Dga domain name detection method and device, electronic equipment and storage medium

Abstract

The application provides a DGA domain name detection method and device, electronic equipment and a storage medium, and relates to the technical field of computers. The DGA domain name detection method comprises the following steps: obtaining a domain name to be detected; inputting the domain name to be detected into a pre-trained DGA domain name detection model to obtain a first probability that the domain name to be detected is a DGA domain name; determining whether the domain name to be detected satisfies a preset DGA domain name structure rule to obtain a first initial detection result; and / or, based on the domain name to be detected and a preset domain name whitelist, obtaining a second initial detection result representing whether the domain name to be detected exists in the domain name whitelist; and based on the first probability that the domain name to be detected is a DGA domain name, the first initial detection result and / or the second initial detection result, obtaining a final detection result representing a second probability that the domain name to be detected is a DGA domain name. The scheme can detect the domain name to be detected from multiple dimensions and more comprehensively, so that the DGA domain name can be detected more accurately.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, in particular to a DGA domain name detection method and device, electronic equipment and a storage medium. BACKGROUND

[0002] In the field of network security, attackers often use domain names to connect malicious programs to remote command and control servers, so as to achieve the purpose of manipulating victim machines. At present, attackers can use domain name generation algorithm (DGA) to generate a large number of pseudo-random or seemingly regular domain names, and encode these generated domain names into malicious software. The current traditional malicious domain name defense strategy is realized by setting a blacklist list, but the DGA domain name generated based on the domain name generation algorithm can effectively avoid the detection of the blacklist list, therefore, it is necessary to accurately detect the DGA domain name, so as to facilitate the discovery of malicious software and risk warning. SUMMARY

[0003] The present application provides a DGA domain name detection method, device, electronic equipment and storage medium to improve the accuracy of detecting DGA domain names.

[0004] In a first aspect, the present application provides a DGA domain name detection method, comprising: obtaining a domain name to be detected; inputting the domain name to be detected into a pre-trained DGA domain name detection model to obtain a first probability that the domain name to be detected is a DGA domain name; determining whether the domain name to be detected satisfies a preset DGA domain name structure rule to obtain a first initial detection result; and / or, based on the domain name to be detected and a preset domain name whitelist, obtaining a second initial detection result representing whether the domain name to be detected exists in the domain name whitelist; based on the first probability that the domain name to be detected is a DGA domain name, the first initial detection result and / or the second initial detection result, obtaining a final detection result representing a second probability that the domain name to be detected is a DGA domain name.

[0005] In the present application, the first probability that the domain name to be detected is a DGA domain name is combined with the first initial detection result and / or the second initial detection result to obtain the final detection result. Since the final detection result is obtained based on multiple dimensions of detection, the DGA domain name detection model has a relatively general detection capability, the DGA domain name structure rule can detect the DGA domain name from the characteristics of the domain name itself, and the domain name whitelist can use known non-DGA domain name information, so compared with the prior art, the present application can more comprehensively detect the domain name to be detected from multiple dimensions, thereby more accurately detecting the DGA domain name.

[0006] In some possible implementation manners, the DGA domain name structure rule comprises a subdomain name length rule and / or a target domain name rule, the target domain name rule comprises a composition format of at least one non-DGA domain name, the determining whether the domain name to be detected satisfies the preset DGA domain name structure rule to obtain a first initial detection result comprises: matching a length of a subdomain name of the domain name to be detected with the subdomain name length rule to obtain a first matching result; and / or matching a composition format of the domain name to be detected with the target domain name rule to obtain a second matching result; and the first initial detection result is obtained based on the first matching result and / or the second matching result.

[0007] In the embodiments of the present application, since the length of the subdomain name of the DGA domain name is usually different from the length of the subdomain name of the normal domain name, the domain name to be detected can be detected by the subdomain name length rule. Meanwhile, since the composition format of some domain names (such as government domain names, educational institution domain names, etc.) has a special rule, and such domain names are usually not DGA domain names, the domain name to be detected can be detected based on the target domain name rule. Therefore, the domain name to be detected is detected by the subdomain name length rule and / or the target domain name rule, so that the domain name to be detected is detected from the dimension of the domain name structure. Thus, the first initial detection result can reflect whether the domain name to be detected is a DGA domain name from the dimension of the domain name structure.

[0008] In some possible implementation manners, the DGA domain name structure rule comprises a subdomain name length rule, a target domain name rule, the target domain name rule comprises a composition format of at least one non-DGA domain name, the determining whether the domain name to be detected satisfies the preset DGA domain name structure rule to obtain a first initial detection result comprises: matching the composition format of the domain name to be detected with the target domain name rule; and in a case where the composition format of the domain name to be detected does not match the composition format of any one of the non-DGA domain names in the target domain name rule, matching a length of a subdomain name of the domain name to be detected with the subdomain name length rule to obtain the first initial detection result.

[0009] In the embodiments of the present application, the target domain name rule can accurately determine whether the domain name to be detected is a non-DGA domain name. Therefore, whether the composition format of the domain name to be detected matches the target domain name rule is determined first, and in a case where the composition format does not match the target domain name rule, whether the length of the subdomain name of the domain name to be detected matches the subdomain name length rule is determined. In a case where the composition format of the domain name to be detected matches the target domain name rule, the first initial detection result can be directly obtained, and it is not necessary to match the length of the subdomain name of the domain name to be detected with the subdomain name length rule, thereby reducing the calculation amount of obtaining the first initial detection result.

[0010] In some possible implementation manners, the domain name whitelist comprises a dynamic domain name whitelist and / or a static domain name whitelist, wherein the domain names in the dynamic domain name whitelist are obtained based on log data of a user, and the static domain name whitelist is obtained based on network data; obtaining a second initial detection result indicating whether the to-be-detected domain name exists in the domain name whitelist based on the to-be-detected domain name and the preset domain name whitelist comprises: determining whether the to-be-detected domain name exists in the dynamic domain name whitelist to obtain a first determination result; and / or determining whether the to-be-detected domain name exists in the static domain name whitelist to obtain a second determination result; and obtaining the second initial detection result based on the first determination result and / or the second determination result.

[0011] In the embodiments of the present application, the domain name whitelist comprises at least one non-DGA domain name, and therefore, the to-be-detected domain name can be detected based on the domain name whitelist to obtain a second initial detection result. The domain name whitelist can comprise a dynamic domain name whitelist and / or a static domain name whitelist, and the data sources of the dynamic domain name whitelist and the static domain name whitelist are different. In actual application, the whitelist of different data sources can be set according to actual requirements, so that the present solution can be more suitable for user requirements. Moreover, if the dynamic domain name whitelist and the static domain name whitelist are used for detection at the same time, the to-be-detected domain name can be detected based on more comprehensive domain name whitelist, and the accuracy of the second initial detection result obtained finally can be improved.

