Method and system for dns data breach detection based on multi-modal spatio-temporal characteristics

Abstract

The application provides a DNS data leakage detection method and system based on multi-modal space-time characteristics, and relates to the technical field of DNS data leakage detection.The application converts each DNS data stream into several different modal images, can retain the time sequence information and position correlation of the DNS data, more effectively extracts space-time characteristics from the multi-modal, thereby provides accurate deep features for DNS leakage data detection, and improves the accuracy of DNS data leakage detection.Meanwhile, a deep feature extraction module based on a deep residual shrinkage network is designed, can effectively integrate the supplementary information from different modes, and can automatically extract deep DNS data leakage features by using the robustness of the deep residual shrinkage network to noise, thereby improving the robustness in actual detection.

Description

Technical Field

[0001] This invention relates to the field of DNS data leakage detection technology, and specifically to a DNS data leakage detection method and system based on multimodal spatiotemporal characteristics. Background Technology

[0002] The Domain Name System (DNS) is a hierarchical database system that maps domain names to IP addresses, making internet access easier. DNS works much like a phone book; users search for someone's name to find their phone number. DNS allows people to access device services using more readable names instead of the difficult-to-read and remember IP addresses.

[0003] DNS data breach is an attack method that uses the DNS protocol to obtain sensitive information from computers through covert channels, allowing attackers to acquire data, commands, and control of hosts, posing a significant threat to system security. Because DNS is a ubiquitous and fundamental resolution service on the internet, basic defense facilities such as firewalls generally do not filter DNS data; its pervasiveness and ability to penetrate make it an ideal covert weapon for attackers.

[0004] Current research on DNS data leakage detection is mainly divided into three categories: traditional methods, classical machine learning methods, and deep learning methods. Among them, deep learning methods are the most advanced DNS data leakage detection technology. This method generally uses CNN and LSTM algorithms and their improved algorithms for detection. However, existing methods generally use single-modal features for detection, which has the technical problem of incomplete extraction of DNS data leakage features. Summary of the Invention

[0005] (a) Technical problems to be solved To address the shortcomings of existing technologies, this invention provides a DNS data leakage detection method and system based on multimodal spatiotemporal characteristics, which solves the technical problem of incomplete extraction of DNS data leakage features in existing detection methods.

[0006] (II) Technical Solution To achieve the above objectives, the present invention provides the following technical solution: In a first aspect, the present invention provides a DNS data leakage detection method based on multimodal spatiotemporal characteristics, comprising: S1. For each DNS data stream, convert it into several different modal images, and combine the several different modal images into a fused image; the different modal images include the temporal information and location correlation information of the DNS data stream; S2. The fused image is detected using a pre-built DNS data leakage detection model to obtain the detection results; The pre-built DNS data leakage detection model includes a deep feature extraction network and a detection network. The deep feature extraction network includes an input layer and n blocks based on deep residual contraction networks. Each of the n blocks based on deep residual contraction networks includes three deep residual contraction network layers, a global attention mechanism, a channel attention mechanism, and a spatial attention mechanism. The input layer is used to extract shallow semantic representations of the fused image. The n blocks based on deep residual contraction networks are used to perform deep learning on the shallow semantic representations to obtain deep features. The detection network is used to detect the deep features and obtain the detection results.

[0007] Preferably, for each DNS data stream, converting it into several different modal images and combining these different modal images into a fused image includes: For each DNS data stream, it is converted into three modal images: Gram angle field, recursive graph, and Markov transition field. The three modal images are then combined into a fused image, which is a three-channel color image.

[0008] Preferably, the input layer includes a two-dimensional convolutional layer and a batch normalization layer, and uses ReLU as the activation function.

[0009] Preferably, the deep residual shrinking network layer includes: adding a shrinking layer to the residual module of ResNet and introducing a soft-thresholding nonlinear layer.

