Sub-domain name blasting method and device and electronic equipment

Abstract

The embodiment of the invention provides a sub-domain name blasting method and device and electronic equipment, and the method comprises the steps: constructing a bipartite graph for the incidence relation between a plurality of sample main domain names and a plurality of sample sub-domain names, and determining a target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network; the node comprises a plurality of sample main domain names and a plurality of sample sub-domain names; and for a target main domain name in the plurality of sample main domain names, based on the target feature vector of the target main domain name and the target feature vector of each sample sub-domain name, determining a target sub-domain name corresponding to the target main domain name from the plurality of sample sub-domain names, and blasting the target sub-domain name. Since the bipartite graph represents the association between the nodes, feature coding is performed on each node in the bipartite graph by using the graph convolutional neural network, and the obtained target feature vector reflects the features of the nodes in the association relationship between the master domain name and the slave domain name, the sub-domain name needing to be exploded can be efficiently and accurately determined based on the target feature vector.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a subdomain blasting method, device and electronic device. Background Art

[0002] In the digital age, network security has become a critical issue. As a key component of network security, subdomain blasting technology is becoming increasingly important. Subdomain blasting is a method of discovering and identifying all possible subdomains under a target domain name through automated technology, which plays an irreplaceable role in network security assessment, data leakage prevention, and malware tracking.

[0003] In the related art, subdomain blasting mainly relies on large-scale dictionary attacks, which use dictionaries to determine the subdomains corresponding to the main domain name and then blast these subdomains.

[0004] However, the blasting effect in the above method depends on the completeness and accuracy of the dictionary, so it is difficult to ensure the accuracy and efficiency of subdomain blasting in actual operation. Summary of the invention

[0005] The embodiments of the present application provide a subdomain blasting method, device and electronic device for efficiently and accurately blasting subdomains.

[0006] In a first aspect, an embodiment of the present application provides a first seed domain name blasting method, the method comprising:

[0007] Constructing a bipartite graph for the association relationship between multiple sample main domain names and multiple sample subdomain names, and determining a target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network; wherein the nodes include the multiple sample main domain names and the multiple sample subdomain names;

[0008] For a target main domain name among the multiple sample main domain names, based on a target feature vector of the target main domain name and a target feature vector of each sample subdomain name, a target subdomain name corresponding to the target main domain name is determined from the multiple sample subdomain names, and the target subdomain name is blasted.

[0009] In the above scheme, since the subdomain set can characterize the business information of the corresponding main domain to a certain extent, a bipartite graph between the main domain and the subdomain is constructed, which represents the relationship between the nodes. The graph convolutional neural network is used to encode the features of each node in the bipartite graph. The obtained target feature vector reflects the characteristics of the nodes in the association relationship between the main and slave domain names. Therefore, based on the target feature vector, the subdomain that needs to be blasted can be efficiently and accurately determined, reducing the occurrence of omissions and mis-blasting, and reducing resource consumption and time costs.

[0010] In some optional implementations, determining a target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network includes:

[0011] Determine an adjacency matrix and a degree matrix corresponding to the bipartite graph;

[0012] Based on the activation function, the adjacency matrix and the degree matrix, the initial feature matrix of the graph convolutional neural network is trained to obtain a target feature matrix; wherein the initial feature matrix includes an initial feature vector corresponding to each node;

[0013] For any node, based on the position corresponding to the node in the target feature matrix, a target feature vector corresponding to the node is determined.

[0014] The above scheme uses the information of adjacent nodes to update the feature vector of the current node through the degree matrix, and represents the influence of its own information through the adjacency matrix; performs pooling operations through the adjacency matrix and the degree matrix, realizes the layer-by-layer transmission of the graph convolutional neural network based on the activation function, the adjacency matrix and the degree matrix, completes the training of the initial feature matrix, and thus obtains the target feature matrix that fully learns the association between the master and slave domain names; since the initial feature matrix contains the initial feature vectors corresponding to each node, the target feature matrix is ​​obtained by training the initial feature matrix, so the target feature vector that accurately represents the characteristics of each node can be determined from the target feature matrix.

