Method, system, storage medium and computer device for determining compromised host based on machine learning algorithm

Abstract

The application provides a method for determining a compromised host based on a machine learning algorithm, a DGA domain name detection algorithm is used to detect and identify sample data, and a malicious domain name set is obtained; original data of malicious domain names in the malicious domain name set is used to query a to-be-tested host accessing the malicious domain names; DNS response events of the to-be-tested host are analyzed, and an analysis result is obtained; the analysis result is reduced to one-dimensional features, and a target host that is compromised is determined from the to-be-tested host according to characteristic values of the one-dimensional features. The application also provides a system for determining a compromised host based on a machine learning algorithm, a storage medium and a computer device. Therefore, the application can more effectively locate a compromised host and has higher identification efficiency.

Description

Technical Field

[0001] This invention relates to the field of machine learning technology, and in particular to a method, system, storage medium, and computer device for identifying compromised hosts based on machine learning algorithms. Background Technology

[0002] In enterprise server management, various machine learning algorithms can be used to discover many DGA (Domain Generation Algorithm) domain access records, but there are also a large number of false alarms. Enterprise security operations personnel expect to discover compromised hosts (i.e., hosts that have been compromised) through malicious domain access.

[0003] The existing technology provides a solution that uses a large number of DGA domains to train a machine learning model, using the following features for training: tfidf-3000, domain length, number of domain dot segments, entropy, vowel ratio, consonant ratio, total number of letters ratio, number ratio, repeated letter ratio, and consecutive number ratio; and uses the trained model to predict whether the domains accessed by the enterprise are DGA domains, and then judges the hosts accessing these domains as compromised hosts.

[0004] However, existing detection methods often produce many false alarms, and the number of compromised hosts is so large that it is difficult to investigate them one by one.

[0005] In summary, the existing methods have many problems in practical use, so it is necessary to improve them. Summary of the Invention

[0006] To address the aforementioned shortcomings, the present invention aims to provide a method, system, storage medium, and computer equipment for identifying compromised hosts based on machine learning algorithms, which can more effectively locate compromised hosts and has higher identification efficiency.

[0007] To achieve the above objectives, the present invention provides a method for identifying compromised hosts based on machine learning algorithms, comprising the following steps:

[0008] The DGA domain name detection algorithm is used to detect and identify sample data to obtain a set of malicious domain names;

[0009] Based on the original data of the malicious domains in the malicious domain set, query the host under test that accessed the malicious domains;

[0010] Analyze the DNS response events of the host under test to obtain the analysis results;

[0011] The analysis results are reduced to one-dimensional features, and the compromised target host is determined from the host under test based on the feature values ​​of the one-dimensional features.

[0012] Optionally, the step of analyzing the DNS response events of the host under test and obtaining the analysis results specifically includes:

[0013] Based on the DNS response events of the host under test, calculate the number of DNS responses, the first percentage of responses with the NXDOMAIN return code, the second percentage of accesses to DGA domains, and the DNS response rate of the host under test.

[0014] Optionally, the step of reducing the analysis results to one-dimensional features and determining the compromised target host from the host under test based on the feature values ​​of the one-dimensional features specifically includes:

[0015] Principal component analysis is used to reduce the number of DNS responses, the first proportion, the second proportion, and the DNS response rate to one-dimensional features, and the feature values ​​corresponding to the one-dimensional features are obtained.

[0016] The compromised target host is determined based on the feature values ​​corresponding to all the hosts under test.

[0017] Optionally, the step of determining the compromised target host based on the feature values ​​corresponding to all the hosts under test specifically includes:

[0018] All the aforementioned feature values ​​are sorted from high to low, and the failure probability corresponding to the host under test is generated based on the sorting information;

[0019] The host under test whose failure probability reaches a preset threshold is identified as the target host that has been compromised.

[0020] Optionally, after the step of determining the compromised target host based on the feature values ​​corresponding to all the hosts under test, the method further includes:

[0021] Create a sorting table in descending order of the probability of failure.

[0022] Optionally, the DGA domain name detection algorithm is a machine learning algorithm, and the machine learning algorithm is at least one of the random forest algorithm, XGBoost algorithm and LGBM algorithm.

[0023] Optionally, the step of detecting and identifying sample data using the DGA domain name detection algorithm to obtain a set of malicious domain names specifically includes:

[0024] The DGA domain name detection algorithm is used to determine the DGA domain name in the sample data.

[0025] The sample data identified as DGA domains are used to generate the malicious domain set.

