High-robustness DGA domain name detection algorithm and device

Abstract

The invention provides a high-robustness DGA domain name detection algorithm and equipment. The method comprises the following steps: extracting a domain name character string; checking whether the domain name character string conforms to the RFC specification or not; preprocessing a domain name character string; the multi-head attention of the input coded word embedding vector is calculated; multiple attention devices are connected; the Shift-Attention attention values of all the heads are connected together through linear projection, and the Shift-Attention attention values of all the heads are connected together through linear projection; regularizing amp by the neural network; an output; according to the method, efficient detection of malicious domain names and high-performance DGA domain name detection are achieved by deeply mining complex and hidden character patterns and dependency relationships of domain names, meanwhile, a DGA detection algorithm is designed, multiple subspaces in domain name character strings are concerned in parallel by using a multi-head attention mechanism, and the detection efficiency of the domain names is improved. The detection model can capture the character combination, the grammar structure and the semantic mode in the domain name at the same time, and the accuracy and generalization ability of detection are remarkably improved.

Description

Technical Field

[0001] The present invention belongs to the field of network security and artificial intelligence application technology, and in particular to a highly robust DGA domain name detection algorithm and device. Background Art

[0002] The use of Domain Generation Algorithms (DGA) marks a new era in which malware communication moves from passive communication to active communication. The core technology of DGA is to dynamically generate a large number of domain names with random strings through different generation algorithms. These domain names are used as a communication bridge between malware and its command and control server (Command & Control, C&C).

[0003] Different from the method of using fixed domain names within a range, the core logic of DGA is to generate a large number of domain names in a short period of time and frequently change malicious communication nodes, thereby effectively circumventing the static defense mechanism; in addition, the rapid evolution of the DGA algorithm and the randomness of the domain name string also significantly increase the difficulty of network defense systems to detect and intercept DGA domain names; therefore, a new detection algorithm that can accurately and efficiently identify DGA domain names has become an urgent need in the field of network security research.

[0004] In order to overcome the above technical deficiencies, existing technicians use a new type of DGA domain name identifier for auxiliary processing, which has the following advantages:

[0005] (1) By leveraging the model's ability to capture long-distance dependencies, we can deeply understand and classify domain names generated by DGAs with complex structures, allowing recognition to span the entire domain name and improve the model's recognition accuracy;

[0006] (2) Find the commonalities between DGA domain name strings and effectively handle the changes or noise of different DGA generation algorithms through the attention transfer mechanism to improve the generalization ability of the model.

[0007] (3) Effectively utilize the model's ability to process input sequences in parallel, significantly reduce domain name detection time in large-scale network domain name systems, and provide a real and deployable solution for existing DNS systems;

[0008] But this new type of DGA domain name identifier also has shortcomings:

[0009] (1) The domain name generation rate of the DGA algorithm is fast, and the frequency of evolution of new DGA algorithms is high. How to make the model find the commonality of DGA domain names becomes a difficult problem;

[0010] (2) The noise in the DGA domain name will affect the model's judgment, but it is still a sign to detect whether the domain name is a DGA domain name. How to divert the attention of the noise while retaining a part of the attention for the model to make judgments becomes another difficult problem. Summary of the invention

[0011] In order to solve the above technical problems, the present invention provides a highly robust DGA domain name detection algorithm and device, which rely on the DNS recursive resolver, deeply mine the complex and hidden character patterns and dependencies of the domain name, realize efficient detection of malicious domain names and high-performance DGA domain name detection, and also design a DGA detection algorithm, which constructs the model input by recording the query domain name and filling the domain name string, and performing character-level embedding preprocessing on the domain name string; according to the Shift-Attention mechanism, the attention calculated each time is ranked, and according to the preset threshold, the invalid attention ranked at the bottom is redistributed evenly to the attention ranked at the top, thereby filtering the influence of noise; using the multi-head attention mechanism, multiple subspaces in the domain name string are paid attention to in parallel, so that the detection model can simultaneously capture the character combination, grammatical structure and semantic pattern in the domain name, and significantly improve the accuracy and generalization ability of detection.