[0012] In some possible implementation manners, the generation process of the dynamic domain name whitelist comprises: obtaining log data of a user; obtaining a space-time feature of each domain name appearing in the log data based on the log data; determining whether the domain name is a DGA domain name based on the space-time feature of the domain name; and generating the dynamic domain name whitelist based on all domain names in the log data that do not belong to the DGA domain name.

[0013] In the embodiments of the present application, all domain names in the log data that do not belong to the DGA domain name are screened out based on the space-time feature of each domain name appearing in the log data, so as to obtain the dynamic domain name whitelist. Since the domain names in the dynamic domain name whitelist are obtained based on the space-time feature of each domain name appearing in the log data of the user, the dynamic domain name whitelist can be more suitable for the actual situation of the user, so as to improve the applicability of the dynamic domain name whitelist to the user, and improve the detection reliability of the non-DGA domain name with respect to the user.

[0014] With the technical solution provided in the first aspect above, in some possible implementation manners, after the dynamic domain name whitelist is generated, the method further includes: obtaining periodic log data generated by the user in a previous period according to a preset period; obtaining a space-time feature of each domain name appearing in the periodic log data based on the periodic log data; determining whether the domain name is a DGA domain name based on the space-time feature of each domain name; and adding a target domain name to the dynamic domain name whitelist, where the target domain name is a domain name that does not belong to a DGA domain name in the log data and does not exist in the dynamic domain name whitelist.

[0015] In the embodiments of the present application, the dynamic domain name whitelist is updated by periodic log data, so that the dynamic domain name whitelist can maintain the applicability to the user.

[0016] With the technical solution provided in the first aspect above, in some possible implementation manners, the space-time feature includes a domain name occurrence threshold and a domain name normal occurrence time distribution; and determining whether the domain name is a DGA domain name based on the space-time feature of each domain name includes: for each domain name appearing in the log data, determining whether the occurrence number of the domain name is greater than a preset domain name occurrence threshold to obtain a first initial determination result; determining whether the domain name occurrence time distribution of the domain name meets a preset domain name normal occurrence time distribution rule to obtain a second initial determination result; and determining whether the domain name is a DGA domain name based on the first initial determination result and the second initial determination result.

[0017] In the embodiments of the present application, since the occurrence number and occurrence time distribution rule of a malicious DGA domain name are different from those of a normal domain name, the domain names appearing in the log data can be determined by screening the domain names appearing in the log data by using the domain name occurrence threshold and the domain name normal occurrence time distribution included in the space-time feature, so that whether the domain names appearing in the log data are DGA domain names can be determined, thereby improving the reliability of the dynamic domain name whitelist constructed.

[0018] With the technical solution provided in the first aspect above, in some possible implementation manners, the method further includes: obtaining a secondary domain name of the domain name to be detected; and inputting the secondary domain name into the pre-trained DGA domain name detection model to obtain the first probability that the domain name to be detected is a DGA domain name.

[0019] In the embodiments of the application, the secondary domain name of the domain name can more intuitively reflect the difference between different domain names, and can also reduce the interference of the secondary domain name. Therefore, the secondary domain name is taken as the input data of the DGA domain name detection model, so that the difference between different input data can be improved, and the output result of the DGA domain name detection model can be more accurate.

[0020] In combination with the technical scheme provided by the first aspect, in some possible implementation manners, the pre-trained DGA domain name detection model comprises an embedding layer, a convolution network layer, a max-pooling layer, a long short-term memory recurrent network layer and a fully connected network layer connected in sequence.

[0021] In the embodiments of the application, the convolution network layer and the long short-term memory recurrent network layer are combined, so that the DGA domain name detection model can more accurately detect the DGA domain name, and the precision and recall rate of detection are improved.

[0022] In the second aspect, the application provides a DGA domain name detection device, comprising: an acquisition module and a processing module, the acquisition module is configured to acquire a domain name to be detected; the processing module is configured to input the domain name to be detected into a pre-trained DGA domain name detection model to obtain a first probability that the domain name to be detected is a DGA domain name; the processing module is further configured to determine whether the domain name to be detected satisfies a preset DGA domain name structure rule to obtain a first initial detection result; and / or, based on the domain name to be detected and a preset domain name whitelist, a second initial detection result representing whether the domain name to be detected exists in the domain name whitelist is obtained; and the processing module is further configured to obtain a final detection result representing a second probability that the domain name to be detected is a DGA domain name based on the first probability that the domain name to be detected is a DGA domain name, the first initial detection result and / or the second initial detection result.

[0023] In the third aspect, the application provides an electronic device, comprising: a memory and a processor, the memory and the processor are connected; the memory is configured to store a program; and the processor is configured to call the program stored in the memory to execute the method of the first aspect and / or any possible implementation manner in combination with the first aspect.

[0024] In the fourth aspect, the application provides a computer readable storage medium, which stores a computer program, and the computer program is run by a computer to execute the method of the first aspect and / or any possible implementation manner in combination with the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced as follows. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be regarded as a limitation on the scope, and for those of ordinary skill in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0026] Figure 1 A flow diagram of a DGA domain name detection method according to an embodiment of the present application is shown.

[0027] Figure 2 A structure block diagram of a DGA domain name detection model according to an embodiment of the present application is shown.

[0028] Figure 3 A structure block diagram of a DGA domain name detection device according to an embodiment of the present application is shown.

[0029] Figure 4 A structure block diagram of an electronic device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0030] The technical solutions of the embodiments of the present application will be described in detail below with reference to the drawings in the embodiments of the present application.

[0031] It should be noted that: similar reference numerals and letters represent similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of the present application, relationship terms such as "first", "second" and the like are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes elements inherent to such process, method, article or device.

[0032] The technical solutions of the present application will be described in detail below with reference to the drawings.

[0033] Please refer to Figure 1 , Figure 1 A DGA domain name detection method according to an embodiment of the present application will be described below. Figure 1 The steps contained therein will be described.

[0034] S100: Obtain a domain name to be detected.

[0035] The domain name to be detected can be pre-acquired and stored in a local storage medium, and directly called when needed. Alternatively, the domain name to be detected can be acquired in real time when detection is needed.

[0036] The plurality of domain names to be detected can be acquired simultaneously.

[0037] In one embodiment, after the domain name to be detected is acquired, it can be determined whether the domain name to be detected is a valid domain name. If the domain name to be detected is not a valid domain name, the domain name to be detected can be discarded. If the domain name to be detected is a valid domain name, subsequent operations of the DGA domain name detection method shown in the embodiments of the application can be performed.

