Malicious domain name automatic detection method and device, equipment and medium

Abstract

The invention discloses a malicious domain name automatic detection method and device, equipment and a medium. The method comprises the following steps: collecting flow data in a set time period, and extracting DNS protocol data from the flow data; analyzing all the DNS protocol data by using analysis software to obtain DNS log data corresponding to each piece of DNS protocol data; performing data cleaning on the DNS log data, and extracting secondary domain name information from the DNS log data after data cleaning; and carrying out black and white list matching on the second-level domain name information, taking the second-level domain name information which does not exist in a black and white list as a to-be-detected domain name, inputting the to-be-detected domain name into the MLP model to carry out DGA detection, and judging whether the to-be-detected domain name is a malicious domain name or not. According to the embodiment of the invention, accurate classification of normal domain names and DGA malicious domain names is realized, and a neural network multilayer perceptron model is continuously optimized, so that the neural network multilayer perceptron model flexibly adapts to network environment changes and provides support for network security situation awareness.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device, equipment and medium for automatically detecting malicious domain names. Background Art

[0002] With the rapid development of the Internet, the IPv6 protocol has a natural advantage in dealing with some network attacks due to its huge address space, but it also brings new security challenges. Among them, DGA malicious domain names are a technical means by which attackers use specific algorithms to generate a large number of pseudo-random domain names to evade domain name blacklist detection. These domain names are usually used for botnet C&C (Command and Control) server communication, which seriously threatens network security.

[0003] In the existing technology, detection algorithms based on DNS graph mining, support vector machines and Markov chain algorithms have been used to identify DGA malicious domain names, but there are problems such as low detection efficiency and high false positive rate. Especially in the IPv6 environment, due to the complexity of the address space and changes in the security mechanism of the protocol itself, traditional detection methods face greater challenges. Summary of the invention

[0004] Based on this, the present invention provides a method, device, equipment and medium for automatically detecting malicious domain names to solve the problem of low accuracy of traditional DGA malicious domain name detection methods.

[0005] In a first aspect, an embodiment of the present invention provides a method for automatically detecting malicious domain names, the method comprising:

[0006] Collecting DNS traffic data of a domain name resolution system within a set time period, and extracting DNS protocol data from the DNS traffic data;

[0007] Utilize the set parsing software to parse all DNS protocol data and obtain the DNS log data corresponding to each DNS protocol data;

[0008] Clean each DNS log data, and extract secondary domain name information from the cleaned DNS log data;

[0009] The extracted second-level domain name information is matched with the blacklist and whitelist, and the second-level domain name information that does not exist in the blacklist and whitelist is used as the domain name to be detected and input into the pre-trained multi-layer perceptron MLP model for domain name generation algorithm DGA detection to determine whether the domain name to be detected is a malicious domain name.

[0010] In a second aspect, an embodiment of the present invention provides a device for automatically detecting malicious domain names, the device comprising:

[0011] A DNS protocol data extraction module is used to collect DNS traffic data of a domain name resolution system within a set time period, and extract DNS protocol data from the DNS traffic data;

[0012] A DNS protocol data parsing module is used to parse all DNS protocol data using the set parsing software to obtain DNS log data corresponding to each DNS protocol data;

[0013] The secondary domain name information extraction module is used to clean the DNS log data and extract the secondary domain name information from the DNS log data after data cleaning;

[0014] The malicious domain name detection module is used to match the extracted second-level domain name information with the blacklist and whitelist, and use the second-level domain name information that does not exist in the blacklist and whitelist as the domain name to be detected, and input it into the pre-trained multi-layer perceptron MLP model to perform domain name generation algorithm DGA detection to determine whether the domain name to be detected is a malicious domain name.

[0015] In a third aspect, an embodiment of the present invention provides an electronic device, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute a malicious domain name automatic detection method described in any embodiment of the present invention.

[0019] In a fourth aspect, a computer-readable storage medium is also provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a method for automatically detecting malicious domain names as described in any embodiment of the present invention when executed.

