A domain name detection method based on attribute heterogeneous graph neural network

Abstract

The application provides a domain name detection method based on an attribute heterogeneous graph neural network, which is divided into four parts. The first part is dataset construction. Based on DNS traffic messages, useful information is found out, and a usable dataset is constructed in combination with domain name black and white lists. The second part is the construction of a heterogeneous information network. The information network formed by node connections is described by using DNS traffic information, and the correlation level characteristics are contained in the information network. The third part is the setting of the initial attributes of the network nodes. The individual level characteristics with high distinguishability are injected into the nodes. The fourth part is the classification of the nodes of the heterogeneous graph. The specific content is that the nodes are sampled and the features are aggregated according to the neighbor relationship, the domain name embedding vector representation is obtained, and the classification and identification are performed. Compared with the existing research, the application can realize more accurate classification of malicious domains in the domain name retrospective detection scene, the accuracy rate reaches 98.67%, and the network managers are convenient for fine classification and supervision of the malicious domain traffic.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of cyberspace security, and relates to a new malicious domain identification detection method combining a graph neural network and network measurement. BACKGROUND

[0002] Domain names are important attack media and are misused in many cybercrime behaviors, such as phishing networks, botnets and malware. In recent years, many technologies such as Fast-Flux and Domain-Flux combined with malicious domains make the DNS mapping related to network attacks change rapidly, making malicious communication behavior more flexible and easy to hide, greatly improving the anti-detection ability of malicious activities. Therefore, accurately identifying malicious domains has always been an important task of network security research. Network measurement methods, as an effective analysis method, combined with powerful deep learning tools, can excellently complete this goal and improve the security detection ability of the defense system.

[0003] According to the data structure used, existing malicious domain post-detection research is mainly divided into non-graph methods and graph methods. Non-graph methods mostly analyze domain name targets as individuals, and the extracted individual text / behavior features may be evaded, and the connections between multiple targets are ignored; the graph method pays attention to the connection between targets and shows better results. However, the existing graph method does not contain more comprehensive and rich target node information, such as some only using one-way behavior (DNS request / response), and some not integrating more discriminative individual information, resulting in poor performance of the existing method in detection.

[0004] The application proposes a method suitable for the review domain name detection scene, which combines network measurement analysis, uses graph neural network technology on the basis of an attribute heterogeneous graph network, extracts distinguishable information from individual and association, obtains domain name embedding representation vectors and classifies, and finally realizes accurate identification and detection of malicious domain names. SUMMARY

[0005] In order to improve the security detection ability, identify malicious domains and block the development of malicious activities, the application proposes a review domain name detection method based on an attribute heterogeneous graph neural network. In order to further improve the information coverage and utilization, the method first performs data preprocessing and extracts available information; secondly, a domain name communication network is constructed based on a heterogeneous graph structure to mine the association features generated during entity interaction; then the initial attributes of the target nodes are set to introduce individual features as a basis for subsequent aggregation, while avoiding the loss of semantics of isolated nodes; finally, inductive learning is used, and a graph neural network is applied to node feature fusion and classification to realize high-precision malicious domain identification. In order to achieve the above purpose, the application provides the following technical solutions:

[0006] A domain name detection method based on attribute heterogeneous graph neural network, comprising the following steps:

[0007] (1) Constructing domain name behavior flow data set. Based on the campus DNS flow data set and the domain name blacklist and whitelist data set, data preprocessing is performed, useful information is filtered out, and the domain name is labeled according to the domain name blacklist and whitelist data set;

[0008] (2) Mapping DNS full behavior into domain name behavior heterogeneous graph information network. Analyzing the entities and relationships in DNS activities, modeling them into point-edge form, extracting meta-paths and assigning associated semantics, and finally creating a graph network containing domain name association level characteristics;

[0009] (3) Extracting domain name individual level features from the data set from the perspectives of text and behavior, setting as the initial attributes of nodes, and creating a heterogeneous graph network with attributes;

[0010] (4) Obtaining a heterogeneous graph neural network node classification model, aggregating based on node individual features and associated semantic features, and then classifying to obtain the recognition detection result of the domain name node to be tested.

