A highly robust dga domain name detection method and apparatus

Abstract

The application provides a high-robust DGA domain name detection algorithm and device, which comprises the following steps: extracting a domain name string; checking whether the domain name string conforms to the RFC specification; preprocessing the domain name string; calculating the multi-head attention of the input coded word embedding vector; connecting the multi-head attention; connecting the Shift-Attention attention values of each head through linear projection; neural network regularization & output; the application deeply mines the complex and hidden character patterns and dependency relationships of domain names, realizes efficient detection of malicious domain names and high-performance DGA domain name detection, and simultaneously designs a DGA detection algorithm, which utilizes the multi-head attention mechanism to parallelly focus on multiple subspaces in the domain name string, so that the detection model can simultaneously capture the character combination, syntax structure and semantic pattern in the domain name, and significantly improves the detection accuracy and generalization ability.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security and artificial intelligence application, and particularly relates to a high-robustness DGA domain name detection method and device. BACKGROUND

[0002] The use of Domain Generation Algorithms (DGA) marks a new era of malware communication from passive communication to active communication; the core technology of DGA is to dynamically generate a large number of domain names with random strings through different generation algorithms; these domain names are used as a communication bridge between malware and its command and control servers (C&C).

[0003] Unlike the use of fixed domain names in the range, the core logic of DGA is to change the malicious communication node frequently by generating a large number of domain names in a short time, thereby effectively avoiding the static defense mechanism; in addition, the rapid evolution of DGA algorithm and the randomness of domain name string also significantly increase the difficulty of network defense system to detect and intercept DGA domain names; therefore, a new type of detection algorithm for accurately and efficiently identifying DGA domain names has become an urgent demand in the field of network security research.

[0004] In order to overcome the above technical deficiencies, the existing technical personnel assist in processing through a new type of DGA domain name identifier, which has the following advantages:

[0005] (1) Using the long-distance dependence capturing ability of the model, the complex DGA generated domain names are deeply understood and classified, so as to make the recognition span the entire domain name and improve the model recognition accuracy;

[0006] (2) Finding the commonality between DGA domain name strings, effectively processing the changes or noises of different DGA generation algorithms through attention transfer mechanism, and improving the model generalization ability.

[0007] (3) Effectively using the model parallel processing input sequence ability, significantly reducing the domain name detection time in large-scale network domain name system, and providing a real deployable solution for the existing DNS system;

[0008] However, this new type of DGA domain name identifier also has the following deficiencies:

[0009] (1) The DGA algorithm domain name generation rate is fast, and the new DGA algorithm evolution frequency is high, so how to make the model find the commonality of DGA domain names becomes a difficulty;

[0010] (2) The noise in the DGA domain name affects the model judgment, but it is still a sign of detecting whether the domain name is a DGA domain name, and how to transfer part of the attention away while retaining part of the attention for the model to judge becomes another problem. SUMMARY

[0011] In order to solve the above technical problems, the present application provides a kind of high robust DGA domain name detection method and equipment, relies on DNS recursive resolver, by deep mining complex and covert character mode and dependence of domain name, realize the efficient detection of malicious domain name and high performance DGA domain name detection, simultaneously, a kind of DGA detection method is designed, by recording query domain name and filling domain name string, and the character level embedding preprocessing mode is carried out to the domain name string to construct model input;According to Shift-Attention mechanism, the attention calculated each time is ranked, according to the threshold value set in advance, the invalid attention of the last ranking is evenly distributed to the attention of the first ranking, to filter the influence of noise;Utilize multi-head attention mechanism, and pay attention to multiple subspaces in domain name string in parallel, so that the detection model can capture character combination, syntax structure and semantic pattern in domain name at the same time, significantly improve the accuracy and generalization ability of detection.

[0012] A kind of high robust DGA domain name detection method and equipment, wherein:

[0013] A kind of high robust DGA domain name detection method, comprising:

[0014] Step 1, extraction of domain name string;

[0015] Real-time acquisition of the domain name string queried in each DNS query request;

[0016] Step 2, check whether the domain name string meets the RFC specification;

[0017] According to the RFC specification, use regular expression to check whether the domain name string meets the domain name specification, if it meets the domain name specification, go to the next step to continue to identify;If it does not meet the domain name specification, it is directly shielded, and the process is ended;

[0018] As an example, the RFC specification refers to: RFC1035 stipulates.