[0015] In some optional implementations, the i+1th layer feature matrix of the graph convolutional neural network is obtained based on the activation function, the adjacency matrix, the degree matrix, the i-th layer adjustment matrix, the i-th layer feature matrix, and the i-th layer training parameters;

[0016] Among them, 1≤i≤M-1, M is the number of network layers in the graph convolutional neural network; the first layer feature matrix is ​​the initial feature matrix; the i-th layer adjustment matrix is ​​determined based on the i-th layer feature matrix and preset parameters.

[0017] The above scheme determines the adjustment matrix based on the feature matrix and preset parameters, and performs pruning through the adjustment matrix to enhance some elements and weaken some elements, thereby reducing the impact of meaningless edge information on node features, thereby increasing the distinguishing features and alleviating the problem of over-smoothing of graph convolutional neural networks.

[0018] In some optional implementations, the i-th layer adjustment matrix is ​​determined in the following manner:

[0019] For the i-th layer feature matrix, determining the i-th feature vector corresponding to each node of the bipartite graph;

[0020] For any node, determining the vector similarity between the i-th eigenvector of the node and the i-th eigenvectors of each node in the bipartite graph;

[0021] The i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities and preset parameters.

[0022] In some optional implementations, obtaining the i-th layer adjustment matrix based on the comparison results of all vector similarities with preset parameters includes:

[0023] For any vector similarity, if the vector similarity is greater than the preset parameter, determining the adjustment value corresponding to the vector similarity to be the first parameter; otherwise, determining the adjustment value corresponding to the vector similarity to be the second parameter; wherein the first parameter is greater than the second parameter;

[0024] The i-th layer adjustment matrix is ​​constructed based on all adjustment values.

[0025] The above scheme further enhances the pruning effect by constructing an adjustment matrix by selecting an upper limit value (first parameter) and a lower limit value (second parameter) of the similarity.

[0026] In some optional implementations, the initial feature matrix of the graph convolutional neural network is trained to obtain a target feature matrix, including:

[0027] Performing forward propagation on each layer of the graph convolutional neural network to obtain a trained graph convolutional neural network;

[0028] The M-th layer feature matrix of the trained graph convolutional neural network is determined as the target feature matrix.

[0029] In some optional implementations, the adjacency matrix is ​​determined in the following manner:

[0030] For any node in the bipartite graph, determining a first element corresponding to the node based on whether the node is associated with each node in the bipartite graph;

[0031] Constructing the adjacency matrix based on the first elements corresponding to all nodes;

[0032] The degree matrix is ​​determined by:

[0033] For any node in the bipartite graph, determining a second element corresponding to the node based on the number of nodes associated with the node in the bipartite graph;

[0034] The degree matrix is ​​constructed based on the second elements corresponding to all nodes.

[0035] In some optional implementations, determining a target subdomain corresponding to the target main domain from the multiple sample subdomains based on the target feature vector of the target main domain and the target feature vectors of each sample subdomain includes:

[0036] Determine the vector similarity between the target feature vector of the target main domain name and the target feature vectors of each sample subdomain name;

[0037] The sample subdomain corresponding to the vector similarity exceeding the target similarity is determined as the target subdomain.

[0038] In the above scheme, since the target feature vector of each node reflects the characteristics of the node in the association relationship between the master and slave domain names, the target feature vector similarity between the master domain name and the subdomain names under it is relatively high; by determining the vector similarity between the target feature vector of each sample subdomain name and the target feature vector of the target master domain name; when the vector similarity exceeds the target similarity, the target subdomain name is accurately determined.

[0039] In a second aspect, an embodiment of the present application provides a first subdomain name blasting device, the device comprising:

[0040] A feature encoding module, used to construct a bipartite graph for the association relationship between multiple sample main domain names and multiple sample subdomain names, and determine a target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network; wherein the nodes include the multiple sample main domain names and the multiple sample subdomain names;

[0041] The blasting module is used to determine the target subdomain corresponding to the target main domain among the multiple sample main domain names based on the target feature vector of the target main domain name and the target feature vectors of each sample subdomain name from the multiple sample subdomain names, and blast the target subdomain name.