[0010] Preferably, the detection network includes two convolutional neural network modules, a BiLSTM layer, and a GRU detection module, wherein the deep features are input into the first convolutional neural network module. The data output from the first convolutional neural network module is input into the second convolutional neural network module, and the data output from the second convolutional neural network module is input into the BiLSTM. After processing by the BiLSTM, the output features are processed by the GRU detection module to obtain the detection results.

[0011] Preferably, the GRU detection module includes a GRU layer, a Dropout layer, a linear layer, and a Softmax layer. The output of the GRU layer randomly discards a portion of neurons through the Dropout layer, the output of the Dropout layer is fed into a linear layer, and then the detection result is output through the Softmax layer.

[0012] Secondly, the present invention provides a DNS data leakage detection system based on multimodal spatiotemporal characteristics, comprising: The graphical module for DNS traffic is used to convert each DNS data stream into several different modal images and combine these different modal images into a fused image; the different modal images include the temporal information and location-related information of the DNS data stream. The detection module is used to detect the fused image using a pre-built DNS data leakage detection model and obtain the detection results. The pre-built DNS data leakage detection model includes a deep feature extraction network and a detection network. The deep feature extraction network includes an input layer and n blocks based on deep residual contraction networks. Each of the n blocks based on deep residual contraction networks includes three deep residual contraction network layers, a global attention mechanism, a channel attention mechanism, and a spatial attention mechanism. The input layer is used to extract shallow semantic representations of the fused image. The n blocks based on deep residual contraction networks are used to perform deep learning on the shallow semantic representations to obtain deep features. The detection network is used to detect the deep features and obtain the detection results.

[0013] Preferably, for each DNS data stream, converting it into several different modal images and combining these different modal images into a fused image includes: For each DNS data stream, it is converted into three modal images: Gram angle field, recursive graph, and Markov transition field. The three modal images are then combined into a fused image, which is a three-channel color image.

[0014] Thirdly, the present invention provides a computer-readable storage medium storing a computer program for detecting DNS data leaks based on multimodal spatiotemporal characteristics, wherein the computer program causes a computer to execute the DNS data leak detection method based on multimodal spatiotemporal characteristics as described above.

[0015] Fourthly, the present invention provides an electronic device, comprising: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including methods for performing DNS data leakage detection based on multimodal spatiotemporal characteristics as described above.

[0016] (III) Beneficial Effects This invention provides a method and system for detecting DNS data leakage based on multimodal spatiotemporal characteristics. Compared with existing technologies, it has the following advantages: This invention converts each DNS data stream into several different modal images, preserving the temporal information and location correlation of the DNS data. This allows for more effective extraction of spatiotemporal features from the multimodal data, providing accurate deep features for DNS data leakage detection and improving the accuracy of DNS data leakage detection. Simultaneously, a deep feature extraction module based on a deep residual shrinking network is designed. This module effectively integrates supplementary information from different modalities and leverages the robustness of the deep residual shrinking network to noise to automatically extract deep DNS data leakage features, improving robustness in practical detection. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a block diagram of a DNS data leakage detection method based on multimodal spatiotemporal characteristics according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a deep feature extraction network; Figure 3 This is a schematic diagram of the block structure based on a deep residual shrinkage network; Figure 4 This is a schematic diagram of the detection network structure; Figure 5 This is the detection page for the DNS data breach detection system; Figure 6 Configure the list for the DNS data breach detection system; Figure 7 This is a screenshot showing the detection results in real time. Figure 8 This is a diagram illustrating the PAP file analysis function. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention are described clearly and completely. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] This application provides a DNS data leakage detection method and system based on multimodal spatiotemporal characteristics, which solves the technical problem of incomplete extraction of DNS data leakage features in existing detection methods. It realizes the transformation of DNS data stream into several different modal images, which can retain the temporal information and location correlation of DNS data, and more effectively extract spatiotemporal features from multimodality, thereby improving the accuracy of DNS data leakage detection.

