Knowledge graph-based entity classification method and system, terminal and storage medium

Abstract

The application provides an entity classification method and system based on a knowledge graph, a terminal and a storage medium. The method comprises the following steps: establishing a DNS knowledge graph based on the hierarchical relationship and query analysis relationship of DNS, wherein the DNS knowledge graph comprises a preset label corresponding to at least one domain name; splitting the DNS knowledge graph into entities and relationships, and fusing the entities and relationships according to an entity attribute alignment mode to obtain a fused DNS knowledge graph; vectorizing the entities and relationships of the fused DNS knowledge graph to obtain a DNS knowledge graph vector, wherein the DNS knowledge graph vector comprises a knowledge graph vector corresponding to each domain name; training a neural network model by taking the knowledge graph vector corresponding to the domain name as an input quantity and taking the preset label corresponding to the domain name as an output quantity to obtain an entity classification model; and classifying and detecting the domain name according to the entity classification model. The application can improve the accuracy and speed of domain name classification and detection.

Description

Technical Field

[0001] This application relates to the field of computer network security technology, and in particular to a knowledge graph-based entity classification method, system, terminal, and storage medium. Background Technology

[0002] With the rapid development of network technology and the internet, both the number of internet users and the data traffic on the network are growing exponentially, and the internet user base is becoming increasingly broad. Various network facilities are facing significant challenges in terms of reliability and security. Currently, internet security is in a rather severe situation, and this state is likely to persist for a long time.

[0003] The Domain Name System (DNS), as the infrastructure of internet communication, resolves domain names to obtain the IP address of the resource to be accessed. Its main applications include accessing web pages and sending and receiving emails. The "my country Internet Cybersecurity Situation in the First Half of 2019" report released by the China National Computer Network Emergency Response Technical Team / Coordination Center (CNCERT) indicates that in the first half of 2019, CNCERT independently detected approximately 46,000 phishing pages targeting websites within my country. Most malicious activities are closely related to the DNS, and the demand for malicious domain name detection is increasing daily.

[0004] Currently, distinguishing whether a domain name is malicious generally involves analyzing its log structure. However, traditional techniques typically perform this one-to-one detection, which is time-consuming and fails to address domains with similar attributes, leading to inaccurate detection. Therefore, developing a method to differentiate malicious domain names is urgently needed. Summary of the Invention

[0005] This application provides a knowledge graph-based entity classification method, system, terminal, and storage medium to solve the problem of inaccurate domain name classification detection in the prior art.

[0006] In a first aspect, this application provides a knowledge graph-based entity classification method, comprising: establishing a DNS knowledge graph based on the hierarchical relationship and query resolution relationship of DNS, wherein the DNS knowledge graph includes at least one preset label corresponding to a domain name, and the preset label includes malicious and non-malicious;

[0007] The DNS knowledge graph is split into entities and relations, and the entities and relations are merged according to the entity attribute alignment method to obtain the merged DNS knowledge graph;

[0008] The entities and relationships of the fused DNS knowledge graph are vectorized to obtain DNS knowledge graph vectors, wherein the DNS knowledge graph vectors include the knowledge graph vectors corresponding to each domain name;

[0009] Using the knowledge graph vector corresponding to the domain name as input and the preset label corresponding to the domain name as output, a neural network model is trained to obtain an entity classification model.

[0010] Based on the entity classification model, the domain names are classified and detected.

[0011] In one possible implementation, the establishment of a DNS knowledge graph based on DNS hierarchical relationships and query resolution relationships includes:

[0012] Based on the hierarchical relationship of DNS, a DNS domain name hierarchy diagram is established, and the preset tags are added to the DNS domain name hierarchy diagram;

[0013] Based on the DNS query resolution relationship, establish a DNS query response graph and a passive DNS graph;

[0014] The DNS query response graph and the passive DNS graph are combined to establish a DNS flow graph, and the preset label is added to the DNS flow graph;

[0015] The DNS domain name hierarchy graph and the DNS flow graph are combined using rule alignment to establish the DNS knowledge graph.

[0016] In one possible implementation, the entity includes a head entity and a tail entity;

[0017] The step of splitting the DNS knowledge graph into entities and relations, and then fusing the entities and relations according to the entity attribute alignment method to obtain the fused DNS knowledge graph includes:

[0018] Using a triplet approach, the client IP address of the DNS knowledge graph is used as the header entity, the Qname attribute of the DNS knowledge graph is used as the relation, and the domain name of the DNS knowledge graph is used as the tail entity.

[0019] By aligning entity attributes, the head entity, the relationship, and the tail entity are merged to obtain the merged DNS knowledge graph.

[0020] In one possible implementation, the DNS knowledge graph includes at least one type of triples corresponding to domain names, and the vectorization of the entities and relations of the fused DNS knowledge graph to obtain DNS knowledge graph vectors includes:

[0021] For each type of domain name, arbitrarily select the head entity of a triplet in that type of domain name as the starting node, and calculate the entity distance between the tail entity of the current triplet and the head entity of the first triplet.

[0022] Determine whether the entity distance between the tail entity of the current triplet and the head entity of the first triplet is not greater than a preset entity distance;

[0023] If the entity distance between the tail entity of the current triplet and the head entity of the first triplet is not greater than the preset entity distance, then the head entity of the first triplet is linked to the tail entity of the current triplet, and the first triplet is used as the current triplet.

[0024] Repeat the current step until the head entity of the current triple is the starting node, to obtain the entity and relation of the domain name;

[0025] Vectorize the entities and relationships corresponding to each domain name to obtain the knowledge graph vectors corresponding to each domain name;

[0026] The first triplet is the triplet that is not linked in the triplet corresponding to this type of domain name.

[0027] In one possible implementation, after determining whether the entity distance between the tail entity of the current triplet and the head entity of the first triplet is not greater than a preset entity distance, the following steps are included:

[0028] Step 1: If the entity distance between the tail entity of the current triplet and the head entity of the first triplet is greater than the preset entity distance, then proceed to Step 2;

[0029] Step 2: Replace the header entity of the first triplet with the header entity of the second triplet, sample the tail entity of the second triplet and replace the tail entity of the first triplet, and use the replaced first triplet as the negative sample triplet; the second triplet is any triplet that has been linked in this type of domain.

