Malicious domain name identification method and device, computer equipment and readable storage medium

Abstract

The embodiment of the invention provides a malicious domain name identification method and device, computer equipment and a readable storage medium. Comprising the steps of intercepting an input sequence of a current time step through a sliding window; generating a first hidden state vector according to a forward time sequence through a first encoder in the target model, and generating a second hidden state vector according to a reverse time sequence through a second encoder in the target model; predicting, by a decoder of the target model, a predicted character of the current time step based on a fused hidden state vector of the first hidden state vector and the second hidden state vector; moving the sliding window to update and obtain an input sequence of the next time step according to the prediction character and predicting the prediction character of the next time step; repeating the above steps until the number of the plurality of predicted characters obtained by updating reaches a preset number threshold; and identifying the to-be-identified domain name based on a predicted malicious domain name list determined by the plurality of predicted characters. Therefore, the timeliness and accuracy of malicious domain name identification can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of domain name identification, and in particular to a method, apparatus, computer device and readable storage medium for identifying malicious domain names. Background Art

[0002] In many cases of network attacks, Domain Generation Algorithm (DGA) is a widely used technology. Malware can dynamically generate a large number of domain names through DGA technology. Even if some domain names are identified and blocked, the malware can still maintain communication with its server through the generated new domain names, posing a serious threat to network security.

[0003] In the related art, in order to comprehensively detect malicious domain names, domain names are generally detected through interception technology based on rules and statistical features. However, this detection consumes a lot of computing resources and memory. When used on devices with limited resources, it will lead to too long computing time and serious lag in the detection results, so that the connection of malicious domain names cannot be blocked in time. On the other hand, since this detection method relies on predefined rules and patterns, it may not be able to adapt to new attack patterns, which will lead to a decrease in the accuracy of malicious domain name identification. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a malicious domain name identification method, device, computer equipment and readable storage medium, which can improve the timeliness and accuracy of malicious domain name identification.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a method for identifying a malicious domain name, the method comprising:

[0006] Through the sliding window, the input sequence of the current time step is intercepted from the historical domain name sequence before the current time step;

[0007] Input the input sequence to the target model, and generate a first hidden state vector of the input sequence according to a forward time sequence by a first encoder in the target model, and generate a second hidden state vector of the input sequence according to a reverse time sequence by a second encoder in the target model;

[0008] Predicting the predicted character of the current time step based on the fused hidden state vector of the first hidden state vector and the second hidden state vector by the decoder of the target model;

[0009] Updating the predicted character to the input sequence, moving the sliding window to update the sequence to be predicted, inputting the sequence to be predicted into the target model, and predicting the predicted character of the next time step based on the sequence to be predicted by the target model;

[0010] Repeating the steps of updating the predicted characters to the input sequence, moving the sliding window to update the sequence to be predicted, inputting the sequence to be predicted into the target model, and predicting the predicted characters of the next time step based on the sequence to be predicted by the target model, until the number of the updated multiple predicted characters reaches a preset number threshold;

[0011] A predicted malicious domain name list is determined based on the multiple predicted characters, and the domain name to be identified is identified according to the predicted malicious domain name list.

[0012] Accordingly, a second aspect of an embodiment of the present application provides a malicious domain name identification device, the device comprising:

[0013] An interception module, used for intercepting the input sequence of the current time step from the historical domain name sequence before the current time step through a sliding window;

[0014] A generating module, configured to input the input sequence into a target model, and generate a first hidden state vector of the input sequence according to a forward time sequence through a first encoder in the target model, and generate a second hidden state vector of the input sequence according to a reverse time sequence through a second encoder in the target model;

[0015] A prediction module, configured to predict a predicted character at the current time step based on a fused hidden state vector of the first hidden state vector and the second hidden state vector through a decoder of the target model;

[0016] A moving module, used for updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step through the target model;

[0017] An updating module, configured to repeatedly execute the steps of updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step by the target model, until the number of the updated multiple predicted characters reaches a preset number threshold;

[0018] The identification module is used to determine a list of predicted malicious domain names based on the multiple predicted characters, and identify the domain name to be identified according to the list of predicted malicious domain names.

[0019] In some embodiments, the generating module is further used to:

[0020] According to the forward time order, the earliest time step corresponding to the input sequence is determined as the forward starting time step, and the other time steps are determined as the forward intermediate time steps;

[0021] Determining, by a first encoder in the target model, a forward hidden state and a forward cell state corresponding to the forward starting time step according to the forward character corresponding to the forward starting time step;

[0022] For each of the forward intermediate time steps, the forward hidden state and the forward cell state corresponding to the previous time step are updated according to the forward hidden state and the forward cell state corresponding to the previous time step and the forward character input in the forward intermediate time step, until the forward hidden state and the forward cell state of the last forward intermediate time step are updated, so as to obtain a first hidden state vector composed of multiple forward hidden states corresponding to the input sequence.

[0023] In some embodiments, the generating module is further used to:

[0024] Determine, in reverse time order, the latest time step corresponding to the input sequence as the reverse start time step, and determine the other time steps as the reverse intermediate time steps;

[0025] Determining, by a second encoder in the target model, a reverse hidden state and a reverse cell state corresponding to the reverse starting time step according to the reverse character corresponding to the reverse starting time step;

[0026] For each of the reverse intermediate time steps, the reverse hidden state and the reverse cell state corresponding to the subsequent time step are updated according to the reverse hidden state and the reverse cell state corresponding to the subsequent time step and the reverse character input in the reverse intermediate time step, until the reverse hidden state and the reverse cell state of the last reverse intermediate time step are updated, so as to obtain a second hidden state vector composed of multiple reverse hidden states corresponding to the input sequence.

[0027] In some embodiments, the identification module is further used to:

[0028] Get the domain name division identifier;

[0029] Determine at least one domain name division identifier from the multiple updated predicted characters, and divide the multiple predicted characters using the domain name division identifier as a division point to obtain multiple predicted malicious domain names;

[0030] Based on the multiple predicted malicious domain names, a predicted malicious domain name list is determined.

[0031] In some embodiments, the identification module is further used to:

[0032] Obtaining a domain name to be identified, and matching the domain name to be identified in the predicted malicious domain name list to obtain a matching result;

[0033] According to the matching result, an identification result of the domain name to be identified is obtained.

[0034] In some implementations, the malicious domain name identification device further includes a training module for:

[0035] Obtain a sample input sequence, and input the sample input sequence into a preset model to obtain a plurality of sample prediction probabilities corresponding to a plurality of sample prediction characters predicted by the preset model;

[0036] Obtaining a true sample label character at a sample time step subsequent to the sample input sequence, and calculating a target loss of the preset model based on the true sample label character, the plurality of sample prediction characters, and the corresponding plurality of sample prediction probabilities;

[0037] The preset model is trained based on the target loss to obtain a target model.

[0038] In some embodiments, the training module is further used to:

[0039] For each of the sample prediction characters, determining a sample prediction probability corresponding to the sample prediction character;

[0040] Determine a first sub-loss corresponding to the sample prediction character according to the sample prediction probability and the real sample label character;

[0041] The target loss of the preset model is calculated according to the multiple first sub-losses corresponding to the multiple sample prediction characters.

[0042] Correspondingly, the third aspect of the embodiments of the present application proposes a computer device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the malicious domain name identification method described in any one of the embodiments of the first aspect of the present application when executing the computer program.

[0043] Correspondingly, the fourth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the malicious domain name identification method described in any one of the embodiments of the first aspect of the present application.