[0021] The technical solution in this application is to solve the above-mentioned technical problems, and the general idea is as follows: Current research directions in DNS data leakage detection, across three common areas, all have some shortcomings. The traditional approach primarily employs traffic information and statistical methods for DNS data leakage detection. Traffic information mainly includes features such as the number of bytes per flow, the number of packets per flow, the number of bytes per packet, and the flow duration. Detection methods primarily utilize thresholding, Brodsky-Darkhovsky distribution methods, and n-gram character frequency analysis. These methods typically rely on rule-based static thresholds, resulting in inflexible detection methods, high false positive rates, and susceptibility to bypass.

[0022] Classical machine learning methods mainly employ decision trees, Bayesian methods, random forests, logistic regression, support vector machines, KNN, and other classic machine learning methods or combinations thereof, based on commonly used query and response packet size and statistical features for detection. Diao Jiawen, Fang Binxing, Tian Zhihong, et al. A method for detecting DNS covert channels based on attack traffic self-generated[J]. Chinese Journal of Computers, 2022, 45(10):2190-2206. This paper proposes 19 features, including single-domain and multi-domain features, and uses random forests for detection. Most of these methods utilize manually extracted features and binary classification methods based on known datasets, which have very limited detection effects on unknown datasets.

[0023] There is a lot of research on deep learning methods. For example, in the paper Angelo G, Castiglione A, Palmieri F. DNS tunnels detection via DNS-images[J]. Information Processing & Magagement, 2022, 59(3):102930, traffic features are extracted and arranged into a two-dimensional image, and the image is used as input to CNN for detection. At the same time, some researchers have combined machine learning and deep learning methods. For example, in the paper Lai A, Prasad A, Kumar A et al. DNS-tunnet: a hybrid approach for DNS tunneling detection[A] / / Proceedingsof the 2022 4th international conference on advance in computer technology, information science and communications, USA, IEEE, 2022:1-6, CNN and SVM are integrated for detection research. The automatic feature extraction feature of CNN and the accurate classification feature of SVM are used to detect hidden channels. The literature Liu Yangyang, Ruan Shuhua, Zeng Xuemei. DNS Covert Channel Detection Based on Traffic Slicing [J]. Computer Applications Research 2023, 40(10):3138-3143.DOI:10.19734 / j.issn.1001-3695.2023.02.0040. proposes a DNS data leakage detection method based on traffic slicing. First, the outbound traffic of the experimental environment is divided into batches based on a sliding window, and then the traffic is aggregated on the host side to form traffic slices. Each slice contains DNS packets and Web packets belonging to the same host in a short time span. Then, feature engineering for DNS detection is carried out on the data volume, request behavior, response behavior and association behavior with Web packets of DNS packets in the slice, and a detection model is established on this basis. However, most of the current deep learning methods use CNN and LSTM algorithms and their improved algorithms for detection. The detection methods are relatively simple and the accuracy is difficult to guarantee. Moreover, most existing methods use single modal features, which have the problem of incomplete extraction of DNS data leakage features.

[0024] To address the shortcomings of existing technologies, this invention proposes a DNS data leakage detection method based on multimodal spatiotemporal characteristics. First, DNS data is graphically represented as several different modal images. A deep feature extraction module based on a deep residual contraction network is designed to further integrate supplementary information from different modalities. The robustness of the deep residual contraction network to noise is utilized to more robustly and automatically extract deep DNS data leakage features. Then, a DNS data leakage detection network is designed based on convolutional neural networks and bidirectional BiLSTM to improve the model's accuracy in detecting actual DNS data leakage.

[0025] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0026] This invention provides a DNS data leakage detection method based on multimodal spatiotemporal characteristics, such as... Figure 1 As shown, the method includes: S1. For each DNS data stream, convert it into several different modal images, and combine the several different modal images into a fused image; the different modal images include the temporal information and location correlation information of the DNS data stream; S2. The fused image is detected using a pre-built DNS data leakage detection model to obtain the detection results; The pre-built DNS data leakage detection model includes a deep feature extraction network and a detection network. The deep feature extraction network includes an input layer and n blocks based on deep residual contraction networks. Each of the n blocks based on deep residual contraction networks includes three deep residual contraction network layers, a global attention mechanism, a channel attention mechanism, and a spatial attention mechanism. The input layer is used to extract shallow semantic representations of the fused image. The n blocks based on deep residual contraction networks are used to perform deep learning on the shallow semantic representations to obtain deep features. The detection network is used to detect the deep features and obtain the detection results.

