DGA domain name classification model training method, system and DGA domain name balanced classification method

Abstract

The present application relates to the field of combining network security with artificial intelligence, and discloses a DGA domain name classification model training method, system, and DGA domain name balanced classification method. The DGA domain name classification model training method includes: extracting TLD character sequences, N-TLD character sequences, statistical feature sequences, and word library sequences, and performing vector conversion and feature fusion to construct a multi-channel feature fusion vector; using an autoencoder network layer to reconstruct features, and combining the reconstruction loss function and the classification loss function to train a target multi-channel semantic learning model; at the same time, using a rebalancing algorithm to process the feature vector and train a target classification model; finally, combining the two models to obtain a target DGA domain name classification model. The target DGA domain name classification model can effectively improve the accuracy and robustness of DGA domain name classification.

Description

Technical Field

[0001] The present invention relates to the field of combining network security with artificial intelligence, and in particular to a DGA domain name classification model training method and system, and a DGA domain name balanced classification method. Background Art

[0002] DGA generates a large number of random or pseudo-random domain names through a specific algorithm. These domain names are usually generated by some fixed character sets and algorithms, which may involve dates, random numbers, or other factors. When the attacker needs to control the victim's machine, he can register one or several domain names. The victim's machine, as a client, will periodically try to connect to the C&C (command and control server). Once the connection is successful, the malicious program can accept the server's instructions and conduct a series of malicious activities such as information collection and malicious destruction. DGA domain name generation algorithms can be divided into several types: 1. Arithmetic-based DGA: This type of algorithm generates a set of values ​​that can be represented by ASCII encoding to form a DGA domain name, which is the most popular type; 2. Hash-based DGA: DGA domain names are generated using the hexadecimal representation of hash values. Commonly used hash algorithms include MD5, SHA256, etc.; 3. Dictionary-based DGA: Words are selected from a proprietary dictionary for combination to reduce the randomness of domain name characters and make them more confusing. The dictionary can be embedded in malicious programs or extracted from public services; 4. DGA based on permutations and combinations: perform character permutations and combinations on an initial domain name to generate a new domain name.

[0003] Researching high-accuracy detection schemes for DGA domain names is of great significance to network security. Existing research rarely pays attention to the problem of data imbalance. The imbalance of sample sizes of each category in the data set will greatly reduce the performance of the classifier. At present, the processing methods for imbalanced data are mainly based on the data and algorithm levels. At the data level, common strategies include: (1) Oversampling minority class samples, such as using random oversampling, SMOTE and ADASYN techniques to balance the number of samples by copying or generating new data. However, this method may cause the model to overfit the oversampled data and weaken the generalization ability of the real data distribution. (2) Undersampling majority class samples, including random undersampling, Tomek Links and ENN methods to reduce the number of majority class samples. However, doing so may lose key information in the original data and affect the model's learning of majority class features. At the algorithm level, the main methods include: (1) Cost-sensitive learning, by adjusting the loss function, giving different weights to samples of different categories to optimize the model's classification performance for minority classes. However, this method often ignores the intrinsic relationship between samples, which may lead to a decline in model performance in some cases. (2) Ensemble learning, which combines the prediction results of multiple classifiers to enhance the overall performance. However, the ensemble effect is limited by the quality and selection of the base classifiers.

[0004] Therefore, for the above research, the problem that needs to be solved is: how to effectively balance the DGA domain name samples, avoid overfitting and information loss, and make full use of the intrinsic relationship between samples, while considering the complexity of DGA domain name characteristics and improving the generalization ability and robustness of the model. Summary of the invention

[0005] Based on this, this application proposes a DGA domain name classification model training method, system and DGA domain name balanced classification method, aiming to effectively balance DGA domain name samples, avoid overfitting and information loss, and make full use of the intrinsic relationship between samples, while considering the complexity of DGA domain name features to improve the generalization ability and robustness of the model.

[0006] The first aspect of the present application provides a DGA domain name classification model training method, the method comprising:

[0007] Extracting an initial TLD character sequence, an initial N-TLD character sequence, an initial N-TLD statistical feature sequence, and an initial N-TLD vocabulary sequence from the acquired initial DGA domain name;

[0008] Performing vector conversion on the initial TLD character sequence, the initial N-TLD character sequence, the initial N-TLD statistical feature sequence and the initial N-TLD vocabulary sequence to obtain corresponding initial TLD character vectors, initial N-TLD character vectors, initial N-TLD statistical feature vectors and initial N-TLD vocabulary vectors to construct an initial vector data set;

[0009] Performing feature fusion on the initial TLD character vector, the initial N-TLD character vector, the initial N-TLD statistical feature vector and the initial N-TLD vocabulary vector to obtain a multi-channel feature fusion vector;

[0010] Input the multi-channel feature fusion vector into the autoencoder network layer to obtain a reconstructed TLD character vector, a reconstructed N-TLD character vector, a reconstructed N-TLD statistical feature vector and a reconstructed N-TLD vocabulary vector to construct a reconstructed vector data set;

[0011] Constructing a reconstruction loss function and a first classification loss function according to the initial vector data set and the reconstructed vector data set;

[0012] Based on the reconstruction loss function and the first classification loss function, obtaining a target multi-channel semantic learning model;

[0013] Applying a rebalancing algorithm to the multi-channel feature fusion vector to obtain a rebalanced vector data set;

[0014] Performing DGA domain classification on the rebalanced vector data set to obtain a predicted balanced classification result;

[0015] Constructing a second classification loss function based on the DGA domain name classification process, and obtaining a target classification model based on the second classification loss function;

[0016] A target DGA domain name classification model is obtained according to the target multi-channel semantic learning model and the target classification model.

