A domain name detection method and device, electronic equipment, and storage medium

Abstract

This application discloses a domain name detection method, apparatus, electronic device, and storage medium. The method includes: acquiring a domain name to be predicted; calculating the perplexity value of the domain name to be predicted; determining whether the perplexity value of the domain name to be predicted is not less than a preset threshold; if the perplexity value of the domain name to be predicted is not less than the preset threshold, inputting the domain name to be predicted into a pre-trained classification network model to obtain the classification result of the domain name to be predicted; wherein, the classification network model includes at least an encoding network model and a fully connected classification layer; the classification network model is pre-trained by comparing the encoding network model with augmented data, and then trained using multiple normal domain names and multiple abnormal domain names; and feeding back the classification result of the domain name to be predicted. Therefore, by pre-judging the domain name using a preset threshold before predicting the domain name, the efficiency of domain name detection can be effectively improved, avoiding the problem of low detection efficiency.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and apparatus for detecting domain names, electronic devices, and storage media. Background Technology

[0002] With the continuous development of network technology, network security issues have become increasingly precarious. Hackers often use DGA to generate a large number of random domain names and communicate with the victim's host, thereby harming the victim's interests. Therefore, it is particularly important to detect DGA domain names.

[0003] Currently, three main methods are used to detect DGA domains. One is brute-force matching, which involves pre-establishing a DGA domain blacklist database. DGA domains can be obtained from open-source datasets, and when an accessed domain matches a domain in the blacklist, it is identified as a DGA domain. Another method is machine learning based on manually extracted features. This involves manually extracting features from the accessed domain and then using machine learning methods to calculate the detection result. A third method is a deep neural network approach that does not require manual feature extraction. The domain text is directly encoded and input into a multi-class neural network model for training, thus also obtaining the domain text detection result.

[0004] However, the blacklist established by the first method (credential stuffing matching) cannot cover all DGA domains, easily leading to omissions and poor detection results. For the second method, machine learning requires a large amount of labeled data, and manual annotation is also necessary, resulting in high labor and time costs, further contributing to low detection efficiency. For the third method, since DGA domains occur far less frequently than normal domains, and deep learning methods are computationally intensive and time-consuming, indiscriminately detecting every accessed domain will also lead to low detection efficiency. Summary of the Invention

[0005] In view of the shortcomings of the prior art, this application provides a domain name detection method and apparatus, electronic device and storage medium to solve the problem of low efficiency in detecting DGA domain names in the prior art.

[0006] To achieve the above objectives, this application provides the following technical solution:

[0007] The first aspect of this application provides a method for detecting domain names, including:

[0008] Obtain the domain name to be predicted;

[0009] Calculate the perplexity value of the domain name to be predicted;

[0010] Determine whether the perplexity value of the domain name to be predicted is not less than a preset threshold; wherein, the preset threshold is obtained in advance based on the perplexity values ​​of multiple normal domain names;

[0011] If it is determined that the perplexity value of the domain name to be predicted is not less than the preset threshold, then the domain name to be predicted is input into a pre-trained classification network model to obtain the classification result of the domain name to be predicted; wherein, the classification network model includes at least an encoding network model and a fully connected classification layer; the classification network model is pre-trained by comparing the encoding network model with augmented data, and then trained on the entire network model using multiple normal domain names and multiple abnormal domain names;

[0012] The classification results of the domain name to be predicted will be provided.

[0013] Optionally, in the above-described domain name detection method, the training method of the classification network model includes:

[0014] Construct the encoding network model and use the encoding network model as the classification network model;

[0015] Obtain multiple original domain names;

[0016] Each of the original domain names is enhanced to obtain each enhanced domain name corresponding to each original domain name;

[0017] Each of the original domain names and its corresponding enhanced domain names are input into the pre-trained language model to obtain the perplexity value of each of the original domain names and its corresponding perplexity value of each of the enhanced domain names.

[0018] Each target enhanced domain name that meets the preset conditions is selected based on the difference between the perplexity value of each original domain name and the perplexity value of each corresponding enhanced domain name.

[0019] Each pair of target augmented domain names is input into a pre-trained classification network model, and the latent vectors of each pair of target augmented domain names are obtained through the classification network model.

