Domain name category prediction method, device, equipment and storage medium

Abstract

A domain name category prediction method, device and equipment and a storage medium are disclosed. The method comprises: obtaining a first sample data set and a second sample data set; the first sample data set is a set composed of first feature sequences corresponding to respective domain names; the second sample data set is a set composed of second feature sequences corresponding to respective domain names; inputting the first sample data set into a first prediction model for training to obtain a first neural network model for predicting domain name categories; inputting the second sample data set into a second prediction model for training to obtain a second neural network model for predicting domain name categories; and determining the category of a domain name to be tested based on the first neural network model and the second neural network model.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a domain name category prediction method and device, equipment and a storage medium. BACKGROUND

[0002] At present, malicious domain names include malicious website domain names, malicious program host domain names, and botnet host domain names. In order to evade detection, the generation method of malicious domain names gradually approaches the generation method of normal website domain names, such as generating domain names based on random word combination or generating domain names based on word and number combination rules, resulting in that the generated malicious domain names are difficult to distinguish from normal website domain names. SUMMARY

[0003] Therefore, the embodiments of the present application aim to provide a domain name category prediction method, device, equipment and storage medium.

[0004] The technical scheme of the embodiments of the present application is implemented as follows:

[0005] At least one embodiment of the present application provides a domain name category prediction method, which comprises:

[0006] obtaining a first sample data set and a second sample data set; the first sample data set is a set composed of first feature sequences respectively corresponding to each domain name; the second sample data set is a set composed of second feature sequences respectively corresponding to each domain name;

[0007] inputting the first sample data set into a first prediction model for training to obtain a first neural network model for predicting the category of domain names; and inputting the second sample data set into a second prediction model for training to obtain a second neural network model for predicting the category of domain names;

[0008] determining the category of a to-be-tested domain name based on the first neural network model and the second neural network model.

[0009] In addition, according to at least one embodiment of the present application, the determination of the category of the to-be-tested domain name based on the first neural network model and the second neural network model comprises:

[0010] using the first neural network model and the second neural network model to respectively predict the to-be-tested domain name to obtain a first prediction result and a second prediction result;

[0011] determining a first credibility of the registration website of the to-be-tested domain name; and determining a second credibility of the top-level domain name in the to-be-tested domain name;

[0012] determine a proportion of the top-level domain name and the malicious domain name containing the top-level domain name from the first sample data set or the second sample data set;

[0013] determine the category of the domain name to be tested by combining the first prediction result and the second prediction result, and at least two of the first credibility, the second credibility and the proportion.

[0014] In addition, according to at least one embodiment of the present application, the determination of the first credibility of the registration website of the domain name to be tested comprises:

[0015] obtain registration information required by the registration website of the domain name to be tested;

[0016] determine the first credibility of the registration website of the domain name to be tested according to the registration information.

[0017] In addition, according to at least one embodiment of the present application, the determination of the second credibility of the top-level domain name in the domain name to be tested comprises:

[0018] obtain registration information required by each registration website of the top-level domain name in the domain name to be tested, to obtain a plurality of registration information;

[0019] determine the second credibility of the top-level domain name in the domain name to be tested according to the plurality of registration information.

[0020] In addition, according to at least one embodiment of the present application, the determination of the proportion of the top-level domain name and the malicious domain name containing the top-level domain name comprises:

[0021] statistically obtain a first number of feature sequences corresponding to each top-level domain name from a first feature sequence corresponding to each domain name; and statistically obtain a second number of malicious domain names containing each top-level domain name in each domain name; and obtain the proportion of the top-level domain name and the malicious domain name containing the top-level domain name based on the first number and the second number;

[0022] Alternatively,

[0023] statistically obtain a third number of feature sequences corresponding to each top-level domain name from a second feature sequence corresponding to each domain name; and statistically obtain a fourth number of malicious domain names containing each top-level domain name in each domain name; and obtain the proportion of the top-level domain name and the malicious domain name containing the top-level domain name based on the third number and the fourth number.

[0024] In addition, according to at least one embodiment of the present application, the obtaining of the first sample data set and the second sample data set comprises:

[0025] obtain a plurality of domain names;

[0026] determine a string corresponding to each domain name respectively;

[0027] segment the string corresponding to each domain name to obtain at least one segmented string;

[0028] convert the at least one segmented string of each domain name into a first feature sequence and a second feature sequence based on a preset dictionary;

[0029] obtain the first sample data set based on the first feature sequence corresponding to each domain name respectively, and obtain the second sample data set based on the second feature sequence corresponding to each domain name respectively.

[0030] At least one embodiment of the present application provides a domain name category prediction device, comprising:

[0031] an acquisition unit configured to acquire a first sample data set and a second sample data set; the first sample data set is a set composed of a first feature sequence corresponding to each domain name respectively; the second sample data set is a set composed of a second feature sequence corresponding to each domain name respectively;

[0032] a first processing unit configured to input the first sample data set into a first prediction model for training to obtain a first neural network model for predicting a domain name category; and input the second sample data set into a second prediction model for training to obtain a second neural network model for predicting a domain name category;

[0033] a second processing unit configured to determine a category of a domain name to be tested based on the first neural network model and the second neural network model.

[0034] At least one embodiment of the present application provides an electronic device, comprising:

[0035] a communication interface configured to acquire a first sample data set and a second sample data set; the first sample data set is a set composed of a first feature sequence corresponding to each domain name respectively; the second sample data set is a set composed of a second feature sequence corresponding to each domain name respectively;

[0036] a processor configured to input the first sample data set into a first prediction model for training to obtain a first neural network model for predicting a domain name category; and input the second sample data set into a second prediction model for training to obtain a second neural network model for predicting a domain name category; and determine a category of a domain name to be tested based on the first neural network model and the second neural network model.

[0037] At least one embodiment of the present application provides an electronic device, comprising a processor and a memory for storing a computer program capable of running on the processor,

[0038] The processor is configured to execute the computer program to perform the steps of any of the above methods.

[0039] At least one embodiment of the present application provides a storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any of the above methods.

