Malicious domain name identification method, device, computer equipment and readable storage medium

Abstract

The embodiments of the present application provide a method, apparatus, computer device, and readable storage medium for identifying malicious domain names. The method comprises: intercepting the input sequence of the current time step through a sliding window; generating a first hidden state vector in a forward time sequence through a first encoder in a target model, and generating a second hidden state vector in a reverse time sequence through a second encoder in the target model; predicting the predicted character of the current time step through a decoder of the target model based on a fusion hidden state vector of the first hidden state vector and the second hidden state vector; moving the sliding window to update the input sequence of the next time step based on the predicted character and predicting the predicted character of the next time step; repeating the above steps until the number of multiple predicted characters obtained by the update reaches a preset number threshold; and identifying the domain name to be identified based on a list of predicted malicious domain names determined based on the multiple predicted characters. In this way, the timeliness and accuracy of malicious domain name identification can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of domain name identification, and in particular to a method, apparatus, computer device, and readable storage medium for identifying malicious domain names. Background Art

[0002] Domain Generation Algorithms (DGAs) are a widely used technique in cyberattacks. Malware can use DGAs to dynamically generate large numbers of domain names. Even if some domains are identified and blocked, the malware can still maintain communication with its servers through the generated new domains, posing a serious threat to network security.

[0003] To comprehensively detect malicious domain names, related technologies typically employ rule-based and statistical interception techniques. However, this type of detection consumes significant computing resources and memory, resulting in excessive computational time on resource-limited devices. This leads to significant lags in detection results, making it impossible to promptly block malicious domain connections. Furthermore, because this detection method relies on predefined rules and patterns, it may not adapt to new attack patterns, resulting in reduced accuracy in identifying malicious domain names. Summary of the Invention

[0004] The main purpose of the embodiments of the present application is to propose a malicious domain name identification method, apparatus, computer equipment and readable storage medium, which can improve the timeliness and accuracy of malicious domain name identification.

[0005] To achieve the above objectives, a first aspect of an embodiment of the present application provides a method for identifying malicious domain names, the method comprising:

[0006] Through the sliding window, the input sequence of the current time step is intercepted from the historical domain name sequence before the current time step;

[0007] Inputting the input sequence into a target model, generating a first hidden state vector of the input sequence by a first encoder in the target model in a forward time sequence, and generating a second hidden state vector of the input sequence by a second encoder in the target model in a reverse time sequence;

[0008] Predicting, by a decoder of the target model, a predicted character at the current time step based on a fused hidden state vector of the first hidden state vector and the second hidden state vector;

[0009] Updating the predicted character to the input sequence, moving the sliding window to update the sequence to be predicted, inputting the sequence to be predicted into the target model, and predicting the predicted character for the next time step based on the sequence to be predicted by the target model;

[0010] Repeating the steps of updating the predicted character to the input sequence, moving the sliding window to update the sequence to be predicted, inputting the sequence to be predicted into the target model, and predicting the predicted character for the next time step based on the sequence to be predicted by the target model, until the number of the updated multiple predicted characters reaches a preset number threshold;

[0011] A predicted malicious domain name list is determined based on the multiple predicted characters, and the domain name to be identified is identified according to the predicted malicious domain name list.

[0012] Accordingly, a second aspect of the embodiments of the present application provides a malicious domain name identification device, the device comprising:

[0013] The interception module is used to intercept the input sequence of the current time step from the historical domain name sequence before the current time step through a sliding window;

[0014] a generation module, configured to input the input sequence into a target model, and generate a first hidden state vector of the input sequence according to a forward time sequence by a first encoder in the target model, and generate a second hidden state vector of the input sequence according to a reverse time sequence by a second encoder in the target model;

[0015] A prediction module, configured to predict a predicted character at the current time step based on a fused hidden state vector of the first hidden state vector and the second hidden state vector through a decoder of the target model;

[0016] a moving module, configured to update the predicted character to the input sequence of the current time step, move the sliding window to update the input sequence of the next time step, input the input sequence of the next time step into the target model, and predict the predicted character of the next time step based on the input sequence of the next time step by the target model;

[0017] an updating module, configured to repeatedly execute the steps of updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step by the target model, until the number of the updated plurality of predicted characters reaches a preset number threshold;

[0018] The identification module is used to determine a predicted malicious domain name list based on the multiple predicted characters, and identify the domain name to be identified according to the predicted malicious domain name list.

[0019] In some embodiments, the generating module is further configured to:

[0020] Determine the earliest time step corresponding to the input sequence as the forward starting time step in forward time order, and determine the other time steps as forward intermediate time steps;

[0021] Determining, by a first encoder in the target model, a forward hidden state and a forward cell state corresponding to the forward starting time step according to the forward character corresponding to the forward starting time step;

[0022] For each of the forward intermediate time steps, the forward hidden state and the forward cell state corresponding to the previous time step are updated according to the forward hidden state and the forward cell state corresponding to the previous time step, and the forward character input in the forward intermediate time step, until the forward hidden state and the forward cell state of the last forward intermediate time step are updated, thereby obtaining a first hidden state vector consisting of multiple forward hidden states corresponding to the input sequence.

[0023] In some embodiments, the generating module is further configured to:

[0024] Determining, in reverse time order, the latest time step corresponding to the input sequence as the reverse starting time step, and determining the other time steps as reverse intermediate time steps;

[0025] Determining, by a second encoder in the target model, a reverse hidden state and a reverse cell state corresponding to the reverse starting time step according to the reverse character corresponding to the reverse starting time step;

[0026] For each of the reverse intermediate time steps, the reverse hidden state and the reverse cell state corresponding to the subsequent time step are updated according to the reverse hidden state and the reverse cell state corresponding to the subsequent time step, and the reverse character input in the reverse intermediate time step, until the reverse hidden state and the reverse cell state of the last reverse intermediate time step are updated, thereby obtaining a second hidden state vector composed of multiple reverse hidden states corresponding to the input sequence.

[0027] In some embodiments, the identification module is further configured to:

[0028] Get the domain name division identifier;

[0029] Determining at least one domain name division identifier from the multiple updated predicted characters, and dividing the multiple predicted characters using the domain name division identifier as a division point to obtain multiple predicted malicious domain names;

[0030] Based on the multiple predicted malicious domain names, a predicted malicious domain name list is determined.

[0031] In some embodiments, the identification module is further configured to:

[0032] Obtaining a domain name to be identified, and matching the domain name to be identified with the predicted malicious domain name list to obtain a matching result;

[0033] According to the matching result, an identification result of the domain name to be identified is obtained.

[0034] In some embodiments, the malicious domain name identification device further includes a training module for:

[0035] Obtaining a sample input sequence, and inputting the sample input sequence into a preset model to obtain a plurality of sample prediction probabilities corresponding to a plurality of sample prediction characters predicted by the preset model;

[0036] Obtaining a true sample label character at a sample time step subsequent to the sample input sequence, and calculating a target loss of the preset model based on the true sample label character, the plurality of sample prediction characters, and the corresponding plurality of sample prediction probabilities;

[0037] The preset model is trained based on the target loss to obtain a target model.

[0038] In some embodiments, the training module is further configured to:

[0039] For each of the sample predicted characters, determining a sample prediction probability corresponding to the sample predicted character;

[0040] Determine a first sub-loss corresponding to the corresponding sample prediction character according to the sample prediction probability and the true sample label character;

[0041] The target loss of the preset model is calculated based on the multiple first sub-losses corresponding to the multiple sample prediction characters.

[0042] Correspondingly, the third aspect of the embodiments of the present application proposes a computer device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the malicious domain name identification method described in any one of the embodiments of the first aspect of the present application when executing the computer program.

[0043] Correspondingly, the fourth aspect of the embodiments of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the malicious domain name identification method described in any one of the embodiments of the first aspect of the present application.