[0020] The technical solution of the embodiment of the present invention adopts a neural network multi-layer perceptron MLP model and combines it with the analysis method of the bag-of-words model to extract domain name features, thereby achieving accurate classification of normal domain names and DGA malicious domain names. At the same time, the neural network multi-layer perceptron model can be continuously optimized through continuous updating of domain name blacklists and whitelists, and by regularly selecting domain name data in a specific time period for retraining and evaluation, it can flexibly adapt to changes in the network environment, thereby providing strong support for network security situation awareness.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 This is a flow chart of a method for automatically detecting malicious domain names provided according to Embodiment 1 of the present invention;

[0024] Figure 2 is a flow chart of another method for automatically detecting malicious domain names provided according to the second embodiment of the present invention;

[0025] Figure 3 This is a schematic diagram of the structure of a malicious domain name automatic detection device provided according to Embodiment 3 of the present invention;

[0026] Figure 4 It is a structural schematic diagram of an electronic device for implementing a method for automatically detecting malicious domain names according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1 This is a flowchart of a DGA malicious domain name method provided by the first embodiment of the present invention. This embodiment can be applied to effectively detect DGA malicious domain names in the network. The method can be executed by a DGA malicious domain name method device, which can be implemented in the form of hardware and / or software. The device can be configured in an IPv6 network domain name detection system based on artificial intelligence. Figure 1 As shown, the method includes:

[0031] S110, collecting domain name resolution system DNS traffic data within a set time period, and extracting DNS protocol data from the DNS traffic data.

[0032] DNS traffic data DNS is the query and response between the device and the DNS server. When the user clicks on a link or enters a domain name in the browser, the user's device will send a DNS request or query to the DNS server to search for the corresponding IP address. In the embodiment of the present invention, by configuring the application layer protocol filtering strategy, Zeek software is deployed using the traffic collection device to collect, filter and parse the DNS traffic data. DNS protocol data can be obtained by performing domain name resolution on the DNS traffic data. DNS protocol data is an application layer protocol.

[0033] S120, using the setting analysis software to analyze all DNS protocol data, and obtain DNS log data corresponding to each DNS protocol data.

[0034] The Zeek time engine module in the Zeek software aggregates DNS protocol data into high-level events and records key information in the traffic in the form of log files. The DNS log data contains relevant application layer information, such as request content query, request type qtype, and response code rcode.

[0035] S130: Clean each DNS log data, and extract secondary domain name information from the cleaned DNS log data.

[0036] The data cleaning process will filter out log domain names with irregularities, duplications, and missing fields to obtain processable DNS log data. In computer networks, domain name levels can be divided into up to five levels. The top-level domain name refers to the first label from the right, the second-level domain name refers to the second label from the right, and so on from right to left.

[0037] Optionally, before performing blacklist and whitelist matching on the secondary domain name information after data cleaning, the following may also be included:

[0038] Collect a preset number of normal domain names from a preset legitimate website to obtain a domain name whitelist, and collect a preset number of DGA malicious domain names from an open source website to obtain a domain name blacklist;

[0039] A combination of the domain name whitelist and the domain name blacklist is determined as the black and white list.

[0040] In an embodiment of the present invention, the preset legitimacy website can be the www.Alexa.com website, and the top ten thousand domain names in the www.Alexa.com website are used as normal domain names in the experiment process and added to the domain name whitelist; the DGA malicious domain names are collected from open source data, and the collected DGA malicious domain names are added to the domain name blacklist, and the domain name blacklist and the domain name whitelist are merged to form a black and white list for pre-training.

[0041] S140, matching the extracted second-level domain name information with the blacklist and whitelist, taking the second-level domain name information that does not exist in the blacklist and whitelist as the domain name to be detected, and inputting it into the pre-trained multi-layer perceptron MLP model to perform domain name generation algorithm DGA detection to determine whether the domain name to be detected is a malicious domain name.

[0042] The domain name generation algorithm is a technical means that uses a specific algorithm to generate a pseudo-random domain name sequence to evade domain name blacklist detection. In the embodiment of the present invention, a neural network multilayer perceptron (MLP) detection model can be used to identify DGA malicious domain names for the domain names to be detected.

[0043] Optionally, after determining whether the domain name to be detected is a malicious domain name, the following steps may also be performed:

[0044] If the domain name to be detected is determined to be a malicious domain name, the domain name to be detected is added to the domain name blacklist as a DGA malicious domain name;

[0045] If the domain name to be detected is determined to be a non-malicious domain name, the domain name to be detected is added to the domain name whitelist as a normal domain name.

[0046] The embodiment of the present invention creatively proposes a self-learning module for domain name data, aiming to continuously optimize the MLP model, thereby improving the monitoring effect of the MLP model in a specific environment. Specifically, the new domain name data collected in real time is added to the corresponding black and white list library according to the detection results to improve the query matching effect of subsequent black and white lists.

