A method and apparatus for detecting domain names of DGA

Abstract

The application discloses a DGA domain name detection method and device, relates to the technical field of network security, and mainly aims to accurately, efficiently and stably detect DGA domain names. The main technical scheme comprises the following steps: determining a to-be-detected domain name in network flow data; and performing DGA domain name detection on the to-be-detected domain name by using a DGA domain name detection model, wherein the detection accuracy of the DGA domain name detection model corresponds to current environmental parameters of a system in which the DGA domain name detection model is located and the number of current to-be-detected domain names.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a DGA domain name detection method and device. Background Art

[0002] In the field of network security, attackers often use domain generation algorithms (DGAs) to generate large numbers of pseudo-random or seemingly patterned domain names. These domains are called DGA domains. DGA domains can effectively evade detection by blacklists. Rapidly detecting DGA domains can reduce potential network security risks and ensure internet security.

[0003] Existing DGA domain name detection methods include the following two: one is to preset a DGA domain name sample library and search for the domain name to be detected in the preset DGA domain name sample library. If the domain name is found, it is directly determined to be a DGA domain name. However, this method can only detect known domain names in the DGA domain name sample library and is powerless against newly generated domain names, resulting in the failure to detect DGA domain names. The second is to use long short-term memory neural networks for DGA domain name detection. However, the biggest problem with long short-term memory neural networks is that the detection speed is very slow, and the survival time of DGA domain names is short. Long short-term memory neural networks are difficult to perform DGA domain name detection work on large amounts of data in a short period of time.

[0004] Therefore, how to avoid the above defects and accurately, efficiently and stably detect DGA domain names has become an urgent problem that needs to be solved. Summary of the Invention

[0005] In view of this, the present application proposes a DGA domain name detection method and device, the main purpose of which is to accurately, efficiently and stably detect DGA domain names.

[0006] In order to achieve the above objectives, this application mainly provides the following technical solutions:

[0007] In a first aspect, the present application provides a DGA domain name detection method, which includes:

[0008] Identify the domain name to be detected in the network traffic data;

[0009] The DGA domain name detection model is used to perform DGA domain name detection on the domain name to be detected, wherein the detection accuracy of the DGA domain name detection model corresponds to the current environmental parameters of the system in which the model is located and the number of the domain names to be detected.

[0010] In some embodiments, determining a domain name to be detected in network traffic data includes: detecting whether a target domain name in the network traffic data is a domain name in a target domain name library, wherein the target domain name library is composed of a goodwill domain name library and / or a DGA domain name library; if not, determining the target domain name as the domain name to be detected.

[0011] In some embodiments, after performing DGA domain name detection on the domain name to be detected using a DGA domain name detection model, the method further includes: when detecting that the domain name to be detected is a DGA domain name, adding the domain name to be detected to a DGA domain name library in the target domain name library.

[0012] In some embodiments, before detecting whether the target domain name in the network traffic data is a domain name in a target domain name library, the method further includes: determining a target-level domain name in the network traffic data as the target domain name.

[0013] In some embodiments, before detecting whether the target domain name in the network traffic data is a domain name in a target domain name library, the method further includes: determining a domain name having a target-level domain name field in the network traffic data as the target domain name.

[0014] In some embodiments, the method further includes: determining a target detection accuracy based on the number of domain names currently to be detected and current environmental parameters of the system in which the DGA domain name detection model is located; and selecting a DGA domain name detection model corresponding to the target detection accuracy from among the preset DGA domain name detection models.

[0015] In some embodiments, the method further includes: determining a target detection accuracy based on the number of domain names currently to be detected and current environmental parameters of the system in which the DGA domain name detection model is located; and adjusting model parameters of the DGA domain name detection model based on the target detection accuracy.

[0016] In some embodiments, the method further includes: counting in real time the number of domain names to be detected determined from the network traffic data within a unit time period, and determining the counted number as the current number of domain names to be detected.

