Defective domain name identification method and system

Abstract

The invention provides a bad domain name identification method and system, and the method comprises the steps: obtaining domain name data, extracting a time sequence feature from the domain name data, generating a node feature matrix based on the time sequence feature, obtaining an attribute value of a domain name node in the domain name data, the multi-modal hypergraph is constructed, a multi-modal hypergraph association matrix is obtained based on the multi-modal hypergraph, and the multi-modal hypergraph is an association mode of the domain name node in different modals; and inputting the node feature matrix and the multi-modal hypergraph incidence matrix into a constructed classification model so as to identify the bad domain name based on the classification model. According to the method, by constructing the multi-modal hypergraph, enhancing explanation of the graph structure and aggregating the node feature matrix of the time information of the domain name nodes, the domain name information is used more comprehensively, and the recognition accuracy of bad domain names can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method and system for identifying bad domain names. Background Art

[0002] A domain name is a string of characters that identifies a computer or a group of computers on the Internet, and is used to replace the hard-to-remember IP address. The Domain Name System (DNS) maps domain names to IP addresses, allowing computers to identify and connect to designated servers. Bad domain names are domain names used by websites that contain or spread illegal or harmful information.

[0003] In order to ensure network security and maintain a healthy network environment, bad domain names can be identified in a variety of ways, such as by analyzing domain name data, extracting multiple significant features, and then performing classification training based on the features. However, it is difficult to capture the global characteristics of the domain name, and does not consider the impact of changes in domain name characteristics over time.

[0004] It is also possible to use a graph neural network model, which can utilize the information of nodes and edges in the domain name relationship graph to capture more complex structured features. However, the relationship between domain names is not a simple one-to-two correspondence, and the connection method of a simple graph will cause information loss, resulting in low recognition accuracy of bad domain names. Summary of the invention

[0005] The present application provides a method and system for identifying bad domain names to solve the problem of low accuracy in identifying bad domain names.

[0006] In a first aspect, the present application provides a method for identifying bad domain names, comprising:

[0007] Acquire domain name data, and acquire attribute values ​​of domain name nodes in the domain name data;

[0008] Extracting time series features from the domain name data, and generating a node feature matrix based on the time series features, wherein the node feature matrix is ​​a matrix that aggregates time information;

[0009] Constructing a multimodal hypergraph through the attribute values ​​of the domain name nodes, wherein the multimodal hypergraph is the association mode of the domain name nodes in different modes;

[0010] Based on the multimodal hypergraph, a multimodal hypergraph association matrix is ​​obtained, where the multimodal hypergraph association matrix is ​​a matrix obtained by concatenating at least three of the multimodal hypergraphs;

[0011] A classification model is constructed, and the node feature matrix and the multimodal hypergraph association matrix are input into the classification model to identify bad domain names based on the classification model.

[0012] By constructing a multimodal hypergraph, enhancing the interpretation of the graph structure, and generating target features that can aggregate the spatial structural features of domain name nodes based on the node feature matrix and the multimodal hypergraph, the domain name information is used more comprehensively, which can improve the accuracy of identifying bad domain names.

[0013] In some feasible embodiments, obtaining the attribute value of the domain name node in the domain name data includes:

[0014] Acquire domain name data, and divide the domain name data into a training set and a test set according to the labels, wherein the training set is the domain name data with labels, and the test set is the domain name data without labels;

[0015] The attribute values ​​of the domain name nodes in the training set and the test set are obtained, wherein the attribute values ​​include the registration subject, the registrar, the IP address, and the autonomous system number.

[0016] In some feasible embodiments, extracting time series features from the domain name data and generating a node feature matrix based on the time series features includes:

[0017] Sorting the domain name data of the training set according to time series to generate time series features;

[0018] Extracting local features of the time series features through a temporal convolutional network;

[0019] Based on multi-layer convolution and dilated causal convolution, local dependencies of the time series features are obtained;

[0020] Based on the local dependency, a node feature matrix is ​​generated.

[0021] Time series features can reflect the characteristic changes of domain names at different time points. Processing the time series features can capture the temporal change information of nodes. Multi-layer convolution can handle dependencies within a longer time range, improve the processing ability of time series features, and make the recognition process more accurate and efficient.

[0022] In some feasible embodiments, after obtaining the local dependency of the time series features based on multi-layer convolution and dilated causal convolution, the method further includes:

[0023] Obtaining the global dependency of time steps in the time series features through a self-attention mechanism and generating attention weights;

[0024] Generate a weighted feature, where the weighted feature is the sum of the product of the feature vector of the time step and the attention weight;

[0025] Inputting the weighted features into a long short-term memory network to generate high-dimensional features through the long short-term memory network;

[0026] Based on the local dependencies and high-dimensional features, a node feature matrix is ​​generated.

