A domain name abuse detection method and system based on cluster analysis

Abstract

The application discloses a domain name abuse detection method and system based on cluster analysis, the method comprising: selecting multi-dimensional features of domain name applications; establishing a one-dimensional feature coordinate system for each feature in the multi-dimensional features; the one-dimensional feature coordinate system is used for identifying the position of the value converted according to a preset value standard in the coordinate system; a multi-dimensional feature coordinate system is established according to all the one-dimensional feature coordinate systems; a preset number of domain name applications are obtained according to a domain name list or a URL list; multi-dimensional features of the domain name applications are collected; each feature in the multi-dimensional features of the domain name is converted into a value used for identification in the multi-dimensional feature coordinate system according to a preset value standard; the clustering condition of the domain name applications is calculated according to the value identified in the multi-dimensional feature coordinate system, and a detection result of domain name abuse is obtained according to the clustering condition, so that the purpose of high detection efficiency and high accuracy without relying on a single feature is achieved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of domain name maintenance, in particular to a domain name abuse detection method and system based on cluster analysis. BACKGROUND

[0002] Due to the easy-to-remember feature, domain names become the access portal of various Internet applications (websites, emails, etc.). With the development of the Internet, the number of domain names has also rapidly increased. According to third-party data, by early 2022, the global top-level domain name registration volume has reached 350 million. The definition of domain name abuse is relatively broad. Generally speaking, any malicious behavior that abuses, misuses or attacks the existing domain name system can be called domain name abuse.

[0003] Common domain name abuses include illegal websites, phishing websites, sending spam emails, botnets, spreading malicious software, and other gray and black domain name industries built by registering domain names. With the development of the Internet, domain name abuses are emerging in an endless stream. These abuses have posed a certain threat to the Internet, affected the normal network of computer users, seriously affected the user experience of the Internet, and even caused significant economic or social losses.

[0004] Currently, the detection technology for domain name abuse mainly applies to each domain name by matching or screening through specific features, including domain name features, URL features, domain name resolution features, text features, website image features, and website structure features (for website form domain name abuse). Specifically, there are two ways: feature library matching detection and machine learning detection can have good detection effect on the discovered abuse, but also have some shortcomings, such as large manual input, low efficiency, poor scalability, and poor detection efficiency sustainability. SUMMARY

[0005] The application provides a domain name abuse detection method and system based on cluster analysis, which solves the problems of large manual input, low efficiency, poor scalability, and poor detection efficiency sustainability.

[0006] In a first aspect, the application provides a domain name abuse detection method based on cluster analysis, which comprises:

[0007] selecting multi-dimensional features of domain name applications;

[0008] establishing a one-dimensional feature coordinate system corresponding to each feature in the multi-dimensional features; the one-dimensional feature coordinate system is used to identify the position of the value converted according to a preset value standard in the coordinate system;

[0009] establishing a multi-dimensional feature coordinate system according to all the one-dimensional feature coordinate systems;

[0010] According to the domain name list or the URL list, a preset number of domain name applications are obtained; and domain name multi-dimensional features of the domain name applications are collected;

[0011] According to a preset numerical standard, each feature in the domain name multi-dimensional features is respectively converted into a numerical value for identifying in a multi-dimensional feature coordinate system;

[0012] According to the numerical value identified in the multi-dimensional feature coordinate system, an aggregation condition of the domain name applications is calculated, and a domain name abuse detection result is obtained according to the aggregation condition.

[0013] In an implementation manner, the multi-dimensional features include a domain name name feature, a URL feature, an IPv4 address, an IP address home country, a domain name resolution feature, a text feature, a website image feature, and a website structure feature.

[0014] In an implementation manner, the preset numerical standard is configured to:

[0015] If there is a feature with difficulty in conversion in the multi-dimensional features, the feature is split into multiple dimensions according to a preset rule, and each dimension is sequentially numbered, so that different features correspond to different numbers.

