Dga domain name family multi-classification detection method based on rbl-cnn-ma

Abstract

The application provides a DGA domain name family multi-classification detection method based on RBL-CNN-MA. The method comprises the following steps: inputting to-be-classified DGA domain name data into a RoBERTa pre-training model to obtain sentence embedding feature vectors and word embedding feature vectors of the domain name; inputting the word embedding feature vectors into a bidirectional LSTM layer to extract long-distance features, so as to obtain a text matrix fusing the context correlation of the domain name; inputting the text matrix into a CNN layer to extract local features; inputting the output of the CNN layer into a multi-head attention layer to extract features from multiple dimensions; fusing the output of the multi-head self-attention layer and the sentence embedding feature vectors output by the RoBERTa pre-training model to obtain a new sentence embedding feature vector; and inputting the new sentence embedding feature vector into a full connection layer to obtain a classification result of the to-be-classified DGA domain name data.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a multi-classification detection method for DGA domain name families based on RBL-CNN-MA. Background Technology

[0002] To conceal their C&C servers, attackers often use various Domain Name Generation Algorithms (DGAs) to automatically generate DGA domains that resemble benign domains, thus evading detection. Consequently, the academic community has conducted extensive research on DGA detection.

[0003] According to data from the CNCERT Internet Security Threat Report, nearly 20,000 server IPs within my country are controlled by botnets. Comprehensive measurement and research on DGAs revealed that these botnets use domain names from different DGA families, posing a significant challenge to security personnel in tracing their origins. Therefore, accurately detecting DGA domain names and identifying their respective DGA families is crucial for security personnel to trace their origins, promptly severing the connection between botnets and C&C servers, and protecting people's privacy and property security.

[0004] However, existing methods are relatively easy for attackers to bypass and perform well in detecting word DGA domains, but poorly in detecting character DGA domains. Most models have low accuracy in multi-class detection of DGA domain families and cannot achieve accurate tracing of DGA families. Summary of the Invention

[0005] To address the issue that existing domain name detection methods are ineffective in detecting character-based DGA domain names, this invention provides a multi-classification detection method for DGA domain name families based on RBL-CNN-MA.

[0006] The multi-class detection method for DGA domain name families based on RBL-CNN-MA provided by this invention includes:

[0007] The DAG domain name data to be classified is input into the RoBERTa pre-trained model to obtain the sentence embedding feature vector and character embedding feature vector of the domain name;

[0008] The word embedding feature vector is input into a bidirectional LSTM layer to extract long-distance features, resulting in a text matrix that integrates domain name contextual relevance.

[0009] The text matrix is ​​input into a CNN layer to extract local features;

[0010] The output of the CNN layer is fed into a multi-head attention layer to extract features from multiple dimensions;

[0011] The output of the multi-head self-attention layer is fused with the sentence embedding feature vector output by the RoBERTa pre-trained model to obtain a new sentence embedding feature vector;

[0012] The new sentence embedding feature vector is input into a fully connected layer to obtain the classification result of the DGA domain name data to be classified.

[0013] Furthermore, the dimensions of the text matrix are [batch size, dictionary length, number of hidden units in the Bi-LSTM layer].

[0014] Furthermore, the CNN layer contains four convolutional kernels of different sizes.

[0015] Furthermore, dynamic k-max pooling is performed in the CNN layer.

[0016] Furthermore, the number of heads in the multi-head attention layer is 4.

[0017] The beneficial effects of this invention are:

[0018] (1) Based on the RoBERTa pre-trained model, this invention proposes the RBL-CNN-MA network model, which treats the domain name string as a one-dimensional text sequence and transforms the domain name detection task into a special text classification task. At the same time, it combines the two outputs of the RoBERTa pre-trained model and multi-head attention to learn the semantic relationship between domain names, thereby realizing the multi-class detection task of DGA domain name families. It can effectively detect character-type DGA domain names and effectively distinguish each DGA domain name family, thus achieving better multi-class detection and tracing.