[0038] The determination of whether the domain name to be detected is a valid domain name can be a determination of whether the domain name to be detected is an available domain name. If the domain name to be detected is an available domain name, it is determined that the domain name to be detected is a valid domain name.

[0039] The specific method for determining whether a domain name is an available domain name is known to those skilled in the art, and will not be described herein for brevity.

[0040] S200: inputting the domain name to be detected into a pre-trained DGA domain name detection model to obtain a first probability that the domain name to be detected is a DGA domain name.

[0041] In one embodiment, the entire domain name to be detected can be directly inputted into the pre-trained DGA domain name detection model to obtain the first probability that the domain name to be detected is a DGA domain name.

[0042] Alternatively, a secondary domain name of the domain name to be detected can be acquired first. Then the secondary domain name is inputted into the pre-trained DGA domain name detection model to obtain the first probability that the domain name to be detected is a DGA domain name.

[0043] The secondary domain name can more intuitively reflect the differences between different domain names and can reduce the interference of the secondary domain name. Therefore, the secondary domain name is used as the input of the DGA domain name detection model, so that the differences between different data can be improved, and the output result of the DGA domain name detection model can be more accurate.

[0044] The secondary domain name is a second-level domain name, and the concept of the secondary domain name is known to those skilled in the art, and will not be described herein for brevity.

[0045] In one embodiment, the DGA domain name detection model can be trained in the following manner: first, a training data set is acquired, and the training data set includes a plurality of training domain names marked with a representation of whether the training domain name is a DGA domain name. Then, the initial DGA domain name detection model is trained based on the training data set to obtain the trained DGA domain name detection model.

[0046] The specific principle and process of training the model are known to those skilled in the art, and will not be described here for brevity.

[0047] The pre-trained DGA domain name detection model can be any kind of neural network model.

[0048] In one embodiment, the pre-trained DGA domain name detection model can include an embedding layer, a convolutional network layer, a max-pooling layer, a long short-term memory recurrent network layer, and a fully connected network layer connected in sequence. For ease of understanding, please refer to Figure 2 .

[0049] The specific calculation process and structure of the embedding layer, the convolutional network layer, the max-pooling layer, the long short-term memory recurrent network layer, and the fully connected network layer are known to those skilled in the art, and will not be described here for brevity.

[0050] S300: Determine whether the to-be-detected domain name satisfies the preset DGA domain name structure rule to obtain a first initial detection result.

[0051] The preset DGA domain name structure rule can include the structural characteristics of non-DGA domain names. A domain name with the structural characteristics of non-DGA domain names is a non-DGA domain name.

[0052] In one embodiment, the DGA domain name structure rule can include a secondary domain name length rule and / or a target domain name rule. The target domain name rule includes the composition format of at least one non-DGA domain name.

[0053] The secondary domain name length rule can be a length interval. When the length of the secondary domain name of the to-be-detected domain name is within the length interval, it is considered that the secondary domain name of the to-be-detected domain name satisfies the secondary domain name length rule. When the length of the secondary domain name of the to-be-detected domain name is not within the length interval, it is considered that the secondary domain name of the to-be-detected domain name does not satisfy the secondary domain name length rule.

[0054] The composition format of non-DGA domain names can be, for example, the composition format of government domain names, the composition format of educational institution domain names (such as domain names of major universities), and the like.

[0055] When the composition format of the to-be-detected domain name satisfies any one of the composition formats of non-DGA domain names, it is considered that the composition format of the to-be-detected domain name meets the target domain name rule. When the composition format of the to-be-detected domain name does not satisfy any one of the composition formats of non-DGA domain names, it is considered that the composition format of the to-be-detected domain name does not meet the target domain name rule.

[0056] Optionally, when the DGA domain name structure rule can include the secondary domain name length rule, the specific process of determining whether the domain name to be detected meets the preset DGA domain name structure rule to obtain the first initial detection result can be: matching the length of the secondary domain name of the domain name to be detected with the secondary domain name length rule to obtain a first matching result. In this case, the first matching result is the first initial detection result.

[0057] When the length of the secondary domain name of the domain name to be detected meets the secondary domain name length rule, a first initial detection result indicating that the domain name to be detected is a non-DGA domain name is obtained.

[0058] When the length of the secondary domain name of the domain name to be detected does not meet the secondary domain name length rule, a first initial detection result indicating that the domain name to be detected can be a DGA domain name is obtained.

[0059] Optionally, when the DGA domain name structure rule can include the target domain name rule, the specific process of determining whether the domain name to be detected meets the preset DGA domain name structure rule to obtain the first initial detection result can be: matching the composition format of the domain name to be detected with the target domain name rule to obtain a second matching result. In this case, the second matching result is the first initial detection result.

[0060] When the composition format of the domain name to be detected meets the target domain name rule, a first initial detection result indicating that the domain name to be detected is a non-DGA domain name is obtained.

[0061] When the composition format of the domain name to be detected does not meet the target domain name rule, a first initial detection result indicating that the domain name to be detected can be a DGA domain name is obtained.

[0062] Optionally, when the DGA domain name structure rule can include the secondary domain name length rule and the target domain name rule, the specific process of determining whether the domain name to be detected meets the preset DGA domain name structure rule to obtain the first initial detection result can be: matching the length of the secondary domain name of the domain name to be detected with the secondary domain name length rule to obtain a first matching result. And matching the composition format of the domain name to be detected with the target domain name rule to obtain a second matching result. Based on the first matching result and the second matching result, the first initial detection result is obtained.

[0063] The specific manner of obtaining the first initial detection result based on the first matching result and the second matching result can be: when one of the first matching result and the second matching result represents that the to-be-detected domain name is a non-DGA domain name (the length of the secondary domain name of the to-be-detected domain name meets the secondary domain name length rule, and / or the to-be-detected domain name meets the target domain name rule), obtaining the first initial detection result representing that the to-be-detected domain name is a non-DGA domain name. When neither of the first matching result and the second matching result represents that the to-be-detected domain name is a non-DGA domain name (the length of the secondary domain name of the to-be-detected domain name does not meet the secondary domain name length rule, and the to-be-detected domain name does not meet the target domain name rule), obtaining the first initial detection result representing that the to-be-detected domain name can be a DGA domain name.

[0064] Alternatively, the specific manner of obtaining the first initial detection result based on the first matching result and the second matching result can be: when both the first matching result and the second matching result represent that the to-be-detected domain name is a non-DGA domain name (the length of the secondary domain name of the to-be-detected domain name meets the secondary domain name length rule, and the to-be-detected domain name meets the target domain name rule), obtaining the first initial detection result representing that the to-be-detected domain name is a non-DGA domain name. When one of the first matching result and the second matching result cannot represent that the to-be-detected domain name is a non-DGA domain name (the length of the secondary domain name of the to-be-detected domain name does not meet the secondary domain name length rule, and / or the to-be-detected domain name does not meet the target domain name rule), obtaining the first initial detection result representing that the to-be-detected domain name can be a DGA domain name.