[0030] Step 3: Determine whether the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is not greater than a preset entity distance;

[0031] Step 4: If the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is not greater than the preset entity distance, then link the head entity of the negative sample triplet to the tail entity of the current triplet, and use the negative sample triplet as the current triplet.

[0032] Step 5: If the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is greater than the preset entity distance, return to step 2 and repeat steps 2 to 5 until the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet meets the preset entity distance.

[0033] In one possible implementation, the vectorization of the entities and relations of the fused DNS knowledge graph to obtain DNS knowledge graph vectors includes:

[0034] The TransE algorithm is used to vectorize the entities and relationships in the fused DNS knowledge graph to obtain the DNS knowledge graph vector.

[0035] In one possible implementation, the step of using the knowledge graph vector corresponding to the domain name as input and the preset label corresponding to the domain name as output to train a neural network model to obtain an entity classification model includes:

[0036] The knowledge graph vector corresponding to the domain name is used as the input, and the preset label corresponding to the domain name is used as the output to train the BiLSTM neural network. The trained BiLSTM neural network model is then used as the entity classification model.

[0037] Secondly, this application provides a knowledge graph-based entity classification system, which includes: a building module, a fusion module, a vectorization module, a training module, and a detection module;

[0038] The establishment module is used to establish a DNS knowledge graph based on the hierarchical relationship and query resolution relationship of DNS, wherein the DNS knowledge graph includes at least one preset label corresponding to a domain name, and the preset label includes malicious and non-malicious;

[0039] The fusion module is used to split the DNS knowledge graph into entities and relations, and fuse the entities and relations according to the entity attribute alignment method to obtain the fused DNS knowledge graph;

[0040] The vectorization module is used to vectorize the entities and relationships of the fused DNS knowledge graph to obtain DNS knowledge graph vectors, wherein the DNS knowledge graph vectors include knowledge graph vectors corresponding to each domain name;

[0041] The training module is used to train a neural network model by taking the knowledge graph vector corresponding to the domain name as input and the preset label corresponding to the domain name as output, so as to obtain an entity classification model.

[0042] The detection module is used to classify and detect domain names according to the entity classification model.

[0043] Thirdly, this application provides a terminal including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method as described in any possible implementation of the first aspect above.

[0044] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method as described in any possible implementation of the first aspect above.

[0045] This application provides a knowledge graph-based entity classification method, system, terminal, and storage medium. It establishes a DNS knowledge graph based on DNS hierarchical relationships and query resolution relationships. The DNS knowledge graph includes at least one preset label corresponding to a domain name, with preset labels including malicious and non-malicious, thus enabling the mapping between domain names and preset labels. The DNS knowledge graph is then split into entities and relationships, and these entities and relationships are merged according to entity attribute alignment to obtain a merged DNS knowledge graph. Next, the entities and relationships in the merged DNS knowledge graph are vectorized to obtain DNS knowledge graph vectors. These vectors include knowledge graph vectors corresponding to each domain name. Using the knowledge graph vectors corresponding to each domain name as input and the preset labels corresponding to each domain name as output, a neural network model is trained to obtain an entity classification model. Based on the entity classification model, domain names are classified and detected. This makes domain name classification and detection more accurate and improves detection speed. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is a flowchart illustrating the implementation of the knowledge graph-based entity classification method provided in this application embodiment;

[0048] Figure 2 This is an embedding structure diagram of the knowledge graph-based entity classification method provided in the embodiments of this application;

[0049] Figure 3 This is a detection structure diagram of the knowledge graph-based entity classification method provided in the embodiments of this application;

[0050] Figure 4 This is a schematic diagram of the structure of a knowledge graph-based entity system provided in an embodiment of this application;

[0051] Figure 5 This is a schematic diagram of the terminal provided in the embodiments of this application. Detailed Implementation

[0052] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following description will be provided in conjunction with the accompanying drawings and specific embodiments.

[0054] Figure 1 The implementation flowchart of the knowledge graph-based entity classification method provided in the embodiments of this application is described in detail below:

[0055] In S101, a DNS knowledge graph is established based on the hierarchical relationship and query resolution relationship of DNS. The DNS knowledge graph includes at least one preset label corresponding to a domain name, and the preset label includes malicious and non-malicious.

[0056] DNS (Domain Name System) is an internet service. As a distributed database that maps domain names to IP addresses, it makes internet access easier. DNS uses UDP port 53. Currently, the length limit for each domain name level is 63 characters, and the total length of a domain name cannot exceed 253 characters.

[0057] The DNS hierarchy, or hierarchical structure, can be viewed as a tree-like structure. The Domain Name System does not distinguish between internal and leaf nodes, referring to them all collectively as nodes. Different nodes can use the same tag. All node tags can consist of only three types of characters: the 26 English letters (a-z), 10 Arabic numerals (0-9), and the hyphen (-), and the tag length cannot exceed 22 characters. A node's domain name is composed of the tags of all nodes from that node to the root, separated by dots. The domain name of the top-level node is called the top-level domain (TLD), the domain name of the second-level node is called the second-level domain, and so on.

[0058] The process of DNS query resolution includes:

[0059] First, based on the hierarchical structure of the Domain Name System (DNS), the domain name space is divided into different regions according to subtrees. Each region can be viewed as a manageable power entity responsible for that part of the nodes in the hierarchy. For example, the top-level region of the entire domain is managed by ICANN, and some country-code domains and their subordinate nodes constitute their own regions; for instance, the .cn domain is managed by CNNIC. The .cn domain is further divided into smaller regions; for example, .fudan.edu.cn is managed by the Network Center of Fudan University.

