DNS (Domain Name Server) data leakage detection method and system based on multi-modal time-space characteristics

Abstract

The invention provides a DNS data leakage detection method and system based on multi-modal time-space characteristics, and relates to the technical field of DNS data leakage detection. According to the method, aiming at each DNS data stream, the DNS data stream is converted into a plurality of different modal images, the time sequence information and the position correlation of the DNS data can be reserved, and the spatial-temporal characteristics are extracted from multiple modals more effectively, so that accurate depth characteristics are provided for DNS leakage data detection, and the accuracy of DNS data leakage detection is improved. Meanwhile, a deep feature extraction module based on the deep residual shrinkage network is designed, supplementary information from different modes can be effectively integrated, the deep DNS data leakage features can be automatically extracted by using the robustness of the deep residual shrinkage network to noise, and the robustness in actual detection is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of DNS data leakage detection, and in particular to a DNS data leakage detection method and system based on multimodal spatiotemporal characteristics. Background Art

[0002] The Domain Name System (DNS) is a hierarchical database system that maps domain names and IP addresses to each other. This system allows people to use the Internet more conveniently. The DNS works like a "phone book" where users can search for the "name" of the person they are looking for and retrieve their "phone number." DNS allows people to access device services using more readable names instead of directly using IP addresses that are difficult to read and remember.

[0003] DNS data leakage is an attack method based on the DNS protocol to obtain sensitive information from computers through covert channels, allowing attackers to obtain data, commands and control hosts, etc., which greatly threatens system security. Since DNS is a basic resolution service that is ubiquitous on the Internet, basic defense facilities such as firewalls generally do not filter DNS data. Its ubiquity and penetration make it an ideal secret weapon in the hands of attackers.

[0004] At present, the research on DNS data leakage detection is mainly divided into three categories: traditional mode, classical machine learning method and deep learning method. Among them, the deep learning method is the most advanced DNS data leakage detection technology in the existing technology. This method generally uses CNN and LSTM algorithms and their improved algorithms for detection. However, the existing methods generally use single modal features for detection, and there is a technical problem that the extraction of DNS data leakage features is not comprehensive. Summary of the invention

[0005] 1. Technical issues to be resolved

[0006] In view of the deficiencies in the prior art, the present invention provides a DNS data leakage detection method and system based on multimodal spatiotemporal characteristics, which solves the technical problem that the existing detection methods have incomplete extraction of DNS data leakage features.

[0007] (II) Technical solution

[0008] To achieve the above objectives, the present invention is implemented through the following technical solutions:

[0009] In a first aspect, the present invention provides a DNS data leakage detection method based on multimodal spatiotemporal characteristics, comprising:

[0010] S1. For each DNS data stream, convert it into a plurality of different modal images, and combine the plurality of different modal images into a fused image; the different modal images include timing information and position correlation information of the DNS data stream;

[0011] S2, detecting the fused image through a pre-built DNS data leakage detection model to obtain a detection result;

[0012] Among them, the pre-built DNS data leakage detection model includes a deep feature extraction network and a detection network; the deep feature extraction network includes an input layer and n blocks based on a deep residual shrinkage network, and the n blocks based on a deep residual shrinkage network each include 3 deep residual shrinkage network layers, a global attention mechanism, a channel attention mechanism and a global attention mechanism; the input layer is used to extract the shallow semantic representation of the fused image; the n blocks based on the deep residual shrinkage network are used to perform deep learning on the shallow semantic representation to obtain deep features; the detection network is used to detect the deep features and obtain detection results.

[0013] Preferably, for each DNS data stream, converting it into a plurality of different modality images, and combining the plurality of different modality images into a fused image, comprises:

[0014] For each DNS data stream, it is converted into three modal images: Gram's angle field, recursive graph and Markov transition field, and the three modal images are combined into a fused image, which is a three-channel color image.

[0015] Preferably, the input layer includes a two-dimensional convolution layer and a batch normalization layer, and uses ReLU as an activation function.

[0016] Preferably, the deep residual shrinkage network layer includes: adding a shrinkage layer based on the residual module of Resnet, and introducing a nonlinear layer of soft thresholding.

[0017] Preferably, the detection network includes two convolutional neural network modules, a layer of BiLSTM, and a layer of GRU detection module, wherein the deep features are input into the first convolutional neural network module.