[0027] The self-attention mechanism generates attention weights by calculating the correlation between different time steps, and then performs weighted summation on the features to obtain the node temporal attention association method.

[0028] In some feasible embodiments, extracting time series features from the domain name data and generating a node feature matrix based on the time series features further includes:

[0029] Extracting statistical features of the time series features, wherein the statistical features include mean value, standard deviation, maximum value, and minimum value;

[0030] By a concatenation operation, the statistical feature is added to the time series feature to generate an updated time series feature;

[0031] Extracting local features of the updated time series features through a temporal convolutional network;

[0032] Based on multi-layer convolution and dilated causal convolution, local dependencies of the time series features are obtained;

[0033] Based on the local dependency, a node feature matrix is ​​generated.

[0034] By introducing statistical features, the expressiveness of time series features can be improved.

[0035] In some feasible embodiments, obtaining a multimodal hypergraph association matrix based on the multimodal hypergraph includes:

[0036] Constructing a first type of hyperedge, a second type of hyperedge, and a third type of hyperedge, wherein the first type of hyperedge is constructed based on a domain name node connecting the registrant, the second type of hyperedge is constructed based on a domain name node connecting the registrar, and the third type of hyperedge is constructed based on a domain name node connecting the IP address and the autonomous system number;

[0037] Based on the first type of hyperedges, the second type of hyperedges, and the third type of hyperedges, generating a first modal hypergraph, a second modal hypergraph, and a third modal hypergraph;

[0038] The polymorphic association matrices of the first modal hypergraph, the second modal hypergraph and the third modal hypergraph are concatenated to obtain a multimodal hypergraph association matrix.

[0039] By using the attribute values ​​of domain names, three types of hyperedges are constructed and the association matrix is ​​spliced ​​to alleviate the simple characterization of the relationship between domain names. This can more accurately describe the relationship between domain names, improve the use of domain name information, mine the interactions between vertices in the graph, and aggregate more comprehensive feature information.

[0040] In some feasible embodiments, constructing a classification model includes:

[0041] Obtaining a target model and initializing parameters of the target model, wherein the target model is used for outputting category prediction;

[0042] Inputting the training set data into the target model to calculate the predicted output through the target model;

[0043] Calculating the difference between the predicted output and the test set label by a loss function;

[0044] Based on the difference, the gradient of the loss function relative to the target model parameters is calculated, and the parameters of the target model are updated through a gradient descent algorithm and the gradient to obtain a classification model.

[0045] In some feasible embodiments, the node feature matrix and the multimodal hypergraph association matrix are input into the classification model to identify bad domain names based on the classification model, including:

[0046] According to the hypergraph nodes of the multimodal hypergraph, a node degree matrix and a hyperedge degree matrix are obtained, wherein the node degree matrix includes the degrees of the hypergraph nodes, and the hyperedge degree matrix is ​​the number of the hypergraph nodes connected by hyperedges;

[0047] Obtaining a learnable weight matrix, wherein the learnable weight matrix is ​​used for learning feature transformation;

[0048] Extracting target features based on the node feature matrix, node degree matrix, hyperedge degree matrix, learnable weight matrix, multimodal association matrix and activation function;

[0049] The updated node feature is obtained through the target feature, so as to input the updated node feature into the classification model, so as to identify the bad domain name based on the classification model.

[0050] In a second aspect, the present application provides a bad domain name identification system, including:

[0051] An acquisition module, used to acquire domain name data and acquire attribute values ​​of the domain name data nodes;

[0052] A multimodal hypergraph construction module, used to construct a multimodal hypergraph, wherein the multimodal hypergraph is a manner of associating the nodes in different modes;

[0053] A time series convolution module, used to extract time series features from the domain name data, and generate a node feature matrix based on the time series features, wherein the node feature matrix is ​​a matrix of aggregated time information;

[0054] The acquisition module is further used to acquire a multimodal hypergraph association matrix based on the multimodal hypergraph, wherein the multimodal hypergraph association matrix is ​​a matrix obtained by concatenating at least three multimodal hypergraphs;

[0055] Classification prediction module, used to build classification models;

[0056] A hypergraph convolution module, used for inputting the node feature matrix and the multimodal hypergraph association matrix into the classification model;

[0057] The classification prediction module is also used to identify bad domain names.