[0042] In some optional implementation manners, the feature encoding module is specifically used to:

[0043] Determine an adjacency matrix and a degree matrix corresponding to the bipartite graph;

[0044] Based on the activation function, the adjacency matrix and the degree matrix, the initial feature matrix of the graph convolutional neural network is trained to obtain a target feature matrix; wherein the initial feature matrix includes an initial feature vector corresponding to each node;

[0045] For any node, based on the position corresponding to the node in the target feature matrix, a target feature vector corresponding to the node is determined.

[0046] In some optional implementations, the i+1th layer feature matrix of the graph convolutional neural network is obtained based on the activation function, the adjacency matrix, the degree matrix, the i-th layer adjustment matrix, the i-th layer feature matrix, and the i-th layer training parameters;

[0047] Among them, 1≤i≤M-1, M is the number of network layers in the graph convolutional neural network; the first layer feature matrix is ​​the initial feature matrix; the i-th layer adjustment matrix is ​​determined based on the i-th layer feature matrix and preset parameters.

[0048] In some optional implementation manners, the feature encoding module is used to determine the i-th layer adjustment matrix in the following manner:

[0049] For the i-th layer feature matrix, determining the i-th feature vector corresponding to each node of the bipartite graph;

[0050] For any node, determining the vector similarity between the i-th eigenvector of the node and the i-th eigenvectors of each node in the bipartite graph;

[0051] The i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities and preset parameters.

[0052] In some optional implementation manners, the feature encoding module is specifically used to:

[0053] For any vector similarity, if the vector similarity is greater than the preset parameter, determining the adjustment value corresponding to the vector similarity to be the first parameter; otherwise, determining the adjustment value corresponding to the vector similarity to be the second parameter; wherein the first parameter is greater than the second parameter;

[0054] The i-th layer adjustment matrix is ​​constructed based on all adjustment values.

[0055] In some optional implementation manners, the feature encoding module is specifically used to:

[0056] Performing forward propagation on each layer of the graph convolutional neural network to obtain a trained graph convolutional neural network;

[0057] The M-th layer feature matrix of the trained graph convolutional neural network is determined as the target feature matrix.

[0058] In some optional implementations, the feature encoding module is used to determine the adjacency matrix in the following manner:

[0059] For any node in the bipartite graph, determining a first element corresponding to the node based on whether the node is associated with each node in the bipartite graph;

[0060] Constructing the adjacency matrix based on the first elements corresponding to all nodes;

[0061] The feature encoding module is used to determine the degree matrix in the following manner:

[0062] For any node in the bipartite graph, determining a second element corresponding to the node based on the number of nodes associated with the node in the bipartite graph;

[0063] The degree matrix is ​​constructed based on the second elements corresponding to all nodes.

[0064] In some optional implementations, the blasting module is specifically used for:

[0065] Determine the vector similarity between the target feature vector of the target main domain name and the target feature vectors of each sample subdomain name;

[0066] The sample subdomain corresponding to the vector similarity exceeding the target similarity is determined as the target subdomain.

[0067] In a third aspect, an embodiment of the present application provides an electronic device, comprising at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes any subdomain blasting method described in the first aspect.

[0068] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium storing a computer program executable by a processor. When the program runs on the processor, the processor executes the subdomain blasting method described in any one of the first aspects above. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0070] Figure 1 A schematic diagram of the process of the first subdomain name blasting method provided in the embodiment of the present application;

[0071] Figure 2 A schematic diagram of a bipartite graph provided for an embodiment of the present application;

[0072] Figure 3 A schematic diagram of the target subdomain provided in the embodiment of the present application;

[0073] Figure 4A schematic diagram of the flow of the second subdomain name blasting method provided in an embodiment of the present application;

[0074] Figure 5 A diagram of a graph convolutional neural network training method provided in an embodiment of the present application;

[0075] Figure 6 A schematic diagram of the process of a third subdomain name blasting method provided in an embodiment of the present application;

[0076] Figure 7 A schematic diagram of the structure of a subdomain blasting device provided in an embodiment of the present application;

[0077] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0078] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0079] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of this application, unless otherwise specified, "plurality" means two or more.