[0040] The domain name category prediction method, device and equipment and storage medium provided by the embodiment of the present application, the first sample data set and the second sample data set are obtained; the first sample data set is a set composed of a first feature sequence corresponding to each domain name; the second sample data set is a set composed of a second feature sequence corresponding to each domain name; the first sample data set is input into the first prediction model for training to obtain a first neural network model for predicting the category of the domain name; and the second sample data set is input into the second prediction model for training to obtain a second neural network model for predicting the category of the domain name; and the category of the domain name to be tested is determined based on the first neural network model and the second neural network model. By using the first sample data set composed of a first feature sequence corresponding to each domain name and the second sample data set composed of a second feature sequence corresponding to each domain name, two neural network models are trained, and the category of the domain name to be tested is predicted based on the two neural network models, which can improve the accuracy of identifying the category of the domain name to be tested. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 is the implementation flowchart of the domain name category prediction method of the embodiment of the present application;

[0042] Figure 2 is the specific implementation flowchart of the domain name category prediction method of the embodiment of the present application;

[0043] Figure 3 is the schematic diagram of the training process of the first neural network model of the embodiment of the present application;

[0044] Figure 4 is the schematic diagram of the training process of the second neural network model of the embodiment of the present application;

[0045] Figure 5 is the schematic diagram of the prediction of the domain name to be tested by using the first neural network model of the embodiment of the present application;

[0046] Figure 6 is the schematic diagram of the prediction of the domain name to be tested by using the second neural network model of the embodiment of the present application;

[0047] Figure 7is a schematic diagram of the composition structure of the domain name category prediction device of the embodiment of the present application.

[0048] Figure 8 is a schematic diagram of the composition structure of the electronic device of the embodiment of the present application. DETAILED DESCRIPTION

[0049] Before introducing the technical solutions of the embodiment of the present application, the related art is described.

[0050] In the related art, malicious domain names include malicious website domain names, malicious program host domain names, and botnet host domain names, etc. In order to evade detection, the generation method of malicious domain names gradually approaches normal website domain names, such as generating domain names based on random word combination, or generating domain names based on the combination rule of words and numbers, resulting in that the generated malicious domain names are difficult to distinguish from normal website domain names.

[0051] In the related art, the detection method of malicious domain names includes:

[0052] The first way is black list detection, which detects malicious domain names by comparing existing malicious domain name black lists.

[0053] The second way is machine learning detection, which classifies by feeding artificial extraction of malicious domain name features into a classification model.

[0054] The third way is deep learning detection, which automatically extracts malicious domain name features through a deep learning framework and classifies according to the features.

[0055] However, the first way has the following defects: the black list detection method needs to be manually maintained, and there is a lag. The second way has the following defects: the machine learning detection method needs a lot of feature engineering, and is easy to be bypassed. The third way has the following defects: the deep learning detection method, the character segmentation method, only relies on model feature extraction, and the model detection accuracy completely depends on the syntax features in the training data. When encountering domain names with syntax features outside the training data, the model's judgment has high randomness, resulting in high false positive rate and false negative rate.

[0056] Based on this, in the embodiment of the application, a first sample data set and a second sample data set are acquired; the first sample data set is a set composed of first feature sequences respectively corresponding to each domain name; the second sample data set is a set composed of second feature sequences respectively corresponding to each domain name; the first sample data set is input into a first prediction model for training to obtain a first neural network model for predicting the category of a domain name; and the second sample data set is input into a second prediction model for training to obtain a second neural network model for predicting the category of a domain name; and based on the first neural network model and the second neural network model, the category of a domain name to be tested is determined.

[0057] Figure 1 is a schematic diagram of the implementation process of the domain name category prediction method of the embodiment of the application, as shown in Figure 1 The method comprises steps 101 to 103.

[0058] Step 101: Acquire a first sample data set and a second sample data set; the first sample data set is a set composed of first feature sequences respectively corresponding to each domain name; the second sample data set is a set composed of second feature sequences respectively corresponding to each domain name.

[0059] That is, for each domain name, the corresponding first feature sequence and second feature sequence can be determined.

[0060] The domain name can refer to a domain name with a normal label, or can also refer to a domain name with a malicious label. The malicious domain name can include a malicious website domain name, a malicious program host domain name, a botnet host domain name, etc. The normal domain name can refer to a domain name other than a malicious domain name.

[0061] In actual application, the domain name can be converted into a string, and then through string segmentation, string conversion and other preprocessing operations, the domain name can be converted into the first feature sequence. Similarly, the domain name can also be converted into a string, and then through string segmentation, string conversion and other preprocessing operations, the domain name can be converted into the second feature sequence.

[0062] Based on this, in an embodiment, the acquisition of the first sample data set and the second sample data set comprises:

[0063] Acquire a plurality of domain names.

[0064] Determine a string corresponding to each domain name.

[0065] Segment the string corresponding to each domain name to obtain at least one segmented string.

[0066] Convert the at least one string segmented from each domain name into a first feature sequence and a second feature sequence based on a preset dictionary;

[0067] Obtain the first sample data set based on the first feature sequence corresponding to each domain name respectively, and obtain the second sample data set based on the second feature sequence corresponding to each domain name respectively.

[0068] Here, the process of constructing the dictionary can include:

[0069] First, collect common English words such as Oxford Dictionary and network vocabulary, and collect pinyin of common Chinese words such as Chinese vocabulary and network vocabulary, and English morphemes.

[0070] Second, for each domain name with a normal label, convert the capital characters in the corresponding domain name to lowercase to obtain a string.

[0071] Third, search for the pre-collected English words, Chinese pinyin, and English morphemes from the string corresponding to the domain name in the order from left to right.

[0072] Fourth, segment the string corresponding to the domain name according to the searched English words or Chinese pinyin or English morphemes.

[0073] It should be noted that if multiple English words containing the same letters are searched, the longest English word is determined from the multiple English words, and the longest English word is segmented; if multiple Chinese pinyin containing the same letters are searched, the longest pinyin is determined from the multiple Chinese pinyin, and the longest pinyin is segmented; if multiple English morphemes containing the same letters are searched, the longest English morpheme is determined from the multiple English morphemes, and the longest English morpheme is segmented.

[0074] Fifth, separately segment the top-level domain name in the domain name.