[0018] The data output by the first convolutional neural network module is input into the second convolutional neural network module, and the second convolutional neural network module is input into BiLSTM. The features output after BiLSTM processing are processed by the GRU detection module to obtain the detection result.

[0019] Preferably, the GRU detection module includes a GRU layer, a Dropout layer, a linear layer and a Softmax layer, wherein the output of the GRU layer randomly discards a part of neurons through the Dropout layer, the output of the Dropout layer is sent to a linear layer, and then the detection result is output through the Softmax layer.

[0020] In a second aspect, the present invention provides a DNS data leakage detection system based on multimodal spatiotemporal characteristics, comprising:

[0021] A graphical module for DNS traffic, for converting each DNS data stream into a plurality of different modal images, and combining the plurality of different modal images into a fused image; the different modal images include timing information and location correlation information of the DNS data stream;

[0022] A detection module is used to detect the fused image using a pre-built DNS data leakage detection model to obtain a detection result;

[0023] Among them, the pre-built DNS data leakage detection model includes a deep feature extraction network and a detection network; the deep feature extraction network includes an input layer and n blocks based on a deep residual shrinkage network, and the n blocks based on a deep residual shrinkage network each include 3 deep residual shrinkage network layers, a global attention mechanism, a channel attention mechanism and a global attention mechanism; the input layer is used to extract the shallow semantic representation of the fused image; the n blocks based on the deep residual shrinkage network are used to perform deep learning on the shallow semantic representation to obtain deep features; the detection network is used to detect the deep features and obtain detection results.

[0024] Preferably, for each DNS data stream, converting it into a plurality of different modality images, and combining the plurality of different modality images into a fused image, comprises:

[0025] For each DNS data stream, it is converted into three modal images: Gram's angle field, recursive graph and Markov transition field, and the three modal images are combined into a fused image, which is a three-channel color image.

[0026] In a third aspect, the present invention provides a computer-readable storage medium storing a computer program for DNS data leakage detection based on multimodal spatiotemporal characteristics, wherein the computer program enables a computer to execute the DNS data leakage detection method based on multimodal spatiotemporal characteristics as described above.

[0027] In a fourth aspect, the present invention provides an electronic device, comprising:

[0028] One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the programs include a method for executing the DNS data leakage detection method based on multimodal spatiotemporal characteristics as described above.

[0029] (III) Beneficial effects

[0030] The present invention provides a DNS data leakage detection method and system based on multimodal spatiotemporal characteristics. Compared with the prior art, it has the following beneficial effects:

[0031] The present invention converts each DNS data stream into several different modal images, which can retain the temporal information and position correlation of the DNS data, and more effectively extract spatiotemporal features from multi-modalities, thereby providing accurate deep features for DNS leak data detection and improving the accuracy of DNS data leakage detection. At the same time, a deep feature extraction module based on a deep residual shrinkage network is designed, which can effectively integrate supplementary information from different modalities, and utilize the robustness of the deep residual shrinkage network to noise, which can automatically extract deep DNS data leakage features and improve the robustness in actual detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 A block diagram of a DNS data leakage detection method based on multimodal spatiotemporal characteristics according to an embodiment of the present invention;

[0034] Figure 2 This is a schematic diagram of the structure of the deep feature extraction network;

[0035] Figure 3 Schematic diagram of the structure of a block based on a deep residual contraction network;

[0036] Figure 4 It is a schematic diagram of the structure of the detection network;

[0037] Figure 5 This is the detection page of the DNS data leakage detection system;

[0038] Figure 6 List settings for DNS data leakage detection system;

[0039] Figure 7This is a detection effect diagram for real-time detection;

[0040] Figure 8 Schematic diagram of pap file analysis function. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention are clearly and completely described. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] The embodiments of the present application provide a DNS data leakage detection method and system based on multimodal spatiotemporal characteristics, thereby solving the technical problem of incomplete extraction of DNS data leakage features in existing detection methods, and realizing the conversion of DNS data streams into a number of different modal images. The timing information and position correlation of DNS data can be retained, and spatiotemporal features can be more effectively extracted from multimodal features, thereby improving the accuracy of DNS data leakage detection.

