A method, apparatus, device, and medium for determining malicious domain names

Abstract

The embodiments of the present application provide a malicious domain name determination method, apparatus, device, and medium for improving the accuracy of malicious domain name determination. Since the electronic device determines each candidate IP address based on the IP addresses and domain names in a pre-stored blacklist, the electronic device also obtains sub-data of a preset type corresponding to the Netflow data of the candidate IP address within a preset time period, and extracts, through an embedded method, feature types corresponding to abnormal sub-data in the sub-data of the preset type corresponding to the candidate IP address, inputs the feature types into a recognition model, and obtains the output of the recognition model to determine whether the candidate IP address is a malicious IP address, thereby avoiding misidentification of malicious IP addresses. Based on the pre-stored correspondence between domain names and IP addresses, each domain name corresponding to each malicious IP address is determined to be a malicious domain name, thereby improving the accuracy of malicious domain name determination.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a method, apparatus, device and medium for determining a malicious domain name. Background Art

[0002] With the development of society, malicious domain names are appearing more and more frequently. Malicious domain names refer to a type of URL with malicious links. Such URLs usually exploit vulnerabilities in application software or browsers to implant malicious codes such as Trojans and virus programs into the website, and use disguised website service content to induce users to visit. If users use their computers to visit these websites, they may be "infected", causing their computers to be infected by malicious codes, which in turn causes security problems.

[0003] Based on the attack method of malicious domain names, web pages linked to malicious domains are divided into two categories: phishing websites and malware websites. Phishing websites are websites that disguise themselves as legitimate institutions such as banks or online stores, attempting to trick users into entering usernames, passwords, or other private information. These websites pose a threat to personal privacy and financial security. Malware websites contain malicious code that can be installed on users' computers, allowing hackers to exploit this software to obtain and transmit private or sensitive information.

[0004] Currently, only a few well-known malicious Internet Protocol (IP) addresses and well-known malicious domain names are known domestically and internationally. The existing method for determining malicious domain names simply uses well-known malicious IP addresses and well-known malicious domain names to match and determine the malicious domain names. However, the malicious domain names determined by this method are not accurate. Summary of the Invention

[0005] The embodiments of the present application provide a malicious domain name determination method, apparatus, device, and medium to improve the accuracy of malicious domain name determination.

[0006] In a first aspect, an embodiment of the present application provides a method for determining a malicious domain name, the method comprising:

[0007] Determine each candidate IP address based on the IP addresses in the pre-stored blacklist and the domain names in the blacklist;

[0008] For each candidate IP address, obtaining sub-data of a preset type corresponding to the network flow (Netflow) data of the candidate IP address within a preset time period, extracting feature types corresponding to abnormal sub-data in the sub-data of the preset type through an embedded method, inputting the feature types into a pre-trained recognition model, and obtaining an output from the recognition model as to whether the candidate IP address is a malicious IP address;

[0009] According to the pre-stored correspondence between domain names and IP addresses, each domain name corresponding to each determined malicious IP address is determined as a malicious domain name.

[0010] Furthermore, determining each candidate IP address based on the IP addresses in the pre-stored blacklist includes:

[0011] According to the correspondence between domain names and IP addresses in the pre-stored Domain Name Resolution Protocol DNS log, each candidate domain name corresponding to the IP address in the pre-stored blacklist is determined, and each candidate IP address corresponding to each candidate domain name is determined.

[0012] Furthermore, determining each candidate IP address based on the domain name in the pre-stored blacklist includes:

[0013] According to the correspondence between domain names and IP addresses in the pre-saved DNS log, each candidate IP address corresponding to the domain name in the blacklist is determined.

[0014] Furthermore, the method further comprises:

[0015] For each candidate IP address, perform the following steps in a loop:

[0016] Determine each candidate IP address and the corresponding domain name;

[0017] Determine the IP address corresponding to each domain name as a candidate IP address;

[0018] Until the IP address corresponding to each acquired domain name is a candidate IP address, or the domain name corresponding to each candidate IP address is acquired.

[0019] Furthermore, after determining each candidate IP address, before inputting the feature type into the recognition model and obtaining the output of the recognition model to determine whether the candidate IP address is a malicious IP address, the method further includes:

[0020] For each candidate IP address, determining the number of domain names corresponding to the candidate IP address as a first number, obtaining the domain name corresponding to the candidate IP address as a target domain name, determining each IP address corresponding to the target domain name, and counting a second number of each IP address that exists in the blacklist;

[0021] Determining a confidence level that the candidate IP address is a malicious IP address based on a ratio of the second number to the first number;

[0022] Inputting the feature type into the recognition model and obtaining whether the candidate IP address output by the recognition model is a malicious IP address includes:

[0023] The confidence level and the feature type corresponding to the candidate IP address are input into the recognition model to obtain whether the candidate IP address is a malicious IP address output by the recognition model.

[0024] In a second aspect, an embodiment of the present application further provides a malicious domain name determination device, the device comprising:

[0025] A determination module, configured to determine each candidate IP address based on the IP addresses in a pre-stored blacklist and the domain names in the blacklist;

[0026] A processing module is configured to obtain, for each candidate IP address, sub-data of a preset type corresponding to the Netflow data of the candidate IP address within a preset time period, extract, using an embedded method, feature types corresponding to abnormal sub-data in the sub-data of the preset type, input the feature types into a pre-trained recognition model, and determine, from the recognition model output, whether the candidate IP address is a malicious IP address;

[0027] The determination module is further configured to determine each domain name corresponding to each malicious IP address as a malicious domain name based on a pre-stored correspondence between domain names and IP addresses.