[0044] In the embodiment of the present application, a sliding window is used to intercept an input sequence of the current time step from a historical domain name sequence located before the current time step; the input sequence is input into a target model, and a first hidden state vector of the input sequence is generated by a first encoder in the target model in a forward time sequence, and a second hidden state vector of the input sequence is generated by a second encoder in the target model in a reverse time sequence; a predicted character of the current time step is predicted by a decoder of the target model based on a fused hidden state vector of the first hidden state vector and the second hidden state vector; the predicted character is updated to the input sequence, the sliding window is moved to update the sequence to be predicted, the sequence to be predicted is input into the target model, and the predicted character of the next time step is predicted by the target model based on the sequence to be predicted; the steps of updating the predicted character to the input sequence, moving the sliding window to update the sequence to be predicted, inputting the sequence to be predicted into the target model, and predicting the predicted character of the next time step based on the sequence to be predicted by the target model are repeated until the number of the updated multiple predicted characters reaches a preset number threshold; a predicted malicious domain name list is determined based on the multiple predicted characters, and the domain name to be identified is identified according to the predicted malicious domain name list. In this way, the characters at the next time point can be predicted in real time, and the predicted malicious domain name list for the next time period can be obtained in advance, thereby improving the timeliness of malicious domain name detection. In addition, the present application predicts the predicted malicious domain name list based on the input sequence at the previous moment, rather than based on fixed rules and patterns. In the prediction process, it can also combine the forward time sequence and the reverse time sequence to generate a fused hidden state vector, which can enable the target model to understand the context information more accurately, so as to accurately predict the malicious domain name based on the domain name pattern at the previous moment and the precise context information, thereby improving the accuracy of malicious domain name recognition. In summary, the present application can improve the timeliness and accuracy of malicious domain name recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 It is a schematic diagram of the architecture of the malicious domain name identification system provided in an embodiment of the present application;

[0046] Figure 2 is a flow chart of a malicious domain name identification method provided by an embodiment of the present application;

[0047] Figure 3 It is a schematic diagram of the process of splicing to obtain a fused hidden state vector provided in an embodiment of the present application;

[0048] Figure 4is a schematic diagram of predicting a predicted character provided by an embodiment of the present application;

[0049] Figure 5 It is an overall flow chart of the malicious domain name identification method provided in the embodiment of the present application;

[0050] Figure 6 It is a schematic diagram of the functional modules of the malicious domain name identification device provided in an embodiment of the present application;

[0051] Figure 7 It is a schematic diagram of the hardware structure of the computer device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0053] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0054] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0055] In many cases of network attacks, Domain Generation Algorithm (DGA) is a widely used technology. Malware can dynamically generate a large number of domain names through DGA technology. Even if some domain names are identified and blocked, the malware can still maintain communication with its server through the generated new domain names, posing a serious threat to network security.

[0056] In the related art, in order to comprehensively detect malicious domain names, domain names are generally detected through interception technology based on rules and statistical features. However, this detection consumes a lot of computing resources and memory. When used on devices with limited resources, it will lead to too long computing time and serious lag in the detection results, so that the connection of malicious domain names cannot be blocked in time. On the other hand, since this detection method relies on predefined rules and patterns, it may not be able to adapt to new attack patterns, which will lead to a decrease in the accuracy of malicious domain name identification.

[0057] DGA is often used in malware and remote control software. It can pseudo-randomly generate a domain name sequence based on the input or default seed value (such as date, time and other numerical values) to effectively avoid detection. Pseudo-random means that the string sequence appears to be random, but because its structure can be predetermined, it can be repeatedly generated and copied. And because of the pseudo-randomness of the domain name sequence, the domain name sequence can be identified as a regular time series. Based on this, the embodiments of the present application provide a malicious domain name identification method, device, computer equipment and readable storage medium, which can improve the timeliness and accuracy of malicious domain name identification.

[0058] The malicious domain name identification method, apparatus, computer device and readable storage medium provided in the embodiments of the present application are specifically described through the following embodiments. First, the malicious domain name identification system in the embodiments of the present application is described.

[0059] Please refer to Figure 1 In some implementations, the present application provides a malicious domain name identification system. The malicious domain name identification system includes a terminal 11 and a server 12.

[0060] Exemplarily, the terminal 11 may be a user's computer, mobile device, IoT device, router, or any other device that may be subject to a network attack. Specifically, the terminal 11 may detect network traffic, and when a domain name needs to be detected, match it in the predicted malicious domain name list to determine whether the domain name is a malicious domain name.

[0061] Exemplarily, the server end 12 can be a cloud server, a dedicated security server, or other device with high computing and storage capabilities, used to perform complex tasks, such as training preset models and generating a list of predicted malicious domain names.

[0062] Furthermore, the terminal 11 and the server 12 can interact through the network. The terminal device sends the network activity data to the server 12, and the server 12 uses its powerful computing power to perform data analysis, model training, and generate a list of predicted malicious domain names. Afterwards, the server 12 sends the updated list of predicted malicious domain names to the terminal 11, and the terminal 11 uses the list of predicted malicious domain names to decide whether to block access to the domain name to be identified. The terminal 11 can use the processing power of the server to improve detection efficiency, reduce its own resource consumption, and improve the timeliness and accuracy of malicious domain name identification.

[0063] The malicious domain name identification method in the embodiment of the present application can be illustrated by the following embodiment.

[0064] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or separate consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or separate consent, the necessary user-related data for enabling the normal operation of the embodiment of the present application will be obtained.

[0065] In the embodiment of the present application, the malicious domain name identification device will be described from the perspective of the malicious domain name identification device, which can be specifically integrated into a computer device. Figure 2 , Figure 2 This is a flowchart of the steps of the malicious domain name identification method provided in the embodiment of the present application. The embodiment of the present application takes the malicious domain name identification device as an example, which is specifically integrated in a terminal or a server. When the processor on the terminal or the server executes the program instructions corresponding to the malicious domain name identification method, the specific process is as follows:

[0066] Step 101, using a sliding window, intercepting an input sequence of the current time step from a historical domain name sequence before the current time step.

[0067] In some embodiments, in order to facilitate the prediction of subsequently appearing characters, an input sequence can be extracted from an existing domain name sequence by setting a sliding window, so as to learn the context information needed to predict the current time step after the first time period based on the input sequence, and accurately predict the characters of the current time step.

[0068] The sliding window may be a movable window of a fixed size, which is used to move on the historical domain name sequence, and each time it moves a time step, that is, a character position is moved. Each time a predicted character is predicted, the sliding window may be slid to cover the predicted character, and the next character of the predicted character is predicted. Specifically, the length of the sliding window may be preset according to actual conditions.

[0069] The current time step may be a time point for starting to predict characters, that is, a time step for starting to predict malicious domain names.

[0070] The historical domain name sequence can be a series of domain names arranged in chronological order, which can be generated by DGA or actual access records collected from network traffic. Since malicious domain names need to be predicted, the historical domain name sequence can be composed of malicious domain names.

[0071] The input sequence may be a partial sequence extracted from the domain name sequence using a sliding window. In order to predict the characters that are not generated later, the input sequence may be selected by selecting the last segment of the generated or predicted domain name sequence through the sliding window. For example, if the domain name sequence is bi nca.com, and the character of the next time step needs to be predicted, and the length of the sliding window is 3, then the input sequence may be com.

[0072] For example, suppose a historical domain name sequence S = [s1, s2, ..., s N ], the length of the sliding window is W. Furthermore, if it is necessary to predict the character at the current time step i+W, an input sequence [s i ,s i+1 ,...,s i+w-1 ], the input sequence can include multiple characters, where i represents the starting position of the sliding window.