[0019] As an example, the regular expression is:

[0020] ^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*\.$;Wherein:

[0021] " " indicates the start of the match for the domain name string;

[0022] "(?<!-)" indicates a negative lookahead, asserting that the current position is not followed by a hyphen (-); i.e. ensuring that the domain name string does not start with a hyphen;

[0023] "[A-Za-z0-9-]{1,63}" indicates matching 1 to 63 characters, which can be uppercase or lowercase letters, numbers or hyphens; this part is used to match the label of the domain name string;

[0024] "(?<!-)" indicates a negative lookahead, asserting that the current position is not followed by a hyphen (-); i.e. ensuring that the domain name string does not start with a hyphen;

[0025] "(\.(?<!-)[A-Za-z0-9-]{1,63}(?<!-))*": indicates matching a dot (.), followed by 1 to 63 letters, numbers or hyphens, and these characters cannot start or end with a hyphen; this part is used to match the subdomain and top-level domain in the domain name, which can appear 0 or more times;

[0026] \.$ ensures that the domain name string matched by the regular expression ends with a period (.).

[0027] Step 3, domain name string preprocessing;

[0028] First, convert each character in the domain name string to a unique corresponding number in units of single characters in the domain name string; according to the definition of RFC1035, the length of each domain name string is not more than 255 characters, and for domain name strings with a length less than 255 characters, fill from the back with 0 to obtain the domain name encoding vector;

[0029] As an example, the conversion to a unique corresponding number is designed according to formula (1) as follows:

[0030] domain = [Char1, Char2,..., Char 255 ] (1)

[0031] Where: domain is the domain name encoding vector;

[0032] Char1 to Char 255 represent the converted numbers of the domain name string at different positions respectively.

[0033] Secondly, after the domain name string is converted into the domain name encoding vector, character embedding calculation is performed on the domain name encoding vector to obtain a word embedding vector;

[0034] As an example, the character embedding calculation employs a learnable matrix: E ∈ R VxD ; for converting the discrete numerical representation of formula (1) into a continuous and dense word embedding vector; wherein: E represents a learnable matrix, V represents the number of word embedding vectors, and D represents the dimension of the word embedding vector. The E is a real matrix with a dimension of V*D.

[0035] Finally, the position encoding vector of the word embedding vector is obtained by using the calculation method of the position encoding. The position encoding vector will be added to the word embedding vector in the form of vector addition to obtain the encoded word embedding vector.

[0036] As an example, the calculation method of the position encoding is designed as follows:

[0037]

[0038] wherein: i represents the index position of different characters in the word embedding vector, d model represents that the word embedding vector encodes even index positions using formula (2) and encodes odd index positions using formula (3).

[0039] Step 4, calculate the multi-head attention of the input encoded word embedding vector;

[0040] After obtaining the encoded word embedding vector, a parallel multiple Shift-Attention layer structure is used to form a multi-head Shift-Attention attention layer. Each head attention of the encoded word embedding vector is calculated by using the head calculation formula and combining the Shift-Attention attention calculation mechanism. The specific operation is as follows:

[0041] First, according to the number of multi-head heads, the query, key, and value weight matrices are divided respectively to obtain the weight matrics required for each head calculation. The weight matrics corresponding to the global query, key, and value are obtained to obtain the query, key, and value of each head.

[0042] Secondly, a threshold t is set, and the weight values calculated by the query and key of each head are sorted.

[0043] Then, the weight values ranked after the threshold t are summed to obtain a sum value, and the sum value is evenly distributed to the weight values ranked before the threshold t, while the weights ranked after the threshold t are set to 0.

[0044] Finally, the Shift-Attention attention value of each head is obtained.

[0045] As an example, the head calculation formula is designed as follows for the i-th head:

[0046]

[0047] wherein: are the weight matrices of the j-th head; Q, K, and V represent global query, key, and value, respectively; d is the dimension of the weight matrix, d h is the dimension of each different head output vector, and the calculation formula is designed as: wherein hd represents the number of heads.

