Domain name detection method, device and communication system

Abstract

The present application discloses a domain name detection method, device and communication system, which belongs to the field of Internet technology. The method comprises: determining multiple domain name segments from a domain name; after determining that there is an abnormal domain name segment in the multiple domain name segments, determining the domain name as a malicious domain name. The present application can improve the accuracy of malicious domain name recognition. The present application is used for malicious domain name recognition.

Description

Technical Field

[0001] The present application relates to the field of Internet technology, and in particular to a domain name detection method, device and communication system. Background Art

[0002] Malicious domain names are illegal domain names generated by hackers during network attacks. Based on the malicious domain names, the host computer controlled by the hacker establishes a direct or indirect communication connection with the zombie computer installed with malware. By identifying malicious domain names, security devices can reduce the probability of the host computer establishing a connection with the zombie computer, thereby reducing the probability of the zombie computer being controlled.

[0003] Currently, after obtaining a domain name, the security device inputs the obtained domain name into a machine learning model, and the machine learning model identifies whether the input domain name is a malicious domain name.

[0004] However, current machine learning models have low accuracy in identifying malicious domain names. Summary of the invention

[0005] The embodiment of the present application provides a domain name detection method, device and communication system. The technical solution is as follows:

[0006] In a first aspect, a domain name detection method is provided, the method comprising:

[0007] Determine multiple domain name segments from the domain name;

[0008] After determining that there is an abnormal domain name segment in the multiple domain name segments, the domain name is determined to be a malicious domain name.

[0009] The domain name detection method provided in the embodiment of the present application obtains multiple domain name segments from the domain name, and determines whether the domain name is a malicious domain name by detecting whether the domain name segment is an abnormal domain name segment. Compared with the related art, the domain name as a whole is no longer used as an identification unit, and the domain name segment is used as an abnormal identification unit, which reduces the interference between the domain name segments and improves the accuracy of identifying malicious domain names.

[0010] Optionally, the method further includes: when the domain name segment satisfies a preset rule, determining that the domain name segment is an abnormal domain name segment; wherein the preset rule is any one or more of the following three rules:

[0011] The first rule is to identify abnormal domain name segments based on the domain name segment through a classifier; for example, the classifier includes a neural network model, such as a recurrent neural network (RNN) model, a convolutional neural network (CNN) model and / or a long short-term memory (LSTM) model and other deep learning models. Alternatively, the abnormal domain name segment is identified through a classifier based on the feature vector of the domain name segment. For example, the classifier includes a machine learning model, such as a logistic regression model, and / or a random forest model. The aforementioned classifier may also include other models, such as a support vector machine (SVM).

[0012] In the embodiment of the present application, there are usually at least two classifiers. Thus, a classifier with higher accuracy is obtained by combining at least two classifiers, which has better generalization ability than a single classifier, so as to more accurately adapt to the domain name data of the existing network, and further improve the accuracy of the determined abnormal domain name segment. When there are at least two classifiers, the final classification result is the weighted sum, or weighted average, of the classification results of the at least two classifiers. For example, the at least two classifiers respectively output at least two classification results, each classification result includes a score value, and the final classification result is the weighted sum, or weighted average, of the at least two score values.

[0013] The feature vector is an n-dimensional feature vector including n features, where n is a positive integer, and the n features include any one or more of the following: the proportion of hyphens included in the domain name segment to the characters included in the domain name segment; the proportion of numbers included in the domain name segment to the characters included in the domain name segment; the length of the domain name segment; the ratio of the number of character types included in the domain name segment to the total number of characters in the domain name segment; the ratio of the number of numbers included in the domain name segment to the total number of characters in the domain name segment; the Shannon entropy of the domain name segment; the ratio of the number of occurrences of consecutive repeated letters included in the domain name segment to the total number of characters in the domain name segment; the proportion of vowels included in the domain name segment in the domain name segment; the proportion of numbers included in the domain name segment to the characters included in the domain name segment; the ratio of the number of occurrences x1 of consecutive letters included in the domain name segment to the first number of characters y1, the first number of characters y1 being the difference between the total number of characters y in the domain name segment and the number of occurrences x1 of consecutive letters; the ratio of the number of occurrences x2 of consecutive consonants included in the domain name segment to the second number of characters y2, the second number of characters y2 being the total number of characters y in the domain name segment to the number of consecutive consonants The difference between the number of occurrences of letters x2; the ratio of the number of occurrences of consecutive numbers included in the domain name segment x3 to the third number of characters y3, the third number of characters y3 being the difference between the total number of characters y in the domain name segment and the number of occurrences of consecutive numbers x3; the ratio of the number of times numbers and letters are switched in the domain name segment to the total number of characters in the domain name segment; the readability score, the readability score is used to indicate the readability of the domain name segment; the reliability score, the reliability score is used to indicate the reliability of the domain name segment; the ratio of the number of words included in the domain name segment to the total number of characters in the domain name segment; the number of words included in the domain name segment; the binary data sorting feature, the binary data sorting feature is a feature determined based on the serial number of multiple binary data included in the domain name segment sorted according to the frequency of occurrence, each of the multiple binary data consists of two consecutive characters in the domain name segment; the ternary data sorting feature, the ternary data sorting feature is a feature determined based on the serial number of multiple ternary data included in the domain name segment sorted according to the frequency of occurrence, each of the multiple ternary data consists of three consecutive characters in the domain name segment.

[0014] Optionally, the n features satisfy one or more of the following: when the n features fully include the readability score, the readability score is the score corresponding to the domain name segment output by the Markov model trained using the specified word library; when the n features fully include the reliability score, the reliability score is the score corresponding to the domain name segment output by the Markov model trained using the domain name segment positive sample set; when the n features fully include the binary data sorting feature, the binary data sorting feature is the median, mean or variance of the serial number after sorting the multiple binary data included in the domain name segment according to the frequency of occurrence; when the n features fully include the binary data sorting feature, the ternary data sorting feature is the median, mean or variance of the serial number after sorting the multiple ternary data included in the domain name segment according to the frequency of occurrence.

[0015] Alternatively, in the second rule, the ratio of the number of vowels included in the domain name segment to the total number of characters in the domain name segment is less than the ratio threshold. By setting the ratio threshold, the randomly generated domain name segments can be effectively screened out, thereby identifying abnormal domain name segments. In particular, the recognition accuracy of the domain name segments in the domain names generated based on DGA is high.

[0016] Alternatively, the third rule is that the domain name segment includes abnormal entries. Optionally, the entries in the domain name segment can be identified by an Aho-Corasick automaton (AC automaton). The identification process includes: analyzing the entries included in the domain name segment from each domain name segment based on the AC automaton's vocabulary, and the AC automaton's vocabulary includes one or more of words, pinyin, institution names (and / or organization names, unit names, company names) or roots. Furthermore, the AC automaton's vocabulary can also include other content, such as entries in a specified website.

[0017] For example, the number of characters included in the union of the terms in the abnormal domain name segment is greater than the character number threshold; and / or, the abnormal term is a term that appears more than the number threshold within a specified time period, and / or the probability of appearing in the same position in different domain name segments is greater than the probability threshold. For example, the specified time period can be 1 to 7 days, such as 5 days.

[0018] In an embodiment of the present application, an entry that appears more than a threshold number of times within a specified time period is determined as an abnormal entry. Based on the generation principle of domain names generated based on word-type DGA, an entry that appears multiple times within a specified time period can be determined as an abnormal entry, thereby accurately identifying the abnormal entry.

[0019] In an embodiment of the present application, entries whose probability of appearing at the same position in different domain name segments is greater than a probability threshold are determined as abnormal entries. Based on the generation principle of domain names generated by the obfuscated DGA, entries that frequently appear at the same position in a domain name segment within a specified time period can be determined as abnormal entries, thereby accurately identifying abnormal entries.

[0020] In an embodiment of the present application, an abnormal term can be determined by constructing a tuple corresponding to the term. For example, the process includes: constructing a tuple for each term in each domain name in the first domain name set, the tuple includes the string included in the corresponding term (i.e., the content of the term) and the order in which the corresponding term appears in the terms included in the domain name segment. Optionally, the order can be represented by a sequence number. When the number of times a tuple corresponding to a certain term w in the first domain name set co-occurs with a target tuple is greater than a co-occurrence threshold, the certain term w is determined to be an abnormal term. Among them, the target tuple is a tuple corresponding to a term other than the certain term w included in the first domain name set, and the distance between the target tuple and the tuple corresponding to the certain term w is less than a distance threshold (or the similarity is greater than a similarity threshold).

[0021] Optionally, the distance between each two bigrams mentioned above can be calculated using the Jaccard Distance formula.

[0022] Optionally, after obtaining multiple domain name segments, one or more domain name segments in the multiple domain name segments may be deleted to obtain multiple updated domain name segments. For example, the update process includes: after determining that the domain name segment at a specified position in the domain name belongs to a domain name segment set corresponding to the specified position, deleting the domain name segment at the specified position in the multiple domain name segments to obtain multiple updated domain name segments, the domain name segment set including one or more domain name segments.

[0023] The present application embodiment takes the following situations as examples to illustrate the update process of the aforementioned multiple domain name segments:

[0024] In the first case, after determining that the first domain name segment in the domain name belongs to the domain name segment set including "www", the first domain name segment in the multiple domain name segments is deleted to obtain multiple updated domain name segments;

[0025] In the second case, after determining that the penultimate domain name segment in the domain name belongs to the top-level domain name set and the total number of characters in the penultimate domain name segment is less than the first quantity threshold, the penultimate domain name segment in the multiple domain name segments is deleted to obtain multiple updated domain name segments, and the top-level domain name set includes one or more top-level domain names;

[0026] In a third case, after determining that the last domain name segment in the domain name belongs to the top-level domain name set, the last domain name segment in the multiple domain name segments is deleted to obtain multiple updated domain name segments.

[0027] Among them, in the aforementioned second and third cases, there may be multiple ways to obtain the top-level domain name set. In the embodiment of the present application, all top-level domain names in the existing network may be collected to obtain the top-level domain name set.

[0028] The update process of multiple domain name segments corresponding to the above three situations can be executed separately or in combination according to the actual scenario, that is, the update process of multiple domain name segments includes any one or more of the update processes corresponding to the above three situations.

[0029] In an optional example, the method includes: when the malicious domain name is accessed once or multiple times, outputting the IP address used for the access. In this way, the zombie machine can be located, thereby determining the controlled computer device, so as to achieve security protection of the computer device and prevent malicious attacks.

[0030] Optionally, when the malicious domain name is accessed once or multiple times and there is no address record for the access, the IP address used for the access is output. In this way, the zombie machine can be located more accurately, thereby improving the positioning accuracy of the zombie machine.

[0031] In another optional example, the method includes: outputting an abnormal organization domain name or host domain name, where the organization domain name or the host domain name is a partial character string or a complete character string in the malicious domain name. The organization domain name is used to identify the organization from which the malicious domain name originates, and the host domain name is used to identify the host from which the malicious domain name originates. By identifying and outputting the marker domain name corresponding to the malicious domain name, the organization or host from which the malicious domain name originates can be located, and DNS tunnel profiling can be achieved.

[0032] The aforementioned process of determining multiple domain name segments from a domain name may include: preprocessing the domain name; and determining the multiple domain name segments from the preprocessed domain name.

[0033] Among them, the process of preprocessing the domain name includes: detecting the legitimacy of the characters in the domain name, and taking the domain name with legal characters as the preprocessed domain name, and this process is called character legitimacy verification processing; and / or, detecting whether the domain name is a domain name for a designated purpose, and taking the domain name that is not for the designated purpose as the preprocessed domain name, and this process is called purpose detection processing; and / or, using the domain name to query a dictionary tree, the dictionary tree is established based on a domain name blacklist and / or a domain name whitelist, and taking the domain name that does not include the domain name in the dictionary tree as the preprocessed domain name, and this process is called dictionary tree query processing.

[0034] Through character validity check and processing, the server can filter out illegal domain names without processing them, and retain legal domain names as pre-processed domain names, thus reducing computing costs.

[0035] Through purpose detection processing, if the domain name is a domain name for a designated purpose, the domain name can be filtered and not processed, and the domain names that are not for the designated purpose are retained as pre-processed domain names. This can reduce the computing cost and reduce the probability of misidentification of malicious domain names.

[0036] Querying the dictionary tree can reduce the number of domain names to be processed later and reduce the computational cost.

[0037] For example, the domain name is a domain name recorded in a DNS traffic log. For example, the DNS traffic log is used to record a DNS request, and the DNS request includes a domain name. The server can extract the domain name from the DNS request.

[0038] Since the domain name is divided into levels by the separation point, in the embodiment of the present application, the server can divide the domain name into multiple domain name segments according to the separation point. This division method is compatible with the aforementioned domain name classification method. By identifying the separation point, the domain name segment can be quickly divided, the efficiency of the domain name segment division is improved, and the complexity of the domain name segment division is reduced.

[0039] The aforementioned domain name detection method can be implemented by the following product forms provided by the server:

[0040] The first product form is the network firewall. The network firewall provided by the server extracts the DNS request in the DNS traffic log to obtain the domain name. The DNS traffic log is used to record network traffic.

[0041] The second product form is the host firewall. The host firewall provided by the server extracts the DNS requests in the DNS traffic log to obtain the domain name. The DNS traffic log is used to record the DNS requests initiated by the host.

[0042] The third product form is the Web Application Firewall (WAF). For example, the server is an application server, and the WAF it provides extracts the DNS request from the DNS traffic log to obtain the domain name. The DNS traffic log is used to record the DNS connection passing through the WAF, which includes the DNS request and may also include the DNS response.

[0043] The fourth product form is the situational awareness platform. For example, the server is an application server, and the situational awareness platform it provides uses probes to collect network traffic of a specified site to obtain a DNS traffic log, and then extracts the DNS request in the DNS traffic log to obtain the domain name. The DNS traffic log is used to record the network traffic of the specified site.