[0060] Secondly, each zone must have a corresponding name server, and the information contained in each zone is stored on the name server. A zone can have two or more name servers, so even if one name server fails, the other can still provide information normally. A name server can also manage multiple zones simultaneously. When a name server receives a request from a user, it queries its own resource record set and returns the final answer the user wants. Alternatively, if the required answer is not found in its own resource record set, it returns a pointer to another name server, and the user will continue to send requests to that name server. Therefore, a name server does not need to record information about all its subordinate domains and hosts; for subdomains (if they exist), it only needs to know the name server for that subdomain.

[0061] A resource record is a domain-to-value binding that includes the following fields: domain, value, type, category, and lifetime. The domain and value fields represent the content being resolved and the result returned, respectively. The type field indicates the type of value: type A means the value is an IP address, i.e., the final answer the user wants; type NS means the value is the domain of another name server that knows how to resolve the domain specified by the domain field; type CNAME means the value is an alias for the host specified by the domain; type MX means the value is the domain of a mail server that receives mail from the domain specified by the domain field; type PTR is used for reverse domain name lookups, etc. The category field allows specifying other record types. The lifetime field indicates the validity period of the resource record. To reduce domain name resolution time, name servers cache some resource records that have been queried from other name servers. Because these resource records expire due to changes, name servers set lifetimes, and expired resource records are cleared from the cache.

[0062] The root name server knows the name servers for all top-level domains. For each top-level domain, it has two resource records: one is an NS resource record, where the domain field is the top-level domain and the value field is the domain name of the name server that the top-level domain resolves to; the other is an A resource record, which specifies the IP address corresponding to the name server's domain name. By using these two records together, it can determine which name server IP address to look for when resolving a specific domain name under that domain. The second-level name servers similarly store pointers to the various third-level name servers. Third-level name servers will have resource records of types A, CNAME, MX, etc. Each name server also has a root name server address record.

[0063] Finally, a user needing domain name resolution first sends the resolution request to their local name server. If the local name server can resolve the domain, it receives the result directly; otherwise, it sends a request to the root name server. Based on the pointer returned by the root name server, it then queries the next level of name servers, and so on, until finally obtaining the IP address of the domain name to be resolved.

[0064] Knowledge graphs, known in the library and information science community as knowledge domain visualization or knowledge domain mapping maps, are a series of different graphics that display the development process and structural relationships of knowledge. They use visualization techniques to describe knowledge resources and their carriers, and to mine, analyze, construct, draw, and display knowledge and the interrelationships between them.

[0065] Knowledge graphs are a modern theory that combines theories and methods from applied mathematics, computer graphics, information visualization, and information science with bibliometric methods such as citation analysis and co-occurrence analysis. They utilize visualized graphs to vividly represent the core structure, development history, cutting-edge fields, and overall knowledge architecture of a discipline, achieving multidisciplinary integration. Knowledge graphs can provide practical and valuable references for disciplinary research.

[0066] The characteristics of knowledge graphs include: the more times and the wider the scope of user searches, the more information and content the search engine can obtain; giving strings new meanings, rather than just simple strings; integrating all disciplines to facilitate the coherence of user searches; finding more accurate information for users, making more comprehensive summaries, and providing more in-depth and relevant information; systematically presenting the knowledge system related to keywords to users; and extracting useful information from the entire Internet so that users can obtain more relevant public resources.

[0067] In this embodiment of the application, a DNS knowledge graph is established based on the hierarchical relationship and query resolution relationship of DNS. The DNS knowledge graph includes at least one domain name and a preset label corresponding to the domain name.

[0068] In this embodiment of the application, the preset tags include malicious tags and non-malicious tags. Non-malicious tags are good tags, which means that the domain name with the tag is a good domain name, that is, a domain name that will not harm the network; malicious tags mean that the domain name with the tag is a bad domain name, that is, a domain name that will have a negative impact on the network.

[0069] In one possible implementation, building a DNS knowledge graph based on DNS hierarchical relationships and query resolution relationships can include:

[0070] Based on the hierarchical relationship of DNS, a DNS domain name hierarchy diagram is established, and preset labels are added to the DNS domain name hierarchy diagram;

[0071] Based on the DNS query resolution relationship, establish a DNS query response graph and a passive DNS graph;

[0072] Combine the DNS query response graph and the passive DNS graph to create a DNS flow graph, and add preset labels to the DNS flow graph;

[0073] A DNS knowledge graph is established by combining the DNS domain name hierarchy graph and the DNS flow graph through rule alignment.

[0074] The DNS domain name hierarchy diagram is based on the hierarchical relationship of DNS and is established through the structural and hierarchical characteristics of the domain name itself. That is, the DNS domain name hierarchy diagram is a hierarchical structure representation diagram of domain names, and a preset label is added to each domain name in the DNS domain name hierarchy diagram.

[0075] The DNS query response graph and passive DNS graph are built based on the DNS query resolution relationship, that is, according to the DNS request process. Then, the established DNS query response graph and passive DNS graph are combined to obtain the DNS flow graph, and a preset label is added to each domain name in the DNS flow graph.

[0076] The main commonality found in both the DNS domain name hierarchy diagram and the DNS flow diagram is domain name information. The Qname attribute in the query portion of the DNS flow diagram is closely related to domain name information.

[0077] By combining the DNS domain name hierarchy graph and the DNS flow graph using rule alignment, a DNS knowledge graph is obtained.

[0078] In S102, the DNS knowledge graph is split into entities and relations, and the entities and relations are merged according to the entity attribute alignment method to obtain the merged DNS knowledge graph.

[0079] In this embodiment, the DNS knowledge graph is fused using entity attribute alignment to obtain a fused DNS knowledge graph.

[0080] Among them, entity attribute alignment is a method of connecting different subgraphs by using entities with the same attribute values.

[0081] In one possible implementation, the entity may include a head entity and a tail entity;

[0082] The DNS knowledge graph is split into entities and relations, and then merged according to the entity attribute alignment method to obtain the merged DNS knowledge graph, which may include:

[0083] Using a triplet approach, the client IP address of the DNS knowledge graph is used as the header entity, the Qname attribute of the DNS knowledge graph is used as the relation, and the domain name of the DNS knowledge graph is used as the tail entity.