[0044] In an embodiment of the present application, a sliding window is used to intercept an input sequence of the current time step from a historical domain name sequence located before the current time step; the input sequence is input into a target model, and a first hidden state vector of the input sequence is generated by a first encoder in the target model in a forward time sequence, and a second hidden state vector of the input sequence is generated by a second encoder in the target model in a reverse time sequence; a decoder of the target model predicts a predicted character of the current time step based on a fused hidden state vector of the first hidden state vector and the second hidden state vector; the predicted character is updated to the input sequence, the sliding window is moved to update the sequence to be predicted, the sequence to be predicted is input into the target model, and the target model predicts the predicted character of the next time step based on the sequence to be predicted; the steps of updating the predicted character to the input sequence, moving the sliding window to update the sequence to be predicted, inputting the sequence to be predicted into the target model, and predicting the predicted character of the next time step based on the sequence to be predicted are repeated until the number of the updated multiple predicted characters reaches a preset number threshold; a predicted malicious domain name list is determined based on the multiple predicted characters, and the domain name to be identified is identified based on the predicted malicious domain name list. In this way, it is possible to predict the characters at the next time point in real time and obtain the predicted malicious domain name list for the next time period in advance, thereby improving the timeliness of malicious domain name detection. In addition, the present application predicts the list of predicted malicious domain names based on the input sequence of the previous moment, rather than based on fixed rules and patterns. In the prediction process, it can also combine the forward time sequence and the reverse time sequence to generate a fused hidden state vector, which can enable the target model to understand the context information more accurately, so as to accurately predict the malicious domain name based on the domain name pattern of the previous moment and the precise context information, thereby improving the accuracy of malicious domain name recognition. In summary, the present application can improve the timeliness and accuracy of malicious domain name recognition. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] Figure 1 This is a schematic diagram of the architecture of the malicious domain name identification system provided by an embodiment of the present application;

[0046] Figure 2 This is a flowchart of a malicious domain name identification method provided by an embodiment of the present application;

[0047] Figure 3 Schematic diagram of the process of splicing to obtain a fused hidden state vector provided in an embodiment of the present application;

[0048] Figure 4is a schematic diagram of predicting a predicted character provided by an embodiment of the present application;

[0049] Figure 5 This is an overall flow chart of the malicious domain name identification method provided by the embodiment of the present application;

[0050] Figure 6 This is a schematic diagram of the functional modules of the malicious domain name identification device provided in an embodiment of the present application;

[0051] Figure 7 This is a schematic diagram of the hardware structure of the computer device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0053] It should be noted that although the device schematics illustrate functional module divisions and the flowcharts illustrate logical sequences, in certain circumstances, the steps shown or described may be performed in a sequence that differs from the module divisions in the device or the sequence in the flowcharts. The terms "first," "second," and so on, in the specification, claims, and drawings, are used to distinguish similar items and are not necessarily used to describe a specific sequence or precedence.

[0054] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application pertains. The terms used herein are for the purpose of describing the embodiments of this application only and are not intended to limit this application.

[0055] Domain Generation Algorithms (DGAs) are a widely used technique in cyberattacks. Malware can use DGAs to dynamically generate large numbers of domain names. Even if some domains are identified and blocked, the malware can still maintain communication with its servers through the generated new domains, posing a serious threat to network security.

[0056] To comprehensively detect malicious domain names, related technologies typically employ rule-based and statistical interception techniques. However, this type of detection consumes significant computing resources and memory, resulting in excessive computational time on resource-limited devices. This leads to significant lags in detection results, making it impossible to promptly block malicious domain connections. Furthermore, because this detection method relies on predefined rules and patterns, it may not adapt to new attack patterns, resulting in reduced accuracy in identifying malicious domain names.

[0057] DGA is often used in malware and remote control software. It can pseudo-randomly generate a domain name sequence based on the input or default seed value (such as date, time, and other numerical values) to effectively avoid detection. Pseudo-random means that the string sequence appears to be random, but because its structure can be predetermined, it can be repeatedly generated and copied. And it is precisely because of the pseudo-randomness of the domain name sequence that the domain name sequence can be identified as a regular time series. Based on this, the embodiments of the present application provide a malicious domain name identification method, device, computer equipment and readable storage medium, which can improve the timeliness and accuracy of malicious domain name identification.

[0058] The malicious domain name identification method, apparatus, computer device, and readable storage medium provided in the embodiments of the present application are specifically illustrated through the following embodiments. First, the malicious domain name identification system in the embodiments of the present application is described.

[0059] Please refer to Figure 1 In some implementations, the present application provides a malicious domain name identification system, which includes a terminal 11 and a server 12.

[0060] For example, the terminal 11 can be a user's computer, mobile device, IoT device, router, or any other device that may be subject to network attacks. Specifically, the terminal 11 can detect network traffic and, when a domain name needs to be detected, match it with a list of predicted malicious domain names to determine whether the domain name is malicious.

[0061] Exemplarily, the server end 12 can be a cloud server, a dedicated security server, or other device with high computing and storage capabilities, used to perform complex tasks, such as training preset models and generating a list of predicted malicious domain names.

[0062] Furthermore, terminal 11 and server 12 can interact over the network. The terminal sends network activity data to server 12, which leverages its powerful computing capabilities to analyze the data, train models, and generate a list of predicted malicious domain names. Server 12 then sends the updated list of predicted malicious domain names to terminal 11, which uses it to decide whether to block access to the domain name being identified. Terminal 11 can leverage the server's processing power to improve detection efficiency, reduce its own resource consumption, and enhance the timeliness and accuracy of malicious domain name identification.

[0063] The malicious domain name identification method in the embodiment of the present application can be illustrated by the following embodiment.

[0064] It should be noted that in each specific embodiment of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first. Moreover, the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0065] In the embodiment of the present application, the malicious domain name identification device will be described from the perspective of the malicious domain name identification device, which can be integrated into a computer device. Figure 2 , Figure 2 This is a flowchart of the steps of the malicious domain name identification method provided in an embodiment of the present application. In this embodiment of the present application, the malicious domain name identification device is specifically integrated into a terminal or server as an example. When the processor on the terminal or server executes the program instructions corresponding to the malicious domain name identification method, the specific process is as follows:

[0066] Step 101: Using a sliding window, extract the input sequence of the current time step from the historical domain name sequence before the current time step.

[0067] In some embodiments, in order to facilitate the prediction of subsequently appearing characters, an input sequence can be extracted from an existing domain name sequence by setting a sliding window, so as to learn the context information needed to predict the current time step after the first time period based on the input sequence, and accurately predict the characters of the current time step.

[0068] The sliding window can be a fixed-size movable window that moves across the historical domain name sequence, each time it moves one time step, i.e., one character. Each time a predicted character is predicted, the sliding window is slid to cover the predicted character, and the next character after the predicted character is predicted. Specifically, the length of the sliding window can be preset based on actual conditions.

[0069] The current time step may be a time point for starting to predict characters, that is, a time step for starting to predict malicious domain names.

[0070] The historical domain name sequence can be a series of domain names arranged in chronological order. These domain names can be generated by DGA or actual access records collected from network traffic. Since malicious domain names need to be predicted, the historical domain name sequence can be composed of malicious domain names.

[0071] The input sequence can be a partial sequence extracted from a domain name sequence using a sliding window. To predict subsequent characters that have not yet been generated, the input sequence can be selected using the sliding window from the last segment of a generated or predicted domain name sequence. For example, if the domain name sequence is "binca.com" and the character prediction for the next time step is required, and the sliding window length is 3, the input sequence can be "com."

[0072] For example, suppose a historical domain name sequence S = [s1, s2, ..., s N ], the length of the sliding window is W. Further, if it is necessary to predict the character at the current time step i+W, an input sequence of length W can be extracted from the historical domain name sequence S [s i ,s i+1 ,...,s i+w-1 ], the input sequence can include multiple characters, where i represents the starting position of the sliding window.