[0048] As an example, the Shift-Attention attention calculation mechanism is designed as follows:

[0049]

[0050] wherein Q', K', and V' represent the input parameters query, key, and value, respectively.

[0051] S F represents the Shift-Attention mechanism attention calculation formula.

[0052] A tk represents the element in the t-th row and k-th column of the matrix after query and key calculation.

[0053] AVG represents the sum average of the weight values ranked after t.

[0054] Step 5, connecting multi-head attention.

[0055] The Shift-Attention attention values of each head are connected together through linear projection, and the C(X) method is used to define the output after the connection of the Shift-Attention attention values of each head.

[0056] As an example, the C(X) method is designed as follows:

[0057] C(X)=Concat(head1,..., head hd )W O (7)

[0058] where: Concat denotes a linear concatenation function; w o denotes a linear transformation matrix, used for mapping the Shift-Attention attention value of each head after concatenation back to the original dimension.

[0059] Step 6, neural network regularization and output;

[0060] First, after obtaining the Shift-Attention attention value of each head, in order to alleviate the problems of gradient disappearance and overfitting of the model, the method of residual connection is used to solve the problem of gradient disappearance; the Droppath method is used to solve the problem of overfitting;

[0061] As an example, the Droppath method randomly discards some training instances in the residual connection during model training, realizes differential model training, and thus reduces the risk of overfitting of the model.

[0062] Then, the layer normalization method is used to normalize the Shift-Attention attention value of each head after residual connection processing, so as to improve the stability of neural network training and accelerate the convergence speed;

[0063] Finally, the Sigmoid function is used as the output layer, and the output result R(X) is output.

[0064] As an example, the calculation formula of the output result R(X) is designed as follows:

[0065] R(X)=Sigmoid(LN(X+Dropout(C(X)))) (8)

[0066] A device of a high-robust DGA domain name detection method, the device comprises:

[0067] A memory and a processor, the memory stores a high-robust DGA domain name detection method, and the processor, when executing the high-robust DGA domain name detection method, can realize the problem needed to be solved for the network domain name system in a real scene, that is, how to efficiently detect whether a query domain name is a DGA domain name on a DNS recursive resolver, divert useless attention, strengthen complex and hidden character patterns and dependency relationships in the domain name string, effectively extract domain name features, and then cope with the noise brought by random characters in the domain name and the rapid evolution of DGA families.

[0068] The beneficial effects of the present application are:

[0069] The SMAD can mine complex character patterns and relationships in DGA domain names by improving the attention mechanism, improve domain name detection accuracy, improve the robustness of the model to unknown DGA domain names, ensure DGA detection accuracy, improve single domain name detection rate, and improve network security.

[0070] The application designs a new high-robust DGA domain name detection method for the network domain name system; uses domain name strings as input sequences, uses an innovative attention transfer mechanism to update the attention allocation strategy of the model, reduces the interference of noise in the domain name string, and makes the model adapt to the characteristics of different DGA domain names, finally converges to an approximately optimal detection model, optimizes the detection performance, and improves the detection accuracy and generalization of malicious domain names.

[0071] The application designs an efficient attention transfer update allocation mechanism, deeply mines the complex and hidden character patterns and dependency relationships of domain names, finds the commonness between DGA domain names, improves the model detection accuracy, improves the model generalization ability, and realizes efficient network defense. BRIEF DESCRIPTION OF DRAWINGS

[0072] Figure 1 The application is a high-robust DGA domain name detection method and device detection method flow structure diagram.

[0073] Figure 2 The application is a high-robust DGA domain name detection method and device DGA detection method diagram applied to a local DNS recursive resolver.

[0074] Figure 3 The application is a high-robust DGA domain name detection method and device infected device communication diagram.

[0075] Figure 4 The application is a high-robust DGA domain name detection method and device domain name encoding vector generation diagram of embodiment 2.

[0076] Figure 5 The application is a high-robust DGA domain name detection method and device word embedding vector and position encoding vector generation diagram.

[0077] Figure 6 The application is a high-robust DGA domain name detection method and device character embedding vector and position encoding vector addition and normalization diagram.