[0017] Compared with the prior art, the present application provides a DGA domain name classification model training method: extracting the initial TLD character sequence, the initial N-TLD character sequence, the initial N-TLD statistical feature sequence and the initial N-TLD vocabulary sequence from the initial DGA domain name, and converting them into vector form to construct an initial vector data set, so that the key features of the DGA domain name can be digitized, laying the foundation for subsequent feature fusion and model training; performing feature fusion on the initial vector data set to obtain a multi-channel feature fusion vector, and this multi-channel feature fusion can more comprehensively capture the semantic information of the DGA domain name and improve the expression ability of the model; inputting the multi-channel feature fusion vector into the autoencoder network layer to obtain a reconstructed vector data set, and the autoencoder network can learn the potential semantic features of the DGA domain name, and optimize the model parameters through the reconstruction process to improve The generalization ability of the model; the reconstruction loss function and the first classification loss function are constructed according to the initial vector data set and the reconstruction vector data set, and the target multi-channel semantic learning model is trained. This joint optimization method can enable the model to have good reconstruction and classification capabilities at the same time; the rebalancing algorithm is used for the multi-channel feature fusion vector to obtain a rebalanced vector data set. This step can alleviate the problem of class imbalance in the data set and improve the classification performance of the model in different categories; the second classification loss function is constructed based on the rebalanced vector data set, and the target classification model is trained. This target classification model can be directly used for the classification task of DGA domain names; finally, the target multi-channel semantic learning model and the target classification model are integrated to obtain the target DGA domain name classification model. This integration method can make full use of the advantages of the two models and improve the overall classification performance. Therefore, this method gradually constructs a powerful DGA domain name classification model through the steps of feature extraction, feature fusion, autoencoder reconstruction, rebalancing and model integration. This method can not only make full use of the various semantic features of the DGA domain name, but also effectively solve problems such as data imbalance, and finally achieve a high classification accuracy.

[0018] As an optional implementation manner of the first aspect, the step of extracting an initial TLD character sequence, an initial N-TLD character sequence, an initial N-TLD statistical feature sequence, and an initial N-TLD vocabulary sequence from the acquired initial DGA domain name includes: dividing the initial DGA domain name into a top-level root domain name TLD and a non-top-level root domain name N-TLD; converting the top-level root domain name TLD into the initial TLD character sequence according to character order; converting the non-top-level root domain name N-TLD into the initial N-TLD character sequence according to character order; and counting key features from the non-top-level root domain name N-TLD to obtain the initial An initial N-TLD statistical feature sequence is obtained, wherein the key features include the character length, character type and proportion of each type of the N-TLD; a DGA English vocabulary is constructed according to the initial DGA domain name; an n-Gram algorithm is used on the initial DGA domain name to generate Token fragments; high-frequency Token fragments are screened out from the Token fragments to form a high-frequency Token vocabulary; the DGA English vocabulary and the high-frequency Token vocabulary are merged to obtain a DGA vocabulary sequence; and the non-top-level root domain name N-TLD is token matched with the DGA vocabulary sequence to obtain the initial N-TLD vocabulary sequence.

[0019] As an optional implementation manner of the first aspect, the step of fusing the initial TLD character vector, the initial N-TLD character vector, the initial N-TLD statistical feature vector and the initial N-TLD vocabulary vector to obtain a multi-channel feature fusion vector includes: fusing the initial TLD character vector , the initial N-TLD character vector , the initial N-TLD statistical feature vector and the initial N-TLD vocabulary vector Perform dimension transformation to obtain the corresponding initial TLD character low-dimensional vector , initial N-TLD character low-dimensional vector , initial N-TLD statistical feature low-dimensional vector and the initial N-TLD vocabulary low-dimensional vector ; , , and stated Perform feature fusion to obtain the multi-channel feature fusion vector.

[0020] As an optional implementation of the first aspect, the steps of inputting the multi-channel feature fusion vector into the autoencoder network layer to obtain a reconstructed TLD character vector, a reconstructed N-TLD character vector, a reconstructed N-TLD statistical feature vector, and a reconstructed N-TLD vocabulary vector include: using an autoencoder AutoEncoder to perform feature reconstruction on the multi-channel feature fusion vector to obtain , , and stated The corresponding reconstructed TLD character vector , Reconstruct N-TLD character vector , reconstruct N-TLD statistical feature vector And reconstruct N-TLD vocabulary vector .

[0021] As an optional implementation of the first aspect, a rebalancing algorithm is used on the multi-channel feature fusion vector to obtain a rebalanced vector data set, including: based on the SMOTE rebalancing algorithm, finding k nearest neighbors for each minority class sample in the multi-channel feature fusion vector that is lower than a preset classification standard; selecting a random sample from the k nearest neighbors and linearly combining it with the original sample to generate a synthetic sample; and obtaining a rebalanced vector data set based on the multi-channel feature fusion vector and the set of synthetic samples.

[0022] As an optional implementation of the first aspect, based on the reconstruction loss function and the first classification loss function, the step of obtaining the target multi-channel semantic learning model includes: constructing a composite loss function according to the reconstruction loss function and the first classification loss function, wherein the composite loss function is used to optimize the multi-channel semantic learning model to obtain the target multi-channel semantic learning model; the expression of the composite loss function is: , where L1 represents the reconstruction loss function and L2 represents the first classification loss function. represents the balance parameter; the expression of the reconstruction loss function is: ; The expression of the first classification loss function is: , where C represents the number of categories, represents the prediction result of the i-th category, Represents the label of the i-th category.