[0026] A system for identifying compromised hosts based on machine learning algorithms is also provided, including:

[0027] The detection unit is used to detect and identify sample data using the DGA domain name detection algorithm to obtain a set of malicious domain names;

[0028] The query unit is used to query the host under test that accessed the malicious domain based on the original data of the malicious domain in the malicious domain set;

[0029] The analysis unit is used to analyze the DNS response events of the host under test and obtain analysis results;

[0030] The determination unit is used to reduce the analysis results to one-dimensional features and determine the compromised target host from the host under test based on the feature values ​​of the one-dimensional features.

[0031] Additionally, a storage medium and a computer device are provided, the storage medium being used to store a computer program for executing the above-described method for identifying compromised hosts based on machine learning algorithms.

[0032] The computer device includes a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor. When the processor executes the computer program, it implements the aforementioned method for determining compromised hosts based on machine learning algorithms.

[0033] The method and system for identifying compromised hosts based on machine learning algorithms described in this invention utilize the DGA domain name detection algorithm to detect and identify sample data, pre-screening suspected malicious domain names and generating a malicious domain name set. Then, based on the original data of the malicious domain names, all hosts accessing these malicious domain names are queried. Next, the DNS response events of the hosts under test are analyzed to obtain corresponding analysis results. Finally, the analysis results are reduced to one-dimensional features, and the compromised target host is identified from the hosts under test based on the feature values ​​of these one-dimensional features. Therefore, compared to the high false positive rate of existing technical solutions, this invention can better locate compromised target hosts, enabling enterprise security operations personnel to promptly locate problems and improving the identification rate of compromised hosts. Attached Figure Description

[0034] Figure 1 A flowchart illustrating the steps of a method for determining a compromised host based on a machine learning algorithm, according to an embodiment of the present invention.

[0035] Figure 2 A flowchart illustrating the steps of a method for determining compromised hosts based on machine learning algorithms, provided in an embodiment of the present invention, for identifying potential target hosts through analysis results;

[0036] Figure 3The flowchart of the steps of the method for determining compromised hosts based on machine learning algorithms provided in an embodiment of the present invention for detecting and screening the hosts to be tested is as follows:

[0037] Figure 4 This is a schematic block diagram of a system for determining a compromised host based on a machine learning algorithm, provided in an embodiment of the present invention.

[0038] Figure 5 A schematic block diagram of the optional structure of the determining unit in a system for determining a compromised host based on a machine learning algorithm, provided in an embodiment of the present invention;

[0039] Figure 6 A schematic block diagram of the optional structure of the detection unit of a system for determining a compromised host based on a machine learning algorithm, provided in an embodiment of the present invention;

[0040] Figure 7 This is a schematic block diagram of the optional structure of the query unit in a system for determining compromised hosts based on machine learning algorithms, provided as an embodiment of the present invention. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0042] It should be noted that references to "an embodiment," "embodiment," "example embodiment," etc., in this specification refer to the described embodiment including specific features, structures, or characteristics, but not every embodiment must include these specific features, structures, or characteristics. Furthermore, such expressions do not refer to the same embodiment. Moreover, when describing specific features, structures, or characteristics in conjunction with embodiments, whether or not explicitly described, it is indicated that incorporating such features, structures, or characteristics into other embodiments is within the knowledge of those skilled in the art.

[0043] Furthermore, certain terms are used in the specification and subsequent claims to refer to specific components or parts. Those skilled in the art will understand that manufacturers may use different names or terms to refer to the same component or part. This specification and subsequent claims do not distinguish components or parts by differences in name, but rather by differences in function. The terms "comprising" and "including" used throughout the specification and subsequent claims are open-ended and should be interpreted as "including but not limited to." Additionally, the term "connection" here includes any direct and indirect electrical connection means. Indirect electrical connection means include connections made through other means.

[0044] Figure 1 This invention illustrates a method for identifying compromised hosts based on machine learning algorithms, according to an embodiment of the present invention. The method can be applied to a management backend to detect and locate hosts compromised by malicious domain attacks, and includes the following steps:

[0045] S101: The sample data is detected and identified using the DGA domain name detection algorithm to obtain a set of malicious domain names. Specifically, the sample data refers to pre-collected domain name data accessed by hosts. In this embodiment, the DGA domain name detection algorithm is used to detect and identify several sample data sets to screen out target data suspected of being malicious domain names, thereby generating a set of malicious domain names. This embodiment preferably uses the existing DGA domain name detection algorithm for malicious domain name detection and identification.