[0017] In some embodiments, the method further includes: when determining that the domain name to be detected is a DGA domain name, adding the domain name to be detected to a target database, so as to be retrieved from the target database when visually displaying the DGA domain name.

[0018] In some embodiments, the method further includes: deleting the DGA domain name in the target database when the storage time of the DGA domain name reaches a preset time.

[0019] In a second aspect, the present application provides a DGA domain name detection device, which includes:

[0020] A determination module, used to determine the domain name to be detected in the network traffic data;

[0021] The detection module is used to perform DGA domain name detection on the domain name to be detected through a DGA domain name detection model, wherein the detection accuracy of the DGA domain name detection model corresponds to the current environmental parameters of the system in which it is located and the number of domain names currently to be detected.

[0022] In a third aspect, the present application provides a computer-readable storage medium, wherein the storage medium includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the DGA domain name detection method described in the first aspect.

[0023] In a fourth aspect, the present application provides an electronic device, comprising: a memory for storing a program; and a processor coupled to the memory for running the program to execute the DGA domain name detection method described in the first aspect.

[0024] The DGA domain name detection method and device provided by the present application first determine the domain name to be detected in the network traffic data, and then perform DGA domain name detection on the domain name to be detected through the DGA domain name detection model. The technical solution provided by the present application has at least the following two beneficial effects: First, the DGA domain name detection is performed on the domain name to be detected through the DGA domain name detection model. Even if the domain name to be detected is a newly generated DGA domain name, it can be accurately detected whether it is a DGA domain name based on its characteristics; Second, the DGA domain name detection model with a detection accuracy corresponding to the current environmental parameters of the system and the current number of domain names to be detected is used to perform DGA domain name detection. Therefore, the DGA domain name detection model can not only reduce the influence of the system environmental parameters on the stability of the DGA domain name detection model, but also the DGA domain name detection model can efficiently complete the DGA domain name detection under the current number of domain names to be detected, avoiding the situation where the domain name to be detected cannot be detected in time. Therefore, the solution provided by the present application can accurately, efficiently and stably detect DGA domain names.

[0025] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0027] Figure 1 A flowchart of a DGA domain name detection method provided by one embodiment of the present application is shown;

[0028] Figure 2 A flowchart of a DGA domain name detection method provided by another embodiment of the present application is shown;

[0029] Figure 3 A schematic structural diagram of a DGA domain name detection device provided by one embodiment of the present application is shown;

[0030] Figure 4 A structural diagram of a DGA domain name detection device provided by another embodiment of the present application is shown. DETAILED DESCRIPTION

[0031] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0032] DGA domain names can effectively avoid detection by blacklists. Therefore, in order to reduce the network security risks brought by DGA domain names, it is necessary to quickly detect DGA domain names.

[0033] Existing DGA domain name detection methods include the following two: one is to pre-set a DGA domain name sample library and search for the domain name to be detected in the preset DGA domain name sample library. If the domain name is found, it is directly determined to be a DGA domain name. However, this method can only detect known domain names in the DGA domain name sample library and is powerless against newly generated domain names, resulting in the failure to detect DGA domain names. The second is to use long short-term memory neural networks for DGA domain name detection. However, the biggest problem with long short-term memory neural networks is that the detection speed is very slow, and the survival time of DGA domain names is relatively short (most DGA domain names survive for 1-7 days). Long short-term memory neural networks are difficult to perform DGA domain name detection work on large amounts of data in a short period of time.

[0034] To avoid the above-mentioned drawbacks, embodiments of the present application provide a DGA domain name detection method and apparatus. These methods and apparatuses can accurately, efficiently, and stably detect DGA domain names in network traffic data, thereby effectively improving network security. The DGA domain name detection method and apparatuses provided in embodiments of the present application can be applied to any network device requiring DGA domain name detection, and embodiments of the present application do not specifically limit the type of network device.

[0035] The following is a detailed description of the DGA domain name detection method and device provided in the embodiments of the present application.

[0036] like Figure 1 As shown, the embodiment of the present application provides a DGA domain name detection method, which mainly includes the following steps:

[0037] 101. Determine the domain name to be detected in the network traffic data.