[0019] (2) Compared with common deep neural network models, the RBL-CNN-MA model has the advantage of combining the RoBERTa pre-trained model with LSTM, CNN, and multi-head attention to capture more important feature information of domain name sequences from multiple dimensions, thereby improving the detection and source tracing effect of DGA domain name family multi-classification tasks. In different experiments, the improvement of the RBL-CNN-MA model on the classification accuracy of each family was verified. Attached Figure Description

[0020] Figure 1 A flowchart illustrating the multi-class detection method for DGA domain name families based on RBL-CNN-MA provided in this embodiment of the invention;

[0021] Figure 2 This is a multi-head attention structure diagram provided in an embodiment of the present invention;

[0022] Figure 3 The recall, precision, and F1 score of five different models provided in the embodiments of the present invention;

[0023] Figure 4 Accuracy and recall curves for the RBL-MA model under different numbers of heads in multi-head attention provided in embodiments of the present invention;

[0024] Figure 5 Accuracy and recall curves for the ensemble learning RCNN-BL-MA model under different numbers of heads in multi-head attention provided in embodiments of the present invention;

[0025] Figure 6 Accuracy and recall curves for the RBL-CNN-MA model under different numbers of heads in multi-head attention provided in embodiments of the present invention;

[0026] Figure 7 Loss curves for three models with different numbers of heads in multi-head attention provided in this embodiment of the invention;

[0027] Figure 8 A confusion matrix diagram based on the RBL-CNN-MA model provided in an embodiment of the present invention;

[0028] Figure 9 The confusion matrix diagram based on the RoBERTa pre-trained model provided in the embodiments of the present invention. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0030] Through experiments and structural analysis on DGA domain families with low detection accuracy in RoBERTa multi-classification tasks, it was found that most of the family domains with low recognition accuracy had small data volume and very messy domain composition. Therefore, it is speculated that the RoBERTa model cannot fully learn the implicit features contained in the domain sequence and the small data volume also affects the detection accuracy to some extent.

[0031] For example, the pykspa and ranbyus families both use time as a seed, resulting in continuous or scattered random character sequences; the ud2, ud3, and shifu family domain names are long and disorganized, containing a large number of implicit features; and the datasets for pykspa, ud, and other family domain names are too small. The RoBERTa pre-trained model may not have learned these features or may not have learned them sufficiently, leading to the overall features contained in the sentence embedding feature vector (pooler output) being unable to accurately classify each DGA domain family, thus causing low classification accuracy for these DGA domain families.

[0032] Example 1

[0033] Considering that the RoBERTa model has two outputs—a sentence embedding feature vector pooler output containing the overall features of the domain name sequence, and a character embedding feature vector sequenceoutput containing the features of all characters in the domain name sequence—and given that DGA is a pseudo-random generation algorithm, although different DGA family domain names differ greatly, the pseudo-randomness of their respective generation algorithms means that each DGA family domain name actually contains rich implicit features, which is very similar to natural language processing tasks, this embodiment of the invention treats the domain name string as a one-dimensional text sequence, transforming the domain name detection task into a special text classification task. It combines the two outputs of the pre-trained model with multi-head attention to learn the semantic relationships between domain names, thus achieving multi-classification detection of DGA domain name families.

[0034] like Figure 1 As shown, this embodiment of the invention provides a multi-classification detection method for DGA domain name families based on RBL-CNN-MA, including the following steps:

[0035] S101: Input the DAG domain name data to be classified into the RoBERTa pre-trained model to obtain the sentence embedding feature vector and character embedding feature vector of the domain name;

[0036] S102: Input the word embedding feature vector into a bidirectional LSTM (Bi-LSTM) layer to extract long-distance features and obtain a text matrix that integrates domain name contextual relevance;

[0037] Specifically, domain names from different DGA families differ in their generation algorithms, resulting in variations in their representation. However, they still maintain certain dependencies in character composition and structure. Therefore, it is crucial to fully extract contextual information from the domain name sequence to obtain a new vector that encompasses the overall characteristics of the domain name sequence.

[0038] For the DGA domain family multi-class classification task, the preprocessed domain character sequence is processed through a RoBERTa pre-trained model to obtain the word embedding feature vector S of all characters in the sequence. ij Embed the character into the feature vector S ij The input is fed into a Bi-LSTM layer; the Bi-LSTM layer embeds the word into the feature vector S. ij The encoding is a vector of the size of its hidden units, and the final output is a text matrix that incorporates the context features of the domain name sequence; the dimensions of the text matrix are [batch size, dictionary length, number of hidden units in the Bi-LSTM layer].