[0016] In an implementation manner, the step of calculating the aggregation condition of the domain name applications according to the numerical value identified in the multi-dimensional feature coordinate system and obtaining the domain name abuse detection result according to the aggregation condition includes:

[0017] The domain name multi-dimensional features are split into multiple dimensions;

[0018] All the dimensions are set to a unit distance;

[0019] A unit space is generated according to the unit distance of all the dimensions;

[0020] The proportion of the number of domain names of the domain name applications in the unit space in the entire multi-dimensional space is calculated;

[0021] It is judged whether the proportion is greater than or equal to a preset threshold value;

[0022] If yes, there is an aggregation domain name application.

[0023] In an implementation manner, the step after judging whether the proportion is greater than or equal to the preset threshold value includes:

[0024] If no, there is no aggregation domain name application.

[0025] In an implementation manner, the step of calculating the proportion of the domain name applications in the unit space includes:

[0026] The proportion = the number of the domain name applications in the unit space / the total number of the domain name applications.

[0027] In a second aspect, the application provides a domain name abuse detection system based on cluster analysis, comprising a configuration module, a data processing module, a first conversion module, a collection module, a second conversion module, and a calculation module.

[0028] The configuration module is configured to select multi-dimensional features of domain name applications.

[0029] The data processing module is configured to establish a one-dimensional feature coordinate system corresponding to each feature in the multi-dimensional features; the one-dimensional feature coordinate system is used to identify the position of the value converted according to a preset value standard in the coordinate system.

[0030] The first conversion module is configured to establish a multi-dimensional feature coordinate system according to all the one-dimensional feature coordinate systems.

[0031] The collection module is configured to obtain a preset number of domain name applications according to a domain name list or a URL list; and collect multi-dimensional features of the domain name applications.

[0032] The second conversion module is configured to convert each feature in the multi-dimensional features of the domain name applications into a value used to identify the value in the multi-dimensional feature coordinate system according to a preset value standard.

[0033] The calculation module is configured to calculate the clustering of the domain name applications according to the values identified in the multi-dimensional feature coordinate system, and obtain a detection result of domain name abuse according to the clustering.

[0034] In a third aspect, the application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the domain name abuse detection method based on cluster analysis according to the first aspect.

[0035] In a fourth aspect, the application provides a non-transitory computer readable storage medium having a computer program stored thereon, wherein the computer program is executable by a processor to implement the steps of the domain name abuse detection method based on cluster analysis according to the first aspect.

[0036] From the above technical solution, by utilizing the aggregation feature of the domain name abuse multi-dimensional feature for abuse detection, it does not depend on a single domain name abuse instance, and does not depend on a single feature (such as: does not depend on the text feature of the domain name abuse application), and can also be used based on other multi-dimensional features in the case that one or more features cannot obtain data. It is suitable for various types of domain name abuse. Moreover, it does not need to model and train various multi-dimensional features separately, and the early work is less. The aggregation feature of the domain name abuse on the multi-dimensional feature is utilized, so that the suspected domain name abuse detected by a single detection is in batches, and the output of a single detection is very high. According to our abuse detection of 20 million domain names, the number of domain name abuse output by a single output is between 200,000 and 400,000. The subsequent manual disposal workload of the batch suspected results is also very small. As a domain name abuse detection technology with the highest output under certain computing power investment, the accuracy of the suspected domain name abuse detected by the technology is high. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, a brief introduction will be given below to the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description are only embodiments of the present application, and those skilled in the art can obtain other drawings without creative labor on the basis of the provided drawings.

[0038] Figure 1 A flowchart of a domain name abuse detection method and system based on cluster analysis provided by the present application;

[0039] Figure 2 A flowchart of calculating the aggregation of domain name applications of a domain name abuse detection method and system based on cluster analysis provided by the present application;

[0040] Figure 3 A schematic diagram of a domain name abuse detection system based on cluster analysis provided by the present application. DETAILED DESCRIPTION

[0041] It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0042] The process of dividing a set of physical or abstract objects into multiple classes composed of similar objects is called clustering. The cluster generated by clustering is a set of data objects, which are similar to each other in the same cluster and different from the objects in other clusters. "Birds of a feather flock together, and people are divided into groups", in natural science and social science, there are a large number of classification problems. Cluster analysis, also known as group analysis, is a statistical analysis method for studying (sample or index) classification problems.

