Domain name detection method and device for dga

Abstract

The specification relates to the technical field of Internet network security, and specifically discloses a DGA domain name detection method and device, wherein the method comprises: obtaining a domain name data set; preprocessing domain name samples in the domain name data set, and constructing a training sample set based on the preprocessed domain name data set; training a preset network model using the training sample set to obtain a target detection model; the target detection model is used to identify DGA malicious domain names; the target detection model comprises a word embedding layer, a feature extraction layer and a prediction output layer, the word embedding layer is used to vectorize the preprocessed domain name sample data; the feature extraction layer comprises a shallow feature extractor, a long short-term memory network and a cache Restormer module based on a self-attention mechanism; and the prediction output layer is used to output a classification result of the domain name. The above scheme can accurately and efficiently identify DGA malicious domain names.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of Internet network security, and particularly relates to a DGA domain name detection method and device. BACKGROUND

[0002] With the popularity of the Internet, people's life is more convenient, but also faces the increasing security challenges. Various security attacks emerge in an endless stream, especially the destruction and impact caused by using botnets as the main means are more serious. These botnet controllers establish a channel with bot hosts through command and control (C&C) servers, realize one-to-many control of multiple bot hosts, and carry out attacks such as spam and malicious software distribution. Because DGA (Domain Generation Algorithm) can generate a large number of random domain names in a very short time, the traditional defense method based on blacklist filtering is limited in effect. The high concealment and low cost characteristics of this DGA algorithm make it widely used by botnet controllers in domain name blacklists to cope with IP blocking and reverse analysis.

[0003] For the banking system, malicious attacks of botnets may lead to potential data leakage risks, threatening the security of customers' sensitive information. However, by identifying DGA-generated domain names, communication between the botnet and the C&C server can be effectively cut off, thereby preventing attacks by the botnet. Therefore, DGA domain name detection plays a crucial role in the banking system, helping to discover potential attack behavior in a timely manner and take appropriate preventive measures to protect customer data and system security.

[0004] Existing DGA domain name detection can be roughly divided into two categories: traditional machine learning-based detection methods and deep learning-based detection methods. The performance of the traditional machine learning-based detection method depends on the hand-crafted features and statistical analysis. Deep learning represents an improvement and upgrade over traditional machine learning, and its powerful self-learning ability enables deep learning-based detection models to better capture the feature relationships between domain names. However, the traditional machine learning-based detection method relies on hand-crafted features, which requires a lot of human resources and time. Meanwhile, the extracted features are relatively fixed and difficult to adapt to new DGA variants. Moreover, the feature extraction and model training process is time-consuming and not real-time. Due to the huge difference in the number of domain names of different DGA families, the imbalance of the data set in the specific family classification task of domain names leads to poor performance. The current detection method for word DGA domain names is difficult to capture effective hierarchical semantic information for differentiation in one-time prediction due to the similarity of its statistical features to benign domain names, resulting in a decline in detection performance.

[0005] At present, there is no effective solution to the above problems. SUMMARY

[0006] Embodiments of the present specification provide a DGA domain name detection method and device to solve the problem of low accuracy of malicious domain name multi-classification task in the prior art.

[0007] Embodiments of the present specification provide a DGA domain name detection method, comprising:

[0008] obtaining a domain name data set; preprocessing domain name samples in the domain name data set, and constructing a training sample set based on the preprocessed domain name data set; the domain name data set includes benign domain name samples and DGA malicious domain name samples;

[0009] training a preset network model using the training sample set to obtain a target detection model; the target detection model is used to identify DGA malicious domain names;

[0010] The target detection model includes a word embedding layer, a feature extraction layer, and a prediction output layer. The word embedding layer is used to vectorize the preprocessed domain name sample data to obtain corresponding word vectors. The feature extraction layer includes a shallow feature extractor, a long short-term memory network, and a cache Restormer module based on a self-attention mechanism. The shallow feature extractor is used to extract shallow features of the word vectors and pass the shallow features to the long short-term memory network. The long short-term memory network is used to establish the shallow feature information in the early stage and the long-term dependency relationship in the later stage. The cache Restormer module based on the self-attention mechanism is used to capture global information of domain name features to establish the dependency relationship between domain name characters. The prediction output layer is used to output the classification result of the domain name.

[0011] In one embodiment, preprocessing the domain name samples in the domain name data set comprises:

[0012] truncating the top-level domain name of the domain name samples in the domain name data set and retaining the second-level domain name to obtain truncated domain name data;

[0013] performing a word segmentation operation on the truncated domain name data to obtain segmented domain name data.

[0014] In one embodiment, the shallow feature extractor is used to perform multiple dilation convolutions on the input features respectively, concatenate the output features in the channel dimension, then perform channel compression on the features through a convolution layer, and finally input the compressed features into an SE channel attention module to obtain the final output result.

[0015] In one embodiment, the multiple expansion convolutions correspond to different expansion rates.

[0016] In one embodiment, the input of the long short-term memory network includes feature information extracted by the shallow feature extractor at the current stage and hidden state information retained by the long short-term memory network at the previous stage.

[0017] In one embodiment, the cache Restormer module based on the self-attention mechanism includes a multi-head cache attention module and a gated feed-forward network; the multi-head cache attention module is used for self-attention calculation and cache attention calculation on the input feature; and the gated feed-forward network is used for allowing useful information to be further transmitted in the network hierarchy.

[0018] In one embodiment, the output result of the multi-head cache attention module is:

[0019] X = σ (λ) * X mem + (1-σ (λ)) * X self ;

[0020] wherein X is the output result of the multi-head cache attention module, X self and X mem are respectively the calculation results of the self-attention calculation and the cache attention calculation on the input feature, σ (·) is a Sigmoid activation function, and λ is a learning parameter for balancing the calculation results of the self-attention calculation and the cache attention calculation.

[0021] In one embodiment, a Focal Loss loss function is used in the process of training the preset network model by using the training sample set.

[0022] In one embodiment, accuracy, precision, recall and F1 score are used as evaluation indexes in the process of training the preset network model by using the training sample set.

