level multi-head attention layer is used to learn the weight coefficients of different neighbor nodes under a certain domain name association type. And the node-level embedding representation of node i The calculation formula is as follows: Where σ is the activation function, and the domain association type is Under the premise of, K is the number of self-attention heads, is the node-level attention vector, || represents the connection operation, and h′ i is the mapping feature vector of node i, h′ j is the mapping feature vector of node i’s neighbor node j, is the neighbor node set of node i, h′k is the mapping feature vector of node k, To represent the type of ψ j The type-level attention weight of node j, To represent the type of ψ k The type-level attention weight of node k; The domain name association types are divided into three categories, namely: domain names associated through the same IP address, domain names associated through the same AS code, and domain names associated through the same domain name.

6. The method according to claim 5, characterized in that The association type level attention layer is used to learn to measure the domain name association type Importance weight And the final embedding representation Z of node i i , the calculation formula is as follows: in is a node set, represents the number of nodes, q is the semantic level attention vector, tanh is the hyperbolic tangent function, W is the weight matrix, b is the bias coefficient, is the node-level embedding representation of node i obtained by the node-level multi-head attention layer.

7. The method according to claim 6, characterized in that The method of obtaining time series graph data includes: obtaining graph information once at regular intervals to obtain a graph sequence in the time dimension; and subjecting the graph at each time point to three self-attention layers to obtain a final node embedding representation at each time point.

8. A bad domain name identification device based on dynamic heterogeneous graph, characterized in that: include: Domain name heterogeneous graph building module, used to build domain name heterogeneous graph; The graph neural network model building module is used to build graph neural network models, including neural network models and RNN models based on the attention mechanism; The graph neural network model training module is used to obtain time series graph data using domain name heterogeneous graphs, input it into the neural network model based on the attention mechanism, obtain the time series information of each node, and input it into the RNN model for training; The bad domain name identification module is used to identify bad domain names using the trained graph neural network model.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the method according to any one of claims 1 to 7 is implemented.

Images