[0023] A second aspect of the present application provides a DGA domain name classification model training system, the system comprising:

[0024] The first target model training module is used to extract the initial TLD character sequence, the initial N-TLD character sequence, the initial N-TLD statistical feature sequence and the initial N-TLD vocabulary sequence from the acquired initial DGA domain name; perform vector conversion on the initial TLD character sequence, the initial N-TLD character sequence, the initial N-TLD statistical feature sequence and the initial N-TLD vocabulary sequence to obtain the corresponding initial TLD character vector, the initial N-TLD character vector, the initial N-TLD statistical feature vector and the initial N-TLD vocabulary vector to construct an initial vector data set; convert the initial TLD character vector, the initial N-TLD character vector, the initial N-TLD statistical feature vector and the initial N-TLD vocabulary sequence into a vector; The initial N-TLD character vector, the initial N-TLD statistical feature vector and the initial N-TLD vocabulary vector are subjected to feature fusion to obtain a multi-channel feature fusion vector; the multi-channel feature fusion vector is input into the autoencoder network layer to obtain a reconstructed TLD character vector, a reconstructed N-TLD character vector, a reconstructed N-TLD statistical feature vector and a reconstructed N-TLD vocabulary vector to construct a reconstructed vector data set; a reconstruction loss function and a first classification loss function are constructed according to the initial vector data set and the reconstructed vector data set; a target multi-channel semantic learning model is obtained based on the reconstruction loss function and the first classification loss function;

[0025] A second target model training module is used to use a rebalancing algorithm on the multi-channel feature fusion vector to obtain a rebalanced vector data set; perform DGA domain classification on the rebalanced vector data set to obtain a predicted balanced classification result; construct a second classification loss function based on the DGA domain classification process, and obtain a target classification model based on the second classification loss function;

[0026] The domain name classification model construction module is used to obtain a target DGA domain name classification model according to the target multi-channel semantic learning model and the target classification model.

[0027] A third aspect of the present application provides a DGA domain name balance classification method, the method comprising:

[0028] Obtain a DGA domain name to be tested, input the DGA domain name to be tested into a target multi-channel semantic learning model, and obtain a multi-channel feature fusion vector, wherein the target multi-channel semantic learning model is trained by the DGA domain name classification model training method as described in the first aspect;

[0029] The multi-channel feature fusion vector is input into a target classification model to obtain a predicted balanced classification result corresponding to the DGA domain name to be tested, wherein the target classification model is obtained by training using the DGA domain name classification model training method as described in the first aspect.

[0030] The fourth aspect of the present application provides an electronic device, comprising: a processor; a memory for storing executable instructions of the processor; wherein the processor is configured to execute the executable instructions to implement a DGA domain name classification model training method as described in the first aspect or a DGA domain name balanced classification method as described in the third aspect.

[0031] The fifth aspect of the present application provides a computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute a DGA domain name classification model training method as described in the first aspect or a DGA domain name balanced classification method as described in the third aspect.

[0032] Additional aspects and advantages of the present application will be given in part in the following description, and in part will become apparent from the following description, or will be understood through the embodiments of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A flowchart of a DGA domain name classification model training method proposed in the first embodiment of the present application;

[0034] Figure 2 A network structure diagram of a DGA domain name classification model proposed in the first embodiment of the present application;

[0035] Figure 3 A structural diagram of a DGA domain name classification model training system proposed in the second embodiment of the present application;

[0036] Figure 4 This is a flow chart of a DGA domain name balance classification method proposed in the second embodiment of the present application.

[0037] The following specific implementation methods will further illustrate the present application in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0039] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here. In addition, the "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally represents that the objects associated with each other are in an "or" relationship.

[0040] In order to illustrate the technical solution described in this application, a specific embodiment is provided below for illustration.

[0041] Example 1

[0042] See also Figure 1 , is a flow chart of a DGA domain name classification model training method proposed in the first embodiment of the present application, the DGA domain name classification model training method includes S01 to S09. Figure 2 , which is a network structure diagram of a DGA domain name classification model proposed in the first embodiment of the present application.

[0043] S01: extracting an initial TLD character sequence, an initial N-TLD character sequence, an initial N-TLD statistical feature sequence and an initial N-TLD vocabulary sequence from the acquired initial DGA domain name.

[0044] Based on the analysis of the DGA domain name generation principle, the important features of the initial DGA domain name include the top-level root domain name (TLD), non-top-level root domain names and some key statistical features (such as negative length, character type composition, etc.), the vocabulary used for random construction of domain names, and the sequence information of domain names. To this end, the present invention performs multi-channel feature extraction and fusion on the randomly generated initial DGA domain names from four aspects to generate a semantic representation that can fully represent the characteristics of each type of initial DGA domain name. The initial DGA domain name feature data preprocessing is specifically divided into the following steps:

[0045] S011: Split the initial DGA domain name into a top-level root domain name TLD and a non-top-level root domain name N-TLD.

[0046] Combined with the root domain name list, the initial DGA domain name is divided into two parts: the top-level domain name TLD and the non-top-level root domain name N-TLD, which is convenient for subsequent steps. For example, for the domain name "dropoutflash-3f6e.ddns.co.uk", it is divided as follows: the TLD part is ".co.uk" and the N-TLD part is "dropoutflash-3f6e.ddns".

[0047] S012: Convert the top-level root domain name TLD into the initial TLD character sequence according to the character sequence.

[0048] For example, if the TLD is ".co.uk", it will be converted to ['.','c','o','.','u','k'].

[0049] S013: Convert the non-top-level root domain name N-TLD into an initial N-TLD character sequence according to the character sequence.

[0050] For example, if N-TLD is "dropoutflash-3f6e.ddns", it will be converted to ['d', 'r', 'o', 'p', 'o', 'u', 't', 'f', 'l', 'a', 's', 'h', '-', '3', 'f', '6', 'e', ​​'.', 'd', 'd', 'n', 's'].