[0023] In one embodiment, the method further includes:

[0024] acquiring target domain name data;

[0025] preprocessing the target domain name data to obtain preprocessed target domain name data;

[0026] inputting the preprocessed target domain name data into the target detection model to obtain a category of the target domain name data, so as to determine whether the target domain name data is a DGA malicious domain name.

[0027] The embodiments of the present specification also provide a DGA domain name detection device, which includes:

[0028] an acquisition module, configured to acquire a domain name data set, pre-process domain name samples in the domain name data set, and construct a training sample set based on the pre-processed domain name data set; the domain name data set includes benign domain name samples and DGA malicious domain name samples;

[0029] a training module, configured to train a preset network model by using the training sample set to obtain a target detection model; the target detection model is used to identify DGA malicious domain names.

[0030] The target detection model includes a word embedding layer, a feature extraction layer, and a prediction output layer. The word embedding layer is used to vectorize the pre-processed domain name sample data to obtain corresponding word vectors. The feature extraction layer includes a shallow feature extractor, a long short-term memory network, and a cache Restormer module based on a self-attention mechanism. The shallow feature extractor is used to extract shallow features of the word vectors and pass the shallow features to the long short-term memory network. The long short-term memory network is used to establish a long-term dependency relationship between early-stage shallow feature information and late-stage information. The cache Restormer module based on the self-attention mechanism is used to capture global information of domain name features to establish a dependency relationship between domain name characters. The prediction output layer is used to output a classification result of the domain name.

[0031] The embodiments of the present specification also provide a computer device, including a processor and a memory for storing processor-executable instructions, and the processor executes the instructions to implement the steps of the DGA domain name detection method described in any of the above embodiments.

[0032] The embodiments of the present specification also provide a computer-readable storage medium having computer instructions stored thereon, and the instructions are executed by a processor to implement the steps of the DGA domain name detection method described in any of the above embodiments.

[0033] The embodiments of the present specification also provide a computer program product, including computer programs / instructions, and the computer programs / instructions are executed by a processor to implement the steps of the DGA domain name detection method described in any of the above embodiments.

[0034] In the embodiment of the present specification, a DGA domain name detection method is provided, which can obtain a domain name data set; the domain name samples in the domain name data set are preprocessed, and based on the preprocessed domain name data set, a training sample set is constructed, the preset network model is trained by using the training sample set, and a target detection model is obtained, which can be used to identify DGA malicious domain names. The target detection model includes a word embedding layer, a feature extraction layer and a prediction output layer. The word embedding layer can be used to vectorize the preprocessed domain name sample data to obtain corresponding word vectors. The feature extraction layer includes a shallow feature extractor, a long short-term memory network and a cache Restormer module based on a self-attention mechanism. The shallow feature extractor is used to extract the shallow features of the word vectors and pass the shallow features to the long short-term memory network. The long short-term memory network is used to establish the long-term dependence relationship between the early-stage shallow feature information and the late-stage. The cache Restormer module based on the self-attention mechanism is used to capture the global information of the domain name features to establish the dependence relationship between the domain name characters. The prediction output layer is used to output the classification result of the domain name. In the above scheme, in the feature extraction layer, the word vector is first preliminarily extracted by the shallow feature extractor to extract the shallow feature representation of the input word vector, and then the shallow feature representation is passed to the next layer of long short-term memory layer, which is used to establish the long-term dependence relationship between the early-stage shallow feature information and the late-stage, realize the cross-stage flow of feature information, and gradually optimize the feature representation, and then the cache Restormer module based on the self-attention mechanism is used to fully capture the global information of the domain name features, establish the dependence relationship between the domain name characters, and the feature extraction layer extracts the deep domain name character feature representation through multi-stage iteration, which is input into the prediction output layer to predict the classification result of the domain name. Through the above scheme, the temporal and spatial context information of the domain name features can be fully aggregated, the progressive optimization of the multi-stage network for the domain name character feature extraction is stable, and the performance of the classification task is improved, so that the DGA malicious domain name can be efficiently and accurately detected. BRIEF DESCRIPTION OF DRAWINGS

[0035] The drawings described herein are used to provide further understanding of the present specification, constitute a part of the present specification, and do not constitute a limitation to the present specification. In the drawings:

[0036] Figure 1 A flowchart of a DGA domain name detection method in an embodiment of the present specification is shown;

[0037] Figure 2 A schematic diagram of the overall structure of a target detection model in an embodiment of the present specification is shown;

[0038] Figure 3 A schematic diagram of a multi-scale expansion aggregation attention module in an embodiment of the present specification is shown;

[0039] Figure 4 A structural diagram of a multi-head cache attention module and a gated feed-forward network is shown in an embodiment of the present specification.

[0040] Figure 5 A structural diagram of a DGA domain name detection device is shown in an embodiment of the present specification.

[0041] Figure 6 A schematic diagram of a computer device is shown in an embodiment of the present specification. DETAILED DESCRIPTION

[0042] The principles and spirits of the present specification will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are given only to enable those skilled in the art to better understand and implement the present specification, and in no way limit the scope of the present specification. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0043] Those skilled in the art understand that the embodiments of the present specification can be implemented as a system, a device, a method or a computer program product. Therefore, the present disclosure can be embodied as a complete hardware, a complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0044] The embodiments of the present specification provide a DGA domain name detection method. Figure 1 A flowchart of the DGA domain name detection method in an embodiment of the present specification is shown. Although the present specification provides the method operation steps or device structures as described in the following embodiments or shown in the accompanying drawings, more or fewer operation steps or module units can be included in the method or device based on conventional or non-creative labor. In steps or structures that do not have essential causal relationship in logic, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure described in the embodiments of the present specification and shown in the accompanying drawings. When the method or module structure is applied in actual device or terminal product, it can be executed sequentially or in parallel (for example, parallel processor or multi-thread processing environment, even distributed processing environment) according to the method or module structure shown in the embodiments or the accompanying drawings.

[0045] Specifically, as shown in the present specification, the DGA domain name detection method provided by an embodiment of the present specification can include the following steps. Figure 1

[0046] ​In step S101, a domain name data set is obtained; domain name samples in the domain name data set are preprocessed, and a training sample set is constructed based on the preprocessed domain name data set; the domain name data set includes benign domain name samples and DGA malicious domain name samples.