[0080] In the description of this application, it should be noted that, unless otherwise clearly specified and limited, the term "connection" should be understood in a broad sense, for example, it can be directly connected, or indirectly connected through an intermediate medium, or it can be the internal connection of two devices. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0081] Subdomain blasting is a method of discovering and identifying all possible subdomains under the target domain name through automated technology. This plays an irreplaceable role in network security assessment, data leakage prevention, and malware tracking.

[0082] In the related art, subdomain blasting mainly relies on large-scale dictionary attacks, which use dictionaries to determine the subdomains corresponding to the main domain name and then blast these subdomains.

[0083] However, the blasting effect in the above method depends on the completeness and accuracy of the dictionary, so it is difficult to ensure the accuracy and efficiency of subdomain blasting in actual operation.

[0084] In view of this, an embodiment of the present application proposes a subdomain blasting method, device and electronic device, the method comprising: constructing a bipartite graph for the association relationship between multiple sample main domain names and multiple sample subdomain names, and determining the target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network; wherein the node includes the multiple sample main domain names and the multiple sample subdomain names; for a target main domain name among the multiple sample main domain names, based on the target feature vector of the target main domain name and the target feature vectors of each sample subdomain name, determining the target subdomain name corresponding to the target main domain name from the multiple sample subdomain names, and blasting the target subdomain name.

[0085] In the above scheme, since the subdomain set can characterize the business information of the corresponding main domain to a certain extent, a bipartite graph between the main domain and the subdomain is constructed, which represents the relationship between the nodes. The graph convolutional neural network is used to encode the features of each node in the bipartite graph. The obtained target feature vector reflects the characteristics of the nodes in the association relationship between the main and slave domain names. Therefore, based on the target feature vector, the subdomain that needs to be blasted can be efficiently and accurately determined, reducing the occurrence of omissions and mis-blasting, and reducing resource consumption and time costs.

[0086] The following will be combined with the accompanying drawings and specific embodiments to describe in detail the technical solution of the present application and how the technical solution of the present application solves the above technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0087] Figure 1 A schematic diagram of the process of the first seed domain name blasting method provided in the embodiment of the present application is shown as follows: Figure 1 As shown, the following steps are included:

[0088] Step S101: construct a bipartite graph for the association relationship between multiple sample main domain names and multiple sample subdomain names, and determine a target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network.

[0089] The node includes the multiple sample main domain names and the multiple sample subdomain names.

[0090] During implementation, a large number of company names are collected, their corresponding main domain names and historical subdomain names are determined, and these are used as samples.

[0091] For example, by entering the company name into the Internet Content Provider (ICP) database, the primary domain name registered by the company can be obtained; by entering the primary domain name into the Domain Name System (DNS), the historical subdomain names (subdomain names with confirmed associations) of the main domain name can be obtained. DNS data is operator-specific data, and there may be other subdomain names under the primary domain name that are not associated in the DNS.

[0092] Since the subdomain set can describe the business information of the corresponding main domain to a certain extent, by constructing a bipartite graph between the main domain and the subdomain, the bipartite graph represents the relationship between the nodes. The main domain and the subdomain are both nodes in the bipartite graph. If there are X main domains and Y subdomain nodes, the total number of nodes in the bipartite graph is Q = X + Y.

[0093] In a bipartite graph, all vertices can be divided into two non-intersecting subsets, so that each edge in the graph connects the vertices between the two subsets, and there is no edge connecting the vertices in the same subset. Furthermore, the graph convolutional neural network is used to encode the features of each node in the bipartite graph. The obtained target feature vector reflects the features of the nodes in the association relationship between the master and slave domain names.