[0065] Optionally, when the DGA domain name structure rule can include the secondary domain name length rule and the target domain name rule, the specific process of determining whether the to-be-detected domain name meets the preset DGA domain name structure rule to obtain the first initial detection result can also be: matching the component format of the to-be-detected domain name with the target domain name rule. In the case that the component format of the to-be-detected domain name matches the component format of a non-DGA domain name in the target domain name rule, obtaining the first initial detection result representing that the to-be-detected domain name is a non-DGA domain name.

[0066] In the case that the component format of the to-be-detected domain name does not match the component format of any non-DGA domain name in the target domain name rule, matching the length of the secondary domain name of the to-be-detected domain name with the secondary domain name length rule to obtain the first initial detection result. If the length of the secondary domain name of the to-be-detected domain name does not meet the secondary domain name length rule, obtaining the first initial detection result representing that the to-be-detected domain name can be a DGA domain name.

[0067] If the length of the secondary domain name of the to-be-detected domain name meets the secondary domain name length rule, obtaining the first initial detection result representing that the to-be-detected domain name is a non-DGA domain name.

[0068] By determining whether the component format of the to-be-detected domain name matches the target domain name rule first, and then determining whether the length of the secondary domain name of the to-be-detected domain name matches the secondary domain name length rule in the case of no match. In the case where the component format of the to-be-detected domain name matches the target domain name rule, the first initial detection result can be directly obtained, without the need to match the length of the secondary domain name of the to-be-detected domain name with the secondary domain name length rule, thereby reducing the calculation amount of obtaining the first initial detection result.

[0069] S400: Obtain a second initial detection result representing whether the to-be-detected domain name exists in the domain name whitelist based on the to-be-detected domain name and the preset domain name whitelist.

[0070] The preset domain name whitelist records at least one non-DGA domain name.

[0071] The preset domain name whitelist can be any existing domain name whitelist that records non-DGA domain names.

[0072] In an implementation, the domain name whitelist can include a dynamic domain name whitelist and / or a static domain name whitelist.

[0073] When the domain name whitelist includes a dynamic domain name whitelist, the specific process of obtaining the second initial detection result representing whether the to-be-detected domain name exists in the domain name whitelist based on the to-be-detected domain name and the preset domain name whitelist can be: determining whether the to-be-detected domain name exists in the dynamic domain name whitelist to obtain a first determination result. At this time, the first determination result is the second initial detection result.

[0074] When the to-be-detected domain name exists in the dynamic domain name whitelist, a first determination result representing that the to-be-detected domain name is a non-DGA domain name is obtained; when the to-be-detected domain name does not exist in the dynamic domain name whitelist, a first determination result representing that the to-be-detected domain name can be a DGA domain name is obtained.

[0075] When the domain name whitelist includes a static domain name whitelist, the specific process of obtaining the second initial detection result representing whether the to-be-detected domain name exists in the domain name whitelist based on the to-be-detected domain name and the preset domain name whitelist can be: determining whether the to-be-detected domain name exists in the static domain name whitelist to obtain a second determination result. At this time, the second determination result is the second initial detection result.

[0076] When the to-be-detected domain name exists in the static domain name whitelist, a second determination result representing that the to-be-detected domain name is a non-DGA domain name is obtained; when the to-be-detected domain name does not exist in the static domain name whitelist, a second determination result representing that the to-be-detected domain name can be a DGA domain name is obtained.

[0077] When the domain name whitelist comprises the dynamic domain name whitelist and the static domain name whitelist, the specific process of obtaining the second initial detection result representing whether the domain name to be detected exists in the domain name whitelist based on the domain name to be detected and the preset domain name whitelist can be: determining whether the domain name to be detected exists in the dynamic domain name whitelist to obtain a first determination result; and determining whether the domain name to be detected exists in the static domain name whitelist to obtain a second determination result. Then, the second initial detection result is obtained based on the first determination result and the second determination result.

[0078] The specific manner of obtaining the second initial detection result based on the first determination result and the second determination result can be: when one of the first determination result and the second determination result represents that the domain name to be detected is a non-DGA domain name (the domain name to be detected exists in the dynamic domain name whitelist and / or the domain name to be detected exists in the static domain name whitelist), a first initial detection result representing that the domain name to be detected is a non-DGA domain name is obtained. When neither the first determination result nor the second determination result represents that the domain name to be detected is a non-DGA domain name (the domain name to be detected does not exist in the dynamic domain name whitelist and the domain name to be detected does not exist in the static domain name whitelist), a second initial detection result representing that the domain name to be detected can be a DGA domain name is obtained.

[0079] The domain names in the static domain name whitelist can be collected from the Internet, for example, can be trusted domain names with large international and domestic access amounts such as alexa top (global ranking, Alexa ranking compares each website with other websites in the global range and gives a relative ranking. The lower the global ranking, the higher the website traffic in the global range). Or, the domain names in the static domain name whitelist can also be non-DGA domain names obtained from a third party.

[0080] In an implementation manner, the non-DGA domain names in the dynamic domain name whitelist are obtained based on log data of a user.

[0081] The generation process of the dynamic domain name whitelist can be: first, obtaining log data of a user; then, based on the log data, obtaining the spatiotemporal characteristics of each domain name appearing in the log data; then, judging whether the domain name is a DGA domain name based on the spatiotemporal characteristics of the domain name; finally, generating the dynamic domain name whitelist based on all domain names in the log data that are not DGA domain names.

[0082] The user can be a single device, in which case the log data of the user is the log data recorded in the device.

[0083] Or, the user can refer to an organization, in which case the log data of the user is the log data recorded by all devices owned by the organization.

[0084] The spatiotemporal characteristics of a domain name refer to its temporal and spatial distribution characteristics in log data.

[0085] Optionally, spatiotemporal features may include a threshold for the number of times a domain name appears and the distribution of normal times when a domain name appears.

[0086] The domain name occurrence threshold may include at least one of the following: hourly domain name occurrence threshold, daily domain name occurrence threshold, monthly domain name occurrence threshold, etc.

[0087] The normal occurrence time distribution of domain names can be the daily occurrence time distribution, the weekly occurrence time distribution, the monthly occurrence time distribution, etc.

[0088] To make it easier to understand, let's take the daily time distribution of normal domain names as an example. The daily time distribution of normal domain names can be measured in hours, showing the number of times a normal domain name appears each hour within a day.