[0051] S014: Count key features from the non-top-level root domain name N-TLD to obtain an initial N-TLD statistical feature sequence, where the key features include the character length, character type, and proportion of each type of the N-TLD.

[0052] Key features are counted from the segmented N-TLDs, including the character length of the N-TLD, whether it is all numbers, whether it is all letters, the proportion of numbers, the proportion of letters, the proportion of special characters, etc. For example, for the domain name with the N-TLD part of "dropoutflash-3f6e.ddns.co.uk", the character length of its N-TLD part is 22, the proportion of letters is about 0.82, the proportion of numbers is about 0.09, and the proportion of special characters is about 0.09 (the result is rounded to two decimal places), that is, the initial N-TLD statistical feature sequence Stats Features = [22, 0.82, 0.09, 0.09...].

[0053] S015: Construct a DGA English vocabulary based on the initial DGA domain name; use the n-Gram algorithm on the initial DGA domain name to generate Token fragments, filter out high-frequency Token fragments from the Token fragments to form a high-frequency Token vocabulary; merge the DGA English vocabulary and the high-frequency Token vocabulary to obtain a DGA vocabulary sequence, perform Token matching on the non-top-level root domain name N-TLD and the DGA vocabulary sequence to obtain an initial N-TLD vocabulary sequence.

[0054] First, construct the DGA English word token list (EWTL): In order to construct the common English word list (EWTL) required for dictionary-based DGA feature extraction, the present invention first screens out the English words (Word) that have appeared in the DGA sample set. Then, these words are added to the word list EWTL one by one to ensure that it contains common English words that can effectively reflect the characteristics of DGA construction. For example, for the domain name "dropoutflash-3f6e.ddns.co.uk", the English words "drop", "out", and "flash" are obtained. After confirming that they have not appeared in EWTL, they are added to EWTL. Repeat the operation until the DGA sample set is traversed, and EWTL=['drop', 'out', 'flash', ....] is obtained. This process lays the foundation for the subsequent word list sequence Word Token extraction.

[0055] Secondly, construct a DGA high-frequency token list (HWTL): When dealing with scenarios that do not use common English words but rely on custom random string generation. The present invention accurately extracts token fragments that frequently appear in a specific DGA category based on data mining technology for a character sequence type DGA sample set and adds them to the HWTL. The specific process includes:

[0056] Generate Token segments based on n-Gram algorithm: For each N-TDL string, use n-Gram algorithm to generate Token segments of different lengths; set The value range is 1, 2, 3, 4, etc. Select the appropriate value according to actual needs. Value; Generate all possible Token fragments and store them as intermediate results. For example, for the domain name "dropoutflash-3f6e.ddns.co.uk", assuming that the value range of n in the n-Gram algorithm is 1-3, when n=1, the generated Token fragment is each character in N-TDL as a fragment, Token=['d', 'r', 'o', 'p', 'o', 'u', 't', 'f', 'l', 'a', 's','h', '-', '3', 'f', '6', 'e']; when n=2, the generated Token fragment is every two adjacent characters in N-TDL as a fragment, Token=['dr', 'ro', 'op', 'po', 'ou', 'ut', 'tf', 'fl', 'la', 'as','sh', 'h-', '-3', '3f', 'f6', '6e']; when n=3, the generated Token fragments are every three adjacent characters in N-TDL as a fragment, Token=['dro', 'rop', 'opo', 'pou', 'out', 'utf', 'tfl', 'fla', 'las', 'ash', 'shh', 'h-3', '-3f', '3f6', 'f6e'], and finally these Token fragments are stored as intermediate results.

[0057] Use FP-Growth or Apriori association rule mining algorithm to count each Token fragment For a certain DGA category Confidence ; Set the confidence threshold and filter out the tokens with confidence higher than the threshold as high-frequency tokens. For example, the confidence results of each token calculated according to the Apriori algorithm are shown in Table 1:

[0058] Table 1 Confidence results of token segments calculated using the Apriori algorithm

[0059]

[0060] Assuming the confidence threshold is 0.09, the high-frequency token segments filtered out are ['shh', 'la', ...].

[0061] The filtered high-frequency token fragments are added to the high-frequency token library (HWTL).

[0062] Construct DGA Word Token Library (Word Token List, WTL): merge EWTL and HWTL, remove duplicates, and then sort by Token length. For example, if there is EWTL=['drop','out','flash',....], merge and remove duplicates and sort by Token length to get WTL=['drop','flash','out',...'shh','la',...].

[0063] N-TLD word library sequence Word Token construction: does not use a fixed length The n-Gram algorithm is used to process the N-TLD sequence, but it is converted into a variable-length Token fragment sequence according to the matching between N-TLD and the Token fragment in WTL. The specific process is: let the length of N-TLD be , starting from the character position of N-TLD ( Initially 1), N-TLD is matched with each Token fragment in WTL, and the matching is carried out in descending order of the length of the Token fragment; once a specific Token fragment is matched , then As a Token fragment, it is added to the word library sequence Word Token, and then from the beginning of the character Start repeating the above matching process (where Indicates the last matched Token fragment length); if no Token fragment in WTL is matched, OTHER is added as a Token fragment to the word library sequence Word Token, and then The above matching process is repeated until N-TLD is converted into a word library sequence Word Token. For example, for WTL=['drop','flash','out',...'shh','la',...], N-TLD=“dropoutflash-3f6e.ddns”, its initial N-TLD word library sequence Word Token=['drop','flash','out',...].

[0064] S02: performing vector conversion on the initial TLD character sequence, the initial N-TLD character sequence, the initial N-TLD statistical feature sequence and the initial N-TLD vocabulary sequence to obtain corresponding initial TLD character vectors, initial N-TLD character vectors, initial N-TLD statistical feature vectors and initial N-TLD vocabulary vectors to construct an initial vector data set.