[0028] Furthermore, the determination module is specifically used to determine each candidate domain name corresponding to the IP address in the pre-saved blacklist based on the correspondence between the domain name and the IP address in the pre-saved domain name resolution protocol DNS log, and determine each candidate IP address corresponding to each candidate domain name.

[0029] Furthermore, the determination module is specifically configured to determine each candidate IP address corresponding to a domain name in the blacklist based on a correspondence between domain names and IP addresses in a pre-stored DNS log.

[0030] Furthermore, the determination module is also used to cyclically perform the following steps for each candidate IP address: determine each domain name corresponding to each candidate IP address; determine the IP address corresponding to each domain name as a candidate IP address; until the IP address corresponding to each acquired domain name is a candidate IP address, or the domain name corresponding to each candidate IP address is acquired.

[0031] Furthermore, the processing module is further configured to, for each candidate IP address, determine the number of domain names corresponding to the candidate IP address as a first number, obtain the domain name corresponding to the candidate IP address as a target domain name, determine each IP address corresponding to the target domain name, and count a second number of each IP address existing in the blacklist; and determine a confidence level that the candidate IP address is a malicious IP address based on a ratio of the second number to the first number;

[0032] The processing module is specifically used to input the confidence level corresponding to the candidate IP address and the feature type into the recognition model, and obtain whether the candidate IP address output by the recognition model is a malicious IP address.

[0033] In a third aspect, an embodiment of the present application further provides an electronic device, which includes at least a processor and a memory, and the processor is configured to execute the steps of any of the above-mentioned malicious domain name determination methods when executing a computer program stored in the memory.

[0034] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the steps of any of the above-mentioned methods for determining a malicious domain name.

[0035] In an embodiment of the present application, the electronic device determines each candidate IP address based on the IP addresses and domain names in a pre-stored blacklist. After determining each candidate IP address, the electronic device obtains, for each determined candidate IP address, sub-data of a preset type corresponding to the Netflow data of the candidate IP address within a preset time period, and extracts, through an embedded method, the feature type corresponding to the abnormal sub-data of the preset type of sub-data corresponding to the candidate IP address, and inputs the feature type into a pre-trained recognition model to obtain the output of the recognition model as to whether the candidate IP address is a malicious IP address. After obtaining each malicious IP address, the electronic device determines each domain name corresponding to each determined malicious IP address as a malicious domain name based on the pre-stored correspondence between the domain name and the IP address. Because in the embodiment of the present application, the electronic device determines each candidate IP address based on the IP addresses and domain names in the pre-stored blacklist. After determining each candidate IP address, the electronic device obtains sub-data of a preset type corresponding to the Netflow data of the candidate IP address within a preset time period, and extracts the feature type corresponding to the abnormal sub-data in the sub-data of the preset type corresponding to the candidate IP address through the Embedded method, inputs the feature type into the pre-trained recognition model, and obtains whether the candidate IP address output by the recognition model is a malicious IP address, thereby avoiding misidentification of malicious IP addresses, and according to the correspondence between the pre-stored domain name and the IP address, each domain name corresponding to each malicious IP address is determined as a malicious domain name, thereby improving the accuracy of malicious domain name determination. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0037] Figure 1 A schematic diagram of a malicious domain name determination process provided in an embodiment of the present application;

[0038] Figure 2 A schematic diagram of IP addresses in a blacklist provided in an embodiment of the present application;

[0039] Figure 3 A schematic diagram of a process for determining a candidate IP address provided in an embodiment of the present application;

[0040] Figure 4 A schematic diagram of a process for training an original recognition model provided in an embodiment of the present application;

[0041] Figure 5 A detailed schematic diagram of determining a malicious domain name provided in an embodiment of the present application;

[0042] Figure 6 A schematic diagram of the structure of a malicious domain name determination device provided in an embodiment of the present application;

[0043] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The present application will be further described in detail below with reference to the accompanying drawings. It is apparent that the embodiments described are only a portion of the embodiments of the present application, not all of them. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present application without creative effort are intended to fall within the scope of protection of the present application.

[0045] In an embodiment of the present application, the electronic device determines each candidate IP address based on the IP addresses and domain names in a pre-stored blacklist. After determining each candidate IP address, the electronic device obtains, for each determined candidate IP address, sub-data of a preset type corresponding to the Netflow data of the candidate IP address within a preset time period, and extracts, through an embedded method, the feature type corresponding to the abnormal sub-data of the preset type of sub-data corresponding to the candidate IP address, and inputs the feature type into a pre-trained recognition model to obtain the output of the recognition model as to whether the candidate IP address is a malicious IP address. After obtaining each malicious IP address, the electronic device determines each domain name corresponding to each determined malicious IP address as a malicious domain name based on the pre-stored correspondence between the domain name and the IP address.

[0046] In order to accurately determine malicious domain names, embodiments of the present application provide a malicious domain name determination method, apparatus, device, and medium. Example 1:

[0047] Figure 1 A schematic diagram of a malicious domain name determination process provided in an embodiment of the present application includes the following steps:

[0048] S101: Determine each candidate IP address based on the IP addresses and domain names in the pre-stored blacklist.

[0049] The malicious domain name determination method provided in the embodiment of the present application is applied to an electronic device, which may be a PC, a server or other device.