[0012] A highly robust DGA domain name detection algorithm and device, wherein:

[0013] A highly robust DGA domain name detection algorithm, including:

[0014] Step 1: Extract the domain name string;

[0015] Obtain the domain name string queried in each DNS query request in real time;

[0016] Step 2: Check whether the domain name string complies with RFC specifications;

[0017] According to the RFC specification, use regular expressions to check whether the domain name string meets the domain name specification. If it meets the domain name specification, proceed to the next step to continue identification; if it does not meet the domain name specification, directly block it and end the process;

[0018] As an example, the RFC specification refers to: RFC1035 regulations.

[0019] As an example, the regular expression is:

[0020] ^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*\.$; where:

[0021] “^” means matching the beginning of the domain name string;

[0022] "(?!-)" indicates negative lookahead, which asserts that the current position cannot be followed by a hyphen (-); that is, it ensures that the domain name string cannot start with a hyphen;

[0023] "[A-Za-z0-9-]{1,63}" means matching 1 to 63 characters, which can be uppercase or lowercase letters, numbers, or hyphens; this part is used to match the label of the domain name string;

[0024] "(?<!-)" indicates negative lookbehind, which asserts that the current position cannot be preceded by a hyphen (-); that is, it ensures that the domain name string cannot end with a hyphen;

[0025] "(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*": means matching a dot (.) followed by 1 to 63 letters, numbers, or hyphens, and these characters cannot start or end with a hyphen; this part is used to match subdomains and top-level domains in domain names, and can be repeated 0 or more times;

[0026] \.$ ensures that the domain name string matched by the regular expression ends with a period (.).

[0027] Step 3: Preprocess the domain name string;

[0028] First, take a single character in the domain name string as a unit and convert each character in the domain name string into a unique corresponding number; according to the definition of RFC1035, the length of each domain name string shall not exceed 255 characters. For domain name strings with a length of less than 255 characters, fill them with 0 from the back to obtain the domain name encoding vector;

[0029] As an example, the conversion into a unique corresponding number is based on formula (1) and is designed as follows:

[0030] domain=[Char1, Char2,...,Char 255 ] (1)

[0031] Where: domain is the domain name encoding vector;

[0032] Char1 to Char 255 They represent the numbers after the domain name string at different positions is converted.

[0033] Secondly, after the domain name character string is converted into the domain name encoding vector, the domain name encoding vector is subjected to character embedding calculation to obtain a word embedding vector;

[0034] As an example, the character embedding calculation uses a learnable matrix: E∈R VxD ; Used to convert the discrete numerical representation of formula (1) into a continuous, dense word embedding vector; where: E represents the learnable matrix, V represents the number of word embedding vectors, D represents the dimension of the word embedding vector, and E is a real number matrix with a dimension of V*D.

[0035] Finally, the position encoding calculation method is used to obtain the position encoding vector of the word embedding vector, and the position encoding vector will be added to the word embedding vector in the form of vector addition to obtain the encoded word embedding vector;

[0036] As an example, the calculation method of the position code is designed as follows:

[0037]

[0038] Where: i represents the index position of different characters in the word embedding vector, d model The word embedding vector is encoded using formula (2) for even index positions and formula (3) for odd index positions.

[0039] Step 4: Calculate the multi-head attention of the encoded word embedding vector input;

[0040] After obtaining the encoded word embedding vector, a multi-head Shift-Attention layer is formed by adopting a parallel structure of multiple Shift-Attention layers. The head calculation formula is used in combination with the Shift-Attention calculation mechanism to calculate each head attention of the encoded word embedding vector. The specific operations are as follows:

[0041] First, the query, key, and value weight matrices are divided according to the number of multiple heads to obtain the weight matrices required for calculation of each head, and the weight matrices are mapped to the global query, key, and value to obtain the query, key, and value of each head;

[0042] Secondly, a threshold t is set to sort the weight values ​​of the query and key calculated for each header;

[0043] Then, the weights of the weight values ​​ranked after the threshold t are summed to obtain a sum value, and the sum value is evenly distributed to the weights of the weight values ​​ranked before the threshold t, and the weights ranked after t are reset to 0;

[0044] Finally, get the Shift-Attention value of each head;

[0045] As an example, the head calculation formula is designed as follows, for the i-th head:

[0046]

[0047] in: are the weight matrices of the jth head; Q, K, and V represent the global query, key, and value, respectively; d is the dimension of the weight matrices, d h is the dimension of each different head output vector, and its calculation formula is designed as: Here, hd represents the number of heads.