[0011] Further, the step (1) specifically comprises the following sub-steps:

[0012] (1.1) After obtaining the DNS flow data set, the entities therein are extracted, specifically including three types of domain names, client hosts and resolution IPs, and useless nodes are removed according to certain rules;

[0013] (1.2) Labeling the domain names extracted in step (1.1) using the public domain name blacklist to form a domain name behavior flow data set that can be used.

[0014] Further, in step (1.1), the entities are filtered according to three filtering rules: for domain name type, nodes that do not meet the format requirements (reference RFC standard) are deleted; for client host, different request times less than or equal to 2 are cropped; for resolution IP, different resolution times less than or equal to 2 are deleted.

[0015] Further, the domain name blacklist used in step (1.2) mainly includes Alexatop 1M, DGArchive, DGA_360netlab and Bambenek.

[0016] Further, the step (2) specifically comprises the following sub-steps:

[0017] (2.1) Setting the points and edges of the graph network. The entities obtained in step (1.1) are set as nodes, four kinds of behavior relationships are obtained by analyzing DNS record types and text information, and edges are set accordingly, as shown in the following table;

[0018]

[0019]

[0020] (2.2) Analyze the edge relationship of step (1.2), and design semantic meta-paths with strong association, a total of 5 kinds.

[0021] Further, the step (3) specifically includes the following sub-steps:

[0022] (3.1) For the domain name node in the graph network obtained in step (2), extract individual text features, including entropy, conversion frequency, n-gram, etc., a total of 15 kinds as shown in the following table;

[0023]

[0024] (3.2) Extract individual behavior features of the domain name, including TTL value, associated NXD number, etc., a total of 11 kinds as shown in the above table;

[0025] (3.3) Assign individual-level text and behavior features to the corresponding domain name node as the initial attribute vector.

[0026] Further, the step (4) specifically includes the following sub-steps:

[0027] (4.1) Learn using the labeled node related information in the attribute heterogeneous graph obtained in step (3) to obtain a heterogeneous graph node classification detection model;

[0028] (4.2) Use the above model to obtain the recognition result of the domain name to be detected in the attribute heterogeneous graph. Through experiments, the effect compared with existing research is shown in the following table:

[0029]

[0030] Further, the step (4.1) specifically includes the following sub-steps:

[0031] (4.1.1) Based on the graphSAGE model, intra-meta-path aggregation is performed. The idea of sampling first and then aggregating is adopted to obtain an embedding vector representation for each domain name in the 5 meta-paths;

[0032] (4.1.2) Based on the attention mechanism, inter-meta-path aggregation is performed. According to certain rules, set the attention coefficient of each semantic meta-path, and according to the target, constantly optimize the parameters in the model learning process, obtain adaptive weights, automatically identify the part that needs to be focused on in each meta-path information, and get the aggregation result:

[0033]

[0034] wherein h f represents the final aggregation result, represents the weight coefficient learned by each meta-path, h′ a is the result of internal aggregation of each meta-path.

[0035] (4.1.3) According to the maximum value index of the aggregation representation vector, the domain name classification result is obtained. Wherein, by using the cross-entropy loss function, the model is continuously optimized through forward and backward propagation, and the representation and classification detection ability of the model is improved.

[0036] Compared with the prior art, the present application has the following advantages and beneficial effects:

[0037] (1) The present application efficiently completes the malicious domain recognition in the review domain name detection scene, and the accuracy reaches 98.67%, which improves the prevention and control supervision ability of DNS behavior.

[0038] (2) The present application comprehensively and effectively pays attention to the domain name attribute from multiple angles, and shows excellent detection ability for different state nodes in the DNS scene. The effective setting of node attributes not only significantly improves the discrimination effect of non-associated state nodes, but also has a beneficial effect on the final aggregation effect of associated nodes.