[0020] Based on the latent vectors of every two target augmented domain names, determine whether the contrastive loss function of the classification network model has converged;

[0021] If it is determined that the contrastive loss function of the classification network model has not converged, the parameters of the classification network model are adjusted, and the process is returned to inputting each pair of target augmentation domain names into the pre-trained classification network model to obtain the latent vectors of each pair of target augmentation domain names through the classification network model.

[0022] If it is determined that the contrastive loss function of the classification network model has converged, then a fully connected classification layer is added to the classification network model.

[0023] The classification network model is iteratively trained using multiple normal domain names and multiple abnormal domain names to obtain the trained classification network model.

[0024] Optionally, in the above-described domain name detection method, after filtering out each target enhanced domain name that meets the preset conditions based on the difference between the perplexity value of each original domain name and the perplexity value of each corresponding enhanced domain name, the method further includes:

[0025] Obtain a pre-built vocabulary;

[0026] Based on the vocabulary, the character length of each of the target enhanced domain names is numbered;

[0027] For each of the target enhanced domain names, determine whether the character length of the target enhanced domain name after the number is greater than a preset length;

[0028] If it is determined that the character length of the target enhanced domain name after the number is greater than the preset length, then the character length of the target enhanced domain name that is greater than the preset length is truncated;

[0029] If it is determined that the character length of the target enhanced domain name after the number is less than the preset length, then the character length of the target enhanced domain name is padded at the end until the preset length is met.

[0030] Optionally, in the above-described domain name detection method, after determining whether the perplexity value of the domain name to be predicted is not less than a preset threshold, the method further includes:

[0031] If the perplexity value of the domain name to be predicted is determined to be less than the preset threshold, then the domain name to be predicted is determined to be the normal domain name.

[0032] A second aspect of this application provides a domain name detection device, comprising:

[0033] The first acquisition unit is used to acquire the domain name to be predicted;

[0034] A calculation unit is used to calculate the perplexity value of the domain name to be predicted;

[0035] The first judgment unit is used to determine whether the perplexity value of the domain name to be predicted is not less than a preset threshold; wherein the preset threshold is obtained in advance based on the perplexity values ​​of multiple normal domain names;

[0036] The first input unit is configured to input the domain name to be predicted into a pre-trained classification network model if it is determined that the perplexity value of the domain name to be predicted is not less than the preset threshold, thereby obtaining the classification result of the domain name to be predicted; wherein the classification network model includes at least an encoding network model and a fully connected classification layer; the classification network model is pre-trained by comparing the encoding network model with augmented data, and then trained on the entire network model using multiple normal domain names and multiple abnormal domain names;

[0037] The feedback unit is used to provide the classification result of the domain name to be predicted.

[0038] Optionally, the domain name detection device described above further includes:

[0039] A construction unit is used to construct the encoding network model and use the encoding network model as the classification network model.

[0040] The second acquisition unit is used to acquire multiple original domain names;

[0041] An enhancement processing unit is used to perform enhancement processing on each of the original domain names to obtain each enhanced domain name corresponding to each of the original domain names;

[0042] The second input unit is used to input each of the original domain names and their corresponding enhanced domain names into the pre-trained language model to obtain the perplexity value of each of the original domain names and their corresponding perplexity value of each of the enhanced domain names.

[0043] The filtering unit is used to filter out each target enhanced domain name that meets the preset conditions based on the difference between the perplexity value of each original domain name and the perplexity value of each corresponding enhanced domain name.

[0044] The third input unit is used to input each pair of target augmented domain names into a pre-trained classification network model, and obtain the latent vectors of each pair of target augmented domain names through the classification network model.

[0045] The second judgment unit is used to determine whether the contrastive loss function of the classification network model has converged based on the latent vectors of every two target augmented domain names.

[0046] The adjustment unit is used to adjust the parameters of the classification network model if it is determined that the contrastive loss function of the classification network model has not converged, and return to the process of inputting each pair of target augmentation domain names into the pre-trained classification network model to obtain the latent vectors of each pair of target augmentation domain names through the classification network model.

[0047] An additional unit is added to the classification network model if it is determined that the contrastive loss function of the classification network model has converged;

[0048] The training unit is used to iteratively train the classification network model using multiple normal domain names and multiple abnormal domain names to obtain the trained classification network model.