[0050] In an embodiment of the present application, in order to determine malicious domain names, a blacklist is pre-stored in the electronic device, and the blacklist includes IP addresses and domain names, wherein the IP addresses and domain names included in the blacklist are well-known and relatively fixed malicious IP addresses at home and abroad, and well-known and relatively fixed malicious domain names at home and abroad. The electronic device can determine each candidate IP address that may be a malicious IP address based on the IP addresses in the pre-stored blacklist and the domain names in the blacklist. Among them, the number of IP addresses included in the blacklist is not fixed, and may include one or more than one, and the number of domain names included in the blacklist is also not fixed. In an embodiment of the present application, the IP addresses and domain names in the blacklist can be referred to as precise threat intelligence seed data.

[0051] In an embodiment of the present application, the electronic device may locally store a correspondence between an IP address and a domain name. Based on the locally stored correspondence between the IP address and the domain name, the electronic device may determine each candidate IP address corresponding to the IP address and the domain name in the blacklist. It is worth noting that a certain IP address may correspond to multiple domain names, or there may not be a corresponding domain name, and a certain domain name may correspond to multiple IP addresses, or there may not be a corresponding IP address. Specifically, the electronic device may determine each IP address corresponding to a domain name in the blacklist as a candidate IP address, and determine each domain name corresponding to the IP address in the blacklist, and determine the IP address corresponding to each domain name as a candidate IP address.

[0052] For example, the domain name in the blacklist includes abcom, and the IP addresses corresponding to abcom are 1.1.1.2 and 1.1.1.3. Then the two IP addresses 1.1.1.2 and 1.1.1.3 are candidate IP addresses.

[0053] S102: For each candidate IP address, obtain sub-data of a preset type corresponding to the Netflow data of the candidate IP address within a preset time period, extract the feature type corresponding to the abnormal sub-data in the sub-data of the preset type through the Embedded method, input the feature type into a pre-trained recognition model, and obtain whether the candidate IP address is a malicious IP address as output by the recognition model.

[0054] After obtaining each candidate IP address, the electronic device determines whether each candidate IP address is a malicious IP address. Specifically, for each obtained candidate IP address, the electronic device obtains Netflow data for the candidate IP address within a preset time period, and obtains sub-data of a preset type corresponding to the Netflow data. The obtained sub-data of the preset type may include one or more of the following: uplink and downlink traffic packet ratios, commonly used ports, peer communication port ranges, and the number of bytes in uplink data packets. In the embodiments of the present application, how to obtain Netflow data for a specific IP address within a preset time period is a prior art and will not be further described here.

[0055] Among them, the Netflow data includes different feature types and sub-data corresponding to each feature type. In an embodiment of the present application, the electronic device can obtain sub-data of the corresponding type of preset type in the Netflow data. For example, if the preset type is the ratio of upstream and downstream traffic packets, the electronic device can obtain sub-data of the corresponding type of upstream and downstream traffic packets in the obtained Netflow data, and the sub-data can be a specific ratio value. For example, if the preset type is a commonly used port, the electronic device can obtain sub-data of the corresponding type of commonly used ports in the obtained Netflow data, and the sub-data is a specific port. For example, if the preset type is the range of peer communication ports, the electronic device can obtain sub-data of the corresponding type of peer communication port range in the obtained Netflow data, and the sub-data is a specific port range.

[0056] After obtaining the sub-data of the preset type corresponding to the Netflow data of each candidate IP address within the preset time period, the electronic device can extract the feature type corresponding to the abnormal sub-data in the sub-data of the preset type corresponding to the candidate IP address through the Embedded method for each candidate IP address. For example, the extracted feature type can be the ratio of uplink and downlink traffic packets. In the embodiment of the present application, the feature type corresponding to the abnormal sub-data from several types of sub-data is extracted through the Embedded method, which is a prior art and will not be repeated here. Among them, the determined feature type can be one or more of the ratio of uplink and downlink traffic packets, commonly used ports, the range of peer communication ports, and the number of bytes of uplink data packets.

[0057] In an embodiment of the present application, in order to further determine whether a candidate IP address is a malicious IP address, a pre-trained recognition model is pre-stored in the electronic device. For each candidate IP address, the electronic device determines the feature type corresponding to the abnormal sub-data of the candidate IP address, inputs the feature type corresponding to the candidate IP address into the recognition model, obtains the output of the recognition model, and the output of the recognition model is whether the candidate IP address is a malicious IP address. In this way, the electronic device can determine the malicious IP address in each candidate IP address.

[0058] For example, the candidate IP addresses obtained include 1.1.1.1, 1.1.1.2, and 1.1.1.3. The electronic device then obtains the sub-data of the uplink and downlink traffic packet ratios, the sub-data of the commonly used ports, the sub-data of the peer communication port range, and the sub-data of the number of bytes of uplink data packets corresponding to 1.1.1.1, 1.1.1.2, and 1.1.1.3 within the preset time period, and extracts the feature type corresponding to the abnormal sub-data in the obtained sub-data through the Embedded method. For each candidate IP address, the feature type corresponding to the candidate IP address is input into the pre-trained recognition model to obtain whether the candidate IP address output by the recognition model is a malicious IP address.

[0059] In an embodiment of the present application, it is not enough to only obtain the candidate IP address, and it is necessary to combine the preset type of sub-data for auxiliary analysis and judgment. In an embodiment of the present application, the preset type of sub-data corresponding to the candidate IP address is obtained, and the Embedded method is used to perform feature screening to obtain the corresponding feature type, and through the pre-trained recognition model, it is further identified whether the candidate IP address is a malicious IP address, thereby improving the accuracy of malicious IP address identification.

[0060] S103: According to the pre-stored correspondence between domain names and IP addresses, each domain name corresponding to each determined malicious IP address is determined as a malicious domain name.