[0039] By leveraging the characteristics of Bi-LSTM to obtain the explicit and implicit features contained in each domain name character over a long distance from both positive and negative directions, it is beneficial to better learn and distinguish the differences between different DGA domain name families.

[0040] S103: Input the text matrix into a CNN layer to extract local features;

[0041] Specifically, normal domain names conform to the characteristics of natural language in terms of structural features, while the composition of character DGA domain names exhibits a divergent state. Therefore, this embodiment uses a one-dimensional CNN to extract new local semantic features based on the global features of the domain name extracted by the Bi-LSTM layer, thereby improving the accuracy of multi-classification of DGA domain name families.

[0042] like Figure 1 As shown, four convolutional kernels of different sizes are set in the CNN. By extracting local features from the DGA domain name sequence from multiple feature dimensions, the implicit patterns between DGA domain name characters under long-distance features are further extracted.

[0043] The key part of a CNN is the convolution kernel, which performs the convolution operation and has a dimension of h*n. The input domain name vector can be represented as a matrix H∈R. k*n Where H is the text matrix, k is the number of text vectors, and n is the dimension of the vectors. The size of the convolution kernel is generally expressed as G∈R h*n It is a technique that can generate new features for each sequence window with height h and width k during movement. The specific convolution operation process can be represented as:

[0044] c i =f(G*H i:i+h-1 +b) (1)

[0045] Among them, c i It is the i-th feature value of the domain name text output after convolution; f(·) is the activation function, and the ReLU non-linear function is used in this embodiment; H i:jrepresents the word vector consisting of the i-th word to the j-th word in the text matrix H; b represents the bias term.

[0046] The convolution kernel is used to perform a convolution operation on the domain name matrix, ultimately obtaining the feature map c, as shown in the following formula:

[0047] C = (c1, c2, ..., c k-h+1 (2)

[0048] Where C is the feature map formed by convolutional kernels on the domain name text, c∈R n-h+1 Since the height of the convolution kernel is h, the feature map obtained after the convolution operation has a height of k-h+1. By setting convolution kernels of different scales, different feature maps can be obtained, thus better capturing regional features.

[0049] S104: Input the output of the CNN layer into the multihead-attention layer to extract features from multiple dimensions;

[0050] Specifically, the multi-head attention layer is responsible for receiving the output of the one-dimensional CNN. Each head represents a feature subspace, and its purpose is to learn the different meanings represented by each character in the domain name sequence through different representation subspaces.

[0051] For example, the word "bear" can mean both bear and endure; different meanings are learned by different feature subspaces.

[0052] Therefore, multi-head attention is used to obtain the feature importance of each character and word in the domain name sequence, so as to adjust the attention weight of each character and word in the model. Smaller weights are assigned to reduce the attention to filler characters and unimportant characters; conversely, larger weights are assigned to increase the attention to important features.

[0053] In practical applications, the Self-Attention mechanism typically employs a scaled dot product attention mechanism. For example... Figure 2 As shown, Q, K, and V are fixed single values. Their values ​​first pass through a linear layer and a scaled dot product attention layer (i.e., multi-head), then the vectors are concatenated, followed by a linear transformation to finally obtain the attention output. The calculation formula is shown below:

[0054]

[0055] Where Q∈R n×d K∈R n×d V∈R n×dThese are three matrices related to the domain name sequence. d is the feature dimension of each character in the domain name sequence. The Q and K matrices are first converted into weight matrices of characters and words in the DGA domain name through the softmax function, and then multiplied with the V matrix to finally obtain the attention output.

[0056] Multi-head attention mechanisms, based on scaled dot product attention, divide attention into multiple heads. This means there are multiple Q, K, and V values ​​in multiple feature subspaces to compute the attention output for each space. Each space may emphasize different feature patterns in the sequence representation. Finally, these output vectors are merged to obtain the final output. The calculation formula is as follows:

[0057] MultiHead(x)=Concat(head1,…head h W o (4)

[0058] head h =attention(Q h ,K h V h (5)

[0059]

[0060] Among them W o The linear transformation matrix of the output, These are the linear transformation matrices of the input Q, K, and V, respectively, with a total number of heads H∈{1,…,h}, and concat is the concatenation function.