[0075] Sixth, after segmenting the string corresponding to the domain name according to the searched English words or Chinese pinyin or English morphemes, if the remaining string still includes a single character, segment the string in the form of a single character. The single character can be a letter, or a number, or a punctuation mark.

[0076] Seventh, the same processing is performed on the malicious domain name in the same way as the string corresponding to the normal domain name is segmented.

[0077] Eighth, count the frequency of English words, Chinese pinyin, English morphemes, and single characters obtained by segmenting the normal domain name; and count the frequency of English words, Chinese pinyin, English morphemes, and single characters obtained by segmenting the malicious domain name.

[0078] Ninth, according to the frequency from large to small, the ranking of the top two categories of domain name shared words, and the unique English words, Chinese words, pinyin, English morphemes and word characters.

[0079] Tenth, from the two categories of domain name segmentation of the string respectively remove the shared words, and according to the remaining English words, Chinese words, pinyin, English morphemes and word characters of the frequency, re from large to small, and from 0 to start one set of serial number. For two categories of domain name, according to the reordering of the serial number, determine the corresponding feature sequence of English words or Chinese words, pinyin or English morphemes or word characters.

[0080] After sorting the English words, Chinese words, pinyin, English morphemes and word characters, set the corresponding serial number of the top level domain name; according to the set of top level domain name serial number, determine the corresponding feature sequence of the top level domain name.

[0081] Eleventh, for two categories of domain name, in the last sorting, replace the common words and other symbols outside the queue, and set the corresponding sorting serial number, which is used as the feature sequence of the common word.

[0082] It should be noted that if the two categories of domain name contain the common word book, bookshop, the common word book, bookshop will be replaced by common, and the two common words set the same sorting serial number.

[0083] Twelfth, the first dictionary is constructed, the first dictionary saves data in the form of key value pair, the key is the English words, Chinese words, pinyin, English morphemes, single character, top level domain name, common word, etc. corresponding to the normal domain name, the value is the sorting serial number of the key.

[0084] Table 1 is a schematic diagram of the first dictionary constructed, as shown in table 1, the first dictionary can be used to convert each domain name in the training set into a first feature sequence, and the first sample data set is formed based on the obtained first feature sequence.

[0085] As shown in table 1, taking the domain name hl85.com as an example, the domain name is segmented to get the string hl, 8, 5,.com. Query the first dictionary to determine the serial number corresponding to each string after segmentation, 2, 4, 5, 8, respectively, then determine the first feature sequence of the domain name as 2458.

[0086] It should be noted that when the first dictionary is used to determine the first feature sequence corresponding to the to-be-tested domain name, if at least one unknown word is searched from the segmented string corresponding to the to-be-tested domain name, another symbol outside the queue can be used to replace the at least one unknown word, and a corresponding order number is set in the first dictionary, which is used as the feature sequence of the at least one unknown word. Wherein, the unknown word can refer to an English word, a pinyin of a Chinese word, an English morpheme, or a word other than a single character.

[0087] It should be noted that for multiple unknown words, the same symbol is used to replace and the same order number is set. That is, the multiple unknown words correspond to the same feature sequence.

[0088]

[0089] Table 1

[0090] Thirteenth, a second dictionary is constructed, the second dictionary saves data in the form of key-value pairs, the key is an English word, a pinyin of a Chinese word, an English morpheme, a single character, a top-level domain name, a common word, etc. corresponding to a malicious domain name, and the value is the order number of the key.

[0091] Table 2 is a schematic diagram of the constructed second dictionary. As shown in Table 2, the second dictionary can be used to convert each domain name in the training set into a second feature sequence respectively, and the second sample data set is formed based on the obtained second feature sequence.

[0092] As shown in Table 2, taking the domain name hl85.com as an example, the domain name is segmented to obtain the string hl, 8, 5,.com. The second dictionary is queried to determine the order numbers 4, 6, 5, and 8 corresponding to each segmented string respectively, and the second feature sequence of the domain name is determined as 4658.

[0093] It should be noted that when the second dictionary is used to determine the second feature sequence corresponding to the to-be-tested domain name, if an unknown word is searched from the segmented string corresponding to the to-be-tested domain name, another symbol outside the queue can be used to replace the unknown word, and a corresponding order number is set in the second dictionary, which is used as the feature sequence of the unknown word. Wherein, the unknown word can refer to an English word, a pinyin of a Chinese word, an English morpheme, or a word other than a single character.

[0094] It should be noted that for multiple unknown words, the same symbol is used to replace and the same order number is set. That is, the multiple unknown words correspond to the same feature sequence.

[0095]

[0096] Table 2

[0097] Step 102: inputting the first sample data set into a first prediction model for training to obtain a first neural network model for predicting the domain name category; and inputting the second sample data set into a second prediction model for training to obtain a second neural network model for predicting the domain name category.

[0098] It can be understood that the first neural network model can be trained by deep learning in combination with the first sample data set; and the second neural network model can be trained by deep learning in combination with the second sample data set.

[0099] Step 103: determining the category of the to-be-tested domain name based on the first neural network model and the second neural network model.

[0100] In actual application, the final classification result of the to-be-tested domain name can be determined according to at least two of the prediction results obtained by respectively predicting the to-be-tested domain name based on the two neural network models, the credibility of the registration website of the to-be-tested domain name, the credibility of the top-level domain name in the to-be-tested domain name, and the proportion of the top-level domain name and the malicious domain name containing the top-level domain name.

[0101] Based on this, in an embodiment, the determining the category of the to-be-tested domain name based on the first neural network model and the second neural network model comprises:

[0102] predicting the to-be-tested domain name based on the first neural network model and the second neural network model respectively to obtain a first prediction result and a second prediction result;

[0103] determining a first credibility of the registration website of the to-be-tested domain name; and determining a second credibility of the top-level domain name in the to-be-tested domain name;

[0104] determining the proportion of the top-level domain name and the malicious domain name containing the top-level domain name by using the first sample data set or the second sample data set;

[0105] determining the category of the to-be-tested domain name by using at least two of the first prediction result, the second prediction result, the first credibility, the second credibility and the proportion.

[0106] The process of how to determine the first credibility, the second credibility and the proportion will be described in detail below.