[0047] The method in this embodiment can be applied to a server. The server can obtain a domain name data set. The domain name data set is composed of two parts of data, a benign domain name data set and a DGA malicious domain name data set. In this embodiment, an open source domain name data set is used to train the network model. The domain name samples in the domain name data set can be preprocessed, and a training sample set is constructed based on the preprocessed domain name data set. In one embodiment, the open source data set of benign domain names can come from the top 50,000 domain names in website traffic, and the malicious domain name data set comes from the publicly available DGA domain name data of a website, containing more than 50 families of DGA data, from which 40 samples of relatively sufficient DGA domain name families are selected as the DGA malicious domain name data set. After the data set is randomly extracted in a ratio of 8:1:1, the training set, the validation set and the test set are set respectively.

[0048] In some embodiments of the present specification, the domain name samples in the domain name data set are preprocessed, including: truncating the top-level domain name of the domain name samples in the domain name data set and retaining the second-level domain name to obtain truncated domain name data; performing a word segmentation operation on the truncated domain name data to obtain segmented domain name data. Specifically, the domain name data set can be processed as follows: first, truncate the top-level domain name of the domain name samples and retain only the second-level domain name. Then, convert all uppercase characters in the domain name data to lowercase characters. For each domain name in the domain name data set, perform Bigram word segmentation operation to construct a corpus.

[0049] In step S102, the training sample set is used to train a preset network model to obtain a target detection model; the target detection model is used to identify DGA malicious domain names.

[0050] In this embodiment, the target detection model includes a word embedding layer, a feature extraction layer and a prediction output layer. The word embedding layer is used to vectorize the preprocessed domain name sample data to obtain corresponding word vectors. The feature extraction layer includes a shallow feature extractor, a long short-term memory network and a cache Restormer module based on a self-attention mechanism. The shallow feature extractor is used to extract shallow features of the word vectors and pass the shallow features to the long short-term memory network. The long short-term memory network is used to establish the shallow feature information in the early stage and the long-term dependency relationship in the later stage. The cache Restormer module based on the self-attention mechanism is used to capture the global information of the domain name features to establish the dependency relationship between the domain name characters; the prediction output layer is used to output the classification result of the domain name.

[0051] Specifically, taking the domain name sample as the original input, the word sequence is first vectorized by the word embedding layer to obtain the word vector. Then, the feature extraction layer performs multi-stage feature extraction on the word vector. The feature extraction layer takes the output of the previous stage as the input of the next stage in the iteration process, and optimizes the feature extraction layer in multiple stages. The composition of each stage of the feature extraction layer is the same and the parameters are shared. This way reduces the number of parameters that need to be trained by the model and the complexity of the model. Assuming that the current stage is stage t, the features F t+1 may be expressed as:

[0052]

[0053] where F t is the feature input of the current stage, F t+1 is the feature input of the next stage, denotes the feature extraction layer module, is the weight parameter that the feature extraction layer needs to learn.

[0054] In the feature extraction layer, the word vector is first processed by the shallow feature extractor to preliminarily extract the shallow feature representation of the input word vector. Then the shallow feature representation is passed to the next layer of long short-term memory. This layer is used to establish the long-term dependency relationship between the shallow feature information of the early stage and the late stage, realize the cross-stage flow of feature information, and gradually optimize the feature representation. Then the cache Restormer module based on the self-attention mechanism is used to fully capture the global nature of the domain name features and establish the dependency relationship between the domain name characters.

[0055] The feature extraction layer extracts the feature representation of the deep domain name characters through multi-stage iteration. This feature representation is input into the prediction output layer to predict the classification result of the domain name. The prediction input layer first flattens the extracted feature representation of the deep domain name characters into a one-dimensional vector through the Flatten layer. Then, the Dropout layer is used to discard the feature representation according to a certain probability to prevent overfitting and improve the generalization ability of the model. Finally, after the feature is linearly operated by the Linear layer, the output probability y is obtained by using the Softmax function for prediction.

[0056] In the above embodiments, in the feature extraction layer, the word vector is first preliminarily extracted by the shallow feature extractor to obtain a shallow feature representation of the input word vector, and then the shallow feature representation is passed to the next layer of the long short-term memory layer, which is used to establish the shallow feature information in the early stage and the long-term dependency relationship in the later stage, realize the cross-stage flow of feature information, and gradually optimize the feature representation, and then pass the feature representation to the cache Restormer module based on the self-attention mechanism to fully capture the global nature of the domain name features and establish the dependency relationship between the domain name characters. The feature extraction layer extracts the feature representation of the deep domain name characters through multi-stage iteration, and the feature representation is input into the prediction output layer to predict the classification result of the domain name. Through the above scheme, the temporal and spatial context information of the domain name features can be fully aggregated, the progressive optimization of the multi-stage network for the domain name character feature extraction is stabilized, and the performance of the classification task is improved, so that the DGA malicious domain name can be efficiently and accurately detected.

[0057] In some embodiments of the present specification, the shallow feature extractor is configured to perform multiple dilated convolutions on the input features respectively, concatenate the output features in the channel dimension, and then perform channel compression on the features through a convolution layer, and finally input the compressed features into the SE channel attention module to obtain the final output result.

[0058] In the present embodiment, the shallow feature extractor is a multi-scale dilated fusion attention module. The multi-scale dilated fusion attention module first performs multiple dilated convolutions on the input features respectively, concatenates the output features in the channel dimension, and then performs channel compression on the features through a convolution layer with a kernel size of 1, and finally inputs the compressed features into the SE channel attention module to obtain the final output result. The dilated convolution can obtain a larger receptive field under the condition that the parameter amount is unchanged. Through multiple dilated convolutions, a larger convolution receptive field can be obtained, and more context information can be obtained while reducing the training burden by fusing domain name character features of different scales. By means of residual connection, the long-distance transmission of features is ensured, the convergence speed of the model is improved, and the channel attention mechanism is used to suppress the interference of irrelevant channels in the domain name character feature extraction process, and the feature channel information is adaptively used to realize effective flow of information.