[0044] The fifth product form is Cloud WAF. For example, the DNS request for the application server is directed by the application server to the Cloud WAF provided by the server. The Cloud WAF generates a DNS traffic log, which records the DNS requests received by the Cloud WAF. The Cloud WAF extracts the DNS requests in the DNS traffic log to obtain the domain name. After the Cloud WAF provided by the server analyzes the domain name, the analysis results and the DNS request can be returned to the application server. Optionally, the server providing the Cloud WAF can be an application server or a server other than the application server.

[0045] In a second aspect, the present application provides a domain name detection device, which may include at least one module, and the at least one module may be used to implement the domain name detection method provided by the above-mentioned first aspect or various possible implementations of the first aspect.

[0046] In a third aspect, the present application provides a computer device, the computer device comprising a processor and a memory. The memory stores computer instructions; the processor executes the computer instructions stored in the memory, so that the computer device executes the method provided by the first aspect or various possible implementations of the first aspect, so that the computer device deploys the domain name detection device provided by the second aspect or various possible implementations of the second aspect.

[0047] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer instructions are stored, and the computer instructions instruct the computer device to execute the method provided by the above-mentioned first aspect or various possible implementations of the first aspect, or the computer instructions instruct the computer device to deploy the domain name detection device provided by the above-mentioned second aspect or various possible implementations of the second aspect.

[0048] In a fifth aspect, the present application provides a computer program product, the computer program product including computer instructions, the computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided by the first aspect or various possible implementations of the first aspect, and the computer device deploys the domain name detection device provided by the second aspect or various possible implementations of the second aspect.

[0049] In a sixth aspect, a chip is provided. The chip may include a programmable logic circuit and / or program instructions. When the chip is running, it is used to implement any domain name detection method as described in the first aspect.

[0050] In a seventh aspect, a communication system is provided, comprising: a server and at least two computer devices, wherein the server comprises a domain name detection device as provided in the second aspect or various possible implementations of the second aspect.

[0051] The embodiment of the present application obtains multiple domain name segments from the domain name, and determines whether the domain name is a malicious domain name by detecting whether the domain name segment is an abnormal domain name segment. Compared with the related art, the entire domain name is no longer used as the identification unit, and the domain name segment is used as the abnormal identification unit, which reduces the interference between the domain name segments and improves the accuracy of identifying malicious domain names.

[0052] In the embodiment of the present application, the training sample set used includes a domain name segment positive sample set and a domain name segment negative sample set, or the training sample set used is a set of feature vectors obtained by extracting features from the domain name segment positive sample set and the domain name segment negative sample set. The training sample set is closer to the real data of the existing network, and the false alarm rate of the trained classifier is lower.

[0053] In the embodiment of the present application, by extracting domain names from DNS traffic logs, using one or more technologies such as dictionary trees, preset rules, AC automata, A record queries, etc., the domain name segments in the domain names are analyzed, malicious domain names can be output, and the IP addresses accessing the malicious domain names and / or abnormal organization domain names or host domain names can also be output, providing security monitoring personnel with a full range of malicious domain name alerts. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 This is a schematic diagram of an application environment of a malicious domain name provided in an embodiment of the present application;

[0055] Figure 2 This is a schematic diagram of another application environment of a malicious domain name provided in an embodiment of the present application;

[0056] Figure 3 It is a flowchart of a domain name identification method provided by an embodiment of the present application;

[0057] Figure 4 is a schematic training process flow chart provided in an embodiment of the present application;

[0058] Figure 5 is a structural diagram of a server provided by an exemplary embodiment of the present application;

[0059] Figure 6 is a block diagram of a domain name detection device provided in an embodiment of the present application;

[0060] Figure 7 is a block diagram of a domain name detection device provided in an embodiment of the present application;

[0061] Figure 8 is a block diagram of a domain name detection device provided in an embodiment of the present application;

[0062] Fig. 9 is a block diagram of a domain name detection device provided in an embodiment of the present application;

[0063] Fig.10 is a block diagram of a domain name detection device provided in an embodiment of the present application;

[0064] Fig.11 is a block diagram of a domain name detection device provided in an embodiment of the present application;

[0065] Fig.12 It is a possible basic hardware architecture of the computer device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0066] In order to make the principles and technical solutions of the present application clearer, the implementation methods of the present application will be further described in detail below in conjunction with the accompanying drawings.

[0067] A domain name, also known as a network domain, consists of a string of characters separated by dots (also called periods or dots). It is used to identify a computer or computer group on the Internet, and can be used to locate the computer during data transmission. For example, the string includes the American Standard Code for Information Interchange (ASCII) and / or characters from various languages.

[0068] When hackers conduct network attacks, they need to communicate with zombie machines (also known as bots) that have malware installed. In order to avoid detection by security devices (such as firewalls), zombie machines will establish direct or indirect communication connections with the main control machines controlled by hackers through malicious domain names. Figure 1 and Figure 2 The following are schematic diagrams of the application environments of two malicious domain names. Figure 1 and Figure 2 The communication system shown supports the Domain Name System (DNS) protocol, and includes: a master machine 101, a zombie machine 102 and a server 103, wherein the master machine 101 and the zombie machine 102 can both be computer devices, such as mobile phones, computers or laptops; the server 103 can be a Domain Name System (DNS) server, also known as a Command and Control (C2) server.

[0069] Figure 1In the example, zombie machine 102 establishes a direct communication connection with host machine 101 through a malicious domain name. The process of establishing the communication connection includes:

[0070] On the zombie machine 102 side, the malware regularly generates a large number of candidate domain names through a random generation algorithm (Domain Generation Algorithm, DGA), and queries it in the server 103; on the host machine 101 side (also called the attacker side), the hacker runs the same set of DGA as the zombie machine 102 side, and also generates a large number of candidate domain names. When the hacker needs to control the zombie machine 102 to launch an attack, the hacker selects a small number of candidate domain names for registration, and maps the registered domain names to the Internet Protocol (Internet Protocol, IP) address of the host machine 101 (that is, establishes a mapping relationship between the domain name and the IP address). Correspondingly, the host machine 101 resolves the registered domain name to the host machine 101. After the zombie machine 102 queries the server 103 for the candidate domain name generated by itself and the registered domain name, it obtains the corresponding IP address based on the queried domain name and the aforementioned mapping relationship. Based on the IP address, the zombie machine 102 can establish a direct communication connection with the host machine 101, and then the host machine 102 can control the zombie machine 102 through the malware to carry out a network attack. Among them, the aforementioned registered domain names and alternative domain names are malicious domain names, for example, Figure 1 The malicious domain names include "ks44qnbtmsn1mhyp.biz".

[0071] When a direct communication connection cannot be established between the host 101 and the zombie 102 due to access control (such as restrictions by Access Control Lists (ACL)), if the DNS of the host 101 and the zombie 102 is not restricted, the host 101 and the zombie 102 can establish an indirect communication connection through the DNS tunnel technology. DNS tunnel technology refers to the technology of repackaging data, other protocol frames or packets and sending them through the DNS tunnel. Hackers often use DNS tunnels to conduct malicious activities such as illegal proxy, data theft or C2 communication. Figure 2 As shown, the process of establishing the communication connection includes:

[0072] When communicating through the DNS tunnel, the zombie 102 uses the DNS tunnel technology to perform reorganization and / or segmentation operations on the data that actually needs to be transmitted (this operation process is called data conversion), and encapsulates the data after the reorganization and / or segmentation operations into the domain name as the payload of the DNS tunnel. For example, the payload of the domain name "yrbh1o.example.com" is "yrbh1o". The zombie 102 is installed with a client of the tunnel application, and by running the tunnel application (i.e., the client), it regularly sends the generated domain name to the server 103; on the main control machine 101 side, the main control machine is installed with a server side of the tunnel application. When the hacker needs to obtain the information of the zombie 102, the hacker runs the tunnel application (i.e., the server side), registers the domain name, and maps the registered domain name to the IP address of the main control machine 101 (i.e., establishes a mapping relationship between the domain name and the IP address). Based on the mapping relationship, the server 103 forwards the domain name sent by the zombie machine 102 to the host machine 103. The host machine 103 extracts the payload encapsulated in the acquired domain name based on the DNS tunneling technology, and performs the reverse operation of the aforementioned reorganization and / or segmentation operation on the extracted payload to obtain the actual transmitted data. Among them, the aforementioned registered domain name and the domain name encapsulated with the payload are both malicious domain names. For example, Figure 2 The malicious domain name is the domain name including "example.com", and the actual data encapsulated in the payload is "This is a test".

[0073] Traditional malicious domain names generated based on DGA are usually highly random. Figure 1 The malicious domain name in the application environment shown is generated based on DGA. The malicious domain name is often not readable, and is easily identified and detected by security devices. For example, an exemplary malicious domain name included in the chinad family (a set of malicious domain names) is: "mzqqoc3s68tewsdr.net".

[0074] In the related art, in the Figure 1 When identifying malicious domain names in the application environment shown, the acquired domain names are input into the machine learning model, and the malicious domain names are identified by the machine learning model.

[0075] In order to evade detection by security devices, obfuscated DGA and word-based DGA have emerged based on traditional DGA. Among them, the domain name generated based on the obfuscated DGA contains a part of randomly generated character strings and a part of fixed character strings. For example, the domain name of the banjori family (a set of malicious domain names) is generated based on the obfuscated DGA. For example, an illustrative malicious domain name included in the banjori family is: "oehuestnessbiophysicalohax.com". Only the first 4 characters from left to right in the domain name are randomly generated, and the remaining characters are fixed characters. The proportion of randomly generated characters in the characters contained in the domain name is very small, which makes it easier to evade detection by security devices, resulting in low recognition accuracy of the machine learning model for domain names generated based on the obfuscated DGA.

[0076] The domain name generated based on the word-based DGA contains a portion of random character strings at the word level. For example, the domain name of the pizd family (a set of malicious domain names) is generated based on the word-based DGA. The domain name is obtained by randomly selecting words from a pre-specified dictionary and combining them. For example, an illustrative malicious domain name included in the pizd family is "companylabor.net". This domain name has stronger concealment and is easier to evade detection by security devices. The aforementioned machine learning model has a low recognition accuracy for domain names generated based on obfuscated DGA.

[0077] like Figure 2 In the malicious domain name in the application environment shown, the payload part of the malicious domain name generated based on the DNS tunneling technology is usually highly random, such as the domain name: "yrbh1o.example.com" The payload part is a random string "yrbh1o". Figure 2 When identifying malicious domain names in the application environment shown in the figure, the acquired domain names are input into the deep learning model, and the malicious domain names are identified by the deep learning model. However, the payload part of the malicious domain name generated based on the DNS tunneling technology may appear after the multi-level domain names from right to left in the domain name, such as the payload of the malicious domain name yrbh1o.example3.example2.example1.example.com: "yrbh1o" is located after the fifth-level domain name from right to left. In this case, the proportion of unreadable characters in the characters contained in the domain name is very small, and the recognition accuracy of malicious domain names through the deep learning model is low.

[0078] The present application embodiment provides a domain name detection method, which can improve the accuracy of domain name recognition. The domain name detection method can be applied to Figure 1 or Figure 2In the application environment shown in the figure, for example, the domain name detection method can be executed by the aforementioned server 102, such as Figure 3 As shown, the method includes:

[0079] S301. Obtain a domain name.

[0080] In the embodiment of the present application, the server that executes the domain name detection method can be in different product forms. In different product forms, the server can obtain a DNS traffic log (log) and extract the domain name from the DNS traffic log. The DNS traffic log is used to record DNS-related data. For example, the DNS traffic log is used to record a DNS request, and the DNS request includes a domain name. The server can extract the domain name from the DNS request. Optionally, the DNS traffic log is also used to record DNS responses and / or log record types, etc. The embodiment of the present application does not limit the content of the DNS traffic log, which at least includes the domain name.

[0081] To facilitate readers' understanding, the following uses the server's provision of the following product forms as an example to explain the process of obtaining a domain name:

[0082] The first product form is a network firewall. The network firewall provided by the server extracts the DNS request in the DNS traffic log to obtain the domain name. The DNS traffic log is used to record network traffic (which at least includes DNS requests).

[0083] The second product form is the host firewall. The host firewall provided by the server extracts the DNS requests in the DNS traffic log to obtain the domain name. The DNS traffic log is used to record the DNS requests initiated by the host.

[0084] The third product form is the Web Application Firewall (WAF). For example, the server is an application server, and the WAF it provides extracts the DNS request from the DNS traffic log to obtain the domain name. The DNS traffic log is used to record the DNS connection passing through the WAF, which includes the DNS request and may also include the DNS response.

[0085] The fourth product form is the situational awareness platform. For example, the server is an application server, and the situational awareness platform provided by it uses a probe to collect the network traffic of the specified site to obtain a DNS traffic log, and then extracts the DNS request in the DNS traffic log to obtain the domain name. The DNS traffic log is used to record the network traffic of the specified site (which at least includes the DNS request).

[0086] The fifth product form is Cloud WAF. For example, the DNS request for the application server is directed by the application server to the Cloud WAF provided by the server. The Cloud WAF generates a DNS traffic log, which records the DNS requests received by the Cloud WAF. The Cloud WAF extracts the DNS requests in the DNS traffic log to obtain the domain name. After the Cloud WAF provided by the server analyzes the domain name, the analysis results and the DNS request can be returned to the application server. Optionally, the server providing the Cloud WAF can be an application server or a server other than the application server.

[0087] Depending on the application scenario, the DNS requests recorded in the obtained DNS traffic logs for the above five product forms provided by the server can be different types of DNS requests. For example, the DNS requests recorded in the DNS traffic logs are DNS requests initiated by computer devices in a specified network, and the specified network can be an enterprise intranet (such as an enterprise office network or an enterprise production network); for another example, the DNS requests recorded in the DNS traffic logs are DNS requests initiated by the cloud platform side; for another example, the DNS requests recorded in the DNS traffic logs are DNS requests initiated by the tenant side (also called the user side or the user device side); for another example, the DNS requests recorded in the DNS traffic logs are DNS requests initiated by the data center.

[0088] The server can obtain multiple domain names from the DNS traffic log. To facilitate the reader's understanding, S302 to S305 are described below using one domain name as an example. The processing method for other domain names can refer to the processing method for this domain name.

