A method and apparatus for identifying malicious domain names based on dynamic heterogeneous graphs

Abstract

This invention relates to a method and apparatus for identifying malicious domain names based on dynamic heterogeneous graphs. The method includes: constructing a heterogeneous domain name graph; constructing a graph neural network model, including an attention-based neural network model and an RNN model; obtaining time-series graph data using the heterogeneous domain name graph, inputting it into the attention-based neural network model to obtain the time-series information of each node, and then inputting this information into the RNN model for training; and using the trained graph neural network model to identify malicious domain names. This invention fully considers the impact of different types of nodes on domain name nodes through different connection methods, increasing the interpretability of the identification results; by introducing a time dimension on top of the heterogeneous graph, it can consider graph information from multiple dimensions, improving the accuracy of the identification results; and through three self-attention layers—node type, node level, and association type level—it can more effectively extract node features, improving the accuracy of the identification results.

Description

Technical Field

[0001] This invention belongs to the field of information technology, specifically relating to a method and apparatus for identifying malicious domain names based on dynamic heterogeneous graphs. Background Technology

[0002] Malicious domain names refer to website domain names that cause the leakage of user information and sensitive data through malicious code, or cause financial losses to users through deception and fraud, or display illegal or unhealthy content. With the rapid development of information technology, domain name registration has become increasingly simple and convenient, and the number of domain names on the Internet is also increasing rapidly. Illegal use of domain names by criminals occurs frequently, making the rapid and accurate identification of malicious domain names a focus of attention.

[0003] Knowledge graphs can effectively store the structure and attribute information of domain names, and can effectively identify bad domain names. However, most commonly used identification methods are based on static isomorphic graphs, that is, the graph only contains nodes of the domain name type and does not consider the time of the graph. This approach is prone to the loss of a lot of rich information, which affects the accuracy of identification. Summary of the Invention

[0004] To address the aforementioned problems, this invention provides a method and apparatus for identifying malicious domain names based on dynamic heterogeneous graphs.

[0005] The technical solution adopted in this invention is as follows:

[0006] In a first aspect, the present invention provides a method for identifying malicious domain names based on dynamic heterogeneous graphs, comprising the following steps:

[0007] Construct a heterogeneous domain name graph;

[0008] Build graph neural network models, including attention-based neural network models and RNN models;

[0009] Time series graph data is obtained by using domain heterogeneous graphs, and then input into an attention-based neural network model to obtain the time series information of each node. This information is then input into the RNN model for training.

[0010] Using a trained graph neural network model to identify malicious domain names.

[0011] Furthermore, the domain heterogeneous graph is an undirected graph, including three node types: domain name, IP address, and AS encoding. The attributes of the domain name node include: domain name registrar code, registrar name, registrant anonymization information, and domain name registration information. The attributes of the IP address node include: IP address location and IP address type. The attributes of the AS encoding node include: the autonomous system to which the autonomous system belongs.

[0012] Furthermore, the attention-based neural network model includes three self-attention layers: a node-type attention layer, a node-level multi-head attention layer, and an association-type-level attention layer.

[0013] Furthermore, the node type attention layer is used to learn the attention weights for different node types, specifically the attention weights for node i with respect to node type ψ. The calculation formula is as follows:

[0014]

[0015]

[0016]

[0017]

[0018] in, Let v be the neighborhood embedding representation of node i with respect to node type ψ. j h′ is a neighboring node of type ψ of node i. j Let be the mapping feature vector of node i's neighbor node j, L be the symmetric normalized Laplacian matrix, I be the identity matrix, D be the degree matrix, and A be the weighted adjacency matrix. Represents node v i Regarding the attention score for the ψ-type neighborhood, σ is the activation function. h′ is the node type attention vector. i Let be the mapping feature vector of node i, || denotes the join operation, and H is the combination of node types.

[0019] Furthermore, the node-level multi-head attention layer is used to learn the weight coefficients of different neighbor nodes under a given domain association type. and the node-level embedding representation of node i The calculation formula is as follows:

[0020]

[0021]

[0022] Where σ is the activation function, in the domain association type is Under the premise that K is the number of heads for self-attention, h′ is the node-level attention vector, || denotes the join operation. i Let h′ be the mapping feature vector of node i. j Let be the mapping feature vector of node i's neighbor node j. Let h′ be the set of neighboring nodes of node i. kLet be the mapping feature vector of node k. To indicate that for type ψ j The type-level attention weights of node j, To indicate that for type ψ k The type-level attention weight of node k; the domain association types are divided into three categories: domains associated through the same IP address, domains associated through the same AS encoding, and domains associated through the same domain name.