[0061] In an embodiment of the present application, the electronic device pre-stores the correspondence between domain names and IP addresses. After determining each malicious IP address, the electronic device determines, for each malicious IP address, that each domain name corresponding to the malicious IP address is a malicious domain name based on the pre-stored correspondence between domain names and IP addresses. In this way, the electronic device can determine the malicious domain name corresponding to each malicious IP address.

[0062] Because in the embodiment of the present application, the electronic device determines each candidate IP address based on the IP addresses and domain names in the pre-stored blacklist. After determining each candidate IP address, the electronic device obtains sub-data of a preset type corresponding to the Netflow data of the candidate IP address within a preset time period, and extracts the feature type corresponding to the abnormal sub-data in the sub-data of the preset type corresponding to the candidate IP address through the Embedded method, inputs the feature type into the pre-trained recognition model, and obtains whether the candidate IP address output by the recognition model is a malicious IP address, thereby avoiding misidentification of malicious IP addresses, and according to the correspondence between the pre-stored domain name and the IP address, each domain name corresponding to each malicious IP address is determined as a malicious domain name, thereby improving the accuracy of malicious domain name determination. Example 2:

[0063] In order to determine each candidate IP address, based on the above embodiments, in the embodiment of the present application, the method of determining each candidate IP address according to the IP addresses in the pre-stored blacklist includes:

[0064] According to the correspondence between domain names and IP addresses in a pre-stored Domain Name System (DNS) log, each candidate domain name corresponding to an IP address in a pre-stored blacklist is determined, and the IP address corresponding to each candidate domain name is determined as a candidate IP address.

[0065] In actual application scenarios, in the correspondence between domain names and IP addresses, a domain name may correspond to multiple IP addresses, and a certain IP address may correspond to multiple domain names. Specifically, if a malicious domain name corresponds to a single IP address, the single IP address may be blocked, making the malicious domain name inaccessible. Malicious domain names may correspond to multiple IP addresses, and usually, in order to prevent malicious domain names from being detected, the offending party will continuously generate new domain names through methods such as the Domain Generation Algorithm (DGA) algorithm, so that multiple domain names corresponding to a certain IP address are all malicious domain names. In an embodiment of the present application, the electronic device can determine each candidate domain name corresponding to an IP address in the blacklist, and determine the IP address corresponding to each candidate domain name as a candidate IP address.

[0066] Specifically in an embodiment of the present application, a DNS log is pre-stored in the electronic device, and the DNS log stores the correspondence between domain names and IP addresses. The electronic device determines that each domain name corresponding to the IP address in the blacklist is a candidate domain name based on the correspondence between the domain name and the IP address in the DNS log. This step can be called IP DNS log inverse decoding. After obtaining each candidate domain name, the electronic device can determine that each IP address corresponding to the candidate domain name is a candidate IP address for each candidate domain name obtained based on the correspondence between the domain name and the IP address stored in the DNS log. In this way, the electronic device can determine each candidate IP address corresponding to each candidate domain name. This step can be called domain name DNS log resolution. Each candidate IP address may be a malicious IP address.

[0067] Specifically, in an embodiment of the present application, after obtaining each candidate IP address, since the IP addresses in the blacklist are malicious IP addresses, there is no need to determine whether the IP addresses in the blacklist are malicious IP addresses. Therefore, in an embodiment of the present application, the IP addresses in the blacklist among the candidate IP addresses are deleted.

[0068] For example, the IP address in the blacklist includes 1.1.1.1. The domain names corresponding to the IP address are abcom and cbcom. The IP addresses corresponding to abcom are 1.1.1.1 and 1.1.1.2, and the IP addresses corresponding to cbcom are 1.1.1.1 and 1.1.1.3. The corresponding candidate IP addresses are 1.1.1.2 and 1.1.1.3.

[0069] Figure 2 A schematic diagram of IP addresses in a blacklist provided in an embodiment of the present application.

[0070] Depend on Figure 2 It can be seen that the blacklist stores IP addresses, and the blacklist can store more than one IP address.

[0071] In this embodiment of the present application, after determining each malicious IP address, the electronic device can determine that each domain name corresponding to each malicious IP address is a malicious domain name based on the correspondence between the domain name and the IP address in the DNS log. Example 3:

[0072] In order to accurately determine each candidate IP address, based on the above embodiments, in the embodiment of the present application, the process of determining each candidate IP address based on the domain name in the pre-stored blacklist includes:

[0073] According to the correspondence between domain names and IP addresses in the pre-saved DNS log, each candidate IP address corresponding to the domain name in the blacklist is determined.

[0074] In an embodiment of the present application, for each domain name in the blacklist, the electronic device determines that each IP address corresponding to the domain name is a candidate IP address in the correspondence between the domain name and the IP address in the pre-saved DNS log. In this way, the electronic device can determine the candidate IP address corresponding to each domain name in the blacklist.

[0075] In an embodiment of the present application, among each candidate IP address corresponding to the domain name in the blacklist, there may be an IP address that is the same as the IP address in the blacklist. Since the IP address in the blacklist itself is a malicious IP address, in order to save time and improve efficiency, there is no need to determine whether it is a malicious IP address. Therefore, after obtaining each candidate IP address, the electronic device can delete each candidate IP address from the candidate IP addresses if the candidate IP address is the same as an IP address in the blacklist. Example 4:

[0076] In order to improve the accuracy of determining malicious IP addresses, based on the above embodiments, in the embodiment of the present application, the method further includes:

[0077] For each candidate IP address, perform the following steps in a loop:

[0078] Determine each candidate IP address and the corresponding domain name;

[0079] Determine the IP address corresponding to each domain name as a candidate IP address;

[0080] Until the IP address corresponding to each acquired domain name is a candidate IP address, or the domain name corresponding to each candidate IP address is acquired.