[0039] (3) In the design of the heterogeneous graph node classification model, the present application replaces all neighbors with sampled neighbors, reducing the processing overhead in time and space. At the same time, the present application is an inductive scheme, which has better generalization ability than the direct inference scheme, and does not need to be repeatedly trained in the dynamic and variable scene of the present research. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 Technical framework schematic diagram of the present application;

[0041] Figure 2 Heterogeneous graph information network meta-path schematic diagram;

[0042] Figure 3 Heterogeneous graph node classification model schematic diagram. DETAILED DESCRIPTION

[0043] The technical solutions provided by the present application will be described in detail below in combination with specific embodiments, and it should be understood that the following specific embodiments are only used to illustrate the present application and not to limit the scope of the present application.

[0044] Example 1: The present application proposes a new dark web traffic classification method based on knowledge graph and dynamic embedding learning, and the classification framework is as follows: Figure 1As shown, the method consists of four parts. The first part is data preprocessing, which involves constructing a domain behavior traffic dataset. Specifically, this dataset is obtained from a campus DNS traffic dataset and a domain blacklist / whitelist dataset. First, data preprocessing is performed to filter out usable information, and domains are tagged according to the domain blacklist / whitelist dataset. Then, a heterogeneous graph with high information coverage is selected as the data structure for this method. All DNS behaviors are mapped into a heterogeneous graph information network, and entities and relationships are modeled as points and edges. Meta-paths are extracted and assigned associative semantics, and invalid nodes are removed according to certain rules. The resulting graph network contains association-level characteristics. Subsequently, highly discriminative individual-level features are injected into nodes, set as initial node attributes, serving as a foundation for subsequent aggregation and preventing isolated nodes from losing semantics. Finally, node sampling and two-class feature aggregation are performed based on neighbor relationships to obtain domain name embedding vector representations and perform classification and recognition.

[0045] Specifically, a method for accurately identifying malicious domains includes the following steps:

[0046] (1) Construct a domain behavior traffic dataset. Based on the campus DNS traffic dataset and the domain name blacklist / whitelist dataset, perform data preprocessing to filter out usable information, and label the domain names according to the domain name blacklist / whitelist dataset.

[0047] The specific process for this step is as follows:

[0048] (1.1) After obtaining the DNS traffic dataset, extract the entities, specifically including three categories: domain names, client hosts, and resolved IPs, and remove useless nodes according to certain rules. Since the traffic contains a lot of invalid information, trimming it can reduce the complexity of subsequent processing. Therefore, three filtering rules were designed: for domain names, nodes that do not meet the format requirements (refer to the RFC standard) are removed; for client hosts, nodes with fewer than or equal to 2 different requests are removed; for resolved IPs, nodes with fewer than or equal to 2 different resolutions are removed.

[0049] (1.2) Tag the domains extracted in step (1.1) using publicly available domain blacklists and whitelists to form a usable domain behavior traffic dataset. The domain blacklists and whitelists used mainly include Alexa top 1M, DGArchive, DGA_360netlab, and Bambenek.

[0050] (2) Map all DNS behaviors to a heterogeneous graph information network of domain behavior. Analyze entities and relationships in DNS activities, model them in the form of nodes and edges, extract meta-paths and assign them associative semantics, and finally create a graph network containing domain association-level characteristics. Since domain activities are complex and diverse, while commonly used homogeneous graph information networks are singular, heterogeneous graphs that cover a wider range of information are more suitable for this study.

[0051] The specific process in this step is as follows:

[0052] (2.1) Set up the nodes and edges of the graph network. Set the entities obtained in step (1.1) as nodes, analyze the DNS record types and text information to obtain four behavioral relationships, and set the corresponding edges, as shown in the table below. The origins and associated record patterns of domain names are not entirely the same, and different edge relationships can appropriately represent their differences.