[0046] Preferably, the DGA domain name detection algorithm is a machine learning algorithm, specifically at least one of the following: Random Forest, XGBoost (eXtreme Gradient Boosting, an optimized distributed gradient boosting library), and LGBM (a lightweight and efficient gradient boosting tree algorithm). In practice, to detect compromised hosts, this embodiment may combine Random Forest, XGBoost, and LGBM algorithms in the DGA domain name detection algorithm to detect and identify sample data, determining whether it is a suspected malicious domain. Of course, if this step fails to detect a suspected malicious domain, the next step is unnecessary.

[0047] S102: Based on the original data of the malicious domains in the malicious domain set, query the hosts to be tested that accessed the malicious domains. Based on the malicious domain set obtained above, query all hosts that accessed these malicious domains from the original data of the malicious domains, and classify these hosts as hosts to be tested; the remaining hosts are classified as non-target hosts.

[0048] S103: Analyze the DNS (Domain Name System) response events of the host under test to obtain analysis results. That is, the analysis results are the DNS response data details corresponding to the host under test. In this embodiment, the DNS response events of each host under test are analyzed to obtain several analysis results corresponding to each host under test. Specifically, the analysis results include various types of analysis data. Optionally, step S103 specifically includes: calculating the number of DNS responses, the first percentage of responses with the NXDOMAIN return code, the second percentage of accessing DGA domain names, and the DNS response rate based on the DNS response events of the host under test. In the DNS response, the corresponding DNS response status is NXDOMAIN, indicating a non-existent record, meaning that this specific domain name does not exist in the authoritative server. That is, this embodiment analyzes the DNS response events of the host under test to calculate the number of DNS responses, the first percentage, the second percentage, and the DNS response rate.

[0049] S104: The analysis results are reduced to one-dimensional features, and the compromised target host is determined from the hosts under test based on the feature values ​​of the one-dimensional features. In this embodiment, the analysis results of each host under test are reduced to one-dimensional features to obtain the corresponding feature values. Since a higher feature value indicates a greater probability that the host is compromised, it is possible to determine whether the corresponding host has been compromised based on the feature value.

[0050] This embodiment uses the DGA domain name detection algorithm to screen out a set of malicious domain names from sample data accessed by hosts. It then queries the hosts accessing these malicious domain names, analyzes their DNS response events, performs dimensionality reduction on the analysis results, and finally identifies the compromised target host based on the feature values ​​of the one-dimensional features of the analysis results. Therefore, this embodiment can better locate compromised target hosts and improves the identification rate of compromised hosts.

[0051] See Figure 2 In one optional implementation, step S104 specifically includes:

[0052] S1041: The DNS response count, the first proportion, the second proportion, and the DNS response rate are reduced to one-dimensional features using Principal Component Analysis (PCA), and the corresponding feature values ​​are obtained. In machine learning, dimensionality reduction refers to using a mapping method to map data points from a high-dimensional space to a low-dimensional space. Dimensionality reduction reduces errors caused by redundant information and improves recognition accuracy. The Principal Component Analysis (PCA) method used in this embodiment is the most commonly used linear dimensionality reduction method. Its goal is to map high-dimensional data to a low-dimensional space through a linear projection, aiming to maximize the variance of the data in the projected dimension, thereby using fewer data dimensions while retaining more of the original data point characteristics. PCA is a linear dimensionality reduction method that loses the least amount of original data information. While reducing the analysis results to one-dimensional features, the corresponding feature values ​​are obtained.

[0053] S1042: Determine the compromised target host based on the characteristic values ​​corresponding to all hosts under test.

[0054] Optionally, step S1042 specifically includes: sorting all the feature values ​​from highest to lowest, and generating a failure probability corresponding to the host under test based on the sorting information; identifying the host under test whose failure probability reaches a preset threshold as the target host that has failed. That is, in this embodiment, after reducing the dimensionality of the analysis results of each host under test to one-dimensional features, the corresponding feature values ​​are sorted from highest to lowest, and a corresponding failure probability is generated. The higher the ranking of the feature value, the greater its failure probability. Based on this, the target host can be determined according to the failure probability of the host under test. Therefore, this embodiment sets a preset threshold; if the failure probability of a host under test reaches or exceeds the preset threshold, the host under test can be identified as the target host.

[0055] In one embodiment, step S104 is followed by: creating a sorting table ranking the compromise probabilities from highest to lowest. The sorting table records the ranking of the compromise probabilities of each host under test; enterprise security operations personnel can use this sorting table to better locate compromised target hosts and resolve host compromise issues in a timely manner.