[0061] In the DGA domain family multi-class detection task, the output of the one-dimensional CNN is passed through three linear layers to obtain the inputs Q, K, and V of the multi-head attention layer, and the domain data X is obtained through the multi-head attention layer. T By adjusting the feature vectors and feature weights between them, the focus is increased on the important features that can classify different DGA domain name families, thereby improving the classification performance of the RBL-CNN-MA model.

[0062] S105: The output of the multi-head self-attention layer is fused with the sentence embedding feature vector output by the RoBERTa pre-trained model to obtain a new sentence embedding feature vector;

[0063] S106: Input the new sentence embedding feature vector into a fully connected layer (also known as a linear layer) to obtain the classification result of the DGA domain name data to be classified.

[0064] Example 2

[0065] Based on the above embodiment 1, in order to further reduce the focus of the detection model on domain name features that are relatively unimportant to the classification task, the embodiment of the present invention makes further improvements to the CNN layer, while the rest of the structure remains unchanged.

[0066] In the pooling layer, domain name features are sampled with a fixed stride *d* to remove some features. Max pooling is typically used, but this may lose positional information between characters in the domain name sequence. If the sequence contains transitions or more complex relationship patterns, the neural network cannot learn them. Therefore, dynamic k-max pooling is performed in the one-dimensional CNN, where *k* is dynamically calculated. In the convolution output, pooling is performed along the sentence length dimension, selecting the *k* largest values. After pooling, the resulting features are concatenated, fused, and then input into the multi-head attention layer.

[0067] Example 3

[0068] To demonstrate the multi-class classification performance of the RBL-CNN-MA model for the DGA domain family, this embodiment verifies its advantages over other neural networks through multiple sets of experiments. Furthermore, to better measure model performance, evaluation metrics such as macro-average (M-avg) and weighted average (W-avg) are used to quantify the model's multi-class classification accuracy.

[0069] (1) Dataset preparation

[0070] The datasets used in the experiment were sourced from: (1) the top 1M benign domains with the highest number of visits collected from the Alexa network; and (2) DGA domains from public data sources of 360 and DGArchive and DGA domains generated by the BiGRU-ATT model.

[0071] The DGA data generated using the generative model was primarily used to expand the dataset of new variant DGA domain families with smaller datasets, thereby improving the model's learning ability for these new variant DGA domain families. A total of 29 DGA domain families from different families were selected in the experiment. The dataset size for each DGA domain family and benign domains is shown in Table 1. 80% of the dataset was used as the training set, and 20% as the test set. The model was trained and tested separately to find the optimal model parameters and complete the multi-classification task for DGA domain families.

[0072] Table 1. Distribution of Experimental Datasets

[0073]

[0074] (2) Experiment and hyperparameter setting

[0075] To test the performance of the RBL-CNN-MA model as a DGA domain family multi-classification model, the following experiment was designed:

[0076] Experiment 1: Performance comparison of CNN and Bi-LSTM under different combinations;

[0077] Experiment 2: Performance comparison of neural networks after adding multi-head attention mechanism;

[0078] Experiment 3: Ablation experiment based on RBL-CNN-MA model;

[0079] After continuous parameter tuning and optimization, the hyperparameters of the model were determined as shown in Table 2.

[0080] Table 2 Model Hyperparameter Settings

[0081] Parameter Indicators Parameter settings Number of hidden units in Bi-LSTM layer 128 CNN output channel count 64 head 4 dropout 0.5 epoch 25 batch size 64 kernel size 2 Learning rate of RoBERTa pre-trained models 2e-5 Learning rates of each layer in LSTM, CNN, and MA 5e-4

[0082] (3) DGA domain name classification that integrates different neural network combinations

[0083] Based on the RoBERTa pre-trained model, this paper combines the RoBERTa pre-trained model with CNN, Bi-LSTM, CNN-BiLSTM, BiLSTM-CNN, and CNN-BiLSTM ensemble learning to perform multi-class classification detection of DGA domain name families. The three models with the best classification performance are then selected for further model improvement. Therefore, this section will first analyze the implementation methods of each model.