[0089] S302: Determine multiple domain name segments from the domain name.

[0090] A domain name is a string of multiple characters, which is usually composed of two or more groups of characters. Each group of characters is separated by a separator ".". Domain names are divided into levels from right to left. The group of characters on the far right is called the top-level domain (TLD) or the first-level domain, the second group of characters on the right (that is, the second to last group of characters from left to right) is called the second-level domain, the third group of characters on the right (that is, the third to last group of characters from left to right) is called the third-level domain, and so on.

[0091] In an embodiment of the present application, multiple domain name segments can be determined from the domain name according to pre-set rules, each domain name segment is a part of the domain name, and each domain name segment is a string of at least two consecutive characters in the domain name, so as to achieve further subdivision of the domain name. Since the domain name is divided into levels by separation points, in an embodiment of the present application, the server can divide the domain name into multiple domain name segments according to the separation points. This division method is compatible with the aforementioned domain name grading method. By identifying the separation points, the domain name segments can be quickly divided, the efficiency of domain name segment division is improved, and the complexity of domain name segment division is reduced. For example, the domain name: "example1.example.com.cn" includes 4 domain name segments "example1", "example", "com", and "cn".

[0092] Optionally, after obtaining the domain name in S301, the domain name can be preprocessed first; then multiple domain name segments are determined from the preprocessed domain name, and the process of determining multiple domain name segments can refer to the process of S302 above. The domain name can be screened and filtered through preprocessing, reducing the processing process of some domain names, thereby reducing the computational cost. The present application embodiment takes the following optional preprocessing methods as examples for illustration:

[0093] In the first optional mode, the preprocessing includes character validity checking processing. The processing process includes: the server checks the validity of characters in the domain name and uses the domain name with valid characters as the preprocessed domain name.

[0094] The category and / or arrangement of characters in a domain name must comply with a preset character rule. A domain name composed of characters that do not comply with the character rule is not a legal domain name, that is, an illegal domain name. The server can filter out illegal domain names and not process them, and retain legal domain names as pre-processed domain names, thereby reducing computational costs. For example, the character rule includes any one or more of the following:

[0095] First, the string in each level of domain name cannot consist only of English characters, numbers or hyphens (also called connectors) "-";

[0096] Second, two adjacent domain names cannot be connected by a hyphen "-";

[0097] The third type: hyphens “-” cannot appear consecutively;

[0098] Fourth, the hyphen "-" cannot appear at the beginning of the domain name;

[0099] Fifth, the hyphen "-" cannot appear at the end of the domain name;

[0100] Sixth, the total number of characters included in the domain name (i.e. the length of the domain name) does not exceed 63.

[0101] It is worth noting that the aforementioned character rules may also include other rules, and the character rules may be updated according to specific application scenarios, which is not limited in the embodiments of the present application.

[0102] In a second optional manner, the preprocessing includes a usage detection process, which includes: the server detects whether the domain name is a domain name for a designated purpose, and regards the domain name that is not for a designated purpose as the preprocessed domain name.

[0103] For some domain names with designated purposes, their purpose has determined that the domain name is not a malicious domain name. Therefore, if the domain name is a domain name with designated purposes, the domain name can be filtered and not processed, and the domain names that are not for designated purposes are retained as pre-processed domain names, which can reduce the computing cost. For example, the domain name with designated purposes can be a big data component domain name, such as an ARPA (Advanced Research Projects Agency Network, arpa) reverse lookup domain name or a kafka domain name. It can also be a local domain name or other preset special domain names.

[0104] In the related art, since the domain names with designated purposes are quite different from normal domain names, if a machine learning model or a deep learning model is used to identify the domain names with designated purposes, they may be mistakenly identified as malicious domain names. In the embodiment of the present application, the domain names with designated purposes are pre-filtered, which can effectively reduce the probability of misidentification of malicious domain names in the subsequent process.

[0105] The server may use a regular expression to detect whether the domain name is a domain name for a designated purpose.

[0106] In a third optional manner, the preprocessing includes a trie query process, which includes: the server uses the acquired domain name to query the trie, and uses the domain name that does not include the domain name in the trie as the preprocessed domain name.

[0107] Among them, the dictionary tree is also called a word search tree or a prefix tree, which is a tree structure. In an optional implementation, the descendants (also called child nodes) of each node in the dictionary tree have a common prefix. For example, "exampl" is the prefix of "example". In an embodiment of the present application, the dictionary tree is established based on a domain name blacklist and / or a domain name whitelist. Among them, the domain name blacklist is used to record malicious domain names, and the domain name whitelist is used to record non-malicious domain names, that is, normal domain names. By querying the dictionary tree, it can be determined whether there are domain names in the domain name blacklist and / or domain name whitelist in the acquired domain name. When there is a domain name in the domain name blacklist in the acquired domain name, it is determined that the acquired domain name is a malicious domain name, and the subsequent S306 can be directly executed to output the malicious domain name; when there is a domain name in the domain name whitelist in the acquired domain name, it is determined that the acquired domain name is a non-malicious domain name, and the domain name can be filtered without processing. Finally, the domain name that does not include the domain name in the dictionary tree is used as the pre-processed domain name, so as to perform subsequent processing, such as executing the process from S303 to S308. If the dictionary tree is built based on a domain name blacklist, the preprocessed domain names do not include the domain names in the domain name blacklist; if the dictionary tree is built based on a domain name whitelist, the preprocessed domain names do not include the domain names in the domain name whitelist; if the dictionary tree is built based on a domain name blacklist and a domain name whitelist, the preprocessed domain names do not include the domain names in the domain name whitelist or the domain name blacklist. In this way, by querying the dictionary tree, the number of domain names to be processed later can be reduced, reducing the computational cost.

[0108] For example, the root node in the dictionary tree does not contain any characters, and each node except the root node contains only one character; from the root node to a certain node g, the characters passed on the path are connected to form the string corresponding to the certain node g; the characters contained in all child nodes of each node are different from each other.

[0109] The root node in the dictionary tree may include an indicator, which indicates that the string on the path where the root node is located is from the domain name blacklist or the domain name whitelist. For example, the indicator indicates that the string is from the domain name blacklist or the domain name whitelist through color. When the indicator is black, it indicates that the string is from the domain name blacklist. When the indicator is white, it indicates that the string is from the domain name whitelist. Each string in the dictionary tree is from the domain name blacklist and / or the domain name whitelist.

[0110] In traditional domain name detection methods, if a domain name blacklist is used to pre-process domain names, only domain names that are exactly the same as those in the domain name blacklist can be determined as malicious domain names. This process is called domain name blacklist filtering; if a domain name whitelist is used to pre-process domain names, only domain names that are exactly the same as those in the domain name whitelist can be determined as non-malicious domain names. This process is called domain name whitelist filtering.

[0111] In the embodiment of the present application, unlike the traditional filtering of domain name blacklist and domain name whitelist, when the acquired domain name includes a domain name in the dictionary tree that originates from the domain name blacklist, the acquired domain name is determined as a malicious domain name; when the acquired domain name includes a domain name in the dictionary tree that originates from the domain name whitelist, the acquired domain name is determined as a non-malicious domain name.

[0112] Among them, the dictionary tree can be used for prefix filtering or suffix filtering. For example, assuming that the dictionary tree is used for prefix filtering, the server uses the obtained domain name to query the dictionary tree in character units in order from right to left, so as to achieve the dictionary tree to match the head of the domain name (that is, matching from the right). For example, a domain name such as example.com has a black root node in the dictionary tree. Then, in the order from left to right, any domain name ending with the domain name: example.com (that is, starting with example.com in the order from right to left) is identified as black, and the server determines the domain name identified as black as a malicious domain name. For example, a domain name such as example1.com has a white root node in the dictionary tree. Then any domain name ending with the domain name: example1.com is identified as white, and the server determines the domain name identified as white as a non-malicious domain name.

[0113] The server establishes a dictionary tree by using a domain name blacklist and / or a domain name whitelist, and uses domain names that do not include domain names in the dictionary tree as pre-processed domain names, thereby quickly filtering domain names that include domain names in the dictionary tree. Compared with traditional domain name blacklist and domain name whitelist filtering methods, more domain names are filtered out, the time for domain name filtering is shorter, and the efficiency is higher.

[0114] In an embodiment of the present application, the domain name blacklist may include domain names extracted from pre-acquired threat intelligence information, and may also include domain names entered by experts or pre-collected malicious domain names generated based on DNS tunneling technology. The domain name whitelist may include the top m domain names (m is a positive integer, for example, m=5000) extracted from a specified domain name ranking website (such as a website that publishes the world ranking of websites), and may also include safe domain names obtained by other means, such as extracting common safe domain names from the current network (i.e., the network at the current stage, such as the network in the past week, month, or year) or safe domain names entered by experts. The embodiment of the present application does not limit the method for obtaining the domain name blacklist and the domain name whitelist.

[0115] S303: Obtain multiple updated domain name segments.

[0116] Optionally, after obtaining multiple domain name segments, one or more domain name segments in the multiple domain name segments may be deleted to obtain multiple updated domain name segments. The process may include: detecting whether the domain name segment at a specified position in the domain name belongs to a domain name segment set corresponding to the specified position; after determining that the domain name segment at a specified position in the domain name belongs to a domain name segment set corresponding to the specified position, deleting the domain name segment at the specified position in the multiple domain name segments to obtain multiple updated domain name segments. The domain name segment set includes one or more domain name segments.

[0117] The present application embodiment takes the following situations as examples to illustrate the update process of the aforementioned multiple domain name segments:

[0118] In the first case, the domain name segment at the specified position in the domain name is the first domain name segment from left to right in the domain name, and the corresponding domain name segment set includes the domain name segment: "www". After determining that the domain name segment at the specified position in the domain name belongs to the domain name segment set corresponding to the specified position, the process of deleting the domain name segment at the specified position in the multiple domain name segments to obtain the updated multiple domain name segments includes: after determining that the first domain name segment in the domain name belongs to the domain name segment set including "www", deleting the first domain name segment in the multiple domain name segments to obtain the updated multiple domain name segments.

[0119] In the second case, the domain name segment at the specified position in the domain name is the second to last domain name segment from left to right in the domain name, and the corresponding domain name segment set is a top-level domain name set, which includes one or more top-level domain names. After determining that the domain name segment at the specified position in the domain name belongs to the domain name segment set corresponding to the specified position, the process of deleting the domain name segment at the specified position in multiple domain name segments to obtain multiple updated domain name segments includes:

[0120] In an optional manner, after determining that the penultimate domain name segment in the domain name belongs to the top-level domain name set, the penultimate domain name segment in the multiple domain name segments is directly deleted to obtain multiple updated domain name segments.

[0121] In another optional manner, after determining that the penultimate domain name segment in the domain name belongs to the top-level domain name set and the total number of characters in the penultimate domain name segment is less than a first quantity threshold, the penultimate domain name segment in the multiple domain name segments is deleted to obtain multiple updated domain name segments. For example, the first quantity threshold is 4. Since when the total number of characters in the penultimate domain name segment is less than the first quantity threshold, even if the domain name segment belongs to the top-level domain name set, the probability that it has actual meaning is low, and the probability that it is an abnormal domain name segment is also low, therefore, by deleting the penultimate domain name segment, unnecessary calculations can be reduced, thereby reducing the computational cost.

[0122] In the third case, the domain name segment at the specified position in the domain name is the last domain name segment from left to right in the domain name, and the corresponding domain name segment set is a top-level domain name set, which includes one or more top-level domain names. After determining that the domain name segment at the specified position in the domain name belongs to the domain name segment set corresponding to the specified position, the domain name segment at the specified position in the multiple domain name segments is deleted to obtain the updated multiple domain name segments. The process includes: after determining that the last domain name segment in the domain name belongs to the top-level domain name set, the last domain name segment in the multiple domain name segments is deleted to obtain the updated multiple domain name segments. The top-level domain name set includes one or more top-level domain names.

[0123] Among them, in the second and third cases, there are multiple ways to obtain the top-level domain name set. In the embodiment of the present application, all top-level domain names in the existing network can be collected to obtain the top-level domain name set. For example, the top-level domain name set includes: ".xyz", ".top", ".com" or ".cn", etc.

[0124] In the above three cases, if the above domain name segments are obtained by dividing by a separator point, each domain name segment usually does not have a separator point ".". The domain name segments in the above domain name segment set may have a separator point "." or may not have a separator point ".". For example, the domain name segment set corresponding to the first domain name segment includes domain name segments: "www" or "www."; the top-level domain names in the top-level domain name set may have a separator point "." or may not have a separator point ".", such as ".xyz" or "top". For a domain name segment x at a specified position, the domain name segment x belongs to the domain name segment set corresponding to the specified position, which means that the domain name segments in the domain name segment set include the domain name segment x. For example, assuming the last domain name segment is: "cn", it belongs to ".cn" and also belongs to "cn".

[0125] It should be noted that the update process of multiple domain name segments corresponding to the above three situations can be executed separately or in combination according to the actual scenario, that is, the update process of multiple domain name segments includes any one or more of the update processes corresponding to the above three situations.

[0126] S304: When the domain name segment meets the preset rules, determine that the domain name segment is an abnormal domain name segment. The preset rules include any one or more of the following first to third rules:

[0127] The first rule is to identify abnormal domain name segments through a classifier based on domain name segments or feature vectors of domain name segments.

[0128] In an optional manner, the domain name segment is input into a classifier so that the classifier identifies an abnormal domain name segment. Optionally, the domain name segment is input into the classifier with characters as the granularity, and after the classifier identifies the domain name segment, it outputs a classification result, which is used to indicate whether the domain name segment is an abnormal domain name segment. For example, the classification result includes a score value, which is used to reflect the probability that the domain name segment is an abnormal domain name segment. For example, the classifier includes a neural network model, such as a recurrent neural network (RNN) model, a convolutional neural network (CNN) model and / or a long short-term memory (LSTM) model and other deep learning models.