[0089] For example, taking a company as an example, the normal daily occurrence of a domain name should be concentrated during employees' working hours. Therefore, the normal occurrence time distribution of a domain name should be: the occurrence time of the domain name is distributed during working hours. Domain names that frequently appear outside of working hours do not meet the normal occurrence time distribution of the domain name.

[0090] The specific process for determining whether a domain name is a DGA domain name based on its spatiotemporal characteristics can be as follows: For each domain name appearing in the log data: First, determine whether the frequency of the domain name's occurrence is greater than a preset domain name occurrence threshold, obtaining a first initial judgment result. Then, determine whether the domain name's occurrence time distribution meets a preset normal domain name occurrence time distribution pattern, obtaining a second initial judgment result. Finally, based on the first and second initial judgment results, determine whether the domain name is a DGA domain name.

[0091] The method for determining whether a domain name is a DGA domain name based on the first and second initial judgment results can be as follows: If either the first or second initial judgment result indicates that the domain name is not a DGA domain name (the domain name's occurrence count is greater than a preset domain name occurrence count threshold, and / or the domain name meets a preset normal domain name occurrence time distribution pattern), then the domain name is determined to be a non-DGA domain name. If both the first and second initial judgment results indicate that the domain name may be a DGA domain name (the domain name's occurrence count is less than a preset domain name occurrence count threshold, and the domain name does not meet a preset normal domain name occurrence time distribution pattern), then the domain name is determined to be a DGA domain name.

[0092] Alternatively, based on the first initial judgment result and the second initial judgment result, the manner of determining whether the domain name is a DGA domain name can also be: when the first initial judgment result and the second initial judgment result both represent that the domain name is a non-DGA domain name (the number of occurrences of the domain name is greater than the preset domain name occurrence threshold, and the domain name satisfies the preset domain name normal occurrence time distribution rule), it is determined that the domain name is a non-DGA domain name. When one of the first initial judgment result and the second initial judgment result represents that the domain name can be a DGA domain name (the number of occurrences of the domain name is less than the preset domain name occurrence threshold, and / or the domain name does not satisfy the preset domain name normal occurrence time distribution rule), it is determined that the domain name is a DGA domain name.

[0093] In an implementation, the log data can include at least one of web (webpage) log, SSL (Secure Socket Layer) log, DNS (Domain Name System) log, and the like.

[0094] Since the DGA domain name usually only appears in the DNS log, when the log data of the user includes the web log and the SSL log, the domain names appearing in the web log and the SSL log can be directly recorded in the dynamic domain name whitelist. Only the domain names appearing in the DNS log need to be subjected to the above judgment process.

[0095] Optionally, the dynamic domain name whitelist can include a web whitelist, an SSL whitelist, and a DNS whitelist. The web whitelist is obtained based on the web log, the SSL whitelist is obtained based on the SSL log, and the DNS whitelist is obtained based on the DNS log.

[0096] Optionally, a timing trigger task can be preset, and when the timing trigger task is triggered, the dynamic domain name whitelist is updated based on the obtained new log data.

[0097] The new log data is the log data of the user obtained between the previous timing task trigger and the current timing trigger task.

[0098] In an implementation, after the dynamic domain name whitelist is generated, the method further includes: obtaining periodic log data generated by the user in a previous period according to a preset period; obtaining a space-time feature of each domain name appearing in the periodic log data based on the periodic log data; determining whether the domain name is a DGA domain name based on the space-time feature of each domain name; and adding a target domain name to the dynamic domain name whitelist, wherein the target domain name is a domain name in the log data that is not a DGA domain name and does not exist in the dynamic domain name whitelist.

[0099] The periodic log data is the log data generated by the user in the previous time period. The specific implementation of the log data has been described above, and will not be described again here for brevity.

[0100] The specific manner and principle of obtaining the spatiotemporal feature and determining whether the domain name is a DGA domain name have been described above, and will not be described again here for brevity.

[0101] The preset period can be set according to actual needs, for example, one hour, one day, one week, one month, etc. For example, if the preset period is one day, the periodic log data generated by the user in the previous day is obtained at a fixed time every day, and the periodic log data is the log data generated by the user in the previous day. The specific length of the preset period is not limited here.

[0102] S500: obtaining a final detection result representing a second probability that the to-be-detected domain name is a DGA domain name based on the first probability that the to-be-detected domain name is a DGA domain name, the first initial detection result, and / or the second initial detection result.

[0103] In the case where only one of S300 and S400 is executed, the DGA domain name detection method includes S100, S200, S300, and S500, or the DGA domain name detection method includes S100, S200, S400, and S500.

[0104] Alternatively, S300 and S400 can also be executed, in which case the DGA domain name detection method includes S100, S200, S300, S400, and S500.

[0105] In one implementation, when the DGA domain name detection method includes S100, S200, S300, and S500, S500 is to obtain a final detection result representing a second probability that the to-be-detected domain name is a DGA domain name based on the first probability that the to-be-detected domain name is a DGA domain name and the first initial detection result.

[0106] Optionally, the specific process of obtaining a final detection result representing a second probability that the to-be-detected domain name is a DGA domain name based on the first probability that the to-be-detected domain name is a DGA domain name and the first initial detection result can be: determining a model detection result of whether the to-be-detected domain name is a DGA domain name based on a preset probability threshold and the first probability that the to-be-detected domain name is a DGA domain name. Then, obtaining the final detection result representing the second probability that the to-be-detected domain name is a DGA domain name based on the model detection result and the first initial detection result.

[0107] The process of obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name based on the model detection result and the first initial detection result can be: when the model detection result and the first initial detection result both represent that the to-be-detected domain name is not a DGA domain name, obtaining the final detection result representing that the to-be-detected domain name is not a DGA domain name.

[0108] Alternatively, the process of obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name based on the model detection result and the first initial detection result can be: when the model detection result and the first initial detection result both represent that the to-be-detected domain name is a DGA domain name, obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name. When the model detection result represents that the to-be-detected domain name is a DGA domain name and the first initial detection result represents that the to-be-detected domain name is not a DGA domain name, obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name. When the model detection result represents that the to-be-detected domain name is not a DGA domain name and the first initial detection result represents that the to-be-detected domain name is a DGA domain name, obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name. When the model detection result represents that the to-be-detected domain name is not a DGA domain name and the first initial detection result represents that the to-be-detected domain name is not a DGA domain name, obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name.