[0038] Network traffic data refers to DNS (Domain Name System) traffic data generated by network devices. Given the short lifespan of DGA domains, network traffic data is generated in real time to enable rapid and immediate detection of DGA domains within network traffic data. Domain generation algorithms use random characters to generate command-and-control (C&C) domain names, thereby evading domain blacklist detection. Therefore, DGA domains are typically C&C domains.

[0039] Network traffic data includes a large number of domain names, not all of which are DGA domain names. Therefore, domain names suspected of being DGA domain names need to be identified as domain names to be detected to confirm whether they are DGA domain names.

[0040] The specific process of determining the domain name to be detected in the network traffic data includes the following steps 101A to 101B:

[0041] 101A. Detect whether the target domain name in the network traffic data is a domain name in a target domain name library, wherein the target domain name library is composed of a good domain name library and / or a DGA domain name library; if not, execute step 101B; if so, execute step 101C.

[0042] The target domain name library is used to filter target domain names in network traffic data. Using the target domain name library can reduce the number of domain names to be detected, thereby reducing the detection pressure on the DGA domain name detection model. Target domain name libraries exist in three forms:

[0043] First, the target domain name database is a benign domain name database. If the target domain name is detected as a domain name in the benign domain name database, it indicates that the target domain name is a benign domain name and does not need to be detected as a DGA domain name. Therefore, step 101C is executed. If the target domain name is not detected as a domain name in the benign domain name database, it indicates that the target domain name is not a benign domain name and may be a DGA domain name. Therefore, step 101B is executed to determine the target domain name as a domain name to be detected.

[0044] Second, the target domain name library is a DGA domain name library. If the target domain name is detected as a domain name in the DGA domain name library, it indicates that the target domain name is a DGA domain name and no DGA domain name detection is required. Therefore, step 101C is executed. If the target domain name is detected as not a domain name in the DGA domain name library, the target domain name can exist in the following two situations: first, the target domain name is a good-faith domain name; second, the target domain name is a DGA domain name, but the DGA domain name library has not yet included it. Therefore, step 101B is executed to determine the target domain name as a domain name to be detected to determine whether it is a DGA domain name.

[0045] Third, the target domain name library is a good-faith domain name library and a DGA domain name library. First, detect whether the target domain name in the network traffic data is a domain name in the good-faith domain name library. When it is detected that the target domain name is a domain name in the good-faith domain name library, it means that the target domain name is a good-faith domain name and there is no need to perform a DGA domain name detection on it, so execute step 101C. When it is detected that the target domain name is not a domain name in the good-faith domain name library, continue to detect whether the target domain name in the network traffic data is a domain name in the DGA domain name library. When it is detected that the target domain name is a domain name in the DGA domain name library, it means that the target domain name is a DGA domain name and there is no need to perform a DGA domain name detection on it, so execute step 101C. When it is detected that the target domain name is not a domain name in the DGA domain name library, the target domain name may be a DGA domain name, but the DGA domain name library has not yet been included. Therefore, execute step 101B to determine the target domain name as the domain name to be detected to determine whether it is a DGA domain name.

[0046] The embodiment of the present application filters the target domain names in the network traffic data through the target domain name library, thereby reducing the number of domain names to be detected to a certain extent, thereby reducing the data processing pressure of the subsequent DGA domain name detection model.

[0047] 101B. Determine the target domain name as the domain name to be detected.

[0048] 101C. Determine the target domain name as a domain name of a corresponding type in the domain name database in which it resides.

[0049] When the target domain name is determined to be a domain name in the goodwill domain name library, the target domain name is determined to be a goodwill domain name. When the target domain name is determined to be a domain name in the DGA domain name library, the target domain name is determined to be a DGA domain name.

[0050] Furthermore, before executing step 101A to detect whether the target domain name in the network traffic data is a domain name in the target domain name library, the DGA domain name detection method further includes the step of determining the target domain name. The methods for determining the target domain name include the following two methods:

[0051] One is to determine the target-level domain name in the network traffic data as the target domain name.