[0073] Input sequence: [s i ,s i+1 ,...,s i+w-1 ]

[0074] Target i =S i+w

[0075] In some embodiments, the length of the input sequence intercepted by the sliding window can be adjusted based on the sequence regularity. For example, if the sequence regularity represents that the length of the main part varies between 3 and 7 characters, and the top-level domain is usually .com. Then the length of the sliding window can be set to 7 characters plus the length of the top-level domain, that is, 11 characters. It is understood that the input sequence should be able to fully express the context information of the character to be predicted so as to be used for accurate prediction of the character to be predicted. At the same time, the input sequence should not be too long so as not to affect the prediction process.

[0076] Through the above method, context information that can effectively predict the characters of the next time step can be effectively extracted from the existing data, so that the predicted characters of the next time step can be generated in advance, thereby improving the accuracy and timeliness of the prediction.

[0077] Step 102, input the input sequence to the target model, and generate a first hidden state vector of the input sequence in a forward time sequence through a first encoder in the target model, and generate a second hidden state vector of the input sequence in a reverse time sequence through a second encoder in the target model.

[0078] In some embodiments, in order to fully utilize the context information of the input sequence, the forward and reverse information of the input sequence can be processed simultaneously by the target model to capture the bidirectional dependency of the input sequence and achieve accurate prediction of the characters of the next time step of the sequence.

[0079] Among them, the target model can be a trained bidirectional long short-term memory network (BiLSTM). The target model can capture the context information of the input sequence by introducing the first encoder (forward LSTM layer) and the second encoder (reverse LSTM layer) to more comprehensively understand the contextual relationship of the input sequence.

[0080] The first encoder may be a forward LSTM unit in the target model. The first encoder may process the input sequence in forward time order, i.e., starting from the first character of the input sequence, and processing one by one in time order until the last character of the input sequence. For each time step of the input sequence, the first encoder generates a hidden state vector in forward time order. The hidden state vector represents the information of the corresponding time step and is based on all the information before the time step in the input sequence until the first hidden state vector of the last time step of the input sequence is obtained. The first hidden state vector may contain information of multiple forward time steps of the entire input sequence.

[0081] The first hidden state vector may be a combination of hidden states consisting of multiple hidden states generated by the first encoder at multiple time steps of the input sequence. The first hidden state vector contains all information of the input sequence from the first time step to the last time step.

[0082] The second encoder may be a reverse LSTM unit in the target model. The first encoder may process the input sequence in reverse time order, i.e., starting from the last character of the input sequence, and processing one by one in time order until the first character of the input sequence. For each time step of the input sequence, the first encoder generates a hidden state vector in reverse time order, which represents the information of the corresponding time step and is based on all information after the time step in the input sequence until the second hidden state vector of the first time step of the input sequence is obtained, and the second hidden state vector may contain information of multiple reverse time steps of the entire input sequence.

[0083] The second hidden state vector may be a combination of hidden states composed of multiple hidden state vectors generated by the second encoder at multiple time steps of the input sequence. The second hidden state vector contains all information of the input sequence from the last time step to the first time step.

[0084] For example, the input sequence is example.com, and the input sequence is input into the target model. The first encoder of the target model will start processing from the leftmost of the input sequence and read each character in turn. For the input sequence "example.com", the first character processed is "e", then "x", and so on, until the last character "m" is processed.

[0085] When processing each character, the first encoder updates its internal state and generates a forward hidden state vector. When the first encoder completes processing the entire input sequence, the hidden state vector of the last time step will contain the forward information about the input sequence, that is, all the information from the start character to the end character. After that, multiple forward hidden state vectors based on multiple time steps can form the first hidden state vector.

[0086] Furthermore, the first encoder of the target model will start processing from the rightmost of the input sequence, reading each character in turn. For the input sequence "example.com", the first character processed is "m", then "o", and so on, until the first character "e" is processed.

[0087] When processing each character, the second encoder updates its internal state and generates a reverse hidden state vector. When the second encoder completes processing the entire input sequence, the hidden state vector of the first time step will contain reverse information about the input sequence, that is, all information from the end character to the start character. Afterwards, multiple reverse hidden state vectors based on multiple time steps can form the second hidden state vector.

[0088] By obtaining the first hidden state vector generated by the first encoder and the second hidden state vector generated by the second encoder, a more accurate and comprehensive sequence data analysis of the input sequence can be fully performed, while also avoiding the problems of gradient vanishing and gradient exploding during the training process of the preset model.

[0089] In some embodiments, in order to enable the target model to build an understanding of the entire input sequence, the forward characters of each time step may be iteratively processed in a forward time order to generate a first hidden state vector representing the overall features of the entire input sequence. For example, in step 102, "generating the first hidden state vector of the input sequence by the first encoder in the target model in a forward time order" may include:

[0090] (102.a1) According to the forward time order, the earliest time step corresponding to the input sequence is determined as the forward starting time step, and the other time steps are determined as the forward intermediate time steps;

[0091] (102.a2) determining, by the first encoder in the target model, a forward hidden state and a forward cell state corresponding to the forward start time step according to the forward character corresponding to the forward start time step;

[0092] (102.a3) For each forward intermediate time step in turn, the forward hidden state and forward cell state corresponding to the previous time step are updated according to the forward hidden state and forward cell state corresponding to the previous time step and the forward character input in the forward intermediate time step, until the forward hidden state and forward cell state of the last forward intermediate time step are updated, and the first hidden state vector consisting of multiple forward hidden states corresponding to the input sequence is obtained.

[0093] The forward time order may be the time direction when processing the input sequence, and specifically may be the order from the beginning to the end of the sequence, that is, the order from front to back.

[0094] The forward start time step may be the first time step in a given input sequence, and data is processed starting from the forward start time step.

[0095] The forward intermediate time step can be any time step other than the start time step. At the forward intermediate time step, the target model will use the information of the previous forward start time step and all the forward intermediate time steps to help process the data of the current forward intermediate time step.

[0096] The forward character may be an input character at a corresponding time step when processing an input sequence.

[0097] The forward hidden state can be the state inside the target model when processing each time step. The forward hidden state contains the information summary from the forward start time step to the current forward intermediate time step, and will be passed to the next forward intermediate time step. At the forward start time step, the forward hidden state is usually initialized.

[0098] Among them, the forward cell state can be a mechanism for carrying long-term information. The forward cell state can selectively retain or discard information fragments through a gating mechanism, thereby helping to alleviate the gradient vanishing problem. At the forward start time step, the forward cell state is initialized.

[0099] Exemplarily, the first encoder includes at least an input gate i t 、Forget gate t , output gate o t ; In addition, the parameters involved include the forward hidden state h of the previous time step t-1 and positive cell state c t-1 , and the representation vector x of the positive character input at the current time step tand positive cell state c t , positive character x t Represents the representation vector of the positive character input at the current time step, cell state c t-1 Then the forward propagation features above are recorded, and the forward hidden state h t-1 Can also be considered as the above features.

[0100] Specifically, the forget gate f t Contains σ (Sigmod) unit, the forget gate can be based on the representation vector x of the forward character input at the current forward intermediate time step t and the forward hidden state h of the previous time sequence t-1 The weights are calculated and normalized by Sigmod neurons to obtain a result f between (0, 1) t , by taking the result f t The cell state c of the previous time series t-1 Multiply them together to fuse and forget some unnecessary information. Among them, the representation vector x of the character input at the current time step is t and the forward hidden state h at the previous time step t-1 The weight calculation process is as follows:

[0101] f t =σ(W fx x t +W fh h t-1 +b f )

[0102] Among them, W fx and W fh represents the weight matrix parameter of the forget gate, b f Represents the bias parameter of the forget gate.

