Training methods, systems, application methods, and systems of the DGA domain name detection model

Abstract

This invention relates to a training method, system, application method, and system for a DGA domain name detection model, belonging to the field of domain name detection technology. The training method includes: acquiring domain name data; dividing the domain name data according to characters to obtain a domain name character sequence; performing word segmentation on the domain name data to obtain a domain name word segmentation sequence; labeling each element in the domain name word segmentation sequence with semantic tags to obtain a semantic tag sequence; merging the domain name character sequence and the semantic tag sequence to obtain a domain name character expansion sequence; constructing a DGA domain name detection model based on a convolutional neural network and a long short-term memory neural network; determining a loss function based on the output of the DGA domain name detection model and the actual category of the domain name corresponding to the domain name character expansion sequence; optimizing the parameters of the DGA domain name detection model according to the loss function to train the DGA domain name detection model, thereby obtaining a trained DGA domain name detection model that can improve the accuracy and effectiveness of domain name detection.

Description

Technical Field

[0001] This invention relates to the field of domain name detection technology, and in particular to a training method, system, application method and system for a DGA domain name detection model. Background Technology

[0002] Domain Generation Algorithm (DGA) domains refer to malicious domains randomly generated according to a specific algorithm. These domains are typically used to build botnets and engage in other cyberattacks. Therefore, detecting DGA domains is essential. Currently, among DGA domain detection methods, those based on domain character features have gradually become a mainstream approach due to their low data dependency and fast response time. The overall process of this method can be divided into four parts: 1. Dividing the domain name into words or characters, with each part forming the input sequence; 2. Encoding the input sequence, using a pre-trained model or neural network word embedding layer to map each part of the domain name to corresponding word vectors; 3. Using deep learning networks such as Recurrent Neural Networks (RNNs) and Convolutional Neural Networks (CNNs) to further mine domain features; 4. Using a fully connected neural network with Softmax or Sigmoid as the activation function to map the high-dimensional features output by the model to label classification. After constructing a dataset consisting of DGA domains and legitimate domains, and training the model according to the above process, the model can then be used for DGA domain detection. However, this method has low detection accuracy and poor detection performance for DGA families generated based on word lists and for DGA families with short domain names (excluding the top-level domain, the remaining domain name is 5-10 characters long). Summary of the Invention

[0003] The purpose of this invention is to provide a training method, system, application method, and system for a DGA domain name detection model, which can improve the detection accuracy and effect of domain names, especially for DGA family domains generated based on a word list and DGA family domains with shorter domain names.

[0004] To achieve the above objectives, the present invention provides the following solution:

[0005] On the one hand, this invention proposes a training method for a DGA domain name detection model, the training method comprising:

[0006] Obtain domain name data, which includes DGA domain name data and legal domain name data. The DGA domain name data includes DGA family domain names generated based on a vocabulary list and DGA family domain names whose number of characters is less than a preset threshold.

[0007] The domain name data is divided into characters to obtain a domain name character sequence;

[0008] The domain name data is segmented into words to obtain a domain name segmentation sequence;

[0009] Each element in the domain name segmentation sequence is labeled with a semantic tag to obtain a semantic tag sequence;

[0010] The domain name character sequence is merged with the semantic tag sequence to obtain the domain name character extended sequence;

[0011] A DGA domain name detection model is constructed based on convolutional neural networks and long short-term memory neural networks. The DGA domain name detection model includes an input layer, a word embedding layer, multiple convolutional layers, a fully connected layer, an LSTM layer, and an output layer connected in sequence. The word embedding layer is used to encode the extended sequence of the input domain name characters to obtain the corresponding word vector matrix. The multiple convolutional layers, fully connected layers, and LSTM layers are used to extract domain name features from the word vector matrix. The output layer is used to output the domain name detection result based on the domain name features.

[0012] Input the domain name character extension sequence into the DGA domain name detection model;

[0013] The loss function is determined based on the output of the DGA domain name detection model and the actual category of the domain name corresponding to the domain name character extension sequence;

[0014] The parameters of the DGA domain name detection model are optimized according to the loss function to train the DGA domain name detection model and obtain a trained DGA domain name detection model.

[0015] Optionally, the step of dividing the domain name data according to characters to obtain a domain name character sequence specifically includes:

[0016] The domain name data is divided into individual characters to obtain a domain name character sequence X = (c1, c2, ..., c...). L ), where C L This represents the L-th element in the domain name character sequence, where L represents the domain name length.

[0017] Optionally, the step of performing word segmentation on the domain name data to obtain a domain name word segmentation sequence specifically includes:

[0018] The domain name data was segmented using the open-source wordninja word segmenter, resulting in a domain name segmentation sequence X' = (α1, α2, ..., α...). n ), where α n This represents the nth element in the domain name segmentation sequence.