[0049] Optionally, the domain name detection device described above further includes:

[0050] The third acquisition unit is used to acquire a pre-established vocabulary;

[0051] The numbering unit is used to number the character length of each of the target enhanced domain names based on the vocabulary;

[0052] The third judgment unit is used to determine, for each of the target enhanced domain names, whether the character length of the target enhanced domain name after the number is greater than a preset length;

[0053] The truncation unit is used to truncate the length of the target enhanced domain name that is longer than the preset length if it is determined that the character length of the target enhanced domain name after the number is greater than the preset length.

[0054] The padding unit is used to pad the end of the character length of the target enhanced domain name if it is determined that the character length of the target enhanced domain name after the number is less than the preset length, until the preset length is met.

[0055] Optionally, the domain name detection device described above further includes:

[0056] The determining unit is configured to determine the domain name to be predicted as the normal domain name if it is determined that the perplexity value of the domain name to be predicted is less than the preset threshold.

[0057] A third aspect of this application provides an electronic device, comprising:

[0058] Memory and processor;

[0059] The memory is used to store programs;

[0060] The processor is used to execute the program, which, when executed, is specifically used to implement a domain name detection method as described in any of the above.

[0061] The fourth aspect of this application provides a computer storage medium for storing a computer program, which, when executed, implements a domain name detection method as described in any of the preceding claims.

[0062] This application provides a domain name detection method. The method involves obtaining a domain name to be predicted, calculating its perplexity value, and then determining whether the perplexity value is not less than a preset threshold. This preset threshold is pre-determined based on the perplexity values ​​of multiple normal domain names. If the perplexity value of the domain name is determined to be not less than the preset threshold, the domain name is input into a pre-trained classification network model to obtain a classification result. The classification network model includes at least an encoding network model and a fully connected classification layer. The classification network model is pre-trained by comparing the encoding network model with augmented data, and then trained using multiple normal domain names and multiple abnormal domain names. Finally, the classification result of the domain name is fed back. By pre-judging the domain name using a preset threshold before prediction, the efficiency of domain name detection can be effectively improved, avoiding the problem of low detection efficiency, and achieving high-efficiency detection results without the need for extensive manual annotation. Attached Figure Description

[0063] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0064] Figure 1 A flowchart illustrating a domain name detection method provided in this application embodiment;

[0065] Figure 2 A flowchart illustrating a training method for a classification network model provided in an embodiment of this application;

[0066] Figure 3 A flowchart illustrating a method for quantifying a target enhanced domain name, as provided in an embodiment of this application;

[0067] Figure 4 A schematic diagram of a domain name detection device provided in another embodiment of this application;

[0068] Figure 5 This is a schematic diagram of the structure of an electronic device provided in another embodiment of this application. Detailed Implementation

[0069] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0070] In this application, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0071] This application provides a method for detecting domain names, such as... Figure 1 As shown, the specific steps include:

[0072] S101. Obtain the domain name to be predicted.

[0073] Optionally, after obtaining the domain name to be predicted, the top-level domain name can be discarded and its second-level domain name can be taken as the feature text. Furthermore, the uppercase letters in the feature text can be converted to lowercase letters to standardize the feature text, which can facilitate subsequent prediction processing.

[0074] S102. Calculate the perplexity value of the domain name to be predicted.

[0075] It should be noted that, in this embodiment of the application, before predicting the domain name to be predicted, it is determined whether the domain name is normal based on a pre-set perplexity value. Therefore, it is necessary to pre-calculate the perplexity value of the domain name to be predicted so that it can be directly processed later, thereby improving detection efficiency. Specifically, the domain name to be predicted is input into a pre-trained language model to calculate the perplexity value.

[0076] S103. Determine whether the confusion value of the domain name to be predicted is not less than the preset threshold.

[0077] The preset threshold is obtained based on the confusion value of multiple normal domain names.

[0078] It should be noted that since the language model is pre-trained based on normal domain names, if the perplexity value of the domain name to be detected calculated by the language model is relatively high, it indicates that the domain name to be detected is very likely to be an abnormal domain name, and therefore further detection is required. Therefore, in order to determine whether the domain name to be predicted is likely to be an abnormal domain name, in this embodiment of the application, it is necessary to determine whether the perplexity value of the domain name to be predicted is not less than a preset threshold. If it is determined that the perplexity value of the domain name to be predicted is not less than the preset threshold, it means that further detection of the domain name to be predicted is required, and therefore step S104 needs to be executed.