[0073] Input sequence: [s i ,s i+1 ,...,s i+w-1 ]

[0074] Target y i =S i+w

[0075] In some embodiments, the length of the input sequence captured by the sliding window can be adjusted based on sequence regularity. For example, if the sequence regularity indicates that the length of the main portion varies between 3 and 7 characters, and the top-level domain is typically .com, the sliding window length can be set to 7 characters plus the length of the top-level domain, or 11 characters. It is understood that the input sequence should be able to fully convey the contextual information of the character to be predicted in order to accurately predict the character to be predicted. At the same time, the input sequence should not be too long, as this will affect the prediction process.

[0076] Through the above method, context information that can effectively predict the characters of the next time step can be effectively extracted from the existing data, so that the predicted characters of the next time step can be generated in advance, thereby improving the accuracy and timeliness of the prediction.

[0077] In step 102, the input sequence is input into the target model, and a first hidden state vector of the input sequence is generated by a first encoder in the target model in a forward time sequence, and a second hidden state vector of the input sequence is generated by a second encoder in the target model in a reverse time sequence.

[0078] In some embodiments, in order to fully utilize the contextual information of the input sequence, the forward and reverse information of the input sequence can be processed simultaneously by the target model to capture the bidirectional dependency of the input sequence and achieve accurate prediction of the character in the next time step of the subsequent sequence.

[0079] Among them, the target model can be a trained bidirectional long short-term memory network (BiLSTM). The target model can capture the contextual information of the input sequence by introducing the first encoder (forward LSTM layer) and the second encoder (reverse LSTM layer) to more comprehensively understand the contextual relationship of the input sequence.

[0080] The first encoder can be a forward LSTM unit in the target model. The first encoder can process the input sequence in forward chronological order, starting from the first character of the input sequence and processing each character in chronological order until the last character of the input sequence. For each time step of the input sequence, the first encoder generates a hidden state vector in forward chronological order. The hidden state vector represents the information of the corresponding time step and is based on all information in the input sequence before the time step, until the first hidden state vector of the last time step of the input sequence is obtained. The first hidden state vector can contain information of multiple forward time steps of the entire input sequence.

[0081] The first hidden state vector may be a combination of hidden states consisting of multiple hidden states generated by the first encoder at multiple time steps of the input sequence. The first hidden state vector contains all information of the input sequence from the first time step to the last time step.

[0082] The second encoder can be a reverse LSTM unit in the target model. The first encoder can process the input sequence in reverse chronological order, starting from the last character of the input sequence and processing each character in chronological order until the first character of the input sequence. For each time step of the input sequence, the first encoder generates a hidden state vector in reverse chronological order. The hidden state vector represents the information of the corresponding time step and is based on all information after the time step in the input sequence, until a second hidden state vector for the first time step of the input sequence is obtained. The second hidden state vector can contain information for multiple reverse time steps of the entire input sequence.

[0083] The second hidden state vector may be a combination of hidden states consisting of multiple hidden state vectors generated by the second encoder at multiple time steps of the input sequence. The second hidden state vector contains all information of the input sequence from the last time step to the first time step.

[0084] For example, consider the input sequence "example.com" and feed it into the target model. The target model's first encoder processes the input sequence starting from the leftmost character, reading each character in turn. For the input sequence "example.com," the first character processed is "e," followed by "x," and so on, until the last character, "m," is reached.

[0085] As the first encoder processes each character, it updates its internal state, producing a forward hidden state vector. When the first encoder completes processing the entire input sequence, the hidden state vector at the last time step contains the forward information about the input sequence, from the start character to the end character. Subsequently, multiple forward hidden state vectors from multiple time steps can be combined to form the first hidden state vector.

[0086] Furthermore, the first encoder of the target model will start processing from the rightmost character of the input sequence, reading each character in turn. For the input sequence "example.com", the first character processed is "m", then "o", and so on, until the first character "e" is processed.

[0087] As the second encoder processes each character, it updates its internal state, producing a reverse hidden state vector. When the second encoder completes processing the entire input sequence, the hidden state vector at the first time step contains reverse information about the input sequence, that is, all information from the end character to the start character. Subsequently, multiple reverse hidden state vectors across multiple time steps can be combined to form the second hidden state vector.

[0088] By obtaining the first hidden state vector generated by the first encoder and the second hidden state vector generated by the second encoder, a more accurate and comprehensive sequence data analysis of the input sequence can be fully performed, while also avoiding the problems of gradient vanishing and gradient exploding during the preset model training process.

[0089] In some embodiments, to enable the target model to build an understanding of the entire input sequence, the forward character of each time step may be iteratively processed in forward time order to generate a first hidden state vector representing the overall characteristics of the entire input sequence. For example, the step 102 of "generating the first hidden state vector of the input sequence in forward time order by the first encoder in the target model" may include:

[0090] (102.a1) Determine the earliest time step corresponding to the input sequence as the forward starting time step in forward time order, and determine the remaining time steps as forward intermediate time steps;

[0091] (102.a2) determining, by the first encoder in the target model, the forward hidden state and the forward cell state corresponding to the forward starting time step according to the forward character corresponding to the forward starting time step;

[0092] (102.a3) For each forward intermediate time step in turn, update the forward hidden state and forward cell state corresponding to the previous time step according to the forward hidden state and forward cell state corresponding to the previous time step, as well as the forward character input in the forward intermediate time step, until the forward hidden state and forward cell state of the last forward intermediate time step are updated, and the first hidden state vector consisting of multiple forward hidden states corresponding to the input sequence is obtained.

[0093] The forward time order may be the time direction when processing the input sequence, specifically the order from the beginning to the end of the sequence, that is, the order from front to back.

[0094] The forward start time step may be the first time step in a given input sequence, and data processing begins from the forward start time step.

[0095] The forward intermediate time step can be any time step other than the start time step. At the forward intermediate time step, the target model uses the information from the previous forward start time step and all forward intermediate time steps to help process the data of the current forward intermediate time step.

[0096] The forward character may be an input character at a corresponding time step when processing the input sequence.

[0097] The forward hidden state can be the internal state of the target model at each time step. The forward hidden state contains a summary of the information from the forward start time step up to the current forward intermediate time step and is passed to the next forward intermediate time step. At the forward start time step, the forward hidden state is usually initialized.

[0098] The forward cell state can be a mechanism for carrying long-term information. The forward cell state can selectively retain or discard fragments of information through a gating mechanism, thereby helping to alleviate the vanishing gradient problem. At the forward start time step, the forward cell state is initialized.

[0099] Exemplarily, the first encoder includes at least an input gate i t 、Forget Gate t , output gate o t ; In addition, the parameters involved include the forward hidden state h of the previous time step t-1 and the positive cell state c t-1 , and the representation vector x of the forward character input at the current time step tand the positive cell state c t , forward character x t Represents the representation vector of the positive character input at the current time step, cell state c t-1 Then the above features of the forward propagation are recorded, and the forward hidden state h t-1 Can also be considered as the above features.

[0100] Specifically, the forget gate f t Contains σ (Sigmod) unit, the forget gate can be based on the representation vector x of the forward character input at the current forward intermediate time step t and the forward hidden state h of the previous time sequence t-1 The weight is calculated and normalized by Sigmod neurons to obtain a result f between (0, 1) t , by converting the result f t Compared with the cell state c in the previous time series t-1 Multiply them together to fuse and forget some unnecessary information. Among them, the representation vector x of the character input at the current time step is t and the forward hidden state h of the previous time step t-1 The weight calculation process is as follows:

[0101] f t =σ(W fx x t +W fh h t-1 +b f )

[0102] Among them, W fx and W fh represents the weight matrix parameter of the forget gate, b f Represents the bias parameter of the forget gate.