[0094] See also Figure 2 As shown in the figure, there are three main domains, namely, main domain A, main domain B and main domain C, and four subdomains, namely, subdomain a, subdomain b, subdomain c and subdomain d; main domain A is associated with subdomain a and subdomain b; main domain B is associated with subdomain b and subdomain c; main domain C is associated with subdomain c and subdomain d. Each domain is a node in the bipartite graph. When a subdomain belongs to a main domain, there is an edge between the two nodes, that is, the associated nodes are connected by an edge.

[0095] Figure 2 This is an exemplary description of the bipartite graph between the main domain name and the subdomain name. In implementation, there will be more main domain names and subdomain names.

[0096] Step S102: for a target main domain name among the multiple sample main domain names, based on a target feature vector of the target main domain name and a target feature vector of each sample subdomain name, a target subdomain name corresponding to the target main domain name is determined from the multiple sample subdomain names, and the target subdomain name is blasted.

[0097] See also Figure 3 As shown in the figure, take the primary domain name A as the target primary domain name as an example. Figure 2 Based on the bipartite graph shown, a subordinate subdomain c not associated with the main domain name A is also determined.

[0098] Above Figure 3 This is just an exemplary description. The target main domain name can be the main domain name corresponding to any blasting object. It may have unrelated subordinate subdomain names or may not have unrelated subordinate subdomain names. This embodiment will not give examples one by one.

[0099] In the above scheme, since the subdomain set can characterize the business information of the corresponding main domain to a certain extent, a bipartite graph between the main domain and the subdomain is constructed, which represents the relationship between the nodes. The graph convolutional neural network is used to encode the features of each node in the bipartite graph. The obtained target feature vector reflects the characteristics of the nodes in the association relationship between the main and slave domain names. Therefore, based on the target feature vector, the subdomain that needs to be blasted can be efficiently and accurately determined, reducing the occurrence of omissions and mis-blasting, and reducing resource consumption and time costs.

[0100] Figure 4 A flow chart of the second domain name blasting method provided in the embodiment of the present application is as follows: Figure 4 As shown, the following steps are included:

[0101] Step S401: construct a bipartite graph for association relationships between multiple sample main domain names and multiple sample subdomain names.

[0102] The specific implementation of step S401 may refer to other embodiments and will not be described in detail here.

[0103] Step S402: Determine the adjacency matrix and degree matrix corresponding to the bipartite graph.

[0104] In the implementation, for the bipartite graph, the information of the adjacent nodes is used to update the feature vector of the current node through the degree matrix, and the influence of the own information is represented by the adjacency matrix; the pooling operation is performed through the adjacency matrix and the degree matrix;

[0105] Based on this, the adjacency matrix and degree matrix corresponding to the bipartite graph are determined before training.

[0106] Step S403: Based on the activation function, the adjacency matrix and the degree matrix, the initial feature matrix of the graph convolutional neural network is trained to obtain a target feature matrix.

[0107] The initial feature matrix includes the initial feature vector corresponding to each node.

[0108] In implementation, the initial feature vectors corresponding to all nodes are combined to obtain an initial feature matrix. For example, there are X main domain names, Y subdomain nodes, and the total number of nodes in the bipartite graph is Q=X+Y; the Q nodes correspond to initial feature vectors of length E, and the initial feature matrix Q*E is obtained by combining. This embodiment does not specifically limit the initial feature vector, such as using a preset value as an element in the initial feature vector.

[0109] Based on the activation function, adjacency matrix and degree matrix, the graph convolutional neural network is transmitted layer by layer to complete the training of the initial feature matrix, so as to obtain the target feature matrix that fully learns the association between the master and slave domain names.

[0110] Step S404: for any node, based on the position corresponding to the node in the target feature matrix, determine the target feature vector corresponding to the node.

[0111] Since the initial feature matrix contains the initial feature vectors corresponding to each node, and the target feature matrix is ​​obtained by training the initial feature matrix, the target feature vectors that accurately represent the characteristics of each node can be determined from the target feature matrix.