[0109] Alternatively, the process of obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name based on the model detection result and the first initial detection result can be: when the model detection result and the first initial detection result both represent that the to-be-detected domain name is a DGA domain name, obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name. When the model detection result represents that the to-be-detected domain name is a DGA domain name and the first initial detection result represents that the to-be-detected domain name is not a DGA domain name, obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name. When the model detection result represents that the to-be-detected domain name is not a DGA domain name and the first initial detection result represents that the to-be-detected domain name is a DGA domain name, obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name. When the model detection result represents that the to-be-detected domain name is not a DGA domain name and the first initial detection result represents that the to-be-detected domain name is not a DGA domain name, obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name.

[0110] The first initial detection result can be represented by two numerical values representing that the to-be-detected domain name satisfies the preset DGA domain name structure rule and that the to-be-detected domain name does not satisfy the preset DGA domain name structure rule, respectively. For example, when a larger numerical value represents a larger first probability of the to-be-detected domain name being a DGA domain name, 0 can be used to represent that the to-be-detected domain name satisfies the preset DGA domain name structure rule, and 1 can be used to represent that the to-be-detected domain name does not satisfy the preset DGA domain name structure rule. The above example is only for understanding and does not limit the present application.

[0111] The weight values of the weighted summation (or weighted average) processing can be set according to actual conditions, and the respective weight values of the first probability of the to-be-detected domain name being a DGA domain name and the first initial detection result are not limited herein.

[0112] In an implementation, when the DGA domain name detection method comprises the four steps of S100, S200, S400 and S500, S500 is: obtaining a final detection result representing a second probability that the to-be-detected domain name is a DGA domain name based on the first probability that the to-be-detected domain name is a DGA domain name and the second initial detection result.

[0113] Optionally, the specific process of obtaining the final detection result representing the second probability that the to-be-detected domain name is a DGA domain name based on the first probability that the to-be-detected domain name is a DGA domain name and the second initial detection result can be: determining a model detection result of whether the to-be-detected domain name is a DGA domain name based on a preset probability threshold and the first probability that the to-be-detected domain name is a DGA domain name. Then, obtaining the final detection result representing the second probability that the to-be-detected domain name is a DGA domain name based on the model detection result and the second initial detection result.

[0114] The process of obtaining the final detection result representing the second probability that the to-be-detected domain name is a DGA domain name based on the model detection result and the second initial detection result can be: when the model detection result and the second initial detection result both represent that the to-be-detected domain name is not a DGA domain name, obtaining the final detection result representing that the to-be-detected domain name is not a DGA domain name.

[0115] Alternatively, the process of obtaining the final detection result representing the second probability that the to-be-detected domain name is a DGA domain name based on the model detection result and the second initial detection result can be: when the model detection result and the second initial detection result both represent that the to-be-detected domain name is a DGA domain name, obtaining the final detection result representing the second probability that the to-be-detected domain name is a DGA domain name. When the model detection result represents that the to-be-detected domain name is a DGA domain name and the second initial detection result represents that the to-be-detected domain name is not a DGA domain name, obtaining the final detection result representing the second probability that the to-be-detected domain name is a DGA domain name. When the model detection result represents that the to-be-detected domain name is not a DGA domain name and the second initial detection result represents that the to-be-detected domain name is a DGA domain name, obtaining the final detection result representing the second probability that the to-be-detected domain name is a DGA domain name. When the model detection result represents that the to-be-detected domain name is not a DGA domain name and the second initial detection result represents that the to-be-detected domain name is not a DGA domain name, obtaining the final detection result representing the second probability that the to-be-detected domain name is a DGA domain name.

[0116] Alternatively, when the second initial detection result represents that the to-be-detected domain name is not a DGA domain name, obtaining the final detection result representing that the to-be-detected domain name is not a DGA domain name. When the second initial detection result represents that the to-be-detected domain name can be a DGA domain name, taking the model detection result as the final detection result.

[0117] Optionally, the specific process of obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name based on the first probability of the to-be-detected domain name being a DGA domain name and the second initial detection result can also be: performing weighted summation (or weighted average) processing on the first probability of the to-be-detected domain name being a DGA domain name and the second initial detection result to obtain the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name.

[0118] The second initial detection result can be represented by two numerical values respectively indicating that the to-be-detected domain name exists in the domain name whitelist and that the to-be-detected domain name does not exist in the domain name whitelist. For example, when a larger numerical value represents a greater first probability of the to-be-detected domain name being a DGA domain name, 0 can be used to represent that the to-be-detected domain name exists in the domain name whitelist, and 1 can be used to represent that the to-be-detected domain name does not exist in the domain name whitelist. This example is only for ease of understanding and does not limit the present application.

[0119] The weight values of the weighted summation (or weighted average) processing can be set according to actual conditions, and the respective weight values of the first probability of the to-be-detected domain name being a DGA domain name and the second initial detection result are not limited herein.

[0120] In one implementation, when the DGA domain name detection method includes the five steps S100, S200, S300, S400, and S500, S500 is: obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name based on the first probability of the to-be-detected domain name being a DGA domain name, the first initial detection result, and the second initial detection result.

[0121] Optionally, the specific process of obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name based on the first probability of the to-be-detected domain name being a DGA domain name, the first initial detection result, and the second initial detection result can be: when the second initial detection result represents that the to-be-detected domain name is not a DGA domain name, obtaining the final detection result representing that the to-be-detected domain name is not a DGA domain name; and when the second initial detection result represents that the to-be-detected domain name can be a DGA domain name, obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name based on the first probability of the to-be-detected domain name being a DGA domain name and the first initial detection result.

[0122] The specific manner and principle of obtaining the final detection result representing the second probability of the to-be-detected domain name being a DGA domain name based on the first probability of the to-be-detected domain name being a DGA domain name and the first initial detection result have been described above, and are not described herein again for brevity.

[0123] Optionally, the specific process of obtaining the final detection result representing the second probability that the to-be-detected domain name is a DGA domain name based on the first probability that the to-be-detected domain name is a DGA domain name, the first initial detection result, and the second initial detection result can also be: performing weighted summation (or weighted average) processing on the first probability that the to-be-detected domain name is a DGA domain name, the first initial detection result, and the second initial detection result to obtain the final detection result representing the second probability that the to-be-detected domain name is a DGA domain name.

[0124] The manner of converting the first initial detection result and the second initial detection result into numerical values has been described above, and will not be described again here for briefness.

[0125] The weight values of the weighted summation (or weighted average) processing can be set according to actual conditions, and the weight values corresponding to the first probability that the to-be-detected domain name is a DGA domain name, the first initial detection result, and the second initial detection result are not limited here.

[0126] Based on the same technical concept, the present application also provides a DGA domain name detection apparatus. As shown in Figure 3 The DGA domain name detection apparatus 100 includes an acquisition module 110 and a processing module 120.