[0052] The target-level domain name can be set based on business requirements. For example, the target-level domain name can be a top-level domain name, a second-level domain name, or a third-level domain name. It should be noted that the principle for determining the target-level domain name is that the target-level domain name must reflect the characteristics of a DGA domain name. This principle is intended to improve the accuracy of DGA domain name detection. The purpose of specifying the target-level domain name as the target domain name is to reduce the number of characters used in DGA domain name detection and improve DGA domain name detection efficiency.

[0053] Another method is to determine a domain name with a target-level domain name field in the network traffic data as the target domain name.

[0054] In order to detect the target domain name in a targeted manner and improve the efficiency of DGA domain name detection, a target-level domain name field is set. The domain name with the target-level domain name field in the network traffic data is determined as the target domain name.

[0055] For example, if the target-level domain name field is the field ".com" corresponding to the top-level domain name, then all domain names with the top-level domain name ".com" in the network traffic data are determined as target domain names.

[0056] It should be noted that before using the above two methods to determine the target domain name, the domain names in the network traffic data can be deduplicated, thereby reducing the amount of data processing required for subsequent determination of the domain name to be detected.

[0057] 102. Perform DGA domain name detection on the domain name to be detected using a DGA domain name detection model, wherein the detection accuracy of the DGA domain name detection model corresponds to the current environmental parameters of the system in which it is located and the number of domain names currently to be detected.

[0058] There are significant differences between DGA domain names and good-intentioned domain names in local data features such as domain name character length, domain name suffix, domain name character entropy, number of domain name digits, domain name digit ratio, maximum length of consecutive domain name digits, maximum length of consecutive domain name letters, maximum length of consecutive identical domain name letters, and longest vowel distance between domain names. Therefore, DGA domain name detection can be performed on the domain name to be detected through the DGA domain name detection model. The type of DGA domain name detection model in the embodiment of the present application can be determined based on business needs, and this embodiment does not make specific limitations. For example, considering that the convolutional neural network model has the excellent characteristics of low false alarm rate, high accuracy, and parallel operation, and is very suitable for capturing local features, the DGA domain name detection model uses a convolutional neural network model.

[0059] The embodiment of the present application performs DGA domain name detection on the domain name to be detected through the DGA domain name detection model. The DGA domain name detection speed of the DGA domain name detection model is limited by its detection accuracy. The greater its detection accuracy, the higher the detection rate of the DGA domain name and the slower the DGA domain name detection speed. Conversely, the smaller its detection accuracy, the lower the detection rate of the DGA domain name and the faster the DGA domain name detection speed. In addition, the greater the detection accuracy of the DGA domain name detection model, the higher its requirements for the memory or CPU of the system in which it is located. When the memory and CPU cannot meet the detection accuracy requirements of the DGA domain name detection model, the DGA domain name detection model will no longer perform DGA domain name detection. In addition, the greater the detection accuracy of the DGA domain name detection model, the slower its domain name detection speed. If the number of domain names to be detected is large at this time, it will cause a backlog of domain names to be detected, resulting in data congestion, and it cannot guarantee that the DGA domain name will be detected within its lifetime.

[0060] Taking the above factors into consideration, the detection accuracy of the DGA domain name detection model for DGA domain name detection needs to correspond to the current environmental parameters of the system in which it is located and the number of domain names currently to be detected, so as to ensure that it can operate stably in the current operating environment of the system in which it is located and can quickly perform DGA domain name detection.

[0061] The following describes the methods for determining the DGA domain name detection model. There are two methods:

[0062] Method 1: Determine the target detection accuracy based on the number of domain names to be detected and the current environmental parameters of the system where the DGA domain name detection model is located. Select the DGA domain name detection model that corresponds to the target detection accuracy from the preset DGA domain name detection models.

[0063] The number of domain names to be detected determined from network traffic data within a unit of time is counted in real time, and the counted number is used as the current number of domain names to be detected. The current number of domain names to be detected reflects the detection pressure of the DGA domain name detection model.