[0047] The embodiment of the present invention adopts a neural network multi-layer perceptron MLP model and combines it with the analysis method of the bag-of-words model to extract domain name features, thereby achieving accurate classification of normal domain names and DGA malicious domain names. At the same time, the neural network multi-layer perceptron model can be continuously optimized through continuous updating of domain name blacklists and whitelists, and retraining and evaluation can be performed by regularly selecting domain name data in a specific time period, so that it can flexibly adapt to changes in the network environment, thereby providing strong support for network security situation awareness.

[0048] Embodiment 2

[0049] Figure 2 This is a flow chart of another method for automatically detecting malicious domain names provided in the second embodiment of the present invention. This embodiment is refined based on the above embodiment. Figure 2 As shown, the method specifically includes:

[0050] S210: Collecting domain name resolution system DNS traffic data within a set time period, and extracting DNS protocol data from the DNS traffic data.

[0051] S220, using the setting parsing software to parse all DNS protocol data, and obtain DNS log data corresponding to each DNS protocol data.

[0052] S230: Clean each DNS log data, and extract secondary domain name information from the cleaned DNS log data.

[0053] S240. Match the extracted secondary domain name information with the blacklist and whitelist, convert each text-type domain name included in the blacklist and whitelist into a numerical domain name, and use a preset word segmentation model to extract domain name features for each numerical domain name to obtain domain name vector data corresponding to each domain name; wherein the domain name vector data of each domain name is pre-added with a data label according to the domain name whitelist or domain name blacklist to which it belongs.

[0054] Among them, for the pre-trained multi-layer perceptron MLP model, since the data in the blacklist and whitelist are domain name data, which are text data, the data needs to be pre-processed before using the neural network multi-layer perceptron model for training, and the text data is converted into numerical data. The 2-gram word segmentation model can be used to extract domain name features and convert them into vector data. Specifically, the vector data in the domain name whitelist can be marked as 0, and the vector data in the domain name blacklist can be marked as 1.

[0055] S250, dividing the domain name vector data corresponding to each domain name into a training set and a test set, and training the MLP model that meets the performance requirements based on the training set and the test set.

[0056] The domain name data is divided into samples to construct training sets and test sets, which are input into the MLP model for training, and the test set is used to evaluate the training effect of the MLP model.

[0057] Optionally, dividing the domain name vector data corresponding to each domain name into a training set and a test set, and training the MLP model that meets the performance requirements based on the training set and the test set may include:

[0058] Input the domain name vector data in the training set into the initial MLP model after parameter adjustment to perform data fitting and obtain the MLP model with the minimum loss;

[0059] Input each domain name data in the test set into the MLP model with the minimum loss to evaluate the prediction results, and obtain the model evaluation results;

[0060] According to the model evaluation result, the MLP model with the smallest loss is iteratively updated until the MLP model that meets the performance requirements is obtained.

[0061] The characteristic of the MLP model is that a complex model is constructed by adjusting the number of hidden layers and the number of hidden units in each hidden layer. The core is to continuously adjust the weights and bias terms through the back-propagation algorithm to minimize the loss function. The back-propagation algorithm is an optimization algorithm based on gradient descent. It calculates the gradient of the loss function with respect to the node weight and updates the parameters along the gradient direction to minimize the prediction error of the model on the training data.

[0062] After obtaining the MLP model with the smallest loss, the test set is input into the MLP model with the smallest loss to obtain the prediction result, and the prediction result of the test set is corrected to verify the prediction accuracy of the MLP model.

[0063] Further, each domain name data in the test set is input into the MLP model with the minimum loss to evaluate the prediction result, and the model evaluation result is obtained, which may include:

[0064] The domain name data in the domain name blacklist in the test set is used as the actual positive sample, and the domain name data in the domain name whitelist in the test set is used as the actual negative sample, and is input into the MLP model with the minimum loss, so as to obtain the predicted positive sample whose prediction result is the DGA malicious domain name and the predicted negative sample whose prediction result is the normal domain name;

[0065] The model evaluation results are obtained using actual positive samples, predicted positive samples, actual negative samples and predicted negative samples with precision, recall and accuracy as evaluation indicators.

[0066] In an embodiment of the present invention, a binary classification problem is used to calculate the model evaluation result. Specifically, the binary classification prediction results may include: the actual positive sample is predicted as the predicted positive sample TP, the actual positive sample is predicted as the predicted negative sample FN, the actual negative sample is predicted as the predicted negative sample TN, and the actual negative sample is predicted as the predicted positive sample FP.