[0081] In actual application scenarios, some malicious IP addresses may correspond to non-malicious domain names, so it is necessary to use DNS logs to repeatedly resolve and obtain each candidate IP address. In order to prevent a candidate IP address from not being obtained, resulting in some malicious IP addresses not being obtained, in an embodiment of the present application, after the candidate IP address is obtained, the following steps are cyclically performed for each determined candidate IP address: according to the correspondence between the domain name and the IP address in the pre-saved DNS log, each domain name corresponding to each candidate IP address is determined, according to the correspondence between the domain name and the IP address in the DNS log, the IP address corresponding to each domain name is determined to be a candidate IP address, and it is judged whether the IP addresses corresponding to each obtained domain name are all candidate IP addresses, or the domain names corresponding to each candidate IP address are all obtained. If the IP addresses corresponding to each domain name are all candidate IP addresses, or the domain names corresponding to each candidate IP address are all obtained, there is no need to continue to determine the candidate IP addresses. If any IP address corresponding to each obtained domain name is not a candidate IP address, the IP address is determined as a candidate IP address, and each domain name corresponding to the IP address is determined; if there is a domain name corresponding to a determined candidate IP address that is not obtained, each IP address corresponding to the domain name is determined, and it is determined whether there is an IP address that is not a candidate IP address among each IP address.

[0082] Taking a domain name abcom in the blacklist as an example, the domain name is repeatedly resolved through the DNS log. The first abcom resolution obtains the IP addresses corresponding to the domain name as 1.1.1.1 and 1.1.1.2. These two IP addresses are used for reverse resolution to obtain the corresponding domain names abcom and cbcom. Since cbcom is a newly added domain name, the DNS log is continued to be used to resolve cbcom, and 1.1.1.2 and 1.1.1.3 are obtained. Since 1.1.1.3 is a newly added IP address, the IP address is continued to be reversed to obtain the corresponding domain names abcom and cbcom. If no new domain name appears, there is no need to continue to determine, and the determined candidate IP addresses are 1.1.1.1, 1.1.1.2, and 1.1.1.3.

[0083] Figure 3 A schematic diagram of a process for determining a candidate IP address provided in an embodiment of the present application includes the following steps:

[0084] in, Figure 3 The figure below is a schematic diagram of the process of determining each candidate IP address corresponding to a domain name in the blacklist.

[0085] S301: Determine each IP address corresponding to the domain name as a candidate IP address.

[0086] S302: Determine the domain name corresponding to each candidate IP address.

[0087] S303: Determine each IP address corresponding to each domain name.

[0088] S304: Determine whether each IP address is a candidate IP address. If so, execute S305; if not, execute S306.

[0089] S305: End.

[0090] S306: Determine each IP address as a candidate IP address, and obtain each newly added candidate IP address.

[0091] S307: Determine each domain name corresponding to each newly added candidate IP address.

[0092] S308: Determine whether there is a newly added domain name in each domain name. If yes, execute S303; if not, execute S305. Example 5:

[0093] In order to improve the accuracy of malicious IP address determination, based on the above embodiments, in an embodiment of the present application, after determining each candidate IP address, before inputting the feature type into the recognition model and obtaining the output of the recognition model as to whether the candidate IP address is a malicious IP address, the method further includes:

[0094] For each candidate IP address, determining the number of domain names corresponding to the candidate IP address as a first number, obtaining the domain name corresponding to the candidate IP address as a target domain name, determining each IP address corresponding to the target domain name, and counting a second number of each IP address that exists in the blacklist;

[0095] Determining a confidence level that the candidate IP address is a malicious IP address based on a ratio of the second number to the first number;

[0096] Inputting the feature type into the recognition model and obtaining whether the candidate IP address output by the recognition model is a malicious IP address includes:

[0097] The confidence level and the feature type corresponding to the candidate IP address are input into the recognition model to obtain whether the candidate IP address is a malicious IP address output by the recognition model.

[0098] In an embodiment of the present application, if only the feature type corresponding to a candidate IP address is input into the recognition model, and the recognition model outputs whether the candidate IP address is a malicious IP address, the result output by the recognition model may not be accurate. Therefore, in an embodiment of the present application, the electronic device determines the confidence level corresponding to each candidate IP address based on the number of domain names corresponding to the candidate IP address, and inputs the confidence level corresponding to the candidate IP address and the feature type corresponding to the candidate IP address into the recognition model, thereby further improving the accuracy of the recognition model in determining whether the IP address is a malicious IP address.

[0099] In an embodiment of the present application, after obtaining each candidate IP address, the electronic device determines each domain name corresponding to the candidate IP address based on the correspondence between the domain name and the IP address in the DNS log, and determines the number of each domain name as a first number. The electronic device also uses each domain name as a target domain name, determines each IP address corresponding to each target domain name based on the correspondence between the domain name and the IP address in the DNS log, and determines the number of each IP address in the blacklist as a second number. After determining the first number and the second number, the electronic device can obtain a ratio of the second number to the first number. The electronic device can determine the ratio as the confidence level corresponding to the candidate IP address, or the product of the ratio and a preset value as the confidence level corresponding to the candidate IP address. In an embodiment of the present application, the larger the second number, the more IP addresses in the blacklist corresponding to each target domain name corresponding to the candidate IP address, the greater the possibility that the candidate IP address is a malicious IP address, and the greater the corresponding confidence level. Therefore, the confidence level can increase the accuracy of the recognition model in identifying whether the IP address is a malicious IP address.