[0043] The current detection technology for domain name abuse mainly applies matching or screening through specific features to each domain name, and the features include: domain name features, URL features, domain name resolution features, text features, website image features, and website structure features (for website form domain name abuse). Specifically, there are the following two ways:

[0044] 1. Feature library matching detection: based on the prepared feature library (text library, image library, other feature library), the system is compared, and the domain name application with specific features is matched;

[0045] 2. Machine learning detection: based on the above single feature or multiple features, positive samples are used for machine learning training modeling, and the model is used for system detection.

[0046] The above detection technology has good detection effect on the discovered abuse, but also has the following shortcomings:

[0047] (1) Large manual input: feature library-based detection needs to be based on a large amount of manual screening or manual reporting processing in advance. And the domain name abuse detection based on machine learning needs to select a large number of positive and negative samples for manual annotation modeling.

[0048] (2) Low efficiency: the existing detection technology needs to model or collect feature libraries for different text, image, and domain name features of domain name applications, and build various detection models or feature libraries. When performing detection, different models need to be calculated or different feature libraries need to be compared, and the detection efficiency is low.

[0049] (3) Poor scalability and poor detection efficiency persistence: the Internet is changing rapidly, and domain name abuse is changing. With the passage of time and the change of domain name abuse, the accuracy and recall rate of detection based on the original feature library or the established detection model will become lower and lower. The feature library must be updated, and the detection model also needs to be re-modeled by collecting new samples.

[0050] The present application is to solve the problem in the prior art that the current detection technology for domain name abuse mainly applies matching or screening through specific features to each domain name, and the features include: domain name features, URL features, domain name resolution features, text features, website image features, and website structure features (for website form domain name abuse). Specifically, there are two ways: feature library matching detection and machine learning detection, which can have good detection effect on the discovered abuse, but also have problems such as large manual input, low efficiency, poor scalability, and poor detection efficiency persistence. Based on the above reasons, the present application provides a domain name abuse detection method and system based on cluster analysis.

[0051] Domain name abuse has developed into multiple upstream and downstream industry chains. There are professional personnel to provide services for the registration of domain names, the leasing and erection of servers, the development and promotion of domain name abuse application programs, and domain name abuse exists in the form of clusters rather than isolated cases in order to obtain more benefits. In our daily data analysis, we also found that a considerable part of domain name abuse has the characteristics of aggregation. Through the analysis of the aggregation characteristics of domain name abuse, we can quickly and batch discover a large number of domain name abuses.

[0052] The method and system of the present application will be further described below in combination with specific embodiments.

[0053] In a first aspect, as shown in the accompanying drawings, the present application provides a domain name abuse detection method based on cluster analysis, which comprises the following steps: Figure 1 S100, selecting multi-dimensional features of domain name application;

[0054]

[0055] In step S100, the multi-dimensional features of common domain name application include domain name name features, URL features, IPv4 address, IP address country of origin, domain name resolution features, text features, website image features and website structure features.

[0056] S200, establishing a one-dimensional feature coordinate system corresponding to each feature in the multi-dimensional features; the one-dimensional feature coordinate system is used to identify the position of the converted value of the feature in the coordinate system according to a preset numerical standard;

[0057] In step S200, the preset numerical standard is configured to: if there is a feature with difficulty in converting numerical values in the multi-dimensional features, the feature is split into multiple dimensions according to a preset rule, and each dimension is sequentially numbered, so that different features correspond to different numbers.