[0084] The RCNN model is a one-dimensional CNN network concatenated after the RoBERTa pre-trained model. Specifically, the word embedding feature vector (squeue output) of RoBERTa is directly fed into the CNN, and local features are extracted from multiple dimensions using different convolution kernels. Finally, the multiple features are concatenated and merged with the sentence embedding feature vector (pooler output) output by the RoBERTa pre-trained model as the final output of the domain name sequence features.

[0085] The implementation of the RBiLSTM model is similar to that of the RCNN model, except that the CNN is replaced by Bi-LSTM.

[0086] The RCNN-BiLSTM model also directly feeds the sequence output of RoBERTa into the CNN, then uses the output of the CNN as the input to the BiLSTM, and finally merges the output of the BiLSTM with the pooler output to form the feature vector for multi-class classification. It's important to note that pooling layers should be avoided during the CNN process to ensure that subsequent positional information of the domain name text can be learned effectively.

[0087] The implementation of RBiLSTM-CNN is similar to that of RCNN-BiLSTM. The difference is that pooling layers can be added after RBiLSTM-CNN. This is because Bi-LSTM has already taken positional information into account when extracting features. Therefore, the vector obtained after the pooling layer is finally merged with the pooler output as the feature vector for multi-class classification.

[0088] The ensemble learning RCNN-BiLSTM model inputs the sequence output of RoBERTa into the CNN and LSTM respectively, then merges the outputs of the CNN and LSTM, and finally merges the merged vector with the pooler output as the feature vector for multi-class classification.

[0089] Table 3. Classification of DGA domain names using different neural network combinations

[0090] method Accuracy (%) Precision rate (%) Recall rate (%) <![CDATA[F1 M (%)]]> RCNN 86.14 87.41 86.37 86.59 RCNN-BiLSTM 90.32 89.97 90.15 89.86 RBiLSTM 93.59 93.95 94.08 93.61 RBiLSTM-CNN 96.32 96.73 95.97 96.39 Ensemble Learning RCNN-BiLSTM 94.87 94.36 94.41 95.08

[0091] When testing the detection models, recall, precision, and F1 scores were compared horizontally. The experimental results are shown in Table 3. Overall, the detection performance is roughly ranked as follows: model classification accuracy from highest to lowest: RBiLSTM-CNN > Ensemble Learning RCNN-BiLSTM > RBiLSTM > RCNN > RCNN-BiLSTM > RCNN. This experiment provides a baseline comparison for subsequent improvements to the detection model architecture to enhance detection performance.

[0092] By comparison Figure 3 The comparison results across various evaluation metrics show that RCNN has the lowest classification accuracy. This is likely because CNN only extracts local features from the encoding vector of each character embedding, neglecting long-distance and contextual relationships between certain domain name sequences. The RCNN-BiLSTM model's classification accuracy is only slightly higher than RCNN. This limitation may be because CNN first learns the local features of the character embedding encoding vector, and then performs long-distance learning on these concatenated local domain name features. This might ignore some features inherent in the original domain name sequence, leading to poor model performance. The RBiLSTM model learns the contextual semantic relationships of the domain name sequence from both forward and reverse directions, performing better than the RCNN-BiLSTM model to some extent. Therefore, to better optimize the subsequent model performance, the three best-performing models—RBiLSTM-CNN, ensemble learning RCNN-BiLSTM, and RBiLSTM—were selected. A multi-head attention mechanism will then be combined with these three models to analyze their multi-class classification detection performance for DGA domain name families.

[0093] (4) Multi-classification of DGA domain family with integrated multi-head attention mechanism

[0094] To reduce the model's focus on useless information and increase its attention to important features for multi-class classification of domain name families, this section further improves upon the three best-performing models from the previous section by incorporating an attention mechanism. The three best-performing models all employ a multi-head attention mechanism, named RBL-CNN-MA (RoBERTa-LSTM-CNN-Multihead-Attention), RBL-MA (RoBERTa-LSTM-Multihead-Attention), and Ensemble Learning RCNN-BL-MA (RoBERTa-Ensemble Learning CNN-LSTM-Multihead-Attention). Experimental results show that all models achieve good results, demonstrating that neural network models incorporating multi-head attention mechanisms can improve multi-class classification of DGA domain name families.