[0058] It can be seen from the above technical solutions that the present application provides a method and system for identifying bad domain names, the method comprising: obtaining domain name data, extracting time series features from the domain name data, and generating a node feature matrix based on the time series features, wherein the node feature matrix is ​​a matrix that aggregates time information; then obtaining the attribute values ​​of the domain name nodes in the domain name data to construct a multimodal hypergraph, and obtaining a multimodal hypergraph association matrix based on the multimodal hypergraph, wherein the multimodal hypergraph is the association mode of the domain name nodes in different modes; constructing a classification model, and inputting the node feature matrix and the multimodal hypergraph association matrix into the classification model to identify bad domain names based on the classification model. The method enhances the interpretation of the graph structure by constructing a multimodal hypergraph, and makes more comprehensive use of the domain name information by aggregating the node feature matrix of the time information of the domain name nodes, thereby improving the accuracy of identifying bad domain names. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the embodiments are briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0060] Figure 1 A flowchart of a method for identifying bad domain names provided in an embodiment of the present application;

[0061] Figure 2 A schematic diagram of the structure of a temporal convolutional network provided in an embodiment of the present application;

[0062] Figure 3 Schematic diagram of LSTM hidden layer provided for the embodiment of the present application;

[0063] Figure 4 A schematic diagram of splicing the correlation matrix provided in the embodiment of the present application;

[0064] Figure 5 A schematic diagram of the structure of a bad domain name identification system provided in an embodiment of the present application;

[0065] Figure 6 A schematic diagram of the identification process of the bad domain name identification system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0066] The following embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following embodiments do not represent all implementations consistent with the present application. They are only examples of systems and methods consistent with some aspects of the present application as detailed in the claims.

[0067] Bad domain names are carriers of illegal activities such as cyber attacks, phishing websites, and the spread of bad software. By identifying bad domain names, security threats can be discovered and blocked in a timely manner, protecting users' personal information, property safety, and the overall security of the network environment.

[0068] In order to identify bad domain names, in some embodiments, classification training is performed by extracting features, and the features include the length of the domain name, the specific characters contained, the similarity with known bad domain names, the registrant information, the registrar, the traffic pattern, etc. For example, the length of the bad domain name is shorter or longer than the length of the normal domain name, anonymous registration or false information, and the domain name is in the known bad domain name blacklist.

[0069] That is to say, identifying bad domain names by extracting features only focuses on the local features of the domain name itself, and the bad nature of the domain name may change over time. Therefore, identification by this method may lead to inaccurate identification results.

[0070] In other embodiments, a Graph Neural Network (GNN) can be used to learn by using the relationship between domain names. By constructing a domain name relationship graph, in which nodes represent domain names and edges represent the relationship between domain names, this graph structure can capture the complex dependencies and relationships between domain names. The GNN propagates and learns information through the information of nodes and edges to determine whether it is a bad domain name.

[0071] Although graph neural architectures can use node and edge information to capture complex structural features, when the relationship between domain names is not a simple two-to-two correspondence, the simple graph connection method may ignore some important relationships, resulting in information loss. In addition, when dealing with high-order relationships, for example, complex interactions between multiple nodes require more complex graph structure representations, such as hypergraphs or multigraphs, which increases the complexity of the model and leads to inaccurate recognition results.

[0072] In order to solve the problem of inaccurate identification results, some embodiments of the present application provide a method for identifying bad domain names. The method captures the timing information of domain name nodes and constructs multi-type hyperedges using the attributes of the domain names to characterize the association between domain names, and captures the target features of the node feature matrix and multimodal hypergraph with timing information. The target features contain graph space information, which can be more explanatory of the characterization of the relationship between domain names, and the use of domain name nodes is more comprehensive, thereby improving the accuracy of bad domain name identification.

[0073] like Figure 1 As shown, the method includes:

[0074] S100: Acquire domain name data, and acquire attribute values ​​of domain name nodes in the domain name data.

[0075] Domain name data refers to all information related to Internet domain names, including but not limited to the domain name string itself, registration information such as registrant, registration date, IP address, historical resolution records, DNS (Domain Name System) query records, WHOIS (World Wide Web Object Identifier Service) information, traffic data, etc.

[0076] The number of domain name data includes multiple, and some domain name data are labeled data, wherein the label of bad domain names is 1, and the label of non-bad domain names is 0. In some embodiments, the domain name data is divided into a training set and a test set, wherein the training set is the labeled domain name data, and the test set is the non-labeled domain name data; the training set includes the bad domain name data and the non-bad domain name data, which are used to train the classification model, and the test set is used to evaluate the performance of the trained model.