[0027] This invention converts each DNS data stream into several different modal images, preserving the temporal information and location correlation of the DNS data. This allows for more effective extraction of spatiotemporal features from the multimodal data, providing accurate deep features for DNS data leakage detection and improving the accuracy of DNS data leakage detection. Simultaneously, a deep feature extraction module based on a deep residual shrinking network is designed. This module effectively integrates supplementary information from different modalities and leverages the robustness of the deep residual shrinking network to noise to automatically extract deep DNS data leakage features, improving robustness in practical detection.

[0028] In one embodiment, S1, for each DNS data stream, several different modal images are combined into a fused image; the different modal images include the temporal information and location-related information of the DNS data stream; specifically including: For each DNS data stream, it is converted into three modal images: Gram Angular Field (GAF), Recursive Graph (RP), and Markov Transition Field (MTF) to effectively preserve the temporal information and location relevance of the DNS data. Then, the GAF, RP, and MTF images are combined into a three-channel color image, where the GAF, RP, and MTF images are treated as three positive channels.

[0029] It should be noted that, for the time-series features and location-related features in the DNS data stream, different features can be converted into grayscale images, and then the grayscale images can be combined into a fused image.

[0030] In one embodiment, S2, the fused image is detected using a pre-built DNS data leakage detection model to obtain the detection result. Specifically, this includes: The fused image is preferably the three-channel color image mentioned above.

[0031] The pre-built DNS data leakage detection model includes a deep feature extraction network and a detection network, such as... Figure 2 As shown, the deep feature extraction network consists of an input layer and five blocks based on a Deep Residual Shrinkage Network (DRSN). The input layer includes a 2D convolutional layer (Conv2D) and a batch normalization layer (BatchNorm2D), using ReLU as the activation function to extract shallow semantic representations of the input data. The blocks based on the Deep Residual Shrinkage Network are shown below. Figure 3 As shown, the algorithm includes three DRSN layers and three attention mechanisms. DRSN adds a shrinking layer to the ResNet residual module and introduces a soft-thresholding nonlinear layer, which can effectively suppress redundant information and improve the robustness of DNS leak data feature extraction. The global attention mechanism can more effectively make DNS leak data features exhibit differences at the global and local levels; while the channel attention mechanism and spatial attention mechanism can promote attention to important features while suppressing irrelevant features.

[0032] like Figure 4As shown, the detection network mainly consists of two convolutional neural network modules, one BiLSTM layer, and one GRU detection layer. First, Conv2D and BatchNorm2D are used to reduce the number of parameters in the network model. Next, the BiLSTM (Bidirectional Long Short-Term Memory) and GRU (Gated Recurrent Unit) modules are connected to better model long-distance dependencies in the DNS data stream, even if DNS leak data is not prominent in the features. Finally, a dropout layer randomly discards a portion of neurons to prevent overfitting; its output is fed into a linear layer, and finally, a Softmax layer is used to detect DNS leak data. In this embodiment, the Log_Softmax function is used in the Softmax layer.

[0033] In the actual implementation process, the pre-built DNS data leakage detection model needs to be pre-trained. During training, the Adam optimizer is used to update the parameters of the DNS data leakage detection model, thereby minimizing the loss function, which is cross-entropy loss.

[0034] The effectiveness of the embodiments of the present invention will be verified through experiments below: The detection method of this invention embodiment is compared and verified with the classic machine learning method and deep learning method in the prior art. The "DNS covert channel detection based on traffic slicing" in the deep learning method mentioned in the specific embodiment is used as the comparison scheme 1 in Table 1, and the "DNS covert channel detection method based on attack traffic self-generated" in the classic machine learning method mentioned in the specific embodiment is used as the comparison scheme 2 in Table 1. First, a DNS leak dataset was constructed. Normal DNS traffic data was derived from the normal DNS traffic of the CIC-Bell-DNS-EXF2021 dataset. Leaked DNS traffic was collected using the open-source tool DNS Exfiltrator. Two hosts were configured on a local area network: one as the controlled host and the other as the server initiating the attack and receiving data, simulating a data leak process and acquiring 94,000 DNS leak traffic packets. The dataset was divided into training and validation sets in a 4:1 ratio for model training and evaluation. Accuracy and false negative rate were used as the evaluation criteria for the model. Table 1 compares the different methods.