[0095] In the experiments, multi-head attention layers were added after the BiLSTM layer in the RBL model, after the CNN layer in the RBL-CNN model, and after the BiLSTM layer in the ensemble learning RCNN-BL. To optimize the model performance, the number of heads in the multi-head attention layer was first tuned. It was found that the size of the heads affects the model's learning ability, and only by selecting an appropriate number of heads can the model achieve optimal results. However, sometimes selecting too many heads can negatively impact model performance. Figures 4 to 7 The figure shows the changes in accuracy, recall, and loss value corresponding to the number of heads under different models.

[0096] The results show that, Figures 4 to 7 As shown, the evaluation metric reaches its optimal value when the number of heads is 4. Further increases in the number of heads result in a slight decrease in the model's metric. Therefore, it can be concluded that increasing the number of heads too much makes it impossible to capture the deep-seated correlations between DGA domain name characters from the newly added feature subspace. Thus, this section selects 4 as the number of model heads.

[0097] After determining the number of heads, the domain name data was input into the three constructed neural network models, and the final classification results are shown in Table 4. Table 4 shows that the three methods each have their own advantages and disadvantages in terms of performance. The RBL-MA model has the fastest training speed, while the RBL-CNN-MA model has the highest performance across all metrics.

[0098] Table 4 Comparison of Test Results

[0099]

[0100]

[0101] From the perspective of the entire model training process, the RBL-MA model trains faster but its accuracy is generally lower. This may be because LSTM only extracts features from long-range sequences, failing to fully represent all the fine-grained semantic information contained within the domain name sequence. The ensemble learning RCNN-BL-MA model, on the other hand, combines local and long-range features and applies multi-head attention, giving the model greater attention to important domain name information. In terms of performance, this model achieves higher classification accuracy than RBL-MA, but it takes longer and is less efficient. The RBL-CNN-MA model achieves the best performance among the three models. This model first uses BiLSTM to extract long-range features from the domain name sequence, obtaining a new text matrix that incorporates contextual semantics. This matrix is ​​then input into a CNN for local feature extraction. Since CNNs struggle to differentiate the importance of multiple features extracted from different dimensions, a multi-head attention mechanism is used to increase the relevance of domain name text positional information, enhancing the model's interpretability. As shown in Table 4, the experimental results show that the RBL-CNN-MA model has the highest classification accuracy and ranks second in training speed among the three models, thus balancing accuracy and efficiency.

[0102] The results of the multi-class detection model for DGA domain families based on the RoBERTa pre-trained model show that the detection accuracy of some domain families is low, such as the ranbyus and shifu families. Therefore, to demonstrate the improvement of the RBL-CNN-MA model in classifying these families, the detection accuracy of each family under this model is output. Table 5 shows the classification index of the RBL-CNN-MA model for each DGA domain family. It can be seen that the recognition accuracy of families such as conficker and pykspa, which had low recognition accuracy in the RoBERTa pre-trained model, has been significantly improved under the RBL-CNN-MA model. This proves that this model can learn the implicit and explicit features contained in the DGA domain sequence better than other neural network models. The RBL-CNN-MA model not only further improves the recognition performance of DGA domain families based on word lists, but also enhances the recognition performance of new variant families with small domain data volume and domain families with very messy composition structures.

[0103] Table 5. Overall classification performance of the RBL-CNN-MA model

[0104]

[0105]

[0106] To demonstrate the predictive performance of the RBL-CNN-MA model in more detail, Figure 8 The confusion matrix of the model is presented. In this matrix, each row represents the actual family category corresponding to a known domain name, and each column represents the domain name family category predicted by the RBL-CNN-MA deep learning model. The value of each small cell is a value in the range [0,1] obtained by normalizing the number of actual and predicted values. As can be clearly seen in the illustration on the right, the larger the value of a small cell, the darker its corresponding color, meaning that the model's detection performance is better, and vice versa.