[0043] The technical solution in the embodiment of the present application is to solve the above technical problems, and the overall idea is as follows:

[0044] The three common research directions of DNS data leakage detection currently have some defects. Among them, the traditional mode mainly uses traffic information and statistical methods to detect DNS data leakage. The traffic information mainly includes the number of bytes per flow, the number of packets per flow, the number of bytes per packet and the flow duration. The detection method mainly uses the threshold method, Brodsky-Darkhovsky distribution method, n-gram character frequency analysis method and other methods. This type of method usually uses static thresholds based on rules. The detection method is inflexible, has a high false alarm rate, and is easy to be bypassed.

[0045] Classic machine learning methods mainly use decision trees, Bayesian, random forests, logistic regression, support vector machines, KNN and other classic machine learning methods or a combination of machine learning methods, based on commonly used query and response packet sizes and statistical features for detection. Diao Jiawen, Fang Binxing, Tian Zhihong, et al. DNS covert channel detection method based on self-generation of attack traffic [J]. Journal of Computers, 2022, 45(10): 2190-2206. 19 features including single domain name and multi-domain name features are proposed, and random forests are used for detection. Most of these methods use manually extracted features and are based on binary classification methods of known data sets, and the detection effect on unknown data sets is very limited.

[0046] There are many studies on deep learning methods, such as Angelo G, Castiglione A, Palmieri F. DNStunnels detection via DNS-images [J]. Information processing & Magagement, 2022, 59 (3): 102930. Traffic features are extracted and arranged into two-dimensional images, and the images are input into CNN for detection. At the same time, some researchers have combined machine learning and deep learning methods, such as Lai A, Prasad A, Kumar A et al. DNS-tunnet: a hybrid approach for DNS tunneling detection [A] / / Proceedings of the 2022 4th international conference on advance in computer technology, information science and communications, USA, IEEE, 2022: 1-6, which integrates CNN and SVM for detection research, and uses the characteristics of CNN automatic feature extraction and SVM precise classification to perform covert channel detection. Literature Liu Yangyang, Ruan Shuhua, Zeng Xuemei. DNS covert channel detection based on traffic slicing [J]. Journal of Computer Applications 2023, 40(10): 3138-3143. DOI: 10.19734 / j.issn.1001-3695.2023.02.0040. A DNS data leakage detection based on traffic slicing is proposed. First, the experimental environment export traffic is divided into batches based on the sliding window, and then traffic slices are formed based on the host-side aggregation. Each slice contains DNS messages and Web messages belonging to the same host in a short time span. Then, the data volume, request behavior, response behavior and associated behavior of the DNS message in the slice are implemented with feature engineering for DNS detection, and a detection model is established on this basis. However, most of the current deep learning methods use CNN and LSTM algorithms and their improved algorithms for detection. The detection method is relatively simple and the accuracy is difficult to guarantee. Moreover, most of the existing methods use single modal features, and there is a problem of incomplete extraction of DNS data leakage features.

[0047] In order to solve the defects existing in the prior art, the embodiment of the present invention proposes a DNS data leakage detection method based on multimodal spatiotemporal characteristics. First, the DNS data is graphically converted into several different modal images, and a deep feature extraction module based on a deep residual shrinkage network is designed to further integrate the supplementary information from different modalities, and the deep residual shrinkage network is used to more robustly automatically extract deep DNS data leakage features by taking advantage of its robustness to noise; then, a DNS data leakage detection network is designed based on a convolutional neural network and a bidirectional BiLSTM to improve the accuracy of the model in actual DNS leakage data detection.

[0048] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0049] The embodiment of the present invention provides a DNS data leakage detection method based on multimodal spatiotemporal characteristics, such as Figure 1 As shown, the method includes:

[0050] S1. For each DNS data stream, convert it into a plurality of different modal images, and combine the plurality of different modal images into a fused image; the different modal images include timing information and position correlation information of the DNS data stream;

[0051] S2, detecting the fused image through a pre-built DNS data leakage detection model to obtain a detection result;

[0052] Among them, the pre-built DNS data leakage detection model includes a deep feature extraction network and a detection network; the deep feature extraction network includes an input layer and n blocks based on a deep residual shrinkage network, and the n blocks based on a deep residual shrinkage network each include 3 deep residual shrinkage network layers, a global attention mechanism, a channel attention mechanism and a global attention mechanism; the input layer is used to extract the shallow semantic representation of the fused image; the n blocks based on the deep residual shrinkage network are used to perform deep learning on the shallow semantic representation to obtain deep features; the detection network is used to detect the deep features and obtain detection results.