[0078] Figure 7 The application is a high-robust DGA domain name detection method and device multi-head Shift-Attention calculation diagram.

[0079] Figure 8 A schematic diagram of the multi-head attention connection of a highly robust DGA domain name detection method and device of the present invention.

[0080] Figure 9 A highly robust DGA domain name detection method and device, as well as a schematic diagram of Droppath operation, is shown in FIG.

[0081] Figure 10 A schematic diagram of result calculation of a highly robust DGA domain name detection method and device of the present invention. DETAILED DESCRIPTION

[0082] Below, reference Figures 1 to 10 As shown, a highly robust DGA domain name detection method and device, wherein:

[0083] A highly robust DGA domain name detection method, comprising:

[0084] Step 1: Extract the domain name string;

[0085] Obtain the domain name string queried in each DNS query request in real time;

[0086] Step 2: Check whether the domain name string complies with RFC specifications;

[0087] According to RFC specifications, regular expressions are used to check whether the domain name string complies with the domain name specifications. If it complies with the domain name specifications, it will proceed to the next step for identification; if it does not comply with the domain name specifications, it will be directly blocked and the process will end;

[0088] As an example, the RFC specification refers to: RFC1035.

[0089] As an example, the regular expression is:

[0090] ^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*\.$; where:

[0091] “^” means matching the beginning of the domain name string;

[0092] "(?!-)" indicates a negative lookahead, which asserts that the current position cannot be followed by a hyphen (-); that is, it ensures that the domain name string cannot start with a hyphen;

[0093] "[A-Za-z0-9-]{1,63}" means matching 1 to 63 characters, which can be uppercase or lowercase letters, numbers or hyphen; this part is used to match the label of the domain name string;

[0094] "(?<!-)" means negative lookbehind, which asserts that the current position cannot be preceded by a hyphen (-); that is, it ensures that the domain name string cannot end with a hyphen;

[0095] "(\.(?<!-)[A-Za-z0-9-]{1,63}(?<!-))*": means matching a dot (.), followed by 1 to 63 letters, numbers or hyphen, and these characters cannot start or end with a hyphen; this part is used to match the subdomain and top-level domain name in the domain name string, which can appear 0 times or more;

[0096] \.$ ensures that the domain name string matched by the regular expression ends with a period (.).

[0097] Step 3, domain name string preprocessing;

[0098] First, convert each character in the domain name string into a unique corresponding number in units of single characters in the domain name string; according to the definition of RFC1035, the length of each domain name string is not more than 255 characters, and the domain name string with a length less than 255 characters is filled with 0 from the back to obtain the domain name encoding vector;

[0099] As an example, the conversion into a unique corresponding number is designed according to formula (1) as follows:

[0100] domain = [Char1, Char2,..., Char 255 ] (1)

[0101] Where: domain is the domain name encoding vector;

[0102] Char1 to Char 255 represent the converted numbers of the domain name string at different positions respectively.

[0103] Secondly, after the domain name string is converted into the domain name encoding vector, the character embedding calculation is performed on the domain name encoding vector to obtain the word embedding vector;

[0104] As an example, the character embedding calculation uses a learnable matrix: E ∈ R VxD; for converting the numerical representation of formula (1) into a continuous, dense word embedding vector; wherein: E represents a learnable matrix, V represents the number of word embedding vectors, D represents the dimension of the word embedding vector, and E is a real number matrix with a dimension of V*D.

[0105] Finally, the position encoding vector of the word embedding vector is obtained using the calculation method of the position encoding, and the position encoding vector is added to the word embedding vector in the form of vector addition to obtain the encoded word embedding vector.

[0106] As an example, the calculation method of the position encoding is designed as follows:

[0107]

[0108] wherein: i represents the index position of different characters in the word embedding vector, d model represents that the word embedding vector encodes even index positions using formula (2) and encodes odd index positions using formula (3).