[0079] Optionally, the preset threshold can be the median of the confusion values ​​of multiple normal domain names. Of course, it can also be other domain names, and the specific threshold can be set according to the needs.

[0080] Optionally, in the application embodiment, after step S103, the method further includes:

[0081] If the perplexity value of the domain name to be predicted is determined to be less than the preset threshold, then the domain name to be predicted is determined to be a normal domain name.

[0082] Specifically, when it is determined that the domain name to be predicted is a normal domain name, it can be ensured that the domain name to be predicted will not affect the security of the network, and its communication with the server can be trusted.

[0083] S104. Input the domain name to be predicted into the pre-trained classification network model to obtain the classification result of the domain name to be predicted.

[0084] The classification network model can include an encoding network model and a fully connected classification layer. The classification network model is pre-trained by comparing the encoding network model with augmented data, and then trained on the entire network model using multiple normal domain names and multiple abnormal domain names.

[0085] Optionally, embodiments of this application provide a method for training a classification network model, such as... Figure 2 As shown, it includes the following steps:

[0086] S201. Construct a coding network model and use it as a classification network model.

[0087] Specifically, in the embodiments of this application, the coding network model is constructed by using a contrastive learning method to train unlabeled domain name data, thereby training the coding network model.

[0088] S202, Obtain multiple original domain names.

[0089] The original domain name can refer to a normal domain name, but since tagged abnormal domain names will be used for model training later, multiple tagged abnormal domain names can be obtained at the same time as multiple normal domain names.

[0090] S203. Perform enhancement processing on each original domain name to obtain each enhanced domain name corresponding to each original domain name.

[0091] It should be noted that augmenting the original data can generate new data from the existing data and effectively improve the accuracy and generalization ability of the model. Therefore, in this embodiment, data augmentation is used to process each original domain name. The specific augmentation method can be to delete a single character or swap the order of adjacent characters. Each augmentation only performs one deletion or order swap. Only after traversing all possible cases can the augmented domain names corresponding to the original domain names be obtained.

[0092] S204. Input each original domain name and its corresponding enhanced domain name into the pre-trained language model to obtain the perplexity value of each original domain name and its corresponding enhanced domain name.

[0093] It should be noted that the perplexity value describes the probability of a text sequence; the higher the probability, the lower the perplexity value. The specific formula for calculating the perplexity value is as follows:

[0094]

[0095] Where W is the domain name text sequence, and L is the sequence length. P(w1w2…w L Let be the sequence probability, and its formula is:

[0096] P(w1w2…w L )=p(w1)p(w2|w1)…p(w L |w1,w2,...,w L-1 )

[0097] Wherein, the conditional probability p(w) i |w1,w2,...,w i-1 The probability can be calculated using a language model constructed from a normal set of domain names. Optionally, the language model can be a statistical language model or a neural network language model, such as the N-gram model in statistical language models, where the probability calculation in the formula for sequence probability can be simplified to:

[0098] p(w1)p(w2|w1)…p(w i |w i-1 ,...,w i-n )…p(w L|w L-1 ,...,w L-n )

[0099] Where n can be 2 or 3, and the conditional probability is calculated statistically, with the specific formula as follows:

[0100]

[0101] Here, count represents the number of times the character appears in the domain name. It can calculate and save the probability of all n-character combinations and the confusion value of normal domain names.

[0102] S205. Based on the difference between the perplexity value of each original domain name and the perplexity value of each corresponding enhanced domain name, select each target enhanced domain name that meets the preset conditions.

[0103] It should be noted that, considering that not all perplexity values ​​of the original domains and their corresponding perplexity values ​​of the augmented domains can improve the training effect of the classification network model, in order to optimize the training effect of the classification model in this embodiment, each original domain and its corresponding augmented domain can be treated as a set of data. Then, the sum of the absolute differences between the perplexity values ​​of each set of original domains and their corresponding perplexity values ​​of the augmented domains can be calculated. Based on the sum of the absolute differences, each set of data is sorted, and the target augmented domains with the smallest sum of absolute differences are selected for subsequent training of the classification network model.