[0107] and Figure 9 The comparison of DGA domain name detection results based on the RoBERTa pre-trained model shows that the RBL-CNN-MA model has more dark squares on the diagonal. This indicates that the proposed RBL-CNN-MA model is more accurate than the RoBERTa pre-trained model in predicting both word-type and character-type DGA domain name families, especially for classes with limited data and complex, difficult-to-identify classes, achieving better detection results. For example, compared to... Figure 9 In terms of Figure 8 The prediction results of the Ranbyus, Conficker, and Pykspa families can be more clearly explained by the color of the diagonal. Under the RBL-CNN-MA model, the small squares corresponding to these DGA domain families show a relatively darker color tone, indicating that the classification of these DGA domains is relatively more accurate. Therefore, the superiority of the proposed RBL-CNN-MA model can be more intuitively explained and confirmed by using the confusion matrix.

[0108] The above experiments lead to the conclusion that the RBL-CNN-MA model achieves the highest classification accuracy in the DGA domain family multi-classification task. To a certain extent, it can be applied to DGA domain detection tasks in real-world scenarios to further facilitate the tracing of the DGA domain family.

[0109] (5) Model ablation experiment

[0110] To more strongly demonstrate the effectiveness of the overall performance of the RBL-CNN-MA model, this section performs ablation testing to prove that the architectural components are reasonable and effective, and that each component plays its corresponding role in the overall RBL-CNN-MA model architecture. In the experiments, the RBL-CNN-MA model is decomposed into smaller components, and their impact on the overall model performance is assessed by performing multi-class classification detection tasks on each component within the DGA domain name family. Since the previous two experiments have demonstrated the improvement in model performance by the BiLSTM layer, CNN layer, and multi-head attention layer, this section decomposes the RBL-CNN-MA model into two different modules: sentence embedding and character embedding + BL-CNN-MA. The impact of these modules on model performance is assessed by removing one of these modules. The experimental results are shown in Table 6.

[0111] Table 6 Model Ablation Experiment

[0112]

[0113] It can be seen that after removing the sentence embedding module, the precision of the RBL-CNN-MA model decreased by about 0.89%, the recall decreased by about 0.943, and the F1 score decreased. M The precision decreased by approximately 0.92%, and the recall increased by approximately 0.027. For the pure RoBERTa model after removing the word embedding module, the precision decreased by approximately 6.71%, the recall decreased by approximately 5.19%, and the F1 score decreased. M The performance decreased by approximately 6.38%, while the loss increased by approximately 0.162. This demonstrates that both modules play crucial roles in improving the overall performance of the model for multi-class classification of DGA domain families, and each module of the RBL-CNN-MA model with word embeddings is indispensable.

[0114] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A multi-class detection method for DGA domain name families based on RBL-CNN-MA, characterized in that, include: The DAG domain name data to be classified is input into the RoBERTa pre-trained model to obtain the sentence embedding feature vector and character embedding feature vector of the domain name; The word embedding feature vector is input into a bidirectional LSTM layer to extract long-distance features, resulting in a text matrix that integrates domain name contextual relevance. The text matrix is ​​input into a CNN layer to extract local features; The CNN layer contains four parallel convolutional kernels of different sizes, and dynamic processing is performed within the CNN layer. k -max pooling extracts local features from DGA domain sequence from multiple feature dimensions, and further extracts implicit patterns between DGA domain characters under long-distance features; The output of the CNN layer is fed into a multi-head attention layer to extract features from multiple dimensions; The output of the multi-head self-attention layer is fused with the sentence embedding feature vector output by the RoBERTa pre-trained model to obtain a new sentence embedding feature vector; The new sentence embedding feature vector is input into a fully connected layer to obtain the classification result of the DGA domain name data to be classified.

2. The multi-class detection method for DGA domain name families based on RBL-CNN-MA according to claim 1, characterized in that, The dimensions of the text matrix are [batch size, dictionary length, number of hidden units in the Bi-LSTM layer].

3. The multi-class detection method for DGA domain name families based on RBL-CNN-MA according to claim 1, characterized in that, The number of heads in the multi-head attention layer is 4.

Images