[0065] It can be understood that the initial TLD character sequence, the initial N-TLD character sequence, the initial N-TLD statistical feature sequence and the initial N-TLD vocabulary sequence are respectively converted into vectors to obtain corresponding vector representations, namely, the initial TLD character vector , initial N-TLD character vector , initial N-TLD statistical feature vector and the initial N-TLD vocabulary vector , and then by , , and Construct the initial vector data set.

[0066] Specifically, for the initial N-TLD word library sequence (Word Token), initial N-TLD character sequence (Char Token), initial TLD character sequence (TLD Token) and initial N-TLD statistical feature sequence (Stats Features) extracted from the initial DGA domain name sample, Token2Vec technology (or similar word embedding methods) and multi-layer perceptron (MLP) are used to convert these original features from their original form into fixed-length vectorized numerical representations. Among them, WordToken is converted into a vector , Char Token converted to vector , TLD Token converted to vector , the statistical features are converted into vectors For example, use Token2Vec to convert each Word Token, Char Token, and TLD Token into a 64-dimensional vectorized numerical representation, and get =[0.1, 0.2, ..., 0.5], =[0.35, 0.3, ..., 0.42], =[0.8, 0.1, ..., 0.05]; the statistical features are transformed through a multi-layer perceptron (MLP) and mapped into a vector space of the same dimension as the Token vector and also converted into a 64-dimensional vector: =[0.4, 0.5, ...,0.2].

[0067] S03: Fusing the initial TLD character vector, the initial N-TLD character vector, the initial N-TLD statistical feature vector and the initial N-TLD vocabulary vector to obtain a multi-channel feature fusion vector.

[0068] Based on the multi-channel data (initial TLD character sequence, initial N-TLD character sequence, initial N-TLD statistical feature sequence and initial N-TLD word library sequence) obtained by processing in step S01, a deep neural network is used to achieve the fusion of multi-channel semantic information through a cross-channel attention mechanism. In the semantic information fusion stage, on the one hand, the multi-channel AutoEncoder task is used to fully retain and integrate the multi-channel semantic information; on the other hand, the multi-classification task of DGA domain name classification is used to fully extract the semantic information related to the target task.

[0069] In some embodiments, , , and Perform dimension transformation to obtain the corresponding initial TLD character low-dimensional vector , initial N-TLD character low-dimensional vector , initial N-TLD statistical feature low-dimensional vector and the initial N-TLD vocabulary low-dimensional vector , and then , , and Perform feature fusion to obtain a multi-channel feature fusion vector.

[0070] First, we use a multi-layer MLP to , , , Process them and convert them into denser neural network hidden layer vector representations, which are recorded as , , , Then, a cross-channel attention mechanism is introduced to , , , Perform weighted fusion to generate a fused multi-channel feature fusion vector , this process ensures that valuable information from different channels can be effectively integrated. For example, , , , After multi-layer MLP processing, a 32-dimensional vectorized numerical representation is obtained: =[0.15, 0.22, ..., 0.55], =[0.32, 0.31, ...,0.09], =[0.78, 0.11, ...,0.12], =[0.42, 0.51, ...,0.17], regenerate the fused multi-channel feature fusion vector , effectively integrating the valuable information of four channels.

[0071] S04: Input the multi-channel feature fusion vector into the autoencoder network layer to obtain the reconstructed TLD character vector, the reconstructed N-TLD character vector, the reconstructed N-TLD statistical feature vector and the reconstructed N-TLD vocabulary vector to construct a reconstructed vector dataset.

[0072] It should be noted that in order to fully retain and fuse the semantic information of multiple channels, the present invention constructs an AutoEncoder network structure similar to the multi-channel feature fusion process. The goal of this network is to make the fused multi-channel features Able to accurately reconstruct the original , , , And other multi-channel features. The specific process is:

[0073] First, based on the multi-channel fusion feature vector Get the hidden vector representation of 4 channels ;

[0074] Then, according to the hidden layer vector , based on multi-layer MLP, the original vector representations of the four channels are reconstructed , , , , respectively, and , , and The corresponding reconstructed TLD character vector , Reconstruct N-TLD character vector , reconstruct N-TLD statistical feature vector And reconstruct N-TLD vocabulary vector .

[0075] Finally, , , and Constructed as a reconstructed vector dataset.

[0076] S05: construct a reconstruction loss function and a first classification loss function according to the initial vector data set and the reconstructed vector data set, and obtain a target multi-channel semantic learning model based on the reconstruction loss function and the first classification loss function.

[0077] In this step, the expression of the reconstruction loss function is: ; The expression of the first classification loss function is: ;

[0078] A composite loss function is constructed based on the reconstruction loss function and the first classification loss function. The expression of the composite loss function is: ;

[0079] Among them, L represents the composite loss function, L1 represents the reconstruction loss function, and L2 represents the first classification loss function. is the balance parameter, C represents the number of categories, represents the prediction result of the i-th category, Represents the label of the i-th category.

[0080] An initial multi-channel semantic learning model is constructed, and the initial multi-channel semantic learning model is optimized and trained based on the composite loss function to obtain the target multi-channel semantic learning model.

[0081] It should be noted that in the model training phase of step S05, the reconstruction loss and the first classification loss of the AutoEncoder are comprehensively considered, and they are combined to form a composite loss function. The parameters of the model are continuously adjusted through optimization algorithms such as gradient descent to minimize this composite loss function. The training process continues until the model reaches a satisfactory performance level on the validation set, thereby obtaining the target multi-channel semantic learning model we need and saving it.

[0082] S06: Use a rebalancing algorithm on the multi-channel feature fusion vector to obtain a rebalanced vector data set.