[0058] ​In an actual application scenario, since the application utilizes the aggregation feature of domain name abuse in multiple dimensions, it is necessary to select the multiple dimensions used by the system first. The selected multiple dimensions can be domain name features, URL features, IPv4 addresses, IP address country of origin, domain name resolution features, text features, website image features, and website structure features, etc. After determining the required multiple dimensions, each feature in the multiple dimensions is converted into a numerical value according to a predetermined numerical standard. If there is no difficulty in converting the numerical value in the multiple dimensions, the selected multiple dimensions can be directly converted into a numerical value, for example, the IPv4 address feature. If the IPv4 address is 193.168.32.2, the converted decimal integer numerical value is 3249020930. The conversion method can also be to directly sequentially number the features, for example, the IP address country of origin feature. Then, the 200+ countries can be numbered, for example, 1 for China and 2 for the United States. Therefore, the numerical value of the IP address country of origin feature is 1. If there is a difficulty in converting the numerical value in the multiple dimensions, it is necessary to split it into multiple dimensions according to the predetermined rule, and sequentially number each dimension to ensure that different features correspond to different numbers, for example, the IP address location feature. Since the IP address location itself is not a number, it needs to be converted into a numerical value. Normally, the geographical location is represented by longitude and latitude, but since it is difficult to obtain longitude and latitude, two dimensions of country and province can be added according to the actual situation. The country is numbered, for example, 1 for China and 2 for the United States. Therefore, the numerical value of the IP address country feature is 1. The province feature is processed in the same way, for example, 1 for Liaoning Province and 2 for Zhejiang Province. Therefore, the numerical value of the IP address province feature is 2. Then, two one-dimensional feature coordinate systems are established according to the converted numerical values.

[0059] S300, a multiple dimension feature coordinate system is established according to all the one-dimensional feature coordinate systems;

[0060] In an actual application scenario, since the one-dimensional feature coordinate system has been established according to the converted numerical values, the points on the one-dimensional feature coordinate system represent the positions of the multiple dimensions. A multiple dimension feature coordinate system is established according to all the obtained one-dimensional feature coordinate systems.

[0061] S400, a predetermined number of domain name applications are obtained according to a domain name list or a URL list; domain name multiple dimensions of the domain name applications are collected;

[0062] In actual application scenarios, the domain name list is a collection of domain names of a website, and the domain name list is usually collected from the Internet or obtained from a third-party channel as an entry for detection. URL is the abbreviation of uniform resource locator, which is a method for specifying the location of information on the World Wide Web service program of the Internet. A URL is composed of a series of characters, which can be letters, numbers and special symbols. The URL contains the following information: the protocol used to access the resource, the location of the server (whether through an IPv4 address or a domain name), the port number on the server, the location of the resource in the server directory structure, and the fragment identifier. The URL list is usually collected from the Internet or obtained from a third-party channel as an entry for detection. A preset number of domain name applications are obtained according to the domain name list or the URL list. In order to better judge the aggregation of the domain name applications, the number of domain name applications should be at least in the unit of ten thousand. The domain name multi-dimensional features of the domain name applications are obtained by using a crawler to crawl web pages and using a detection program to perform data detection.

[0063] S500, converting each feature in the domain name multi-dimensional features into a value for identifying a position in the multi-dimensional feature coordinate system according to a preset numerical standard;

[0064] In actual application scenarios, a preset numerical standard needs to be established first, and each feature in the domain name multi-dimensional features is converted into a value according to the preset numerical standard, and the value is used to identify the position of the feature in the multi-dimensional feature coordinate system. When each feature in the domain name multi-dimensional features is converted into a value, if there is no feature in the domain name multi-dimensional features that is difficult to convert into a value, the selected domain name multi-dimensional features can be directly converted into a value according to the above-mentioned preset rule, or the conversion mode can be directly sequentially numbered. If there is a feature in the domain name multi-dimensional features that is difficult to convert into a value, the feature needs to be split into multiple dimensions according to the above-mentioned preset rule, and each dimension is sequentially numbered to ensure that different features correspond to different numbers.

[0065] S600, calculating the aggregation of the domain name applications according to the values identified in the multi-dimensional feature coordinate system, and obtaining a detection result of domain name abuse according to the aggregation.