[0059] In some embodiments of the present specification, the multiple dilated convolutions correspond to different dilation rates. The dilation rate determines the interval of the convolution kernel when sampling. A larger dilation rate can allow the convolution kernel to span a larger area, thereby expanding the receptive field. Multiple dilated convolutions with different dilation rates can perform multi-scale dilated convolutions, thereby obtaining different convolution receptive fields, fusing domain name character features of different scales, and obtaining more context information while reducing the training burden.

[0060] In some embodiments of the present specification, the input of the long short-term memory network includes the feature information extracted by the shallow feature extractor in the current stage and the hidden state information retained by the long short-term memory network in the previous stage.

[0061] In the present embodiment, the cross-stage feature propagation mechanism based on the long short-term memory network can enable the shallow domain name character feature information and the deep feature information in each stage to be propagated in the network for a long distance. The long short-term memory network models the long-term dependency between the shallow feature information in the early stage and the late stage, and stabilizes the progressive optimization of the multi-stage network for domain name character feature extraction. The long short-term memory network includes three gating units, namely, an input gate, a forget gate, and an output gate. Assuming that the current stage is t, the input is x t , the output of the previous stage is h t-1 , the memory cell state of the current stage is c t , and the output is h t . The input of the long short-term memory network includes the feature information extracted by the shallow network in the current stage and the hidden state information retained by the long short-term memory network in the previous stage. Based on the above input information, the input gate in the long short-term memory network selectively retains the current cell state information and passes it to the next stage, while the output gate updates the current cell state information, which enables the feature information to flow for a long distance and effectively accumulate the feature information stage by stage.

[0062] In some embodiments of the present specification, the cache Restormer module based on the self-attention mechanism includes a multi-head cache attention module and a gated feedforward network; the multi-head cache attention module is used for self-attention calculation and cache attention calculation on the input feature; and the gated feedforward network is used for allowing useful information to be further transmitted in the network hierarchy. In the present embodiment, the cache Restormer module based on the self-attention mechanism is composed of a multi-head cache attention module and a gated feedforward network. The multi-head cache attention module mainly includes self-attention calculation and cache attention calculation. The introduction of the cache Restormer module helps to fully capture the global nature of the domain name features, the cache mechanism helps to effectively learn the long-term representation of the domain name features, establishes the spatiotemporal dependency between the domain name characters, and thus improves the accuracy of classification and prediction.

[0063] In some embodiments of the present specification, the output result of the multi-head cache attention module is:

[0064] X = σ (λ) × X mem + (1-σ (λ)) × X self ;

[0065] wherein X is the output result of the multi-head cache attention module, X self and X memrespectively, is a self-attention calculation result of input features and a cache attention calculation result, σ(·) is a Sigmoid activation function, and λ is a learning parameter for balancing the self-attention calculation result and the cache attention calculation result.

[0066] In some embodiments of the present specification, during the process of training the preset network model by using the training sample set, a Focal Loss loss function is adopted. In the present embodiment, due to the significant difference in the number of domain names of each DGA family, the problem of domain name data imbalance in the data set occurs. In order to solve this problem, the original cross-entropy loss function is improved, and the Focal Loss loss function is introduced.

[0067] In some embodiments of the present specification, during the process of training the preset network model by using the training sample set, accuracy, precision, recall and F1 score are used as evaluation indexes. In the present embodiment, the accuracy represents the ratio of the number of correctly classified samples to the total number of samples, the precision refers to the ratio of the number of samples correctly predicted as malicious to the number of all samples predicted as malicious by the model, the recall refers to the ratio of the number of samples correctly predicted as malicious to the number of all actual malicious samples, and the F1 score is the harmonic mean of precision and recall, which is used to comprehensively consider both.

[0068] In some embodiments of the present specification, the method further comprises: obtaining target domain name data; preprocessing the target domain name data to obtain preprocessed target domain name data; inputting the preprocessed target domain name data into the target detection model to obtain the category of the target domain name data, so as to determine whether the target domain name data is a DGA malicious domain name. Through the above manner, the target detection model can be used to detect the DGA malicious domain name.

[0069] Each of the embodiments in the present specification adopts a progressive manner for description, and the same or similar parts between the embodiments can be mutually referred to. Each embodiment mainly describes the difference from other embodiments. Specifically, the description of the related embodiments of the foregoing related processing can be referred to, which will not be repeated here.

[0070] The above describes specific embodiments of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in an order different than the order in the embodiments and still achieve the desired result. In addition, the processes depicted in the figures do not necessarily require the particular order shown or sequential order to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous or possible.

[0071] The above method will be described below in combination with a specific embodiment, however, it is worth noting that the specific embodiment is only for better illustrating the present specification and does not constitute an improper limitation on the present specification.

[0072] The data set of domain names is composed of two parts of data, i.e., a benign domain name data set and a DGA malicious domain name data set, and the present method adopts an open source domain name data set to train the network model. The open source data set of benign domain names is from the top 50,000 domain names in Alexa website access, and the malicious domain name data set is from the DGA domain name data disclosed by 360Netlab website, which contains more than 50 families of DGA data, from which 40 sample sufficient DGA domain name families are selected as the DGA malicious domain name data set. After the data set is randomly extracted in the ratio of 8:1:1, the training set, the verification set and the test set are set respectively.

[0073] The domain name data set is processed, first, the top-level domain name of the domain name sample is truncated, and only the second-level domain name is reserved. Then, all the capital letters in the domain name data are converted to lowercase.

[0074] For each domain name in the domain name data set, Bigram segmentation operation is performed to construct a corpus. Word Embedding technology is adopted to vectorize the word sequence.

[0075] The progressive self-attention network model proposed in the present embodiment is as shown in Figure 2 The model is mainly composed of three parts of word embedding layer, feature extraction layer and prediction input layer. With the domain name sample as the original input, first, the word sequence is vectorized by Word Embedding to obtain the word vector. Then, the feature extraction layer performs multi-stage feature extraction on the word vector. In the iteration process, the output result of the previous stage is taken as the input of the next stage, the module is optimized for T stages, and the module composition of each stage is the same and the parameters are shared. In this way, the parameter amount required for training the model and the complexity of the model are reduced.