[0048] As an example, the attention calculation mechanism of Shift-Attention is designed as follows:

[0049]

[0050]

[0051] Where: Q', K', V' represent the incoming parameters query, key, and Value respectively;

[0052] S F Represents the attention calculation formula of the Shift-Attention mechanism;

[0053] A tk Represents the element in the tth row and kth column of the matrix after the query and key are calculated;

[0054] AVG represents the summed average of the weight values ​​ranked after t;

[0055] Step 5: Connect multiple attention heads;

[0056] Connect the Shift-Attention values ​​of each head together through linear projection; and use C(X) to define the output of the connected Shift-Attention values ​​of each head;

[0057] As an example, the C(X) method is designed as follows:

[0058] C(X)=Concat(head1,...,head hd )W O (7)

[0059] Where: Concat represents the linear connection function; w o Represents a linear transformation matrix, which is used to concatenate the Shift-Attention values ​​of each head and map them back to the original dimension.

[0060] Step 6: Neural network regularization & output;

[0061] First, after obtaining the Shift-Attention value of each head, in order to alleviate the gradient vanishing and overfitting problems that may occur in the model, the residual connection method is used to solve the gradient vanishing problem; the Droppath method is used to solve the overfitting problem;

[0062] As an example, the Droppath method randomly discards some training instances in the residual connection during model training, thereby realizing differential model training and reducing the risk of overfitting of the model.

[0063] Then, the Shift-Attention value of each head after residual connection processing is normalized using layer normalization to improve the stability of neural network training and accelerate convergence;

[0064] Finally, the Sigmoid function is used as the output layer to output the result R(X).

[0065] As an example, the calculation formula of the output result R(X) is designed as follows:

[0066] R(X)=Sigmoid(LN(X+Dropout(C(X)))) (8)

[0067] A device for a highly robust DGA domain name detection algorithm, the device comprising:

[0068] A memory and a processor, wherein the memory stores a highly robust DGA domain name detection algorithm, and when the processor executes the highly robust DGA domain name detection algorithm, the problem that needs to be solved for a network domain name system in a real scenario can be achieved, namely, how to efficiently detect whether a query domain name is a DGA domain name on a DNS recursive resolver, divert useless attention, strengthen the complex and hidden character patterns and dependencies in the domain name string, effectively extract domain name features, and then cope with the noise caused by random characters in the domain name and the rapid evolution of the DGA family.

[0069] Beneficial effects of the present invention:

[0070] The SMAD proposed in the present invention can utilize the improved attention mechanism to mine the complex character patterns and relationships in the DGA domain names, improve the domain name detection accuracy, improve the robustness of the model facing unknown DGA domain names, and improve the detection rate of a single domain name while ensuring accurate DGA detection, thereby improving network security.

[0071] The present invention designs a new highly robust DGA domain name detection algorithm for the network domain name system; using the domain name string as the input sequence, an innovative attention transfer mechanism is adopted to update the model's attention allocation strategy, reduce the interference caused by noise in the domain name string, make the model adapt to the characteristics of different DGA domain names, and finally converge to a near-optimal detection model, optimize the detection performance, and improve the detection accuracy and generalization of malicious domain names.

[0072] The present invention designs an efficient attention transfer update allocation mechanism, starts from the perspective of deeply mining the complex and hidden character patterns and dependencies of domain names, finds the commonalities between DGA domain names, improves the model detection accuracy, enhances the model generalization ability, and realizes efficient network defense. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 The present invention is a highly robust DGA domain name detection algorithm and device detection algorithm flow structure schematic diagram.

[0074] Figure 2 The present invention is a highly robust DGA domain name detection algorithm and device for DGA detection algorithm applied to a local DNS recursive resolver.

[0075] Figure 3 The figure is a schematic diagram of the communication between a highly robust DGA domain name detection algorithm and an infected device of the present invention.

[0076] Figure 4 A schematic diagram of domain name encoding vector generation in Example 2 of a highly robust DGA domain name detection algorithm and device of the present invention.

[0077] Figure 5 A schematic diagram of generating word embedding vectors and position encoding vectors of a highly robust DGA domain name detection algorithm and device of the present invention.

[0078] Figure 6 The present invention is a highly robust DGA domain name detection algorithm and a schematic diagram of normalization after the character embedding vector and position encoding vector of the device are added.

[0079] Figure 7The figure is a schematic diagram of multi-head Shift-Attention calculation of a highly robust DGA domain name detection algorithm and device of the present invention.