[0019] Optionally, the step of labeling each element in the domain name segmentation sequence with semantic tags to obtain a semantic tag sequence specifically includes:

[0020] Based on the category of semantic tags, the domain name segmentation sequence X'=(α1,α2,...,α) is segmented. n Each element in the sequence is semantically labeled, and each element is labeled with a corresponding semantic label category, resulting in a semantic label sequence T = (t1, t2, ..., t...). n ), where t n This represents the nth element in the semantic tag sequence.

[0021] Optionally, the semantic tags include the following categories: number category, "-" separator, "." separator, single letter category, bi-gram category, and English word category, wherein the English word category includes noun category, verb category, adjective category, and other word categories.

[0022] Optionally, merging the domain name character sequence with the semantic tag sequence to obtain the domain name character extended sequence specifically includes:

[0023] Let the domain name character sequence X = (c1, c2, ..., c L ) and semantic label sequence T=(t1,t2,...,t n Concatenate all elements in ) to obtain the domain name character extension sequence X” = (c1, c2, ..., c L ,t1,t2,...,t n ), where C L This represents the L-th element in the domain name character sequence, where L represents the domain name length, and t n This represents the nth element in the semantic tag sequence.

[0024] Optionally, after obtaining the domain name data and before dividing the domain name data according to characters to obtain the domain name character sequence, the training method further includes:

[0025] Remove the top-level domain portion from each domain in the domain name data.

[0026] On the other hand, the present invention also proposes an application method for the DGA domain name detection model, the application method comprising:

[0027] Obtain the domain name data to be tested;

[0028] The domain name data to be tested is divided into characters to obtain the character sequence of the domain name to be tested;

[0029] The domain name data to be tested is segmented into words to obtain the word segmentation sequence of the domain name to be tested;

[0030] Each element in the word segmentation sequence of the domain name to be tested is labeled with a semantic tag to obtain the semantic tag sequence to be tested;

[0031] The character sequence of the domain name to be tested is merged with the semantic tag sequence to be tested to obtain the extended character sequence of the domain name to be tested;

[0032] The extended character sequence of the domain name to be tested is input into the DGA domain name detection model to obtain the domain name detection result of the domain name data to be tested. The DGA domain name detection model is a model trained by the training method of the DGA domain name detection model described above.

[0033] On the other hand, the present invention also proposes a training system for a DGA domain name detection model, the training system comprising:

[0034] The domain name data acquisition module is used to acquire domain name data, which includes DGA domain name data and legal domain name data. The DGA domain name data includes DGA family domain names generated based on a vocabulary list and DGA family domain names whose number of characters is less than a preset threshold.

[0035] The domain name character sequence acquisition module is used to divide the domain name data according to characters to obtain the domain name character sequence;

[0036] The domain name segmentation sequence acquisition module is used to perform segmentation processing on the domain name data to obtain the domain name segmentation sequence;

[0037] The semantic tag sequence acquisition module is used to label each element in the domain name segmentation sequence with semantic tags to obtain a semantic tag sequence;

[0038] The domain name character extension sequence acquisition module is used to merge the domain name character sequence with the semantic tag sequence to obtain the domain name character extension sequence;

[0039] The model building module is used to construct a DGA domain name detection model based on convolutional neural networks and long short-term memory neural networks. The DGA domain name detection model includes an input layer, a word embedding layer, multiple convolutional layers, a fully connected layer, an LSTM layer, and an output layer connected in sequence. The word embedding layer is used to encode the extended sequence of the input domain name characters to obtain the corresponding word vector matrix. The multiple convolutional layers, fully connected layers, and LSTM layers are used to extract domain name features from the word vector matrix. The output layer is used to output the domain name detection result based on the domain name features.

[0040] The first input module is used to input the domain name character extension sequence into the DGA domain name detection model;

[0041] The loss function determination module is used to determine the loss function based on the output of the DGA domain name detection model and the actual category of the domain name corresponding to the domain name character extension sequence.

[0042] The model training module is used to optimize the parameters of the DGA domain name detection model according to the loss function, so as to train the DGA domain name detection model and obtain the trained DGA domain name detection model.

[0043] On the other hand, the present invention also proposes an application system for a DGA domain name detection model, the application system comprising:

[0044] The domain name data acquisition module is used to acquire domain name data to be tested;

[0045] The domain name character sequence acquisition module is used to divide the domain name data to be tested according to characters to obtain the domain name character sequence to be tested;

[0046] The domain name segmentation sequence acquisition module is used to perform segmentation processing on the domain name data to be tested to obtain the domain name segmentation sequence;

[0047] The module for obtaining the semantic tag sequence to be tested is used to label each element in the word segmentation sequence of the domain name to be tested with semantic tags to obtain the semantic tag sequence to be tested.