[0109] Step 4, calculating the multi-head attention of the input encoded word embedding vector;

[0110] After obtaining the encoded word embedding vector, a parallel multiple Shift-Attention layer structure is adopted to form a multi-head Shift-Attention attention layer, and each head attention of the encoded word embedding vector is calculated using the head calculation formula combined with the Shift-Attention attention calculation mechanism. The specific operation is as follows:

[0111] First, the query, key, and value weight matrices are divided according to the number of multi-head heads to obtain the weight matrics required for each head calculation, and the weight matrics corresponding to the global query, key, and value are obtained to obtain the query, key, and value of each head.

[0112] Second, a threshold t is set, and the weight values calculated from the query and key of each head are sorted.

[0113] Then, the weights ranked after the threshold t are added to obtain an addition value, and the addition value is then evenly distributed to the weights ranked before the threshold t, while the weights ranked after t are set to 0.

[0114] Finally, the Shift-Attention attention value of each head is obtained.

[0115] As an example, the head computation formula is designed as follows for the i-th head:

[0116]

[0117] wherein: are the weight matrices of the j-th head; Q, K, V represent the global query, key, and value, respectively; d is the dimension of the weight matrics, d h is the dimension of each different head output vector, which is designed as: wherein hd represents the number of heads.

[0118] As an example, the Shift-Attention attention mechanism is designed as follows:

[0119]

[0120] wherein: Q', K', V' represent the incoming parameter query, key, and value, respectively;

[0121] S F represents the Shift-Attention mechanism attention formula;

[0122] A tk represents the element in the t-th row and k-th column of the matrix after the query and key computation;

[0123] AVG represents the summation average of the weight values ranked after t;

[0124] Step 5, connecting multi-head attention;

[0125] The Shift-Attention attention values of each head are connected together through linear projection; and the C(X) method is used to define the output after the Shift-Attention attention value connection of each head.

[0126] As an example, the C(X) method is designed as follows:

[0127] C(X) = Concat(head1,..., head hd )W O (7)

[0128] wherein: Concat represents a linear connection function; w o represents a linear transformation matrix, which is used to map the concatenated Shift-Attention attention values of each head back to the original dimension.

[0129] Step 6: Neural network regularization and output;

[0130] First, after obtaining the Shift-Attention value for each head, to alleviate the possible gradient vanishing and overfitting problems of the model, the residual connection method is used to solve the gradient vanishing problem; the Droppath method is used to solve the overfitting problem;

[0131] As an example, the Droppath method randomly discards some training instances in the residual connection during model training, thereby achieving differential model training and reducing the risk of overfitting of the model.

[0132] Then, layer normalization is used to normalize the Shift-Attention value of each head after residual connection processing to improve the stability of neural network training and accelerate convergence;

[0133] Finally, the Sigmoid function is used as the output layer to output the result R(X).

[0134] As an example, the calculation formula of the output result R(X) is designed as follows:

[0135] R(X)=Sigmoid(LN(X+DRopout(C(X)))) (8)

[0136] A highly robust DGA domain name detection method device, the device comprising:

[0137] A memory and a processor are provided. The memory stores a highly robust DGA domain name detection method. When the processor executes the highly robust DGA domain name detection method, it can address issues that need to be addressed in real-world network domain name systems, namely, how to efficiently detect whether a query domain name is a DGA domain name on a DNS recursive resolver, divert useless attention, enhance complex and hidden character patterns and dependencies within domain name strings, effectively extract domain name features, and thus cope with noise caused by random characters in domain names and the rapid evolution of the DGA family.

[0138] In order to better illustrate the design concept of the present invention, the specific principles are introduced in practice through specific examples 1 and 2 as follows:

[0139] Example 1:

[0140] Assume that in a typical local area network environment, infected devices and normal devices attempt to communicate with external normal servers and malicious C&C servers (the C&C servers are controlled by the attacker) through the DNS recursive resolver; the DNS recursive resolver will receive DNS resolution requests from both benign devices and infected devices at the same time. For the DNS recursive resolver, the content of each DNS request is plain text, and each requested domain name string can be seen and processed.

[0141] Step 1: Extract the query domain name node115 from the log.

[0142] Step 2: According to the regular expression:

[0143] ^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*\.$

[0144] Verify that the domain name complies with the domain name usage specifications. If the domain name is found not to comply with the naming specifications specified in RFC1035, the detection process will be terminated directly.