[0104] Optionally, in another embodiment of this application, after step S205, each target augmentation domain name needs to be quantized before being input into the model for training, thereby improving the model's processing efficiency. Figure 3 As shown, another embodiment of this application provides a method for quantifying a target enhanced domain name, including the following steps:

[0105] S301. Obtain the pre-established vocabulary.

[0106] Specifically, the vocabulary can include lowercase letters, numbers, connectors, etc.

[0107] S302. Based on the vocabulary, number the character length of each target enhanced domain name.

[0108] Specifically, the field lengths of the target enhanced domain name can be numbered according to the index in the thesaurus, making it easier to process them directly later, thereby improving processing efficiency.

[0109] S303. For each target enhanced domain name, determine whether the character length of the target enhanced domain name after the number is greater than the preset length.

[0110] It should be noted that, considering that the character length of some target enhanced domain names may be too long, and that a long target enhanced domain name may affect the efficiency of subsequent models, a preset length is pre-set in this embodiment. Then, it is determined whether the character length of the target enhanced domain name after the number is greater than the preset length. If it is determined that the character length of the target enhanced domain name after the number is greater than the preset length, step S304 is executed. If it is determined that the character length of the target enhanced domain name after the number is less than the preset length, step S305 is executed, thereby preventing the problem of the target enhanced domain name field length being too long or too short.

[0111] Optionally, the preset length is 48, but other thresholds are also possible; the specific setting can be determined according to requirements.

[0112] S304. Truncate the character length of the target augmented domain name that is longer than the preset length.

[0113] Specifically, for target enhanced domain names that are longer than the preset length, the portion of the characters exceeding the preset length is truncated.

[0114] S305. Fill in the character length backend of the target enhanced domain name until the preset length is met.

[0115] Specifically, for target enhanced domains that are shorter than the preset length, padding is done at the back using the number 0.

[0116] S206. Input each pair of target augmentation domain names into the pre-trained classification network model, and obtain the latent vectors of each pair of target augmentation domain names through the classification network model.

[0117] Specifically, the classification network model uses unsupervised learning based on a contrastive learning method with restricted data augmentation. Therefore, the input to the model consists of only two target augmented domains. However, two domains can be randomly selected from each target augmented domain corresponding to an original domain as input to the classification network model. It's worth noting that contrastive learning can learn internal domain features even without labels, thus rapidly improving detection performance even with limited labeled data.

[0118] It should also be noted that the classification network model contains an encoding module, namely the Bi-LSTM network. This encoding module generates the hidden vectors needed by the model, which are then used for training using the contrastive loss function. Specifically, the formula for calculating the contrastive loss function is:

[0119]

[0120] Where N is the batch data size. and The loss corresponding to the two enhanced domain names of the input network, For example, its calculation formula is as follows:

[0121]

[0122] Here, cos is used to calculate the cosine similarity between two vectors, and τ is a temperature coefficient used to adjust the degree of attention given to samples that are difficult to distinguish.

[0123] S207. Based on the latent vectors of every two target augmented domain names, determine whether the contrastive loss function of the classification network model has converged.

[0124] Specifically, the smaller the model's loss function, the better the model's robustness. Therefore, in this embodiment, it is necessary to determine whether the contrastive loss function of the classification network model has converged based on the latent vectors of every two target augmentation domains. If the contrastive loss function of the classification network model converges, it indicates that the model's training results have met the expected requirements, and therefore step S209 needs to be executed. If it is determined that the contrastive loss function of the classification network model has not converged, it indicates that the anomaly detection model needs to be iteratively trained, and step S208 is executed.

[0125] S208. Adjust the parameters of the classification network model.

[0126] It should be noted that when it is determined that the contrastive loss function of the classification network model has not converged, it is necessary to return to step S206 until the contrastive loss function of the classification network model achieves convergence.

[0127] S209. Add a fully connected classification layer to the classification network model.

[0128] Specifically, when the contrastive loss function of the classification network model converges, it means that the classification network model has been trained. At this point, it is only necessary to add a fully connected classification layer at the end of the model for supervised classification training, so as to accurately detect the domain name to be predicted and obtain the classification result of the domain name to be predicted.