[0077] Domain name nodes are the basis for building a graph structure. The connection (edge) between nodes is used to represent the relationship graph structure between different domain names. A specific domain name can be represented by nodes to store relevant information about the domain name. The domain name node has attribute values, which are data or features associated with the domain name node. These attribute values ​​may include but are not limited to the registration entity, registrar, IP address, and autonomous system number. These attribute values ​​are used to build a multimodal hypergraph to represent the characteristics of domain names in different aspects.

[0078] The registrant is the individual or company that registers the domain name, which is used to identify bad behavior patterns, such as using a false registration name. The registrar is the service provider for domain name registration, and some registrars are easily used for malicious registration. The IP address is the IP address resolved to the domain name, and some IP addresses may be associated with high-risk activities. The Autonomous System Number (ASN) is a network block associated with a specific IP, which is used to identify the domain name hosted under it. Through the ASN, it can be verified whether the domain name is in the same network as a known bad IP address.

[0079] S200: extracting time series features from the domain name data, and generating a node feature matrix based on the time series features.

[0080] The time series features describe the characteristics of domain names changing over time, such as the registration time of the domain name, the last resolution time, the number of visits to the domain name, the trend of traffic over time, the frequency change of DNS queries, etc. Time series features can reflect the behavior pattern of the domain name and its changing trend over time. In the process of extracting time series features, the time series features are generated from the domain name data of the training set according to the time series sorting.

[0081] For example, take the domain name node a as an example:

[0082] X a,seq ={x a,0 ,x a,1 ,...,x a,T};

[0083] Where a=1,2…, T=0,1…, T is the time series feature vector of domain name node a at time point T.

[0084] The feature vectors are organized into a node feature matrix, where each row corresponds to a domain node and each column corresponds to a time series feature.

[0085] The node feature matrix is ​​used to aggregate the information of domain name nodes in the time series, where each row represents a node (domain name) and each column represents a time series feature. In this process, each element in the matrix is ​​the result of time series feature extraction.

[0086] In some embodiments, local features of time series features are extracted through a temporal convolutional network (TCN); local dependencies of time series features are obtained based on multi-layer convolution and dilated causal convolution; and a node feature matrix is ​​generated based on the local dependencies.

[0087] TCN is a deep learning model used to process sequence data. It captures local dependencies in the data through convolution operations. TCN is operated through multiple layers of time convolution to capture the dependencies of domain time series features. The convolution operation in TCN slides on the time axis and captures the dependencies between different time steps through dilated causal convolution. Dilated Causal Convolution (DCC) is a form of convolution in TCN that allows the model to reduce the number of parameters while maintaining the receptive field and ensures that future data does not affect the current output.

[0088] The formula for dilated causal convolution is:

[0089]

[0090] Among them, f(i) is the filter, k is the convolution kernel size, d is the expansion coefficient, and td·i is the time series feature vector obtained after TCN processing in the previous direction.

[0091] like Figure 2 As shown in the figure, TCN consists of N repeated residual blocks, where ReLu is the activation function. Normalized weights and Dropout layers (random inactivation layers) are added after each dilated convolution to suppress noise interference and avoid overfitting, and then 1×1 convolution is performed to make the input and output dimensions the same. Dilated causal convolution introduces intervals in the convolution operation, allowing the convolution kernel to perform non-continuous sampling on the input sequence, which can capture dependencies over a longer time range without increasing computational complexity.

[0092] Continue to see Figure 2 In some embodiments, if y7 is to capture the features of x0, 7 layers of causal convolution with a kernel size of 2 are required. However, with dilated causal convolution, only 3 layers of y7 are needed to capture the features of x0, thus increasing the speed of convolution.

[0093] Exemplarily, we first sort the domain name data by time series, use TCN to extract local features, capture local dependencies through multi-layer convolution and dilated causal convolution, and generate a node feature matrix that can capture local changes in time series features.

[0094] Based on TCN, a self-attention mechanism is added. a =Attention(Y a ), which is used to capture the global dependencies between different time steps in time series features.

[0095] In some embodiments, the global dependencies of time steps in time series features are obtained through a self-attention mechanism, and attention weights are generated to generate weighted features. The weighted features are input into a long short-term memory network (LSTM) to generate high-dimensional features through the long short-term memory network, and a node feature matrix is ​​generated based on local dependencies and high-dimensional features.

[0096] Among them, the self-attention mechanism allows the model to focus on different parts of the input when processing sequence data. The self-attention mechanism can obtain the global dependencies of all time steps in the time series features and assign different attention weights to different time steps. The attention feature representation is shown in the following formula:

[0097]

[0098] Where Q = W q Y a , K=W k Y a , V=W v Y a , d k is the dimension of the feature vector, W q , W k , W v is a trainable weight matrix.