[0048] The module for obtaining the character extension sequence of the domain name to be tested is used to merge the character sequence of the domain name to be tested with the semantic tag sequence to be tested to obtain the character extension sequence of the domain name to be tested.

[0049] The second input module is used to input the extended character sequence of the domain name to be tested into the DGA domain name detection model to obtain the domain name detection result of the domain name data to be tested. The DGA domain name detection model is a model trained by the training method of the DGA domain name detection model as described above.

[0050] According to specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0051] This invention provides a training method, system, application method, and system for a DGA domain name detection model, primarily addressing the low accuracy and poor performance of existing detection methods for DGA families generated from word lists and DGA families with short domain names. Specifically, for DGA families with short domain names, this invention constructs a semantic tag sequence by annotating each element in the domain name segmentation sequence with semantic tags. These semantic tags extend the sequence features of the characters themselves, mitigating the insufficient feature information caused by the short length of the DGA domain name and enhancing its character features, thereby improving the detection accuracy and performance for DGA families with short domain names. For DGA families generated from word lists, this invention merges the domain name character sequence with the semantic tag sequence to form a domain name character extension sequence. Based on the original character data of the domain name, semantic tags corresponding to the word segmentation are added. This combination of original character data and semantic tag data results in better detection accuracy and performance for DGA families generated from word lists, addressing the problem of low accuracy and poor detection performance for DGA families generated from word lists. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly described below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. The following drawings are not intentionally drawn to scale to actual size; their focus is on illustrating the main points of the present invention.

[0053] Figure 1 This is a flowchart of the training method for the DGA domain name detection model provided in Embodiment 1 of the present invention;

[0054] Figure 2 This is a schematic diagram of the training method for the DGA domain name detection model provided in Embodiment 1 of the present invention;

[0055] Figure 3 This is a schematic diagram of the structure of the DGA domain name detection model provided in Embodiment 1 of the present invention;

[0056] Figure 4 A flowchart of the application method of the DGA domain name detection model provided in Embodiment 2 of the present invention;

[0057] Figure 5 This is a structural diagram of the training system for the DGA domain name detection model provided in Embodiment 3 of the present invention;

[0058] Figure 6This is a structural diagram of the application system of the DGA domain name detection model provided in Embodiment 4 of the present invention. Detailed Implementation

[0059] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] As indicated in this invention and the claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" do not specifically refer to the singular and may also include the plural. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0061] This invention uses flowcharts to illustrate the operations performed by the system according to embodiments of the invention. It should be understood that the preceding or following operations are not necessarily performed precisely in sequence. Instead, various steps can be processed in reverse order or simultaneously, as needed. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0062] The DGA domain name detection method based on domain name character features is a detection method that uses individual character segmentation and word embedding granularity, and is based on character-level word embedding. However, this method is not ideal for detecting domains of DGA families generated from word lists, such as the bigviktor, matsnu, and suppobox families. These families use commonly used English words as word lists, randomly combining 2-4 words to generate domain names. Because these domains are composed entirely of normal English words, their character combination patterns are very similar to normal domain names, making them difficult to detect, resulting in low detection accuracy and poor performance. Furthermore, this method is also not ideal for DGA families that control the length of generated domain names very short, such as the conficker, nymaim, and virut families. Excluding the top-level domain, the remaining length of these families' domain names is mostly 5-10 characters, which provides very little character information, making accurate detection difficult and resulting in low detection accuracy and poor performance.

[0063] This invention provides a training method, system, application method, and system for a DGA domain name detection model. Its purpose is to accurately identify and determine the category of a given domain name, classifying it as a DGA domain or a legitimate domain. This invention improves the accuracy and effectiveness of domain name detection, especially for DGA family domains generated based on word lists and for DGA family domains with shorter domain lengths.

[0064] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0065] Example 1

[0066] like Figure 1 and Figure 2 As shown, this embodiment provides a training method for a DGA domain name detection model, which specifically includes the following steps:

[0067] Step S1: Obtain domain name data.

[0068] In this embodiment, the domain name data includes DGA domain name data and legal domain name data. The DGA domain name data includes DGA family domain names generated based on a word list, DGA family domain names with a number of characters less than a preset threshold, and other DGA family domain names.

[0069] In this context, domain names with fewer than the preset threshold number of characters refer to DGA family domain names with shorter lengths. Therefore, the preset threshold in this embodiment is 10. However, in general, the domain name length will still have at least 5 characters after removing the top-level domain. Therefore, this actually refers to DGA family domain names with a length of 5-10 characters after removing the top-level domain, such as the conficker, nymaim, and virut families.

[0070] Step S2: Divide the domain name data according to characters to obtain the domain name character sequence.

[0071] Step S3: Perform word segmentation on the domain name data to obtain a domain name word segmentation sequence.