[0056] See Figure 3 In one optional implementation, step S101 specifically includes:

[0057] S1011: The sample data is judged by the DGA domain name detection algorithm.

[0058] S1012: The sample data identified as DGA domains are used to generate a malicious domain set.

[0059] In practice, the DGA domain name algorithm is used to detect and identify whether the sample data is a DGA domain name. If a sample data is determined to be a DGA domain name, the sample data is recorded in a pre-created malicious domain name set. The malicious domain name set stores all data that have been detected and identified as malicious domain names.

[0060] In one embodiment, after step S104, the method further includes: generating location alert information for the target host based on the device identifier of the target host. In this embodiment, when a host is determined to be a compromised host through step S104, location alert information is generated based on the device identifier of the compromised target host; and the location alert information is automatically sent to the enterprise security operations personnel so that the compromise problem can be detected and resolved in a timely manner, improving processing efficiency.

[0061] Figure 4 This invention illustrates a system 100 for identifying compromised hosts based on machine learning algorithms, according to an embodiment of the present invention. The system includes a detection unit 10, a query unit 20, an analysis unit 30, and a determination unit 40, wherein:

[0062] The detection unit 10 is used to detect and identify sample data using the DGA domain name detection algorithm to obtain a set of malicious domain names; the query unit 20 is used to query the host under test that accessed the malicious domain name based on the original data of the malicious domain name in the set of malicious domain names; the analysis unit 30 is used to analyze the DNS response events of the host under test to obtain analysis results; and the determination unit 40 is used to reduce the analysis results to one-dimensional features and determine the compromised target host from the host under test based on the feature value of the one-dimensional features.

[0063] Preferably, the DGA domain name detection algorithm is a machine learning algorithm, and the machine learning algorithm is at least one of the random forest algorithm, XGBoost algorithm and LGBM algorithm.

[0064] This embodiment uses the DGA domain name detection algorithm to screen out a set of malicious domain names from sample data accessed by hosts. It then queries the hosts accessing these malicious domain names, analyzes their DNS response events, performs dimensionality reduction on the analysis results, and finally identifies the compromised target host based on the feature values ​​of the one-dimensional features of the analysis results. Therefore, this embodiment can better locate compromised target hosts and improves the identification rate of compromised hosts.

[0065] Optionally, the analysis unit 30 is specifically used to: calculate the number of DNS responses of the host under test, the first proportion of responses with the NXDOMAIN return code, the second proportion of accessing DGA domain names, and the DNS response rate based on the DNS response events of the host under test.

[0066] See Figure 5 In an optional implementation, the determining unit 40 specifically includes a dimensionality reduction subunit 41 and a loss determination subunit 42, wherein:

[0067] Dimensionality reduction subunit 41 is used to reduce the number of DNS responses, the first proportion, the second proportion, and the DNS response rate into one-dimensional features using principal component analysis, and obtain the feature values ​​corresponding to the one-dimensional features; the failure determination subunit 42 is used to determine the failed target host based on the feature values ​​corresponding to all the hosts under test. Preferably, the determination subunit 42 is specifically used to: sort all the feature values ​​from high to low, and generate the failure probability corresponding to the host under test based on the sorting information; and determine the host under test whose failure probability reaches a preset threshold as the failed target host.

[0068] In one embodiment, the system further includes a creation unit for creating a sorting table that ranks the compromise probabilities from highest to lowest. The sorting table records the ranking of the compromise probabilities of each host under test; enterprise security operations personnel can use this sorting table to better locate compromised target hosts and resolve host compromise issues in a timely manner.

[0069] See Figure 6 In an optional implementation, the detection unit 10 specifically includes a detection subunit 11 and an aggregation subunit 12, wherein:

[0070] The detection subunit 11 is used to determine the DGA domain name of the sample data using the DGA domain name detection algorithm; the set subunit 12 is used to set the sample data that is determined to be a DGA domain name to generate the malicious domain name set.

[0071] See Figure 7 In an optional implementation, the query unit 20 specifically includes an extraction subunit 21 and a host-to-test determination subunit 22, wherein:

[0072] Extraction subunit 21 is used to obtain the original data of the DGA domain name in the malicious domain name set, and extract the access information of accessing the DGA domain name from the original data; host to be tested determination subunit 22 is used to determine the host to be tested based on the access information.