[0084] By aligning entity attributes, the head entity, relationship, and tail entity are merged to obtain the merged DNS knowledge graph.

[0085] In this context, a triplet is a set of the form ((x, y), z), often abbreviated as (x, y, z). It's primarily used as a compression method for storing sparse matrices, also called a triplet table. Assuming a sequential storage structure is used to represent the triplet table, we obtain a compressed storage method for sparse matrices, namely a triplet sequential list, or simply a triplet table. Due to its inherent sparsity, compression can significantly reduce the memory cost of sparse matrices. Specifically, the operation involves forming a triplet (i, j, v) with the row, column, and value of a non-zero element, and then storing these triplets according to a certain pattern. This method saves storage space.

[0086] In this embodiment of the application, based on the above description of the triples, it can be seen that x is equivalent to the head entity, y is equivalent to the relation, and z is equivalent to the tail entity.

[0087] Using a triplet approach, the client IP address in the DNS flow graph of the DNS knowledge graph is used as the header entity, the Qname attribute in the DNS flow graph is used as the relation, and the corresponding domain name in the DNS domain name hierarchy graph of the DNS knowledge graph is used as the tail entity. That is, according to the triplet approach (header entity + relation = tail entity), the client IP address in the DNS flow graph + the Qname attribute = the corresponding domain name in the DNS domain name hierarchy graph, thus ensuring the consistency of the entire DNS knowledge graph. Through entity attribute alignment, the client IP address, Qname attribute in the DNS flow graph, and the corresponding domain name in the DNS domain name hierarchy graph are merged to obtain the merged DNS knowledge graph.

[0088] In one possible implementation, the DNS knowledge graph includes at least one class of triples corresponding to domain names. The entities and relationships of the merged DNS knowledge graph are vectorized to obtain DNS knowledge graph vectors, which include:

[0089] For each type of domain name, arbitrarily select the head entity of a triplet in that type of domain name as the starting node, and calculate the entity distance between the tail entity of the current triplet and the head entity of the first triplet.

[0090] Determine whether the entity distance between the tail entity of the current triplet and the head entity of the first triplet is not greater than a preset entity distance;

[0091] If the entity distance between the tail entity of the current triplet and the head entity of the first triplet is not greater than the preset entity distance, then link the head entity of the first triplet with the tail entity of the current triplet, and use the first triplet as the current triplet.

[0092] Repeat the current step until the head entity of the current triple is the starting node, and obtain the entity and relation of the domain name;

[0093] Vectorize the entities and relationships corresponding to each domain name to obtain the knowledge graph vectors corresponding to each domain name;

[0094] The first triplet is the triplet that is not linked in the triplet corresponding to this type of domain name.

[0095] In this embodiment of the application, the entities between DNS knowledge graphs adopt the concept of distance. Utilizing the characteristics of directed graphs, the process of obtaining the entities and relationships of a domain name includes: for each type of domain name, arbitrarily selecting the head entity of a triplet in that type of domain name as the starting node, setting a preset entity distance, calculating the entity distance between the tail entity of the current triplet and the head entity of the first triplet, and determining whether the entity distance between the tail entity of the current triplet and the head entity of the first triplet is not greater than the preset entity distance. If it is not greater, then link the head entity of the first triplet with the tail entity of the current triplet, and take the first triplet as the current triplet. Repeat the above operation until the head entity of the current triplet is the starting node, thus obtaining the entities and relationships of the domain name.

[0096] Then, vectorization operations are performed on the entities and relationships corresponding to each domain name to obtain the knowledge graph vectors corresponding to each domain name.

[0097] For example, consider a class of domains containing domains A, B, C, and D. Here, we set the default entity distance to 1. The head entity of domain A is the starting node. We then search for the next domain after domain A. When domain B is identified, we calculate the entity distance between the tail entity of domain A and the head entity of domain B. If this entity distance is not greater than 1, we link the head entity of domain B to the tail entity of domain A and set domain B as the current domain. We continue searching for the next domain until domain D is the last domain. We then calculate the entity distance between the tail entity of domain D and the head entity of domain A. If this entity distance is not greater than 1, we consider the domain calculation complete, and we have obtained the entity and relation relationships for that domain.

[0098] In one possible implementation, after determining whether the entity distance between the tail entity of the current triplet and the head entity of the first triplet is not greater than a preset entity distance, the process includes:

[0099] Step 1: If the entity distance between the tail entity of the current triplet and the head entity of the first triplet is greater than the preset entity distance, then proceed to Step 2;

[0100] Step 2: Replace the header entity of the first triple with the header entity of the second triple, sample the tail entity of the second triple and replace the tail entity of the first triple, and use the replaced first triple as the negative sample triple; the second triple is any triple that has been linked in this type of domain.

[0101] Step 3: Determine whether the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is not greater than the preset entity distance;

[0102] Step 4: If the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is not greater than the preset entity distance, then link the head entity of the negative sample triplet with the tail entity of the current triplet, and use the negative sample triplet as the current triplet.

[0103] Step 5: If the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is greater than the preset entity distance, return to step 2 and repeat steps 2 to 5 until the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet meets the preset entity distance.

[0104] In this embodiment of the application, if some entities cannot be linked after the entity distance calculation is completed, that is, the entity distance between the tail entity of the current triplet and the head entity of the first triplet is greater than the preset entity distance, then the distance between the two is considered to be infinite.

[0105] In this embodiment, during triplet training, the head and tail entities of the second triplet are randomly selected to replace the head and tail entities of the first triplet, respectively. The replaced first triplet is then used as a negative sample triplet. The second triplet is any triplet that has been linked in the domain name. The system then determines whether the preset distance between the tail entity of the current triplet and the head entity of the negative sample triplet is not greater than a preset entity distance. If it is not greater, the head entity of the negative sample triplet is linked to the tail entity of the current triplet, and the negative sample triplet is used as the current triplet. If it is greater, the system reselects linked triplet groups to replace the first triplet until the entity distance between the tail entity of the current triplet and the head entity of the replaced negative sample triplet is not greater than the preset distance.