[0107] In actual application, the domain name can be registered in the website on the Internet, and the credibility of each website can be divided by the registration information required to be entered by each website when registering the domain name.

[0108] Based on this, in an embodiment, the determining the first credibility of the registration website of the to-be-tested domain name comprises:

[0109] obtaining registration information required by a registration website of the to-be-tested domain name;

[0110] determining a first credibility of the registration website of the to-be-tested domain name according to the registration information.

[0111] It can be understood that the registration website of the to-be-tested domain name can also be referred to as a domain name registrar.

[0112] It can be understood that the registration information can refer to legal identity information of a user using the domain name.

[0113] For example, when a domain name is registered in China, the page of Wanwang will display prompt information to prompt the domain name registrant to submit the ID card of a citizen for record, since the ID card can be uniquely associated with the domain name registrant, the first credibility of Wanwang is "highly credible". However, a foreign Namecheap registrar only needs to provide an email address of the registrant to register a domain name, but the email address cannot be traced back to the registrant, so the first credibility of Namecheap is "lowly credible".

[0114] In actual application, when a domain name is registered in a website on the Internet, a top-level domain name in the domain name can also be registered. Since the top-level domain name can be registered in multiple registration websites, the registration information required by different websites for registering the top-level domain name can be counted, and the minimum requirement of the registration information required by different registration websites can be used as a classification standard of the credibility of the top-level domain name in the registered domain name.

[0115] Based on this, in an embodiment, the determining of the second credibility of the top-level domain name in the to-be-tested domain name comprises:

[0116] obtaining registration information required by each registration website of the top-level domain name in the to-be-tested domain name, to obtain multiple registration information;

[0117] determining the second credibility of the top-level domain name in the to-be-tested domain name according to the multiple registration information.

[0118] For example, assuming that the to-be-tested domain name is www.M.im, if the top-level domain name ".im" is registered in two registration websites, i.e., the personal ID card needs to be provided for registration in a domestic A website, and only an email address needs to be provided for registration in a foreign B website, the requirement of the B website is used as a classification basis of the reliability of the top-level domain name ".im".

[0119] That is, for a top-level domain name that must provide personal identity information, such as ".cn", the credibility level of the top-level domain name of the domain name is set as "highly credible"; for a top-level domain name that does not need to provide personal identity information, such as ".gg", the credibility level of the top-level domain name of the domain name is set as "lowly credible".

[0120] In actual application, the proportion of the top-level domain name and the malicious domain name containing the top-level domain name can be calculated by using the first sample data set or the second sample data set.

[0121] Based on this, in an embodiment, the proportion of the top-level domain name and the malicious domain name containing the top-level domain name is determined by using the first sample data set or the second sample data set, which includes:

[0122] The first quantity of the feature sequence corresponding to each top-level domain name is counted from the first feature sequence corresponding to each domain name, and the second quantity of the malicious domain name containing each top-level domain name in each domain name is counted; and the proportion of the top-level domain name and the malicious domain name containing the top-level domain name is obtained based on the counted first quantity and second quantity.

[0123] Alternatively,

[0124] The third quantity of the feature sequence corresponding to each top-level domain name is counted from the second feature sequence corresponding to each domain name, and the fourth quantity of the malicious domain name containing each top-level domain name in each domain name is counted; and the proportion of the top-level domain name and the malicious domain name containing the top-level domain name is obtained based on the counted third quantity and fourth quantity.

[0125] It can be understood that the proportion of the top-level domain name and the malicious domain name containing the top-level domain name can be determined, which specifically includes:

[0126] It is assumed that the training set contains 100 domain names, which specifically includes 50 normal domain names and 50 malicious domain names.

[0127] First, for each domain name, the corresponding domain name is segmented to obtain at least one string, and the at least one string corresponding to the corresponding domain name is converted into a first feature sequence according to the first dictionary, to obtain a first feature sequence corresponding to each domain name.

[0128] Second, if each top-level domain name contained in each domain name is.com and.cn respectively, the total quantity of the first feature sequence corresponding to.com and.cn is counted from the first feature sequence corresponding to each domain name, that is, the first quantity.

[0129] Third, the total quantity of the malicious domain name containing.com and.cn is counted from the 50 malicious domain names contained in the 100 domain names, that is, the second quantity.

[0130] Fourthly, a ratio of the third quantity corresponding to.com and the fourth quantity corresponding to.com is calculated to obtain a proportion of the top-level domain name and the malicious domain name containing the top-level domain name. A ratio of the third quantity corresponding to.cn and the fourth quantity corresponding to.cn is calculated to obtain a proportion of the top-level domain name and the malicious domain name containing the top-level domain name.

[0131] It can be understood that determining the proportion of the top-level domain name and the malicious domain name containing the top-level domain name can further include:

[0132] It is assumed that the training set contains 100 domain names, which can specifically include 50 normal domain names and 50 malicious domain names.

[0133] Firstly, for each domain name, the corresponding domain name is segmented to obtain at least one string, and at least one string corresponding to the corresponding domain name is converted into a second feature sequence according to the second dictionary, to obtain a second feature sequence corresponding to each domain name respectively.

[0134] Secondly, if each top-level domain name contained in each domain name is.com and.cn respectively, the total number of the second feature sequence corresponding to.com and.cn is counted from the second feature sequence corresponding to each domain name respectively, that is, the third quantity.

[0135] Thirdly, the total number of malicious domain names containing.com and.cn is counted from the 50 malicious domain names contained in the 100 domain names respectively, that is, the fourth quantity.

[0136] Fourthly, a ratio of the third quantity corresponding to.com and the fourth quantity corresponding to.com is calculated to obtain a proportion of the top-level domain name and the malicious domain name containing the top-level domain name. A ratio of the third quantity corresponding to.cn and the fourth quantity corresponding to.cn is calculated to obtain a proportion of the top-level domain name and the malicious domain name containing the top-level domain name.

[0137] It can be understood that the determination of the category of the to-be-tested domain name includes the following cases:

[0138] The first case is that the prediction results of the two neural network models are the same, and both are "normal domain name".