[0080] Figure 8 This is a schematic diagram of the multi-head attention connection between a highly robust DGA domain name detection algorithm and a device of the present invention.

[0081] Fig. 9 The present invention is a highly robust DGA domain name detection algorithm and residual connection of the device and a Droppath operation schematic diagram.

[0082] Fig.10 A schematic diagram of result calculation of a highly robust DGA domain name detection algorithm and device of the present invention. DETAILED DESCRIPTION

[0083] Below, reference Figures 1 to 10 As shown, a highly robust DGA domain name detection algorithm and device, wherein:

[0084] A highly robust DGA domain name detection algorithm, including:

[0085] Step 1: Extract the domain name string;

[0086] Obtain the domain name string queried in each DNS query request in real time;

[0087] Step 2: Check whether the domain name string complies with RFC specifications;

[0088] According to the RFC specification, use regular expressions to check whether the domain name string meets the domain name specification. If it meets the domain name specification, proceed to the next step to continue identification; if it does not meet the domain name specification, directly block it and end the process;

[0089] As an example, the RFC specification refers to: RFC1035 regulations.

[0090] As an example, the regular expression is:

[0091] ^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*\.$; where:

[0092] “^” means matching the beginning of the domain name string;

[0093] "(?!-)" indicates negative lookahead, which asserts that the current position cannot be followed by a hyphen (-); that is, it ensures that the domain name string cannot start with a hyphen;

[0094] "[A-Za-z0-9-]{1,63}" means matching 1 to 63 characters, which can be uppercase or lowercase letters, numbers, or hyphens; this part is used to match the label of the domain name string;

[0095] "(?<!-)" indicates negative lookbehind, which asserts that the current position cannot be preceded by a hyphen (-); that is, it ensures that the domain name string cannot end with a hyphen;

[0096] "(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*": means matching a dot (.) followed by 1 to 63 letters, numbers, or hyphens, and these characters cannot start or end with a hyphen; this part is used to match subdomains and top-level domains in domain names, and can be repeated 0 or more times;

[0097] \.$ ensures that the domain name string matched by the regular expression ends with a period (.).

[0098] Step 3: Preprocess the domain name string;

[0099] First, take a single character in the domain name string as a unit and convert each character in the domain name string into a unique corresponding number; according to the definition of RFC1 035, the length of each domain name string shall not exceed 255 characters. For domain name strings with a length of less than 255 characters, fill them with 0 from the back to obtain the domain name encoding vector;

[0100] As an example, the conversion into a unique corresponding number is based on formula (1) and is designed as follows:

[0101] domain=[Char1, Char2,...,Char 255 ] (1)

[0102] Where: domain is the domain name encoding vector;

[0103] Char1 to Char 255 They represent the numbers after the domain name string at different positions is converted.

[0104] Secondly, after the domain name character string is converted into the domain name encoding vector, the domain name encoding vector is subjected to character embedding calculation to obtain a word embedding vector;

[0105] As an example, the character embedding calculation uses a learnable matrix: E∈R VxD; Used to convert the discrete numerical representation of formula (1) into a continuous, dense word embedding vector; where: E represents the learnable matrix, V represents the number of word embedding vectors, D represents the dimension of the word embedding vector, and E is a real number matrix with a dimension of V*D.

[0106] Finally, the position encoding calculation method is used to obtain the position encoding vector of the word embedding vector, and the position encoding vector will be added to the word embedding vector in the form of vector addition to obtain the encoded word embedding vector;

[0107] As an example, the calculation method of the position code is designed as follows:

[0108]

[0109] Where: i represents the index position of different characters in the word embedding vector, d model The word embedding vector is encoded using formula (2) for even index positions and formula (3) for odd index positions.

[0110] Step 4: Calculate the multi-head attention of the encoded word embedding vector input;

[0111] After obtaining the encoded word embedding vector, a multi-head Shift-Attention layer is formed by adopting a parallel structure of multiple Shift-Attention layers. The head calculation formula is used in combination with the Shift-Attention calculation mechanism to calculate each head attention of the encoded word embedding vector. The specific operations are as follows:

[0112] First, the query, key, and value weight matrices are divided according to the number of multiple heads to obtain the weight matrices required for calculation of each head, and the weight matrices are mapped to the global query, key, and value to obtain the query, key, and value of each head;

[0113] Secondly, a threshold t is set to sort the weight values ​​of the query and key calculated for each header;

[0114] Then, the weights of the weight values ​​ranked after the threshold t are summed to obtain a sum value, and the sum value is evenly distributed to the weights of the weight values ​​ranked before the threshold t, and the weights ranked after t are reset to 0;

[0115] Finally, get the Shift-Attention value of each head;

[0116] As an example, the head calculation formula is designed as follows, for the i-th head:

[0117]

[0118] in: are the weight matrices of the jth head; Q, K, and V represent the global query, key, and value, respectively; d is the dimension of the weight matrices, d h is the dimension of each different head output vector, and its calculation formula is designed as: Here, hd represents the number of heads.