[0127] The acquisition module 110 is configured to acquire a to-be-detected domain name.

[0128] The processing module 120 is configured to input the to-be-detected domain name into a pre-trained DGA domain name detection model to obtain a first probability that the to-be-detected domain name is a DGA domain name.

[0129] The processing module 120 is further configured to determine whether the to-be-detected domain name satisfies a preset DGA domain name structure rule to obtain a first initial detection result, and / or obtain a second initial detection result representing whether the to-be-detected domain name exists in a preset domain name whitelist based on the to-be-detected domain name and the preset domain name whitelist.

[0130] The processing module 120 is further configured to obtain a final detection result representing a second probability that the to-be-detected domain name is a DGA domain name based on the first probability that the to-be-detected domain name is a DGA domain name, the first initial detection result, and / or the second initial detection result.

[0131] The DGA domain name structure rule includes a secondary domain name length rule and / or a target domain name rule, the target domain name rule including a composition format of at least one non-DGA domain name, the processing module 120 is specifically configured to match the length of the secondary domain name of the to-be-detected domain name with the secondary domain name length rule to obtain a first matching result; and / or, match the composition format of the to-be-detected domain name with the target domain name rule to obtain a second matching result; and obtain the first initial detection result based on the first matching result and / or the second matching result.

[0132] The DGA domain name structure rule includes a secondary domain name length rule and / or a target domain name rule, the processing module 120 is specifically configured to match the length of the secondary domain name of the to-be-detected domain name with the secondary domain name length rule to obtain a first matching result; and / or, match the composition format of the to-be-detected domain name with the target domain name rule to obtain a second matching result; and obtain the first initial detection result based on the first matching result and / or the second matching result.

[0133] The domain name whitelist includes a dynamic domain name whitelist and / or a static domain name whitelist, wherein the domain names in the dynamic domain name whitelist are obtained based on log data of a user, and the static domain name whitelist is obtained based on network data; the processing module 120 is specifically configured to determine whether the to-be-detected domain name exists in the dynamic domain name whitelist to obtain a first determination result; and / or, determine whether the to-be-detected domain name exists in the static domain name whitelist to obtain a second determination result; and obtain the second initial detection result based on the first determination result and / or the second determination result.

[0134] The processing module 120 is further configured to obtain log data of a user; obtain a spatio-temporal feature of each domain name appearing in the log data based on the log data; determine whether the domain name is a DGA domain name based on the spatio-temporal feature of the domain name; and generate the dynamic domain name whitelist based on all domain names in the log data that are not DGA domain names.

[0135] The processing module 120 is further configured to, after generating the dynamic domain name whitelist, obtain periodic log data generated by the user in a previous period according to a preset period; obtain a spatio-temporal feature of each domain name appearing in the periodic log data based on the periodic log data; determine whether the domain name is a DGA domain name based on the spatio-temporal feature of the domain name; and add a target domain name to the dynamic domain name whitelist, wherein the target domain name is a domain name in the log data that is not a DGA domain name and does not exist in the dynamic domain name whitelist.

[0136] The spatiotemporal features include a domain name occurrence frequency threshold and a domain name normal occurrence time distribution.

[0137] The processing module 120 is specifically configured to obtain a subdomain of the domain name to be detected, and input the subdomain into the pre-trained DGA domain name detection model to obtain a first probability that the domain name to be detected is a DGA domain name.

[0138] In an implementation form, the pre-trained DGA domain name detection model comprises, in sequence, an embedding layer, a convolution network layer, a max-pooling layer, a long short-term memory recurrent network layer, and a fully connected network layer.

[0139] The DGA domain name detection device 100 provided by the embodiments of the present application has the same implementation principle and technical effects as the foregoing DGA domain name detection method embodiments. For brevity, the part of the device embodiments not mentioned in the foregoing DGA domain name detection method embodiments can be referred to the corresponding content in the foregoing DGA domain name detection method embodiments.

[0140] Please refer to Figure 4 The electronic device 200 provided by the embodiments of the present application. The electronic device 200 comprises a processor 210, a memory 220.

[0141] The memory 220 and the processor 210 are directly or indirectly electrically connected to each other to realize the transmission or interaction of data. For example, these elements can be electrically connected to each other through one or more communication buses or signal lines. Among them, the memory 220 is used to store computer programs, such as storing Figure 3The software function module shown in the middle is the DGA domain name detection apparatus 100. The DGA domain name detection apparatus 100 includes at least one software function module stored in the memory 220 in the form of software or firmware or solidified in the operating system (OS) of the electronic device 200. The processor 210 is configured to execute the executable modules stored in the memory 220, such as the software function module or computer program included in the DGA domain name detection apparatus 100. At this time, the processor 210 is configured to obtain a domain name to be detected; input the domain name to be detected into a pre-trained DGA domain name detection model to obtain a first probability that the domain name to be detected is a DGA domain name; determine whether the domain name to be detected satisfies a preset DGA domain name structure rule to obtain a first initial detection result; and / or, based on the domain name to be detected and a preset domain name whitelist, obtain a second initial detection result representing whether the domain name to be detected exists in the domain name whitelist; and based on the first probability that the domain name to be detected is a DGA domain name, the first initial detection result, and / or the second initial detection result, obtain a final detection result representing a second probability that the domain name to be detected is a DGA domain name.

[0142] The memory 220 can be, but is not limited to, a RAM (Random Access Memory), a ROM (Read Only Memory), a PROM (Programmable Read-Only Memory), an EPROM (Erasable Programmable Read-Only Memory), an EEPROM (Electric Erasable Programmable Read-Only Memory), and the like.

[0143] The processor 210 can be an integrated circuit chip with signal processing capability. The processor described above can be a general purpose processor, including a CPU (Central Processing Unit), a NP (Network Processor), etc.; also can be a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic device, discrete gate or transistor logic device, discrete hardware component. The disclosed methods, steps and logic block diagrams in the embodiments of the present application can be implemented or executed. The general purpose processor can be a microprocessor or the processor 210 can also be any conventional processor.

[0144] The electronic device 200 described above includes, but is not limited to, a personal computer, a server, etc.

[0145] The embodiments of the present application also provide a computer readable storage medium (hereinafter referred to as a storage medium) having a computer program stored thereon, wherein the computer program is run by a computer such as the electronic device 200 described above, and performs the DGA domain name detection method shown above. The computer readable storage medium includes a U disk, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, and various media that can store program codes.

[0146] In the description of the embodiments of the present application, the meaning of "a plurality of" is two or more, unless otherwise explicitly and specifically limited.

[0147] In this document, reference to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another. It is expressly understood that the embodiments described herein are merely examples from a whole class of embodiments of which the application is a part. It is further expressly understood that the application is intended to encompass all changes and modifications that fall within the scope of the claims.