[0067] Specifically, the precision rate is: the ratio of the number of samples that are actually positive samples and predicted to be positive samples to the total predicted positive samples, that is, TP / (TP+FP); the recall rate is: the ratio of the number of samples that are actually positive samples and predicted to be positive samples to the total number of actual positive samples (TP / TP+FN); the accuracy rate refers to the ratio of the number of samples correctly classified by the classifier to the total number of samples, that is, (TP+TN) / (TP+FN+TN+FP).

[0068] Optionally, before inputting the domain name vector data in the training set into the initial MLP model after parameter adjustment for data fitting, the following steps may also be included:

[0069] Import the built-in initial MLP model in the neural network library in the specified open source learning library;

[0070] In the initial MLP model, the hidden layer scale parameters of the multilayer perceptron classifier are redefined to obtain an initial MLP model with two hidden layers, 5 nodes in the first hidden layer, and 2 nodes in the second hidden layer.

[0071] In an embodiment of the present invention, the built-in initial MLP model is imported from the Neural_network library of Sklearn, and the input layer of the MLP model is the featurization vector data of the domain name data after word segmentation. Among them, MIPClassifier is a classifier of the neural network multi-layer perceptron. The classifier has many built-in parameters, such as the number of hidden layers, activation function, optimization weight method, etc. The setting of each parameter needs to be optimized and adjusted accordingly according to the specific data. For example, in the MIPClassifier classifier, the hidden layer scale parameter hidden_layer_sizes is defined. After adjusting the model parameters, it is determined that when the hidden layer is designed to be 2 layers and the number of nodes is 5 and 2 respectively, the model effect is better. Therefore, hidden_layer_sizes=(5,2) is set to obtain the initial MLP model after parameter adjustment.

[0072] S260: The secondary domain name information that does not exist in the blacklist and whitelist is used as the domain name to be detected, and is input into a pre-trained multi-layer perceptron MLP model to perform detection using a domain name generation algorithm DGA to determine whether the domain name to be detected is a malicious domain name.

[0073] The technical solution of the embodiment of the present invention mainly explains the pre-training work of the MLP model by refining the overall solution, including extracting secondary domain name data, blacklist and whitelist matching, domain name data sample division, initial MLP model parameter adjustment, and model prediction result evaluation using binary classification. If the model prediction result is close to the actual result, it ensures that the MLP model can effectively detect DGA malicious domain names in the network, which not only improves the detection efficiency of malicious domain names but also improves the detection accuracy, which helps to improve the security protection capabilities of the entire network.

[0074] Embodiment 3

[0075] Figure 3 This is a schematic diagram of the structure of a fault troubleshooting device for a continuity test provided by the third embodiment of the present invention. Figure 3 As shown, the device comprises:

[0076] A DNS protocol data extraction module 310 is used to collect DNS traffic data of a domain name resolution system within a set time period, and extract DNS protocol data from the DNS traffic data;

[0077] The DNS protocol data parsing module 320 is used to parse all DNS protocol data using the set parsing software to obtain DNS log data corresponding to each DNS protocol data;

[0078] The secondary domain name information extraction module 330 is used to clean each DNS log data and extract the secondary domain name information from the DNS log data after the data cleaning;

[0079] The malicious domain name detection module 340 is used to match the extracted second-level domain name information with the blacklist and whitelist, and use the second-level domain name information that does not exist in the blacklist and whitelist as the domain name to be detected, and input it into the pre-trained multi-layer perceptron MLP model to perform domain name generation algorithm DGA detection to determine whether the domain name to be detected is a malicious domain name.

[0080] The embodiment of the present invention adopts a neural network multi-layer perceptron MLP model and combines the analysis method of the bag-of-words model to extract domain name features, thereby achieving accurate classification of normal domain names and DGA malicious domain names. At the same time, the neural network multi-layer perceptron model can be continuously optimized through continuous updating of domain name blacklists and whitelists, and domain name data in a specific time period is regularly selected for retraining and evaluation, so that it can flexibly adapt to changes in the network environment, thereby providing strong support for network security situation awareness.

[0081] Optionally, on the basis of the above embodiments, a blacklist and whitelist creation unit is further included, which is used to collect a preset number of normal domain names from a preset legal website to obtain a domain name whitelist before matching the blacklist and whitelist of the secondary domain name information after data cleaning, and collect a preset number of DGA malicious domain names from an open source website to obtain a domain name blacklist;

[0082] A combination of the domain name whitelist and the domain name blacklist is determined as the black and white list.