[0100] The formula for the confidence level of a candidate IP address of an electronic device is:

[0101] Score=100∗(Cevil / Ctotal)

[0102] Among them, Score refers to the confidence level corresponding to the candidate IP address, 100 refers to the preset value, Celvil refers to the second number, and Ctotal refers to the first number.

[0103] For each candidate IP address, after obtaining the confidence level corresponding to the candidate IP address being a malicious IP address and the feature type corresponding to the candidate IP address, the electronic device inputs the confidence level and feature type corresponding to the candidate IP address into a pre-trained recognition model and obtains the output of the recognition model. The output of the recognition model is whether the candidate IP address is a malicious IP address.

[0104] In an embodiment of the present application, when the electronic device determines whether a candidate IP address is a malicious IP address through a pre-trained recognition model, it determines it based on the confidence level and feature type corresponding to the candidate IP address, thereby increasing the diversity of the input information and further improving the accuracy of model recognition.

[0105] In an embodiment of the present application, when training the recognition model, a sample set is pre-stored in the electronic device, and a plurality of IP addresses are stored in the sample set, and each IP address is marked with whether it is a malicious IP address. The electronic device obtains, for each IP address in the sample set, sub-data of a preset type corresponding to the IP address within a preset time period, and extracts the feature type corresponding to the abnormal sub-data in the sub-data of the preset type through the embedding method, and determines the third number of domain names corresponding to the IP address, determines each domain name corresponding to the IP address, determines each IP address corresponding to each domain name, counts the fourth number of each IP address existing in the blacklist, determines the confidence that the IP address is a malicious IP address based on the ratio of the fourth number to the third number, inputs the confidence and the feature type into the original recognition model, obtains the output of the original recognition model as to whether the IP address is a malicious IP address, and trains the original recognition model based on the result output by the original recognition model and the pre-marked information of whether the IP address is a malicious IP address.

[0106] The recognition model is trained using the above method, and when preset conditions are met, a trained recognition model is obtained. The preset conditions may include: the number of training results obtained after training the original recognition model for the feature types and confidence levels corresponding to the IP addresses in the sample set, and the number of results indicating whether the IP addresses are malicious, that are consistent with a set number; or the number of iterations of training the original recognition model reaches a set maximum number of iterations. Specifically, the embodiments of the present application do not impose any restrictions on this.

[0107] Figure 4 A schematic diagram of the process of training an original recognition model provided in an embodiment of the present application.

[0108] Depend on Figure 4 It can be seen that when the original recognition model is trained, a sample set is saved, in which each IP address stores whether it is a malicious IP address. The electronic device determines the corresponding feature type and confidence for each IP address in the sample set, inputs the corresponding feature type and confidence into the original recognition model, obtains the result output by the original recognition model, and trains the original recognition model based on the result output by the original recognition model and the stored information for each IP address as to whether it is a malicious IP address.

[0109] Figure 5 A detailed schematic diagram of determining a malicious domain name provided in an embodiment of the present application includes the following steps:

[0110] in, Figure 5 The following example illustrates the process of first determining the confidence level corresponding to the candidate IP address and then determining the feature type corresponding to the IP address.

[0111] S501: Determine each candidate IP address based on the IP addresses and domain names in the pre-stored blacklist.

[0112] S502: For each candidate IP address, determine the number of domain names corresponding to the candidate IP address as a first number, obtain the domain name corresponding to the candidate IP address as a target domain name, determine each IP address corresponding to the target domain name, and count the second number of each IP address in the blacklist.

[0113] S503: For each candidate IP address, determine a ratio of the second number corresponding to the candidate IP address to the first number, which is the confidence level corresponding to the candidate IP address.

[0114] S504: Obtain sub-data of a preset type corresponding to each candidate IP address within a preset time period.

[0115] S505: Extracting the feature type corresponding to the abnormal sub-data in the sub-data of the preset type corresponding to each candidate IP address through the Embedded method.

[0116] S506: For each candidate IP address, input the feature type corresponding to the candidate IP address into a pre-trained recognition model, and obtain whether the candidate IP address is a malicious IP address output by the recognition model.

[0117] S507: Determine each malicious domain name corresponding to each malicious IP address based on the correspondence between the domain name and the IP address in the DNS log. Example 6:

[0118] Figure 6 A schematic diagram of the structure of a malicious domain name determination device provided in an embodiment of the present application, the device comprising:

[0119] Determination module 601, for determining each candidate IP address based on the IP addresses and domain names in the pre-stored blacklist;

[0120] Processing module 602 is configured to obtain, for each candidate IP address, sub-data of a preset type corresponding to the Netflow data of the candidate IP address within a preset time period, extract, using an embedded method, feature types corresponding to abnormal sub-data of the preset type, input the feature types into a pre-trained recognition model, and determine, from the recognition model output, whether the candidate IP address is a malicious IP address;

[0121] The determining module 601 is further configured to determine each domain name corresponding to each malicious IP address as a malicious domain name based on a pre-stored correspondence between domain names and IP addresses.

[0122] In a possible implementation, the determination module 601 is specifically used to determine each candidate domain name corresponding to the IP address in the pre-saved blacklist based on the correspondence between the domain name and the IP address in the pre-saved domain name resolution protocol DNS log, and determine each candidate IP address corresponding to each candidate domain name.

[0123] In a possible implementation, the determining module 601 is specifically configured to determine each candidate IP address corresponding to a domain name in the blacklist according to a correspondence between domain names and IP addresses in a pre-stored DNS log.