[0106] For example, consider a class of domains containing A, B, C, and D. We set the default entity distance to 1, and take the header entity of domain A as the starting node. To find the next domain after A, if it's B, we calculate the entity distance between the tail entity of domain A and the header entity of domain B as 15. If this entity distance is greater than 1, we consider the distance between the tail entity of domain A and the header entity of domain B to be infinite. Then, we randomly select a domain C (which is already linked) and replace its header entity with... The header entity of domain B is replaced with the tail entity of domain C. The replaced domain B is used as the negative sampling triple. The entity distance between the tail entity of domain A and the header entity of the negative sampling triple is calculated to be 0.7. Since this entity distance is less than 1, the header entity of the replaced negative sampling triple is linked with the tail entity of domain A, and the negative sampling triple is used as the current triple. If the negative sampling triple obtained after replacing domain B with domain C still does not meet the requirements, it is reselected until the requirements are met.

[0107] In this embodiment, data processing is required on the merged DNS knowledge graph. This mainly involves filtering out duplicate and redundant data, merging identical entities, and adding features such as frequency and duration to make the data in the merged DNS knowledge graph cleaner. For example, if a host sends requests to the domain name www.google.com at different times with the same request parameters, these two requests are considered identical, and such requests are merged. However, this operation does not affect the data content of the merged DNS knowledge graph.

[0108] In S103, the entities and relationships of the merged DNS knowledge graph are vectorized to obtain DNS knowledge graph vectors, where the DNS knowledge graph vectors include the knowledge graph vectors corresponding to each domain name.

[0109] In one possible implementation, the entities and relations of the merged DNS knowledge graph are vectorized to obtain DNS knowledge graph vectors, including:

[0110] The TransE algorithm is used to vectorize the entities and relations of the fused DNS knowledge graph to obtain DNS knowledge graph vectors.

[0111] Among them, the TransE algorithm is an algorithm for embedding representations of nodes and relations in graph structures. It is a distributed vector representation based on entities and relations. The algorithm is inspired by word2vec and utilizes the translation invariance of word vectors.

[0112] In this embodiment, the TransE algorithm is used to vectorize the entities and relationships of the fused DNS knowledge graph to obtain DNS knowledge graph vectors, which serve as the basis for subsequent training of neural network models.

[0113] Specifically, refer to Figure 2 Since the TransE algorithm is used for embedding representation, the process consists of two parts: triple embedding and attribute embedding. Attribute embedding is implemented based on triples. For the triple embedding part, the TransE algorithm is used for training, with the goal of making the sum of the head entity and relation equal to the tail entity as much as possible. Because the head or tail entity is randomly replaced, in the DNS knowledge graph of this embodiment, the randomly replaced entity may be very close to the entity being trained. During training, we found that the replaced entity may be only one entity away from the currently trained entity. This is mainly because graph fusion based on rule alignment reduces the distance between many entities, or may connect entities that were originally different.

[0114] In S104, the knowledge graph vector corresponding to the domain name is used as the input and the preset label corresponding to the domain name is used as the output to train the neural network model and obtain the entity classification model.

[0115] In one possible implementation, the knowledge graph vector corresponding to the domain name is used as input, and the preset label corresponding to the domain name is used as output to train a neural network model, resulting in an entity classification model, including:

[0116] The knowledge graph vector corresponding to the domain name is used as the input, and the preset label corresponding to the domain name is used as the output to train the BiLSTM neural network. The trained BiLSTM neural network model is then used as the entity classification model.

[0117] In this embodiment of the application, the trained model obtained by training a BiLSTM neural network is used as the entity classification model.

[0118] BiLSTM (Bi-directional Long Short-Term Memory) is a combination of a forward LSTM and a backward LSTM, used to process contextual information. LSTM suffers from the limitation of not being able to utilize information from the back to the front due to its sequential structure, resulting in weaker learning capabilities for fine-grained classification tasks. BiLSTM uses a forward LSTM to utilize past information and a backward LSTM to utilize future information. Each node in BiLSTM is an LSTM neuron. During training, each training sequence is divided into two independent recurrent neural networks, forward and backward, which are ultimately connected to the same output layer. The detection module ultimately uses BiLSTM for feature extraction. Because it can utilize bidirectional information simultaneously at the current moment, it is more accurate than a unidirectional LSTM in prediction.

[0119] In this embodiment, the knowledge graph vector corresponding to the domain name is used as the input of the BiLSTM neural network.

[0120] In this embodiment, the knowledge graph vector corresponding to the domain name is used as the input of the BiLSTM neural network, and the preset label corresponding to the domain name is used as the output of the BiLSTM neural network. The BiLSTM neural network is trained, and the trained BiLSTM neural network model is used as the entity classification model.

[0121] Specifically, the knowledge graph vector corresponding to the domain name is used as the input of the BiLSTM neural network, and the malicious or non-malicious label corresponding to the domain name is used as the output of the BiLSTM neural network. The BiLSTM neural network is then trained to obtain an entity classification model.

[0122] Specifically, refer to Figure 3 This entity classification model sequentially passes through a BiLSTM layer, an Attention layer, a Dropout layer, a Flatten layer, a Dense layer, and a Softmax layer, finally outputting the detection result. The explanation of each layer is as follows:

[0123] The main function of the BiLSTM layer is to learn the contextual relationships between vectors in a sequence, including both forward and backward vectors, thereby better extracting features for classification.

[0124] Attention layers were originally used in image processing, aiming to focus the computer's attention on areas of the image that require attention. This means that the attention distribution is different for each scene within the image, with some pixels having higher weights than others. However, training with text sequences presents certain challenges. First, when the input sequence is extremely long, the model struggles to generate effective vector representations. Second, as the sequence progresses, all context is compressed to a fixed length, limiting the model's capabilities. The Attention mechanism addresses this by preserving the encoding results of the BiLSTM layer, selectively learning from these inputs, and associating the output sequence with them.