[0099] Attention weights are generated by weighting the feature vectors of each time step. These weights are used to reflect the importance of certain time steps to the current data. The weighted feature is the weighted sum of the feature vector of the time step and the attention weight.

[0100] The self-attention mechanism is used to obtain global dependencies, generate attention weights, and then input the weighted features into LSTM to generate high-dimensional features. The node feature matrix is ​​generated by combining local dependencies. LSTM can effectively capture long-term and short-term dependencies in time series and avoid the problems of gradient explosion and gradient disappearance.

[0101] When generating time series features, statistical features can also be introduced to enhance the expressive power of time series features. In some embodiments, statistical features of time series features are extracted, and the statistical features include mean, standard deviation, maximum, and minimum. The statistical features are added to the time series features through a connection operation to generate updated time series features, and the local features of the updated time series features are extracted through a time convolution network; based on multi-layer convolution and dilated causal convolution, the local dependencies of the time series features are obtained; based on the local dependencies, a node feature matrix is ​​generated. For each time series feature, a variety of statistical features can be calculated. Statistical features are calculated from the time series features, which quantify the overall behavior of the time series features, and the extracted statistical features are added to the original time series features to generate updated time series features. The time features are combined with behavioral data to enhance the expressive power of the time series features. Through statistical features, time series data can be more comprehensively understood, and performance in time series prediction and event detection tasks can be improved. Statistical features enable the model to be better generalized to new data to improve recognition accuracy.

[0102] The extracted statistical features are added to the time series feature matrix to form a new feature matrix, and the statistical features are combined with the time series features extracted by TCN to enrich the feature representation. The combined feature matrix is ​​then subjected to feature extraction using a temporal convolutional network.

[0103] It is understandable that, whether through the method of hyperedge node similarity or through the method of statistical features, a self-attention mechanism can be added on the basis of TCN, and the attention features after convolution can be input into LSTM (Long Short-Term Memory). LSTM processes time series features through a gating mechanism to alleviate the problems of gradient explosion and gradient disappearance.

[0104] See also Figure 3 , characteristic data A a,i The forget gate controls the degree of forgetting of the previous unit state:

[0105] f t =σ(W f ·[h t-1 ,A a,t ]+b f );

[0106] Among them, f t is the output of the forget gate, W f is the corresponding weight matrix, h t-1 is the hidden state of the unit at the previous moment, b f is the corresponding bias vector, h t is the hidden state of the current cell.

[0107] Hidden state refers to the memory and understanding of past information when processing sequence data. Its function is to remember and transmit sequence information. The forget gate determines which past information needs to be forgotten. The σ function converts the input value into a probability value between 0 and 1, where 0 means complete forgetting and 1 means complete retention.

[0108] The input gate determines the impact of the information on the current cell state:

[0109] i t =σ(W i ·[h t-1 ,A a,t ]+b i );

[0110] The input gate is used to determine how much of the current input information needs to be written into the memory cell. t represents the output of the input gate, W i is the corresponding weight matrix, b i is the corresponding bias vector, and the input value is converted into a probability value between 0 and 1 through the σ function.

[0111] Generate new candidate cell states Used to update the current cell state. The candidate cell state is as follows:

[0112]

[0113] Among them, W C is the corresponding weight matrix, b C is the corresponding bias vector. The candidate value of the new information is generated by the tanh function Make sure the value of the new information is between -1 and 1.

[0114] The information of the input gate, forget gate and candidate unit state is integrated to update the unit state C of the current time step t :

[0115]

[0116] Among them, i t Decided How much needs to be written to the memory cell.

[0117] Control the current cell state C t For the current h t The output gate is calculated as follows:

[0118] o t =σ(W o ·[h t-1 ,A a,t ]+b0);

[0119] The output gate is used to determine how much information in the memory cell should be output to the hidden state. t is the output threshold, W o is the corresponding weight matrix, and b0 is the corresponding bias vector. The input value is converted into a probability value between 0 and 1 through the σ function to determine the information C in the memory unit. t How much needs to be output to the hidden state h t , and uses the tanh function to perform nonlinear transformation on the value of the memory unit to ensure that the output value is between -1 and 1.

[0120] Based on the current cell state and output gate, generate the hidden state h of the current time step t :

[0121] h t =o t tanh(C t );

[0122] After LSTM processing, the node high-dimensional feature representation X of the aggregated time series features is obtained. a =LSTM(A a ), and then generate the node feature matrix based on local dependencies, weighted adjacency matrix and high-dimensional features.