[0103] Specifically, the input gate includes a σ (Sigmod) unit and a tanh unit, which are used to determine whether the representation vector of the positive character input at the current time step needs to be stored in the cell state c at the current time step. t Specifically, the input gate can be based on the representation vector x of the positive character input at this time step t and the forward hidden state h of the previous time sequence t-1 The weight is calculated and normalized by the σ unit to obtain the result i with a value between (0, 1) t , to indicate the feature information that needs to be memorized and updated. The calculation process is as follows:

[0104] i t =σ(W ix x t +Wih h t-1 +b i )

[0105] Among them, W ix and W ih represents the weight matrix parameter of the input gate, b i Represents the bias parameter.

[0106] In addition, the input gate is also based on the representation vector x of the forward character input at the current time step t and the forward hidden state h at the previous time step t-1 The weights are calculated and normalized by the tanh unit to obtain a value between (-1, 1) Represents the candidate memory information, which can also be called the candidate forward cell state. The weight calculation process is:

[0107]

[0108] Among them, W cx and W ch represents the weight matrix parameter of the input gate, b c Represents the bias parameter of the input gate.

[0109] Furthermore, the candidate positive cell state And the feature information i that needs to be updated t Multiply them to achieve the fusion between the two and obtain the final information that the input gate needs to remember at the current time step, that is, the forward cell state of the current forward intermediate time step. Then, based on the final information that needs to be remembered and the forward cell state c of the previous time sequence t-1 And forget information t , determine the cell state c at the current time sequence t The specific calculation process is as follows:

[0110]

[0111] It should be noted that the output f of the forget gate t The positive cell state c at the previous time step t-1 Multiplying by , indicates that part of the feature information in the previous feature that is being passed to the intermediate time step needs to be forgotten. t With the current candidate forward cell state Multiplication indicates that the input gate needs to remember the characteristic information in the cell state at the current time step. So far, by forgetting the information in the forward cell state and memorizing the new information, the information useful for the subsequent moment calculation can be transmitted, while the useless information is discarded, and the cell state c at the current time step is obtained.t .

[0112] Specifically, the output gate includes a σ (Sigmod) unit, a tanh unit, and a fusion unit, which are used to determine the forward hidden state result at the current time step. The output gate can be based on the character representation vector x input at the time step t and the forward hidden state h at the previous time step t-1 The weight calculation is performed and the σ unit is used for normalization to obtain a result o with a value between (0, 1) t , the result is t Indicates the forward cell state that needs to be output at the current time step. The calculation process is as follows:

[0113] o t =σ(W ox x t +W oh h t-1 +b o )

[0114] Among them, W ox and W oh represents the weight matrix parameter of the output gate, b o Represents the bias parameter of the output gate.

[0115] In addition, the output gate is also based on the positive cell state c at the current time step t Based on the tanh function, nonlinear changes are performed and the nonlinear change processing results are compared with the positive cell state o output at the current time step. t Multiply them together to fuse and get the forward hidden state h at the current time step t , which belongs to the positive cell state c t The eigenvector after attenuation, in addition, h t It also belongs to the input of the forward hidden state of the next forward intermediate time step. The specific calculation process is:

[0116] h t =o t ·tanh(c t )

[0117] So far, the processing process of the first encoder in the target model in the forward propagation has been described, and the processing process of the forward propagation for each forward intermediate time step can refer to the above embodiment. Specifically, when processing the forward time sequence, first determine the starting time step of the input sequence as the forward starting time step, and regard the remaining time steps as the forward intermediate time steps. For the forward starting time step, the initial hidden state and the initial cell state are calculated according to the forward character by the first encoder. Then, for each forward intermediate time step, based on the forward hidden state and the forward cell state of the previous time step and the forward character of the current time step, the forward cell state and the forward hidden state are updated through the mechanism of the forget gate, the input gate and the output gate. Among them, the forget gate determines which information is discarded, the input gate determines which new information is added to the cell state, and the output gate determines which information is output as the forward hidden state of the current forward intermediate time step. This process continues until the last forward intermediate time step of the sequence, thereby obtaining the final hidden state vector of the entire input sequence, that is, the first hidden state vector composed of multiple forward hidden states.

[0118] By introducing the first encoder with input gate, forget gate and output gate mechanism, it is possible to effectively selectively forget irrelevant information and retain key information when processing the input sequence, thereby optimizing the target model's ability to capture long-term dependencies. This mechanism not only helps alleviate the gradient vanishing problem, but also improves the target model's understanding of the input sequence, ensuring that important information can be passed to subsequent calculation steps, and ultimately improving the overall model's performance and prediction accuracy.

[0119] In some embodiments, in order to capture bidirectional context information when processing the input sequence, the second hidden state vector may be generated by introducing a reverse time order to capture information from the end of the sequence to the current time step. For example, "generating the second hidden state vector of the input sequence by the second encoder in the target model in reverse time order" in step 102 may include:

[0120] (102.b1) According to the reverse time order, the latest time step corresponding to the input sequence is determined as the reverse starting time step, and the other time steps are determined as the reverse intermediate time steps;

[0121] (102.b2) determining, by the second encoder in the target model, a reverse hidden state and a reverse cell state corresponding to the reverse start time step according to the reverse character corresponding to the reverse start time step;

[0122] (102.b3) For each reverse intermediate time step in turn, the reverse hidden state and reverse cell state corresponding to the subsequent time step are updated according to the reverse hidden state and reverse cell state corresponding to the subsequent time step and the reverse character input in the reverse intermediate time step, until the reverse hidden state and reverse cell state of the last reverse intermediate time step are updated, and the second hidden state vector composed of multiple reverse hidden states corresponding to the input sequence is obtained.

[0123] Among them, the reverse time order can be the time direction used when processing the input sequence, specifically the order from the end to the beginning of the input sequence, that is, the order from back to front. The reverse time order is opposite to the forward time order, and the latter is to start processing from the reverse characters of the first time step of the sequence to the reverse characters of the last time step.

[0124] The reverse start time step may refer to the last time step in a given input sequence, which is the starting point of the reverse process. Starting from the reverse start time step, the reverse process will proceed back along the sequence.

[0125] The reverse intermediate time step may be all other time steps except the reverse start time step. At the reverse intermediate time step, the target model will use the information of the subsequent reverse start time step and all reverse intermediate time steps to help process the data of the current reverse intermediate time step.

[0126] The reverse character may be an input character at a corresponding time step when processing an input sequence, and the reverse character is processed in reverse time order.

[0127] The reverse hidden state may refer to the state inside the target model when processing each time step, and the reverse hidden state is updated in reverse time order. The reverse hidden state contains the information summary from the reverse start time step until the current reverse intermediate time step, and will be passed to the previous reverse intermediate time step. At the reverse start time step, the reverse hidden state is usually initialized.

[0128] Among them, the reverse cell state can be a mechanism for carrying long-term information, similar to the forward cell state, but it is updated in reverse time order. The reverse cell state can selectively retain or discard information fragments through a gating mechanism, thereby helping to alleviate the gradient vanishing problem. At the reverse start time step, the reverse cell state is also initialized.

[0129] Specifically, when processing the reverse time sequence, the end time step of the input sequence is first determined as the reverse start time step, and the remaining time steps are regarded as reverse intermediate time steps. For the reverse start time step, the initial hidden state and the initial cell state are calculated according to the reverse character by the second encoder. Then, for each reverse intermediate time step, based on the reverse hidden state and reverse cell state of the next time step and the reverse character of the current reverse intermediate time step, the reverse cell state and the reverse hidden state are updated through the mechanism of the forget gate, the input gate and the output gate. Among them, the forget gate determines which information is discarded, the input gate determines which new information is added to the reverse cell state, and the output gate determines which information is output as the reverse hidden state of the current reverse intermediate time step. This process continues until the first reverse intermediate time step of the input sequence, thereby obtaining the final reverse hidden state vector of the entire input sequence, that is, the second hidden state vector composed of multiple reverse hidden states.