[0145] Example 2:

[0146] Step 1: Extract the query domain name increasedivide.net from the log.

[0147] Step 2: Verify that the domain name complies with the domain name specifications. The verification found that the domain name complies with the naming specifications specified in RFC1035.

[0148] Step 3: Convert the characters in the input domain name into their corresponding unique numbers one by one, and then fill them with the domain name string to generate the domain name encoding vector.

[0149] After the domain name is encoded, the encoded vector is calculated using character embedding to generate a word embedding vector, and a position encoding vector is generated according to the position of the character.

[0150] Add the character embedding vector and the position encoding vector. The encoded word embedding vector obtained after addition is subjected to layer normalization.

[0151] Step 4: Apply the normalized vector to the Shift-Attention mechanism to calculate the attention of each head. In this example, there are eight heads. Because implementing the Shift-Attention mechanism requires multiple complex vector transformations, only the important transformation results are presented in this example. Using Equations 5 and 6 from Step 4 above, we can obtain the final vector containing the weight values.

[0152] Step 5: the completed vector needs to be connected with multi-head attention, and the connected vector can be obtained according to formula 7 in step 5 in the foregoing.

[0153] Step 6: after the shift-attention calculation is completed, residual connection and drop path operation are performed, and a neural network regularization specification output result is obtained.

[0154] After normalization calculation, a linear full connection layer and a Sigmoid layer are used for activation calculation to obtain a final result, and thus the case 2 is completed.

[0155] The SMAD can mine complex character patterns and relationships in the DGA domain name by using the improved attention mechanism, improve the domain name detection accuracy, improve the robustness of the model to unknown DGA domain names, ensure the detection accuracy of the DGA, and improve the detection rate of a single domain name, thereby improving the network security; the present application is a novel high-robust DGA domain name detection method designed for the network domain name system, which deeply mines complex and hidden character patterns and dependency relationships of domain names, innovatively updates the attention allocation strategy of the model through the attention shift mechanism, reduces the interference of noise in the domain name string, makes the model adapt to the characteristics of different DGA domain names, and realizes high-robust DGA domain name detection. The service mode of the method is as shown in Figure 2 The method can obtain the queried domain name of the local recursive resolver in time, detect the domain name by using a fast and efficient detection method, block malicious software communication, and protect network security.

[0156] The above only describes preferred embodiments of the present application, and it should be understood that the above embodiment description is only used to help understand the method of the present application and its core idea, and does not limit the protection scope of the present application, and any modification, equivalent replacement, etc. within the idea and principle of the present application should be included in the protection scope of the present application.

Claims

1. A highly robust DGA domain name detection method, characterized in that: include: Step 1: Extract the domain name string; Obtain the domain name string queried in each DNS query request in real time; Step 2: Check whether the domain name string complies with RFC specifications. Based on the RFC specifications, use regular expressions to check whether the domain name string complies with the domain name specifications. If it complies with the domain name specifications, proceed to the next step for identification. If it does not comply with the domain name specifications, it will be directly blocked and the process ends. Step 3: Preprocess the domain name string; First, each character in the domain name string is converted into a unique corresponding number. According to RFC1035, the length of each domain name string does not exceed 255 characters. Domain names with a length of less than 255 characters are padded with zeros to obtain the domain name encoding vector. Secondly, after the domain name string is converted into the domain name encoding vector, the domain name encoding vector is subjected to character embedding calculation to obtain a word embedding vector; Finally, the position encoding calculation method is used to obtain the position encoding vector of the word embedding vector. The position encoding vector will be added to the word embedding vector in the form of vector addition to obtain the encoded word embedding vector; Step 4: Calculate the multi-head attention of the input encoded word embedding vector; after obtaining the encoded word embedding vector, adopt the structure of multiple parallel Shift-Attention layers to form a multi-head Shift-Attention attention layer, and use the head calculation formula to calculate the attention of each head of the encoded word embedding vector; the specific operation is as follows: First, the query, key, and value weight matrices are divided according to the number of multi-headers to obtain the weight matrices required for calculation of each head. The weight matrices are mapped to the global query, key, and value to obtain the query, key, and value of each head; Secondly, a threshold t is set to sort the weight values ​​of the query and key calculated for each header; Then, the weights ranked after the threshold t are summed to obtain a sum value, and the sum value is evenly distributed to the weights ranked before the threshold t, while the weights ranked after t are reset to 0; Finally, get the Shift-Attention value of each head; Step 5: Connect multiple attention heads; connect the Shift-Attention values ​​of each head through linear projection; and use C(X) to define the output of the connected Shift-Attention values ​​of each head; Step 6: Neural network regularization and output; First, after obtaining the Shift-Attention value of each head, residual connection and Droppath operation are performed; Then, the Shift-Attention value of each head after residual connection processing is normalized using layer normalization; Finally, the Sigmoid function is used as the output layer to output the result R(X).