[0076] Suppose the current stage is stage t, then the feature F t+1 extracted in this stage can be represented as:

[0077]

[0078] where F t is the feature input of the current stage, represents the feature extraction layer module, and Wtis the weight parameter to be learned by the feature extraction layer.

[0079] In the feature extraction layer, the word vector is first extracted by a shallow feature extractor composed of a multiscale dilated aggregation channel attention block to preliminarily extract the shallow feature representation of the input word vector. Then the shallow feature representation is passed to the next layer of long short-term memory (LSTM). This layer is used to establish the shallow feature information in the early stage and the long-term dependence relationship in the later stage, realize the cross-stage flow of feature information, and gradually optimize the feature representation. Then the cached Restormer module based on the self-attention mechanism is used to fully capture the global nature of the domain name features and establish the dependence relationship between the domain name characters.

[0080] As shown in Figure 2 , the feature extraction layer extracts the feature representation of the deep domain name characters through multi-stage iteration (recurrent), which is input into the prediction output layer to predict the classification result of the domain name. The prediction output layer first flattens the extracted deep domain name character feature representation into a one-dimensional vector through the Flatten layer, then uses the Dropout layer to discard the feature representation according to a certain probability to prevent overfitting and improve the generalization ability of the model, and finally the feature is linearly operated through the Linear layer, and the output probability y is obtained using the Softmax function for prediction.

[0081] As shown in Figure 3 , the module first performs multiple dilated convolutions on the input features, and then concatenates the output features in the channel dimension. Then a convolution layer Conv with a kernel size of 1 is used for channel compression, and finally the compressed features are input into the SE channel attention module to obtain the final output result. The SE channel includes a GAP (Global Average Pooling) layer and two convolution layers (Conv 1x1 Relu and Conv 1x1 Sigmoid)

[0082] Dilated convolution can obtain a larger receptive field without increasing the number of parameters. Through multi-scale dilated convolution, a larger and different convolution receptive field can be obtained, and more context information can be obtained while reducing the training burden by fusing domain name character features of different scales. With the help of residual connection, the long-distance transmission of features is ensured, the convergence speed of the model is improved, and the channel attention mechanism is used to suppress irrelevant channel interference in the domain name character feature extraction process, adaptively use feature channel information, and realize effective flow of information. The output F out can be represented as:

[0083] F out = SE(Conv 1x1 (Cat[δ(Conv K3D1 (F in )),δ(Conv K3D3 (F in )),δ(Conv K3D5 (F in ))]))+F in (1)

[0084] where F in is the input feature map, Conv KxDy (·) is a convolutional layer with kernel size x and dilation size y, δ is the Relu activation function, Cat[·] is the channel dimension concatenation operation, and SE is the squeeze-and-excitation module.

[0085] The cross-stage feature propagation mechanism based on the long short-term memory network (LSTM) can enable the shallow domain name character feature information and deep feature information of each stage to be propagated in the network over a long distance. The long-term dependency relationship between the shallow feature information of the early stage and the later stage is modeled, and the progressive optimization of the multi-stage network for domain name character feature extraction is stabilized.

[0086] The LSTM unit includes three gating units, namely, an input gate, a forget gate, and an output gate. Assuming that the current stage is t, the input is x t , the output of the previous stage is h t-1 , the memory cell state of the current stage is c t , and the output is h t . The calculation of the LSTM unit is as follows:

[0087] First, the calculation of the forget gate is as follows:

[0088] f t = σ(W f ·[h t-1 ,x t ]+b f ) (2)

[0089] where σ(·) is the Sigmoid activation function, W f and b f are the weight parameters and bias parameters of the forget gate, respectively. The forget gate is used to control whether the memory state c t-1 of the previous stage needs to be retained or forgotten information.

[0090] The calculation of the input gate is as follows:

[0091] i t = σ(Wi ·[h t-1 ,x t ]+b i ) (3)

[0092]

[0093] where tanh is a Tanh activation function, W i , b i , and W c , b c are weight parameters of the input gate and the memory cell, is the candidate memory cell state at the current time. The input gate is used to determine the update of the memory state at the current time.

[0094] The calculation of the output gate, whose expression is as follows:

[0095] o t =σ(W o ·[h t-1 ,x t ]+b o ) (5)

[0096] h t =o t ·tanh(c t ) (6)

[0097] where W o , b o are weight parameters of the output gate. The output gate is used to determine the output of the memory cell at the current time.

[0098] The input of the LSTM layer includes the feature information extracted by the shallow network at the current stage and the hidden state information retained by the LSTM layer in the last stage. Based on the above input information, the input gate in the LSTM layer selectively retains the current cell state information and transmits it to the next stage, and the output gate updates the current cell state information, which enables the feature information to flow long distances and effectively accumulate the feature information stage by stage.

[0099] The cache Restormer module based on the self-attention mechanism is composed of a multi-head cache attention module (MCTA) and a gated feed-forward network (GDFN). The multi-head cache attention module (MCTA) mainly includes self-attention calculation and cache attention calculation. The introduction of the cache Restormer module helps to fully capture the global nature of domain name features, the cache mechanism helps to effectively learn long-term representations of domain name features, establishes the spatio-temporal dependency relationship between domain name characters, and thus improves the accuracy of classification prediction.

[0100] The multi-head cache attention module can be represented as:

[0101] X=σ(λ)*X mem +(1-σ(λ))*X self (7)

[0102] Where X self and X mem These are the computation results of self-attention and cached attention, respectively. σ(·) is the Sigmoid activation function, and λ is a learnable parameter used to balance the computation results of self-attention and cached attention.

[0103] For the self-attention calculation in the multi-head caching attention module, the input domain name feature F is first transformed linearly to obtain the query matrix Q, the key matrix K, and the value matrix V, as shown in the following formula.

[0104]

[0105]

[0106]

[0107] Where F is the input feature map, Conv 1x1 (·) and Conv 3x3 (·) represent convolutional layers with kernel sizes of 1 and 3, respectively, and LN(·) represents the layer normalization operation.