[0072] Step S4: Label each element in the domain name segmentation sequence with a semantic tag to obtain a semantic tag sequence.

[0073] Step S5: Merge the domain name character sequence with the semantic tag sequence to obtain the domain name character extended sequence.

[0074] Step S6: Construct a DGA domain name detection model based on convolutional neural networks and long short-term memory neural networks.

[0075] Step S7: Input the domain name character extension sequence into the DGA domain name detection model.

[0076] Step S8: Determine the loss function based on the output of the DGA domain name detection model and the actual category of the domain name corresponding to the domain name character extension sequence. The actual category includes DGA domain names and legitimate domain names; that is, when acquiring domain name data, each domain name in the domain name data corresponds to a known actual category to determine whether the domain name to be detected belongs to a DGA domain name or a legitimate domain name, thereby completing the model training process.

[0077] Step S9: Optimize the parameters of the DGA domain name detection model according to the loss function to train the DGA domain name detection model and obtain the trained DGA domain name detection model.

[0078] In this embodiment, after obtaining domain name data in step S1 and before dividing the domain name data according to characters in step S2 to obtain the domain name character sequence, the training method further includes:

[0079] Remove the top-level domain portion from each domain in the domain name data.

[0080] Specifically, step S2 includes:

[0081] The domain name data is divided into individual characters to obtain a domain name character sequence X = (c1, c2, ..., c...). L ), where C L This represents the L-th element in the domain name character sequence, where L represents the domain name length.

[0082] Step S3 specifically includes:

[0083] The domain name data was segmented using the open-source wordninja word segmenter, resulting in a domain name segmentation sequence X′=(α1, α2, ..., α n ), where α n This represents the nth element in the domain name segmentation sequence.

[0084] Step S4 specifically includes:

[0085] Based on the category of semantic tags, the domain name segmentation sequence X′=(α1, α2, ..., α3) is segmented into words. n Each element in the sequence is semantically labeled, and each element is labeled with a corresponding semantic label category, resulting in a semantic label sequence T = (t1, t2, ..., t3). n ), where t n This represents the nth element in the semantic tag sequence.

[0086] The semantic tags include the following categories: number, "-" separator, "." separator, single letter, bigram, and English word, with the English word category including noun, verb, adjective, and other word categories.

[0087] Step S5 specifically includes:

[0088] Let the domain name character sequence X = (c1, c2, ..., c L ) and semantic label sequence T = (t1, t2, ..., t n Concatenate all elements in () to obtain the domain name character extension sequence X” = (c1, c2, ..., c L ,t1,t2,...,t n ), where C L This represents the L-th element in the domain name character sequence, where L represents the domain name length, and t n This represents the nth element in the semantic tag sequence.

[0089] In this embodiment, for a domain name, the top-level domain is first removed, and then the domain is segmented. Based on the segmentation results, semantic tags are applied to each part of the result. For domain name segmentation, since the domain name itself is in English and does not use spaces for separation, a word segmenter is required. This embodiment preferably uses the open-source wordninjja word segmenter to process the domain name, obtaining a domain name segmentation sequence. Then, semantic tags are applied to each part of the sequence. The semantic tags are divided into six categories, as shown in Table 1:

[0090] Table 1 Semantic Tag Categories

[0091]

[0092] For English words, they are further categorized according to their parts of speech, as shown in Table 2:

[0093] Table 2 English word classification

[0094] Semantic tags Part of speech Nouns This includes general nouns, personal pronouns, etc. Verbs verb Adjectives Including adjectives, adverbs, etc. Other word classes Including conjunctions, particles, and modal particles.

[0095] This results in nine semantic tags: numbers, '-' separators, '.' separators, single letters, bigrams, nouns, verbs, adjectives, and other words. In the case of English words having multiple parts of speech, this embodiment only selects the most common part of speech for each word as the semantic tag.

[0096] In this embodiment, the domain name data is divided into characters to obtain a domain name character sequence. This sequence is then concatenated with the semantic tag sequence obtained from domain name segmentation and annotation to obtain a domain name character extension sequence. Using this extension sequence as input data, the corresponding word vectors are encoded through the word embedding layer of the DGA domain name detection model, thus obtaining a word vector matrix. The word vector matrix obtained by encoding the domain name character extension sequence is then input into a subsequent neural network layer. This neural network layer extracts and perceives the local and global features of the vector matrix, and trains the model based on the extracted features.

[0097] like Figure 3 As shown, this embodiment constructs a DGA domain name detection model based on convolutional neural networks and long short-term memory neural networks. The DGA domain name detection model includes an input layer, a word embedding layer, multiple convolutional layers, a fully connected layer, an LSTM layer, and an output layer connected in sequence. The word embedding layer is used to encode the extended sequence of the input domain name characters to obtain the corresponding word vector matrix. The multiple convolutional layers, fully connected layers, and LSTM layers are used to extract domain name features from the word vector matrix. The output layer is used to output the domain name detection result based on the domain name features. A max pooling layer is set after each convolutional layer, and a Dense layer is set between the LSTM layer and the output layer. The Dense layer is used to non-linearly transform the previously extracted features, extract the correlation between these features, and map the correlation between features onto the output layer.