[0129] S210. Iteratively train the classification network model using multiple normal domain names and multiple abnormal domain names to obtain a trained classification network model.

[0130] Specifically, during training, the trained classification network model uses labeled data for supervised iterative learning with cross-entropy loss.

[0131] S105. Feedback on the classification results of the domain names to be predicted.

[0132] Specifically, based on the classification results of the domain name to be predicted, it can be determined whether the domain name to be predicted is an abnormal domain name. If the classification result of the domain name to be predicted is an abnormal domain name, it can be dealt with immediately, thereby effectively protecting network security.

[0133] This application provides a domain name detection method. The method involves obtaining a domain name to be predicted, calculating its perplexity value, and then determining whether the perplexity value is not less than a preset threshold. This preset threshold is pre-determined based on the perplexity values ​​of multiple normal domain names. If the perplexity value of the domain name is determined to be not less than the preset threshold, the domain name is input into a pre-trained classification network model to obtain a classification result. The classification network model includes at least an encoding network model and a fully connected classification layer. The classification network model is pre-trained by comparing the encoding network model with augmented data, and then trained using multiple normal domain names and multiple abnormal domain names. Finally, the classification result of the domain name is fed back. By pre-judging the domain name using a preset threshold before prediction, the efficiency of domain name detection can be effectively improved, avoiding the problem of low detection efficiency, and achieving high-efficiency detection results without the need for extensive manual annotation.

[0134] Another embodiment of this application provides a domain name detection device, such as... Figure 4 As shown, it includes:

[0135] The first acquisition unit 401 is used to acquire the domain name to be predicted.

[0136] The calculation unit 402 is used to calculate the perplexity value of the domain name to be predicted.

[0137] The first judgment unit 403 is used to determine whether the confusion value of the domain name to be predicted is not less than a preset threshold.

[0138] The preset threshold is obtained based on the confusion value of multiple normal domain names.

[0139] The first input unit 404 is used to input the domain name to be predicted into a pre-trained classification network model if it is determined that the perplexity value of the domain name to be predicted is not less than a preset threshold, so as to obtain the classification result of the domain name to be predicted.

[0140] The classification network model includes at least an encoding network model and a fully connected classification layer. The classification network model is pre-trained by comparing the encoding network model with augmented data, and then trained on the entire network model using multiple normal domain names and multiple abnormal domain names.

[0141] Feedback unit 405 is used to provide feedback on the classification results of the domain name to be predicted.

[0142] It should be noted that the specific working process of the above-mentioned units in the embodiments of this application can be referred to steps S101 to S105 in the above method embodiments, and will not be repeated here.

[0143] Optionally, another embodiment of this application provides a domain name detection device that further includes:

[0144] The building block is used to construct the encoding network model and then use the encoding network model as the classification network model.

[0145] The second acquisition unit is used to acquire multiple original domain names.

[0146] The enhancement processing unit is used to enhance each original domain name to obtain the enhanced domain names corresponding to each original domain name.

[0147] The second input unit is used to input each original domain name and its corresponding enhanced domain name into the pre-trained language model to obtain the perplexity value of each original domain name and its corresponding enhanced domain name.

[0148] The filtering unit is used to filter out target enhanced domains that meet preset conditions based on the difference between the perplexity value of each original domain and the perplexity value of each corresponding enhanced domain.

[0149] The third input unit is used to input each pair of target augmentation domain names into the pre-trained classification network model, and obtain the latent vectors of each pair of target augmentation domain names through the classification network model.

[0150] The second judgment unit is used to determine whether the contrastive loss function of the classification network model has converged based on the latent vectors of every two target augmentation domains.

[0151] The adjustment unit is used to adjust the parameters of the classification network model if it is determined that the contrastive loss function of the classification network model has not converged, and then return to the pre-trained classification network model to input each pair of target augmentation domains into the classification network model to obtain the latent vectors of each pair of target augmentation domains.

[0152] An additional unit is added to the classification network model if the contrastive loss function of the classification network model is determined to be converged, in which case a fully connected classification layer is added.

[0153] The training unit is used to iteratively train the classification network model using multiple normal domain names and multiple abnormal domain names to obtain a trained classification network model.