[0130] The reverse propagation process of the second encoder is the same as the forward propagation process, and the only difference is the direction of the representation vector of the input character. Specifically, the representation vector of each reverse character is processed from back to front in the reverse order of the input sequence as input. The embodiment of the present application does not elaborate on the reverse propagation process, and the specific reference may be made to the processing process of the input sequence by the first encoder.

[0131] By adopting reverse time order processing and introducing an encoder with input gate, forget gate and output gate mechanism, it is possible to effectively selectively forget irrelevant information and retain key information when processing the input sequence, thereby optimizing the target model's ability to capture long-term dependencies from the end to the beginning; this mechanism not only helps to alleviate the gradient vanishing problem, but also enhances the target model's understanding of the end information of the input sequence, ensuring that important information can be passed back to the previous calculation steps, and ultimately improving the overall performance and prediction accuracy of the target model.

[0132] Step 103, predicting the predicted character of the current time step based on the fused hidden state vector of the first hidden state vector and the second hidden state vector through the decoder of the target model.

[0133] In some embodiments, in order to obtain richer and more complete sequence features of the input sequence, the first hidden state vector generated in forward time order according to the time step and the second hidden state vector generated in reverse time order can be concatenated to obtain a fused hidden state vector, so that the target model can obtain the global information in the input sequence and improve the accuracy of predicting the predicted characters.

[0134] The fused hidden state vector may be a vector formed by concatenating the first hidden state vector and the second hidden state vector according to each time step in the target model.

[0135] Among them, the predicted character can be in the target model, and the decoder predicts the next character of the input sequence based on the fused hidden state vector.

[0136] Please refer to Figure 3 In some embodiments, in combination Figure 3 The process of concatenating the first hidden state vector and the second hidden state vector to obtain the fused hidden state vector is given as an example. For example, if there is an input sequence A, in the process of predicting the predicted character of the current time step through the input sequence, the first hidden state vector is raeb and the corresponding forward cell state, and the second hidden state vector is bear and the corresponding reverse cell state (the cell state can be represented by LSTM Ce ll, for the specific direction of the cell state, please refer to Figure 3 ), by concatenating the first hidden state vector and the second hidden state vector, and concatenating the forward cell state and the reverse cell state, a fused hidden state vector can be obtained. Specifically, the "r" and "b" of the first time step and the corresponding cell state can be concatenated, the "a" and "e" of the second time step and the corresponding cell state can be concatenated, the "e" and "a" of the third time step and the corresponding cell state can be concatenated, and the "b" and "r" of the fourth time step and the corresponding cell state can be concatenated to obtain a fused hidden state vector.

[0137] Furthermore, the decoder of the target model can predict the predicted character of the current time step based on the fused hidden state vector. The decoder usually uses a linear layer to convert the fused hidden state vector into a prediction distribution, and then selects the character with the highest probability as the predicted character.

[0138] For example, please refer to Figure 4 The decoder usually uses a linear layer to convert the fused hidden state vector into a prediction distribution, and then selects the character with the highest probability as the predicted character. When predicting the input sequence "exyxsoi d.bazar (followed by a space)", the predicted character at the current time step can be predicted as "v" based on the fused hidden state vector corresponding to the input sequence.

[0139] By fusing the first hidden state vector in the forward time sequence and the second hidden state vector in the reverse time sequence, the target model can obtain the global information of the input sequence. This fusion of two-way information helps to improve the target model's understanding of the input sequence, more accurately capture the long-distance dependencies of the sequence, and improve the accuracy of the predicted character prediction for the current time step.

[0140] Step 104, update the predicted character to the input sequence of the current time step, move the sliding window to update the input sequence of the next time step, input the input sequence of the next time step into the target model, and predict the predicted character of the next time step based on the input sequence of the next time step through the target model.

[0141] In some embodiments, in order to ensure the relevance of the context and the consistency of the prediction, the predicted characters for the next time step can be generated each time, that is, the sliding window is moved to update the input sequence for the next time step, so that the target model can continuously receive new input sequences and make predictions for the next time step based on them, thereby improving the continuity and accuracy of the prediction.

[0142] Please refer to Figure 4 , assuming that the initial input sequence is "exyxsoi d.bazar (followed by a space)", the predicted character of the current time step is predicted to be "v" according to the fused hidden state vector of "exyxsoi d.bazar (followed by a space)". Furthermore, since the length of the sliding window is fixed, at this time, the predicted character "v" can be updated to the input sequence of the current time step "exyxsoi d.bazar (followed by a space)", and "exyxsoi d.bazar v" can be obtained. The sliding window is moved to obtain the input sequence of the next time step as "xyxsoi d.bazar v". Furthermore, the target model can predict that the predicted character of the next time step is "u".

[0143] In the above way, the sliding window can be used to ensure that the target model only focuses on the most recent sequence at each prediction, so as to help the target model reduce its dependence on early input without adjusting the model's own architecture, thereby avoiding long-term dependency problems and improving the efficiency and accuracy of predicting characters.

[0144] Step 105, repeatedly executing the steps of updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step through the target model, until the number of the updated multiple predicted characters reaches a preset number threshold.

[0145] In some embodiments, in order to make advance predictions of malicious domain names in subsequent time periods, after obtaining each predicted character, the sliding window can be repeatedly moved to update the input sequence, and the predicted character at the next time point can be predicted to gradually construct a complete malicious domain name, thereby improving the accuracy of the entire domain name prediction.

[0146] Please refer to the figure. For example, if the input sequence corresponding to the current time step is "exyxsoi d.bazar", the predicted character of the current time step is "v" according to the input sequence prediction, and "v" is updated to the input sequence of the current time step to obtain "exyxsoi d.bazar v". Further, the sliding window is moved to update the input sequence of the next time step to "xyxsoi d.bazar v", and the predicted character of the next time step is "u" according to "xyxsoi d.bazar v". "u" is updated to the input sequence of the next time step to obtain "xyxso i d.bazar vu". Further, the sliding window is moved to update the input sequence of the next time step to "yxsoi d.bazar vu", and the predicted character of the next time step is predicted to be "t" based on "yxsoi d.bazarvu", and the cycle is repeated until the number of the updated multiple predicted characters reaches a preset number threshold. For the specific cyclic generation method of the predicted characters, please refer to the above, which is not listed here one by one.

[0147] Furthermore, the preset number threshold can be determined according to the volume of malicious domain names corresponding to the time period to be predicted. For example, when the volume of malicious domain names is small, a smaller preset number threshold can be set, such as 50, 100, etc.; when the volume of malicious domain names is large, a larger preset number threshold can be set, such as 300, 1000, etc., which is set according to the actual situation and is not specifically limited in the embodiments of the present application.

[0148] In some embodiments, when the initial input sequence corresponds to a first time period and a malicious domain name for a second time period needs to be predicted, and the first time period is equal to the second time period, then the predicted characters for the next time point can be repeatedly obtained until the updated input sequence does not contain the characters of the initial input sequence corresponding to the first time period, and multiple predicted characters corresponding to the second time period can be obtained.

[0149] By predicting each character one by one, and each predicted character is predicted based on the previous character, the entire generation process is more coherent, accurate and reasonable, making it easier to gradually build a complete malicious domain name.

[0150] In some implementations, in order to improve the accuracy and interception efficiency of the target model in predicting unknown malicious domain names, the preset model can be trained to obtain the target model, so that the trained target model can grasp the generation rules of malicious domain names, thereby accurately predicting malicious domain names in subsequent time steps. For example, the target model can be trained in the following ways:

[0151] (A.1) obtaining a sample input sequence, and inputting the sample input sequence into a preset model to obtain a plurality of sample prediction probabilities corresponding to a plurality of sample prediction characters predicted by the preset model;

[0152] (A.2) obtaining the true sample label character at the sample time step at the end of the sample input sequence, and calculating the target loss of the preset model based on the true sample label character, the multiple sample prediction characters and the corresponding multiple sample prediction probabilities;

[0153] (A.3) Train the preset model based on the target loss to obtain the target model.