[0098] In this embodiment, the multiple convolutional layers, max pooling layers, fully connected layers, LSTM layers, and Dense layers are collectively referred to as neural network layers. After the input domain name data to be detected is output from the word embedding layer, multiple parallel convolutional layers with different kernel sizes first perform N-gram feature extraction. Then, the data is input to the LSTM layer for further sequence feature extraction, finally yielding the domain name classification output. By using a DGA domain name detection model based on convolutional neural networks and long short-term memory neural networks, with the activation function set to Softmax or Sigmoid, the probabilities of each category calculated by the neural network are converted into specific classification results for output, thereby determining whether the domain name to be detected belongs to a DGA domain or a legitimate domain.

[0099] This invention starts with the character data provided by the domain name itself, and further mines it to obtain semantic tag sequence data. This data, together with the original domain name character sequence data, serves as input data, thereby providing additional domain name features. This enhances the relevant features provided by the domain name characters themselves, improving the detection accuracy and effectiveness of DGA domain names.

[0100] To verify the effectiveness of this invention, the following experimental examples are provided:

[0101] This embodiment uses the domain name data publicly available from 360Netlab as DGA domain name data, and the top 1M domain names from Alexa statistics as legitimate domain name data. Some DGA families have a small number of domain names, so some DGA families with a small number of samples were removed. Finally, a total of 39 DGA families and 1,458,860 domain name data were obtained, as shown in Table 3.

[0102] Table 3. Specific Composition of Domain Name Families

[0103]

[0104]

[0105] To balance the number of positive and negative samples, a portion of the DGA family domains (banjori and emottet families) were randomly selected according to their proportion, ensuring a consistent number of positive and negative samples. Finally, the data from each DGA family and the normal domains were divided into training, validation, and test sets in a 6:2:2 ratio.

[0106] In this embodiment, two sets of experiments were designed on the constructed dataset. The first set of experiments was a binary classification experiment for DGA domain name detection, and the second set of experiments was a multi-classification experiment for domain name families. Precision, recall, and F1 score were used as the experimental evaluation metrics.

[0107] In the experiments, the data was first preprocessed. In the binary classification experiment, DGA domains were labeled as 1 (positive samples), and normal domains from the Alexa dataset were labeled as 0 (negative samples). In the multi-class classification experiment, the domain labels in the DGA dataset were the corresponding DGA family fields, with 1-39 as the corresponding classification labels. The labels for normal domains in the Alexa dataset were the Alexa family, with 0 as the classification label. Then, the domain names were divided into individual character units, and word segmentation was performed. Semantic labels were added to each part, and the semantic labels and characters formed multi-dimensional features, generating extended sequences of domain names. The length of each domain name sequence was standardized, and zero vectors were used to pad the vectors to the set standard length. A dictionary was generated for the characters and semantic labels, and finally, each part of the extended domain name sequence was mapped to word vectors.

[0108] The comparative models used in this embodiment are a separate LSTM model and a CNN model.

[0109] The experimental results of binary classification of DGA domains are shown in Table 4. The two comparison models are denoted as LSTM and CNN, respectively. After adding semantic sequences, the models are denoted as LSTM-TAG and CNN-TAG. 0 represents normal domains and 1 represents DGA domains.

[0110] Table 4 Results of the binary classification experiment

[0111]

[0112] As shown in Table 4, all of the above models can achieve good detection results. After adding semantic label data and the original character data to form an extended sequence as input, the models have achieved better detection results in binary classification tasks.

[0113] The experimental results of this embodiment on the multi-classification of domain name families for DGA domains are shown in Tables 5 and 6:

[0114] Table 5. Results of the multi-classification experiment of domain name families (1)

[0115]

[0116]

[0117] Table 6. Results of the multi-classification experiment of domain name families (2)

[0118]

[0119] By comparing the results of the two algorithms on multi-class classification tasks with and without semantically labeled data, it can be seen that after adding semantically labeled data to the domain name data, the micro-average precision, micro-average recall, and micro-average F1 score of the two algorithms are improved to varying degrees. Therefore, it can be concluded that the method of adding semantically labeled data to the domain name data proposed in this invention can improve the multi-class classification performance of the model globally.

[0120] Furthermore, based on the method and comparison model proposed in this invention, the detection performance of the previously mentioned, more difficult-to-detect DGA family was compared. The experimental results are shown in Table 7:

[0121] Table 7. Experimental Results of DGA Family Detection

[0122]

[0123]

[0124] The experimental results show that the improved algorithm proposed in this invention performs well in most indicators and can effectively improve the detection effect of two types of DGA domains with high concealment and high harm: DGA family generated based on word list and DGA family with short domain name length.