[0123] S300: Construct a multimodal hypergraph through the attribute values ​​of domain name nodes.

[0124] A multimodal hypergraph is a way of associating domain name nodes in different modes. A multimodal hypergraph is a graph structure in which nodes and edges can contain multiple types of information (modalities). In a multimodal hypergraph, domain name nodes are connected by different edges (different types of associations), and each node and edge can have multiple attributes or features, which can more comprehensively represent the complex relationship between domain names.

[0125] S400: Based on the multimodal hypergraph, obtain a multimodal hypergraph association matrix.

[0126] The multimodal hypergraph association matrix is ​​a matrix obtained by concatenating at least three of the multimodal hypergraphs, such as Figure 4 As shown, a multimodal hypergraph association matrix can be constructed through the attribute values ​​of the domain name nodes. In some embodiments, a first type of hyperedge, a second type of hyperedge, and a third type of hyperedge are constructed. Based on the first type of hyperedge, the second type of hyperedge, and the third type of hyperedge, a first modal hypergraph, a second modal hypergraph, and a third modal hypergraph are generated. The polymorphic association matrices of the first modal hypergraph, the second modal hypergraph, and the third modal hypergraph are concatenated to obtain a multimodal hypergraph association matrix.

[0127] Among them, the first type of hyperedge is constructed based on the domain name node connecting the registrant, the second type of hyperedge is constructed based on the domain name node connecting the registrar, and the third type of hyperedge is constructed based on the domain name node connecting the IP address and the autonomous system number.

[0128] For the training set and the test set, a multimodal hypergraph is constructed respectively. Taking the test set as an example, each domain name node is taken as the starting point, and a hyperedge H1 is constructed to connect the domain name node of the same registrant as the domain name node, a hyperedge H2 is constructed to connect the domain name node of the same registrar as the domain name node, and a hyperedge H3 is constructed to connect the domain name node that has the same ASN resolution IP as the domain name node. Three modal hypergraphs are obtained, and the association matrices of the three modal hypergraphs are spliced ​​to form a multimodal association matrix: Get a multimodal hypergraph.

[0129] Using the different types of hyperedges constructed, the first modality hypergraph, second modality hypergraph, and third modality hypergraph are generated respectively. Then, multimodal hypergraphs are constructed. These hypergraphs will capture relationships in their respective dimensions, integrate the relationships between hypergraphs of different modalities, and enhance feature representation by splicing hypergraph matrices under different modalities. Multimodal hypergraphs can capture the relationships between domain names and improve the ability to identify bad activities by combining different types of hyperedges.

[0130] First extract the time series features of each node to obtain the node feature matrix of aggregated time information, and then construct the hypergraph (or both are done in parallel) to reduce resource consumption.

[0131] S500: Construct a classification model, and input the node feature matrix and the multimodal hypergraph association matrix into the classification model to identify bad domain names based on the classification model.

[0132] After building the classification model, the features of each node will be combined with the features of its neighboring nodes. After multiple propagation iterations, a new feature representation Z for each node will be formed. That is, the final feature representation of the node that aggregates temporal information and graph spatial structure information is further obtained through the node feature matrix and the multimodal hypergraph association matrix, which is used as the input for classification prediction for the identification of bad domain names.

[0133] In some embodiments, according to the hypergraph nodes of the multimodal hypergraph, a node degree matrix and a hyperedge degree matrix are obtained, and a learnable weight matrix is ​​obtained. Based on the node feature matrix, the node degree matrix, the hyperedge degree matrix, the learnable weight matrix, the multimodal association matrix and the activation function, the target features are extracted, and the updated node features are obtained through the target features, so as to input the updated node features into the classification model to identify bad domain names based on the classification model. Among them, the node degree matrix includes the degree of the hypergraph node, that is, how many hyperedges are connected to each node. The hyperedge degree matrix is ​​the number of hypergraph nodes connected by hyperedges, and the learnable weight matrix is ​​used to learn feature transformation. Through the introduction of the node degree matrix, the hyperedge degree matrix and the learnable weight matrix, the feature representation can be enhanced and richer information can be provided.

[0134] Exemplarily, the propagation process of node feature X is as follows:

[0135]

[0136] Among them, D v is the node degree matrix, H is the multimodal association matrix, D e is the hyperedge degree matrix, X (l) represents the input features of the lth layer, X (0) =X is the output of the temporal convolution module, W (l) is the learnable weight matrix of layer l.