[0129] In another optional manner, the feature vector of the domain name segment is input into a classifier so that the classifier can identify abnormal domain name segments. For example, the classifier includes a machine learning model, such as a logistic regression model, and / or a random forest model. The aforementioned classifier may also include other models, such as a support vector machine (SVM), and the embodiment of the present application does not limit the type of the classifier.

[0130] The feature vector of the aforementioned domain name segment is a vector composed of features extracted from the domain name segment, which is used to reflect the attributes (also called characteristics) of the domain name segment. After receiving the feature vector, the classifier identifies the feature vector and outputs a classification result, which indicates whether the domain name segment corresponding to the feature vector is an abnormal domain name segment. For example, the classification result includes a score value, which is used to reflect the probability that the domain name segment is an abnormal domain name segment. For example. The feature vector is an n-dimensional feature vector including n features, where n is a positive integer, and the n features include one or more of the following:

[0131] The first feature is the ratio of the number of hyphens "-" in the domain name segment to the number of characters in the domain name segment. The total number of characters in the domain name segment is the length of the domain name segment. Assuming the domain name segment is "example-1", the number of hyphens "-" in the domain name segment is 1, and the length of the domain name segment is 9. The ratio of the number of hyphens "-" in the domain name segment to the number of characters in the domain name segment is 1 / 9.

[0132] The second feature is the ratio of the number of digits in the domain name segment to the number of characters in the domain name segment. Assuming the domain name segment is "example-1", the number of digits in the domain name segment is 1, the length of the domain name segment is 9, and the ratio of the number of digits in the domain name segment to the number of characters in the domain name segment is 1 / 9.

[0133] The third characteristic is the length of the domain name segment. Assuming the domain name segment is "example-1", the length of the domain name segment is 9.

[0134] The fourth characteristic is the ratio of the number of character types included in the domain name segment to the total number of characters in the domain name segment. The character types are pre-set. In one example, the character types of the domain name segment include one or more of numbers, letters, and hyphens. Assuming that the domain name segment is "example-1", the domain name segment includes three types of characters, namely, numbers, letters, and hyphens, that is, the number of character types included in the domain name segment is 3, the length of the domain name segment is 9, and the ratio of the number of character types included in the domain name segment to the total number of characters in the domain name segment is 1 / 3. In another example, different characters in the domain name segment are different types of characters. Assuming that the domain name segment is "example-1", the domain name segment includes eight characters, namely, "e", "x", "a", "m", "p", "l", "-", and "1", the number of character types included in the domain name segment is 8, the length of the domain name segment is 9, and the ratio of the number of character types included in the domain name segment to the total number of characters in the domain name segment is 8 / 9.

[0135] The fifth characteristic is the ratio of the number of types of numbers included in the domain name segment to the total number of characters in the domain name segment. Different numbers in the domain name segment are different types of numbers. Assuming the domain name segment is "example-12", the domain name segment includes two types of numbers, "1" and "2", that is, the number of types of numbers included in the domain name segment is 2, the length of the domain name segment is 10, and the ratio of the number of types of numbers included in the domain name segment to the total number of characters in the domain name segment is 1 / 5.

[0136] The sixth characteristic is the Shannon entropy (also called information entropy) of the domain name segment. The Shannon entropy of the domain name segment is the Shannon entropy of the string included in the domain name segment.

[0137] The seventh characteristic is the ratio of the number of occurrences of consecutively repeated letters included in the domain name segment to the total number of characters in the domain name segment. Among them, two identical letters appearing adjacent to each other is considered as one occurrence of consecutively repeated letters. For example, assuming the domain name segment is "examplee-1", the consecutively repeated letters are "ee", that is, the number of occurrences of consecutively repeated letters is 1, the length of the domain name segment is 10, and the number of consecutively repeated letters included in the domain name segment accounts for 1 / 10; for another example, assuming the domain name segment is "exampleee-1", the consecutively repeated letters are two groups of adjacent "ee", that is, the number of occurrences of consecutively repeated letters is 2, the length of the domain name segment is 10, and the number of consecutively repeated letters included in the domain name segment accounts for 1 / 5.

[0138] The eighth characteristic is the proportion of vowels in the domain name segment. There are 5 vowels, namely: a, e, i, o, u. For example, assuming the domain name segment is "example-1", the vowels are "e", "a", and "e", that is, the domain name segment includes 3 vowels, the length of the domain name segment is 9, and the proportion of vowels in the domain name segment is 1 / 3.

[0139] The ninth characteristic is the ratio of the number of numbers included in the domain name segment to the number of characters included in the domain name segment. Assuming the domain name segment is "example-1", the domain name segment includes "1", which means the number of numbers included in the domain name segment is 1, the length of the domain name segment is 9, and the ratio of the number of numbers included in the domain name segment to the number of characters included in the domain name segment is 1 / 9.

[0140] The tenth characteristic is the ratio of the number of occurrences x1 of consecutive letters included in the domain name segment to the first number of characters y1, where the first number of characters y1 is the difference between the total number of characters y in the domain name segment and the number of occurrences x1 of consecutive letters. Two letters appearing adjacent to each other is considered as one occurrence of consecutive letters. For example, assuming that the domain name segment is "example-1", the consecutive letters include "ex", "xa", "am", "mp", "pl" and "le", with a total of 6 consecutive letters appearing, then x1=6, the total number of characters y, i.e., the character length, is 9, the first number of characters y1=y-x1=9-6=3, then the ratio of the number of occurrences x1 of consecutive letters included in the domain name segment to the first number of characters y1 is 6 / 3=2.

[0141] The eleventh characteristic is the ratio of the number of occurrences x2 of consecutive consonants included in the domain name segment to the second number of characters y2, where the second number of characters y2 is the difference between the total number of characters y in the domain name segment and the number of occurrences x2 of consecutive consonants. There are 21 consonants, namely: b, c, d, f, g, h, j, k, l, m, n, p, q, r, s, t, v, w, x, y, z. Two consonants appearing adjacent to each other is considered one occurrence of consecutive consonants. For example, assuming that the domain name segment is "example-1", the consecutive consonants include: "mp" and "pl", with a total of 2 consecutive consonant occurrences, x2=2, the length of the domain name segment is 9, the second number of characters y2=y-x2=9-2=7, and the ratio of the number of occurrences x1 of consecutive letters included in the domain name segment to the first number of characters y1 is 2 / 7.

[0142] The twelfth characteristic is the ratio of the number of occurrences x3 of consecutive numbers included in the domain name segment to the third number of characters y3, where the third number of characters y3 is the difference between the total number of characters y in the domain name segment and the number of occurrences x3 of consecutive numbers. Two numbers appearing adjacently is considered to be one occurrence of consecutive numbers. For example, assuming the domain name segment is "example-12", the consecutive numbers include: "12", with a total of 1 occurrence of consecutive numbers, x3=1, the length of the domain name segment is 10, the third number of characters y3=y-x3=10-1=9, and the ratio of the number of occurrences x1 of consecutive letters included in the domain name segment to the first number of characters y1 is 1 / 9.

[0143] The thirteenth characteristic is the ratio of the number of switching between numbers and letters in the domain name segment to the total number of characters in the domain name segment. A number and a letter appearing adjacent to each other is considered a number and letter switching. For example, "8a" or "e9" is a number and letter switching situation. Assuming the domain name segment is "example1", the number and letter switching situation is "e1", with a total of 1 number and letter switching. The length of the domain name segment is 8, and the length of the domain name segment is 10, which is 1 / 8.

[0144] The fourteenth feature, readability score, is used to indicate the readability of the domain name segment. For example, the readability score is the score corresponding to the domain name segment output by the Markov model trained with a specified word library. For example, the specified word library is the Corpus of Contemporary American English (COCA).

[0145] The fifteenth feature, reliability score, is used to indicate the reliability of the domain name segment. For example, the reliability score is the score corresponding to the domain name segment output by the Markov model obtained by training the domain name segment positive sample set. The domain name segment positive sample set is a domain name segment sample set obtained based on the domain name positive sample set, and the domain name segment sample set includes one or more domain name segments. The domain name positive sample set includes one or more domain names. For example, the domain name positive sample set may include the top d domain names (d is a positive integer, for example, d is 1 million) extracted from a specified domain name ranking website (such as a website that publishes the world ranking of websites). Among them, the process of obtaining the domain name segment sample set based on the domain name positive sample set includes: for each domain name in the domain name positive sample set, multiple domain name segments are determined from the domain name, and this process can refer to S302; optionally, multiple updated domain name segments can also be obtained, and this process can refer to S303. Optionally, the domain name can also be preprocessed, and the preprocessing process refers to the preprocessing process in the aforementioned S302.

[0146] The sixteenth characteristic is the ratio of the number of words included in the domain name segment to the total number of characters in the domain name segment. For example, assuming the domain name segment is "example-1", the word is "example", that is, the number of words is 1, the length of the domain name segment is 9, and the ratio of the number of words included in the domain name segment to the total number of characters in the domain name segment is 1 / 9.

[0147] The seventeenth feature is the number of words included in the domain name segment. For example, assuming the domain name segment is "example-1", the word is "example", that is, the number of words is 1.

[0148] The eighteenth feature is a bigram data sorting feature. The bigram data sorting feature is a feature determined by a sequence number after sorting multiple bigram data included in the domain name segment according to the frequency of occurrence (the frequency of occurrence is the frequency of occurrence in the domain name segment). Each bigram data in the multiple bigram data consists of two consecutive characters in the domain name segment. For example, the multiple bigram data can be obtained through a sliding window mechanism. Optionally, the bigram data sorting feature is the median, mean or variance of the sequence number after sorting multiple bigram data included in the domain name segment according to the frequency of occurrence. For example, assuming that the domain name segment is "examplex", the multiple binary data obtained by using the sliding window mechanism are: "ex", "xa", "am", "mp", "pl", "le" and "ex", a total of 7 groups of binary data, among which the frequencies of occurrence of "ex", "xa", "am", "mp", "pl" and "le" are 2 / 7, 1 / 7, 1 / 7, 1 / 7, 1 / 7 and 1 / 7 respectively, and the serial numbers after sorting according to the frequency of occurrence are 1, 2, 2, 2, 2, 2 respectively. Assuming that the binary data sorting feature is the median of the serial numbers of the multiple binary data included in the domain name segment after sorting according to the frequency of occurrence, the binary data sorting feature is (1+2+2+2+2+2) / 6=11 / 6.

[0149] The nineteenth feature, trigram data sorting feature, is a feature determined by a sequence number after sorting multiple trigram data included in the domain name segment according to the frequency of occurrence (the frequency of occurrence is the frequency of occurrence in the domain name segment), and each of the multiple trigram data consists of three consecutive characters in the domain name segment. For example, the multiple trigram data can be obtained through a sliding window mechanism. Optionally, the trigram data sorting feature is the median, mean or variance of the sequence number after sorting multiple trigram data included in the domain name segment according to the frequency of occurrence. For example, assuming that the domain name segment is "examplex", the multiple triple data obtained by using the sliding window mechanism are: "exa", "xam", "amp", "mpl", "ple" and "lex", a total of 6 groups of triple data, among which the frequencies of occurrence of "exa", "xam", "amp", "mpl", "ple" and "lex" are 1 / 6, 1 / 6, 1 / 6, 1 / 6, 1 / 6 and 1 / 6 respectively, and the serial numbers after sorting according to the frequency of occurrence are 1, 1, 1, 1, 1, 1 respectively. Assuming that the sorting feature of the triple data is the median of the serial numbers of the multiple triple data included in the domain name segment after sorting according to the frequency of occurrence, the sorting feature of the triple data is (1+1+1+1+1+1) / 6=6 / 6=1.

[0150] The above 19 features are only for illustrative purposes. In actual implementation, other features of the domain name segment may also be extracted. For example, the n features may include one or more of the following:

[0151] The twentieth characteristic is the ratio of the number of occurrences x4 of consecutively repeated letters included in the domain name segment to the fourth number of characters y4, where the fourth number of characters y4 is the difference between the total number of characters y in the domain name segment and the number of occurrences x4 of consecutively repeated letters.

[0152] The 21st characteristic is the ratio of the number of occurrences x1 of consecutive letters included in the domain name segment to the total number of characters y in the domain name segment.

[0153] The twenty-second feature is the ratio of the number of occurrences x2 of consecutive consonant letters included in the domain name segment to the total number of characters y in the domain name segment.

[0154] The twenty-third feature is the ratio of the number of occurrences x3 of consecutive numbers included in the domain name segment to the total number of characters y in the domain name segment.

[0155] Optionally, the aforementioned n features can also be deleted, changed or replaced according to actual conditions, for example, the seventh feature is replaced by the aforementioned twentieth feature; and / or, the tenth feature is replaced by the aforementioned twenty-first feature; and / or, the eleventh feature is replaced by the aforementioned twenty-second feature; and / or, the twelfth feature is replaced by the aforementioned twenty-third feature. The aforementioned n features can reflect the partial or overall attributes of the domain name segment, thereby enabling the classifier to accurately identify abnormal domain name segments.

[0156] Based on different application scenarios, the above two optional methods in the first rule can be executed in combination or separately.

[0157] In the embodiment of the present application, there are usually at least two classifiers. Thus, a classifier with higher accuracy is obtained by combining at least two classifiers, which has better generalization ability than a single classifier, so as to more accurately adapt to the domain name data of the existing network, and further improve the accuracy of the determined abnormal domain name segment. When there are at least two classifiers, the final classification result is the weighted sum, or weighted average, of the classification results of the at least two classifiers. For example, the at least two classifiers respectively output at least two classification results, each classification result includes a score value, and the final classification result is the weighted sum, or weighted average, of the at least two score values. For example, the weight of each classification result is 1.