[0103] Specifically, the input gate contains a σ (Sigmod) unit and a tanh unit, which is used to determine whether the representation vector of the positive character input at the current time step needs to be stored in the cell state c at the current time step. t Specifically, the input gate can be based on the representation vector x of the forward character input at this time step t and the forward hidden state h of the previous time sequence t-1 The weight is calculated and normalized by the σ unit to obtain the result i with a value between (0, 1) t , to indicate the feature information that needs to be memorized and updated. The calculation process is as follows:

[0104] i t =σ(W ix x t +Wih h t-1 +b i )

[0105] Among them, W ix and W ih represents the weight matrix parameter of the input gate, b i Represents the bias parameter.

[0106] In addition, the input gate is also based on the representation vector x of the forward character input at the current time step t and the forward hidden state h of the previous time step t-1 The weights are calculated and normalized by the tanh unit to obtain a value between (-1, 1) Represents the candidate memory information, which can also be called the candidate forward cell state. The weight calculation process is:

[0107]

[0108] Among them, W cx and W ch represents the weight matrix parameter of the input gate, b c Represents the bias parameter of the input gate.

[0109] Furthermore, the candidate positive cell state The feature information i that needs to be updated is t Multiply them to achieve the fusion between the two and obtain the final information that the input gate needs to remember at the current time step, that is, the forward cell state of the current forward intermediate time step. Then, based on the final information that needs to be remembered and the forward cell state c of the previous time sequence, t-1 and forget information f t , determine the cell state c at the current time sequence t The specific calculation process is as follows:

[0110]

[0111] It should be noted that the output of the forget gate is f t and the forward cell state c at the previous time step t-1 Multiplication indicates that part of the feature information that needs to be forgotten in the previous feature that is passed to the intermediate time step at the previous moment. t With the current candidate forward cell state Multiplication indicates that the input gate needs to remember the feature information in the cell state at the current time step. So far, by forgetting the information in the forward cell state and memorizing new information, the information useful for subsequent moment calculations can be transmitted, while useless information is discarded, and the cell state c at the current time step is obtained.t .

[0112] Specifically, the output gate includes a σ (Sigmod) unit, a tanh unit, and a fusion unit, which are used to determine the forward hidden state result at the current time step. The output gate can be based on the character representation vector x input at the time step. t and the forward hidden state h of the previous time step t-1 The weight calculation is performed and the σ unit is normalized to obtain the result o with a value between (0, 1) t , the result is t Indicates the forward cell state that needs to be output at the current time step. The calculation process is as follows:

[0113] o t =σ(W ox x t +W oh h t-1 +b o )

[0114] Among them, W ox and W oh represents the weight matrix parameter of the output gate, b o Represents the bias parameter of the output gate.

[0115] In addition, the output gate is also based on the forward cell state c at the current time step t Based on the tanh function, nonlinear changes are performed and the nonlinear change processing results are compared with the positive cell state o output at the current time step. t Multiply them together to fuse and get the forward hidden state h at the current time step t , which belongs to the positive cell state c t The eigenvector after attenuation, in addition, h t It also belongs to the input of the forward hidden state of the next forward intermediate time step. The specific calculation process is:

[0116] h t =o t tanh(c t )

[0117] At this point, the forward propagation processing of the first encoder in the target model has been described. The forward propagation processing for each forward intermediate time step can refer to the above embodiment. Specifically, when processing a forward time sequence, the starting time step of the input sequence is first determined as the forward starting time step, and the remaining time steps are considered forward intermediate time steps. For the forward starting time step, the first encoder calculates the initial hidden state and initial cell state based on the forward character. Next, for each forward intermediate time step, the forward cell state and forward hidden state are updated using a forget gate, input gate, and output gate mechanism based on the forward hidden state and forward cell state of the previous time step and the forward character of the current time step. The forget gate determines which information is discarded, the input gate determines which new information is added to the cell state, and the output gate determines which information is output as the forward hidden state for the current forward intermediate time step. This process continues until the last forward intermediate time step of the sequence, resulting in the final hidden state vector for the entire input sequence, i.e., the first hidden state vector composed of multiple forward hidden states.

[0118] By introducing a first encoder with input, forget, and output gates, it is possible to effectively selectively forget irrelevant information while retaining key information when processing the input sequence, thereby optimizing the target model's ability to capture long-term dependencies. This mechanism not only helps alleviate the vanishing gradient problem but also improves the target model's understanding of the input sequence, ensuring that important information is passed to subsequent calculation steps, ultimately improving the overall model's performance and prediction accuracy.

[0119] In some embodiments, in order to capture bidirectional contextual information when processing the input sequence, a reverse time order may be introduced to generate a second hidden state vector to capture information from the end of the sequence to the current time step. For example, in step 102, "generating a second hidden state vector of the input sequence by a second encoder in the target model in reverse time order" may include:

[0120] (102.b1) According to the reverse time order, the latest time step corresponding to the input sequence is determined as the reverse starting time step, and the other time steps are determined as the reverse intermediate time steps;

[0121] (102.b2) determining, by the second encoder in the target model, the reverse hidden state and the reverse cell state corresponding to the reverse starting time step according to the reverse character corresponding to the reverse starting time step;

[0122] (102.b3) For each reverse intermediate time step in turn, according to the reverse hidden state and reverse cell state corresponding to the subsequent time step and the reverse character input in the reverse intermediate time step, update the reverse hidden state and reverse cell state corresponding to the reverse intermediate time step until the reverse hidden state and reverse cell state of the last reverse intermediate time step are updated, and obtain the second hidden state vector composed of multiple reverse hidden states corresponding to the input sequence.

[0123] Among them, the reverse time order can be the time direction used when processing the input sequence, specifically the order from the end to the beginning of the input sequence, that is, the order from back to front. The reverse time order is opposite to the forward time order, which is to start processing from the reverse character of the first time step of the sequence to the reverse character of the last time step.

[0124] The reverse start time step may refer to the last time step in a given input sequence, which is the starting point of the reverse process. Starting from the reverse start time step, the reverse process will proceed backward along the sequence.

[0125] The reverse intermediate time step can be any time step other than the reverse start time step. At the reverse intermediate time step, the target model will use the information of the subsequent reverse start time step and all reverse intermediate time steps to help process the data of the current reverse intermediate time step.

[0126] The reverse character may be an input character at a corresponding time step when processing the input sequence, and the reverse character is processed in reverse time order.

[0127] The reverse hidden state refers to the state within the target model during each time step. The reverse hidden state is updated in reverse time order. The reverse hidden state contains a summary of information from the reverse start time step to the current reverse intermediate time step and is propagated to the previous reverse intermediate time step. At the reverse start time step, the reverse hidden state is typically initialized.

[0128] The reverse cell state can be a mechanism for carrying long-term information. Similar to the forward cell state, it is updated in reverse chronological order. The reverse cell state can selectively retain or discard information fragments through a gating mechanism, thereby helping to alleviate the vanishing gradient problem. At the reverse start time step, the reverse cell state is also initialized.

[0129] Specifically, when processing a reverse time sequence, the ending time step of the input sequence is first determined as the reverse starting time step, and the remaining time steps are considered as reverse intermediate time steps. For the reverse starting time step, the initial hidden state and initial cell state are calculated based on the reverse character through the second encoder. Then, for each reverse intermediate time step, based on the reverse hidden state and reverse cell state of the next time step and the reverse character of the current reverse intermediate time step, the reverse cell state and reverse hidden state are updated through a mechanism of forget gate, input gate, and output gate. The forget gate determines which information is discarded, the input gate determines which new information is added to the reverse cell state, and the output gate determines which information is output as the reverse hidden state for the current reverse intermediate time step. This process continues until the first reverse intermediate time step of the input sequence, thereby obtaining the final reverse hidden state vector of the entire input sequence, that is, the second hidden state vector composed of multiple reverse hidden states.