[0137] Regarding the construction of the classification model, in some embodiments, it includes: obtaining a target model and initializing the parameters of the target model, wherein the target model is used to output category predictions; inputting the training set data into the target model to calculate the predicted output through the target model; calculating the difference between the predicted output and the test set label through the loss function; based on the difference, calculating the gradient of the loss function relative to the target model parameters, and updating the parameters of the target model through the gradient descent algorithm and the gradient to obtain the classification model.

[0138] The domain name category prediction probability is obtained through the target feature Z, and the process can be expressed as follows:

[0139]

[0140] in, It is the probability result of domain name category prediction, sofmax maps the result to the range of 0-1, and w and b are learnable parameters.

[0141] By initializing parameters and optimizing them using the gradient descent algorithm, a classification model that can distinguish bad domain names from non-bad domain names can be trained. The loss function is the cross entropy loss function, which can quantify the prediction error and guide the update of model parameters. By performing multiple iterations of optimization on the training set, the model can learn to extract useful features from the input data and improve the generalization ability of new data. The trained classification model is then used to classify each node in the test set and identify bad domain names.

[0142] Based on the above-mentioned bad domain name identification method, such as Figure 5 , Figure 6 As shown, some embodiments of the present application also provide a bad domain name identification system, including:

[0143] An acquisition module, used to acquire domain name data and acquire attribute values ​​of the domain name data nodes;

[0144] A multimodal hypergraph construction module, used to construct a multimodal hypergraph, wherein the multimodal hypergraph is a manner of associating the nodes in different modes;

[0145] A time series convolution module, used to extract time series features from the domain name data, and generate a node feature matrix based on the time series features, wherein the node feature matrix is ​​a matrix of aggregated time information;

[0146] The acquisition module is further used to acquire a multimodal hypergraph association matrix based on the multimodal hypergraph, wherein the multimodal hypergraph association matrix is ​​a matrix obtained by concatenating at least three multimodal hypergraphs;

[0147] Classification prediction module, used to build classification models;

[0148] A hypergraph convolution module, used for inputting the node feature matrix and the multimodal hypergraph association matrix into the classification model;

[0149] The classification prediction module is also used to identify bad domain names.

[0150] The present application provides a method and system for identifying bad domain names, the method comprising: obtaining domain name data, extracting time series features from the domain name data, and generating a node feature matrix based on the time series features, wherein the node feature matrix is ​​a matrix that aggregates time information, and then obtaining attribute values ​​of domain name nodes in the domain name data to construct a multimodal hypergraph, and obtaining a multimodal hypergraph association matrix based on the multimodal hypergraph, wherein the multimodal hypergraph is the association mode of the domain name nodes in different modes; constructing a classification model, and inputting the node feature matrix and the multimodal hypergraph association matrix into the classification model to identify bad domain names based on the classification model. The method enhances the interpretation of the graph structure by constructing a multimodal hypergraph, and makes more comprehensive use of domain name information by aggregating the node feature matrix of the time information of the domain name nodes, thereby improving the accuracy of identifying bad domain names.

[0151] Similar parts between the embodiments provided in this application can be referenced to each other. The specific implementation methods provided above are only a few examples under the general concept of this application and do not constitute a limitation on the protection scope of this application. For those skilled in the art, any other implementation methods expanded based on the scheme of this application without creative work belong to the protection scope of this application.

Claims

1. A method for identifying bad domain names, characterized in that: include: Acquire domain name data, and acquire attribute values ​​of domain name nodes in the domain name data; Extracting time series features from the domain name data, and generating a node feature matrix based on the time series features, wherein the node feature matrix is ​​a matrix that aggregates time information; Constructing a multimodal hypergraph through the attribute values ​​of the domain name nodes, wherein the multimodal hypergraph is the association mode of the domain name nodes in different modes; Based on the multimodal hypergraph, a multimodal hypergraph association matrix is ​​obtained, where the multimodal hypergraph association matrix is ​​a matrix obtained by concatenating at least three of the multimodal hypergraphs; A classification model is constructed, and the node feature matrix and the multimodal hypergraph association matrix are input into the classification model to identify bad domain names based on the classification model.

2. The method for identifying bad domain names according to claim 1, characterized in that: Obtaining domain name data and obtaining attribute values ​​of domain name nodes in the domain name data, including: Acquire domain name data, and divide the domain name data into a training set and a test set according to the labels, wherein the training set is the domain name data with labels, and the test set is the domain name data without labels; The attribute values ​​of the domain name nodes in the training set and the test set are obtained, wherein the attribute values ​​include the registration subject, the registrar, the IP address, and the autonomous system number.