[0073] In one embodiment, a reminder unit is also included, which is used to generate location reminder information for the target host based on the device identifier of the target host.

[0074] The present invention also provides a storage medium for storing, for example, Figures 1-4The computer program for the method of determining a compromised host based on a machine learning algorithm. For example, computer program instructions, when executed by a computer, can invoke or provide the methods and / or technical solutions according to this application through the operation of the computer. The program instructions invoking the methods of this application may be stored in a fixed or removable storage medium, and / or transmitted via data streams in broadcast or other signal carrying media, and / or stored in the storage medium of a computer device operating according to the program instructions. Here, one embodiment according to this application includes, as... Figure 5 The computer device shown is a system for determining compromised hosts based on machine learning algorithms. The computer device preferably includes a storage medium for storing computer programs and a processor for executing computer programs. When the computer program is executed by the processor, the computer device is triggered to execute the methods and / or technical solutions based on the foregoing embodiments.

[0075] It should be noted that this application can be implemented in software and / or a combination of software and hardware, for example, using an application-specific integrated circuit (ASIC), a general-purpose computer, or any other similar hardware device. In one embodiment, the software program of this application can be executed by a processor to implement the steps or functions described above. Similarly, the software program of this application (including related data structures) can be stored in a computer-readable recording medium, such as RAM memory, magnetic or optical drives, floppy disks, and similar devices. Furthermore, some steps or functions of this application can be implemented in hardware, for example, as circuitry that works with a processor to perform the various steps or functions.

[0076] The method according to the invention can be implemented on a computer as a computer-implemented method, or in dedicated hardware, or a combination of both. Executable code or portions thereof for the method according to the invention can be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product includes non-transitory program code components stored on a computer-readable medium so as to execute the method according to the invention when the program product is executed on a computer.

[0077] In a preferred embodiment, the computer program includes computer program code components adapted to perform all the steps of the method according to the invention when the computer program is run on a computer. Preferably, the computer program is embodied on a computer-readable medium.

[0078] In summary, the method and system for identifying compromised hosts based on machine learning algorithms described in this invention utilize the DGA domain name detection algorithm to detect and identify sample data, pre-screening suspected malicious domain names and generating a malicious domain name set. Then, based on the original data of the malicious domain names, all hosts accessing these malicious domain names are queried. Next, the DNS response events of the hosts under test are analyzed to obtain corresponding analysis results. Finally, the analysis results are reduced to one-dimensional features, and the compromised target host is identified from the hosts under test based on the feature values ​​of these one-dimensional features. Therefore, compared to the high false positive rate of existing technical solutions, this invention can better locate compromised target hosts, enabling enterprise security operations personnel to promptly locate problems and improving the identification rate of compromised hosts.

[0079] Of course, the present invention may have other various embodiments. Without departing from the spirit and essence of the present invention, those skilled in the art can make various corresponding changes and modifications according to the present invention, but these corresponding changes and modifications should all fall within the protection scope of the appended claims.

Claims

1. A method for identifying compromised hosts based on machine learning algorithms, characterized in that, Including the following steps: The DGA domain name detection algorithm is used to detect and identify sample data to obtain a set of malicious domain names; Based on the original data of the malicious domains in the malicious domain set, query the host under test that accessed the malicious domains; Analyze the DNS response events of the host under test to obtain the analysis results; The analysis results are reduced to one-dimensional features, and the compromised target host is determined from the host under test based on the feature values ​​of the one-dimensional features. The steps for analyzing the DNS response events of the host under test and obtaining the analysis results specifically include: Based on the DNS response events of the host under test, calculate the number of DNS responses, the first percentage of responses with the NXDOMAIN return code, the second percentage of accesses to DGA domains, and the DNS response rate of the host under test. The step of reducing the analysis results to one-dimensional features and determining the compromised target host from the host under test based on the feature values ​​of the one-dimensional features specifically includes: Principal component analysis is used to reduce the number of DNS responses, the first proportion, the second proportion, and the DNS response rate to one-dimensional features, and the feature values ​​corresponding to the one-dimensional features are obtained. The compromised target host is determined based on the feature values ​​corresponding to all the hosts under test.

2. The method for determining compromised hosts based on machine learning algorithms according to claim 1, characterized in that, The step of determining the compromised target host based on the feature values ​​corresponding to all the hosts under test specifically includes: All the aforementioned feature values ​​are sorted from high to low, and the failure probability corresponding to the host under test is generated based on the sorting information; The host under test whose failure probability reaches a preset threshold is identified as the target host that has been compromised.