[0083] Through step S05, we obtain the trained target multi-channel semantic learning model, which can extract the key features of the original DGA sample. Based on the trained model, feature extraction is performed on the training set and test set of the original sample, and the converted feature representation is saved to replace the training set and test set of the original sample. The specific steps include:

[0084] Load the trained target multi-channel semantic learning model, traverse each DGA sample in the training set and test set of the original sample, and extract features from the original data set; save the feature representation extracted from the DGA samples in the original training set and test set in numerical form to form a new training set and test set. For example, let the original character sequence type DGA data set be , which is converted into a data set in the form of numerical semantic representation , these numerical features represent It will be used for subsequent sample rebalancing generation, as well as model training and testing.

[0085] Furthermore, this step can be based on sample rebalancing algorithms such as SMOTE (artificial synthetic data algorithm) and ADASYN (adaptive synthetic oversampling) to act on DGA datasets in the form of numerical semantic representation. , generate a rebalanced dataset , for subsequent model training.

[0086] In some embodiments, based on the SMOTE rebalancing algorithm, k nearest neighbors are found for each minority class sample in a multi-channel feature fusion vector that is below a preset classification standard; a random sample is selected from the k nearest neighbors and linearly combined with the original sample to generate a synthetic sample; and a rebalanced vector data set is obtained based on the set of multi-channel feature fusion vectors and synthetic samples.

[0087] It can be understood that, first, the number of samples in each category in the DGA multi-channel feature fusion vector dataset in the form of numerical semantic representation is counted, the imbalance ratio is calculated, the degree of imbalance of the dataset is understood, and the distribution of minority class samples is counted. Secondly, the sample rebalancing algorithm is applied to generate samples: based on rebalancing algorithms such as SMOTE, a certain number of synthetic samples are generated for each minority class sample according to the distribution of minority class samples. During the generation process, SMOTE will find its k nearest neighbors (k nearest neighbors) for each minority class sample. Then a sample is randomly selected from its k nearest neighbors, and the original sample and the neighbor sample are linearly combined to generate a synthetic sample that is similar to the original sample but not exactly the same. Finally, a new balanced DGA sample dataset is generated. (Rebalanced vector dataset): Combine the original multi-channel feature fusion vector dataset and the synthetic sample dataset to form a balanced DGA dataset for each category .

[0088] S07: Perform DGA domain classification on the rebalanced vector data set to obtain a predicted balanced classification result.

[0089] S08: construct a second classification loss function based on the DGA domain classification process, and obtain a target classification model based on the second classification loss function.

[0090] According to the characteristics of DGA domain name classification problem, select appropriate classification models, such as decision tree, random forest, support vector machine, neural network, etc., based on the balanced data set Retrain the classification model, save and deploy the model. Based on the trained target classification model , apply, verify and evaluate the model effects.

[0091] It should be noted that the relevant semantic information is extracted through the DGA domain name classification task: In order to extract the semantic information closely related to the target task (i.e., DGA domain name classification), the present invention is based on the DGA domain name semantic representation after multi-channel fusion. , a classification network consisting of MLP and Softmax layers is designed, in which the MLP part is responsible for further extracting and transforming features to make them more suitable for classification tasks; the Softmax layer is used to output the probability distribution of each category, thereby realizing the classification of DGA domain names. At the same time, the second classification loss function of the classification model is defined as another part of the loss in the training process of the DGA domain semantic representation learning model. By introducing this classification network, the model not only learns how to reconstruct the input features (as AutoEncoder does), but also learns how to distinguish different categories of DGA domain names, so that it can extract semantic information closely related to the classification task.

[0092] S09: Obtain a target DGA domain name classification model according to the target multi-channel semantic learning model and the target classification model.

[0093] Based on the target model construction stage of step S05 and step S08, the trained target multi-channel semantic learning model and target classification model are obtained respectively, and the two trained target models are combined as the target DGA domain name classification model to be obtained in this step. Thus, the target DGA domain name classification model can be used as an optimization model for solving the imbalanced classification problem of the DGA domain name samples to be tested.

[0094] In summary, the present application provides a balanced classification method for DGA domain name samples: extracting the initial TLD character sequence, the initial N-TLD character sequence, the initial N-TLD statistical feature sequence and the initial N-TLD vocabulary sequence from the initial DGA domain name, and converting them into vector form to construct an initial vector data set, so that the key features of the DGA domain name can be digitized, laying the foundation for subsequent feature fusion and model training; performing feature fusion on the initial vector data set to obtain a multi-channel feature fusion vector, and this multi-channel feature fusion can more comprehensively capture the semantic information of the DGA domain name and improve the expression ability of the model; inputting the multi-channel feature fusion vector into the autoencoder network layer to obtain a reconstructed vector data set, and the autoencoder network can learn the potential semantic features of the DGA domain name, and optimize the model parameters through the reconstruction process to improve the model. generalization ability; the reconstruction loss function and the first classification loss function are constructed according to the initial vector data set and the reconstructed vector data set, and the target multi-channel semantic learning model is trained. This joint optimization method can enable the model to have good reconstruction and classification capabilities at the same time; the rebalancing algorithm is used for the multi-channel feature fusion vector to obtain the rebalanced vector data set. This step can alleviate the problem of class imbalance in the data set and improve the classification performance of the model in different categories; the second classification loss function is constructed based on the rebalanced vector data set, and the target classification model is trained. This target classification model can be directly used for the classification task of DGA domain names; finally, the target multi-channel semantic learning model and the target classification model are integrated to obtain the target DGA domain name classification model. This integration method can make full use of the advantages of the two models and improve the overall classification performance. Therefore, this method gradually constructs a powerful DGA domain name classification model through the steps of feature extraction, feature fusion, autoencoder reconstruction, rebalancing and model integration. This method can not only make full use of the various semantic features of the DGA domain name, but also effectively solve problems such as data imbalance, and finally achieve a high classification accuracy.