[0139] In this case, if the first credibility of the registration website of the to-be-tested domain name is "low credibility" or there is no first credibility information of the registration website or the second credibility of the top-level domain name in the to-be-tested domain name is "low credibility", the probability that the to-be-tested domain name is a malicious domain name is obtained by the two neural network models respectively; the first top-level domain name contained in the to-be-tested domain name is determined, the first proportion corresponding to the first top-level domain name is determined from the determined proportion, and the category of the to-be-tested domain name is determined by using the obtained probability and the first proportion.

[0140] Specifically, the probabilities that the two neural network models predict the to-be-tested domain name to be a malicious domain name and the first proportion are weighted and summed to obtain a summation result. The weights are each 1 / 3. The first proportion can be a percentage or a fraction.

[0141] If the summation result exceeds 50%, it is determined that the final classification result of the to-be-tested domain name is a "malicious domain name"; if the summation result is less than 50%, it is determined that the final classification result of the to-be-tested domain name is a "normal domain name".

[0142] In the second case, the prediction results of the two neural network models are the same and are both "malicious domain name".

[0143] In this case, if the first credibility of the registration website of the to-be-tested domain name is "low credibility" or the second credibility of the top-level domain name in the to-be-tested domain name is "low credibility", it is determined that the final classification result of the to-be-tested domain name is "malicious domain name".

[0144] In the third case, the prediction results of the two neural network models are different.

[0145] In this case, if the second credibility of the top-level domain name in the to-be-tested domain name is "low credibility", the probabilities that the two neural network models predict the to-be-tested domain name to be a malicious domain name are obtained; the first top-level domain name contained in the to-be-tested domain name is determined, the first proportion corresponding to the first top-level domain name is determined from the determined proportion, and the category of the to-be-tested domain name is determined by using the obtained probabilities and the first proportion.

[0146] Specifically, the probabilities that the two neural network models predict the to-be-tested domain name to be a malicious domain name and the first proportion are weighted and summed to obtain a summation result. The weights are each 1 / 3. The first proportion can be a percentage or a fraction.

[0147] If the summation result exceeds 50%, it is determined that the final classification result of the to-be-tested domain name is a "malicious domain name"; if the summation result is less than 50%, it is determined that the final classification result of the to-be-tested domain name is a "normal domain name".

[0148] It should be noted that in actual application, the first credibility and the second credibility can also be used to determine the category of the to-be-tested domain name. If the first credibility of the registration website of the to-be-tested domain name is "high credibility" or there is no first credibility information of the registration website, but the second credibility of the top-level domain name in the to-be-tested domain name is "high credibility", it is determined that the final classification result of the to-be-tested domain name is a "normal domain name".

[0149] In the embodiment of the application, two neural network models are trained by using two different sets of domain names, and the following advantages are achieved:

[0150] (1) A first sample data set composed of first feature sequences corresponding to respective domain names and a second sample data set composed of second feature sequences corresponding to respective domain names are used to train two neural network models, and the categories of the to-be-tested domain names are predicted based on the two neural network models, which can improve the accuracy of identifying the categories of the to-be-tested domain names.

[0151] (2) The first dictionary and the second dictionary are constructed, specifically, the frequencies of English words, pinyins of Chinese words, English morphemes, and single characters contained in normal domain names and malicious domain names are respectively counted, and common words with higher frequencies in the two types of domain names are removed, then for the two types of domain names, the frequencies of English words, pinyins of Chinese words, English morphemes, and single characters are sorted, the corresponding feature sequences are determined according to the sorting sequence numbers, and the common words, top-level domain names, and the like are set at the end of the sorting queue, and the corresponding feature sequences are determined according to the sorting sequence numbers. Compared with the manner of counting the total frequencies of the strings contained in the normal domain names and the malicious domain names and determining the feature sequences according to the total frequencies in the related technologies, the occurrence of the problem of misidentifying the categories of the domain names can be avoided.

[0152] Figure 2 is a specific implementation flowchart of the domain name category prediction method of the embodiment of the present application, as shown in Figure 2 , the method comprises steps 201 to 206:

[0153] Step 201: Obtain a first sample data set and a second sample data set; the first sample data set is a set composed of first feature sequences corresponding to respective domain names; and the second sample data set is a set composed of second feature sequences corresponding to respective domain names.

[0154] Step 202: input the first sample data set into a first prediction model for training to obtain a first neural network model for predicting the category of the domain name; and input the second sample data set into a second prediction model for training to obtain a second neural network model for predicting the category of the domain name.

[0155] It can be understood that the neural network model can be trained by using deep learning and the first sample data set and the second sample data set to obtain the first neural network model and the second neural network model with the same structure. The structure of the two neural network models can include a word embedding layer, a plurality of hidden layers, and an output layer. There is a connection between adjacent two layers from the word embedding layer to the output layer. The two neural network models can have the same loss function.

[0156] Here, Figure 3 is a schematic diagram of the training process of the first neural network model, as shown in Figure 3As shown, specifically can include:

[0157] First, initialize the model parameters; the initial value of the model parameters can be randomly set;

[0158] Second, the feature sequence corresponding to each normal domain name is taken as the first training data, and the first training data is input into the first prediction model;

[0159] Third, the word embedding layer of the first prediction model converts the input feature sequence into a fixed length word vector;

[0160] Fourth, the hidden layer of the first prediction model extracts the features of the data from the word vector;

[0161] Wherein, the closer to the output layer, the more complex the features extracted by the hidden layer.

[0162] Fifth, the output layer of the first prediction model obtains the prediction result of each normal domain name through the activation function.

[0163] It should be noted that since it is a binary classification problem, the prediction result of the output of the first prediction model is the probability of predicting the domain name as a normal domain name and the probability of predicting the domain name as a malicious domain name.

[0164] Sixth, compare the actual classification of the input domain name with the prediction result of the first prediction model, and calculate the gradient of each parameter in the first prediction model through the loss function, and update the parameters of the model according to the gradient from the output layer to the word embedding layer through back propagation.

[0165] That is, based on the current model parameters, the first training data is input into the first prediction model to update the model parameters.

[0166] Seventh, repeat the input of the first training data several times until the difference between the output of the first prediction model and the actual classification of the input domain name is less than a predefined threshold, thereby obtaining the first neural network model.