[0108] Then the output X of the self-attention calculation self It can be represented as:

[0109] X self =Conv 1x1 (Attention(Q,K,V))+F (11)

[0110] Attention(Q,K,V)=V·Softmax(K·Q / α) (12)

[0111] Here, α is a learnable weight parameter used to control the size of the dot product of K and Q, avoiding an excessively large matrix after the inner product. Attention(·) is the self-attention calculation operation, and Softmax(·) represents the Sofrmax activation function.

[0112] like Figure 4 As shown, for the cache attention calculation in the multi-head cache attention module, the input domain name feature vector F is first split along the channel dimension, and then a portion is selected as the feature vector input for the information to be cached. For convenience of calculation, the number of channels is usually selected as The gated recurrent unit (GRU) is introduced to complete the long-term feature representation learning (updates) of Two key gating mechanisms, update gate and reset gate, are introduced in the gated recurrent unit to better control the flow and preservation of information. The cache state h in the gated recurrent unit will accumulate the effective information in the historical sampling process.

[0113] Assuming that the current is the t stage, the input is The hidden state of the previous stage is h t-1 The update process of the gated recurrent unit can be represented as follows.

[0114] The update gate z t The calculation can be represented as:

[0115]

[0116] The reset gate r t The calculation can be represented as:

[0117]

[0118] The candidate memory The calculation can be represented as:

[0119]

[0120] The hidden state h t The update can be represented as:

[0121]

[0122] Where σ(·) is the Sigmoid activation function, [·,·] is the channel concatenation operation, W z , W r , W h are the weight matrices corresponding to the update gate, the reset gate and the candidate memory respectively.

[0123] After the gated recurrent unit is updated, the and h t are obtained at the current time step t. After linear transformation, the query matrix Q, the key matrix K and the value matrix V are obtained, and their formulas are as follows:

[0124]

[0125]

[0126]

[0127] The output X of the cache attention computation mem may be represented as:

[0128]

[0129]

[0130] As shown in Figure 4 , for the gated feed-forward network part, the computation process can be represented as:

[0131]

[0132]

[0133] where F is the domain name feature vector, represents the GELU nonlinear activation function, LN(·) represents the layer normalization operation, ⊙ represents the pixel-by-pixel multiplication operation, and Conv(·) is the convolution operation.

[0134] Due to the significant difference in the number of domain names in each DGA family, the data set has the problem of domain name data imbalance. To solve this problem, we improved the original cross-entropy loss function and introduced the Focal Loss loss function.

[0135] Focal Loss reduces the weight of simple class samples that account for a large proportion of the overall loss, making the model more focused on difficult-to-classify samples. This adjustment helps the classifier pay more attention to difficult classes when calculating the iterative loss, thereby improving the model's performance in the face of class imbalance. The specific calculation formula of Focal Loss is as follows:

[0136]

[0137] where y is the true value of the sample, y' is the predicted result value output by the network model, α is used to adjust the proportion of positive and negative samples imbalance, and γ is used to make the model pay more attention to difficult-to-detect samples. The greater γ is, the smaller the loss weight of simple samples is, and the greater the loss weight of difficult samples is.

[0138] The evaluation index of DGA domain name detection is an important standard for measuring the performance and accuracy of the model. This method uses accuracy (Accuracy), precision (Precision), recall (Recall), and F1 score (F1-score) as evaluation indexes.

[0139] The calculation formula is as follows:

[0140]

[0141] Wherein, TP (True Positive) refers to the positive examples correctly identified by the model, FN (False Negative) indicates the positive examples incorrectly identified by the model, FP (False Positive) refers to the negative examples incorrectly identified as positive examples by the model, and TN (True Negative) indicates the negative examples correctly identified by the model.

[0142] The accuracy represents the ratio of the correctly classified sample number to the total sample number, the precision refers to the ratio of the sample number correctly predicted as malicious by the model to the sample number predicted as malicious by the model, the recall refers to the ratio of the sample number correctly predicted as malicious by the model to the total number of actual malicious samples, and the F1 score is the harmonic mean of the precision and the recall, which is used to comprehensively consider both.

[0143] In the above embodiment, a multi-stage shared structure and parameter model is adopted, which reduces the complexity of the model and the number of parameters required by the model to be trained, and improves the real-time response speed of the model. Based on the long short-term memory network (LSTM), a cross-stage feature propagation mechanism and a cache Restormer module based on the self-attention mechanism are designed to fully aggregate the spatio-temporal context information of the domain name features, stabilize the progressive optimization of the multi-stage network for domain name character feature extraction, and improve the performance of the classification task. The Focal loss loss function is introduced to alleviate the data imbalance problem of the domain name dataset.

[0144] Based on the same inventive concept, the DGA domain name detection device is also provided in the embodiments of the present specification, as described in the following embodiments. Since the principle of solving the problem of the DGA domain name detection device is similar to that of the DGA domain name detection method, the implementation of the DGA domain name detection device can be referred to the implementation of the DGA domain name detection method, and the repeated parts will not be described again. The term "unit" or "module" used below can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware or a combination of software and hardware is also possible and is conceived. Figure 5 is a structural block diagram of the DGA domain name detection device of the embodiments of the present specification, as shown in Figure 5 The structure is described below.

[0145] The acquisition module 501 is configured to acquire a domain name dataset; pre-process the domain name samples in the domain name dataset, and construct a training sample set based on the pre-processed domain name dataset; the domain name dataset includes benign domain name samples and DGA malicious domain name samples.

[0146] The training module 502 is configured to train a preset network model by using the training sample set to obtain a target detection model; the target detection model is configured to identify a DGA malicious domain name.

[0147] The target detection model comprises a word embedding layer, a feature extraction layer and a prediction output layer. The word embedding layer is configured to vectorize the preprocessed domain name sample data to obtain corresponding word vectors. The feature extraction layer comprises a shallow feature extractor, a long short-term memory network and a cache Restormer module based on a self-attention mechanism. The shallow feature extractor is configured to extract shallow features of the word vectors and transmit the shallow features to the long short-term memory network. The long short-term memory network is configured to establish a long-term dependency relationship between early-stage shallow feature information and a later stage. The cache Restormer module based on the self-attention mechanism is configured to capture global information of domain name features to establish a dependency relationship between domain name characters. The prediction output layer is configured to output a classification result of the domain name.