[0125] Correspondingly, the following are the experimental results of detection using only the CNN-LSTM model without using the method of merging the domain name character sequence and semantic tag sequence of this invention:

[0126] Table 8. Binary classification results of the CNN-LSTM model

[0127]

[0128] Table 9. Experimental results of the CNN-LSTM model for multi-class classification (1)

[0129]

[0130]

[0131] Table 10 Experimental results of the CNN-LSTM model for multi-class classification (2)

[0132]

[0133] Table 11 Experimental results of DGA family detection using the CNN-LSTM model

[0134]

[0135] As shown in Tables 8 to 11, the CNN-LSTM model itself does not outperform the CNN and LSTM models overall in terms of detection performance, but it does achieve better results on some difficult-to-detect malicious domains. The detection performance of the CNN-LSTM model is also improved overall after adding semantic labels.

[0136] For DGA families with relatively short domain names, this invention constructs a semantic tag sequence by annotating each element in the domain name segmentation sequence with semantic tags. These semantic tags extend the sequence features of the characters themselves. Since domain names are not composed of words, after segmentation, they are mostly decomposed into commonly used two-letter groups, single letters, and numbers stored in the segmentation dictionary. By incorporating sequence analysis of these semantic tags, the problem of insufficient feature information caused by the short length of DGA domain names can be addressed to some extent, enhancing their character features and thus improving the detection accuracy and performance for DGA families with short domain names. Simultaneously, this invention merges the domain name character sequence with the semantic tag sequence to form a domain name character extension sequence. Based on the original character data of the domain name, semantic tags corresponding to the segmented domain name are added. This combination of original character data and semantic tag data allows the model to achieve better detection accuracy and performance for DGA families generated based on word lists, thus addressing to some extent the problem of low recognition accuracy and poor detection performance for DGA family domain names generated based on word lists.

[0137] Meanwhile, compared with the DGA domain name detection method based on word-level word embedding, the present invention does not rely on the pre-trained model trained on external corpus, has less data dependence, and since it does not use a large pre-trained model, the training cycle of the entire DGA domain name detection model is also shorter, the computing power requirement of the training environment is also lower, the training efficiency is higher, and the training effect is better.

[0138] Example 2

[0139] This embodiment proposes an application method for the DGA domain name detection model. This application method corresponds to the application method of the DGA domain name detection model trained in Embodiment 1, such as... Figure 4 As shown, the application method includes:

[0140] Step A1: Obtain the domain name data to be tested;

[0141] Step A2: Divide the domain name data to be tested into characters to obtain the character sequence of the domain name to be tested;

[0142] Step A3: Perform word segmentation on the domain name data to be tested to obtain the word segmentation sequence of the domain name to be tested;

[0143] Step A4: Label each element in the word segmentation sequence of the domain name to be tested with a semantic tag to obtain the semantic tag sequence to be tested;

[0144] Step A5: Merge the character sequence of the domain name to be tested with the semantic tag sequence to be tested to obtain the extended character sequence of the domain name to be tested;

[0145] Step A6: Input the extended character sequence of the domain name to be tested into the DGA domain name detection model to obtain the domain name detection result of the domain name data to be tested. The DGA domain name detection model is a model trained according to the training method of the DGA domain name detection model described in Example 1.

[0146] Example 3

[0147] Corresponding to the training method of the DGA domain name detection model in Example 1, this example proposes a training system for the DGA domain name detection model, such as... Figure 5 As shown, the training system includes:

[0148] Domain data acquisition module M1 is used to acquire domain data, which includes DGA domain data and legal domain data. The DGA domain data includes DGA family domains generated based on a word list and DGA family domains whose number of characters is less than a preset threshold.

[0149] The domain name character sequence acquisition module M2 is used to divide the domain name data according to characters to obtain the domain name character sequence;

[0150] The domain name segmentation sequence acquisition module M3 is used to perform segmentation processing on the domain name data to obtain the domain name segmentation sequence;

[0151] The semantic tag sequence acquisition module M4 is used to label each element in the domain name segmentation sequence with semantic tags to obtain a semantic tag sequence.

[0152] The domain character extension sequence acquisition module M5 is used to merge the domain character sequence with the semantic tag sequence to obtain the domain character extension sequence;

[0153] The model building module M6 is used to construct a DGA domain name detection model based on convolutional neural networks and long short-term memory neural networks. The DGA domain name detection model includes an input layer, a word embedding layer, multiple convolutional layers, a fully connected layer, an LSTM layer, and an output layer connected in sequence. The word embedding layer is used to encode the extended sequence of the input domain name characters to obtain the corresponding word vector matrix. The multiple convolutional layers, fully connected layers, and LSTM layers are used to extract domain name features from the word vector matrix. The output layer is used to output the domain name detection result based on the domain name features.