[0066] In step S600, as shown in Figure 2 the step of calculating the aggregation of the domain name applications according to the values identified in the multi-dimensional feature coordinate system and obtaining a detection result of domain name abuse according to the aggregation includes:

[0067] S610, splitting the domain name multi-dimensional features into multiple dimensions;

[0068] In step S610, if there is a feature of the domain name multi-dimensional feature that is difficult to convert into a numerical value, the feature needs to be split into multiple dimensions according to a preset rule, so as to facilitate the conversion into a numerical value.

[0069] S620, setting a unit distance for all the dimensions;

[0070] In step S620, a standard distance L is set for each dimension after splitting, from L1 to L W .

[0071] S630, generating a unit space according to the unit distance of all the dimensions;

[0072] In step S630, a unit space is composed according to the unit distance set for each dimension (the volume of the unit space is L1*L2*…*L w ).

[0073] S640, calculating the proportion of the number of domain name applications in the unit space in the entire multi-dimensional space (multi-dimensional feature coordinate system);

[0074] In step S640, in order to determine whether there is an agglomeration application, the proportion of the domain name application in the unit space needs to be calculated, wherein the proportion = the number of domain name applications in the unit space / the number of all domain name applications.

[0075] S650, determining whether the proportion is greater than or equal to a preset threshold;

[0076] In step S650, since it is necessary to determine whether the proportion is greater than or equal to a preset threshold to determine whether there is an agglomeration application, the preset threshold K is a small number between 0 and 1. Moreover, the value of K actually depends on multiple factors: whether the detected domain name applications are sufficient and representative, the selection of multi-dimensional features, and the establishment standard of each feature dimension coordinate system (the calculation method of feature conversion into a numerical value).

[0077] S660, if yes, there is an agglomeration domain name application;

[0078] S670, if no, there is no agglomeration domain name application.

[0079] In an actual application scenario, the domain name multi-dimensional features are first split into multiple dimensions, and a unit distance is set for each dimension after splitting. If the domain name multi-dimensional features are split into three dimensions: L1L2L3, the unit space generated by the unit distance of all dimensions is represented as V=L1*L2*L3. Then, the proportion R of the domain name application in the unit space needs to be calculated. Since the proportion = the number of domain name applications in the unit space / the total number of domain name applications. If the preset threshold K is 0.1, if the number of domain name applications in the standard unit space is 500, and the total number of domain name applications is 50000, then R=500÷50000=0.01, so R

[0080] Taking website domain name abuse detection as an example: first, obtain the multi-dimensional features of the domain name application, wherein the multi-dimensional features include: domain name name features, URL features, IPv4 address, IP address country of origin, domain name resolution features, text features, website image features and website structure features. After determining the required multi-dimensional features, each feature in the multi-dimensional features is converted into a numerical value according to a preset numerical standard. If there is no difficulty in converting the numerical value in the multi-dimensional features, the selected multi-dimensional features can be directly converted into numerical values, and the conversion method can be direct sequential numbering of the multi-dimensional features. If there is a difficulty in converting the numerical value in the multi-dimensional features, it needs to be split into multiple dimensions according to the preset rule, and each dimension is sequentially numbered to ensure that different features correspond to different numbers. A one-dimensional feature coordinate system is established according to the converted numerical values, and a multi-dimensional feature coordinate system is established according to all one-dimensional feature coordinate systems.

[0081] According to the domain name list or URL list, a preset number of website applications are obtained, and domain name multi-dimensional features of the website applications are collected. For website domain name abuse detection, the selected domain name multi-dimensional features are website IPv4 address, website keyword, and website server country / region. First, the website IPv4 address is converted into a numerical value. Second, the website keyword selects an abuse text feature library. Whether the text contains the feature library and the frequency of the feature text are converted into numerical values through a preset numerical standard. Finally, the website server country / region is converted into a numerical value according to a preset numerical standard. Each country / region needs to be numbered, for example, region A is numbered as 1, and region B is numbered as 5. Each individual website application is calculated according to the above three features to obtain specific three-dimensional coordinates. According to the aggregation degree of all website applications in the three-dimensional space, abuse analysis is carried out: if the proportion of website applications appearing in a certain three-dimensional space to all website applications reaches a certain threshold, it is judged that the domain name applications aggregated in this space are suspected of domain name abuse, and subsequent manual disposal or further screening combined with other specific features is carried out for manual disposal.