[0035] Table 1 Detection results of different methods To verify the effectiveness of the embodiments of the present invention, a DNS data leakage detection system was constructed by coding the above method, such as... Figure 5 and Figure 6 As shown, the system provides detection and analysis of real-time DNS traffic and PCAP traffic files.

[0036] The detection interface offers two main functions: traffic file detection and real-time traffic detection. Traffic file detection allows users to scan and detect local PCAP traffic files, helping them analyze existing traffic for research purposes. Real-time traffic detection, once enabled, begins listening for DNS traffic passing through port 53 of the host, extracting features and performing model analysis. The analysis results are displayed on the detection interface, enabling real-time detection of host DNS data leaks. The whitelist settings page is based on user needs; the system uses a default file to import some commonly used domains as a default whitelist. Users can import multiple domain text files as supplementary whitelists, and a full export function is also provided. The configured whitelist content is used in the real-time traffic detection function. During detection, if DNS traffic requests point to domains in the whitelist, the system will not perform a detection and judgment process, treating it as benign traffic for management.

[0037] Figure 7 The first image shows the detection results in real-time, while the second image shows the analysis results in online mode. Figure 8 This is the analysis result of the PAP file analysis function in offline mode.

[0038] This invention also provides a DNS data leakage detection system based on multimodal spatiotemporal characteristics, comprising: The graphical module for DNS traffic is used to convert each DNS data stream into several different modal images and combine these different modal images into a fused image; the different modal images include the temporal information and location-related information of the DNS data stream. The detection module is used to detect the fused image using a pre-built DNS data leakage detection model and obtain the detection results. The pre-built DNS data leakage detection model includes a deep feature extraction network and a detection network. The deep feature extraction network includes an input layer and n blocks based on deep residual contraction networks. Each of the n blocks based on deep residual contraction networks includes three deep residual contraction network layers, a global attention mechanism, a channel attention mechanism, and a spatial attention mechanism. The input layer is used to extract shallow semantic representations of the fused image. The n blocks based on deep residual contraction networks are used to perform deep learning on the shallow semantic representations to obtain deep features. The detection network is used to detect the deep features and obtain the detection results.

[0039] It is understood that the DNS data leakage detection system based on multimodal spatiotemporal characteristics provided in this embodiment of the invention corresponds to the DNS data leakage detection method based on multimodal spatiotemporal characteristics described above. The explanations, examples, and beneficial effects of the relevant content can be referred to the corresponding content in the DNS data leakage detection method based on multimodal spatiotemporal characteristics, and will not be repeated here.

[0040] This invention also provides a computer-readable storage medium storing a computer program for DNS data leakage detection based on multimodal spatiotemporal characteristics, wherein the computer program causes a computer to execute the DNS data leakage detection method based on multimodal spatiotemporal characteristics as described above.

[0041] This invention also provides an electronic device, including: one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including methods for performing DNS data leakage detection based on multimodal spatiotemporal characteristics as described above.

[0042] In summary, compared with existing technologies, it has the following beneficial effects: 1. This invention converts each DNS data stream into three modal images: Gram angle field, recursive graph, and Markov transition field. This preserves the temporal information and positional relevance of the DNS data, and more effectively extracts spatiotemporal features from multiple modalities, thereby providing accurate deep features for DNS data leakage detection and improving the accuracy of DNS data leakage detection. Simultaneously, a deep feature extraction module based on a deep residual shrinking network is designed. This module can effectively integrate supplementary information from different modalities and utilize the robustness of the deep residual shrinking network to noise to automatically extract deep DNS data leakage features, improving robustness in actual detection.