[0095] Example 2

[0096] See also Figure 3 , which is a schematic diagram of the structure of a DGA domain name classification model training system proposed in the second embodiment of the present application, and the system includes:

[0097] The first target model training module 10 is used to extract the initial TLD character sequence, the initial N-TLD character sequence, the initial N-TLD statistical feature sequence and the initial N-TLD vocabulary sequence from the acquired initial DGA domain name; perform vector conversion on the initial TLD character sequence, the initial N-TLD character sequence, the initial N-TLD statistical feature sequence and the initial N-TLD vocabulary sequence to obtain the corresponding initial TLD character vector, initial N-TLD character vector, initial N-TLD statistical feature vector and initial N-TLD vocabulary vector to construct an initial vector data set; convert the initial TLD character vector, The initial N-TLD character vector, the initial N-TLD statistical feature vector and the initial N-TLD vocabulary vector are subjected to feature fusion to obtain a multi-channel feature fusion vector; the multi-channel feature fusion vector is input into the autoencoder network layer to obtain a reconstructed TLD character vector, a reconstructed N-TLD character vector, a reconstructed N-TLD statistical feature vector and a reconstructed N-TLD vocabulary vector to construct a reconstructed vector data set; a reconstruction loss function and a first classification loss function are constructed according to the initial vector data set and the reconstructed vector data set; based on the reconstruction loss function and the first classification loss function, a target multi-channel semantic learning model is obtained;

[0098] The second target model training module 20 is used to use a rebalancing algorithm on the multi-channel feature fusion vector to obtain a rebalanced vector data set; perform DGA domain classification on the rebalanced vector data set to obtain a predicted balanced classification result; construct a second classification loss function based on the DGA domain classification process, and obtain a target classification model based on the second classification loss function;

[0099] The domain name classification model construction module 30 is used to obtain a target DGA domain name classification model according to the target multi-channel semantic learning model and the target classification model.

[0100] Example 3

[0101] See also Figure 4 , is a flow chart of a DGA domain name balancing classification method proposed in the third embodiment of the present application, wherein the DGA domain name balancing classification method comprises:

[0102] S101: Obtain the DGA domain name to be tested;

[0103] S102: inputting the DGA domain name to be tested into a target multi-channel semantic learning model to obtain a multi-channel feature fusion vector, wherein the target multi-channel semantic learning model is obtained by training using a DGA domain name classification model training method;

[0104] S103: Input the multi-channel feature fusion vector into the target classification model to obtain a predicted balanced classification result corresponding to the DGA domain name to be tested, and the target classification model is obtained by training using the DGA domain name classification model training method.

[0105] On the other hand, the present application also proposes an electronic device, comprising: a processor; a memory for storing executable instructions of the processor; wherein the processor is configured to execute the executable instructions to implement the above-mentioned DGA domain name classification model training method or a DGA domain name balanced classification method.

[0106] On the other hand, the present application also proposes a computer-readable storage medium. When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is able to execute the above-mentioned DGA domain name classification model training method or a DGA domain name balance classification method.

[0107] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0108] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, an air conditioner, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0109] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A DGA domain name classification model training method, characterized in that: The method comprises: Extracting an initial TLD character sequence, an initial N-TLD character sequence, an initial N-TLD statistical feature sequence, and an initial N-TLD vocabulary sequence from the acquired initial DGA domain name; Performing vector conversion on the initial TLD character sequence, the initial N-TLD character sequence, the initial N-TLD statistical feature sequence and the initial N-TLD vocabulary sequence to obtain corresponding initial TLD character vectors, initial N-TLD character vectors, initial N-TLD statistical feature vectors and initial N-TLD vocabulary vectors to construct an initial vector data set; Performing feature fusion on the initial TLD character vector, the initial N-TLD character vector, the initial N-TLD statistical feature vector and the initial N-TLD vocabulary vector to obtain a multi-channel feature fusion vector; Input the multi-channel feature fusion vector into the autoencoder network layer to obtain a reconstructed TLD character vector, a reconstructed N-TLD character vector, a reconstructed N-TLD statistical feature vector and a reconstructed N-TLD vocabulary vector to construct a reconstructed vector data set; Constructing a reconstruction loss function and a first classification loss function according to the initial vector data set and the reconstructed vector data set; Based on the reconstruction loss function and the first classification loss function, obtaining a target multi-channel semantic learning model; Applying a rebalancing algorithm to the multi-channel feature fusion vector to obtain a rebalanced vector data set; Performing DGA domain classification on the rebalanced vector data set to obtain a predicted balanced classification result; Constructing a second classification loss function based on the DGA domain name classification process, and obtaining a target classification model based on the second classification loss function; A target DGA domain name classification model is obtained according to the target multi-channel semantic learning model and the target classification model.

2. A DGA domain name classification model training method according to claim 1, characterized in that: The steps of extracting an initial TLD character sequence, an initial N-TLD character sequence, an initial N-TLD statistical feature sequence, and an initial N-TLD vocabulary sequence from the acquired initial DGA domain name include: Splitting the initial DGA domain name into top-level root domain names TLD and non-top-level root domain names N-TLD; Convert the top-level root domain name TLD into the initial TLD character sequence according to the character sequence; Convert the non-top-level root domain name N-TLD into the initial N-TLD character sequence according to the character sequence; Counting key features from the non-top-level root domain name N-TLD to obtain the initial N-TLD statistical feature sequence, wherein the key features include the character length, character type and proportion of each type of the N-TLD; Constructing a DGA English vocabulary based on the initial DGA domain name; Using the n-Gram algorithm on the initial DGA domain name to generate a Token fragment; Filter out high-frequency Token segments from the Token segments to form a high-frequency Token vocabulary; Merge the DGA English vocabulary and the high-frequency Token vocabulary to obtain a DGA vocabulary sequence; The non-top-level root domain name N-TLD is token-matched with the DGA vocabulary sequence to obtain the initial N-TLD vocabulary sequence.