3. The method for identifying bad domain names according to claim 2, characterized in that: Extracting time series features from the domain name data, and generating a node feature matrix based on the time series features, including: Sorting the domain name data of the training set according to time series to generate time series features; Extracting local features of the time series features through a temporal convolutional network; Based on multi-layer convolution and dilated causal convolution, local dependencies of the time series features are obtained; Based on the local dependency, a node feature matrix is ​​generated.

4. The method for identifying bad domain names according to claim 3, characterized in that: Extracting time series features from the domain name data and generating a node feature matrix based on the time series features also includes: Extracting statistical features of the time series features, wherein the statistical features include mean value, standard deviation, maximum value, and minimum value; By a concatenation operation, the statistical feature is added to the time series feature to generate an updated time series feature; Extracting local features of the updated time series features through a temporal convolutional network; Based on multi-layer convolution and dilated causal convolution, local dependencies of the time series features are obtained; Based on the local dependency, a node feature matrix is ​​generated.

5. The method for identifying bad domain names according to claim 3 or 4, characterized in that: After obtaining the local dependency of the time series features based on multi-layer convolution and dilated causal convolution, the following is also included: Obtaining the global dependency of time steps in the time series features through a self-attention mechanism and generating attention weights; Generate a weighted feature, where the weighted feature is the sum of the product of the feature vector of the time step and the attention weight; Inputting the weighted features into a long short-term memory network to generate high-dimensional features through the long short-term memory network; Based on the local dependencies and high-dimensional features, a node feature matrix is ​​generated.

6. The method for identifying bad domain names according to claim 2, characterized in that: Based on the multimodal hypergraph, obtaining a multimodal hypergraph association matrix includes: Constructing a first type of hyperedge, a second type of hyperedge, and a third type of hyperedge, wherein the first type of hyperedge is constructed based on a domain name node connecting the registrant, the second type of hyperedge is constructed based on a domain name node connecting the registrar, and the third type of hyperedge is constructed based on a domain name node connecting the IP address and the autonomous system number; Based on the first type of hyperedges, the second type of hyperedges, and the third type of hyperedges, generating a first modal hypergraph, a second modal hypergraph, and a third modal hypergraph; The polymorphic association matrices of the first modal hypergraph, the second modal hypergraph and the third modal hypergraph are concatenated to obtain a multimodal hypergraph association matrix.

7. The method for identifying bad domain names according to claim 2, characterized in that: Build a classification model, including: Obtaining a target model and initializing parameters of the target model, wherein the target model is used to output category prediction; Inputting the training set data into the target model to calculate the predicted output through the target model; Calculating the difference between the predicted output and the test set label by a loss function; Based on the difference, the gradient of the loss function relative to the target model parameters is calculated, and the parameters of the target model are updated through a gradient descent algorithm and the gradient to obtain a classification model.

8. The method for identifying bad domain names according to claim 2, characterized in that: Inputting the node feature matrix and the multimodal hypergraph association matrix into the classification model to identify bad domain names based on the classification model, including: According to the hypergraph nodes of the multimodal hypergraph, a node degree matrix and a hyperedge degree matrix are obtained, wherein the node degree matrix includes the degrees of the hypergraph nodes, and the hyperedge degree matrix is ​​the number of the hypergraph nodes connected by hyperedges; Obtaining a learnable weight matrix, wherein the learnable weight matrix is ​​used for learning feature transformation; Extracting target features based on the node feature matrix, node degree matrix, hyperedge degree matrix, learnable weight matrix, multimodal association matrix and activation function; The updated node feature is obtained through the target feature, so as to input the updated node feature into the classification model, so as to identify the bad domain name based on the classification model.

9. A bad domain name identification system, characterized in that: include: An acquisition module, used to acquire domain name data and acquire attribute values ​​of the domain name data nodes; A multimodal hypergraph construction module, used to construct a multimodal hypergraph, wherein the multimodal hypergraph is a manner of associating the nodes in different modes; A time series convolution module, used to extract time series features from the domain name data, and generate a node feature matrix based on the time series features, wherein the node feature matrix is ​​a matrix of aggregated time information; The acquisition module is further used to acquire a multimodal hypergraph association matrix based on the multimodal hypergraph, wherein the multimodal hypergraph association matrix is ​​a matrix obtained by concatenating at least three multimodal hypergraphs; Classification prediction module, used to build classification models; A hypergraph convolution module, used for inputting the node feature matrix and the multimodal hypergraph association matrix into the classification model; The classification prediction module is also used to identify bad domain names.

Images