[0154] The sample input sequence may be a sequence of sample characters contained in a sample sliding window of a fixed length, and based on the sample input sequence, the sample characters following the sample input sequence may be predicted.

[0155] The preset model may be based on a BiLSTM model, and the preset model adopts an encoder-decoder structure, wherein the encoder uses a Bi LSTM network model, and the decoder uses an LSTM layer and a fully connected layer. By training the preset model, a target model may be obtained.

[0156] Among them, the sample predicted character can be the character of the next sample time step predicted by a preset model based on the sample input sequence.

[0157] The sample prediction probability may be a probability value assigned by a preset model to each character in the index dictionary that may be a prediction result, and multiple probability values ​​constitute a probability distribution.

[0158] The true sample label character may be the character that actually appears in the next time step in the sample input sequence.

[0159] Among them, the target loss can be used to measure the difference between the probability distribution of the sample predicted characters output by the preset model and the real sample label characters. Exemplarily, the target loss can be a multivariate cross entropy loss.

[0160] In some embodiments, multiple sample input sequences can be obtained from a sample sequence through a sample sliding window, and the multiple sample input sequences can be predicted. According to the multiple sample prediction characters predicted for a sample input sequence each time and the corresponding multiple sample prediction probabilities, the target loss corresponding to the sample input sequence is calculated, and the parameters of the preset model are continuously adjusted accordingly to obtain the target model.

[0161] Exemplarily, if the sample input sequence is "examp l eco", the input value of "examp l eco" is preset in the model, and the preset model predicts the sample characters of the next sample time step of "examp l eco". If the preset model predicts multiple characters of the next sample time step, they are "m", and the corresponding sample prediction probability is 0.6, ".", and the corresponding sample prediction probability is 0.2, and the sample prediction probabilities of other characters are 0.2 in total, which will not be elaborated here.

[0162] Furthermore, the target loss of the preset model can be calculated based on the real sample label character, multiple sample prediction characters and the corresponding multiple sample prediction probabilities. Specifically, the gap between each character and the real sample label character can be determined based on the multiple sample prediction probabilities, and the target loss can be determined based on the gap. Exemplarily, if "m" is the correct character of the next sample time step, the target loss will be lower; otherwise, the target loss will be higher.

[0163] Furthermore, the preset model can be trained through multiple sample input sequences until the preset model reaches the convergence condition, and the target model can be obtained. The convergence condition can be that the number of times the preset model is trained reaches the preset number of training times, for example, the preset number of training times can be 500 times. When the number of times the preset model is trained reaches 500 times, the training of the preset model can be stopped to obtain the target model. The preset number of training times can be adjusted according to actual conditions. Alternatively, the convergence condition can also be that the number of times the target loss is continuously lower than the preset threshold exceeds the target number of times, for example, the target number of times is 10 times. When the number of times the target loss is continuously lower than the preset threshold exceeds 10 times, the training of the preset model can be stopped to obtain the target model.

[0164] By training the preset model and continuously adjusting the model parameters to obtain the target model, the target model can be enabled to make advance predictions of malicious domain names in future time periods, thereby improving the timeliness and accuracy of malicious domain name predictions.

[0165] In some embodiments, in order to effectively quantify the difference between the sample prediction characters and the real sample label characters, the first sub-loss between each sample prediction character and the real sample label character can be calculated, so as to calculate the target loss of the target model based on multiple first sub-losses, so that the model can better learn the mapping relationship between input and output, and improve the accuracy of prediction. For example, "calculating the target loss of the preset model based on the real sample label characters, multiple sample prediction characters and corresponding multiple sample prediction probabilities" in (A.2) may include:

[0166] (A.2.1) for each sample prediction character, determining a sample prediction probability corresponding to the sample prediction character;

[0167] (A.2.2) determining the first sub-loss corresponding to the corresponding sample prediction character according to the sample prediction probability and the true sample label character;

[0168] (A.2.3) Calculate the target loss of the preset model based on multiple first sub-losses corresponding to the characters predicted by multiple samples.

[0169] Among them, the first sub-loss can be a quantified value of the difference between the predicted character of each sample and the true sample label character at the next time step of the corresponding sample input sequence.

[0170] Exemplarily, a multivariate cross entropy function can be used to calculate the target loss of the preset model when predicting the sample input sequence. Specifically, the fully connected layer in the preset model can receive the output from the decoder, and the sample fusion hidden state vector corresponding to the sample input sequence is transformed linearly and activated by the Softmax function to generate the sample prediction probability of the target character category in all character indexes. All character indexes are index dictionaries composed of all sample characters that have appeared in the input sample training set, and the sample prediction probability distribution corresponding to multiple sample prediction characters is generated.

[0171] Among them, the output y of the fully connected layer t The mathematical expression of is as follows:

[0172] y t =W fc h t +b fc

[0173] Among them, W fc is the weight matrix of the fully connected layer, h t is the sample fusion hidden state vector, b fc is the bias of the fully connected layer.

[0174] Specifically, the output y of the fully connected layer is transformed into tConvert to sample prediction probability distribution The formula is as follows:

[0175]

[0176] Among them, t represents the sample time step, K represents the type of character index, and num_class represents the number of types of character index.

[0177] Furthermore, the target loss of the preset model can be calculated based on the sample prediction probability distribution. The specific formula for calculating the target loss Loss L is as follows:

[0178]

[0179] Among them, n is the total number of sample prediction characters, y t,i is the one-hot encoding of the real sample label character, It is the sample prediction probability of the i-th sample prediction character among multiple sample prediction characters output by the preset model.

[0180] For example, if the true sample label character is "b", and the sample prediction probability distribution predicted by the preset model is P("a") = 0.2, P("b") = 0.5, P("c") = 0.3, then for the next sample time step, the first sub-loss of "a" and the first sub-loss of "c" are both 0, and the first sub-loss of "b" is -log(P("b")) = -log(0.5).

[0181] Furthermore, the target loss of the preset model can be obtained by summing up the first sub-losses corresponding to the predicted characters of the multiple samples. The preset model can take the target loss as the target, and adjust the model parameters through optimization algorithms such as gradient descent, so that the target loss is gradually reduced, thereby making the prediction of the preset model for the sample input sequence closer and closer to the real sample label character.

[0182] By training the preset model by minimizing the target loss, the preset model can be forced to continuously deeply learn the rules of the sample input sequence during the training process, and more accurately learn the mapping relationship between input data and output labels, so as to improve the prediction performance of the preset model and facilitate accurate prediction of the sample characters at the next sample time step.

[0183] Step 106: determining a list of predicted malicious domain names based on the multiple predicted characters, and identifying the domain name to be identified according to the list of predicted malicious domain names.

[0184] In some embodiments, in order to intercept malicious domain names, predicted malicious domain names can be determined based on the predicted characters, and a predicted malicious domain name list can be generated based on all predicted malicious domain names. When a new domain name to be identified enters, it is matched according to the predicted malicious domain name list, thereby improving the timeliness and accuracy of intercepting malicious domain names.

[0185] The predicted malicious domain name list may be a list of predicted malicious domain names obtained by predicting an input sequence through a target model. The input sequence may be a sequence intercepted from a historical domain name sequence composed of malicious domain names.

[0186] Specifically, the malicious domain name list may include multiple predicted malicious domain names. A malicious domain name may be an Internet domain name used to conduct malicious activities. A malicious domain name may be used by bad elements for a variety of bad purposes, including but not limited to phishing websites, malware distribution, domain names in spam, etc.