[0167] Here, Figure 4 is a schematic diagram of the training process of the second neural network model, as Figure 4 shown, specifically can include:

[0168] First, initialize the model parameters; the initial value of the model parameters can be randomly set.

[0169] Second, the feature sequence corresponding to each malicious domain name is taken as the second training data, and the second training data is input into the second prediction model;

[0170] Third, the word embedding layer of the second prediction model converts the input feature sequence into a fixed length word vector;

[0171] Fourth, the hidden layer of the second prediction model extracts features of data from the word vector;

[0172] Wherein, the closer to the output layer, the more complex the features extracted by the hidden layer.

[0173] Fifth, the output layer of the second prediction model obtains the prediction result of each normal domain name through the activation function.

[0174] It should be noted that, since a binary classification problem is solved, the prediction result of the output of the second prediction model is the probability of predicting that the domain name is a normal domain name and the probability of predicting that the domain name is a malicious domain name.

[0175] Sixth, the actual classification of the input domain name and the prediction result of the second prediction model are compared, and the gradient of each parameter in the second prediction model is calculated through the loss function, and the gradient is propagated from the output layer to the word embedding layer, and the parameters of the model are updated in turn according to the gradient.

[0176] That is, based on the current model parameters, the second training data is input into the second prediction model to update the model parameters.

[0177] Seventh, the second training data is input repeatedly for multiple times until the output of the second prediction model and the actual classification of the input domain name are less than a predefined threshold, thereby obtaining the second neural network model.

[0178] Step 203: predicting the to-be-tested domain name by using the first neural network model and the second neural network model respectively to obtain a first prediction result and a second prediction result.

[0179] It can be understood that, Figure 5 is a schematic diagram of predicting the to-be-tested domain name by using the first neural network model, as Figure 5 shown, specifically comprising:

[0180] According to a preset dictionary, determining a first feature sequence and a second feature sequence corresponding to the to-be-tested domain name; the first feature sequence can be obtained by querying a preset first dictionary; and the second feature sequence can be obtained by querying a preset second dictionary.

[0181] Inputting the first feature sequence corresponding to the to-be-tested domain name into the trained first neural network model to obtain an output first prediction result.

[0182] Wherein, the first prediction result includes a probability of predicting that the to-be-tested domain name is a normal domain name and a probability of predicting that the to-be-tested domain name is a malicious domain name.

[0183] Further, if the probability of predicting the to-be-tested domain name as a malicious domain name is greater than or equal to 50%, the category of the to-be-tested domain name is marked as "malicious domain name". If the probability of predicting the to-be-tested domain name as a malicious domain name is less than 50%, the category of the to-be-tested domain name is marked as "normal domain name".

[0184] It can be understood that, Figure 6 is a schematic diagram of predicting the to-be-tested domain name by using the second neural network model, as Figure 6 indicated, and can specifically include:

[0185] According to a preset dictionary, the first feature sequence and the second feature sequence corresponding to the to-be-tested domain name are determined. The first feature sequence can be obtained by querying a preset first dictionary. The second feature sequence can be obtained by querying a preset second dictionary.

[0186] The second feature sequence corresponding to the to-be-tested domain name is input into the trained second neural network model to obtain an output second prediction result.

[0187] The second prediction result includes the probability of predicting the to-be-tested domain name as a normal domain name and the probability of predicting the to-be-tested domain name as a malicious domain name.

[0188] Further, if the probability of predicting the to-be-tested domain name as a malicious domain name is greater than or equal to 50%, the category of the to-be-tested domain name is marked as "malicious domain name". If the probability of predicting the to-be-tested domain name as a malicious domain name is less than 50%, the category of the to-be-tested domain name is marked as "normal domain name".

[0189] Step 204: determining the first credibility of the registration website of the to-be-tested domain name; and determining the second credibility of the top-level domain name in the to-be-tested domain name.

[0190] It can be understood that the first credibility of the registration website of the to-be-tested domain name can be divided according to the registration information required to be entered by the registration website when registering the to-be-tested domain name.

[0191] It can be understood that the second credibility of the top-level domain name in the to-be-tested domain name can be divided by counting the registration information required to be entered by different websites when registering the top-level domain name in the to-be-tested domain name, and by the minimum requirement met by the registration information required to be provided by different websites.

[0192] Step 205: determining the proportion of the top-level domain name and the malicious domain name containing the top-level domain name by using the first sample data set or the second sample data set.

[0193] a first number of feature sequences corresponding to each top-level domain name is counted from the first feature sequences corresponding to each domain name respectively, and a second number of malicious domain names containing each top-level domain name in each domain name is counted, and a proportion of a top-level domain name and a malicious domain name containing the top-level domain name is obtained based on the counted first number and second number;

[0194] or,

[0195] a third number of feature sequences corresponding to each top-level domain name is counted from the second feature sequences corresponding to each domain name respectively, and a fourth number of malicious domain names containing each top-level domain name in each domain name is counted, and a proportion of a top-level domain name and a malicious domain name containing the top-level domain name is obtained based on the counted third number and fourth number.

[0196] Step 206: The first prediction result and the second prediction result are used to determine the category of the domain name to be tested in combination with at least two of the first confidence, the second confidence, and the proportion.

[0197] In the embodiment of the application, the first prediction result and the second prediction result are used to determine the category of the domain name to be tested in combination with at least two of the first confidence, the second confidence, and the proportion, which has the following advantages:

[0198] (1) By introducing the first confidence of the registration website of the domain name, the second confidence of the top-level domain name in the domain name to be tested, and the proportion of the top-level domain name and the malicious domain name containing the top-level domain name as the classification basis of the domain name, compared with the model detection method based on pure syntax prediction in the related art, the final classification result is more reliable, and the detection accuracy can be improved when detecting domain names outside the training set, especially when detecting domain names with unknown syntax features.

[0199] (2) By combining the multi-dimensional domain name registration confidence, the detection confidence of the domain name with unknown syntax features is improved.