[0082] Taking spam detection as an example: first, the multi-dimensional features of the domain name application are obtained, wherein the multi-dimensional features include: domain name name features, URL features, IPv4 address, IP address country of origin, domain name resolution features, text features, website image features, and website structure features. After determining the required multi-dimensional features, each feature in the multi-dimensional features is converted into a numerical value according to a preset numerical standard. If there is no difficulty in converting the numerical value in the multi-dimensional features, the selected multi-dimensional features can be directly converted into numerical values, and the conversion method can be direct sequential numbering of the multi-dimensional features. If there are features in the multi-dimensional features that are difficult to convert into numerical values, they need to be split into multiple dimensions according to the preset rules, and each dimension is sequentially numbered to ensure that different features correspond to different numbers. A one-dimensional feature coordinate system is established according to the converted numerical values, and a multi-dimensional feature coordinate system is established according to all one-dimensional feature coordinate systems.

[0083] According to the domain name list or the URL list, a preset number of mails are obtained, and domain name multi-dimensional features of the mails are collected. For the junk mail detection, the selected domain name multi-dimensional features are: mail sending IPv4 address, mail server IPv4 address, mail sending time, and mail sender. After the domain name multi-dimensional features are confirmed, the domain name multi-dimensional features are respectively converted into values according to preset value standards. The mail sending IPv4 address is converted into a value in base 256, the mail sending server IPv4 address is converted into a value in base 256, the mail sending time is converted into a value in base 300 (5 minutes as a period) of a time stamp, and the mail sender is converted into a value according to a comparison table (a new record is added every time a new mail sender is found in the processing process). Each mail obtains specific four-dimensional coordinates according to the above four domain name multi-dimensional features. According to the aggregation degree of all mails in the four-dimensional space, abuse analysis is performed: if the proportion of the mails appearing in a certain four-dimensional space to all mails reaches a certain threshold value, the mails aggregated in the space are judged as suspected junk mails, and the suspected junk mails can be directly shielded.

[0084] In a second aspect, as shown in the accompanying drawings, the application provides a domain name abuse detection system based on cluster analysis, comprising: a configuration module, a data processing module, a first conversion module, a collection module, a second conversion module, and a calculation module. Figure 3 The configuration module is configured to select multi-dimensional features of domain name applications.

[0085] The data processing module is configured to establish a one-dimensional feature coordinate system for each of the multi-dimensional features; and the one-dimensional feature coordinate system is configured to identify a position of a value converted according to a preset value standard in the coordinate system.

[0086] The first conversion module is configured to establish a multi-dimensional feature coordinate system according to all the one-dimensional feature coordinate systems.

[0087] The collection module is configured to obtain a preset number of domain name applications according to a domain name list or a URL list; and collect domain name multi-dimensional features of the domain name applications.

[0088] The second conversion module is configured to convert each of the domain name multi-dimensional features into a value for identifying a value in the multi-dimensional feature coordinate system according to a preset value standard.

[0089] The calculation module is configured to calculate an aggregation condition of the domain name applications according to the values identified in the multi-dimensional feature coordinate system, and obtain a detection result of domain name abuse according to the aggregation condition.

[0090] The effects of the system in the application of the foregoing method can be referred to the descriptions in the foregoing method embodiments, and will not be repeated here.

[0091]

[0092] ​In a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and capable of running on the processor, wherein the processor implements the steps of the domain name abuse detection method based on cluster analysis according to the first aspect when executing the program.

[0093] In a fourth aspect, the present application provides a non-transitory computer readable storage medium, having stored thereon a computer program, which, when executed by a processor, implements the steps of the domain name abuse detection method based on cluster analysis according to the first aspect.