[0154] The first input module M7 is used to input the domain name character extension sequence into the DGA domain name detection model;

[0155] The loss function determination module M8 is used to determine the loss function based on the output of the DGA domain name detection model and the actual category of the domain name corresponding to the domain name character extension sequence.

[0156] The model training module M9 is used to optimize the parameters of the DGA domain name detection model according to the loss function, so as to train the DGA domain name detection model and obtain the trained DGA domain name detection model.

[0157] Example 4

[0158] Corresponding to the application method of the DGA domain name detection model in Example 2, this example proposes an application system for the DGA domain name detection model, such as... Figure 6 As shown, the application system includes:

[0159] The domain name data acquisition module N1 is used to acquire domain name data to be detected;

[0160] The domain name character sequence acquisition module N2 is used to divide the domain name data to be tested according to characters to obtain the domain name character sequence to be tested;

[0161] The domain name segmentation sequence acquisition module N3 is used to perform segmentation processing on the domain name data to be tested to obtain the domain name segmentation sequence;

[0162] The module N4 for obtaining the semantic tag sequence to be tested is used to label each element in the word segmentation sequence of the domain name to be tested with semantic tags to obtain the semantic tag sequence to be tested.

[0163] The domain name character extension sequence acquisition module N5 is used to merge the domain name character sequence to be tested with the semantic tag sequence to be tested to obtain the domain name character extension sequence to be tested.

[0164] The second input module N6 is used to input the extended character sequence of the domain name to be tested into the DGA domain name detection model to obtain the domain name detection result of the domain name data to be tested. The DGA domain name detection model is a model trained by the training method of the DGA domain name detection model as described above.

[0165] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. It should also be understood that terms such as those defined in a common dictionary shall be interpreted as having a meaning consistent with their meaning in the context of the relevant art, and not as having an idealized or highly formalized meaning, unless expressly defined herein.

[0166] The foregoing description is illustrative of the invention and should not be construed as limiting it. Although several exemplary embodiments of the invention have been described, those skilled in the art will readily understand that many modifications can be made to the exemplary embodiments without departing from the novel teachings and advantages of the invention. Therefore, all such modifications are intended to be included within the scope of the invention as defined in the claims. It should be understood that the foregoing description is illustrative of the invention and should not be construed as limiting it to the specific embodiments disclosed, and modifications to the disclosed embodiments and other embodiments are intended to be included within the scope of the appended claims. The invention is defined by the claims and their equivalents.

Claims

1. A training method for a DGA domain name detection model, characterized in that, The training method includes: Obtain domain name data, which includes DGA domain name data and legal domain name data. The DGA domain name data includes DGA family domain names generated based on a word list and DGA family domain names with a number of characters less than a preset threshold. The preset threshold is 10. The DGA family domain names with a number of characters less than the preset threshold are DGA family domain names with a length of 5-10 characters after removing the top-level domain. The DGA family domain names generated based on a word list are DGA family domain names generated by randomly combining 2-4 words from a word list commonly used in daily life. The domain name data is divided into character sequences to obtain a domain name character sequence. Specifically, the domain name data is divided into individual character sequences X = (c1, c2, ..., c...). L ), where C L This represents the L-th element in the domain name character sequence, where L represents the domain name length. The domain name data is segmented to obtain a domain name segmentation sequence. Specifically, the open-source wordninja word segmenter is used to segment the domain name data, resulting in a domain name segmentation sequence X' = (α1, α2, ..., α...). n ), where α n This represents the nth element in the domain name segmentation sequence; Each element in the domain name segmentation sequence is labeled with a semantic tag to obtain a semantic tag sequence, wherein the domain name segmentation sequence X'=(α1,α2,...,α) is classified according to the category of the semantic tag. n Each element in the sequence is semantically labeled, and each element is labeled with a corresponding semantic label category, resulting in a semantic label sequence T = (t1, t2, ..., t...). n ), where t n This represents the nth element in the semantic tag sequence; the categories of the semantic tags include: number class, "-" separator, "." separator, single letter class, bi-gram class, and English word class, wherein the English word class includes noun class, verb class, adjective class, and other word classes; The domain name character sequence is merged with the semantic tag sequence to obtain the domain name character extension sequence, wherein the domain name character sequence X = (c1, c2, ..., c L ) and semantic label sequence T=(t1,t2,...,t n Concatenate all elements in ) to obtain the domain name character extension sequence X” = (c1, c2, ..., c L ,t1,t2,...,t n ), where C L This represents the L-th element in the domain name character sequence, where L represents the domain name length, and t n This represents the nth element in the semantic tag sequence; After obtaining the domain name data and before dividing the domain name data according to characters to obtain the domain name character sequence, the training method further includes: removing the top-level domain part from each domain name in the domain name data; A DGA domain name detection model is constructed based on convolutional neural networks and long short-term memory neural networks. The DGA domain name detection model includes an input layer, a word embedding layer, multiple convolutional layers, a fully connected layer, an LSTM layer, and an output layer connected in sequence. The word embedding layer is used to encode the extended sequence of the input domain name characters to obtain the corresponding word vector matrix. The multiple convolutional layers, fully connected layers, and LSTM layers are used to extract domain name features from the word vector matrix. The output layer is used to output the domain name detection result based on the domain name features. A max pooling layer is set after each convolutional layer. A Dense layer is set between the LSTM layer and the output layer. The Dense layer is used to non-linearly transform the previously extracted features, extract the correlation between these features, and map the correlation between features onto the output layer. Input the domain name character extension sequence into the DGA domain name detection model; The loss function is determined based on the output of the DGA domain name detection model and the actual category of the domain name corresponding to the domain name character extension sequence; The parameters of the DGA domain name detection model are optimized according to the loss function to train the DGA domain name detection model and obtain a trained DGA domain name detection model.