[0053] The embodiment of the present invention converts each DNS data stream into several different modal images, which can retain the temporal information and position correlation of the DNS data, and more effectively extract spatiotemporal features from multi-modalities, thereby providing accurate deep features for DNS leak data detection and improving the accuracy of DNS data leakage detection. At the same time, a deep feature extraction module based on a deep residual shrinkage network is designed, which can effectively integrate supplementary information from different modalities, and utilize the robustness of the deep residual shrinkage network to noise, which can automatically extract deep DNS data leakage features and improve the robustness in actual detection.

[0054] In one embodiment, S1, for each DNS data stream, a plurality of different modality images are combined into a fused image; the different modality images include timing information and position correlation information of the DNS data stream; specifically including:

[0055] For each DNS data stream, it is converted into three modal images: Gram Angle Field (GAF), Recursive Graph (RP), and Markov Transfer Field (MTF) to effectively preserve the temporal information and position correlation of the DNS data. Then, the GAF, RP, and MTF images are combined into a three-channel color image, where the GAF, RP, and MTF images are regarded as three orthogonal channels.

[0056] It should be noted that, for the time series features, location correlation features, etc. in the DNS data stream, different features can be converted into grayscale images respectively, and then the grayscale images can be combined into a fused image.

[0057] In one embodiment, S2, the fused image is detected by a pre-built DNS data leakage detection model to obtain a detection result. Specifically, it includes:

[0058] The fused image is preferably the three-channel color image mentioned above.

[0059] The pre-built DNS data leakage detection model includes a deep feature extraction network and a detection network, where Figure 2 As shown in Figure 1, the deep feature extraction network includes an input layer and five blocks based on the Deep Residual Shrinkage Network (DRSN). The input layer includes a two-dimensional convolutional layer (Conv2D) and a batch normalization layer (BatchNorm2D), and uses ReLU as the activation function to extract the shallow semantic representation of the input data. The blocks based on the deep residual shrinkage network are shown in Figure 1. Figure 3 As shown in the figure, it includes 3 DRSN layers and 3 attention mechanisms. DRSN adds a contraction layer based on the residual module of Resnet and introduces a nonlinear layer with soft thresholding, which can effectively suppress redundant information and improve the robustness of DNS leak data feature extraction. The global attention mechanism can more effectively make the DNS leak data features show differences at the global and local levels; while the channel attention mechanism and spatial attention mechanism can promote attention to important features while suppressing irrelevant features.

[0060] like Figure 4As shown, the detection network mainly includes 2 convolutional neural network modules, a layer of BiLSTM, and a layer of GRU detection module. First, the number of parameters of the network model is reduced by Conv2D and BatchNorm2D. Next, the BiLSTM (Bidirectional Long Short-Term Memory, BiLSTM) and GRU (Gated Recurrent Unit) modules are connected to better model the long-distance dependencies in the DNS data stream, even if the DNS leak data is not obvious in the features. Finally, a part of the neurons is randomly discarded through the Dropout layer to prevent overfitting, and its output is sent to a linear layer, and finally the detection of DNS leak data is realized through the Softmax layer. In the embodiment of the present invention, the function in the Softmax layer uses the Log_Softmax function.

[0061] In the specific implementation process, the pre-built DNS data leakage detection model needs to be pre-trained. During the training process, the parameters of the DNS data leakage detection model are updated using the Adam optimizer to minimize the loss function, and the loss function uses the cross entropy loss.

[0062] The effectiveness of the embodiment of the present invention is verified by the following experiment:

[0063] The detection method of the embodiment of the present invention is compared and verified with the classical machine learning method and deep learning method in the prior art. The “DNS covert channel detection based on traffic slicing” in the deep learning method mentioned in the specific implementation is used as the comparison scheme 1 in Table 1, and the “DNS covert channel detection method based on self-generation of attack traffic” in the classical machine learning method mentioned in the specific implementation is used as the comparison scheme 2 in Table 1;

[0064] First, a DNS leakage dataset was constructed, in which the normal DNS traffic data came from the normal DNS traffic of the dataset CIC-Bell-DNS-EXF2021; the DNS data leakage traffic used the open source tool DNS Exfiltrator, and two hosts were set up in the local area network: one as a controlled host and the other as a server for launching attacks and receiving data, simulating the data leakage process and obtaining 94,000 DNS data leakage traffic packets. The dataset was divided into a training set and a validation set in a ratio of 4:1 for model training and evaluation. Accuracy and false negative rate were used as evaluation criteria for the model. Table 1 shows the comparison of different methods.