[0187] For example, if the domain name to be identified is abc.com, it can be matched with the list of predicted malicious domain names obtained in advance to determine whether abc.com is in the list of predicted malicious domain names. If so, abc.com is a malicious domain name and needs to be intercepted; if not, abc.com is a non-malicious domain name and does not need to be intercepted.

[0188] Through the above method, the predicted characters of the subsequent multiple time steps can be used to pre-generate a corresponding list of predicted malicious domain names to quickly match the domain names to be identified, thereby reducing the amount of real-time calculations and improving the system's response speed and security protection level.

[0189] In some implementations, in order to ensure the generation of effective predicted malicious domain names, the multiple updated predicted characters may be divided according to the domain name division identifier to obtain multiple predicted malicious domain names, so as to facilitate subsequent matching of the domain name to be identified. For example, "determining a list of predicted malicious domain names based on multiple predicted characters" in step 106 may include:

[0190] (106.a1) Obtaining domain name division identification;

[0191] (106.a2) determining at least one domain name division identifier from the multiple updated predicted characters, and dividing the multiple predicted characters using the domain name division identifier as a division point to obtain multiple predicted malicious domain names;

[0192] (106.a3) Determine a list of predicted malicious domain names based on multiple predicted malicious domain names.

[0193] The domain name division mark may be a specific mark or character used to separate different predicted malicious domain names, which is generally generated together with the predicted characters. For example, the domain name division mark may be a space or other symbol that is different from the characters of the predicted malicious domain name.

[0194] For example, if the domain name partition identifier is a space, the predicted multiple characters are goodguy1example2a.com3malicious4evil5corp6, and 5 spaces, i.e. 5 domain name partition identifiers, can be determined from the multiple predicted characters. Then goodguy1example2a.com3malicious4evil5corp6 can be divided with the space as the dividing point to obtain the following predicted malicious domain names: goodguy1;example2;a.com3;malicious4;evil5;corp6. The multiple predicted malicious domain names are stored in the predicted malicious domain name list respectively.

[0195] Furthermore, in the list of predicted malicious domain names, the predicted malicious domain names can be classified and stored, so as to quickly match them in the list of predicted malicious domain names according to the categories of the domain names to be identified. Alternatively, in the list of malicious domain names, the predicted first characters of each predicted malicious domain name can be stored, and when matching the domain names to be identified, the first characters of the domain names to be identified can be quickly located to the relevant character area and further matched, so as to improve the matching efficiency.

[0196] Through the above method, the separation of predicted malicious domain names can be quickly achieved to facilitate user query and subsequent rapid matching based on the domain name to be identified.

[0197] In some implementations, in order to timely discover and prevent potential threats and protect the network system from malware, network attacks, etc., the domain name to be identified can be identified based on the predicted malicious domain name list to accurately determine whether the domain name to be identified is a malicious domain name, so as to improve the security of the system. For example, "identifying the domain name to be identified based on the predicted malicious domain name list" in step 106 can include:

[0198] (106.b1) Obtain the domain name to be identified, and match it with the predicted malicious domain name list according to the domain name to be identified to obtain a matching result;

[0199] (106.b2) According to the matching result, the identification result of the domain name to be identified is obtained.

[0200] The matching result may be a result obtained by comparing the domain name to be identified with each entry or entry of the corresponding category in the predicted malicious domain name list. The matching result indicates whether the domain name to be identified exists in the predicted malicious domain name list.

[0201] Among them, the identification result can be the result of the system determining whether the domain name to be identified should be marked as a malicious domain name based on the matching result. When the matching result indicates that the domain name to be identified exists in the predicted malicious domain name list, the identification result of the domain name to be identified is malicious; when the matching result indicates that the domain name to be identified does not exist in the predicted malicious domain name list, the identification result of the domain name to be identified is non-malicious.

[0202] For example, the predicted malicious domain name list is a.com, badguy.com, booth.com, example.com, evi l.com, and ma l icious.com, and the domain name to be identified is evi l.com. Then, the predicted malicious domain names example.com and evi l.com starting with "e" can be located in the predicted malicious domain name list according to the character "e". Further, the matching result evi l.com can be obtained. The identification result of evi l.com is a malicious domain name, and corresponding measures can be taken accordingly.

[0203] By generating a list of predicted malicious domain names through the target model, there is no need to consume a large amount of computing resources to analyze each domain name to be identified one by one. Instead, it only needs to quickly match the predicted malicious domain name list, which greatly improves the detection speed and ensures the security of the network environment.

[0204] Please refer to Figure 5 In some embodiments, the present application is combined with Figure 5 The overall process of the malicious domain name identification method is introduced. Specifically, the input sequence intercepted by the sliding window can be input into the input layer of the target model, and the discrete character indexes in the input sequence are converted into continuous high-dimensional vectors through the embedding layer to capture the semantic information of the characters, so that the target model can operate in a higher-dimensional space.

[0205] Furthermore, the input sequence can be processed in a forward time order by a first encoder, and the input sequence can be processed in a reverse time order by a second encoder to obtain a first hidden state vector output by the first encoder and a second hidden state vector output by the second encoder, and the first hidden state vector and the second hidden state vector can be concatenated through a connection layer to obtain a fused hidden state vector. Furthermore, the decoder of the target model can predict multiple characters of the current time step based on the fused hidden state vector, and the output of the decoder can be converted into a probability distribution through a fully connected layer, and the character with the highest probability can be selected as the predicted character of the next time step. In some embodiments, the decoder can include a fully connected layer.

[0206] In the embodiment of the present application, a sliding window is used to intercept an input sequence of the current time step from a historical domain name sequence located before the current time step; the input sequence is input into a target model, and a first hidden state vector of the input sequence is generated by a first encoder in the target model in a forward time sequence, and a second hidden state vector of the input sequence is generated by a second encoder in the target model in a reverse time sequence; a predicted character of the current time step is predicted by a decoder of the target model based on a fused hidden state vector of the first hidden state vector and the second hidden state vector; the predicted character is updated to the input sequence, the sliding window is moved to update the sequence to be predicted, the sequence to be predicted is input into the target model, and the predicted character of the next time step is predicted by the target model based on the sequence to be predicted; the steps of updating the predicted character to the input sequence, moving the sliding window to update the sequence to be predicted, inputting the sequence to be predicted into the target model, and predicting the predicted character of the next time step based on the sequence to be predicted by the target model are repeated until the number of the updated multiple predicted characters reaches a preset number threshold; a predicted malicious domain name list is determined based on the multiple predicted characters, and the domain name to be identified is identified according to the predicted malicious domain name list. In this way, the characters at the next time point can be predicted in real time, and the predicted malicious domain name list for the next time period can be obtained in advance, thereby improving the timeliness of malicious domain name detection. In addition, the present application predicts the predicted malicious domain name list based on the input sequence at the previous moment, rather than based on fixed rules and patterns. In the prediction process, it can also combine the forward time sequence and the reverse time sequence to generate a fused hidden state vector, which can enable the target model to understand the context information more accurately, so as to accurately predict the malicious domain name based on the domain name pattern at the previous moment and the precise context information, thereby improving the accuracy of malicious domain name recognition. In summary, the present application can improve the timeliness and accuracy of malicious domain name recognition.