2. An application method for a DGA domain name detection model, characterized in that, The application method includes: Obtain the domain name data to be tested; The domain name data to be tested is divided into characters to obtain the character sequence of the domain name to be tested; The domain name data to be tested is segmented into words to obtain the word segmentation sequence of the domain name to be tested; Each element in the word segmentation sequence of the domain name to be tested is labeled with a semantic tag to obtain the semantic tag sequence to be tested; The character sequence of the domain name to be tested is merged with the semantic tag sequence to be tested to obtain the extended character sequence of the domain name to be tested; The extended character sequence of the domain name to be tested is input into the DGA domain name detection model to obtain the domain name detection result of the domain name data to be tested. The DGA domain name detection model is a model trained by the training method of the DGA domain name detection model according to claim 1.

3. A training system for a DGA domain name detection model, characterized in that, The training system is used to implement the training method of the DGA domain name detection model according to claim 1, and the training system includes: The domain name data acquisition module is used to acquire domain name data, which includes DGA domain name data and legal domain name data. The DGA domain name data includes DGA family domain names generated based on a vocabulary list and DGA family domain names whose number of characters is less than a preset threshold. The domain name character sequence acquisition module is used to divide the domain name data according to characters to obtain the domain name character sequence; The domain name segmentation sequence acquisition module is used to perform segmentation processing on the domain name data to obtain the domain name segmentation sequence; The semantic tag sequence acquisition module is used to label each element in the domain name segmentation sequence with semantic tags to obtain a semantic tag sequence; The domain name character extension sequence acquisition module is used to merge the domain name character sequence with the semantic tag sequence to obtain the domain name character extension sequence; The model building module is used to construct a DGA domain name detection model based on convolutional neural networks and long short-term memory neural networks. The DGA domain name detection model includes an input layer, a word embedding layer, multiple convolutional layers, a fully connected layer, an LSTM layer, and an output layer connected in sequence. The word embedding layer is used to encode the extended sequence of the input domain name characters to obtain the corresponding word vector matrix. The multiple convolutional layers, fully connected layers, and LSTM layers are used to extract domain name features from the word vector matrix. The output layer is used to output the domain name detection result based on the domain name features. The first input module is used to input the domain name character extension sequence into the DGA domain name detection model; The loss function determination module is used to determine the loss function based on the output of the DGA domain name detection model and the actual category of the domain name corresponding to the domain name character extension sequence. The model training module is used to optimize the parameters of the DGA domain name detection model according to the loss function, so as to train the DGA domain name detection model and obtain the trained DGA domain name detection model.

4. An application system for a DGA domain name detection model, characterized in that, The application system includes: The domain name data acquisition module is used to acquire domain name data to be tested; The domain name character sequence acquisition module is used to divide the domain name data to be tested according to characters to obtain the domain name character sequence to be tested; The domain name segmentation sequence acquisition module is used to perform segmentation processing on the domain name data to be tested to obtain the domain name segmentation sequence; The module for obtaining the semantic tag sequence to be tested is used to label each element in the word segmentation sequence of the domain name to be tested with semantic tags to obtain the semantic tag sequence to be tested. The module for obtaining the character extension sequence of the domain name to be tested is used to merge the character sequence of the domain name to be tested with the semantic tag sequence to be tested to obtain the character extension sequence of the domain name to be tested. The second input module is used to input the extended character sequence of the domain name to be tested into the DGA domain name detection model to obtain the domain name detection result of the domain name data to be tested. The DGA domain name detection model is a model trained by the training method of the DGA domain name detection model according to claim 1.

Images