[0064] The current environment parameters of the system where the DGA domain name detection model resides include, but are not limited to, the current available memory space and the current number of available CPU cores. These parameters reflect the system's support for the DGA domain name detection model.

[0065] In practical applications, data reflecting the correspondence between quantity, environmental parameters, and detection accuracy can be pre-stored. After obtaining the current number of domain names to be detected and the current environmental parameters of the system in which the DGA domain name detection model resides, the pre-set data is queried, and the detection accuracy corresponding to the current number of domain names to be detected and the current environmental parameters of the system in which the DGA domain name detection model resides in the pre-set data is determined as the target detection accuracy.

[0066] To quickly use a DGA domain detection model to detect a domain name, multiple DGA domain detection models corresponding to different detection accuracy ranges can be preset, with the detection accuracy ranges of the DGA domain detection models not overlapping. After determining the target detection accuracy, the DGA domain detection model with a detection accuracy range that includes the target detection accuracy is selected and used for DGA domain detection.

[0067] Method 2: Determine the target detection accuracy based on the number of domain names to be detected and the current environmental parameters of the system where the DGA domain name detection model is located. Adjust the model parameters of the DGA domain name detection model based on the target detection accuracy.

[0068] The DGA domain name detection model in this embodiment is capable of adaptively adjusting model parameters. After determining the target detection accuracy, the required adjustment values ​​for the model parameters of the DGA domain name detection model are determined, and then the model parameters of the DGA domain name detection model are adjusted based on the adjustment values. The model parameters referred to here are those that affect the detection accuracy of the DGA domain name detection model. This embodiment does not limit the specific types of model parameters; they can be selected based on specific business needs. Exemplary model parameters may include, but are not limited to, the number of neurons in the model, connection weights, thresholds, and so on.

[0069] The DGA domain name detection method provided in the embodiment of the present application first determines the domain name to be detected in the network traffic data, and then performs DGA domain name detection on the domain name to be detected through the DGA domain name detection model. The technical solution provided in the embodiment of the present application has at least the following two beneficial effects: First, the DGA domain name detection is performed on the domain name to be detected through the DGA domain name detection model. Even if the domain name to be detected is a newly generated DGA domain name, it can be accurately detected whether it is a DGA domain name based on its characteristics; Second, the DGA domain name detection model with a detection accuracy corresponding to the current environmental parameters of the system and the current number of domain names to be detected is used to perform DGA domain name detection. Therefore, the DGA domain name detection model can not only reduce the influence of the system environmental parameters on the stability of the DGA domain name detection model, but also the DGA domain name detection model can efficiently complete the DGA domain name detection under the current number of domain names to be detected, avoiding the situation where the domain name to be detected cannot be detected in time. Therefore, the solution provided in the embodiment of the present application can accurately, efficiently and stably detect DGA domain names.

[0070] Further, according to Figure 1 Another embodiment of the present application further provides a DGA domain name detection method, such as Figure 2 As shown, the DGA domain name detection method mainly includes:

[0071] 201. Check whether the target domain name in the network traffic data is a domain name in the good domain name database. If so, execute step 202; otherwise, execute step 203.

[0072] 202. Determine the target domain name as a good-intentioned domain name, and terminate the current process.

[0073] After the target domain name is determined to be a good-intentioned domain name, it means that the DGA domain name detection for the current target domain name has been completed, and the DGA domain name detection can be continued for subsequent target domain names.

[0074] 203. Check whether the target domain name in the network traffic data is a domain name in the DGA domain name library. If so, execute step 204; otherwise, execute step 207.

[0075] 204. Determine the target domain name as the DGA domain name.

[0076] 205. Add the determined DGA domain name to the target database so that it can be retrieved from the target database when visually displaying the DGA domain name.

[0077] To facilitate unified management of detected DGA domain names, they are added to the target database. When users need to visualize the DGA domain names in the target database, they can directly retrieve them from the target database, allowing users to analyze whether the DGA domain names are malicious domain names.