[0207] See also Figure 6 The embodiment of the present application also provides a malicious domain name identification device, which can implement the above malicious domain name identification method. The malicious domain name identification device includes:

[0208] An interception module 61 is used to intercept the input sequence of the current time step from the historical domain name sequence before the current time step through a sliding window;

[0209] A generating module 62, configured to input the input sequence into the target model, and generate a first hidden state vector of the input sequence according to a forward time sequence through a first encoder in the target model, and generate a second hidden state vector of the input sequence according to a reverse time sequence through a second encoder in the target model;

[0210] A prediction module 63, configured to predict a predicted character at a current time step based on a fused hidden state vector of the first hidden state vector and the second hidden state vector through a decoder of a target model;

[0211] A moving module 64 is used to update the predicted character to the input sequence of the current time step, move the sliding window to update the input sequence of the next time step, input the input sequence of the next time step into the target model, and predict the predicted character of the next time step based on the input sequence of the next time step through the target model;

[0212] An updating module 65 is used to repeatedly execute the steps of updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step by the target model, until the number of the updated multiple predicted characters reaches a preset number threshold;

[0213] The identification module 66 is used to determine a list of predicted malicious domain names based on the multiple predicted characters, and identify the domain name to be identified according to the list of predicted malicious domain names.

[0214] The specific implementation of the malicious domain name identification device is basically the same as the specific implementation of the malicious domain name identification method described above, and will not be repeated here. On the premise of meeting the requirements of the embodiment of the present application, the malicious domain name identification device can also be provided with other functional modules to implement the malicious domain name identification method in the above embodiment.

[0215] The embodiment of the present application also provides a computer device, the computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the above malicious domain name identification method when executing the computer program. The computer device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0216] See also Figure 7 , Figure 7 The hardware structure of a computer device according to another embodiment is shown, and the computer device includes:

[0217] The processor 71 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0218] The memory 72 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 72 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 72, and the processor 71 calls and executes the malicious domain name identification method of the embodiment of this application;

[0219] Input / output interface 73, used to implement information input and output;

[0220] Communication interface 74, used to realize communication interaction between the device and other devices, which can be realized by wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WI FI, Bluetooth, etc.);

[0221] A bus 75 that transmits information between the various components of the device (e.g., the processor 71, the memory 72, the input / output interface 73, and the communication interface 74);

[0222] The processor 71 , the memory 72 , the input / output interface 73 and the communication interface 74 are connected to each other in communication within the device via a bus 75 .

[0223] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned malicious domain name identification method is implemented.

[0224] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0225] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0226] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0227] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0228] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0229] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0230] It should be understood that in the present application, "at least one (item)" and "several" refer to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and subsequent associated objects are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0231] In the several embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0232] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0233] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0234] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0235] The preferred embodiments of the present application are described above with reference to the accompanying drawings, but the scope of the rights of the present application is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present application should be within the scope of the rights of the present application.

Claims

1. A method for identifying malicious domain names, characterized in that: The method comprises: Through the sliding window, the input sequence of the current time step is intercepted from the historical domain name sequence before the current time step; Input the input sequence to the target model, and generate a first hidden state vector of the input sequence according to a forward time sequence by a first encoder in the target model, and generate a second hidden state vector of the input sequence according to a reverse time sequence by a second encoder in the target model; Predicting the predicted character of the current time step based on the fused hidden state vector of the first hidden state vector and the second hidden state vector by the decoder of the target model; Updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step by the target model; Repeating the steps of updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step by the target model, until the number of the updated multiple predicted characters reaches a preset number threshold; A predicted malicious domain name list is determined based on the multiple predicted characters, and the domain name to be identified is identified according to the predicted malicious domain name list.

2. The malicious domain name identification method according to claim 1, characterized in that: The step of generating a first hidden state vector of the input sequence according to a forward time order by a first encoder in the target model comprises: According to the forward time order, the earliest time step corresponding to the input sequence is determined as the forward starting time step, and the other time steps are determined as the forward intermediate time steps; Determining, by a first encoder in the target model, a forward hidden state and a forward cell state corresponding to the forward starting time step according to the forward character corresponding to the forward starting time step; For each of the forward intermediate time steps, the forward hidden state and the forward cell state corresponding to the previous time step are updated according to the forward hidden state and the forward cell state corresponding to the previous time step and the forward character input in the forward intermediate time step, until the forward hidden state and the forward cell state of the last forward intermediate time step are updated, so as to obtain a first hidden state vector composed of multiple forward hidden states corresponding to the input sequence.

3. The malicious domain name identification method according to claim 1, characterized in that: The step of generating a second hidden state vector of the input sequence according to a reverse time order by a second encoder in the target model comprises: Determine, in reverse time order, the latest time step corresponding to the input sequence as the reverse start time step, and determine the other time steps as the reverse intermediate time steps; Determining, by a second encoder in the target model, a reverse hidden state and a reverse cell state corresponding to the reverse starting time step according to the reverse character corresponding to the reverse starting time step; For each of the reverse intermediate time steps, the reverse hidden state and the reverse cell state corresponding to the subsequent time step are updated according to the reverse hidden state and the reverse cell state corresponding to the subsequent time step and the reverse character input in the reverse intermediate time step, until the reverse hidden state and the reverse cell state of the last reverse intermediate time step are updated, so as to obtain a second hidden state vector composed of multiple reverse hidden states corresponding to the input sequence.

4. The malicious domain name identification method according to claim 1, characterized in that: The step of determining a predicted malicious domain name list based on the plurality of predicted characters comprises: Get the domain name division identifier; Determine at least one domain name division identifier from the multiple updated predicted characters, and divide the multiple predicted characters using the domain name division identifier as a division point to obtain multiple predicted malicious domain names; Based on the multiple predicted malicious domain names, a predicted malicious domain name list is determined.

5. The malicious domain name identification method according to claim 1, characterized in that: The identifying the domain name to be identified according to the predicted malicious domain name list includes: Obtaining a domain name to be identified, and matching the domain name to be identified in the predicted malicious domain name list to obtain a matching result; According to the matching result, an identification result of the domain name to be identified is obtained.

6. The malicious domain name identification method according to claim 1, characterized in that: The target model is trained in the following way: Obtain a sample input sequence, and input the sample input sequence into a preset model to obtain a plurality of sample prediction probabilities corresponding to a plurality of sample prediction characters predicted by the preset model; Obtaining a true sample label character at a sample time step that is subsequent to the sample input sequence, and calculating a target loss of the preset model based on the true sample label character, the plurality of sample prediction characters, and the corresponding plurality of sample prediction probabilities; The preset model is trained based on the target loss to obtain a target model.

7. The malicious domain name identification method according to claim 6, characterized in that: The calculating the target loss of the preset model based on the real sample label character, the multiple sample prediction characters and the corresponding multiple sample prediction probabilities includes: For each of the sample prediction characters, determining a sample prediction probability corresponding to the sample prediction character; Determine a first sub-loss corresponding to the corresponding sample prediction character according to the sample prediction probability and the real sample label character; The target loss of the preset model is calculated according to the multiple first sub-losses corresponding to the multiple sample prediction characters.

8. A malicious domain name identification device, characterized in that: The device comprises: An interception module, used for intercepting the input sequence of the current time step from the historical domain name sequence before the current time step through a sliding window; A generating module, configured to input the input sequence into a target model, and generate a first hidden state vector of the input sequence according to a forward time sequence through a first encoder in the target model, and generate a second hidden state vector of the input sequence according to a reverse time sequence through a second encoder in the target model; A prediction module, configured to predict a predicted character of the current time step based on a fused hidden state vector of the first hidden state vector and the second hidden state vector through a decoder of the target model; A moving module, used for updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step through the target model; An updating module, configured to repeatedly execute the steps of updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step by the target model, until the number of the updated multiple predicted characters reaches a preset number threshold; The identification module is used to determine a list of predicted malicious domain names based on the multiple predicted characters, and identify the domain name to be identified according to the list of predicted malicious domain names.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the malicious domain name identification method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the malicious domain name identification method according to any one of claims 1 to 7 is implemented.

Images