[0124] In a possible implementation, the determination module 601 is further configured to cyclically execute the following steps for each candidate IP address: determining each domain name corresponding to each candidate IP address; determining the IP address corresponding to each domain name as a candidate IP address; until the IP address corresponding to each acquired domain name is a candidate IP address, or the domain name corresponding to each candidate IP address is acquired.

[0125] In one possible implementation, the processing module 602 is further configured to, for each candidate IP address, determine the number of domain names corresponding to the candidate IP address as a first number, obtain the domain name corresponding to the candidate IP address as a target domain name, determine each IP address corresponding to the target domain name, and count a second number of each IP address that exists in the blacklist; and determine a confidence level that the candidate IP address is a malicious IP address based on a ratio of the second number to the first number.

[0126] The processing module 602 is specifically configured to input the confidence level and the feature type corresponding to the candidate IP address into a recognition model, and obtain information output by the recognition model as to whether the candidate IP address is a malicious IP address. Example 7:

[0127] Based on the above embodiments, Figure 7A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 7 As shown, it includes: a processor 701 , a communication interface 702 , a memory 703 and a communication bus 704 , wherein the processor 701 , the communication interface 702 and the memory 703 communicate with each other via the communication bus 704 .

[0128] The memory 703 stores a computer program. When the program is executed by the processor 701, the processor 701 performs the following steps:

[0129] Determine each candidate IP address based on the IP addresses in the pre-stored blacklist and the domain names in the blacklist;

[0130] For each candidate IP address, obtain sub-data of a preset type corresponding to the Netflow data of the candidate IP address within a preset time period, extract the feature type corresponding to the abnormal sub-data in the sub-data of the preset type through the embedded method, input the feature type into a pre-trained recognition model, and obtain the output of the recognition model to determine whether the candidate IP address is a malicious IP address;

[0131] According to the pre-stored correspondence between domain names and IP addresses, each domain name corresponding to each determined malicious IP address is determined as a malicious domain name.

[0132] Furthermore, the processor 701 is specifically used to determine each candidate domain name corresponding to the IP address in the pre-stored blacklist based on the correspondence between the domain name and the IP address in the pre-stored domain name resolution protocol DNS log, and determine each candidate IP address corresponding to each candidate domain name.

[0133] Furthermore, the processor 701 is specifically configured to determine each candidate IP address corresponding to a domain name in the blacklist according to a correspondence between domain names and IP addresses in a pre-stored DNS log.

[0134] Furthermore, the processor 701 is further configured to cyclically perform the following steps for each candidate IP address:

[0135] Determine each candidate IP address and the corresponding domain name;

[0136] Determine the IP address corresponding to each domain name as a candidate IP address;

[0137] Until the IP address corresponding to each acquired domain name is a candidate IP address, or the domain name corresponding to each candidate IP address is acquired.

[0138] Furthermore, the processor 701 is further configured to, for each candidate IP address, determine the number of domain names corresponding to the candidate IP address as a first number, obtain the domain name corresponding to the candidate IP address as a target domain name, determine each IP address corresponding to the target domain name, and count a second number of each IP address that exists in the blacklist;

[0139] Determining a confidence level that the candidate IP address is a malicious IP address based on a ratio of the second number to the first number;

[0140] The processor 701 is specifically configured to input the confidence level and the feature type corresponding to the candidate IP address into a recognition model, and obtain information output by the recognition model as to whether the candidate IP address is a malicious IP address.

[0141] The communication bus mentioned in the server above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into address buses, data buses, and control buses. For ease of illustration, the figure uses only a single thick line, but this does not mean that there is only one bus or only one type of bus.

[0142] The communication interface 702 is used for communication between the electronic device and other devices.

[0143] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage. Alternatively, the memory may be at least one storage device located away from the processor.

[0144] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; it can also be a digital signal processing processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc. Example 8:

[0145] Based on the above embodiments, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program executable by an electronic device. When the program is executed on the electronic device, the electronic device implements the following steps:

[0146] The memory stores a computer program, which, when executed by the processor, causes the processor to perform the following steps:

[0147] Determine each candidate IP address based on the IP addresses in the pre-stored blacklist and the domain names in the blacklist;

[0148] For each candidate IP address, obtain sub-data of a preset type corresponding to the Netflow data of the candidate IP address within a preset time period, extract the feature type corresponding to the abnormal sub-data in the sub-data of the preset type through the embedded method, input the feature type into a pre-trained recognition model, and obtain the output of the recognition model to determine whether the candidate IP address is a malicious IP address;

[0149] According to the pre-stored correspondence between domain names and IP addresses, each domain name corresponding to each determined malicious IP address is determined as a malicious domain name.

[0150] In a possible implementation, determining each candidate IP address based on the IP addresses in the pre-stored blacklist includes:

[0151] According to the correspondence between domain names and IP addresses in the pre-stored Domain Name Resolution Protocol DNS log, each candidate domain name corresponding to the IP address in the pre-stored blacklist is determined, and each candidate IP address corresponding to each candidate domain name is determined.

[0152] In a possible implementation, determining each candidate IP address based on a domain name in a pre-stored blacklist includes:

[0153] According to the correspondence between domain names and IP addresses in the pre-saved DNS log, each candidate IP address corresponding to the domain name in the blacklist is determined.

[0154] In one possible implementation, the method further includes:

[0155] For each candidate IP address, perform the following steps in a loop:

[0156] Determine each candidate IP address and the corresponding domain name;

[0157] Determine the IP address corresponding to each domain name as a candidate IP address;

[0158] Until the IP address corresponding to each acquired domain name is a candidate IP address, or the domain name corresponding to each candidate IP address is acquired.