[0154] It should be noted that the specific working process of each unit provided in the above embodiments of this application can be referred to the corresponding steps in the above method embodiments, and will not be repeated here.

[0155] Optionally, another embodiment of this application provides a domain name detection device that further includes:

[0156] The third acquisition unit is used to acquire a pre-established vocabulary.

[0157] Numbering units are used to number the character length of each target augmented domain name based on a vocabulary.

[0158] The third judgment unit is used to determine whether the character length of the target enhanced domain name after the number is greater than the preset length for each target enhanced domain name.

[0159] The truncation unit is used to truncate the characters of the target enhanced domain name that exceed the preset length if it is determined that the character length of the target enhanced domain name after the number is greater than the preset length.

[0160] The padding unit is used to pad the end of the target enhanced domain name's character length if it is determined that the character length of the target enhanced domain name after the number is less than the preset length, until the preset length is met.

[0161] It should be noted that the specific working process of each unit provided in the above embodiments of this application can be referred to the corresponding steps in the above method embodiments, and will not be repeated here.

[0162] Optionally, another embodiment of this application provides a domain name detection device that further includes:

[0163] The determination unit is used to determine that the domain name to be predicted is a normal domain name if the perplexity value of the domain name to be predicted is less than a preset threshold.

[0164] It should be noted that the specific working process of each unit provided in the above embodiments of this application can be referred to the corresponding steps in the above method embodiments, and will not be repeated here.

[0165] Another embodiment of this application provides an electronic device, such as... Figure 5 As shown, it includes:

[0166] Memory 501 and processor 502.

[0167] The memory 501 is used to store the program.

[0168] The processor 502 is used to execute a program, which, when executed, is specifically used to implement a domain name detection method as provided in any of the above embodiments.

[0169] Another embodiment of this application provides a computer storage medium for storing a computer program, which, when executed, implements a domain name detection method as provided in any of the above embodiments.

[0170] Computer storage media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0171] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0172] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting domain names, characterized in that, include: Obtain the domain name to be predicted; Calculate the perplexity value of the domain name to be predicted; Determine whether the perplexity value of the domain name to be predicted is not less than a preset threshold; wherein, the preset threshold is obtained in advance based on the perplexity values ​​of multiple normal domain names; If it is determined that the perplexity value of the domain name to be predicted is not less than the preset threshold, then the domain name to be predicted is input into a pre-trained classification network model to obtain the classification result of the domain name to be predicted; wherein, the classification network model includes at least an encoding network model and a fully connected classification layer; the classification network model is pre-trained by comparing the encoding network model with augmented data, and then trained on the entire network model using multiple normal domain names and multiple abnormal domain names; Feedback on the classification results of the domain name to be predicted; The training method for the classification network model includes: constructing the encoding network model and using the encoding network model as the classification network model; obtaining multiple original domain names; performing enhancement processing on each of the original domain names to obtain enhanced domain names corresponding to each original domain name; inputting each of the original domain names and their corresponding enhanced domain names into a pre-trained language model to obtain the perplexity value of each of the original domain names and their corresponding enhanced domain names; filtering out target enhanced domain names that meet preset conditions based on the difference between the perplexity values ​​of each of the original domain names and their corresponding enhanced domain names; inputting every two target enhanced domain names into the pre-trained classification network model, and then using the classification network model to perform the classification process. The classification network model obtains the latent vectors of every two target augmented domain names; based on the latent vectors of every two target augmented domain names, it is determined whether the contrastive loss function of the classification network model has converged; if it is determined that the contrastive loss function of the classification network model has not converged, the parameters of the classification network model are adjusted, and the process is returned to inputting every two target augmented domain names into the pre-trained classification network model to obtain the latent vectors of every two target augmented domain names; if it is determined that the contrastive loss function of the classification network model has converged, a fully connected classification layer is added to the classification network model; the classification network model is iteratively trained using multiple normal domain names and multiple abnormal domain names to obtain the trained classification network model.