[0112] For example, the first line in the initial feature matrix is ​​the initial feature vector of the main domain name A, and the first line in the target feature matrix is ​​the target feature vector of the main domain name A; the fourth line in the initial feature matrix is ​​the initial feature vector of the subdomain name a, and the fourth line in the target feature matrix is ​​the target feature vector of the subdomain name a…

[0113] Step S405: For a target main domain name among the multiple sample main domain names, based on a target feature vector of the target main domain name and a target feature vector of each sample subdomain name, a target subdomain name corresponding to the target main domain name is determined from the multiple sample subdomain names, and the target subdomain name is blasted.

[0114] The specific implementation of step S405 may refer to other embodiments and will not be described in detail here.

[0115] The above scheme uses the information of adjacent nodes to update the feature vector of the current node through the degree matrix, and represents the influence of its own information through the adjacency matrix; performs pooling operations through the adjacency matrix and the degree matrix, realizes the layer-by-layer transmission of the graph convolutional neural network based on the activation function, the adjacency matrix and the degree matrix, completes the training of the initial feature matrix, and thus obtains the target feature matrix that fully learns the association between the master and slave domain names; since the initial feature matrix contains the initial feature vectors corresponding to each node, the target feature matrix is ​​obtained by training the initial feature matrix, so the target feature vector that accurately represents the characteristics of each node can be determined from the target feature matrix.

[0116] In some optional implementation manners, determining the adjacency matrix in the above step S402 may be implemented by, but not limited to, the following methods:

[0117] For any node in the bipartite graph, determining a first element corresponding to the node based on whether the node is associated with each node in the bipartite graph;

[0118] The adjacency matrix is ​​constructed based on the first elements corresponding to all nodes.

[0119] In implementation, since the initial feature matrix contains the initial feature vectors corresponding to each node, that is, the initial feature matrix is ​​obtained by combining the initial feature vectors corresponding to all nodes. For example, there are X main domain names, Y subdomain nodes, and the total number of nodes in the bipartite graph is Q=X+Y; the Q nodes respectively correspond to an initial feature vector of length E, and the initial feature matrix of Q*E is obtained by combining them.

[0120] If the adjacency matrix is ​​directly established based on the association between each main domain name and each subdomain name, the adjacency matrix is ​​X*Y and cannot be directly used in subsequent calculations;

[0121] Based on this, this embodiment determines the association between each node and all nodes; for the main domain name, there is no association with itself or other main domain names; for the subdomain name, there is no association with itself or other subdomain names.

[0122] For example, the first element between node i and node j is denoted as a ij , if there is a correlation ij If it is 1, there is no association. ij is 0. Based on the first element, the Q*Q adjacency matrix A is constructed, as shown in Table 1:

[0123] Table 1

[0124] <![CDATA[a1]]> <![CDATA[a2]]> …… <![CDATA[a Q ]]> <![CDATA[a1]]> 0 <![CDATA[a2]]> 0 …… 0 <![CDATA[a Q ]]> 0

[0125] The value of the first element in the vacant position in the table needs to be determined based on the association relationship.

[0126] In implementation, a static adjacency matrix may be determined in the above manner, or the adjacency matrix may be dynamically adjusted, such as constructing an initial adjacency matrix (first-layer adjacency matrix) based on the first elements corresponding to all nodes;

[0127] Based on the multiplication of the i-th layer adjacency matrix and the first matrix, the i+1-th layer adjacency matrix is ​​obtained, and the first matrix can be set according to actual applications.

[0128] In some optional implementations, the degree of certainty matrix in the above step S402 may be implemented by, but not limited to, the following methods:

[0129] For any node in the bipartite graph, determining a second element corresponding to the node based on the number of nodes associated with the node in the bipartite graph;

[0130] The degree matrix is ​​constructed based on the second elements corresponding to all nodes.

[0131] In implementation, since the initial feature matrix contains the initial feature vectors corresponding to each node, that is, the initial feature matrix is ​​obtained by combining the initial feature vectors corresponding to all nodes. For example, there are X main domain names, Y subdomain nodes, and the total number of nodes in the bipartite graph is Q=X+Y; the Q nodes respectively correspond to an initial feature vector of length E, and the initial feature matrix of Q*E is obtained by combining them.