[0023] Furthermore, the association type-level attention layer is used to learn how to measure domain association types. Importance weight and the final embedding representation Z of node i i The calculation formula is as follows:

[0024]

[0025]

[0026] in For a set of nodes, Let represent the number of nodes, q be the semantic attention vector, tanh be the hyperbolic tangent function, W be the weight matrix, and b be the bias coefficient. This is the node-level embedding representation of node i obtained from the node-level multi-head attention layer.

[0027] Furthermore, the acquisition of time series graph data includes: acquiring graph information at regular intervals to obtain a time-dimension graph sequence; and passing the graph at each time point through three self-attention layers to obtain the final node embedding representation at each time point.

[0028] Secondly, the present invention provides a malicious domain name identification device based on a dynamic heterogeneous graph, comprising:

[0029] The domain heterogeneous graph construction module is used to build domain heterogeneous graphs.

[0030] The graph neural network model building module is used to build graph neural network models, including attention-based neural network models and RNN models.

[0031] The graph neural network model training module is used to obtain time series graph data by utilizing domain heterogeneous graphs, inputting it into a neural network model based on an attention mechanism to obtain the time series information of each node, and then inputting it into the RNN model for training.

[0032] The malicious domain name identification module is used to identify malicious domain names using a trained graph neural network model.

[0033] Thirdly, the present invention provides a computer device including a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the steps of the method of the present invention.

[0034] Fourthly, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a computer, implements the various steps of the method of the present invention.

[0035] The advantages and beneficial effects of this invention are as follows:

[0036] 1) It can fully consider the impact of different types of nodes on domain name nodes through different connection methods, increasing the interpretability of the identification results. Introducing a time dimension into heterogeneous graphs allows for multi-dimensional consideration of graph information, further improving the accuracy of the identification results. Heterogeneous graphs contain richer information than homogeneous graphs, fully exploring the impact of different types of nodes and connection paths on nodes, better extracting node features, and thus improving the accuracy of identifying malicious domain names. Introducing a time dimension on this basis allows for a more comprehensive understanding of node characteristics, making the identification results even more accurate.

[0037] 2) By employing three self-attention layers—node type, node level, and association type level—node features can be extracted more effectively, improving the accuracy of recognition results. This invention introduces an attention mechanism based on domain association type into the graph neural network, enabling the network to focus more on useful node information during feature extraction, fully considering different connection methods between domain names, thus improving efficiency and enhancing the interpretability of the recognition results. Attached Figure Description

[0038] Figure 1 This is a flowchart of the steps of a method for identifying malicious domain names based on dynamic heterogeneous graphs in one embodiment of the present invention.

[0039] Figure 2 This is a module composition diagram of a malicious domain name identification device based on dynamic heterogeneous graphs in one embodiment of the present invention. Detailed Implementation

[0040] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0041] This invention mainly includes the following:

[0042] 1) Construction of a heterogeneous domain name graph, which includes three node types: domain name, IP address, and AS encoding. The graph is an undirected graph.

[0043] 2) Construct a graph neural network model and train it using historical graph data.

[0044] 3) To enable the model to focus more on useful information and fully consider the impact of different connection relationships on nodes when extracting features, an attention mechanism based on domain name association type is introduced.

[0045] 4) The graph neural network is generally divided into two parts. The first part is used to extract the graph structure information at each time point, and the second part is an RNN model that introduces the time dimension.

[0046] In one embodiment of the present invention, a method for identifying malicious domain names based on dynamic heterogeneous graphs is provided. The overall process of this method is as follows: Figure 1 As shown, it includes the following steps:

[0047] S101: Build a heterogeneous domain name graph.

[0048] S102: Build graph neural network models, including attention-based neural network models and RNN models.

[0049] S103: Obtain time series graph data using domain heterogeneous graphs, input it into a neural network model based on attention mechanism to obtain the time series information of each node, and input it into the RNN model for training.

[0050] S104: Use the trained graph neural network model to identify malicious domain names.