[0094] Those skilled in the art can clearly understand from the description of the above embodiments that each embodiment can be realized by means of software and necessary general hardware platforms, and of course can also be realized by hardware. Based on such understanding, the above technical solutions, essentially or in terms of contribution to the prior art, can be embodied in the form of a software product. The computer software product can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, or an optical disc, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0095] Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the application disclosed herein. The application is intended to cover any variations, uses, or adaptations of the application following, in general, the principles of the application and including such departures from the present disclosure as come within known or customary practice in the art to which the application pertains. The specification and examples are to be regarded as illustrative only, and the true scope and spirit of the application are indicated by the appended claims.

Claims

1. A domain name abuse detection method based on cluster analysis, the method comprising: Selecting domain name applications involves multiple dimensions; Establish a corresponding one-dimensional feature coordinate system for each of the multi-dimensional features; The one-dimensional feature coordinate system is used to identify the position of the feature in the coordinate system according to the value converted according to the preset numerical standard; Establish a multidimensional feature coordinate system based on all the aforementioned one-dimensional feature coordinate systems; Obtain a preset number of domain applications from a domain name list or URL list; collect the multi-dimensional characteristics of the domain applications. Each feature in the domain name's multidimensional features is converted into a numerical value used to identify it in the multidimensional feature coordinate system according to a preset numerical standard. The clustering of the domain name applications is calculated based on the values ​​identified in the multidimensional feature coordinate system, and the detection result of domain name abuse is obtained based on the clustering. The steps of calculating the clustering of domain name applications based on the values ​​identified in the multidimensional feature coordinate system, and obtaining the detection result of domain name abuse based on the clustering, include: The multidimensional features of the domain name are broken down into multiple dimensions; Set all dimensions to unit distance; Generate a unit space based on the unit distances of all the dimensions described; Calculate the proportion of the number of domain names applied in the unit space to the total multidimensional space; Determine whether the percentage is greater than or equal to a preset threshold; If so, there is a clustering of domain name applications.

2. The method for detecting domain name abuse based on cluster analysis according to claim 1, characterized in that, The multidimensional features include: domain name features, URL features, IPv4 address, country of origin of IP address, domain name resolution features, text features, website image features, and website structure features.

3. The method for detecting domain name abuse based on cluster analysis according to claim 1, characterized in that, The preset numerical standard is configured as follows: If there are features among the multidimensional features that are difficult to convert to numerical values, then the feature is split into multiple dimensions according to a preset rule, and each dimension is sequentially numbered so that different features correspond to different numbers.

4. The method for detecting domain name abuse based on cluster analysis according to claim 1, characterized in that, The steps following determining whether the percentage is greater than or equal to a preset threshold include: If not, there is no clustered domain application.

5. The method for detecting domain name abuse based on cluster analysis according to claim 1, characterized in that, The steps for calculating the proportion of the domain name used in the unit space include: Percentage = Number of domain name applications in the unit space / Total number of domain name applications.

6. A domain name abuse detection system based on cluster analysis, applied to the domain name abuse detection method based on cluster analysis as described in any one of claims 1 to 5, characterized in that, include: Configuration module, data processing module, first conversion module, acquisition module, second conversion module, calculation module; The configuration module is used to select the multidimensional features of the domain application; The data processing module is used to establish a corresponding one-dimensional feature coordinate system for each feature in the multi-dimensional features; the one-dimensional feature coordinate system is used to identify the position of the feature in the coordinate system after the value is converted according to the preset numerical standard; The first transformation module is used to establish a multi-dimensional feature coordinate system based on all the one-dimensional feature coordinate systems; The data collection module is used to obtain a preset number of domain application domains based on a domain name list or URL list; and to collect the multi-dimensional characteristics of the domain application domains. The second conversion module is used to convert each feature in the domain name multidimensional features into a value used to identify the multidimensional feature coordinate system according to a preset numerical standard. The calculation module is used to calculate the clustering of the domain name applications based on the values ​​identified in the multidimensional feature coordinate system, and to obtain the detection result of domain name abuse based on the clustering.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the domain name abuse detection method based on cluster analysis as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of a domain name abuse detection method based on cluster analysis as described in any one of claims 1 to 5.

Images