[0078] 206. When the storage time of the DGA domain name in the target database reaches a preset time, the DGA domain name is deleted and the current process ends.

[0079] In practical applications, there are two factors: first, DGA domain names have a lifespan; second, the target database has limited storage space. Therefore, considering these two factors, once the DGA domain name in the target database has reached a preset storage time, it is deleted.

[0080] 207. Determine the target domain name as the domain name to be detected.

[0081] 208. Perform DGA domain name detection on the domain name to be detected using the DGA domain name detection model. The detection accuracy of the DGA domain name detection model corresponds to the current environmental parameters of the system in which it is located and the number of domain names to be detected. Execute steps 209 and 210.

[0082] 209. When it is detected that the domain name to be detected is a DGA domain name, the domain name to be detected is added to the DGA domain name library in the target domain name library, and the current process ends.

[0083] When the domain name to be detected is detected as a DGA domain name, the domain name to be detected is added to the DGA domain name library in the target domain name library to increase the number of DGA domain names in the DGA domain name library. It can be seen that the embodiment of the present application can incrementally expand the number of DGA domain names in the DGA domain name library. This incremental expansion of the DGA domain name library can, to a certain extent, increase the probability of DGA domain names being screened out, thereby further reducing the number of domain names to be detected, and further reducing the data processing pressure of the DGA domain name detection model.

[0084] 210. When the domain name to be detected is detected as a DGA domain name, the domain name to be detected is added to the target database for retrieval from the target database when visually displaying the DGA domain name, and step 206 is executed.

[0085] Furthermore, according to the above method embodiment, another embodiment of the present application also provides a DGA domain name detection device, such as Figure 3 As shown, the DGA domain name detection device includes:

[0086] A determination module 31 is used to determine a domain name to be detected in the network traffic data;

[0087] The detection module 32 is configured to perform DGA domain name detection on the domain name to be detected using a DGA domain name detection model, wherein the detection accuracy of the DGA domain name detection model corresponds to the current environmental parameters of the system in which it is located and the number of domain names to be detected.

[0088] The DGA domain name detection device provided in the embodiment of the present application first determines the domain name to be detected in the network traffic data, and then performs DGA domain name detection on the domain name to be detected through the DGA domain name detection model. The technical solution provided in the embodiment of the present application has at least the following two beneficial effects: First, the DGA domain name detection is performed on the domain name to be detected through the DGA domain name detection model. Even if the domain name to be detected is a newly generated DGA domain name, it can be accurately detected whether it is a DGA domain name based on its characteristics; Second, the DGA domain name detection model with a detection accuracy corresponding to the current environmental parameters of the system and the current number of domain names to be detected is used to perform DGA domain name detection. Therefore, the DGA domain name detection model can not only reduce the influence of the system environmental parameters on the stability of the DGA domain name detection model, but also the DGA domain name detection model can efficiently complete the DGA domain name detection under the current number of domain names to be detected, avoiding the situation where the domain name to be detected cannot be detected in time. Therefore, the solution provided in the embodiment of the present application can accurately, efficiently and stably detect DGA domain names.

[0089] Optional, such as Figure 4 As shown, the determination module 31 includes a detection unit 311 and a determination unit 312;

[0090] The detection unit 311 is used to detect whether the target domain name in the network traffic data is a domain name in the target domain name library, wherein the target domain name library is composed of a good domain name library and / or a DGA domain name library; if not, the trigger determination unit 312 determines the target domain name as the domain name to be detected.

[0091] Optional, such as Figure 4 As shown, the DGA domain name detection device also includes:

[0092] The first adding module 33 is configured to add the domain name to be detected to the DGA domain name library in the target domain name library when the detecting module 32 detects that the domain name to be detected is a DGA domain name.

[0093] Optional, such as Figure 4 As shown, the detection unit 311 is further configured to determine the target-level domain name in the network traffic data as the target domain name before detecting whether the target domain name in the network traffic data is a domain name in the target domain name library.