[0125] The Dropout layer essentially generates small models randomly within the overall network, simulating ensemble learning. Its direct effect is to reduce the number of intermediate features, decreasing redundancy and thus increasing the orthogonality between features in each layer. During model training, this manifests as randomly setting the output of some nodes to zero without updating the weights. The parameter of this layer is primarily a probability, indicating the probability at which nodes should be stopped. Adding the Dropout layer helps prevent overfitting.

[0126] The purpose of the Flatten layer is to transform a multi-dimensional vector into a single-dimensional vector without affecting the batch size.

[0127] Dense layers are the most commonly used fully connected layers. The purpose of fully connected layers is to perform a non-linear transformation on the output of the upper layer.

[0128] The Softmax layer ultimately maps multiple scalars to a probability distribution, resulting in an output between (0, 1). The output of the Softmax function completes the detection for the entire module.

[0129] In S105, domain names are classified and detected based on the entity classification model.

[0130] Based on the entity classification model trained in S104, the knowledge graph vector corresponding to the domain name to be detected is input into the entity classification model to perform domain name classification detection. The final output is malicious or non-malicious, that is, whether the domain name to be detected is a malicious domain name or a non-malicious domain name.

[0131] This application provides a knowledge graph-based entity classification method. It establishes a DNS knowledge graph based on DNS hierarchical relationships and query resolution relationships. The DNS knowledge graph includes at least one preset label corresponding to a domain name, with preset labels categorized as malicious or non-malicious, thus ensuring a correspondence between domain names and preset labels. The DNS knowledge graph is then split into entities and relationships, and these entities and relationships are merged according to entity attribute alignment to obtain a merged DNS knowledge graph. Next, the entities and relationships in the merged DNS knowledge graph are vectorized to obtain DNS knowledge graph vectors. These vectors include knowledge graph vectors corresponding to each domain name. Using the knowledge graph vectors corresponding to each domain name as input and the preset labels corresponding to each domain name as output, a neural network model is trained to obtain an entity classification model. Based on this model, domain names are classified and detected. This approach improves the accuracy and speed of domain name classification and detection.

[0132] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0133] The following are system embodiments of this application. For details not described in detail, please refer to the corresponding method embodiments described above.

[0134] Figure 4 The diagram illustrates the structure of a knowledge graph-based entity classification system provided in an embodiment of this application. For ease of explanation, only the parts relevant to the embodiment of this application are shown, and are described in detail below:

[0135] like Figure 4 As shown, the knowledge graph-based entity classification system 4 includes: a building module 41, a fusion module 42, a vectorization module 43, a training module 44, and a detection module 45;

[0136] Module 41 is used to establish a DNS knowledge graph based on the hierarchical relationship and query resolution relationship of DNS. The DNS knowledge graph includes at least one preset label corresponding to a domain name, and the preset label includes malicious and non-malicious.

[0137] The fusion module 42 is used to split the DNS knowledge graph into entities and relations, and merge the entities and relations according to the entity attribute alignment method to obtain the fused DNS knowledge graph;

[0138] Vectorization module 43 is used to vectorize the entities and relationships of the fused DNS knowledge graph to obtain DNS knowledge graph vectors, wherein the DNS knowledge graph vectors include the knowledge graph vectors corresponding to each domain name;

[0139] Training module 44 is used to train a neural network model by taking the knowledge graph vector corresponding to the domain name as input and the preset label corresponding to the domain name as output, so as to obtain an entity classification model.

[0140] The detection module 45 is used to classify and detect domain names based on the entity classification model.

[0141] This application provides a knowledge graph-based entity classification system. It establishes a DNS knowledge graph based on DNS hierarchical relationships and query resolution relationships. The DNS knowledge graph includes at least one preset label corresponding to a domain name, with preset labels categorized as malicious or non-malicious, thus ensuring a correspondence between domain names and preset labels. The DNS knowledge graph is then split into entities and relationships, and these entities and relationships are merged according to entity attribute alignment to obtain a merged DNS knowledge graph. Next, the entities and relationships in the merged DNS knowledge graph are vectorized to obtain DNS knowledge graph vectors. These vectors include knowledge graph vectors corresponding to each domain name. Using the knowledge graph vectors corresponding to each domain name as input and the preset labels corresponding to each domain name as output, a neural network model is trained to obtain an entity classification model. Based on this model, domain names are classified and detected. This approach improves the accuracy and speed of domain name classification and detection.

[0142] In one possible implementation, module 41 is established, which can be used specifically for:

[0143] Based on the hierarchical relationship of DNS, a DNS domain name hierarchy diagram is established, and preset labels are added to the DNS domain name hierarchy diagram;

[0144] Based on the DNS query resolution relationship, establish a DNS query response graph and a passive DNS graph;

[0145] Combine the DNS query response graph and the passive DNS graph to create a DNS flow graph, and add preset labels to the DNS flow graph;

[0146] A DNS knowledge graph is established by combining the DNS domain name hierarchy graph and the DNS flow graph through rule alignment.

[0147] In one possible implementation, an entity may include a head entity and a tail entity.

[0148] In one possible implementation, the fusion module 42 can specifically be used for:

[0149] Using a triplet approach, the client IP address of the DNS knowledge graph is used as the header entity, the Qname attribute of the DNS knowledge graph is used as the relation, and the domain name of the DNS knowledge graph is used as the tail entity.

[0150] By aligning entity attributes, the head entity, relationship, and tail entity are merged to obtain the merged DNS knowledge graph.

[0151] In one possible implementation, the DNS knowledge graph includes at least one class of triples corresponding to domain names, and the vectorization module 43 can be specifically used for:

[0152] For each type of domain name, arbitrarily select the head entity of a triplet in that type of domain name as the starting node, and calculate the entity distance between the tail entity of the current triplet and the head entity of the first triplet.