[0119] As an example, the attention calculation mechanism of Shift-Attention is designed as follows:

[0120]

[0121] Where: Q', K', V' represent the incoming parameters query, key, and value respectively;

[0122] S F Represents the attention calculation formula of the Shift-Attention mechanism;

[0123] A tk Represents the element in the tth row and kth column of the matrix after the query and key are calculated;

[0124] AVG represents the summed average of the weight values ​​ranked after t;

[0125] Step 5: Connect multiple attention heads;

[0126] Connect the Shift-Attention values ​​of each head together through linear projection; and use C(X) to define the output of the connected Shift-Attention values ​​of each head;

[0127] As an example, the C(X) method is designed as follows:

[0128] C(X)=Concat(head1,...,head hd )W O (7)

[0129] Where: Concat represents the linear connection function; w o Represents a linear transformation matrix, which is used to concatenate the Shift-Attention values ​​of each head and map them back to the original dimension.

[0130] Step 6: Neural network regularization & output;

[0131] First, after obtaining the Shift-Attention value of each head, in order to alleviate the gradient vanishing and overfitting problems that may occur in the model, the residual connection method is used to solve the gradient vanishing problem; the Droppath method is used to solve the overfitting problem;

[0132] As an example, the Droppath method randomly discards some training instances in the residual connection during model training, thereby realizing differential model training and reducing the risk of overfitting of the model.

[0133] Then, the Shift-Attention value of each head after residual connection processing is normalized using layer normalization to improve the stability of neural network training and accelerate convergence;

[0134] Finally, the Sigmoid function is used as the output layer to output the result R(X).

[0135] As an example, the calculation formula of the output result R(X) is designed as follows:

[0136] R(X)=Sigmoid(LN(X+Dropout(C(X)))) (8)

[0137] A device for a highly robust DGA domain name detection algorithm, the device comprising:

[0138] A memory and a processor, wherein the memory stores a highly robust DGA domain name detection algorithm, and when the processor executes the highly robust DGA domain name detection algorithm, the problem that needs to be solved for a network domain name system in a real scenario can be achieved, namely, how to efficiently detect whether a query domain name is a DGA domain name on a DNS recursive resolver, divert useless attention, strengthen the complex and hidden character patterns and dependencies in the domain name string, effectively extract domain name features, and then cope with the noise caused by random characters in the domain name and the rapid evolution of the DGA family.

[0139] In order to better illustrate the design concept of the present invention, the specific principles are introduced in practice through specific embodiments 1 and 2 as follows:

[0140] Embodiment 1:

[0141] Assume that in a typical local area network environment, infected devices and normal devices try to communicate with external normal servers and malicious C&C servers (the C&C server is controlled by the attacker) through the DNS recursive resolver; the DNS recursive resolver will receive DNS resolution requests from both benign devices and infected devices. For the DNS recursive resolver, the content of each DNS request is in plain text, and each requested domain name string can be seen and processed.

[0142] Step 1: Extract the query domain name node115 from the log.

[0143] Step 2: According to the regular expression:

[0144] ^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*\.$

[0145] Verify whether the domain name complies with the domain name usage specifications. If the domain name is found not to comply with the naming specifications specified in RFC1035, the detection process will be exited directly.

[0146] Embodiment 2:

[0147] Step 1: Extract the query domain name increasedivide.net from the log.

[0148] Step 2: Verify whether the domain name complies with the domain name specification. The verification found that the domain name complies with the naming specification specified in RFC1035.

[0149] Step 3: Convert the characters in the input domain name into their corresponding unique numbers one by one, and then fill in the domain name string to generate a domain name encoding vector.

[0150] After the domain name is encoded, the encoded vector is calculated using character embedding to generate a word embedding vector, and a position encoding vector is generated according to the position of the character.