[0051] For example, the domain heterogeneous graph includes three node types: domain name, IP address, and AS encoding.

[0052] For example, the graph neural network model is divided into two parts: the first part is an attention mechanism neural network model for extracting graph structure information at each time point, and the second part is an RNN model that introduces the time dimension.

[0053] For example, the above method also includes: determining the domain association type.

[0054] For example, the above method further includes: defining a mapping matrix M for each type of node in the graph. i This allows nodes of all types to be projected onto the same feature space.

[0055] For example, the attention-based neural network model consists of three self-attention layers. The first layer is a node-type attention layer, which learns the attention weights for different node types. The second layer is a node-level multi-head attention layer, which learns the weight coefficients of different neighboring nodes under the domain association type. and the node-level embedding representation of the original node i The third layer is the association type-level attention layer, which can learn to measure the domain association type. Importance weight and the final embedding representation Z of the original node i i .

[0056] For example, the above method further includes: determining the time node division and processing the spectrum G for each time node. t After passing through the three self-attention layers mentioned above, the node embedding representations for each time point are obtained. Then the above obtained The concatenated data is used as temporal information input into an RNN model for classification training, with cross-entropy loss function selected. After training, the trained graph neural network (including attention-based neural network models and RNN models) is used to identify malicious domain names.

[0057] In a more specific embodiment of the present invention, a method for identifying malicious domain names based on dynamic heterogeneous graphs is provided. The specific implementation process of this method includes the following steps:

[0058] (1) Construction of Heterogeneous Domain Name Graph. The heterogeneous domain name graph is an undirected graph. The graph includes three types of nodes: domain name ψ1, IP address ψ2, and AS code ψ3. The attributes of the domain name include: domain name registrar code, registrar name, registrant anonymization information, domain name registration information, etc. The attributes of the IP address include: IP address location and IP address type (IPv4, IPv6). The attributes of the AS code include: autonomous system to which the autonomous system belongs.

[0059] (2) Building a graph neural network model. The graph neural network model consists of two parts. The first part is used to extract the graph structure information at each time point and build an attention mechanism graph neural network model. The second part is an RNN model that introduces the time dimension.

[0060] (3) Determine the domain association type. Domain association types are divided into three categories. They are respectively: domain name - IP address - domain name Domain Name - AS Encoding - Domain Name Domain-domain-domain refers to domains associated with the same IP address, domains associated with the same AS code, and domains associated with the same domain name.

[0061] (4) Define mapping matrices for each type of node in the domain heterogeneous graph. This projects nodes of all types onto the same feature space. Specifically: the mapping feature vector for domain name type nodes is... The mapping feature vector of the IP address type node is The mapping feature vector of AS-encoded type nodes is Where h1, h2, and h3 represent the original feature vectors of the three types of nodes.

[0062] (5) A graph neural network model based on the attention mechanism is built using three self-attention layers. The first layer is a node type attention layer, which is used to learn the attention weights of different node types and the attention weight of node i with respect to node type ψ. The calculation formula is as follows:

[0063]

[0064]

[0065]

[0066]

[0067] in, Let v be the neighborhood embedding representation of node i with respect to node type ψ. j h′ is a neighboring node of type ψ of node i. j Let L be the mapping feature vector of node i's neighbor node j, and L be the symmetric normalized Laplace matrix. ij Let I be the element of matrix L, D be the degree matrix, and A be the weighted adjacency matrix (the weight of an edge directly connecting two domains is set to 2, the weight of all other connecting edges is 1, and the weight of an edge without a connection is 1). Represents node v i Regarding the attention score for the ψ-type neighborhood, σ is the activation function. h′ is a node-type attention vector that is shared by all nodes. j Let be the mapping feature vector of node i, || denotes the join operation, and H is the combination of node types, H={ψ1,ψ2,ψ3}.

[0068] (6) The second layer is a node-level multi-head attention layer, which is used to learn the weight coefficients of different neighbor nodes under a given domain association type. and the node-level embedding representation of the original node i The corresponding calculation formula is as follows:

[0069]

[0070]

[0071] Where σ is the activation function, in the domain association type is Under this premise, K is the number of self-attention heads (multi-head attention is to ensure the stability of training; for example, K = 8 in this embodiment). This is the node-level attention vector, where || denotes the join operation, and h ′ Let h′ be the mapping feature vector of node i. j Let be the mapping feature vector of node i's neighbor node j. Let h′ be the set of neighboring nodes of node i. k Let be the mapping feature vector of node k. To indicate that for type ψ j The type-level attention weights of node j, To indicate that for type ψ k The type-level attention weights for node k.