[0153] Determine whether the entity distance between the tail entity of the current triplet and the head entity of the first triplet is not greater than a preset entity distance;

[0154] If the entity distance between the tail entity of the current triplet and the head entity of the first triplet is not greater than the preset entity distance, then link the head entity of the first triplet with the tail entity of the current triplet, and use the first triplet as the current triplet.

[0155] Repeat the current step until the head entity of the current triple is the starting node, and obtain the entity and relation of the domain name;

[0156] Vectorize the entities and relationships corresponding to each domain name to obtain the knowledge graph vectors corresponding to each domain name;

[0157] The first triplet is the triplet that is not linked in the triplet corresponding to this type of domain name.

[0158] In one possible implementation, vectorization module 43 can also be used for:

[0159] Step 1: If the entity distance between the tail entity of the current triplet and the head entity of the first triplet is greater than the preset entity distance, then proceed to Step 2;

[0160] Step 2: Replace the header entity of the first triple with the header entity of the second triple, sample the tail entity of the second triple and replace the tail entity of the first triple, and use the replaced first triple as the negative sample triple; the second triple is any triple that has been linked in this type of domain.

[0161] Step 3: Determine whether the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is not greater than the preset entity distance;

[0162] Step 4: If the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is not greater than the preset entity distance, then link the head entity of the negative sample triplet with the tail entity of the current triplet, and use the negative sample triplet as the current triplet.

[0163] Step 5: If the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is greater than the preset entity distance, return to step 2 and repeat steps 2 to 5 until the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet meets the preset entity distance.

[0164] In one possible implementation, vectorization module 43 can also be used for:

[0165] The TransE algorithm is used to vectorize the entities and relations of the fused DNS knowledge graph to obtain DNS knowledge graph vectors.

[0166] In one possible implementation, training module 44 can be specifically used for:

[0167] The knowledge graph vector corresponding to the domain name is used as the input, and the preset label corresponding to the domain name is used as the output to train the BiLSTM neural network. The trained BiLSTM neural network model is then used as the entity classification model.

[0168] Figure 5 This is a schematic diagram of the terminal provided in an embodiment of this application. For example... Figure 5 As shown, the terminal 5 in this embodiment includes: a processor 50, a memory 51, and a computer program 52 stored in the memory 51 and executable on the processor 50. When the processor 50 executes the computer program 52, it implements the steps in the various knowledge graph-based entity classification method embodiments described above, for example... Figure 1 S101 to S105 are shown. Alternatively, when the processor 50 executes the computer program 52, it implements the functions of each module / unit in the above system embodiments, for example... Figure 4 The functions of modules 41 to 45 are shown.

[0169] For example, the computer program 52 can be divided into one or more modules / units, which are stored in the memory 51 and executed by the processor 50 to complete this application. The one or more modules / units can be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program 52 in the terminal 5. For example, the computer program 52 can be divided into... Figure 4 Modules 41 to 45 are shown.

[0170] The terminal 5 can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. The terminal 5 may include, but is not limited to, a processor 50 and a memory 51. Those skilled in the art will understand that... Figure 5This is merely an example of terminal 5 and does not constitute a limitation on terminal 5. It may include more or fewer components than shown, or combine certain components, or different components. For example, the terminal may also include input / output devices, network access devices, buses, etc.

[0171] The processor 50 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0172] The memory 51 can be an internal storage unit of the terminal 5, such as a hard disk or memory of the terminal 5. The memory 51 can also be an external storage device of the terminal 5, such as a plug-in hard disk, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card equipped on the terminal 5. Furthermore, the memory 51 can include both internal storage units and external storage devices of the terminal 5. The memory 51 is used to store the computer program and other programs and data required by the terminal. The memory 51 can also be used to temporarily store data that has been output or will be output.

[0173] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0174] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0175] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0176] In the embodiments provided in this application, it should be understood that the disclosed devices / terminals and methods can be implemented in other ways. For example, the device / terminal embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0177] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0178] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0179] If the integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above-described embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various knowledge graph-based entity classification method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately added to or subtracted from the content as required by the legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the computer-readable medium may not include electrical carrier signals and telecommunication signals.

[0180] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A knowledge graph-based entity classification method, characterized in that, include: A DNS knowledge graph is established based on the hierarchical relationship and query resolution relationship of DNS, wherein the DNS knowledge graph includes at least one preset label corresponding to a domain name, and the preset label includes malicious and non-malicious; The DNS knowledge graph is split into entities and relations, and the entities and relations are merged according to the entity attribute alignment method to obtain the merged DNS knowledge graph; The entities and relationships of the fused DNS knowledge graph are vectorized to obtain DNS knowledge graph vectors, wherein the DNS knowledge graph vectors include the knowledge graph vectors corresponding to each domain name; Using the knowledge graph vector corresponding to the domain name as input and the preset label corresponding to the domain name as output, a neural network model is trained to obtain an entity classification model. Based on the entity classification model, the domain names are classified and detected; The establishment of a DNS knowledge graph based on DNS hierarchical relationships and query resolution relationships includes: Based on the hierarchical relationship of DNS, a DNS domain name hierarchy diagram is established, and the preset tags are added to the DNS domain name hierarchy diagram; Based on the DNS query resolution relationship, establish a DNS query response graph and a passive DNS graph; The DNS query response graph and the passive DNS graph are combined to establish a DNS flow graph, and the preset label is added to the DNS flow graph; The DNS domain name hierarchy graph and the DNS flow graph are combined using rule alignment to establish the DNS knowledge graph; The DNS knowledge graph includes at least one type of triples corresponding to domain names. The vectorization of entities and relationships in the fused DNS knowledge graph to obtain DNS knowledge graph vectors includes: For each type of domain name, arbitrarily select the head entity of a triplet in that type of domain name as the starting node, and calculate the entity distance between the tail entity of the current triplet and the head entity of the first triplet. Determine whether the entity distance between the tail entity of the current triplet and the head entity of the first triplet is not greater than a preset entity distance; If the entity distance between the tail entity of the current triplet and the head entity of the first triplet is not greater than the preset entity distance, then the head entity of the first triplet is linked to the tail entity of the current triplet, and the first triplet is used as the current triplet. Repeat the current step until the head entity of the current triple is the starting node, to obtain the entity and relation of the domain name; Vectorize the entities and relationships corresponding to each domain name to obtain the knowledge graph vectors corresponding to each domain name; The first triplet is the triplet that is not linked in the triplet corresponding to this type of domain name; The step of determining whether the entity distance between the tail entity of the current triplet and the head entity of the first triplet is not greater than a preset entity distance includes: Step 1: If the entity distance between the tail entity of the current triplet and the head entity of the first triplet is greater than the preset entity distance, then proceed to Step 2; Step 2: Replace the header entity of the first triplet with the header entity of the second triplet, sample the tail entity of the second triplet and replace the tail entity of the first triplet, and use the replaced first triplet as the negative sample triplet; the second triplet is any triplet that has been linked in this type of domain. Step 3: Determine whether the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is not greater than a preset entity distance; Step 4: If the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is not greater than the preset entity distance, then link the head entity of the negative sample triplet to the tail entity of the current triplet, and use the negative sample triplet as the current triplet. Step 5: If the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is greater than the preset entity distance, return to step 2 and repeat steps 2 to 5 until the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet meets the preset entity distance.