[0151] Add the character embedding vector and the position encoding vector. After adding, the encoded word embedding vector is normalized by layer.

[0152] Step 4: Use the Shift-Attention mechanism to calculate the attention of each head after the normalization. In this case, the number of heads is 8. Since multiple complex vector transformations are required to implement the Shift-Attention mechanism, only the important transformation results are described in this example. According to Formula 5 in Step 4 above, Formula 6 can be used to calculate the final vector that records the weight value.

[0153] Step 5: The calculated vector needs to be connected to multiple attention heads. The connected vector can be obtained by calculating according to Formula 7 in Step 5 above.

[0154] Step 6: After completing the Shift-Attention calculation, perform residual connection and Droppath operations, and the neural network regularizes the output results.

[0155] After normalization calculation, Linear fully connected layer and Sigmoid layer are used to activate the calculation to get the final result. This concludes Case 2.

[0156] The SMAD proposed in the present invention can utilize the improved attention mechanism to mine the complex character patterns and relationships in DGA domain names, improve the accuracy of domain name detection, improve the robustness of the model facing unknown DGA domain names, and ensure that the detection rate of a single domain name is improved while ensuring accurate DGA detection, thereby improving network security. The present invention is a novel highly robust DGA domain name detection algorithm designed for the network domain name system, which deeply mines the complex and hidden character patterns and dependencies of domain names, and innovatively updates the model's attention allocation strategy through an attention transfer mechanism, thereby reducing the interference caused by noise in the domain name string, and adapting the model to the characteristics of different DGA domain names, thereby achieving highly robust DGA domain name detection. The service model of the algorithm is as follows: Figure 2 As shown, the domain name queried by the local recursive resolver can be obtained in time, and the domain name can be detected using a fast and efficient detection algorithm to block malware communication and protect network security.

[0157] The above are only preferred embodiments of the present invention. It should be understood that the description of the above embodiments is only used to help understand the method and core ideas of the present invention, and is not used to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, etc. made within the ideas and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A highly robust DGA domain name detection algorithm, characterized in that: include: Step 1: Extract the domain name string; Obtain the domain name string queried in each DNS query request in real time; Step 2: Check whether the domain name string complies with the RFC specification. According to the RFC specification, use regular expressions to check whether the domain name string complies with the domain name specification. If it complies with the domain name specification, proceed to the next step to continue identification. If it does not comply with the domain name specification, directly block it and end the process. Step 3: Preprocess the domain name string; First, take a single character in the domain name string as a unit and convert each character in the domain name string into a unique corresponding number; according to the definition of RFC1035, the length of each domain name string shall not exceed 255 characters. For domain name strings with a length of less than 255 characters, fill them with 0 from the back to obtain the domain name encoding vector; Secondly, after the domain name character string is converted into the domain name encoding vector, the domain name encoding vector is subjected to character embedding calculation to obtain a word embedding vector; Finally, the position encoding calculation method is used to obtain the position encoding vector of the word embedding vector, and the position encoding vector will be added to the word embedding vector in the form of vector addition to obtain the encoded word embedding vector; Step 4: Calculate the multi-head attention of the input encoded word embedding vector; after obtaining the encoded word embedding vector, adopt a structure of multiple parallel Shift-Attention layers to form a multi-head Shift-Attention layer, and use the head calculation formula to calculate each head attention of the encoded word embedding vector; the specific operations are as follows: First, the query, key, and value weight matrices are divided according to the number of multiple heads to obtain the weight matrices required for calculation of each head, and the weight matrices are mapped to the global query, key, and value to obtain the query, key, and value of each head; Secondly, a threshold t is set to sort the weight values ​​of the query and key calculated for each header; Then, the weights of the weight values ​​ranked after the threshold t are summed to obtain a sum value, and the sum value is evenly distributed to the weights of the weight values ​​ranked before the threshold t, and the weights ranked after t are reset to 0; Finally, get the Shift-Attention value of each head; Step 5: Connect multiple attention heads; connect the Shift-Attention values ​​of each head together through linear projection; and use C(X) to define the output of the connected Shift-Attention values ​​of each head; Step 6: Neural network regularization & output; First, after obtaining the Shift-Attention value of each head, in order to alleviate the gradient vanishing and overfitting problems that may occur in the model, the residual connection method is used to solve the gradient vanishing problem; the Droppath method is used to solve the overfitting problem; Then, the Shift-Attention value of each head after residual connection processing is normalized using layer normalization to improve the stability of neural network training and accelerate convergence; Finally, the Sigmoid function is used as the output layer to output the result R(X).