[0148] In some embodiments of the present specification, the acquisition module is specifically configured to truncate the top-level domain name of the domain name sample in the domain name data set and retain the second-level domain name to obtain truncated domain name data; and perform a word segmentation operation on the truncated domain name data to obtain segmented domain name data.

[0149] In some embodiments of the present specification, the shallow feature extractor is configured to perform multiple dilation convolutions on the input features respectively, concatenate the output features in the channel dimension, then compress the features in the channel dimension through a convolution layer, and finally input the compressed features into an SE channel attention module to obtain a final output result.

[0150] In some embodiments of the present specification, the multiple dilation convolutions correspond to different dilation rates.

[0151] In some embodiments of the present specification, the input of the long short-term memory network comprises feature information extracted by the shallow feature extractor in the current stage and hidden state information retained by the long short-term memory network in the last stage.

[0152] In some embodiments of the present specification, the cache Restormer module based on the self-attention mechanism comprises a multi-head cache attention module and a gated feed-forward network. The multi-head cache attention module is configured to perform self-attention calculation and cache attention calculation on the input features. The gated feed-forward network is configured to allow useful information to be further transmitted in the network hierarchy.

[0153] In some embodiments of the present specification, the output result of the multi-head cache attention module is:

[0154] X=σ(λ)×Xmem + (1 - σ(λ)) x X self ;

[0155] wherein X is an output result of the multi-head cache attention module, X self and X mem are respectively a calculation result of self-attention calculation and a calculation result of cache attention calculation on the input feature, σ(·) is a Sigmoid activation function, and λ is a learning parameter for balancing the calculation result of the self-attention calculation and the calculation result of the cache attention calculation.

[0156] In some embodiments of the present specification, a Focal Loss loss function is used in the process of training the preset network model by using the training sample set.

[0157] In some embodiments of the present specification, accuracy, precision, recall and F1 score are used as evaluation indexes in the process of training the preset network model by using the training sample set.

[0158] In some embodiments of the present specification, the device further comprises a detection module, which is specifically configured to: obtain target domain name data; pre-process the target domain name data to obtain pre-processed target domain name data; input the pre-processed target domain name data into the target detection model to obtain a category of the target domain name data, so as to determine whether the target domain name data is a DGA malicious domain name.

[0159] From the above description, it can be seen that the embodiments of the present specification achieve the following technical effects: in the feature extraction layer, the word vector is first preliminarily extracted by the shallow feature extractor to extract the shallow feature representation of the input word vector, and then the shallow feature representation is transmitted to the next long short-term memory layer, which is used to establish the shallow feature information in the early stage and the long-term dependency relationship in the later stage, realize the cross-stage flow of feature information, and gradually optimize the feature representation, and then the cache Restormer module based on the self-attention mechanism is used to fully capture the global nature of the domain name feature and establish the dependency relationship between the domain name characters. The feature extraction layer extracts the feature representation of the deep domain name characters through multi-stage iteration, and the feature representation is input into the prediction output layer to predict the classification result of the domain name. Through the above scheme, the temporal and spatial context information of the domain name feature can be fully aggregated, the progressive optimization of the multi-stage network for the domain name character feature extraction is stabilized, and the performance of the classification task is improved, so that the DGA malicious domain name can be efficiently and accurately detected.

[0160] The present specification also provides a computer device, which can be specifically referred to Figure 6An apparatus for implementing the DGA domain name detection method provided by the embodiments of the present application is shown in FIG. 1. The apparatus can include an input device 61, a processor 62, and a memory 63. The memory 63 is configured to store processor-executable instructions. The processor 62 executes the instructions to implement the steps of the DGA domain name detection method described in any of the embodiments.

[0161] In the embodiments, the input device can be one of the main devices for exchanging information between a user and a computer system. The input device can include a keyboard, a mouse, a camera, a scanner, a light pen, a handwriting input board, a voice input device, etc. The input device is configured to input raw data and programs for processing the data into the computer. The input device can also acquire data transmitted by other modules, units, or devices. The processor can be implemented in any appropriate manner. For example, the processor can take the form of a microprocessor or a processor and a computer readable medium storing computer readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, etc. The memory can be a memory device for storing information in modern information technology. The memory can include multiple levels, and in a digital system, as long as it can store binary data, it can be a memory; in an integrated circuit, a circuit without a physical form and with a storage function is also called a memory, such as RAM, FIFO, etc.; in a system, a storage device with a physical form is also called a memory, such as a memory stick, a TF card, etc.

[0162] In the embodiments, the functions and effects of the computer device can be explained in comparison with other embodiments, and thus will not be described here.

[0163] The embodiments of the present application also provide a computer storage medium for implementing the DGA domain name detection method. The computer storage medium stores computer program instructions. When the computer program instructions are executed by a processor, the steps of the DGA domain name detection method described in any of the embodiments are implemented.

[0164] In the present embodiment, the storage medium includes, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a cache, a hard disk drive (HDD), or a memory card. The storage medium can be used to store computer program instructions. The network communication unit can be an interface configured according to a standard specified by a communication protocol, and used for network connection communication.

[0165] In the present embodiment, the functions and effects realized by the program instructions stored in the computer storage medium can be explained in comparison with other embodiments, and will not be described here.

[0166] The embodiments of the present specification also provide a computer program product, comprising computer programs / instructions, which, when executed by a processor, implement the steps of the application deployment method based on a low-code platform in any of the above embodiments.

[0167] Obviously, those skilled in the art should understand that each module or each step of the above-described embodiments of the present specification can be realized by a general computing device, which can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be realized by program codes executable by a computing device, so that they can be stored in a storage device and executed by a computing device, and in some cases, the steps shown or described can be executed in an order different from here, or they can be manufactured into individual integrated circuit modules, or multiple modules or steps among them can be manufactured into a single integrated circuit module. Thus, the embodiments of the present specification are not limited to any particular combination of hardware and software.