[0158] The second rule is that the ratio of the number of vowels included in the domain name segment to the total number of characters in the domain name segment is less than the ratio threshold. For example, the ratio threshold is 0.2. Since the ratio of vowels to consonants in English letters is 5:21, the ratio of vowels to all letters is 5:26. If the domain name segment is randomly generated, such as generated by DGA, the ratio of the number of vowels in the domain name segment to the total number of characters included in the domain name segment is about 5:26, which is less than 0.2. In actual applications, the probability of occurrence of each letter in a non-malicious domain name is set according to the frequency of occurrence of the letters in the language usage scenario. For example, in some common normal domain names, the ratio of vowels to consonants is 1:1. In this way, in actual language usage scenarios, the ratio of vowels to all letters is about 1:2, which is much greater than 0.2. By setting this ratio threshold, randomly generated domain name segments can be effectively screened out, thereby identifying abnormal domain name segments. In particular, the recognition accuracy of domain name segments in domain names generated based on DGA is high.

[0159] The third rule is that the domain name segment includes abnormal tokens. The tokens are determined according to the preset token division rules, each token includes one or more characters, usually at least two characters, and have specific meanings.

[0160] Optionally, the entries in the domain name segment can be identified by an AC automaton (Aho-Corasick automaton). The identification process includes: analyzing the entries included in the domain name segment from each domain name segment based on the AC automaton's vocabulary, and the AC automaton's vocabulary includes one or more of words, pinyin, institution names (and / or organization names, unit names, company names) or roots. Furthermore, the AC automaton's vocabulary can also include other content, such as entries in a specified website. For example, the specified website is Wikipedia or Baidu Encyclopedia. For example, the multiple domain name segments included in the domain name are respectively input into the AC automaton, and the AC automaton matches the input domain name segments with the vocabulary, and outputs the entries that match the entries in the vocabulary in each domain name segment, thereby realizing the recognition of the entries in the domain name segment.

[0161] For example, an abnormal term is a term that appears more than a threshold number of times within a specified time period, and / or appears at the same position in different domain name segments with a probability greater than a probability threshold. For example, the specified time period can be 1 to 7 days, such as 5 days.

[0162] As mentioned above, the domain name generated based on the word-type DGA contains a portion of random character strings at the word level, and since this portion of words comes from a fixed dictionary. Therefore, within a period of time, the probability of word repetition in this type of domain name is high. In the embodiment of the present application, the entries that appear more than the number threshold within the specified time are determined as abnormal entries. According to the generation principle of the domain name generated based on the word-type DGA, the entries that appear multiple times within the specified time can be determined as abnormal entries, thereby accurately identifying the abnormal entries.

[0163] The domain name generated based on the obfuscated DGA contains a part of randomly generated character strings and a part of fixed character strings, and the position of the randomly generated character strings in different domain name segments is usually relatively fixed. Therefore, within a period of time, the probability of a fixed character string appearing in the same position in different domain name segments in this type of domain name is high. In an embodiment of the present application, entries whose probability of appearing in the same position in different domain name segments is greater than a probability threshold are determined as abnormal entries. Based on the generation principle of domain names generated based on the obfuscated DGA, entries that often appear in the same position of a domain name segment within a specified period of time can be determined as abnormal entries, thereby accurately identifying abnormal entries.

[0164] In the embodiment of the present application, the abnormal terms can be determined by constructing a tuple corresponding to the terms. For example, the process includes:

[0165] A1. For each term in each domain name in the first domain name set, a tuple is constructed, the tuple including the string included in the corresponding term (i.e., the content of the term) and the order in which the corresponding term appears in the terms included in the domain name segment. Optionally, the order can be represented by a sequence number.

[0166] In a first optional example, the first domain name set includes domain names obtained within a specified time period. In a second optional example, the first domain name set includes domain names whose number of terms included in the domain names obtained within the specified time period is greater than a quantity threshold. In an example, the quantity threshold is 1 or 2. Since a normal domain name usually includes at most one term, the domain names obtained within the specified time period are screened based on the number of terms included in the domain name, and the normal domain names can be filtered out, thereby reducing the calculation of the normal domain names and reducing the computational cost.

[0167] For example, the specified time is 5 days, and the server obtains a total of 10,000 domain names. The 10,000 domain names are obtained as the first domain name set, or the domain names whose number of entries in the 10,000 domain names is greater than the quantity threshold are obtained as the first domain name set. A tuple is constructed for each entry in each domain name in the first domain name set. Assume that a domain name segment is "companylabor", which contains two entries, namely "company" and "labor", and the tuples corresponding to the two entries are (company, 1) and (labor, 2).

[0168] A2. When the number of times a bigram corresponding to a certain term w in the first domain name set co-occurs with a target bigram is greater than a co-occurrence threshold, the term w is determined to be an abnormal term. The target bigram is a bigram corresponding to a term other than the term w in the first domain name set, and the distance between the target bigram and the bigram corresponding to the term w is less than a distance threshold (or the similarity is greater than a similarity threshold). The term w can be any term in the first domain name set. Optionally, the co-occurrence threshold is the difference between the aforementioned threshold and 1. For example, the co-occurrence threshold is 5.

[0169] For example, the server can calculate the distance between each pair of bigrams corresponding to each term of the domain name in the first domain name set. For a bigram corresponding to a certain term w, when the distance between any bigram in the bigrams corresponding to terms other than the certain term w and the bigram corresponding to the certain term w is less than a distance threshold, the any bigram is determined as a target bigram, and the number of times the bigram corresponding to the certain term w and all the target bigrams co-occur is calculated. When the number of co-occurrences is greater than the co-occurrence threshold, the certain term w is determined to be an abnormal term.

[0170] Optionally, the distance between each two bigrams mentioned above can be calculated using the Jaccard Distance formula.

[0171] In actual implementation of the embodiment of the present application, the server can obtain the bigram corresponding to each term in the first domain name set, obtain a bigram sequence, and construct a co-occurrence matrix based on the bigram sequence. The co-occurrence matrix includes p rows and p columns of elements, wherein the element in the i-th row and j-th column represents the distance between the i-th bigram and the j-th bigram in the bigram sequence. 1≤i≤p, 1≤j≤p, p is the number of bigrams included in the bigram sequence. Based on the co-occurrence matrix, the number of times each bigram co-occurs with its corresponding target bigram can be quickly retrieved, thereby identifying abnormal terms.

[0172] It should be noted that, since the number of entries in each domain name segment in a normal domain name is usually small, and the entries in a malicious domain name are randomly selected, there may be a situation where there are multiple entries in a domain name segment. Therefore, in an optional manner, for each domain name segment, the domain name segment whose number of characters included in the union of the entries is greater than the character number threshold can also be identified as an abnormal domain name segment. That is, the number of characters included in the union of the entries in the abnormal domain name segment is greater than the character number threshold. For example, the character number threshold is 9. For example, the domain name segment is "companylabor", and the entries include words. Through identification, it is found that the domain name segment includes "company" and "labor", and the number of characters included in the union of the two words "companylabor" is 12, which is greater than the character number threshold 9, and the domain name segment can be identified as an abnormal domain name segment. In another optional manner, for each domain name segment, when the domain name segment includes abnormal entries and the number of characters included in the union of the entries is greater than the character number threshold, the domain name segment is identified as an abnormal domain name segment, which can improve the recognition accuracy of abnormal domain name segments.

[0173] As mentioned above, the preset rules include any one or more of the first to third rules. When the preset rules include multiple of the first to third rules, for each domain name segment, it can be judged whether the domain name segment satisfies each of the multiple rules, and based on the judgment result, it is determined whether the domain name segment is an abnormal domain name segment. For example, based on the judgment result, an abnormal score value is generated. When the abnormal score value is greater than the score threshold, the domain name segment is determined to be an abnormal domain name segment; when the abnormal score value is not greater than the score threshold, the domain name segment is determined not to be an abnormal domain name segment. For example, the initial value of the abnormal score value is 0. When the domain name segment satisfies a rule, the score value corresponding to the rule is 1. When the domain name segment does not satisfy a rule, the score value corresponding to the rule is 0. Finally, the sum of the score values ​​corresponding to the rules satisfied by the domain name segment is determined as the abnormal score value. When the abnormal score value exceeds the score threshold, the domain name segment is determined to be an abnormal domain name segment. When the abnormal score value does not exceed the score threshold, the domain name segment is determined not to be an abnormal domain name segment. Assuming the score threshold is 2, when the domain name segment satisfies 3 rules, the abnormal score value is 3, and the domain name segment is determined to be an abnormal domain name segment.

[0174] Furthermore, since the aforementioned first rule involves one or more classifiers, when the first rule involves at least two classifiers, the weighted sum or weighted average of the classification results of the at least two classifiers can be converted into a score value corresponding to the first rule. For example, if the weighted sum or weighted average is greater than the specified value, the score value corresponding to the first rule is 1; if the weighted sum or weighted average is not greater than the specified value, the score value corresponding to the first rule is 0. Alternatively, the weighted sum or weighted average of the classification results of at least two classifiers can be converted into an abnormal score value and directly used as the score value corresponding to the first rule. The embodiment of the present application does not limit the method for determining the aforementioned abnormal score value.

[0175] S305: After determining that there is an abnormal domain name segment among the multiple domain name segments corresponding to the domain name, determine the domain name as a malicious domain name.

[0176] For example, when any domain name segment among multiple domain name segments corresponding to a domain name is an abnormal domain name segment, the domain name to which the multiple domain name segments belong is determined as a malicious domain name.

[0177] As mentioned above, in the related art, a machine learning model is used to analyze the domain name as a whole to identify malicious domain names generated based on DGA, and a deep learning model is used to analyze the domain name as a whole to identify malicious domain names generated based on DNS tunnel technology. However, on the one hand, the accuracy of malicious domain name identification is low, and on the other hand, it is impossible to simultaneously identify malicious domain names generated based on DGA and malicious domain names generated based on DNS tunnel technology.

[0178] In the embodiment of the present application, by refining the domain name into domain name segments, detecting whether the domain name segment is an abnormal domain name segment to determine whether the domain name is a malicious domain name, the accuracy of malicious domain name identification is improved. In addition, although the malicious domain name generated based on DGA and the malicious domain name generated based on DNS tunnel technology are different in generation principle, the character string in the malicious domain name generated based on DGA (such as mzqqoc3s68tewsdr) and the payload part in the malicious domain name generated based on DNS tunnel technology (such as yrbh1o) are highly random and unreadable in form. By identifying these random and unreadable domain name segments, the malicious domain name generated based on DGA and the malicious domain name generated based on DNS tunnel technology can be identified at the same time, thereby realizing unified detection of malicious domain names, and the recognition efficiency of malicious domain names is high.

[0179] Furthermore, in the related art, since in the domain names generated based on obfuscated DGA and word-based DGA, the randomly generated characters account for a very small proportion of the characters contained in the entire domain name, and the payload part of the malicious domain name generated based on DNS tunnel technology is encapsulated after the multi-level domain name, the proportion of unreadable characters in the characters contained in the domain name is very small. Therefore, these three types of malicious domain names are morphologically similar to normal domain names, and only have local problems. The recognition accuracy of these three types of malicious domain names in the related art is low.

[0180] In the embodiment of the present application, as long as there is an abnormal domain name segment in the domain name, the malicious domain name can be located. For the above three types of malicious domain names, even if the randomly generated or unreadable characters account for a small proportion of the entire domain name (that is, only part of the domain name has problems), the malicious domain name can be identified through the abnormal domain name segment, thereby improving the recognition accuracy of the malicious domain name.

[0181] S306: Output the malicious domain name.

[0182] The server may output each malicious domain name after identifying it, or output all identified malicious domain names after the number of identified malicious domain names reaches a specified threshold, or periodically identify malicious domain names and output malicious domain name identification results once in each identification cycle, the malicious domain name identification results including the malicious domain names identified in the identification cycle. The malicious domain names may be output through the user interface of the server or other devices connected to the server.

[0183] S307: When the malicious domain name is accessed once or multiple times, the IP address used for the access is output.

[0184] refer to Figure 1In the application environment shown, when the zombie machine 102 establishes a direct communication connection with the main control machine 101, a large number of alternative domain names need to be generated. These domain names are all malicious domain names. Normal computer devices usually do not access these malicious domain names, but the zombie machine 102 needs to access these malicious domain names to complete the establishment of the communication connection. In the embodiment of the present application, the IP address of the malicious domain name is output, and the IP address is actually the IP address of the zombie machine. In this way, the zombie machine can be located, thereby determining the controlled computer device, so as to achieve security protection of the computer device and prevent malicious attacks.

[0185] Because in Figure 1 In the application environment shown, only a small number of alternative domain names will be registered, so there are a large number of malicious domain names that are not registered and do not have corresponding IP addresses. In order to establish a connection with the main control machine 101, the zombie machine 102 will access these malicious domain names once or multiple times. Since these malicious domain names do not have corresponding IP addresses, the corresponding access will not generate address records (also known as A records). Optionally, when the malicious domain name is accessed once or multiple times and there is no address record for the access, the server outputs the IP address used for the access. In this way, the zombie machine can be located more accurately and the accuracy of identifying the zombie machine can be improved. It should be noted that after the malicious domain name is accessed once or multiple times, the server may not query whether there is an address record for the access, and directly output the IP address used for the access, which can reduce the query complexity and reduce the server load.

[0186] Optionally, the server may output each IP address after identifying an IP address that accesses a malicious domain name, or may output all identified IP addresses that access malicious domain names after the number of identified IP addresses that access malicious domain names reaches a specified threshold. The server may also periodically identify IP addresses that access malicious domain names, and output an identification result of the IP addresses that access malicious domain names once in each identification cycle, wherein the identification result of the IP addresses that access malicious domain names includes the IP addresses that access malicious domain names that are identified in the identification cycle. The IP addresses that access malicious domain names may be output through the user interface of the server or other devices connected to the server. The aforementioned identification cycle may be 5 days.

[0187] Among them, the aforementioned IP address accessing the malicious domain name can be output in correspondence with the malicious domain name, or can be output separately. For example, when using ADS to establish a direct communication connection, the zombie machine will generate a large number of malicious domain names in a short period of time, but most of them do not have IP addresses. In the embodiment of the present application, when periodically identifying the IP address accessing the malicious domain name, the malicious domain name accessed by the computer device with the same IP address within an identification cycle can be obtained as a malicious domain name set, and output in association with the same IP address. In this way, the association between the IP address accessing the malicious domain name and the malicious domain name in the identification cycle can be reflected, which is more convenient for security monitoring personnel to view and locate the IP address accessing the malicious domain name. Among them, the identification cycles in S306 and S307 can be the same or different.