[0083] Optionally, on the basis of the above embodiments, it further includes an MLP model training unit, which is used to convert each text domain name included in the black and white list into a numerical domain name before inputting the secondary domain name information that does not exist in the black and white list as the domain name to be detected into the pre-trained multi-layer perceptron MLP model for DGA detection, and extract the domain name features of each numerical domain name using a preset word segmentation model to obtain domain name vector data corresponding to each domain name;

[0084] The domain name vector data of each domain name is pre-labeled according to the domain name whitelist or domain name blacklist to which it belongs;

[0085] The domain name vector data corresponding to each domain name are divided into a training set and a test set, and the MLP model that meets the performance requirements is trained based on the training set and the test set.

[0086] Optionally, based on the above embodiments, the MLP model training unit further includes:

[0087] The data fitting subunit is used to input the vector data of each domain name in the training set into the initial MLP model after parameter adjustment to perform data fitting and obtain the MLP model with the minimum loss;

[0088] A result evaluation subunit is used to input each domain name data in the test set into the MLP model with the minimum loss to evaluate the prediction result and obtain the model evaluation result;

[0089] The iterative updating subunit is used to iteratively update the MLP model with the smallest loss according to the model evaluation result until the MLP model that meets the performance requirements is obtained.

[0090] Optionally, based on the above embodiments, the result evaluation subunit may also be used for:

[0091] The domain name data in the domain name blacklist in the test set is used as the actual positive sample, and the domain name data in the domain name whitelist in the test set is used as the actual negative sample, and is input into the MLP model with the minimum loss, so as to obtain the predicted positive sample whose prediction result is the DGA malicious domain name and the predicted negative sample whose prediction result is the normal domain name;

[0092] The model evaluation results are obtained using actual positive samples, predicted positive samples, actual negative samples and predicted negative samples with precision, recall and accuracy as evaluation indicators.

[0093] Optionally, based on the above embodiments, it further includes an initial MLP model parameter adjustment unit, which is used to import a built-in initial MLP model in a neural network library in a designated open source learning library before inputting each domain name vector data in the training set into the adjusted initial MLP model for data fitting;

[0094] In the initial MLP model, the hidden layer scale parameters of the multilayer perceptron classifier are redefined to obtain an initial MLP model with two hidden layers, 5 nodes in the first hidden layer, and 2 nodes in the second hidden layer.

[0095] Optionally, on the basis of the above embodiments, it further includes a domain name list updating unit, which is used to, after determining whether the domain name to be detected is a malicious domain name, if the domain name to be detected is determined to be a malicious domain name, add the domain name to be detected as a DGA malicious domain name to the domain name blacklist;

[0096] If the domain name to be detected is determined to be a non-malicious domain name, the domain name to be detected is added to the domain name whitelist as a normal domain name.

[0097] An automatic malicious domain name detection device provided by an embodiment of the present invention can execute an automatic malicious domain name detection method provided by any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0098] Embodiment 4

[0099] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0100] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0101] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0102] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a method for automatically detecting malicious domain names.

[0103] That is: collecting DNS traffic data of a domain name resolution system within a set time period, and extracting DNS protocol data from the DNS traffic data;

[0104] Utilize the set parsing software to parse all DNS protocol data and obtain the DNS log data corresponding to each DNS protocol data;

[0105] Clean each DNS log data, and extract secondary domain name information from the cleaned DNS log data;

[0106] The extracted second-level domain name information is matched with the blacklist and whitelist, and the second-level domain name information that does not exist in the blacklist and whitelist is used as the domain name to be detected and input into the pre-trained multi-layer perceptron MLP model for domain name generation algorithm DGA detection to determine whether the domain name to be detected is a malicious domain name.

[0107] In some embodiments, a method for automatically detecting malicious domain names may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the method for automatically detecting malicious domain names described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform a method for automatically detecting malicious domain names in any other appropriate manner (e.g., by means of firmware).

[0108] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0109] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0110] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0111] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0112] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0113] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0114] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0115] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for automatically detecting malicious domain names, characterized in that: include: Collecting DNS traffic data of a domain name resolution system within a set time period, and extracting DNS protocol data from the DNS traffic data; Utilize the set parsing software to parse all DNS protocol data and obtain the DNS log data corresponding to each DNS protocol data; Perform data cleaning on each DNS log data, and extract secondary domain name information from the cleaned DNS log data; The extracted second-level domain name information is matched with the blacklist and whitelist, and the second-level domain name information that does not exist in the blacklist and whitelist is used as the domain name to be detected and input into the pre-trained multi-layer perceptron MLP model for domain name generation algorithm DGA detection to determine whether the domain name to be detected is a malicious domain name.