[0094] Optional, such as Figure 4As shown, the detection unit 311 is further configured to determine the domain name having the target level domain name field in the network traffic data as the target domain name before detecting whether the target domain name in the network traffic data is a domain name in the target domain name library.

[0095] Optional, such as Figure 4 As shown, the DGA domain name detection device also includes:

[0096] The selection module 34 is configured to determine a target detection accuracy based on the number of domain names to be detected and the current environmental parameters of the system in which the DGA domain name detection model resides, and select a DGA domain name detection model corresponding to the target detection accuracy from among the preset DGA domain name detection models.

[0097] Optional, such as Figure 4 As shown, the DGA domain name detection device also includes:

[0098] The adjustment module 35 is configured to determine target detection accuracy based on the number of domain names to be detected and current environmental parameters of the system in which the DGA domain name detection model resides; and adjust model parameters of the DGA domain name detection model based on the target detection accuracy.

[0099] Optional, such as Figure 4 As shown, the DGA domain name detection device also includes:

[0100] The statistics module 36 is used to count the number of domain names to be detected determined from the network traffic data in real time within a unit time period, and determine the counted number as the current number of domain names to be detected.

[0101] Optional, such as Figure 4 As shown, the DGA domain name detection device also includes:

[0102] The second adding module 37 is configured to add the domain name to be detected to the target database when determining that the domain name to be detected is a DGA domain name, so as to be retrieved from the target database when visually displaying the DGA domain name.

[0103] Optional, such as Figure 4 As shown, the second adding module 37 is further configured to delete the DGA domain name in the target database when the storage time of the DGA domain name reaches a preset time.

[0104] In the DGA domain name detection device provided in the embodiment of the present application, the detailed description of the method adopted during the operation of each functional module can be found in the detailed description of the corresponding method in the above method embodiment, and will not be repeated here.

[0105] Furthermore, according to the above embodiment, another embodiment of the present application also provides a computer-readable storage medium, wherein the storage medium includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the above-mentioned DGA domain name detection method.

[0106] The beneficial effects of the computer-readable storage medium provided in the embodiment of the present application are substantially the same as those of the above-mentioned DGA domain name detection method, and therefore will not be described in detail here.

[0107] Furthermore, according to the above embodiment, another embodiment of the present application also provides an electronic device, which includes: a memory for storing a program; and a processor coupled to the memory for running the program to execute the above DGA domain name detection method.

[0108] The beneficial effects of the electronic device provided in the embodiment of the present application are substantially the same as those of the above-mentioned DGA domain name detection method, and therefore will not be described in detail here.

[0109] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0110] It is understood that the relevant features of the above methods and devices can be referenced to each other. In addition, the terms "first" and "second" in the above embodiments are used to distinguish between the embodiments, and do not represent the advantages and disadvantages of the embodiments.

[0111] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0112] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems may also be used together with the teachings herein. Based on the above description, it is apparent that the structure required for constructing such systems is suitable. In addition, the present application is not directed to any specific programming language. It should be understood that various programming languages ​​may be utilized to implement the present application described herein, and the description of the specific languages ​​above is provided for the purpose of disclosing the preferred embodiment of the present application.

[0113] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0114] Furthermore, those skilled in the art will appreciate that although some embodiments described herein include certain features included in other embodiments but not other features, combinations of features from different embodiments are intended to be within the scope of this application and to form different embodiments. For example, in the claims below, any of the claimed embodiments may be used in any combination.