[0043] 2. The present invention designs a detection network based on convolutional neural networks and bidirectional BiLSTM, which can comprehensively utilize the advantages of CNN and BiLSTM to improve the accuracy of DNS leak data detection.

[0044] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0045] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A DNS data leakage detection method based on multimodal spatiotemporal characteristics, characterized in that, include: S1. For each DNS data stream, convert it into three modal images: Gram angle field, recursive graph, and Markov transition field. Combine the three modal images into a fused image, which is a three-channel color image. The different modal images include the temporal information and location correlation information of the DNS data stream. S2. The fused image is detected using a pre-built DNS data leakage detection model to obtain the detection results; The pre-built DNS data leakage detection model includes a deep feature extraction network and a detection network. The deep feature extraction network includes an input layer and n blocks based on deep residual contraction networks. Each of the n blocks based on deep residual contraction networks includes three deep residual contraction network layers, a global attention mechanism, a channel attention mechanism, and a spatial attention mechanism. The input layer is used to extract shallow semantic representations of the fused image. The n blocks based on deep residual contraction networks are used to perform deep learning on the shallow semantic representations to obtain deep features. The detection network is used to detect deep features and obtain detection results.

2. The DNS data leakage detection method based on multimodal spatiotemporal characteristics as described in claim 1, characterized in that, The input layer includes a two-dimensional convolutional layer and a batch normalization layer, and uses ReLU as the activation function.

3. The DNS data leakage detection method based on multimodal spatiotemporal characteristics as described in claim 1, characterized in that, The deep residual shrinking network layer includes: adding a shrinking layer to the residual module of ResNet and introducing a soft-thresholding nonlinear layer.

4. The DNS data leakage detection method based on multimodal spatiotemporal characteristics as described in any one of claims 1 to 3, characterized in that, The detection network comprises two convolutional neural network modules, a BiLSTM layer, and a GRU detection layer. The deep features are input into the first convolutional neural network module. The data output from the first convolutional neural network module is input into the second convolutional neural network module, and the data output from the second convolutional neural network module is input into the BiLSTM. After processing by the BiLSTM, the output features are processed by the GRU detection module to obtain the detection results.

5. The DNS data leakage detection method based on multimodal spatiotemporal characteristics as described in claim 4, characterized in that, The GRU detection module includes a GRU layer, a Dropout layer, a linear layer, and a Softmax layer. The output of the GRU layer is randomly dropped by the Dropout layer, and the output of the Dropout layer is fed into a linear layer and then output through the Softmax layer to produce the detection result.

6. A DNS data leakage detection system based on multimodal spatiotemporal characteristics, characterized in that, include: The DNS traffic graphical module is used to convert each DNS data stream into three modal images: Gram angle field, recursion graph, and Markov transition field. These three modal images are then combined into a fused image, which is a three-channel color image. The different modal images include the temporal information and location-related information of the DNS data stream. The detection module is used to detect the fused image using a pre-built DNS data leakage detection model and obtain the detection results. The pre-built DNS data leakage detection model includes a deep feature extraction network and a detection network. The deep feature extraction network includes an input layer and n blocks based on deep residual contraction networks. Each of the n blocks based on deep residual contraction networks includes three deep residual contraction network layers, a global attention mechanism, a channel attention mechanism, and a spatial attention mechanism. The input layer is used to extract shallow semantic representations of the fused image. The n blocks based on deep residual contraction networks are used to perform deep learning on the shallow semantic representations to obtain deep features. The detection network is used to detect deep features and obtain detection results.

7. A computer-readable storage medium, characterized in that, It stores a computer program for detecting DNS data leaks based on multimodal spatiotemporal characteristics, wherein the computer program causes a computer to execute the DNS data leak detection method based on multimodal spatiotemporal characteristics as described in any one of claims 1 to 5.

8. An electronic device, characterized in that, include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including methods for performing the DNS data leakage detection method based on multimodal spatiotemporal characteristics as described in any one of claims 1 to 5.

Images