2. A highly robust DGA domain name detection method according to claim 1, characterized in that: The RFC specification refers to: RFC1035 regulations.

3. A highly robust DGA domain name detection method according to claim 1, characterized in that: The regular expression is: ^(?!-)[A-Za-z0-9-]{1,63}(?<!-)(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*\.$; where: "^" means matching the beginning of the domain name string; "(?!-)" indicates a negative lookahead, asserting that the current position cannot be followed by a hyphen "-", i.e. ensuring that the domain name string cannot start with a hyphen; "[A-Za-z0-9-]{1,63}" means matching 1 to 63 characters, which can be uppercase or lowercase letters, numbers or hyphens; this part is used to match the label of the domain name string; "(?<!-)" indicates a negative lookbehind, asserting that the current position cannot be preceded by a hyphen "-", i.e. ensuring that the domain name string cannot end with a hyphen; "(\.(?!-)[A-Za-z0-9-]{1,63}(?<!-))*": means matching a dot ".", followed by 1 to 63 letters, numbers or hyphens, and these characters cannot start or end with a hyphen; this part is used to match subdomains and top-level domains in domain names and can be repeated 0 or more times; "\.$" ensures that the domain name string matched by the regular expression ends with a period.

4. A highly robust DGA domain name detection method according to claim 1, characterized in that: The conversion into a unique corresponding number is based on formula 1 and is designed as follows: domain=[Char1,Char2,...,Char 255 ] Formula 1 Where: domain is the domain name encoding vector; Char1 to Char 255 They represent the numbers converted from the domain name string at different positions.

5. A highly robust DGA domain name detection method according to claim 4, characterized in that: The character embedding calculation uses a learnable matrix: E∈R VxD ; Used to convert the discrete numerical representation of Formula 1 into a continuous, dense word embedding vector; where: E represents the learnable matrix, V represents the number of word embedding vectors, D represents the dimension of the word embedding vector, and E is a real number matrix with a dimension of V*D.

6. A highly robust DGA domain name detection method according to claim 1, characterized in that: The calculation method of the position code is designed as follows: Where: i represents the index position of different characters in the word embedding vector, d model Represents the word embedding vector, using Formula 2 to encode the even index positions and Formula 3 to encode the odd index positions.

7. A highly robust DGA domain name detection method according to claim 5, characterized in that: The head calculation formula is designed as follows, for the jth head: in: are the weight matrices of the jth head; Q, K, and V represent the global query, key, and value respectively; d is the dimension of the weight matrices, d h is the dimension of each head output vector, and its calculation formula is designed as: Among them, hd represents the number of heads; The attention calculation mechanism of the Shift-Attention is designed as follows: Among them: Q', K', V' respectively represent the incoming parameters query, key, and value; A tk Represents the element in row t and column k of the weight matrix after the query and key are calculated; AVG represents the sum average of the weight values ​​ranked after t.

8. A highly robust DGA domain name detection method according to claim 1, characterized in that: The C(X) method is designed as follows: C(X)=Concat(head1, ..., head hd )W O Formula 7 Where: Concat represents the linear connection function; W o Represents a linear transformation matrix, which is used to concatenate the Shift-Attention values ​​of each head and map them back to the original dimension.

9. A highly robust DGA domain name detection device, characterized in that: The device includes: a memory and a processor, wherein the processor is configured to execute the highly robust DGA domain name detection method according to any one of claims 1 to 8.

Images