[0130] The reverse propagation process of the second encoder is identical to the forward propagation process, differing only in the direction of the input character representation vectors. Specifically, the representation vector of each reverse character is processed from back to front in the reverse order of the input sequence as input. This embodiment of the application does not elaborate on the reverse propagation process; for details, please refer to the aforementioned first encoder's processing of the input sequence.

[0131] By adopting reverse time sequence processing and introducing an encoder with input gate, forget gate and output gate mechanism, it is possible to effectively selectively forget irrelevant information and retain key information when processing the input sequence, thereby optimizing the target model's ability to capture long-term dependencies from the end to the beginning; this mechanism not only helps to alleviate the gradient vanishing problem, but also enhances the target model's understanding of the end information of the input sequence, ensuring that important information can be passed back to the previous calculation steps, ultimately improving the overall performance and prediction accuracy of the target model.

[0132] Step 103 , predicting the predicted character of the current time step based on the fused hidden state vector of the first hidden state vector and the second hidden state vector through the decoder of the target model.

[0133] In some embodiments, in order to obtain richer and more complete sequence features of the input sequence, the first hidden state vector generated in forward time order according to the time step and the second hidden state vector generated in reverse time order can be spliced ​​to obtain a fused hidden state vector, so that the target model can obtain the global information in the input sequence and improve the accuracy of predicting the predicted characters.

[0134] The fused hidden state vector may be a vector formed by concatenating the first hidden state vector and the second hidden state vector according to each time step in the target model.

[0135] The predicted character can be in the target model, where the decoder predicts the next character of the input sequence based on the fused hidden state vector.

[0136] Please refer to Figure 3 In some embodiments, combined Figure 3 The process of concatenating the first hidden state vector and the second hidden state vector to obtain the fused hidden state vector is given as an example. For example, if there is an input sequence A, in the process of predicting the predicted character of the current time step through the input sequence, the first hidden state vector is raeb and the corresponding forward cell state, and the second hidden state vector is bear and the corresponding reverse cell state (the cell state can be represented by LSTM Ce ll, for the specific direction of the cell state, please refer to Figure 3 ), a fused hidden state vector can be obtained by concatenating the first hidden state vector and the second hidden state vector, and concatenating the forward cell state and the reverse cell state. Specifically, the fused hidden state vector can be obtained by concatenating "r" and "b" and the corresponding cell state of the first time step, concatenating "a" and "e" and the corresponding cell state of the second time step, concatenating "e" and "a" and the corresponding cell state of the third time step, and concatenating "b" and "r" and the corresponding cell state of the fourth time step.

[0137] Furthermore, the decoder of the target model can predict the predicted character at the current time step based on the fused hidden state vector. The decoder usually uses a linear layer to convert the fused hidden state vector into a prediction distribution and then selects the character with the highest probability as the predicted character.

[0138] For example, please refer to Figure 4 The decoder usually uses a linear layer to convert the fused hidden state vector into a prediction distribution, and then selects the character with the highest probability as the predicted character. When predicting the input sequence "exyxsoi d.bazar (followed by a space)", the predicted character at the current time step can be predicted as "v" based on the fused hidden state vector corresponding to the input sequence.

[0139] By fusing the first hidden state vector in the forward time sequence and the second hidden state vector in the reverse time sequence, the target model can obtain the global information of the input sequence. This fusion of two-way information helps to improve the target model's understanding of the input sequence, more accurately capture the long-distance dependencies of the sequence, and improve the accuracy of the predicted character prediction for the current time step.

[0140] Step 104: Update the predicted character to the input sequence of the current time step, move the sliding window to update the input sequence of the next time step, input the input sequence of the next time step into the target model, and predict the predicted character of the next time step based on the input sequence of the next time step through the target model.

[0141] In some embodiments, in order to ensure the relevance of the context and the consistency of the prediction, the predicted characters for the next time step can be generated each time, that is, the sliding window is moved to update the input sequence for the next time step, so that the target model can continuously receive new input sequences and make predictions for the next time step based on them, thereby improving the continuity and accuracy of the prediction.

[0142] Please refer to Figure 4 Assuming the initial input sequence is "exyxsoi d.bazar (followed by a space)", the predicted character for the current time step is predicted to be "v" based on the fused hidden state vector of "exyxsoi d.bazar (followed by a space)". Furthermore, since the length of the sliding window is fixed, the predicted character "v" can be updated to the input sequence of the current time step "exyxsoi d.bazar (followed by a space)" to obtain "exyxsoi d.bazar v". The sliding window is then moved to obtain the input sequence of the next time step as "xyxsoi d.bazar v". Furthermore, the target model can predict the predicted character for the next time step to be "u".

[0143] In this way, a sliding window can be used to ensure that the target model only focuses on the most recent sequence at each prediction. This helps the target model reduce its dependence on early input without adjusting the model's own architecture, thereby avoiding long-term dependency problems and improving the efficiency and accuracy of character prediction.

[0144] Step 105, repeatedly executing the steps of updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step through the target model, until the number of the updated multiple predicted characters reaches a preset number threshold.

[0145] In some embodiments, in order to make advance predictions of malicious domain names in subsequent time periods, the sliding window can be repeatedly moved to update the input sequence after obtaining each predicted character, and the predicted character at the next time point can be predicted to gradually construct a complete malicious domain name, thereby improving the accuracy of the entire domain name prediction.

[0146] As shown in the figure, for example, if the input sequence corresponding to the current time step is "exyxsoi d.bazar", the predicted character for the current time step is "v" based on the input sequence prediction. "v" is updated to the input sequence of the current time step, resulting in "exyxsoi d.bazar v". Furthermore, the sliding window is moved to update the input sequence for the next time step to "xyxsoi d.bazar v". Based on "xyxsoi d.bazar v", the predicted character for the next time step is "u". "u" is updated to the input sequence of the next time step, resulting in "xyxso i d.bazar vu". Furthermore, the sliding window is moved to update the input sequence for the next time step to "yxsoi d.bazar vu", and the predicted character for the next time step is predicted to be "t" based on "yxsoi d.bazarvu". This process is repeated until the number of the updated predicted characters reaches a preset threshold. For the specific method of generating predicted characters in a loop, please refer to the above and will not be listed here.

[0147] Furthermore, the preset number threshold can be determined based on the volume of malicious domain names corresponding to the time period to be predicted. For example, when the volume of malicious domain names is small, a smaller preset number threshold can be set, such as 50, 100, etc.; when the volume of malicious domain names is large, a larger preset number threshold can be set, such as 300, 1000, etc. The specific setting depends on the actual situation and is not specifically limited in the embodiments of this application.

[0148] In some embodiments, when the initial input sequence corresponds to a first time period and a malicious domain name for a second time period needs to be predicted, and the first time period is equal to the second time period, then the predicted characters for the next time point can be repeatedly obtained until the updated input sequence does not contain the characters of the initial input sequence corresponding to the first time period, and multiple predicted characters corresponding to the second time period can be obtained.

[0149] By predicting each character one by one, and each predicted character is based on the previous character, the entire generation process is made more coherent, accurate and reasonable, making it easier to gradually build a complete malicious domain name.

[0150] In some embodiments, to improve the accuracy and interception efficiency of the target model for predicting unknown malicious domain names, a preset model can be trained to obtain a target model, so that the trained target model can grasp the generation patterns of malicious domain names and accurately predict malicious domain names in subsequent time steps. For example, the target model can be trained by:

[0151] (A.1) Obtaining a sample input sequence and inputting the sample input sequence into a preset model to obtain a plurality of sample prediction probabilities corresponding to the plurality of sample prediction characters predicted by the preset model;

[0152] (A.2) Obtaining the true sample label character at the sample time step that is subsequent to the sample input sequence, and calculating the target loss of the preset model based on the true sample label character, the multiple sample prediction characters, and the corresponding multiple sample prediction probabilities;

[0153] (A.3) Train the preset model based on the target loss to obtain the target model.