2. The method according to claim 1, characterized in that Before matching the blacklist and whitelist of the secondary domain name information after data cleaning, it also includes: Collect a preset number of normal domain names from a preset legitimate website to obtain a domain name whitelist, and collect a preset number of DGA malicious domain names from an open source website to obtain a domain name blacklist; A combination of the domain name whitelist and the domain name blacklist is determined as the black and white list.

3. The method according to claim 1 or 2, characterized in that: Before the secondary domain name information that does not exist in the blacklist and whitelist is used as the domain name to be detected and input into the pre-trained multi-layer perceptron MLP model for DGA detection, the following is also included: Convert each text domain name included in the blacklist and whitelist into a numeric domain name, and use a preset word segmentation model to extract domain name features from each numeric domain name to obtain domain name vector data corresponding to each domain name; The domain name vector data of each domain name is pre-labeled according to the domain name whitelist or domain name blacklist to which it belongs; The domain name vector data corresponding to each domain name are divided into a training set and a test set, and the MLP model that meets the performance requirements is trained based on the training set and the test set.

4. The method according to claim 3, characterized in that The domain name vector data corresponding to each domain name is divided into a training set and a test set, and the MLP model that meets the performance requirements is trained based on the training set and the test set, including: Input the domain name vector data in the training set into the initial MLP model after parameter adjustment to perform data fitting and obtain the MLP model with the minimum loss; Input each domain name data in the test set into the MLP model with the minimum loss to evaluate the prediction results, and obtain the model evaluation results; According to the model evaluation result, the MLP model with the smallest loss is iteratively updated until the MLP model that meets the performance requirements is obtained.

5. The method according to claim 4, characterized in that The domain data of each domain in the test set is respectively input into the MLP model with the minimum loss to evaluate the prediction results, and the model evaluation results are obtained, including: The domain name data in the domain name blacklist in the test set is used as the actual positive sample, and the domain name data in the domain name whitelist in the test set is used as the actual negative sample, and is input into the MLP model with the minimum loss, so as to obtain the predicted positive sample whose prediction result is the DGA malicious domain name and the predicted negative sample whose prediction result is the normal domain name; The model evaluation results are obtained using actual positive samples, predicted positive samples, actual negative samples and predicted negative samples with precision, recall and accuracy as evaluation indicators.

6. The method according to claim 4, characterized in that Before inputting the domain name vector data in the training set into the initial MLP model after parameter adjustment for data fitting, the following steps are also included: Import the built-in initial MLP model in the neural network library in the specified open source learning library; In the initial MLP model, the hidden layer scale parameters of the multilayer perceptron classifier are redefined to obtain an initial MLP model with two hidden layers, 5 nodes in the first hidden layer, and 2 nodes in the second hidden layer.

7. The method according to claim 1, characterized in that After determining whether the domain name to be detected is a malicious domain name, the following steps are also included: If the domain name to be detected is determined to be a malicious domain name, the domain name to be detected is added to the domain name blacklist as a DGA malicious domain name; If the domain name to be detected is determined to be a non-malicious domain name, the domain name to be detected is added to the domain name whitelist as a normal domain name.

8. A malicious domain name automatic detection device, characterized in that: include: A DNS protocol data extraction module is used to collect DNS traffic data of a domain name resolution system within a set time period, and extract DNS protocol data from the DNS traffic data; A DNS protocol data parsing module is used to parse all DNS protocol data using the set parsing software to obtain DNS log data corresponding to each DNS protocol data; The secondary domain name information extraction module is used to clean the DNS log data and extract the secondary domain name information from the DNS log data after data cleaning; The malicious domain name detection module is used to match the extracted second-level domain name information with the blacklist and whitelist, and use the second-level domain name information that does not exist in the blacklist and whitelist as the domain name to be detected, and input it into the pre-trained multi-layer perceptron MLP model to perform domain name generation algorithm DGA detection to determine whether the domain name to be detected is a malicious domain name.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute a method for automatically detecting malicious domain names according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a malicious domain name automatic detection method according to any one of claims 1 to 7 when executed.

Images