[0188] It is worth noting that in the aforementioned S301, the server can extract a triplet including a domain name from the DNS traffic log, the triplet including: the domain name, the request time of the DNS request, and the IP address of the requester (i.e., the IP address of the access domain name). In this way, in S307, the IP address of the requester who accessed the malicious domain name in the current identification period can be quickly determined based on the triplet including the malicious domain name.

[0189] S308. Output an abnormal organization domain name or host domain name, where the organization domain name or host domain name is a partial character string or the entire character string in the malicious domain name.

[0190] refer to Figure 2 In the application environment shown, the zombie machine 102 uses the DNS tunnel technology to convert the data actually required to be transmitted to obtain a payload, and encapsulates the payload in the domain name of the DNS tunnel. The domain name actually registered by the hacker is a domain name that does not carry a payload. The domain name is used to identify the organization or host. In the embodiment of the present application, the domain name that does not carry a payload is called a flag domain name, and the flag domain name is an organization domain name (or organization name, unit name, company name) or a host domain name, wherein the organization domain name is used to identify the organization from which the malicious domain name comes, and the host domain name is used to identify the host from which the malicious domain name comes. By identifying and outputting the flag domain name corresponding to the malicious domain name, the organization or host from which the malicious domain name comes can be located to achieve DNS tunnel profiling.

[0191] According to the domain name generation rules in the DNS tunneling technology, from left to right, the flag domain name usually only includes the last two domain name segments of the malicious domain name, and in a few cases includes the last three domain name segments of the malicious domain name. Based on this generation principle, in the embodiment of the present application, the flag domain name satisfies any of the following rules:

[0192] The first rule is that the marker domain name includes the last three domain name segments in the malicious domain name (i.e., the last three domain name segments in order from left to right), wherein the penultimate domain name segment in the malicious domain name belongs to the top-level domain name set, and the total number of characters in the penultimate domain name segment in the malicious domain name is less than the second quantity threshold, and the top-level domain name set records multiple top-level domain names. For example, the second quantity threshold is 4. Since the penultimate domain name segment belongs to the top-level domain name set and the total number of characters is less than the second quantity threshold, it is usually used as part of the identification of an organization or host, and is combined with the previous-level domain name segment and the next-level domain name segment to identify the organization or host. Therefore, in this scenario, the part of the malicious domain name including the last three domain name segments is determined as the marker domain name. For example, the marker domain name of the malicious domain name "yrbh1o.example.com.cn" is "example.com.cn".

[0193] The second rule is that the signature domain name includes the last two domain name segments in the malicious domain name, wherein the second to last domain name segment in the malicious domain name does not belong to the set of top-level domain names, or the total number of characters in the second to last domain name segment in the malicious domain name is not less than the second quantity threshold. For example, the signature domain name of the malicious domain name "yrbh1o.example.com" is "example.com".

[0194] When identifying a flag domain name, the server may first detect whether the penultimate domain name segment in the malicious domain name belongs to the top-level domain name set, and detect whether the total number of characters in the penultimate domain name segment in the malicious domain name is less than a second quantity threshold; when the penultimate domain name segment belongs to the top-level domain name set, and the total number of characters in the penultimate domain name segment is less than the second quantity threshold, the portion of the malicious domain name including the last three domain name segments is determined as a flag domain name; when the penultimate domain name segment does not belong to the top-level domain name set, or the total number of characters in the penultimate domain name segment is less than the second quantity threshold, the portion of the malicious domain name including the last two domain name segments is determined as a flag domain name.

[0195] For example, the part of the malicious domain name including the last three domain name segments refers to the last three domain name segments in the malicious domain name, as well as the interval between each two domain name segments or the interval before each domain name segment, such as "example.com.cn" or ".example.com.cn"; the part of the malicious domain name including the last two domain name segments refers to the last two domain name segments in the malicious domain name, as well as the interval between each two domain name segments or the interval before each domain name segment, such as "example.com" or ".example.com". In this way, the outputted flag domain name is the same as the second half of the malicious domain name, which is convenient for security monitoring personnel to watch and facilitate DNS tunnel profiling.

[0196] Optionally, the server may output the flag domain name after each flag domain name is identified, or may output all the flag domain names identified after the number of flag domain names identified reaches a specified threshold, or may periodically identify the flag domain name and output the flag domain name identification result once in each identification cycle, and the flag domain name identification result includes the flag domain name identified in the identification cycle. The flag domain name may be output through the user interface of the server or other devices connected to the server. The aforementioned identification cycle may be 5 days.

[0197] Among them, the aforementioned marker domain name can be output in correspondence with the malicious domain name, or can be output separately. For example, when the DNS tunnel technology is used to establish an indirect communication connection, the zombie machine will generate a large number of malicious domain names in a short period of time to achieve the transmission of the payload. In the embodiment of the present application, when periodically identifying the marker domain name, the malicious domain name with the same marker domain name in an identification cycle can be obtained as a malicious domain name set, and output in association with the marker domain name. In this way, the association between the marker domain name and the malicious domain name in the identification cycle can be reflected, which makes it easier for security monitoring personnel to view and locate the marker domain name. It is worth noting that the identification cycles in S306 and S308 can be the same or different.

[0198] To summarize, the embodiment of the present application obtains multiple domain name segments from the domain name, and determines whether the domain name is a malicious domain name by detecting whether the domain name segment is an abnormal domain name segment. Compared with the related art, the domain name as a whole is no longer used as an identification unit, and the domain name segment is used as an abnormal identification unit, which reduces the interference between the domain name segments and improves the accuracy of identifying malicious domain names.

[0199] Furthermore, the embodiments of the present application use one or more of the following technologies: using a classifier obtained by combining at least two classifiers to identify abnormal domain name segments, preprocessing domain names, and locating IP addresses such as S307, which can effectively reduce the probability of misidentification of malicious domain names and provide security monitoring personnel with comprehensive malicious domain name alerts.

[0200] It should be noted that the order of the domain name detection method provided in the embodiment of the present application can be appropriately adjusted, and the steps can be increased or decreased accordingly according to the situation. For example, S304 can be directly executed after executing S302, and the aforementioned S303, S307 and / or S308 can be deleted. Any technician familiar with the technical field can easily think of the changed method within the technical scope disclosed in this application, and it should be covered within the scope of protection of this application, so it will not be repeated.

[0201] It is worth noting that in the aforementioned S304, if a classifier is used to identify abnormal domain name segments, the classifier needs to be trained before S304. The training process includes:

[0202] B1. Obtain a training sample set.

[0203] Different classifiers need to be trained, and different training sample sets are used. Corresponding to the first rule of 304, the training sample set acquisition method of the embodiment of the present application includes the following two exemplary methods:

[0204] The first acquisition method corresponds to the first optional method in the first rule of 304 above, and the training sample set includes one or more domain name segments. For example, the training sample set includes a domain name segment positive sample set and a domain name segment negative sample set. Among them, the domain name segment positive sample set is a domain name segment sample set obtained based on the domain name positive sample set. The domain name positive sample set includes one or more domain names. For example, the domain name positive sample set may include the top u domain names (u is a positive integer, for example, u is 1 million) extracted from a specified domain name ranking website (such as a website that publishes the world ranking of websites). Among them, the process of obtaining the domain name segment positive sample set based on the domain name positive sample set includes: for each domain name in the domain name positive sample set, multiple domain name segments are determined from the domain name to obtain a domain name segment positive sample set, and this process can refer to S302; optionally, multiple updated domain name segments can also be obtained to obtain an updated domain name segment positive sample set, and this process can refer to S303. Optionally, the domain name can also be preprocessed, and the preprocessing process refers to the preprocessing process in S302 above.

[0205] Among them, the domain name segment negative sample set is a domain name segment sample set obtained based on the domain name negative sample set. The domain name negative sample set includes one or more domain names. Among them, the process of obtaining the domain name segment sample set based on the domain name negative sample set includes: for each domain name in the domain name negative sample set, multiple domain name segments are determined from the domain name to obtain a domain name segment negative sample set, and this process can refer to S302; optionally, multiple updated domain name segments can also be obtained to obtain an updated domain name segment negative sample set, and this process can refer to S303. Optionally, the domain name can also be preprocessed, and the preprocessing process refers to the preprocessing process in the aforementioned S302.

[0206] For example, the domain name negative sample set may include domain names in the current common DGA family and / or domain names generated by using common DGA. For example, the current common DGA family includes the following DGA families: Bamital, Banjori, Bebloh / urlzone, Bedep, Beebone, Chinad, Corebot, Cryptolocker, Dircrypt, Dnschanger, Dromedan, Dyre, Fobber, G01, Geodo, Gozi, Hesperbot, Kraken, Locky, Madmax, Matsnu, Mirai, Murofet, Mydoom, Necurs, Newgoz, Nymaim, P2p goz, Padcrypt, Pandabanker, Pitou, Pizd, Proslikefan, Pt goz / new goz, Pushdo, Pykspa, Pykspaimproved, Pykspaprecursor, Qadars, Qakbot, Ramdo, Ramnit, Ranbyus, Shifu, Shiotob, Simda, Sisron, Sphinx, Suppobox, Symmi, Tempedreve, Tinba / tinybanker, Tinynuke, Tofsee, Vawtrak, Vidro, Virut, Volatile cedar / explosive. For example, there are 1 million domain names generated by common DGA.

[0207] The second acquisition method corresponds to the second optional method in the first rule of 304 above. The training sample set includes one or more feature vectors, each feature vector in the training sample set corresponds to a domain name segment, and each feature vector is obtained by extracting features from the corresponding domain name segment. For example, the training sample set includes a set of feature vectors obtained by extracting features from domain name segments in a positive sample set of domain name segments and domain name segments in a negative sample set of domain name segments. Among them, the acquisition method of the domain name segment positive sample set and the domain name segment negative sample set refers to the first acquisition method mentioned above. Each feature vector can be an n-dimensional feature vector including n features, and the extraction method of the n features is the same as the extraction method of the n features in the second optional method in the first rule of 304 above. Therefore, the extraction method of the n features in the training stage can refer to the corresponding description in the second optional method in the first rule of 304 above, and the embodiment of the present application will not be repeated in detail.

[0208] B2. Use the training sample set to train the initial classifier to obtain the classifier.

[0209] The training samples in the training sample set are input into the initial classifier to train the initial classifier to obtain the classifier. For example, when the training sample set is obtained by the first acquisition method in B1, the domain name segments in the training sample set are input into the initial classifier in batches with characters as the granularity until the loss value of the loss function converges within a preset range, and a trained classifier is obtained; when the training sample set is obtained by the second acquisition method in B1, the feature vectors in the training sample set are input into the initial classifier in batches until the loss value of the loss function converges within a preset range, and a trained classifier is obtained.

[0210] In the related technology, when training a machine learning model or a deep learning model, the training sample set used is a relatively clean training sample set, such as domain name data sets of families such as Alexa, Chinad, and Banjori. However, there are certain differences between the training sample set and the real data of the existing network. The machine learning model or deep learning model trained in this way has a high false alarm rate.

[0211] In the embodiment of the present application, the training sample set used includes a domain name segment positive sample set and a domain name segment negative sample set, or the training sample set used is a set of feature vectors obtained by extracting features from the domain name segment positive sample set and the domain name segment negative sample set. The training sample set is closer to the real data of the existing network, and the false alarm rate of the trained classifier is lower.

[0212] Figure 4 is a schematic training process flow chart provided in the embodiment of the present application. Figure 4 As shown, it is assumed that the classifiers to be trained include LSTM models, logistic regression models, and random forest models. The top u domain names extracted from the specified domain name ranking website are used to obtain a domain name positive sample set; multiple common DGA families are obtained to obtain a domain name negative sample set. Based on the domain name positive sample set and the domain name negative sample set, a domain name segment sample set is obtained. This process can refer to S302; optionally, multiple updated domain name segments can also be obtained to obtain an updated domain name segment sample set. This process can refer to S303. Figure 4 Assume that based on the domain name segment: "www" and the top-level domain name set, multiple updated domain name segments are obtained to obtain an updated domain name segment sample set. The specific process can refer to the first to third cases in S303. The domain name segment sample set is used as a training sample set to train the initial LSTM model to obtain an LSTM model; the domain name segments in the domain name segment sample set are subjected to feature extraction to obtain a set of feature vectors, and the set of feature vectors is used as a training sample set to train the initial logistic regression model and the initial random forest model, respectively, to obtain a logistic regression model and a random forest model.

[0213] Optionally, the domain name recognition results outputted from the aforementioned S306 to S308 may be sent to a management device for manual confirmation by a management personnel. Manual confirmation may improve the accuracy of the domain name recognition results and reduce the probability of misidentification.

[0214] Furthermore, after receiving the confirmation result, the server can update the domain name positive sample set and / or the domain name negative sample set based on the confirmation result, and further update the domain name segment positive sample set and / or the domain name segment negative sample set. Correspondingly, the training sample set is also updated, and the server can use the updated training sample set to perform incremental training of the classifier, thereby obtaining a new classifier, which is updated as the training sample set is updated, and is more adaptable to the domain name changes of the existing network, ensuring stable identification of malicious domain names.

[0215] Figure 5 It is a structural diagram of a server provided by an illustrative embodiment of the present application, wherein the server includes a data source 501, a preprocessing module 502, an algorithm analysis module 503, an IP address positioning module 504, a DNS tunnel profiling module 505, and a malicious domain name warning module 506.

[0216] The data source 501 is used to store data for training or preprocessing. For example, the data source 501 can store malicious domain names of multiple DGA families, the top d domain names of websites that publish world rankings of websites, collected malicious domain names generated based on DNS tunneling technology, and a specified word library such as COCA.

[0217] The preprocessing module 502 is used to preprocess the domain name. The preprocessing process includes one or more of the aforementioned character validity verification process, usage detection process or dictionary tree query process.

[0218] The algorithm analysis module 503 is used to execute the aforementioned S304. For example, the algorithm analysis module 503 is installed with an AC automaton, an LSTM model, a logistic regression model, and a random forest model. The training and working process of each model refer to the aforementioned embodiment.