[0159] In one possible implementation, after determining each candidate IP address and before inputting the feature type into a recognition model and obtaining an output from the recognition model indicating whether the candidate IP address is a malicious IP address, the method further includes:

[0160] For each candidate IP address, determining the number of domain names corresponding to the candidate IP address as a first number, obtaining the domain name corresponding to the candidate IP address as a target domain name, determining each IP address corresponding to the target domain name, and counting a second number of each IP address that exists in the blacklist;

[0161] Determining a confidence level that the candidate IP address is a malicious IP address based on a ratio of the second number to the first number;

[0162] Inputting the feature type into the recognition model and obtaining whether the candidate IP address output by the recognition model is a malicious IP address includes:

[0163] The confidence level and the feature type corresponding to the candidate IP address are input into the recognition model to obtain whether the candidate IP address is a malicious IP address output by the recognition model.

[0164] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0165] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0166] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0167] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0168] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for determining a malicious domain name, characterized in that: The method comprises: Determine each candidate IP address based on the IP addresses in the pre-stored blacklist and the domain names in the blacklist; For each candidate IP address, obtain sub-data of a preset type corresponding to the Netflow data of the candidate IP address within a preset time period, extract feature types corresponding to abnormal sub-data in the sub-data of the preset type through an embedded method, input the feature types into a pre-trained recognition model, and determine whether the candidate IP address is a malicious IP address from the output of the recognition model; According to the pre-stored correspondence between domain names and IP addresses, each domain name corresponding to each determined malicious IP address is determined as a malicious domain name; After determining each candidate IP address, and before inputting the feature type into the recognition model and obtaining the output of the recognition model as to whether the candidate IP address is a malicious IP address, the method further includes: For each candidate IP address, determining the number of domain names corresponding to the candidate IP address as a first number, obtaining the domain name corresponding to the candidate IP address as a target domain name, determining each IP address corresponding to the target domain name, and counting a second number of each IP address that exists in the blacklist; Determining a confidence level that the candidate IP address is a malicious IP address based on a ratio of the second number to the first number; Inputting the feature type into the recognition model and obtaining whether the candidate IP address output by the recognition model is a malicious IP address includes: The confidence level and the feature type corresponding to the candidate IP address are input into the recognition model to obtain whether the candidate IP address is a malicious IP address output by the recognition model.

2. The method according to claim 1, characterized in that Determining each candidate IP address based on the IP addresses in the pre-stored blacklist includes: According to the correspondence between domain names and IP addresses in the pre-stored Domain Name Resolution Protocol DNS log, each candidate domain name corresponding to the IP address in the pre-stored blacklist is determined, and each candidate IP address corresponding to each candidate domain name is determined.

3. The method according to claim 1, characterized in that Determining each candidate IP address based on the domain name in the pre-stored blacklist includes: According to the correspondence between domain names and IP addresses in the pre-saved DNS log, each candidate IP address corresponding to the domain name in the blacklist is determined.

4. The method according to claim 2 or 3, characterized in that The method further comprises: For each candidate IP address, perform the following steps in a loop: Determine each candidate IP address and the corresponding domain name; Determine the IP address corresponding to each domain name as a candidate IP address; Until the IP address corresponding to each acquired domain name is a candidate IP address, or the domain name corresponding to each candidate IP address is acquired.

5. A malicious domain name determination device, characterized in that: The device comprises: A determination module, configured to determine each candidate IP address based on the IP addresses in a pre-stored blacklist and the domain names in the blacklist; A processing module is configured to obtain, for each candidate IP address, sub-data of a preset type corresponding to the Netflow data of the candidate IP address within a preset time period, extract, using an embedded method, feature types corresponding to abnormal sub-data in the sub-data of the preset type, input the feature types into a pre-trained recognition model, and determine, from the recognition model output, whether the candidate IP address is a malicious IP address; The determination module is further configured to determine each domain name corresponding to each determined malicious IP address as a malicious domain name based on a pre-stored correspondence between domain names and IP addresses; The processing module is further configured to, for each candidate IP address, determine the number of domain names corresponding to the candidate IP address as a first number, obtain the domain name corresponding to the candidate IP address as a target domain name, determine each IP address corresponding to the target domain name, and count a second number of each IP address that exists in the blacklist; and determine a confidence level that the candidate IP address is a malicious IP address based on a ratio of the second number to the first number; The processing module is specifically used to input the confidence level corresponding to the candidate IP address and the feature type into the recognition model, and obtain whether the candidate IP address output by the recognition model is a malicious IP address.

6. The device according to claim 5, characterized in that The determination module is specifically used to determine each candidate domain name corresponding to the IP address in the pre-stored blacklist according to the correspondence between the domain name and the IP address in the pre-stored domain name resolution protocol DNS log, and determine each candidate IP address corresponding to each candidate domain name.

7. The device according to claim 5, characterized in that The determining module is specifically configured to determine each candidate IP address corresponding to a domain name in the blacklist based on a correspondence between domain names and IP addresses in a pre-stored DNS log.

8. An electronic device, characterized in that: The electronic device includes at least a processor and a memory, and the processor is configured to execute the steps of the malicious domain name determination method according to any one of claims 1 to 4 when executing a computer program stored in the memory.

9. A computer-readable storage medium, characterized in that It stores a computer program, which, when executed by a processor, performs the steps of the malicious domain name determination method according to any one of claims 1 to 4.

Images