[0154] The sample input sequence may be a sequence of sample characters contained in a sample sliding window of a fixed length, and based on the sample input sequence, the sample characters following the sample input sequence may be predicted.

[0155] The preset model can be based on a BiLSTM model, which uses an encoder-decoder structure, where the encoder uses a BiLSTM network model and the decoder uses an LSTM layer and a fully connected layer. By training the preset model, a target model can be obtained.

[0156] The sample predicted character may be the character of the next sample time step predicted by a preset model based on the sample input sequence.

[0157] The sample prediction probability may be a probability value assigned by a preset model to each character in the index dictionary that may be a prediction result, and multiple probability values ​​constitute a probability distribution.

[0158] The true sample label character may be the character that actually appears in the next time step of the sample input sequence.

[0159] Among them, the target loss can be used to measure the difference between the probability distribution of the sample predicted characters output by the preset model and the real sample label characters. Exemplarily, the target loss can be a multivariate cross entropy loss.

[0160] In some embodiments, multiple sample input sequences can be obtained from a sample sequence through a sample sliding window, and predictions can be made on the multiple sample input sequences. Based on the multiple sample prediction characters predicted for each sample input sequence and the corresponding multiple sample prediction probabilities, the target loss corresponding to the sample input sequence is calculated, and the parameters of the preset model are continuously adjusted accordingly to obtain a target model.

[0161] For example, if the sample input sequence is "examp l eco", the input value of "examp l eco" is preset in the model, and the preset model predicts the sample characters of the next sample time step of "examp l eco". If the preset model predicts multiple characters of the next sample time step, they are "m", the corresponding sample prediction probability is 0.6, ".", the corresponding sample prediction probability is 0.2, and the sample prediction probabilities of other characters are 0.2 in total, which will not be elaborated here.

[0162] Furthermore, the target loss of the preset model can be calculated based on the true sample label character, multiple sample predicted characters, and the corresponding multiple sample prediction probabilities. Specifically, the difference between each character and the true sample label character can be determined based on the multiple sample prediction probabilities, and the target loss can be determined based on the difference. For example, if "m" is the correct character for the next sample time step, the target loss will be low; otherwise, the target loss will be high.

[0163] Furthermore, the preset model can be trained using multiple sample input sequences until the preset model reaches a convergence condition, and a target model can be obtained. The convergence condition can be that the number of times the preset model is trained reaches a preset number of training times, for example, the preset number of training times can be 500 times. When the number of times the preset model is trained reaches 500 times, the training of the preset model can be stopped to obtain the target model. The preset number of training times can be adjusted according to actual conditions. Alternatively, the convergence condition can also be that the number of times the target loss is continuously lower than a preset threshold exceeds the target number of times, for example, the target number of times is 10 times. When the number of times the target loss is continuously lower than the preset threshold exceeds 10 times, the training of the preset model can be stopped to obtain the target model.

[0164] By training the preset model and continuously adjusting the model parameters to obtain the target model, the target model can be enabled to make advance predictions of malicious domain names in future time periods, thereby improving the timeliness and accuracy of malicious domain name predictions.

[0165] In some embodiments, in order to effectively quantify the difference between the sample predicted characters and the true sample label characters, a first sub-loss can be calculated between each sample predicted character and the true sample label character, so as to calculate the target loss of the target model based on multiple first sub-losses, so that the model can better learn the mapping relationship between input and output, thereby improving the accuracy of prediction. For example, in (A.2), "calculating the target loss of the preset model based on the true sample label character, multiple sample predicted characters, and corresponding multiple sample prediction probabilities" may include:

[0166] (A.2.1) For each sample predicted character, determining a sample prediction probability corresponding to the sample predicted character;

[0167] (A.2.2) Determine the first sub-loss corresponding to the corresponding sample prediction character based on the sample prediction probability and the true sample label character;

[0168] (A.2.3) Calculate the target loss of the preset model based on multiple first sub-losses corresponding to the characters predicted by multiple samples.

[0169] The first sub-loss may be a quantified value of the difference between the predicted character of each sample and the true sample label character at the next time step of the corresponding sample input sequence.

[0170] For example, a multivariate cross entropy function can be used to calculate the target loss of the preset model when predicting the sample input sequence. Specifically, the fully connected layer in the preset model can receive the output from the decoder, and pass the sample fusion hidden state vector corresponding to the sample input sequence through a linear transformation and a Softmax activation function to generate the sample prediction probability of the target character category in all character indexes. All character indexes are index dictionaries composed of all sample characters that have appeared in the input sample training set, and generate sample prediction probability distributions corresponding to multiple sample prediction characters.

[0171] Among them, the output y of the fully connected layer t The mathematical expression is as follows:

[0172] y t =W fc h t +b fc

[0173] Among them, W fc is the weight matrix of the fully connected layer, h t is the sample fusion hidden state vector, b fc is the bias of the fully connected layer.

[0174] Specifically, the output y of the fully connected layer is converted into tConvert to sample prediction probability distribution The formula is as follows:

[0175]

[0176] Among them, t represents the sample time step, K represents the type of character index, and num_c l ass represents the number of types of character index.

[0177] Furthermore, the target loss of the preset model can be calculated based on the sample prediction probability distribution. The specific formula for calculating the target loss Loss L is as follows:

[0178]

[0179] Among them, n is the total number of sample prediction characters, y t,i is the one-hot encoding of the real sample label character, It is the sample prediction probability of the i-th sample prediction character among multiple sample prediction characters output by the preset model.

[0180] For example, if the true sample label character is "b", and the sample prediction probability distribution predicted by the preset model is P("a") = 0.2, P("b") = 0.5, P("c") = 0.3, then for the next sample time step, the first sub-loss of "a" and the first sub-loss of "c" are both 0, and the first sub-loss of "b" is -log(P("b")) = -log(0.5).

[0181] Furthermore, by summing the multiple first sub-losses corresponding to the predicted characters of multiple samples, the target loss of the preset model can be obtained. The preset model can use the target loss as a target and adjust the model parameters through optimization algorithms such as gradient descent to gradually reduce the target loss, thereby making the preset model's prediction of the sample input sequence closer and closer to the actual sample label character.

[0182] By training the preset model by minimizing the target loss, the preset model can be forced to continuously learn the rules of the sample input sequence in depth during the training process, and more accurately learn the mapping relationship between input data and output labels, so as to improve the prediction performance of the preset model and facilitate accurate prediction of the sample characters in the next sample time step.

[0183] Step 106: Determine a list of predicted malicious domain names based on the multiple predicted characters, and identify the domain name to be identified based on the list of predicted malicious domain names.

[0184] In some embodiments, in order to intercept malicious domain names, predicted malicious domain names can be determined based on the predicted characters, and a predicted malicious domain name list can be generated based on all predicted malicious domain names. When a new domain name to be identified enters, it is matched according to the predicted malicious domain name list, thereby improving the timeliness and accuracy of intercepting malicious domain names.

[0185] The predicted malicious domain name list may be a list of predicted malicious domain names obtained by predicting an input sequence using a target model. The input sequence may be a sequence intercepted from a historical domain name sequence consisting of malicious domain names.

[0186] Specifically, the malicious domain name list may include multiple predicted malicious domain names. Malicious domain names may be Internet domain names used to carry out malicious activities. Malicious domain names may be used by bad elements for various bad purposes, including but not limited to phishing websites, malware distribution, domain names in spam, etc.