[0115] The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all of the functions of some or all of the components of the DGA domain name detection method, device, and framework according to the embodiments of the present application. The present application can also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing the present application can be stored on a computer-readable medium, or can be in the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0116] It should be noted that the above embodiments illustrate rather than limit the present application, and that a person skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbols placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present application may be implemented by means of hardware comprising several different elements and by means of appropriately programmed computers. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

Claims

1. A DGA domain name detection method, characterized in that: The method comprises: Determine the target-level domain name in the network traffic data as the target domain name, or determine the domain name with the target-level domain name field in the network traffic data as the target domain name; the target-level domain name reflects the characteristics of the DGA domain name; Determining a domain name to be detected in the network traffic data, wherein determining the domain name to be detected in the network traffic data includes: detecting whether a target domain name in the network traffic data is a domain name in a target domain name library, wherein the target domain name library is composed of a good domain name library and / or a DGA domain name library; if not, determining the target domain name as the domain name to be detected; Performing DGA domain name detection on the domain name to be detected using a DGA domain name detection model, wherein the detection accuracy of the DGA domain name detection model corresponds to the current environmental parameters of the system in which it is located and the number of domain names currently to be detected; Determining a DGA domain name detection model includes: determining a target detection accuracy based on the number of domain names to be detected and current environmental parameters of a system in which the DGA domain name detection model resides; and adjusting model parameters of the DGA domain name detection model based on the target detection accuracy; the current environmental parameters are used to reflect the degree of detection support for the DGA domain name detection model by the system in which the DGA domain name detection model resides, and the model parameters are model parameters that affect the detection accuracy of the DGA domain name detection model.

2. The method according to claim 1, characterized in that After performing DGA domain name detection on the domain name to be detected using the DGA domain name detection model, the method further includes: When it is detected that the domain name to be detected is a DGA domain name, the domain name to be detected is added to the DGA domain name library in the target domain name library.

3. The method according to any one of claims 1 to 2, characterized in that The method further comprises: Determining target detection accuracy based on the number of domain names currently to be detected and current environmental parameters of the system in which the DGA domain name detection model resides; A DGA domain name detection model corresponding to the target detection accuracy in a preset DGA domain name detection model is selected.

4. The method according to any one of claims 1 to 2, characterized in that The method further comprises: The number of domain names to be detected determined from the network traffic data within a unit time is counted in real time, and the counted number is determined as the number of domain names currently to be detected.

5. The method according to any one of claims 1 to 2, characterized in that The method further comprises: When it is determined that the domain name to be detected is a DGA domain name, the domain name to be detected is added to a target database so as to be retrieved from the target database when visually displaying the DGA domain name.

6. The method according to claim 5, characterized in that The method further comprises: When the storage time of the DGA domain name in the target database reaches a preset time, the DGA domain name is deleted.

7. A DGA domain name detection device, characterized in that: The device comprises: A determination module includes a detection unit and a determination unit; the detection unit is used to determine a target-level domain name in the network traffic data as a target domain name, or to determine a domain name having a target-level domain name field in the network traffic data as a target domain name; the target-level domain name reflects the characteristics of the DGA domain name; a determination module configured to determine a domain name to be detected in the network traffic data; the detection unit configured to detect whether a target domain name in the network traffic data is a domain name in a target domain name library, wherein the target domain name library is composed of a good domain name library and / or a DGA domain name library; if not, triggering the determination unit to determine the target domain name as the domain name to be detected; a detection module, configured to perform DGA domain name detection on the domain name to be detected using a DGA domain name detection model, wherein the detection accuracy of the DGA domain name detection model corresponds to the current environmental parameters of the system in which it is located and the number of domain names currently to be detected; The apparatus further includes an adjustment module configured to determine a DGA domain name detection model. The process of determining the DGA domain name detection model includes: determining a target detection accuracy based on the number of domain names to be detected and current environmental parameters of a system in which the DGA domain name detection model resides; and adjusting model parameters of the DGA domain name detection model based on the target detection accuracy. The current environmental parameters are used to reflect the degree of detection support provided by the system in which the DGA domain name detection model resides for the DGA domain name detection model, and the model parameters are model parameters that affect the detection accuracy of the DGA domain name detection model.

8. A computer-readable storage medium, characterized in that The storage medium includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the DGA domain name detection method according to any one of claims 1 to 6.

9. An electronic device, characterized in that: The electronic device comprises: Memory, used to store programs; A processor, coupled to the memory, configured to run the program to execute the DGA domain name detection method according to any one of claims 1 to 6.

Images