[0148] In the description of the embodiments of the present application, the term "and / or" is only a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A alone, A and B together, and B alone. In addition, the character " / " in this document generally represents an "or" relationship between the front and rear associated objects.

[0149] The above descriptions are only the preferred embodiments of the present application, and are not intended to limit the present application. The present application can have various modifications and changes for those skilled in the art. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for detecting DGA domain names, characterized in that, The method comprises: obtaining a domain name to be detected; inputting the domain name to be detected into a pre-trained DGA domain name detection model to obtain a first probability that the domain name to be detected is a DGA domain name; determining whether the domain name to be detected satisfies a preset DGA domain name structure rule to obtain a first initial detection result; and / or, based on the domain name to be detected and a preset domain name whitelist, obtaining a second initial detection result representing whether the domain name to be detected exists in the domain name whitelist; based on the first probability that the domain name to be detected is a DGA domain name, the first initial detection result and / or the second initial detection result, obtaining a final detection result representing a second probability that the domain name to be detected is a DGA domain name; the domain name whitelist comprises a dynamic domain name whitelist and / or a static domain name whitelist; the generation process of the dynamic domain name whitelist comprises: obtaining log data of a user; based on the log data, obtaining a space-time feature of each domain name appearing in the log data; the space-time feature comprises a domain name appearance frequency threshold and a domain name normal appearance time distribution; for each domain name appearing in the log data: determining whether the appearance frequency of the domain name is greater than a preset domain name appearance frequency threshold to obtain a first initial judgment result; determining whether the domain name appearance time distribution of the domain name satisfies a preset domain name normal appearance time distribution rule to obtain a second initial judgment result; based on the first initial judgment result and the second initial judgment result, determining whether the domain name is a DGA domain name; based on all domain names in the log data that are not DGA domain names, generating the dynamic domain name whitelist.

2. The method of claim 1, wherein, The DGA domain name structure rule comprises a subdomain name length rule and / or a target domain name rule, the target domain name rule comprises a component format of at least one non-DGA domain name, determining whether the domain name to be detected satisfies the preset DGA domain name structure rule to obtain the first initial detection result comprises: matching the length of the subdomain name of the domain name to be detected with the subdomain name length rule to obtain a first matching result; and / or, matching the component format of the domain name to be detected with the target domain name rule to obtain a second matching result; based on the first matching result and / or the second matching result, obtaining the first initial detection result.

3. The method of claim 1, wherein, The DGA domain name structure rule comprises a subdomain name length rule and a target domain name rule, the target domain name rule comprises a component format of at least one non-DGA domain name, determining whether the domain name to be detected satisfies the preset DGA domain name structure rule to obtain the first initial detection result comprises: matching the component format of the domain name to be detected with the target domain name rule; in the case that the component format of the domain name to be detected does not match the component format of any non-DGA domain name in the target domain name rule, matching the length of the subdomain name of the domain name to be detected with the subdomain name length rule to obtain the first initial detection result.

4. The method of claim 1, wherein, The domain name whitelist comprises a dynamic domain name whitelist and / or a static domain name whitelist, wherein the domain names in the dynamic domain name whitelist are obtained based on log data of a user, and the static domain name whitelist is obtained based on network data; Based on the to-be-detected domain name and a preset domain name whitelist, a second initial detection result is obtained, which represents whether the to-be-detected domain name exists in the domain name whitelist, comprising: determining whether the to-be-detected domain name exists in the dynamic domain name whitelist to obtain a first determination result; and / or, determining whether the to-be-detected domain name exists in the static domain name whitelist to obtain a second determination result; Based on the first determination result and / or the second determination result, the second initial detection result is obtained.

5. The method of claim 4, wherein, After the dynamic domain name whitelist is generated, the method further comprises: acquiring periodic log data generated by a user in a previous period according to a preset period; based on the periodic log data, acquiring a space-time feature of each domain name appearing in the periodic log data; determining whether the domain name is a DGA domain name based on the space-time feature of each domain name; adding a target domain name to the dynamic domain name whitelist, wherein the target domain name is a domain name in the log data that does not belong to a DGA domain name and does not exist in the dynamic domain name whitelist.

6. The method of claim 1, wherein, inputting the to-be-detected domain name into a pre-trained DGA domain name detection model to obtain a first probability that the to-be-detected domain name is a DGA domain name, comprising: acquiring a secondary domain name of the to-be-detected domain name; inputting the secondary domain name into the pre-trained DGA domain name detection model to obtain the first probability that the to-be-detected domain name is a DGA domain name.

7. The method according to any one of claims 1 to 6, characterized in that, The pre-trained DGA domain name detection model comprises an embedding layer, a convolution network layer, a max-pooling layer, a long short-term memory recurrent network layer and a fully connected network layer connected in sequence.

8. A DGA domain name detection apparatus, characterized by, comprising: an acquisition module configured to acquire a to-be-detected domain name; a processing module configured to input the to-be-detected domain name into a pre-trained DGA domain name detection model to obtain a first probability that the to-be-detected domain name is a DGA domain name; the processing module is further configured to determine whether the to-be-detected domain name satisfies a preset DGA domain name structure rule to obtain a first initial detection result; and / or, based on the to-be-detected domain name and a preset domain name whitelist, a second initial detection result is obtained, which represents whether the to-be-detected domain name exists in the domain name whitelist; the processing module is further configured to obtain a second probability that the to-be-detected domain name is a DGA domain name based on the first probability that the to-be-detected domain name is a DGA domain name, the first initial detection result and / or the second initial detection result, to obtain a final detection result representing the second probability; The domain name whitelist comprises a dynamic domain name whitelist and / or a static domain name whitelist; the processing module is further configured to acquire log data of a user; based on the log data, acquire a space-time feature of each domain name appearing in the log data; the space-time feature comprises a domain name appearance frequency threshold and a domain name normal appearance time distribution; For each domain name appearing in the log data: determining whether the number of appearances of the domain name is greater than a preset domain name appearance number threshold, to obtain a first initial judgment result; determining whether the domain name appearance time distribution of the domain name meets a preset domain name normal appearance time distribution rule, to obtain a second initial judgment result; based on the first initial judgment result and the second initial judgment result, determining whether the domain name is a DGA domain name; based on all domain names in the log data that do not belong to the DGA domain name, generating the dynamic domain name white list.

9. An electronic device, comprising: comprising: a memory and a processor, the memory and the processor being connected; the memory, configured to store a program; the processor, configured to call the program stored in the memory, so as to execute the method in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, a computer program is stored thereon, and the computer program is run by a computer to execute the method in any one of claims 1-7.

Images