[0053]

[0054] (2.2) Analyze the edge relationships in step (1.2) and design five types of semantic meta-paths with strong associations, such as... Figure 2 As shown in the table above, the serial numbers, such as ①, represent the type serial numbers. Observation reveals that domains exhibiting similar behavior, i.e., strong correlation, tend to belong to the same category. If an unknown domain resolves to an IP address that has been resolved by other malicious domains, then that unknown domain is likely also malicious; and vice versa. This step uses meta-paths to quantify these correlations.

[0055] (3) Based on the dataset, individual-level features of domain names are extracted from both textual and behavioral perspectives and set as initial attributes of nodes to create a heterogeneous graph network with attributes. Compared to common practices such as directly encoding domain name text numbers without feature extraction, this can generate more expressive aggregate vectors and improve the performance of downstream classification tasks.

[0056] The specific process in this step is as follows:

[0057] (3.1) represents the domain name nodes in the graph network obtained in step (2). Individual text features are extracted, including entropy, transition frequency, n-gram, etc., as shown in the table below, totaling 15 categories.

[0058]

[0059]

[0060] (3.2) Extract individual behavioral features of the domain name, including TTL value, number of associated NXDs, etc., as shown in the table above, a total of 11 categories;

[0061] (3.3) Assign individual-level text and behavioral features to the corresponding domain name nodes as initial attribute vectors.

[0062] (4) Obtain the heterogeneous graph neural network node classification model, aggregate based on the individual node features and associated semantic features, and then classify to obtain the identification and detection results of the domain name nodes to be tested.

[0063] This step specifically includes the following processes:

[0064] (4.1) Using the information related to the labeled nodes in the attribute heterogeneous graph obtained in step (3), a learning process is performed to obtain a heterogeneous graph node classification and detection model, such as... Figure 3 As shown.

[0065] This step specifically includes the following processes:

[0066] (4.1.1) Meta-path aggregation based on the graphSAGE model. A sampling-then-aggregation approach is adopted to obtain embedding vector representations for each domain within the five meta-path types. First, for each meta-path, a subgraph containing only that type of path is extracted. Simultaneously, using the adjacency relationships in the subgraph, a random walk strategy is employed to sample the neighbors of the central node. This not only reduces computational cost and is applicable to large-scale scenarios but also enhances the generalization ability of the trained model. Then, the aggregator transforms the vector set consisting of the target node and its neighbors into the embedding vector representation of the target node. In this way, information from all neighboring nodes is converged on the central node, quantizing individual and related features into the final embedding vector.

[0067] (4.1.2) Path aggregation based on attention mechanism. Attention coefficients are set for each semantic meta-path according to certain rules. Parameters are continuously optimized during model learning based on the objective to obtain adaptive weights. This automatically identifies the parts of each meta-path information that require special attention and yields the aggregation results.

[0068]

[0069] Where h f This represents the final aggregation result. h′ represents the weight coefficients learned for each meta-path. a ′ represents the result of aggregation within each meta-path;

[0070] (4.1.3) Based on the maximum index of the aggregated representation vector, the domain name classification result is obtained. The cross-entropy loss function is used to continuously optimize the model through forward and backward propagation, improving its representation and classification detection capabilities.

[0071]

[0072] Among them, X labeled Y is a training sample node with known labels. l For the true label distribution, y l The model predicts the output distribution for the classification model. Guided by the loss function, the model is continuously optimized through forward and backpropagation to improve its representation and classification detection capabilities.

[0073] (4.2) Using the above model, the identification results of the domain names to be detected in the attribute heterogeneity graph are obtained. The results of the experiment are compared with those of existing research, as shown in the table below:

[0074]

[0075] The technical means disclosed in this invention are not limited to those disclosed in the above embodiments, but also include technical solutions composed of any combination of the above technical features. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications are also considered within the scope of protection of this invention.