[0072] (7) The third layer is the association type-level attention layer, which is used to learn: the measure of domain association type. Importance weight and the final embedding representation Z of the original node i i The corresponding calculation formula is as follows:

[0073]

[0074]

[0075] in For a set of nodes, Let represent the number of nodes, q be the semantic attention vector, tanh be the hyperbolic tangent function, W be the weight matrix, and b be the bias coefficient. This is the node-level embedding representation of the original node i obtained from the node-level multi-head attention layer.

[0076] (8) Acquire map information every half month, with a time length of half a year, to obtain the time-dimension map sequence G. t ={G0,…,G 11}, for the graph Gt at each time point, steps (5)-(7) are executed respectively, that is, after passing through three self-attention layers, the final node embedding representation at each time point is obtained.

[0077] (9) The above-obtained The concatenated information is used as time-series data input into the RNN model for training. The cross-entropy loss function is selected, and the loss function is as follows:

[0078]

[0079] Where y L Y is a set of labeled nodes. l Z is the original node with a label. l Let C be the predicted node representation of the RNN, and C be the classifier parameters.

[0080] (10) Use the trained graph neural network (including attention-based neural network models and RNN models) to identify malicious domain names. This step inputs graph information over a period of time: adjacency matrix, degree matrix, and node feature matrix (preferably a time length of 5 months or more, with graph information obtained every half month) into the trained graph neural network to identify potential malicious domain names and output the domain name nodes that may be malicious domain names.

[0081] Key aspects of this invention include:

[0082] 1) The method for identifying bad domain names based on dynamic heterogeneous graphs can incorporate richer graph information into heterogeneous graph data. On the one hand, by introducing a multi-head attention mechanism, the network model's focus is on node information with more data value, while the advantages of multi-head attention are used to stabilize the training process. On the other hand, by introducing a time dimension, the model can acquire graph change information more comprehensively and dynamically, perform multi-dimensional graph data feature representation as a whole, improve the model training accuracy, and increase the accuracy of the identification results.

[0083] 2) Based on three self-attention layers with different purposes (node ​​type attention layer, node-level multi-head attention layer, and association type-level attention layer), node-level features and association-level features of nodes are extracted respectively, and a graph neural network model based on attention mechanism is constructed. This not only improves the accuracy of the recognition results, but also enhances the interpretability of the recognition results.

[0084] Another embodiment of the present invention provides a malicious domain name identification device based on a dynamic heterogeneous graph, such as... Figure 2 As shown, the device includes:

[0085] Domain Heterogeneous Graph Construction Module 201 is used to construct a domain heterogeneous graph.

[0086] Graph Neural Network Model Building Module 202 is used to build graph neural network models, including attention-based neural network models and RNN models;

[0087] The graph neural network model training module 203 is used to obtain time series graph data by utilizing domain heterogeneous graphs, input it into a neural network model based on attention mechanism, obtain the time series information of each node, and input it into the RNN model for training.

[0088] The malicious domain name identification module 204 is used to identify malicious domain names using a trained graph neural network model.

[0089] For the specific implementation process of each module, please refer to the description of the method of the present invention above.

[0090] Another embodiment of the present invention provides a computer device (computer, server, smartphone, etc.) including a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the steps of the method of the present invention.

[0091] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, optical disk) storing a computer program that, when executed by a computer, implements the various steps of the method of the present invention.

[0092] The device embodiments described above are merely illustrative. The units / modules described as separate components may or may not be physically separate. The components shown as units may or may not be physical units, and may be located in one place or distributed across multiple network units. Some or all of the units or modules can be selected to achieve the purpose of the present invention according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0093] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0094] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and to implement it accordingly. Those skilled in the art will understand that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the content disclosed in the embodiments of this specification; the scope of protection of the present invention is defined by the claims.