[0065] Table 1 Detection results of different methods

[0066]

[0067] In order to verify the effectiveness of the embodiment of the present invention, a DNS data leakage detection system is constructed by coding the above method. Figure 5 and Figure 6 As shown, the system provides detection and analysis of real-time DNS traffic and PCAP traffic files.

[0068] The detection interface provides two major functions: traffic file detection and real-time traffic detection. Traffic file detection allows users to scan and detect local PCAP traffic files, helping users to analyze and detect existing traffic for research. After the real-time traffic detection is turned on, the system begins to monitor the DNS traffic passing through port 53 of the host and performs feature extraction and model analysis on it, and displays the analysis results on the detection interface to achieve real-time detection of host DNS data leakage; the whitelist setting page is based on user needs. The system uses the default file to import some commonly used domain names as the default whitelist. Users can import multiple domain name text files as a supplement and provide an overall export function. The set whitelist content is used in the real-time traffic detection function. During the detection, if the DNS traffic request points to the domain name in the whitelist, the system will no longer perform the detection and judgment process and treat it as benign traffic for management.

[0069] Figure 7 This is the detection effect diagram of real-time detection, and this is the analysis result of online mode. Figure 8 It is the analysis result of the pap file analysis function in offline mode.

[0070] The embodiment of the present invention further provides a DNS data leakage detection system based on multimodal spatiotemporal characteristics, including:

[0071] A graphical module for DNS traffic, for converting each DNS data stream into a plurality of different modal images, and combining the plurality of different modal images into a fused image; the different modal images include timing information and location correlation information of the DNS data stream;

[0072] A detection module is used to detect the fused image using a pre-built DNS data leakage detection model to obtain a detection result;

[0073] Among them, the pre-built DNS data leakage detection model includes a deep feature extraction network and a detection network; the deep feature extraction network includes an input layer and n blocks based on a deep residual shrinkage network, and the n blocks based on a deep residual shrinkage network each include 3 deep residual shrinkage network layers, a global attention mechanism, a channel attention mechanism and a global attention mechanism; the input layer is used to extract the shallow semantic representation of the fused image; the n blocks based on the deep residual shrinkage network are used to perform deep learning on the shallow semantic representation to obtain deep features; the detection network is used to detect the deep features and obtain detection results.

[0074] It can be understood that the DNS data leakage detection system based on multimodal space-time characteristics provided in the embodiment of the present invention corresponds to the above-mentioned DNS data leakage detection method based on multimodal space-time characteristics. The explanations, examples, beneficial effects and other parts of the relevant contents can refer to the corresponding contents in the DNS data leakage detection method based on multimodal space-time characteristics, and will not be repeated here.

[0075] An embodiment of the present invention also provides a computer-readable storage medium, which stores a computer program for DNS data leakage detection based on multimodal spatiotemporal characteristics, wherein the computer program enables a computer to execute the DNS data leakage detection method based on multimodal spatiotemporal characteristics as described above.

[0076] An embodiment of the present invention also provides an electronic device, comprising: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the program includes a method for executing the DNS data leakage detection method based on multimodal spatiotemporal characteristics as described above.

[0077] In summary, compared with the prior art, the present invention has the following beneficial effects:

[0078] 1. The embodiment of the present invention converts each DNS data stream into three modal images: Gram angle field, recursive graph and Markov transition field, which can retain the temporal information and position correlation of DNS data, and more effectively extract spatiotemporal features from multi-modality, thereby providing accurate deep features for DNS leak data detection and improving the accuracy of DNS data leakage detection. At the same time, a deep feature extraction module based on a deep residual shrinkage network is designed, which can effectively integrate supplementary information from different modalities, and utilize the robustness of the deep residual shrinkage network to noise, which can automatically extract deep DNS data leakage features and improve the robustness in actual detection.

[0079] 2. The embodiment of the present invention designs a detection network based on convolutional neural network and bidirectional BiLSTM, which can comprehensively utilize the advantages of CNN and BiLSTM to improve the accuracy of DNS leak data detection.