2. A highly robust DGA domain name detection algorithm according to claim 1, characterized in that: The RFC specification refers to: RFC1035 regulations.

3. A highly robust DGA domain name detection algorithm according to claim 1, characterized in that: The regular expression is: ^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*\.$; where: "^" means matching the beginning of the domain name string; "(?!-)" indicates a negative lookahead, asserting that the current position cannot be followed by a hyphen -, i.e. ensuring that the domain name string cannot start with a hyphen; "[A-Za-z0-9-]{1,63}" means matching 1 to 63 characters, which can be uppercase or lowercase letters, numbers or hyphens; this part is used to match the label of the domain name string; "(?<!-)" indicates a negative lookbehind, asserting that the current position cannot be preceded by a hyphen -; that is, ensuring that the domain name string cannot end with a hyphen; "(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*": means matching a dot. followed by 1 to 63 letters, numbers, or hyphens, and these characters cannot start or end with a hyphen; this part is used to match subdomains and top-level domains in domain names, and can be repeated 0 or more times; \.$ ensures that the domain name string matched by the regular expression ends with a period.

4. A highly robust DGA domain name detection algorithm according to claim 1, characterized in that: The conversion into a unique corresponding number is based on formula 1 and is designed as follows: domain=[Char1,Char2,...,Char 255 ] Formula 1 Where: domain is the domain name encoding vector; Char1 to Char 255 They represent the numbers after the domain name string at different positions is converted.

5. A highly robust DGA domain name detection algorithm according to claim 1, characterized in that: The character embedding calculation uses a learnable matrix: E∈R VxD ; Used to convert the discrete numerical representation of Formula 1 into a continuous, dense word embedding vector; where: E represents the learnable matrix, V represents the number of word embedding vectors, D represents the dimension of the word embedding vector, and E is a real number matrix with a dimension of V*D.

6. A highly robust DGA domain name detection algorithm according to claim 1, characterized in that: The calculation method of the position encoding is designed as follows: Where: i represents the index position of different characters in the word embedding vector, d model The word embedding vector represents the encoding of even-numbered index positions using Formula 2 and the encoding of odd-numbered index positions using Formula 3.

7. A highly robust DGA domain name detection algorithm according to claim 1, characterized in that: The head calculation formula is designed as follows, for the i-th head: in: are the weight matrices of the jth head; Q, K, and V represent the global query, key, and value, respectively; d is the dimension of the weight matrices, d h is the dimension of each different head output vector, and its calculation formula is designed as: Among them, hd represents the number of heads; The attention calculation mechanism of Shift-Attention is designed as follows: Among them: Q', K', V' respectively represent the incoming parameters query, key, value; S F Represents the attention calculation formula of the Shift-Attention mechanism; A tk Represents the element in the tth row and kth column of the matrix after the query and key are calculated; AVG represents the summed average of the weight values ​​ranked after t.

8. A highly robust DGA domain name detection algorithm according to claim 1, characterized in that: The C(X) method has the following formula: C(X)=Concat(head1,...,head hd )W O Formula 7 Where: Concat represents the linear connection function; w o Represents a linear transformation matrix, which is used to concatenate the Shift-Attention values ​​of each head and map them back to the original dimension.

9. A highly robust DGA domain name detection algorithm according to claim 1, characterized in that: The Droppath method randomly discards some training instances in the residual connection during model training, and differential model training is implemented, thereby reducing the risk of overfitting of the model; the calculation formula of the output result R(X) is designed as follows: R(X)=Sigmoid(LN(X+Dropout(C(X)))) Formula 8.

10. A device for a highly robust DGA domain name detection algorithm, characterized in that: The device includes: a memory and a processor, wherein the memory stores a highly robust DGA domain name detection algorithm, and when the processor executes the highly robust DGA domain name detection algorithm described in any one of claims 1 to 9, the problem that needs to be solved for a network domain name system in a real scenario can be achieved, namely, how to efficiently detect whether a query domain name is a DGA domain name on a DNS recursive resolver, divert useless attention, strengthen complex and hidden character patterns and dependencies in a domain name string, effectively extract domain name features, and then cope with the noise caused by random characters in the domain name and the rapid evolution of the DGA family.

Images