3. The method for determining compromised hosts based on machine learning algorithms according to claim 2, characterized in that, After the step of determining the compromised target host based on the feature values ​​corresponding to all the hosts under test, the method further includes: Create a sorting table in descending order of the probability of failure.

4. The method for determining compromised hosts based on machine learning algorithms according to claim 1, characterized in that, The DGA domain name detection algorithm is a machine learning algorithm, and the machine learning algorithm is at least one of the random forest algorithm, XGBoost algorithm and LGBM algorithm.

5. The method for determining compromised hosts based on machine learning algorithms according to claim 4, characterized in that, The step of detecting and identifying sample data using the DGA domain name detection algorithm to obtain a set of malicious domain names specifically includes: The DGA domain name detection algorithm is used to determine the DGA domain name in the sample data. The sample data identified as DGA domains are used to generate the malicious domain set.

6. The method for determining a compromised host based on a machine learning algorithm according to claim 5, characterized in that, The step of querying the host under test that accessed the malicious domain based on the original data of the malicious domain in the malicious domain set specifically includes: Obtain the original data of the DGA domain in the malicious domain set, and extract the access information of the DGA domain from the original data; The host to be tested is determined based on the access information.

7. The method for determining compromised hosts based on machine learning algorithms according to claim 1, characterized in that, After the step of reducing the analysis results to one-dimensional features and determining the compromised target host from the host under test based on the feature values ​​of the one-dimensional features, the method further includes: Based on the device identifier of the target host, a location alert message for the target host is generated.

8. A system for identifying compromised hosts based on machine learning algorithms, characterized in that, Including: The detection unit is used to detect and identify sample data using the DGA domain name detection algorithm to obtain a set of malicious domain names; The query unit is used to query the host under test that accessed the malicious domain based on the original data of the malicious domain in the malicious domain set; The analysis unit is used to analyze the DNS response events of the host under test and obtain analysis results; The determination unit is used to reduce the analysis results to one-dimensional features and determine the compromised target host from the host under test based on the feature values ​​of the one-dimensional features. The analysis unit is specifically used for: Based on the DNS response events of the host under test, calculate the number of DNS responses, the first percentage of responses with the NXDOMAIN return code, the second percentage of accesses to DGA domains, and the DNS response rate of the host under test. The determining unit specifically includes: The dimensionality reduction subunit is used to reduce the number of DNS responses, the first proportion, the second proportion, and the DNS response rate into one-dimensional features using principal component analysis, and obtain the feature values ​​corresponding to the one-dimensional features. The defect determination subunit is used to determine the defected target host based on the feature values ​​corresponding to all the hosts under test.

9. The system for determining compromised hosts based on machine learning algorithms according to claim 8, characterized in that, The determining subunit is specifically used for: All the aforementioned feature values ​​are sorted from high to low, and the failure probability corresponding to the host under test is generated based on the sorting information; The host under test whose failure probability reaches a preset threshold is identified as the target host that has been compromised.

10. The system for determining compromised hosts based on machine learning algorithms according to claim 9, characterized in that, It also includes: A creation unit is used to create a sorting table in descending order of the probability of failure.

11. The system for determining compromised hosts based on machine learning algorithms according to claim 8, characterized in that, The DGA domain name detection algorithm is a machine learning algorithm, and the machine learning algorithm is at least one of the random forest algorithm, XGBoost algorithm and LGBM algorithm.

12. The system for determining compromised hosts based on machine learning algorithms according to claim 11, characterized in that, The detection unit specifically includes: The detection subunit is used to determine the DGA domain name of the sample data using the DGA domain name detection algorithm. The set subunit is used to generate the malicious domain set by combining the sample data identified as DGA domains.

13. The system for determining compromised hosts based on machine learning algorithms according to claim 12, characterized in that, The query unit specifically includes: An extraction subunit is used to obtain the original data of the DGA domain in the malicious domain set, and extract the access information of the DGA domain from the original data; The host under test determination subunit is used to determine the host under test based on the access information.

14. The system for determining compromised hosts based on machine learning algorithms according to claim 8, characterized in that, It also includes: The reminder unit is used to generate location reminder information for the target host based on the device identifier of the target host.

15. A storage medium, characterized in that, Used to store a computer program for performing the method of determining a compromised host based on a machine learning algorithm as described in any one of claims 1 to 7.

16. A computer device comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method for determining a compromised host based on a machine learning algorithm as described in any one of claims 1 to 7.

Images