Claims

1. A method for identifying bad domain name based on dynamic heterogeneous graph, characterized in that, The method comprises the following steps: constructing a domain name heterogeneous graph; constructing a graph neural network model, including a neural network model based on an attention mechanism and an RNN model; obtaining time sequence graph data from the domain name heterogeneous graph, inputting the time sequence graph data into the neural network model based on the attention mechanism, obtaining time sequence information of each node, and inputting the time sequence information into the RNN model for training; performing bad domain name recognition by using the trained graph neural network model; the neural network model based on the attention mechanism comprises three self-attention layers: a node type attention layer, a node level multi-head attention layer, and a correlation type level attention layer; the node type attention layer is used to learn attention weights of different node types; The node-level multi-head attention layer is used to learn the weight coefficients of different neighboring nodes under a given domain association type. and the node-level embedding representation of node i The association type-level attention layer is used to learn how to measure domain association types. Importance weight and the final embedding representation Z of node i i .

2. The method of claim 1, wherein, the domain name heterogeneous graph is a directed graph, including three node types of domain names, IP addresses, and AS codes; the attributes of the domain name node include: domain name registrar code, registrar name, registrant desensitization information, and domain name registration information; the attributes of the IP address node include: IP address attribution and IP address type; the attributes of the AS code node include: autonomous domain belonging organization.

3. The method of claim 2, wherein, In the node type attention layer, the attention weight for node i with respect to node type ψ The calculation formula is as follows: wherein, is the neighborhood embedding representation of node i with respect to node type ψ, v j is a neighbor node of node i of type ψ, h' j is the mapped feature vector of neighbor node j of node i, L is a symmetric normalized Laplacian matrix, I denotes an identity matrix, D denotes a degree matrix, A is a weighted adjacency matrix, denotes a node v i is the attention score with respect to the ψ type neighborhood, σ is an activation function, is the node type attention vector, h' i is the mapped feature vector of node i, || denotes a concatenation operation, H is a combination of node types.

4. The method of claim 3, wherein, The calculation formula of the node level multi-head attention layer is as follows: Where σ is the activation function, in the domain association type is Under the premise that K is the number of heads for self-attention, h′ is the node-level attention vector, || denotes the join operation. i Let h′ be the mapping feature vector of node i. j Let be the mapping feature vector of node i's neighbor node j. Let h be the set of neighboring nodes of node i. ′ k Let be the mapping feature vector of node k. To indicate that for type ψ j The type-level attention weights of node j, To indicate that for type ψ k The type-level attention weights for node k; the domain name correlation types are divided into three categories, which are: domain names associated through the same IP address, domain names associated through the same AS code, and domain names associated through the same domain name.

5. The method of claim 4, wherein, The calculation formula of the correlation type level attention layer is as follows: wherein is a set of nodes, denotes the number of nodes, q is a semantic-level attention vector, tanh is a hyperbolic tangent function, W is a weight matrix, and b is a bias coefficient, is a node-level embedding representation of node i obtained by the node-level multi-head attention layer.

6. The method of claim 5, wherein, the time sequence graph data is obtained by: obtaining graph information at a certain time interval to obtain a graph sequence in the time dimension; and passing each time point of the graph through the three self-attention layers to obtain the final node embedding representation of each time point.

7. A dynamic heterogeneous graph-based bad domain name recognition device, characterized in that, The method comprises: a domain name heterogeneous graph construction module for constructing a domain name heterogeneous graph; a graph neural network model construction module for constructing a graph neural network model, including a neural network model based on an attention mechanism and an RNN model; a graph neural network model training module for obtaining time sequence graph data from the domain name heterogeneous graph, inputting the time sequence graph data into the neural network model based on the attention mechanism, obtaining time sequence information of each node, and inputting the time sequence information into the RNN model for training; a bad domain name recognition module for performing bad domain name recognition by using the trained graph neural network model; the neural network model based on the attention mechanism comprises three self-attention layers: a node type attention layer, a node level multi-head attention layer, and a correlation type level attention layer; the node type attention layer is used to learn attention weights of different node types; The node-level multi-head attention layer is used to learn the weight coefficients of different neighboring nodes under a given domain association type. and the node-level embedding representation of node i The association type-level attention layer is used to learn how to measure domain association types. Importance weight and the final embedding representation Z of node i i .

8. A computer device, comprising: a computer readable storage medium stores a computer program, and the computer program is executed by a computer to implement the method in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by a computer to implement the method in any one of claims 1-6.

Images