[0080] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0081] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A DNS data leakage detection method based on multimodal spatiotemporal characteristics, characterized in that: include: S1. For each DNS data stream, convert it into a plurality of different modal images, and combine the plurality of different modal images into a fused image; the different modal images include timing information and position correlation information of the DNS data stream; S2, detecting the fused image through a pre-built DNS data leakage detection model to obtain a detection result; Among them, the pre-built DNS data leakage detection model includes a deep feature extraction network and a detection network; the deep feature extraction network includes an input layer and n blocks based on a deep residual shrinkage network, and the n blocks based on a deep residual shrinkage network each include 3 deep residual shrinkage network layers, a global attention mechanism, a channel attention mechanism and a global attention mechanism; the input layer is used to extract a shallow semantic representation of the fused image; the n blocks based on a deep residual shrinkage network are used to perform deep learning on the shallow semantic representation to obtain deep features; The detection network is used to detect deep features and obtain detection results.

2. The DNS data leakage detection method based on multimodal spatiotemporal characteristics according to claim 1, characterized in that: The method converts each DNS data stream into a plurality of different modal images, and combines the plurality of different modal images into a fused image, including: For each DNS data stream, it is converted into three modal images: Gram's angle field, recursive graph and Markov transition field, and the three modal images are combined into a fused image, which is a three-channel color image.

3. The DNS data leakage detection method based on multimodal spatiotemporal characteristics according to claim 1, characterized in that: The input layer includes a 2D convolutional layer and a batch normalization layer, and uses ReLU as the activation function.

4. The DNS data leakage detection method based on multimodal spatiotemporal characteristics according to claim 1, characterized in that: The deep residual shrinkage network layer includes: adding a shrinkage layer on the basis of the residual module of Resnet, and introducing a nonlinear layer of soft thresholding.

5. The DNS data leakage detection method based on multimodal spatiotemporal characteristics according to any one of claims 1 to 4, characterized in that: The detection network includes two convolutional neural network modules, a layer of BiLSTM, and a layer of GRU detection module, wherein the deep features are input into the first convolutional neural network module. The data output by the first convolutional neural network module is input into the second convolutional neural network module, and the second convolutional neural network module is input into BiLSTM. The features output after BiLSTM processing are processed by the GRU detection module to obtain the detection result.

6. The DNS data leakage detection method based on multimodal spatiotemporal characteristics as claimed in claim 5, characterized in that: The GRU detection module includes a GRU layer, a Dropout layer, a linear layer and a Softmax layer, wherein the output of the GRU layer randomly discards a part of neurons through the Dropout layer, the output of the Dropout layer is sent to a linear layer, and then the detection result is output through the Softmax layer.

7. A DNS data leakage detection system based on multimodal spatiotemporal characteristics, characterized in that: include: A graphical module for DNS traffic, for converting each DNS data stream into a plurality of different modal images, and combining the plurality of different modal images into a fused image; the different modal images include timing information and location correlation information of the DNS data stream; A detection module is used to detect the fused image using a pre-built DNS data leakage detection model to obtain a detection result; Among them, the pre-built DNS data leakage detection model includes a deep feature extraction network and a detection network; the deep feature extraction network includes an input layer and n blocks based on a deep residual shrinkage network, and the n blocks based on a deep residual shrinkage network each include 3 deep residual shrinkage network layers, a global attention mechanism, a channel attention mechanism and a global attention mechanism; the input layer is used to extract a shallow semantic representation of the fused image; the n blocks based on a deep residual shrinkage network are used to perform deep learning on the shallow semantic representation to obtain deep features; The detection network is used to detect deep features and obtain detection results.

8. The DNS data leakage detection system based on multimodal spatiotemporal characteristics as claimed in claim 7, characterized in that: The method converts each DNS data stream into a plurality of different modal images, and combines the plurality of different modal images into a fused image, including: For each DNS data stream, it is converted into three modal images: Gram's angle field, recursive graph and Markov transition field, and the three modal images are combined into a fused image, which is a three-channel color image.

9. A computer-readable storage medium, characterized in that: It stores a computer program for DNS data leakage detection based on multimodal spatiotemporal characteristics, wherein the computer program enables a computer to execute the DNS data leakage detection method based on multimodal spatiotemporal characteristics as described in any one of claims 1 to 6.

10. An electronic device, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the programs include a method for executing the DNS data leakage detection method based on multimodal spatiotemporal characteristics as described in any one of claims 1 to 6.

Images