2. The entity classification method based on knowledge graphs according to claim 1, characterized in that, The entity includes a head entity and a tail entity; The step of splitting the DNS knowledge graph into entities and relations, and then fusing the entities and relations according to the entity attribute alignment method to obtain the fused DNS knowledge graph includes: Using a triplet approach, the client IP address of the DNS knowledge graph is used as the header entity, the Qname attribute of the DNS knowledge graph is used as the relation, and the domain name of the DNS knowledge graph is used as the tail entity. By aligning entity attributes, the head entity, the relationship, and the tail entity are merged to obtain the merged DNS knowledge graph.

3. The entity classification method based on knowledge graphs according to claim 1, characterized in that, The step of vectorizing the entities and relations of the fused DNS knowledge graph to obtain DNS knowledge graph vectors includes: The TransE algorithm is used to vectorize the entities and relationships in the fused DNS knowledge graph to obtain the DNS knowledge graph vector.

4. The entity classification method based on knowledge graphs according to claim 1, characterized in that, The step of using the knowledge graph vector corresponding to the domain name as input and the preset label corresponding to the domain name as output to train a neural network model to obtain an entity classification model includes: The knowledge graph vector corresponding to the domain name is used as the input, and the preset label corresponding to the domain name is used as the output to train the BiLSTM neural network. The trained BiLSTM neural network model is then used as the entity classification model.

5. A knowledge graph-based entity classification system, characterized in that, The system includes: a modeling module, a fusion module, a vectorization module, a training module, and a detection module; The establishment module is used to establish a DNS knowledge graph based on the hierarchical relationship and query resolution relationship of DNS, wherein the DNS knowledge graph includes at least one preset label corresponding to a domain name, and the preset label includes malicious and non-malicious; The fusion module is used to split the DNS knowledge graph into entities and relations, and fuse the entities and relations according to the entity attribute alignment method to obtain the fused DNS knowledge graph; The vectorization module is used to vectorize the entities and relationships of the fused DNS knowledge graph to obtain DNS knowledge graph vectors, wherein the DNS knowledge graph vectors include knowledge graph vectors corresponding to each domain name; The training module is used to train a neural network model by taking the knowledge graph vector corresponding to the domain name as input and the preset label corresponding to the domain name as output, so as to obtain an entity classification model. The detection module is used to classify and detect domain names according to the entity classification model; The establishment module is used for: Based on the hierarchical relationship of DNS, a DNS domain name hierarchy diagram is established, and the preset tags are added to the DNS domain name hierarchy diagram; Based on the DNS query resolution relationship, establish a DNS query response graph and a passive DNS graph; The DNS query response graph and the passive DNS graph are combined to establish a DNS flow graph, and the preset label is added to the DNS flow graph; The DNS domain name hierarchy graph and the DNS flow graph are combined using rule alignment to establish the DNS knowledge graph; The DNS knowledge graph includes at least one type of triples corresponding to domain names, and the vectorization module is used for: For each type of domain name, arbitrarily select the head entity of a triplet in that type of domain name as the starting node, and calculate the entity distance between the tail entity of the current triplet and the head entity of the first triplet. Determine whether the entity distance between the tail entity of the current triplet and the head entity of the first triplet is not greater than a preset entity distance; If the entity distance between the tail entity of the current triplet and the head entity of the first triplet is not greater than the preset entity distance, then the head entity of the first triplet is linked to the tail entity of the current triplet, and the first triplet is used as the current triplet. Repeat the current step until the head entity of the current triple is the starting node, to obtain the entity and relation of the domain name; Vectorize the entities and relationships corresponding to each domain name to obtain the knowledge graph vectors corresponding to each domain name; The first triplet is the triplet that is not linked in the triplet corresponding to this type of domain name; The vectorization module is further used for: Step 1: If the entity distance between the tail entity of the current triplet and the head entity of the first triplet is greater than the preset entity distance, then proceed to Step 2; Step 2: Replace the header entity of the first triplet with the header entity of the second triplet, sample the tail entity of the second triplet and replace the tail entity of the first triplet, and use the replaced first triplet as the negative sample triplet; the second triplet is any triplet that has been linked in this type of domain. Step 3: Determine whether the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is not greater than a preset entity distance; Step 4: If the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is not greater than the preset entity distance, then link the head entity of the negative sample triplet to the tail entity of the current triplet, and use the negative sample triplet as the current triplet. Step 5: If the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet is greater than the preset entity distance, return to step 2 and repeat steps 2 to 5 until the entity distance between the tail entity of the current triplet and the head entity of the negative sample triplet meets the preset entity distance.

6. A terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the knowledge graph-based entity classification method as described in any one of claims 1 to 4.

7. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the knowledge graph-based entity classification method as described in any one of claims 1 to 4.

Images