[0219] The IP address locating module 504 is used to locate the IP address, such as executing the aforementioned S307; the DNS tunnel profiling module 505 is used to execute the aforementioned S308; and the malicious domain name warning module 506 is used to execute the aforementioned S306.

[0220] Figure 6 is a block diagram of a domain name detection device 60 provided in an embodiment of the present application. The domain name detection device 60 can be applied to a server. The device 60 includes:

[0221] The first determination module 601 is used to determine multiple domain name segments from the domain name; the second determination module 602 is used to determine the domain name as a malicious domain name after determining that there is an abnormal domain name segment in the multiple domain name segments.

[0222] To sum up, in the embodiment of the present application, the first determination module obtains multiple domain name segments from the domain name, and the second determination module determines whether the domain name is a malicious domain name by detecting whether the domain name segment is an abnormal domain name segment. Compared with the related art, the entire domain name is no longer used as the identification unit, and the domain name segment is used as the abnormal identification unit, which reduces the interference between the domain name segments and improves the accuracy of identifying malicious domain names.

[0223] Figure 7 is a block diagram of a domain name detection device 60 provided in an embodiment of the present application, and the domain name detection device 60 also includes:

[0224] A third determination module 603, configured to determine that the domain name segment is an abnormal domain name segment when the domain name segment meets a preset rule;

[0225] Among them, the preset rule is any one or more of the following: an abnormal domain name segment is identified through a classifier based on the domain name segment or the feature vector of the domain name segment; or, the ratio of the number of vowels included in the domain name segment to the total number of characters in the domain name segment package is less than a ratio threshold; or, the domain name segment includes an abnormal entry.

[0226] In an optional example, the feature vector is an n-dimensional feature vector including n features, where n is a positive integer, and the n features include any one or more of the following: the proportion of hyphens included in the domain name segment to the characters included in the domain name segment; the proportion of numbers included in the domain name segment to the characters included in the domain name segment; the length of the domain name segment; the ratio of the number of character types included in the domain name segment to the total number of characters in the domain name segment; the ratio of the number of number types included in the domain name segment to the total number of characters in the domain name segment; the Shannon entropy of the domain name segment; the ratio of the number of occurrences of consecutive repeated letters included in the domain name segment to the total number of characters in the domain name segment; the proportion of vowels included in the domain name segment in the domain name segment; the proportion of numbers included in the domain name segment to the characters included in the domain name segment; the ratio of the number of occurrences x1 of consecutive letters included in the domain name segment to the first number of characters y1, the first number of characters y1 being the difference between the total number of characters y in the domain name segment and the number of occurrences x1 of consecutive letters; the ratio of the number of occurrences x2 of consecutive consonants included in the domain name segment to the second number of characters y2, the second number of characters y2 being the difference between the total number of characters y in the domain name segment and The difference between the number of occurrences of consecutive consonants x2; the ratio of the number of occurrences of consecutive numbers included in the domain name segment x3 to the third number of characters y3, the third number of characters y3 being the difference between the total number of characters y in the domain name segment and the number of occurrences of consecutive numbers x3; the ratio of the number of times numbers and letters are switched in the domain name segment to the total number of characters in the domain name segment; the readability score, the readability score is used to indicate the readability of the domain name segment; the reliability score, the reliability score is used to indicate the reliability of the domain name segment; the ratio of the number of words included in the domain name segment to the total number of characters in the domain name segment; the number of words included in the domain name segment; the binary data sorting feature, the binary data sorting feature is a feature determined based on the serial number of multiple binary data included in the domain name segment sorted according to the frequency of occurrence, each of the multiple binary data consists of two consecutive characters in the domain name segment; the ternary data sorting feature, the ternary data sorting feature is a feature determined based on the serial number of multiple ternary data included in the domain name segment sorted according to the frequency of occurrence, each of the multiple ternary data consists of three consecutive characters in the domain name segment.

[0227] In an optional example, the n features satisfy one or more of the following: when the n features fully include the readability score, the readability score is the score corresponding to the domain name segment output by the Markov model trained using the specified word library; when the n features fully include the reliability score, the reliability score is the score corresponding to the domain name segment output by the Markov model trained using the domain name segment positive sample set; when the n features fully include the binary data sorting feature, the binary data sorting feature is the median, mean or variance of the serial number after sorting the multiple binary data included in the domain name segment according to the frequency of occurrence; when the n features fully include the binary data sorting feature, the ternary data sorting feature is the median, mean or variance of the serial number after sorting the multiple ternary data included in the domain name segment according to the frequency of occurrence.

[0228] In an optional example, the classifier includes one or more of the following: a logistic regression model; or a random forest model; or a long short-term memory (LSTM) model.

[0229] In an optional example, the number of characters included in the union of the entries in the abnormal domain name segment is greater than the character quantity threshold; and / or the abnormal entry is an entry that appears more than the number threshold within a specified time period, and / or the probability of appearing in the same position in different domain name segments is greater than the probability threshold.

[0230] Figure 8 It is a block diagram of a domain name detection device 60 provided in an embodiment of the present application. The domain name detection device 60 also includes: an analysis module 604, which is used to analyze the entries included in the domain name segment from each domain name segment based on the vocabulary of the AC automaton, and the vocabulary of the AC automaton includes one or more of words, pinyin, organization names or roots.

[0231] Fig. 9 It is a block diagram of a domain name detection device 60 provided in an embodiment of the present application. The domain name detection device 60 also includes: a deletion module 605, which is used to delete the domain name segment at the specified position in the multiple domain name segments after determining that the domain name segment at the specified position in the domain name belongs to the domain name segment set corresponding to the specified position, to obtain multiple updated domain name segments, and the domain name segment set includes one or more domain name segments.

[0232] Optionally, the deletion module 605 is used to delete the first domain name segment among the multiple domain name segments to obtain multiple updated domain name segments after determining that the first domain name segment in the domain name belongs to a domain name segment set including "www"; and / or, after determining that the second-to-last domain name segment in the domain name belongs to a top-level domain name set and the total number of characters in the second-to-last domain name segment is less than a first quantity threshold, delete the second-to-last domain name segment among the multiple domain name segments to obtain multiple updated domain name segments, and the top-level domain name set includes one or more top-level domain names; and / or, after determining that the last domain name segment in the domain name belongs to a top-level domain name set, delete the last domain name segment among the multiple domain name segments to obtain multiple updated domain name segments.

[0233] Fig.10 It is a block diagram of a domain name detection device 60 provided in an embodiment of the present application. The domain name detection device 60 also includes: a first output module 606, which is used to output the Internet Protocol IP address used for the access when the malicious domain name is accessed once or multiple times and there is no address record for the access.

[0234] Fig.11It is a block diagram of a domain name detection device 60 provided in an embodiment of the present application. The domain name detection device 60 also includes: a second output module 607, which is used to output an abnormal organization domain name or host domain name, and the organization domain name or the host domain name is a partial character string or the entire character string in the malicious domain name.

[0235] In an optional example, the first determination module 601 is used to: pre-process the domain name; and determine the multiple domain name segments from the pre-processed domain name.

[0236] Optionally, the first determination module 601 is used to: detect the legitimacy of the characters in the domain name, and use the domain name with legal characters as the pre-processed domain name; and / or, detect whether the domain name is a domain name for a designated purpose, and use the domain name that is not for the designated purpose as the pre-processed domain name; and / or, use the domain name to query a dictionary tree, which is established based on a domain name blacklist and / or a domain name whitelist, and use the domain name that does not include the domain name in the dictionary tree as the pre-processed domain name.

[0237] Optionally, the domain name is a domain name recorded in a DNS traffic log.

[0238] In an optional example, the first determination module 601 is used to: divide the domain name into the multiple domain name segments according to separation points.

[0239] Optionally, the device is applied to any one of the following: a network firewall; or a host firewall; or a website application protection system WAF of an application server; or a situation awareness platform; or a cloud WAF.

[0240] It is worth noting that when the domain name identification device is integrated into Figure 5 In the server shown, one or more of the aforementioned first determination module 601, second determination module 602, third determination module 603, analysis module 604 and deletion module 605 can be integrated in the aforementioned algorithm analysis module 503; the first output module 606 can be integrated in the IP address positioning module 504; the second output module 607 can be integrated in the DNS tunnel portrait module 505.

[0241] Optionally, Fig.12 This is a possible basic hardware architecture of a computer device provided in an embodiment of the present application. The computer device may be a server.

[0242] See also Fig.12 , the computer device 700 includes a processor 701 , a memory 702 , a communication interface 703 and a bus 704 .

[0243] In the computer device 700, the number of processors 701 may be one or more. Fig.12Only one of the processors 701 is shown. Optionally, the processor 701 may be a central processing unit (CPU). If the computer device 700 has multiple processors 701, the types of the multiple processors 701 may be different or the same. Optionally, the multiple processors 701 of the computer device 700 may also be integrated into a multi-core processor.

[0244] The memory 702 stores computer instructions and data; the memory 702 may store computer instructions and data required to implement the domain name detection method provided in the present application, for example, the memory 702 stores instructions for implementing the steps of the domain name detection method. The memory 702 may be any one or any combination of the following storage media: non-volatile memory (e.g., read-only memory (ROM), solid state drive (SSD), hard disk (HDD), optical disk), volatile memory.

[0245] The communication interface 703 may be any one or any combination of the following devices: a network interface (eg, an Ethernet interface), a wireless network card, or other device with a network access function.

[0246] The communication interface 703 is used for the computer device 700 to perform data communication with other computer devices or terminals.

[0247] The bus 704 can connect the processor 701 to the memory 702 and the communication interface 703. In this way, the processor 701 can access the memory 702 through the bus 704, and can also use the communication interface 703 to exchange data with other computer devices or terminals.

[0248] In the present application, the computer device 700 executes the computer instructions in the memory 702, so that the computer device 700 implements the domain name detection method provided in the present application, or enables the computer device 700 to deploy a domain name detection device.

[0249] In an exemplary embodiment, a non-transitory computer-readable storage medium including instructions is also provided, such as a memory including instructions, and the above instructions can be executed by a processor of a server to complete the domain name detection method shown in various embodiments of the present application. For example, the non-transitory computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a tape, a floppy disk, and an optical data storage device.

[0250] The embodiment of the present application provides a communication system, including: a server and at least two computer devices, the server includes the domain name detection device provided in the embodiment of the present application, such as the aforementioned domain name detection device 60, or the server is Figure 5The at least two computer devices can establish a direct or indirect communication connection. For example, the at least two computer devices include a master and a zombie. The structure of the communication system can refer to the aforementioned Figure 1 and Figure 2 The structure of the communication system shown.

[0251] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product, and the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server, data center, etc. that contains one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium, or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0252] In this application, the terms "first", "second" and "third" are used for descriptive purposes only and should not be understood as indicating or implying relative importance. The term "at least one" means one or more, and the term "plurality" means two or more, unless otherwise expressly limited; " / " means or. A refers to B, which means that A is the same as B or A is a simple variation of B.

[0253] It should be noted that: when the domain name detection device provided in the above embodiment executes the domain name detection method, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the domain name detection device, communication system and domain name detection method embodiments provided in the above embodiment belong to the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0254] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0255] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A domain name detection method, characterized in that: The method comprises: Determine multiple domain name segments from the domain name; Analyze the terms included in each domain name segment from the multiple domain name segments; Constructing a binary group corresponding to each term, wherein the binary group includes a character string included in the corresponding term and an order in which the corresponding term appears in the terms included in the domain name segment; Based on the co-occurrence matrix, determining the number of times a bigram corresponding to any term and a target bigram co-occur, wherein the co-occurrence matrix is ​​constructed based on a bigram sequence, the bigram sequence is obtained by obtaining a bigram corresponding to each term in the first domain name set, the co-occurrence matrix includes p rows and p columns of elements, the element in the i-th row and the j-th column represents the distance between the i-th bigram and the j-th bigram in the bigram sequence, 1≤i≤p, 1≤j≤p, p is the number of bigrams included in the bigram sequence, the target bigram is a bigram corresponding to a term other than the any term included in the first domain name set, and the distance between the target bigram and the bigram corresponding to the any term is less than a distance threshold or the similarity is greater than a similarity threshold; when the number of times the bigram corresponding to the any term and the target bigram co-occur is greater than the co-occurrence threshold, determining the any term to be an abnormal term; When the domain name segment includes the abnormal entry, determining that the domain name segment is an abnormal domain name segment; After determining that the abnormal domain name segment exists in the multiple domain name segments, the domain name is determined to be a malicious domain name.

2. The method according to claim 1, characterized in that The method further comprises: When an abnormal domain name segment is identified by a classifier based on the domain name segment or a feature vector of the domain name segment, determining that the domain name segment is an abnormal domain name segment; And / or, when the ratio of the number of vowels included in the domain name segment to the total number of characters in the domain name segment package is less than a ratio threshold, the domain name segment is determined to be an abnormal domain name segment.