[0187] For example, if the domain name to be identified is abc.com, it can be matched with the predicted malicious domain name list obtained in advance to determine whether abc.com exists in the predicted malicious domain name list. If it exists, abc.com is a malicious domain name and needs to be intercepted; if it does not exist, abc.com is a non-malicious domain name and does not need to be intercepted.

[0188] Through the above method, the predicted characters of the subsequent multiple time steps can be used to pre-generate a corresponding list of predicted malicious domain names to quickly match the domain names to be identified, thereby reducing the amount of real-time calculations and improving the system's response speed and security protection level.

[0189] In some embodiments, to ensure the generation of effective predicted malicious domain names, the updated predicted characters may be divided according to the domain name division identifier to obtain multiple predicted malicious domain names, so as to facilitate subsequent matching with the domain name to be identified. For example, the "determining a list of predicted malicious domain names based on the multiple predicted characters" in step 106 may include:

[0190] (106.a1) Obtain domain name division identification;

[0191] (106.a2) determining at least one domain name partition identifier from the multiple updated predicted characters, and dividing the multiple predicted characters using the domain name partition identifier as a partition point to obtain multiple predicted malicious domain names;

[0192] (106.a3) Determine a list of predicted malicious domain names based on multiple predicted malicious domain names.

[0193] The domain name delimiter can be a specific identifier or character used to separate different predicted malicious domain names, and is generally generated together with the predicted characters. For example, the domain name delimiter can be a space or other symbol that distinguishes characters from predicted malicious domain names.

[0194] For example, if the domain name partition identifier is a space, and the predicted characters are goodguy1, example2, a.com3, malicious4, evi15, and corp6, five spaces, i.e., five domain name partition identifiers, can be determined from these predicted characters. Then, goodguy1, example2, a.com3, malicious4, evil5, and corp6 can be partitioned using spaces as the partition points, resulting in the following predicted malicious domain names: goodguy1, example2, a.com3, malicious4, evil5, and corp6. These predicted malicious domain names are then stored in a predicted malicious domain name list.

[0195] Furthermore, the predicted malicious domain names can be categorized and stored in the list of predicted malicious domain names to facilitate rapid matching against the category of the domain name to be identified. Alternatively, the list of predicted malicious domain names can be stored according to the first predicted character of each domain name. When matching against the domain name to be identified, the first character of the domain name to be identified can be used to quickly locate the relevant character area and perform further matching, thereby improving matching efficiency.

[0196] Through the above method, the separation of predicted malicious domain names can be quickly achieved to facilitate user queries and subsequent rapid matching based on the domain name to be identified.

[0197] In some embodiments, in order to promptly detect and prevent potential threats and protect the network system from malware, network attacks, and other hazards, the domain name to be identified can be identified based on the predicted malicious domain name list to accurately determine whether the domain name to be identified is a malicious domain name, thereby improving the security of the system. For example, the "identifying the domain name to be identified based on the predicted malicious domain name list" in step 106 can include:

[0198] (106.b1) Obtain the domain name to be identified, and match it with the predicted malicious domain name list according to the domain name to be identified to obtain a matching result;

[0199] (106.b2) According to the matching result, the identification result of the domain name to be identified is obtained.

[0200] The matching result may be obtained by comparing the domain name to be identified with each entry or entry of the corresponding category in the list of predicted malicious domain names. The matching result indicates whether the domain name to be identified exists in the list of predicted malicious domain names.

[0201] Among them, the identification result can be the result of the system determining whether the domain name to be identified should be marked as a malicious domain name based on the matching result. When the matching result indicates that the domain name to be identified exists in the predicted malicious domain name list, the identification result of the domain name to be identified is malicious; when the matching result indicates that the domain name to be identified does not exist in the predicted malicious domain name list, the identification result of the domain name to be identified is non-malicious.

[0202] For example, the predicted malicious domain name list is a.com, badguy.com, booth.com, example.com, evi l.com, ma l icious.com, and the domain name to be identified is evi l.com. Then, according to the character "e", the predicted malicious domain names example l e.com and evi l.com starting with "e" can be located in the predicted malicious domain name list, and the matching result evi l.com can be further matched. The identification result of evi l.com is a malicious domain name, and corresponding measures can be taken accordingly.

[0203] By generating a list of predicted malicious domain names through the target model, there is no need to consume a large amount of computing resources to analyze each domain name to be identified one by one. Instead, it only needs to quickly match the predicted malicious domain name list, which greatly improves the detection speed and ensures the security of the network environment.

[0204] Please refer to Figure 5 In some embodiments, the present application is combined with Figure 5 This paper introduces the overall process of the malicious domain name identification method. Specifically, the input sequence intercepted by the sliding window is first input into the input layer of the target model. Then, the embedding layer converts the discrete character indexes in the input sequence into continuous high-dimensional vectors to capture the semantic information of the characters, enabling the target model to operate in a higher-dimensional space.

[0205] Furthermore, the input sequence can be processed in forward time order by the first encoder and in reverse time order by the second encoder to obtain a first hidden state vector output by the first encoder and a second hidden state vector output by the second encoder, and the first hidden state vector and the second hidden state vector can be concatenated through a connection layer to obtain a fused hidden state vector. Furthermore, the decoder of the target model can predict multiple characters of the current time step based on the fused hidden state vector, and the output of the decoder can be converted into a probability distribution through a fully connected layer, and the character with the highest probability can be selected as the predicted character for the next time step. In some embodiments, the decoder can include a fully connected layer.

[0206] In an embodiment of the present application, a sliding window is used to intercept an input sequence of the current time step from a historical domain name sequence located before the current time step; the input sequence is input into a target model, and a first hidden state vector of the input sequence is generated by a first encoder in the target model in a forward time sequence, and a second hidden state vector of the input sequence is generated by a second encoder in the target model in a reverse time sequence; a decoder of the target model predicts a predicted character of the current time step based on a fused hidden state vector of the first hidden state vector and the second hidden state vector; the predicted character is updated to the input sequence, the sliding window is moved to update the sequence to be predicted, the sequence to be predicted is input into the target model, and the target model predicts the predicted character of the next time step based on the sequence to be predicted; the steps of updating the predicted character to the input sequence, moving the sliding window to update the sequence to be predicted, inputting the sequence to be predicted into the target model, and predicting the predicted character of the next time step based on the sequence to be predicted are repeated until the number of the updated multiple predicted characters reaches a preset number threshold; a predicted malicious domain name list is determined based on the multiple predicted characters, and the domain name to be identified is identified based on the predicted malicious domain name list. In this way, it is possible to predict the characters at the next time point in real time and obtain the predicted malicious domain name list for the next time period in advance, thereby improving the timeliness of malicious domain name detection. In addition, the present application predicts the list of predicted malicious domain names based on the input sequence of the previous moment, rather than based on fixed rules and patterns. In the prediction process, it can also combine the forward time sequence and the reverse time sequence to generate a fused hidden state vector, which can enable the target model to understand the context information more accurately, so as to accurately predict the malicious domain name based on the domain name pattern of the previous moment and the precise context information, thereby improving the accuracy of malicious domain name recognition. In summary, the present application can improve the timeliness and accuracy of malicious domain name recognition.

[0207] See also Figure 6 The embodiment of the present application further provides a malicious domain name identification device that can implement the above-mentioned malicious domain name identification method. The malicious domain name identification device includes:

[0208] The interception module 61 is used to intercept the input sequence of the current time step from the historical domain name sequence before the current time step through a sliding window;

[0209] a generation module 62 for inputting an input sequence into a target model, generating a first hidden state vector of the input sequence in a forward time sequence by a first encoder in the target model, and generating a second hidden state vector of the input sequence in a reverse time sequence by a second encoder in the target model;

[0210] A prediction module 63 is configured to predict a predicted character at a current time step based on a fused hidden state vector of the first hidden state vector and the second hidden state vector through a decoder of a target model;

[0211] a moving module 64 for updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step by the target model;

[0212] an updating module 65 for repeatedly executing the steps of updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step by the target model, until the number of the updated multiple predicted characters reaches a preset number threshold;

[0213] The identification module 66 is configured to determine a list of predicted malicious domain names based on the plurality of predicted characters, and identify the domain name to be identified according to the list of predicted malicious domain names.