[0168] It should be understood that the above description is intended for illustration only and not for limitation. Many implementations and many applications other than the examples provided would be apparent to those skilled in the art from the above description. The scope of the present specification should therefore not be determined with reference to the above description, but instead should be determined with reference to the appended claims along with their full scope of equivalents.

[0169] The above only describes the preferred embodiments of the present specification and is not intended to limit the present specification. The embodiments of the present specification can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the protection scope of the present specification.

Claims

1. A method for detecting DGA domain names, characterized in that, The method comprises the following steps: obtaining a domain name data set; preprocessing domain name samples in the domain name data set, and constructing a training sample set based on the preprocessed domain name data set; the domain name data set comprises benign domain name samples and DGA malicious domain name samples; training a preset network model using the training sample set to obtain a target detection model; the target detection model is used to identify DGA malicious domain names; wherein, the target detection model comprises a word embedding layer, a feature extraction layer and a prediction output layer; the word embedding layer is used to vectorize the preprocessed domain name sample data to obtain corresponding word vectors; the feature extraction layer comprises a shallow feature extractor, a long short-term memory network and a cache Restormer module based on a self-attention mechanism; the shallow feature extractor is used to extract shallow features of the word vectors and pass the shallow features to the long short-term memory network; the long short-term memory network is used to establish the shallow feature information in the early stage and the long-term dependency relationship in the later stage; the cache Restormer module based on the self-attention mechanism is used to capture the global information of the domain name features to establish the dependency relationship between the characters of the domain name; and the prediction output layer is used to output the classification result of the domain name; wherein, the cache Restormer module based on the self-attention mechanism comprises a multi-head cache attention module and a gated feed-forward network; the multi-head cache attention module is used to perform self-attention calculation and cache attention calculation on the input features; and the gated feed-forward network is used to allow useful information to be further transmitted in the network hierarchy; the output result of the multi-head cache attention module is: X = σ(λ) x X mem + (1 - σ(λ)) x X self ; wherein X is an output result of the multi-head cache attention module, X self and X mem are respectively a calculation result of self-attention calculation and cache attention calculation on input features, σ(·) is a Sigmoid activation function, and λ is a learning parameter for balancing the calculation result of the self-attention calculation and the calculation result of the cache attention calculation.

2. The method of claim 1, wherein the DGA domain detection method is characterized by, the preprocessing of the domain name samples in the domain name data set comprises: truncating the top-level domain name of the domain name samples in the domain name data set and retaining the second-level domain name to obtain truncated domain name data; performing a word segmentation operation on the truncated domain name data to obtain segmented domain name data.

3. The method of claim 1, wherein the DGA domain detection method is characterized by, The shallow feature extractor is used to perform multiple dilation convolutions on the input features respectively, concatenate the output features in the channel dimension, then perform channel compression on the features through a convolution layer, and finally input the compressed features into an SE channel attention module to obtain the final output result.

4. The method of claim 3, wherein the DGA domain detection method is further characterized by, The multiple dilation convolutions have different dilation rates.

5. The method of claim 1, wherein the DGA domain detection method is further characterized by, The input of the long short-term memory network comprises feature information extracted by the shallow feature extractor in the current stage and hidden state information retained by the long short-term memory network in the previous stage.

6. The method of claim 1, wherein the DGA domain detection method is further characterized by, In the process of training the preset network model using the training sample set, a Focal Loss loss function is used.

7. The method of claim 1, wherein the DGA domain detection method is further characterized by, In the process of training the preset network model using the training sample set, accuracy, precision, recall and F1 score are used as evaluation indexes.

8. The method of claim 1, wherein the DGA domain detection is performed by a domain name system (DNS) server. The method further comprises the following steps: obtaining target domain name data; preprocessing the target domain name data to obtain preprocessed target domain name data; inputting the preprocessed target domain name data into the target detection model to obtain the category of the target domain name data, so as to determine whether the target domain name data is a DGA malicious domain name.

9. A DGA domain name detection apparatus, characterized by, The method comprises the following steps: An acquisition module is configured to acquire a domain name dataset; The domain name samples in the domain name dataset are preprocessed, and a training sample set is constructed based on the preprocessed domain name dataset; The domain name dataset includes benign domain name samples and DGA malicious domain name samples; A training module is configured to train a preset network model using the training sample set to obtain a target detection model; the target detection model is configured to identify DGA malicious domain names; The target detection model includes a word embedding layer, a feature extraction layer, and a prediction output layer; the word embedding layer is configured to vectorize the preprocessed domain name sample data to obtain corresponding word vectors; the feature extraction layer includes a shallow feature extractor, a long short-term memory network, and a cache Restormer module based on a self-attention mechanism; the shallow feature extractor is configured to extract shallow features of the word vectors and pass the shallow features to the long short-term memory network; the long short-term memory network is configured to establish a long-term dependency relationship between early-stage shallow feature information and late-stage information; the cache Restormer module based on the self-attention mechanism is configured to capture global information of domain name features to establish a dependency relationship between domain name characters; and the prediction output layer is configured to output a classification result of the domain name. The cache Restormer module based on the self-attention mechanism includes a multi-head cache attention module and a gated feed-forward network; the multi-head cache attention module is configured to perform self-attention calculation and cache attention calculation on input features; and the gated feed-forward network is configured to allow useful information to be further transmitted in a network hierarchy. The output result of the multi-head cache attention module is: X = σ(λ) x X mem + (1 - σ(λ)) x X self ; wherein X is an output result of the multi-head cache attention module, X self and X mem are respectively a calculation result of self-attention calculation and cache attention calculation on input features, σ(·) is a Sigmoid activation function, and λ is a learning parameter for balancing the calculation result of the self-attention calculation and the calculation result of the cache attention calculation.

10. A computer device, comprising: A processor and a memory for storing processor-executable instructions are included; when the processor executes the instructions, the steps of the method in any one of claims 1 to 8 are implemented.

11. A computer readable storage medium having stored thereon computer instructions, wherein, When the instructions are executed by the processor, the steps of the method in any one of claims 1 to 8 are implemented.

12. A computer program product comprising computer programs / instructions, characterized in that, When the computer program / instructions are executed by the processor, the steps of the method in any one of claims 1 to 8 are implemented.

Images