3. A DGA domain name classification model training method according to claim 1, characterized in that: The step of fusing the initial TLD character vector, the initial N-TLD character vector, the initial N-TLD statistical feature vector and the initial N-TLD vocabulary vector to obtain a multi-channel feature fusion vector comprises: The initial TLD character vector , the initial N-TLD character vector , the initial N-TLD statistical feature vector and the initial N-TLD vocabulary vector Perform dimension transformation to obtain the corresponding initial TLD character low-dimensional vector , initial N-TLD character low-dimensional vector , initial N-TLD statistical feature low-dimensional vector and the initial N-TLD vocabulary low-dimensional vector ; The , , and stated Perform feature fusion to obtain the multi-channel feature fusion vector.

4. A DGA domain name classification model training method according to claim 3, characterized in that: The steps of inputting the multi-channel feature fusion vector into the autoencoder network layer to obtain a reconstructed TLD character vector, a reconstructed N-TLD character vector, a reconstructed N-TLD statistical feature vector, and a reconstructed N-TLD vocabulary vector include: Use an automatic encoder to reconstruct the multi-channel feature fusion vector to obtain , , and stated The corresponding reconstructed TLD character vector , Reconstruct N-TLD character vector , reconstruct N-TLD statistical feature vector And reconstruct N-TLD vocabulary vector .

5. A DGA domain name classification model training method according to claim 4, characterized in that: Based on the reconstruction loss function and the first classification loss function, the step of obtaining a target multi-channel semantic learning model includes: Constructing a composite loss function according to the reconstruction loss function and the first classification loss function, wherein the composite loss function is used to optimize the multi-channel semantic learning model to obtain the target multi-channel semantic learning model; The expression of the composite loss function is: , Among them, L1 represents the reconstruction loss function, L2 represents the first classification loss function, represents the equilibrium parameter; The expression of the reconstruction loss function is: ; The expression of the first classification loss function is: , where C represents the number of categories, represents the prediction result of the i-th category, Represents the label of the i-th category.

6. A DGA domain name classification model training method according to claim 1, characterized in that: The step of applying a rebalancing algorithm to the multi-channel feature fusion vector to obtain a rebalanced vector data set includes: Based on the SMOTE rebalancing algorithm, find k nearest neighbors for each minority class sample below a preset classification standard in the multi-channel feature fusion vector; Select a random sample from the k nearest neighbors and perform linear combination with the original sample to generate a synthetic sample; A rebalanced vector data set is obtained according to the multi-channel feature fusion vector and the set of synthetic samples.

7. A DGA domain name classification model training system, characterized in that: The system comprises: The first target model training module is used to extract the initial TLD character sequence, the initial N-TLD character sequence, the initial N-TLD statistical feature sequence and the initial N-TLD vocabulary sequence from the acquired initial DGA domain name; perform vector conversion on the initial TLD character sequence, the initial N-TLD character sequence, the initial N-TLD statistical feature sequence and the initial N-TLD vocabulary sequence to obtain the corresponding initial TLD character vector, the initial N-TLD character vector, the initial N-TLD statistical feature vector and the initial N-TLD vocabulary vector to construct an initial vector data set; convert the initial TLD character vector, the initial N-TLD character vector, the initial N-TLD statistical feature vector and the initial N-TLD vocabulary sequence into a vector; The initial N-TLD character vector, the initial N-TLD statistical feature vector and the initial N-TLD vocabulary vector are subjected to feature fusion to obtain a multi-channel feature fusion vector; the multi-channel feature fusion vector is input into the autoencoder network layer to obtain a reconstructed TLD character vector, a reconstructed N-TLD character vector, a reconstructed N-TLD statistical feature vector and a reconstructed N-TLD vocabulary vector to construct a reconstructed vector data set; a reconstruction loss function and a first classification loss function are constructed according to the initial vector data set and the reconstructed vector data set; a target multi-channel semantic learning model is obtained based on the reconstruction loss function and the first classification loss function; A second target model training module is used to use a rebalancing algorithm on the multi-channel feature fusion vector to obtain a rebalanced vector data set; perform DGA domain classification on the rebalanced vector data set to obtain a predicted balanced classification result; construct a second classification loss function based on the DGA domain classification process, and obtain a target classification model based on the second classification loss function; The domain name classification model construction module is used to obtain a target DGA domain name classification model according to the target multi-channel semantic learning model and the target classification model.

8. A DGA domain name balance classification method, characterized in that: The method comprises: Obtain a DGA domain name to be tested, input the DGA domain name to be tested into a target multi-channel semantic learning model to obtain a multi-channel feature fusion vector, wherein the target multi-channel semantic learning model is trained by the DGA domain name classification model training method according to any one of claims 1 to 6; The multi-channel feature fusion vector is input into a target classification model to obtain a predicted balanced classification result corresponding to the DGA domain name to be tested, wherein the target classification model is obtained by training the DGA domain name classification model training method according to any one of claims 1 to 6.

9. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the executable instructions to implement a DGA domain name classification model training method as described in any one of claims 1 to 6 or a DGA domain name balanced classification method as described in claim 8.

10. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute a DGA domain name classification model training method as described in any one of claims 1 to 6 or a DGA domain name balanced classification method as described in claim 8.

Images