3. The method according to claim 2, characterized in that The feature vector is an n-dimensional feature vector including n features, where n is a positive integer, and the n features include any one or more of the following: The ratio of hyphens in the domain name segment to the number of characters in the domain name segment; The ratio of the number of digits in the domain name segment to the number of characters in the domain name segment; The length of the domain name segment; The ratio of the number of character types included in the domain name segment to the total number of characters in the domain name segment; The ratio of the number of types of numbers included in the domain name segment to the total number of characters in the domain name segment; Shannon entropy of domain name segment; The ratio of the number of occurrences of consecutive repeated letters included in the domain name segment to the total number of characters in the domain name segment; The proportion of vowels included in the domain name segment; The ratio of the number of digits in the domain name segment to the number of characters in the domain name segment; The ratio of the number of occurrences x1 of consecutive letters included in the domain name segment to the first number of characters y1, where the first number of characters y1 is the difference between the total number of characters y in the domain name segment and the number of occurrences x1 of consecutive letters; The ratio of the number of occurrences x2 of consecutive consonants included in the domain name segment to the second number of characters y2, where the second number of characters y2 is the difference between the total number of characters y in the domain name segment and the number of occurrences x2 of consecutive consonants; The ratio of the number of occurrences x3 of consecutive numbers included in the domain name segment to the third number of characters y3, wherein the third number of characters y3 is the difference between the total number of characters y in the domain name segment and the number of occurrences x3 of consecutive numbers; The ratio of the number of times numbers and letters are switched in the domain name segment to the total number of characters in the domain name segment; a readability score, the readability score being used to indicate readability of the domain name segment; a reliability score, the reliability score being used to indicate the reliability of the domain name segment; The ratio of the number of words included in the domain name segment to the total number of characters in the domain name segment; The number of words included in the domain name segment; A binary data sorting feature, wherein the binary data sorting feature is a feature determined by a sequence number after sorting a plurality of binary data included in the domain name segment according to the frequency of occurrence, wherein each of the plurality of binary data consists of two consecutive characters in the domain name segment; The triple data sorting feature is a feature determined by a sequence number after sorting multiple triple data included in the domain name segment according to the frequency of occurrence, and each of the multiple triple data consists of three consecutive characters in the domain name segment.

4. The method according to claim 3, characterized in that The n characteristics satisfy one or more of the following: When the n features fully include a readability score, the readability score is a score corresponding to the domain name segment output by a Markov model trained using a specified word library; When the n features fully include the reliability score, the reliability score is the score corresponding to the domain name segment output by the Markov model obtained by training the domain name segment positive sample set; When the n features fully include binary data sorting features, the binary data sorting features are the median, average or variance of the sequence numbers of the multiple binary data included in the domain name segment sorted according to the frequency of occurrence; When the n features fully include binary data sorting features, the ternary data sorting features are the median, average or variance of the sequence numbers of the multiple ternary data included in the domain name segment sorted according to the frequency of occurrence.

5. The method according to any one of claims 2 to 4, characterized in that: The classifier includes one or more of the following: a logistic regression model; Alternatively, a random forest model; Or, the Long Short-Term Memory (LSTM) model.

6. The method according to any one of claims 1 to 4, characterized in that: The number of characters included in the union of the terms in the abnormal domain name segment is greater than the character quantity threshold; And / or, the abnormal entry is an entry whose number of appearances within a specified time period is greater than a number threshold, and / or whose probability of appearing at the same position in different domain name segments is greater than a probability threshold.

7. The method according to any one of claims 1 to 4, characterized in that: The step of analyzing the terms included in each domain name segment from each of the multiple domain name segments includes: The AC automaton-based vocabulary library analyzes the entries included in the domain name segment from each domain name segment, and the AC automaton vocabulary library includes one or more of words, pinyin, organization names or roots.

8. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: After determining that the domain name segment at the specified position in the domain name belongs to the domain name segment set corresponding to the specified position, the domain name segment at the specified position in the multiple domain name segments is deleted to obtain multiple updated domain name segments, and the domain name segment set includes one or more domain name segments.

9. The method according to claim 8, characterized in that After determining that the domain name segment at the designated position in the domain name belongs to the domain name segment set corresponding to the designated position, deleting the domain name segment at the designated position in the multiple domain name segments to obtain the updated multiple domain name segments, includes: After determining that the first domain name segment in the domain name belongs to the domain name segment set including "www", deleting the first domain name segment in the multiple domain name segments to obtain multiple updated domain name segments; and / or, after determining that the penultimate domain name segment in the domain name belongs to a top-level domain name set and the total number of characters in the penultimate domain name segment is less than a first quantity threshold, deleting the penultimate domain name segment in the multiple domain name segments to obtain multiple updated domain name segments, wherein the top-level domain name set includes one or more top-level domain names; And / or, after determining that the last domain name segment in the domain name belongs to the top-level domain name set, the last domain name segment in the multiple domain name segments is deleted to obtain multiple updated domain name segments.

10. The method according to any one of claims 1 to 4 and 9, characterized in that: The method comprises: When the malicious domain name is accessed one or more times, the Internet Protocol (IP) address used for the access is output.

11. The method according to any one of claims 1 to 4 and 9, characterized in that: The method comprises: Output an abnormal organization domain name or host domain name, where the organization domain name or the host domain name is a partial character string or the entire character string in the malicious domain name.

12. The method according to any one of claims 1 to 4 and 9, characterized in that: Determining multiple domain name segments from the domain name includes: Preprocessing the domain name; The multiple domain name segments are determined from the preprocessed domain name.

13. The method according to claim 12, characterized in that The preprocessing of the domain name includes: Detecting the legitimacy of characters in the domain name, and using the domain name with legal characters as the pre-processed domain name; and / or, detecting whether the domain name is a domain name for a designated purpose, and treating the domain name that is not for the designated purpose as the pre-processed domain name; And / or, the domain name query dictionary tree is used, the dictionary tree is established based on a domain name blacklist and / or a domain name whitelist, and the domain name that does not include the domain name in the dictionary tree is used as the pre-processed domain name.

14. The method according to any one of claims 1-4, 9 and 13, characterized in that: The domain name is the domain name recorded in the domain name system DNS traffic log.

15. The method according to any one of claims 1-4, 9 and 13, characterized in that: Determining a plurality of domain name segments from the domain name includes: dividing the domain name into the plurality of domain name segments according to separation points.

16. The method according to any one of claims 1-4, 9 and 13, characterized in that: The method is applied to any of the following: A network firewall; or, A host firewall; or, The website application protection system WAF of the application server; or Situational awareness platform; or, Cloud WAF.

17. A domain name detection device, characterized in that: The device comprises: A first determination module, used to determine multiple domain name segments from the domain name; An analysis module, used for analyzing the terms included in each domain name segment from the multiple domain name segments; The third determination module is used to construct a bigram corresponding to each term, wherein the bigram includes a character string included in the corresponding term and the order in which the corresponding term appears in the terms included in the domain name segment; based on a co-occurrence matrix, determine the number of times the bigram corresponding to any term and the target bigram co-occur, wherein the co-occurrence matrix is ​​constructed based on a bigram sequence, wherein the bigram sequence is obtained by obtaining the bigram corresponding to each term in the first domain name set, and the co-occurrence matrix includes p rows and p columns of elements, and the element in the i-th row and j-th column represents the number of times the bigram corresponding to any term and the target bigram co-occur in the bigram sequence. , 1≤i≤p, 1≤j≤p, p is the number of bigrams included in the bigram sequence, the target bigram is a bigram corresponding to an entry other than any one of the entries included in the first domain name set, and the distance between the target bigram and the bigram corresponding to any one of the entries is less than a distance threshold or the similarity is greater than a similarity threshold; when the number of co-occurrences of the bigram corresponding to any one of the entries and the target bigram is greater than a co-occurrence threshold, the any one of the entries is determined to be an abnormal entry; when the domain name segment includes the abnormal entry, the domain name segment is determined to be an abnormal domain name segment; The second determination module is used to determine the domain name as a malicious domain name after determining that there is an abnormal domain name segment in the multiple domain name segments.

18. The device according to claim 17, characterized in that The third determination module is further used for: When an abnormal domain name segment is identified by a classifier based on the domain name segment or a feature vector of the domain name segment, determining that the domain name segment is an abnormal domain name segment; And / or, when the ratio of the number of vowels included in the domain name segment to the total number of characters in the domain name segment package is less than a ratio threshold, the domain name segment is determined to be an abnormal domain name segment.

19. The device according to claim 18, characterized in that The feature vector is an n-dimensional feature vector including n features, where n is a positive integer, and the n features include any one or more of the following: The ratio of hyphens in the domain name segment to the number of characters in the domain name segment; The ratio of the number of digits in the domain name segment to the number of characters in the domain name segment; The length of the domain name segment; The ratio of the number of character types included in the domain name segment to the total number of characters in the domain name segment; The ratio of the number of types of numbers included in the domain name segment to the total number of characters in the domain name segment; Shannon entropy of domain name segment; The ratio of the number of occurrences of consecutive repeated letters included in the domain name segment to the total number of characters in the domain name segment; The proportion of vowels included in the domain name segment; The ratio of the number of digits in the domain name segment to the number of characters in the domain name segment; The ratio of the number of occurrences x1 of consecutive letters included in the domain name segment to the first number of characters y1, where the first number of characters y1 is the difference between the total number of characters y in the domain name segment and the number of occurrences x1 of consecutive letters; The ratio of the number of occurrences x2 of consecutive consonants included in the domain name segment to the second number of characters y2, where the second number of characters y2 is the difference between the total number of characters y in the domain name segment and the number of occurrences x2 of consecutive consonants; The ratio of the number of occurrences x3 of consecutive numbers included in the domain name segment to the third number of characters y3, wherein the third number of characters y3 is the difference between the total number of characters y in the domain name segment and the number of occurrences x3 of consecutive numbers; The ratio of the number of times numbers and letters are switched in the domain name segment to the total number of characters in the domain name segment; a readability score, the readability score being used to indicate readability of the domain name segment; a reliability score, the reliability score being used to indicate the reliability of the domain name segment; The ratio of the number of words included in the domain name segment to the total number of characters in the domain name segment; The number of words included in the domain name segment; A binary data sorting feature, wherein the binary data sorting feature is a feature determined by a sequence number after sorting a plurality of binary data included in the domain name segment according to the frequency of occurrence, wherein each of the plurality of binary data consists of two consecutive characters in the domain name segment; The triple data sorting feature is a feature determined by a sequence number after sorting multiple triple data included in the domain name segment according to the frequency of occurrence, and each of the multiple triple data consists of three consecutive characters in the domain name segment.

20. The device according to claim 19, characterized in that The n characteristics satisfy one or more of the following: When the n features fully include a readability score, the readability score is a score corresponding to the domain name segment output by a Markov model trained using a specified word library; When the n features fully include the reliability score, the reliability score is the score corresponding to the domain name segment output by the Markov model obtained by training the domain name segment positive sample set; When the n features fully include binary data sorting features, the binary data sorting features are the median, average or variance of the sequence numbers of the multiple binary data included in the domain name segment sorted according to the frequency of occurrence; When the n features fully include binary data sorting features, the ternary data sorting features are the median, average or variance of the sequence numbers of the multiple ternary data included in the domain name segment sorted according to the frequency of occurrence.

21. The device according to any one of claims 18 to 20, characterized in that: The classifier includes one or more of the following: a logistic regression model; Alternatively, a random forest model; Or, the Long Short-Term Memory (LSTM) model.

22. The device according to any one of claims 17 to 20, characterized in that: The number of characters included in the union of the terms in the abnormal domain name segment is greater than the character quantity threshold; And / or, the abnormal entry is an entry whose number of appearances within a specified time period is greater than a number threshold, and / or whose probability of appearing at the same position in different domain name segments is greater than a probability threshold.

23. The device according to any one of claims 17 to 20, characterized in that: The analysis module is used to analyze the entries included in the domain name segment from each domain name segment based on the AC automaton's vocabulary, and the AC automaton's vocabulary includes one or more of words, pinyin, organization names or roots.

24. The device according to any one of claims 17 to 20, characterized in that: The device also includes: A deletion module is used to delete the domain name segment at the specified position in the domain name after determining that the domain name segment at the specified position belongs to the domain name segment set corresponding to the specified position, so as to obtain multiple updated domain name segments, and the domain name segment set includes one or more domain name segments.

25. The device according to claim 24, characterized in that The deletion module is used to: After determining that the first domain name segment in the domain name belongs to the domain name segment set including "www", deleting the first domain name segment in the multiple domain name segments to obtain multiple updated domain name segments; and / or, after determining that the penultimate domain name segment in the domain name belongs to a top-level domain name set and the total number of characters in the penultimate domain name segment is less than a first quantity threshold, deleting the penultimate domain name segment in the multiple domain name segments to obtain multiple updated domain name segments, wherein the top-level domain name set includes one or more top-level domain names; And / or, after determining that the last domain name segment in the domain name belongs to the top-level domain name set, the last domain name segment in the multiple domain name segments is deleted to obtain multiple updated domain name segments.

26. The device according to any one of claims 17-20 and 25, characterized in that: The device comprises: The first output module is used to output the Internet Protocol IP address used for the access when the malicious domain name is accessed once or multiple times.

27. The device according to any one of claims 17 to 20 and 25, characterized in that: The device comprises: The second output module is used to output an abnormal organization domain name or host domain name, where the organization domain name or the host domain name is a partial character string or the entire character string in the malicious domain name.

28. The device according to any one of claims 17 to 20 and 25, characterized in that: The first determining module is used to: Preprocessing the domain name; The multiple domain name segments are determined from the preprocessed domain name.

29. The device according to claim 28, characterized in that The first determining module is used to: Detecting the legitimacy of characters in the domain name, and using the domain name with legal characters as the pre-processed domain name; and / or, detecting whether the domain name is a domain name for a designated purpose, and treating the domain name that is not for the designated purpose as the pre-processed domain name; And / or, the domain name query dictionary tree is used, the dictionary tree is established based on a domain name blacklist and / or a domain name whitelist, and the domain name that does not include the domain name in the dictionary tree is used as the pre-processed domain name.

30. The device according to any one of claims 17-20, 25 and 29, characterized in that: The domain name is the domain name recorded in the domain name system DNS traffic log.

31. The device according to any one of claims 17-20, 25 and 29, characterized in that: The first determination module is used to divide the domain name into the multiple domain name segments according to separation points.

32. The device according to any one of claims 17-20, 25 and 29, characterized in that: The device is applied to any of the following: A network firewall; or, A host firewall; or, The website application protection system WAF of the application server; or Situational awareness platform; or, Cloud WAF.

33. A computer device, characterized in that: include: Processor and memory; The memory is used to store computer instructions; The processor is used to execute the computer instructions stored in the memory, so that the computer device executes the domain name detection method according to any one of claims 1 to 16.

34. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes computer instructions, and the computer instructions instruct a computer device to execute the domain name detection method according to any one of claims 1 to 16.

35. A communication system, characterized in that: include: A server and at least two computer devices, wherein the server comprises the domain name detection device as described in any one of claims 17 to 32.

Images