[0214] The specific implementation of the malicious domain name identification device is basically the same as the specific embodiment of the malicious domain name identification method described above, and will not be repeated here. Under the premise of meeting the requirements of the embodiment of this application, the malicious domain name identification device can also be provided with other functional modules to implement the malicious domain name identification method in the above embodiment.

[0215] The present application also provides a computer device comprising a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the above-mentioned malicious domain name identification method. The computer device can be any intelligent terminal, including a tablet computer, an in-vehicle computer, or the like.

[0216] See also Figure 7 , Figure 7 The hardware structure of a computer device according to another embodiment is shown. The computer device includes:

[0217] The processor 71 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is configured to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0218] The memory 72 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 72 can store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 72 and is called by the processor 71 to execute the malicious domain name identification method of the embodiments of this application.

[0219] Input / output interface 73, used for information input and output;

[0220] Communication interface 74, used to implement communication interaction between this device and other devices, which can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, Wi-Fi, Bluetooth, etc.);

[0221] bus 75 , which transmits information between the various components of the device (e.g., processor 71 , memory 72 , input / output interface 73 , and communication interface 74 );

[0222] The processor 71 , the memory 72 , the input / output interface 73 and the communication interface 74 are connected to each other in communication within the device via a bus 75 .

[0223] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned malicious domain name identification method.

[0224] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0225] The embodiments described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0226] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0227] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.

[0228] Those skilled in the art will appreciate that all or some of the steps in the methods, systems, and functional modules / units in the devices disclosed above may be implemented as software, firmware, hardware, or appropriate combinations thereof.

[0229] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0230] It should be understood that in this application, "at least one (item)" and "several" refer to one or more, and "plurality" refers to two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship. "At least one of the following items" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0231] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For example, the division of the above units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0232] The units described above as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0233] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0234] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store programs.

[0235] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and essence of the present invention should be within the scope of the present invention.

Claims

1. A method for identifying malicious domain names, characterized in that: The method comprises: Through the sliding window, the input sequence of the current time step is intercepted from the historical domain name sequence before the current time step; Inputting the input sequence into a target model, generating a first hidden state vector of the input sequence by a first encoder in the target model in a forward time sequence, and generating a second hidden state vector of the input sequence by a second encoder in the target model in a reverse time sequence; Predicting, by a decoder of the target model, a predicted character at the current time step based on a fused hidden state vector of the first hidden state vector and the second hidden state vector; Updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step by the target model; Repeating the steps of updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step by the target model, until the number of the updated multiple predicted characters reaches a preset number threshold; A predicted malicious domain name list is determined based on the multiple predicted characters, and the domain name to be identified is identified according to the predicted malicious domain name list.

2. The malicious domain name identification method according to claim 1, characterized in that: Generating a first hidden state vector of the input sequence according to a forward time order by a first encoder in the target model includes: Determine the earliest time step corresponding to the input sequence as the forward starting time step in forward time order, and determine the other time steps as forward intermediate time steps; Determining, by a first encoder in the target model, a forward hidden state and a forward cell state corresponding to the forward starting time step according to the forward character corresponding to the forward starting time step; For each of the forward intermediate time steps, the forward hidden state and the forward cell state corresponding to the previous time step are updated according to the forward hidden state and the forward cell state corresponding to the previous time step, and the forward character input in the forward intermediate time step, until the forward hidden state and the forward cell state of the last forward intermediate time step are updated, thereby obtaining a first hidden state vector consisting of multiple forward hidden states corresponding to the input sequence.

3. The malicious domain name identification method according to claim 1, characterized in that: Generating a second hidden state vector of the input sequence according to reverse time order by a second encoder in the target model includes: Determining, in reverse time order, the latest time step corresponding to the input sequence as the reverse starting time step, and determining the other time steps as reverse intermediate time steps; Determining, by a second encoder in the target model, a reverse hidden state and a reverse cell state corresponding to the reverse starting time step according to the reverse character corresponding to the reverse starting time step; For each of the reverse intermediate time steps, the reverse hidden state and the reverse cell state corresponding to the subsequent time step are updated according to the reverse hidden state and the reverse cell state corresponding to the subsequent time step, and the reverse character input in the reverse intermediate time step, until the reverse hidden state and the reverse cell state of the last reverse intermediate time step are updated, thereby obtaining a second hidden state vector composed of multiple reverse hidden states corresponding to the input sequence.

4. The malicious domain name identification method according to claim 1, characterized in that: Determining a predicted malicious domain name list based on the multiple predicted characters includes: Get the domain name division identifier; Determining at least one domain name division identifier from the multiple updated predicted characters, and dividing the multiple predicted characters using the domain name division identifier as a division point to obtain multiple predicted malicious domain names; Based on the multiple predicted malicious domain names, a predicted malicious domain name list is determined.

5. The malicious domain name identification method according to claim 1, characterized in that: The identifying the domain name to be identified according to the predicted malicious domain name list includes: Obtaining a domain name to be identified, and matching the domain name to be identified with the predicted malicious domain name list to obtain a matching result; According to the matching result, an identification result of the domain name to be identified is obtained.

6. The malicious domain name identification method according to claim 1, characterized in that: The target model is trained in the following way: Obtaining a sample input sequence, and inputting the sample input sequence into a preset model to obtain a plurality of sample prediction probabilities corresponding to a plurality of sample prediction characters predicted by the preset model; Obtaining a true sample label character at a sample time step subsequent to the sample input sequence, and calculating a target loss of the preset model based on the true sample label character, the plurality of sample prediction characters, and the corresponding plurality of sample prediction probabilities; The preset model is trained based on the target loss to obtain a target model.

7. The method for identifying malicious domain names according to claim 6, wherein: The calculating the target loss of the preset model based on the real sample label character, the multiple sample prediction characters, and the corresponding multiple sample prediction probabilities includes: For each of the sample predicted characters, determining a sample prediction probability corresponding to the sample predicted character; Determine a first sub-loss corresponding to the corresponding sample prediction character according to the sample prediction probability and the true sample label character; The target loss of the preset model is calculated based on the multiple first sub-losses corresponding to the multiple sample prediction characters.

8. A malicious domain name identification device, characterized in that: The device comprises: The interception module is used to intercept the input sequence of the current time step from the historical domain name sequence before the current time step through a sliding window; a generation module, configured to input the input sequence into a target model, and generate a first hidden state vector of the input sequence according to a forward time sequence by a first encoder in the target model, and generate a second hidden state vector of the input sequence according to a reverse time sequence by a second encoder in the target model; A prediction module, configured to predict a predicted character at the current time step based on a fused hidden state vector of the first hidden state vector and the second hidden state vector through a decoder of the target model; a moving module, configured to update the predicted character to the input sequence of the current time step, move the sliding window to update the input sequence of the next time step, input the input sequence of the next time step into the target model, and predict the predicted character of the next time step based on the input sequence of the next time step by the target model; an updating module, configured to repeatedly execute the steps of updating the predicted character to the input sequence of the current time step, moving the sliding window to update the input sequence of the next time step, inputting the input sequence of the next time step into the target model, and predicting the predicted character of the next time step based on the input sequence of the next time step by the target model, until the number of the updated plurality of predicted characters reaches a preset number threshold; The identification module is used to determine a predicted malicious domain name list based on the multiple predicted characters, and identify the domain name to be identified according to the predicted malicious domain name list.

9. A computer device, characterized in that: The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the malicious domain name identification method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the malicious domain name identification method according to any one of claims 1 to 7 is implemented.

Images