[0200] To implement the domain name category prediction method of the embodiment of the application, an embodiment of the application further provides a domain name category prediction device. Figure 7 The composition structure diagram of the domain name category prediction device of the embodiment of the application is shown in Figure 7 The device comprises:

[0201] The acquisition unit 71 is configured to acquire a first sample data set and a second sample data set; the first sample data set is a set composed of first feature sequences corresponding to each domain name respectively; and the second sample data set is a set composed of second feature sequences corresponding to each domain name respectively;

[0202] The first processing unit 72 is configured to input the first sample data set into a first prediction model for training to obtain a first neural network model for predicting the domain name category, and input the second sample data set into a second prediction model for training to obtain a second neural network model for predicting the domain name category.

[0203] The second processing unit 73 is configured to determine the category of the to-be-tested domain name based on the first neural network model and the second neural network model.

[0204] In an embodiment, the second processing unit 73 is specifically configured to:

[0205] predict the to-be-tested domain name by using the first neural network model and the second neural network model respectively to obtain a first prediction result and a second prediction result;

[0206] determine a first credibility of a registration website of the to-be-tested domain name, and determine a second credibility of a top-level domain name in the to-be-tested domain name;

[0207] determine a proportion of the top-level domain name in the malicious domain name containing the top-level domain name by using the first sample data set or the second sample data set;

[0208] determine the category of the to-be-tested domain name by using the first prediction result and the second prediction result in combination with at least two of the first credibility, the second credibility and the proportion.

[0209] In an embodiment, the second processing unit 73 is specifically configured to:

[0210] obtain registration information required by a registration website of the to-be-tested domain name;

[0211] determine the first credibility of the registration website of the to-be-tested domain name according to the registration information.

[0212] In an embodiment, the second processing unit 73 is specifically configured to:

[0213] obtain registration information required by each registration website of the top-level domain name in the to-be-tested domain name to obtain a plurality of registration information;

[0214] determine the second credibility of the top-level domain name in the to-be-tested domain name according to the plurality of registration information.

[0215] In an embodiment, the second processing unit 73 is specifically configured to:

[0216] statistically obtain a first number of the feature sequence corresponding to each top-level domain name from the first feature sequence corresponding to each domain name, and a second number of malicious domain names containing each top-level domain name in each domain name; and obtain a proportion of a top-level domain name and malicious domain names containing the top-level domain name based on the first number and the second number.

[0217] Or,

[0218] statistically obtain a third number of the feature sequence corresponding to each top-level domain name from the second feature sequence corresponding to each domain name, and a fourth number of malicious domain names containing each top-level domain name in each domain name; and obtain a proportion of a top-level domain name and malicious domain names containing the top-level domain name based on the third number and the fourth number.

[0219] In an embodiment, the acquisition unit 71 is specifically configured to:

[0220] acquire a plurality of domain names;

[0221] determine a string corresponding to each domain name;

[0222] segment the string corresponding to each domain name to obtain at least one segmented string;

[0223] convert the at least one segmented string of each domain name into a first feature sequence and a second feature sequence based on a preset dictionary;

[0224] obtain the first sample data set based on the first feature sequence corresponding to each domain name, and obtain the second sample data set based on the second feature sequence corresponding to each domain name.

[0225] In actual application, the acquisition unit 71 can be implemented by a communication interface in the domain name category prediction device; and the first processing unit 72 and the second processing unit 73 can be implemented by a processor in the domain name category prediction device.

[0226] It should be noted that the domain name category prediction device provided in the above embodiments is only used as an example for illustrating the division of the above program modules, and in actual application, the above processing can be completed by different program modules according to needs, that is, the internal structure of the device is divided into different program modules to complete all or part of the above processing. In addition, the domain name category prediction device and the domain name category prediction method provided in the above embodiments belong to the same concept, and the specific implementation process is described in detail in the method embodiments, which will not be repeated here.

[0227] The embodiment of the application further provides an electronic device, as shown in the figure, comprising: Figure 8

[0228] ​The communication interface 81 is capable of exchanging information with other devices.

[0229] The processor 82 is connected with the communication interface 81, and is configured to execute a computer program to implement the method provided by any one of the above technical solutions of the electronic device. The computer program is stored in the memory 83.

[0230] It should be noted that the specific processing process of the processor 82 and the communication interface 81 is described in the method embodiments, which will not be repeated here.

[0231] Of course, in actual application, various components in the electronic device 80 are coupled together through the bus system 84. It can be understood that the bus system 84 is used to realize the connection and communication between the components. The bus system 84 includes not only a data bus, but also a power bus, a control bus and a status signal bus. However, in order to clearly illustrate the application, all kinds of buses are marked as the bus system 84 in the Figure 8 .

[0232] The memory 83 in the embodiment of the present application is used to store various types of data to support the operation of the electronic device 80. Examples of these data include any computer programs used for operation on the electronic device 80.

[0233] The method disclosed in the above embodiments of the present application can be applied to or implemented by the processor 82. The processor 82 can be an integrated circuit chip with processing capability. In the implementation process, each step of the above method can be completed by the integrated logic circuit or the instruction of software form in the processor 82. The processor 82 can be a general processor, a digital signal processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc. The processor 82 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. The general processor can be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiments of the present application, the hardware decoding processor can be directly embodied to execute the above steps, or the hardware and software modules in the decoding processor can be combined to execute the above steps. The software module can be located in the storage medium, which is located in the memory 83, and the processor 82 reads the information in the memory 83 and combines the hardware to complete the steps of the above method.

[0234] In an exemplary embodiment, the electronic device 80 can be implemented with one or more Application Specific Integrated Circuits (ASICs), DSPs, Programmable Logic Devices (PLDs), Complex Programmable Logic Devices (CPLDs), Field-Programmable Gate Arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic elements for executing the aforementioned methods.

[0235] It can be understood that the memory (the memory 83) of the embodiments of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. The non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a ferromagnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM). The magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM) used as an external cache. By way of example but not limitation, many forms of RAM can be used, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), sync link dynamic random access memory (SLDRAM), and direct rambus random access memory (DRRAM).The memory described in the embodiments of the present application is intended to include, but not limited to, these and any other suitable types of memory.

[0236] In the example embodiments, the embodiments of the present application also provide a storage medium, specifically a computer readable storage medium, such as a memory storing a computer program, which can be executed by the processor 82 of the electronic device 80 to complete the steps of the aforementioned electronic device side method. The computer readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0237] It should be noted that "first", "second", and the like are used to distinguish similar objects, and do not necessarily have to describe a specific order or sequence.