2. The method according to claim 1, characterized in that, After filtering out target enhanced domains that meet preset conditions based on the difference between the perplexity values ​​of each original domain and the perplexity values ​​of their corresponding enhanced domains, the process further includes: Obtain a pre-built vocabulary; Based on the vocabulary, the character length of each of the target enhanced domain names is numbered; For each of the target enhanced domain names, determine whether the character length of the target enhanced domain name after the number is greater than a preset length; If it is determined that the character length of the target enhanced domain name after the number is greater than the preset length, then the character length of the target enhanced domain name that is greater than the preset length is truncated; If it is determined that the character length of the target enhanced domain name after the number is less than the preset length, then the character length of the target enhanced domain name is padded at the end until the preset length is met.

3. The method according to claim 1, characterized in that, After determining whether the perplexity value of the domain name to be predicted is not less than a preset threshold, the method further includes: If the perplexity value of the domain name to be predicted is determined to be less than the preset threshold, then the domain name to be predicted is determined to be the normal domain name.

4. A domain name detection device, characterized in that, include: The first acquisition unit is used to acquire the domain name to be predicted; A calculation unit is used to calculate the perplexity value of the domain name to be predicted; The first judgment unit is used to determine whether the perplexity value of the domain name to be predicted is not less than a preset threshold; wherein the preset threshold is obtained in advance based on the perplexity values ​​of multiple normal domain names; The first input unit is configured to input the domain name to be predicted into a pre-trained classification network model if it is determined that the perplexity value of the domain name to be predicted is not less than the preset threshold, thereby obtaining the classification result of the domain name to be predicted; wherein the classification network model includes at least an encoding network model and a fully connected classification layer; the classification network model is pre-trained by comparing the encoding network model with augmented data, and then trained on the entire network model using multiple normal domain names and multiple abnormal domain names; A feedback unit is used to provide the classification result of the domain name to be predicted; A construction unit is used to construct the encoding network model and use the encoding network model as the classification network model. The second acquisition unit is used to acquire multiple original domain names; An enhancement processing unit is used to perform enhancement processing on each of the original domain names to obtain each enhanced domain name corresponding to each of the original domain names; The second input unit is used to input each of the original domain names and their corresponding enhanced domain names into a pre-trained language model to obtain the perplexity value of each of the original domain names and their corresponding perplexity value of each of the enhanced domain names. The filtering unit is used to filter out each target enhanced domain name that meets the preset conditions based on the difference between the perplexity value of each original domain name and the perplexity value of each corresponding enhanced domain name. The third input unit is used to input each pair of target augmented domain names into a pre-trained classification network model, and obtain the latent vectors of each pair of target augmented domain names through the classification network model. The second judgment unit is used to determine whether the contrastive loss function of the classification network model has converged based on the latent vectors of every two target augmented domain names. The adjustment unit is used to adjust the parameters of the classification network model if it is determined that the contrastive loss function of the classification network model has not converged, and return to the process of inputting each pair of target augmentation domain names into the pre-trained classification network model to obtain the latent vectors of each pair of target augmentation domain names through the classification network model. An additional unit is added to the classification network model if it is determined that the contrastive loss function of the classification network model has converged; The training unit is used to iteratively train the classification network model using multiple normal domain names and multiple abnormal domain names to obtain the trained classification network model.

5. The apparatus according to claim 4, characterized in that, Also includes: The third acquisition unit is used to acquire a pre-established vocabulary; The numbering unit is used to number the character length of each of the target enhanced domain names based on the vocabulary; The third judgment unit is used to determine, for each of the target enhanced domain names, whether the character length of the target enhanced domain name after the number is greater than a preset length; The truncation unit is used to truncate the length of the target enhanced domain name that is longer than the preset length if it is determined that the character length of the target enhanced domain name after the number is greater than the preset length. The padding unit is used to pad the end of the character length of the target enhanced domain name if it is determined that the character length of the target enhanced domain name after the number is less than the preset length, until the preset length is met.

6. The apparatus according to claim 4, characterized in that, Also includes: The determining unit is configured to determine the domain name to be predicted as the normal domain name if it is determined that the perplexity value of the domain name to be predicted is less than the preset threshold.

7. An electronic device, characterized in that, include: Memory and processor; The memory is used to store programs; The processor is used to execute the program, which, when executed, is specifically used to implement a domain name detection method as described in any one of claims 1 to 3.

8. A computer storage medium, characterized in that, Used to store a computer program, which, when executed, is used to implement a domain name detection method as described in any one of claims 1 to 3.

Images