Claims

1. A domain name detection method based on an attribute heterogeneous graph neural network, characterized in that, Comprising the following steps: (1) Constructing domain name behavior flow dataset, based on campus DNS flow dataset and domain name black and white list dataset for data preprocessing, filtering out useful information, and labeling domain names according to domain name black and white list dataset; (2) Mapping DNS full behavior into domain name behavior heterogeneous graph information network, analyzing entities and relationships in DNS activity, modeling into point-edge form, and extracting meta-path and giving associated semantics, finally creating a graph network containing domain name association level characteristics; (3) Extracting domain name individual level features from text and behavior based on the dataset, setting as node initial attribute, and creating heterogeneous graph network with attribute; (4) Obtaining heterogeneous graph neural network node classification model, aggregating based on node individual features and association semantic features, and then classifying to obtain the identification detection result of the domain name node to be tested; Said step (4) specifically comprises the following sub-steps: (4.1) Learning the relevant information of the labeled nodes in the attribute heterogeneous graph obtained in step (3) to obtain a heterogeneous graph node classification detection model; (4.2) Using the above model to obtain the identification result of the domain name to be detected in the attribute heterogeneous graph; Said step (4.1) specifically comprises the following sub-steps: (4.1.1) Based on the graphSAGE model, intra-path aggregation is performed, and the idea of sampling first and then aggregating is adopted to obtain an embedding vector representation for each domain name in 5 kinds of meta-paths; (4.1.2) Based on the attention mechanism, inter-path aggregation is performed, the attention coefficients of each semantic meta-path are set according to the rules, the adaptive weights are obtained according to the optimization of parameters in the model learning process, and the parts that need to be focused on in each meta-path information are automatically identified, and the aggregation result is obtained: where h f represents the final aggregation result, represents the weight coefficient learned by each meta-path, h′ a ′ is the result of internal aggregation of each meta-path; (4.1.3) According to the maximum value index of the aggregation representation vector, the domain name classification result is obtained, wherein the cross-entropy loss function is used to continuously optimize the model through forward and backward propagation, and the representation and classification detection ability of the model is improved.

2. The attribute-based heterogeneous graph neural network-based domain name detection method of claim 1, wherein, Step (1) specifically comprises the following sub-steps: (1.1) After obtaining the DNS flow dataset, the entities in it are extracted, including domain names, client hosts and resolution IPs, and useless nodes are removed according to certain rules; (1.2) Labeling the domain names extracted in step (1.1) using the public domain name black and white list to form a usable domain name behavior flow dataset.

3. The attribute-based heterogeneous graph neural network-based domain name detection method according to claim 2, characterized in that, In step (1.1), the entities are screened, and there are 3 filtering rules: for domain name type, nodes that do not meet the format requirements are deleted, wherein the format requirements refer to the RFC standard; for client host, nodes with different request times less than or equal to 2 are pruned; for resolution IP, nodes with different resolution times less than or equal to 2 are deleted.

4. The attribute-based heterogeneous graph neural network-based domain name detection method according to claim 2, characterized in that, The domain name black and white list used in step (1.2) includes Alexatop 1M, DGArchive, DGA_360netlab and Bambenek.

5. The attribute-based heterogeneous graph neural network-based domain name detection method according to claim 2, characterized in that, Step (2) specifically comprises the following sub-steps: (2.1) Set the points and edges of the graph network, set the entities obtained in step (1.1) as nodes, analyze the DNS record types and text information to obtain four kinds of behavioral relationships, and set the edges accordingly, as shown in the following table; (2.2) Analyze the edge relationships of step (1.2) and design five semantic meta-paths with strong associations.

6. The attribute-based heterogeneous graph neural network-based domain name detection method according to claim 1, characterized in that, The step (3) specifically includes the following sub-steps: (3.1) Extract individual text features for the domain name nodes in the graph network obtained in step (2), as shown in the following table, a total of 15 categories; (3.2) Extract individual behavior features for the domain name, as shown in the following table, a total of 11 categories; (3.3) Assign individual-level text and behavior features to the corresponding domain name nodes as initial attribute vectors.

Images