[0238] In addition, the technical solutions described in the embodiments of the present application can be arbitrarily combined without conflict.

[0239] The above is only a preferred embodiment of the present application, and is not intended to limit the protection scope of the present application.

Claims

1. A domain name category prediction method characterized by, The method comprises: obtaining a first sample data set and a second sample data set; the first sample data set is a set composed of first feature sequences corresponding to respective domain names; the second sample data set is a set composed of second feature sequences corresponding to respective domain names; inputting the first sample data set into a first prediction model for training to obtain a first neural network model for predicting the category of a domain name; and inputting the second sample data set into a second prediction model for training to obtain a second neural network model for predicting the category of a domain name; determining the category of a to-be-tested domain name based on the first neural network model and the second neural network model; wherein the determination of the category of the to-be-tested domain name based on the first neural network model and the second neural network model comprises: predicting the to-be-tested domain name by using the first neural network model and the second neural network model respectively to obtain a first prediction result and a second prediction result; determining a first credibility of a registration website of the to-be-tested domain name; and determining a second credibility of a top-level domain name in the to-be-tested domain name; determining the proportion of the top-level domain name and malicious domain names containing the top-level domain name by using the first sample data set or the second sample data set; determining the category of the to-be-tested domain name by using the first prediction result and the second prediction result in combination with at least two of the first credibility, the second credibility and the proportion.

2. The method of claim 1, wherein, The determination of the first credibility of the registration website of the to-be-tested domain name comprises: obtaining registration information required by a registration website of the to-be-tested domain name; determining the first credibility of the registration website of the to-be-tested domain name according to the registration information.

3. The method of claim 1, wherein, The determination of the second credibility of the top-level domain name in the to-be-tested domain name comprises: obtaining registration information required by respective registration websites of the top-level domain name in the to-be-tested domain name to obtain a plurality of registration information; determining the second credibility of the top-level domain name in the to-be-tested domain name according to the plurality of registration information.

4. The method of claim 1, wherein, The determination of the proportion of the top-level domain name and malicious domain names containing the top-level domain name by using the first sample data set or the second sample data set comprises: statistically obtaining a first number of feature sequences corresponding to respective top-level domain names from the first feature sequences corresponding to respective domain names; and statistically obtaining a second number of malicious domain names containing respective top-level domain names in respective domain names; obtaining the proportion of the top-level domain name and malicious domain names containing the top-level domain name based on the statistical first number and the statistical second number; or, statistically obtaining a third number of feature sequences corresponding to respective top-level domain names from the second feature sequences corresponding to respective domain names; and statistically obtaining a fourth number of malicious domain names containing respective top-level domain names in respective domain names; obtaining the proportion of the top-level domain name and malicious domain names containing the top-level domain name based on the statistical third number and the statistical fourth number.

5. The method of claim 1, wherein, The obtaining of the first sample data set and the second sample data set comprises: obtaining a plurality of domain names; determining a string corresponding to each domain name; segmenting the string corresponding to each domain name to obtain at least one segmented string; Convert at least one string after each domain name is segmented into a first feature sequence and a second feature sequence based on a preset dictionary; Obtain the first sample data set based on the first feature sequence corresponding to each domain name respectively, and obtain the second sample data set based on the second feature sequence corresponding to each domain name respectively.

6. A domain name category prediction apparatus characterized by comprising: Comprise: An acquisition unit is configured to acquire a first sample data set and a second sample data set; The first sample data set is a set composed of the first feature sequence corresponding to each domain name respectively; The second sample data set is a set composed of the second feature sequence corresponding to each domain name respectively; A first processing unit is configured to input the first sample data set into a first prediction model for training to obtain a first neural network model for predicting the category of the domain name, and input the second sample data set into a second prediction model for training to obtain a second neural network model for predicting the category of the domain name; A second processing unit is configured to determine the category of the domain name to be tested based on the first neural network model and the second neural network model, wherein the determination of the category of the domain name to be tested based on the first neural network model and the second neural network model comprises: Using the first neural network model and the second neural network model to predict the domain name to be tested respectively to obtain a first prediction result and a second prediction result; Determining the first credibility of the registration website of the domain name to be tested, and determining the second credibility of the top-level domain name in the domain name to be tested; Using the first sample data set or the second sample data set to determine the proportion of the top-level domain name and the malicious domain name containing the top-level domain name; Using the first prediction result and the second prediction result, combining at least two of the first credibility, the second credibility and the proportion to determine the category of the domain name to be tested.

7. An electronic device, comprising: Comprise: A communication interface is configured to acquire a first sample data set and a second sample data set; the first sample data set is a set composed of the first feature sequence corresponding to each domain name respectively; The second sample data set is a set composed of the second feature sequence corresponding to each domain name respectively; A processor is configured to input the first sample data set into a first prediction model for training to obtain a first neural network model for predicting the category of the domain name, and input the second sample data set into a second prediction model for training to obtain a second neural network model for predicting the category of the domain name; and determine the category of the domain name to be tested based on the first neural network model and the second neural network model; Wherein, the determination of the category of the domain name to be tested based on the first neural network model and the second neural network model comprises: Using the first neural network model and the second neural network model to predict the domain name to be tested respectively to obtain a first prediction result and a second prediction result; Determining the first credibility of the registration website of the domain name to be tested, and determining the second credibility of the top-level domain name in the domain name to be tested; Using the first sample data set or the second sample data set to determine the proportion of the top-level domain name and the malicious domain name containing the top-level domain name; Using the first prediction result and the second prediction result, combining at least two of the first credibility, the second credibility and the proportion to determine the category of the domain name to be tested. The first prediction result and the second prediction result are combined with at least two of the first credibility, the second credibility, and the proportion to determine a category of the to-be-tested domain name.

8. An electronic device, comprising: comprising a processor and a memory for storing a computer program capable of running on the processor, wherein the processor is configured to execute the computer program to perform the steps of the method of any one of claims 1 to 5.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 5. The computer program is executed by the processor to implement the steps of the method of any one of claims 1 to 5.

Images