[0132] There are Q nodes in the bipartite graph, so taking each node as a row and column, we can directly generate a Q*Q degree matrix;

[0133] Unlike the adjacency matrix, the degree matrix is ​​not based on whether the nodes are associated, but on the number of associated nodes of each node, that is, the number of out-degree / in-degree. It only has practical meaning when the rows and columns are the same node, so the degree matrix is ​​a diagonal matrix.

[0134] For example, the second element between row node i and column node j is denoted as b ij , i and j are the same b ij The number of nodes associated with node i will correspond to that of node i itself. Based on the second element, the degree matrix D of Q*Q is constructed, as shown in Table 2:

[0135] Table 2

[0136] <![CDATA[b1]]> <![CDATA[b2]]> …… <![CDATA[b Q ]]> <![CDATA[b1]]> 2 - - - <![CDATA[b2]]> - 3 - - …… - - …… - <![CDATA[b Q ]]> - - - 2

[0137] The "-" position in the table has no corresponding second element.

[0138] In implementation, a static degree matrix can be determined by the above method, or the degree matrix can be dynamically adjusted, such as constructing an initial degree matrix (first-level degree matrix) based on the second elements corresponding to all nodes;

[0139] Based on the multiplication of the i-th level degree matrix and the second matrix, the i+1-th level degree matrix is ​​obtained, and the second matrix can be set according to actual applications.

[0140] In some optional implementations, the i+1th layer feature matrix of the graph convolutional neural network is obtained based on the activation function, the adjacency matrix, the degree matrix, the i-th layer adjustment matrix, the i-th layer feature matrix, and the i-th layer training parameters;

[0141] Among them, 1≤i≤M-1, M is the number of network layers in the graph convolutional neural network; the first layer feature matrix is ​​the initial feature matrix; the i-th layer adjustment matrix is ​​determined based on the i-th layer feature matrix and preset parameters.

[0142] In this embodiment, the first-layer feature matrix of the graph convolutional neural network is the initial feature matrix H (1) ;

[0143] The second-layer feature matrix is ​​the initial feature matrix based on the activation function σ, the adjacency matrix A, the degree matrix D, and the first-layer adjustment matrix θ (1) , initial feature matrix H (1) And the first layer training parameters W (1) obtained;

[0144] The third-layer feature matrix is ​​the initial feature matrix based on the activation function σ, the adjacency matrix A, the degree matrix D, and the second-layer adjustment matrix θ (2) , the second-layer feature matrix H (2) And the second layer training parameters W (2) obtained;

[0145] The feature matrices of other layers are also determined in the above manner and will not be described here.

[0146] Exemplarily, the training formula for the i+1th layer is:

[0147] H (i+1) =σ{[D -1 / 2 (θ (i) *A)D -1 / 2 H (i) ]W (i)}; Among them, H (i+1) is the feature matrix of the i+1th layer, σ is the activation function, A is the adjacency matrix, D is the degree matrix, θ (i) Adjust the matrix for the i-th layer, H (i) is the feature matrix of the i-th layer, W (i) is the i-th layer training parameter;

[0148] D -1 / 2 AD -1 / 2 It is a pooling operation, which uses A to represent the influence of its own information, and uses D to update the feature vector of the current node using the information of the adjacent nodes; by taking the square root of D, the data is kept standardized; by taking the inverse of D, the more frequently used nodes are, the less influence they have on other nodes. (i) Direct multiplication with A represents direct pruning of A; multiplication with D -1 / 2 AD -1 / 2 The multiplication represents the pruning of the pooled matrix.

[0149] The above training formula is only an example. In practice, θ can be changed according to the actual length of each matrix. (i) It can be placed at other locations, which is not specifically limited in this embodiment.

[0150] The above scheme determines the adjustment matrix based on the feature matrix and preset parameters, and performs pruning through the adjustment matrix to enhance some elements and weaken some elements, thereby reducing the impact of meaningless edge information on node features, thereby increasing the distinguishing features and alleviating the problem of over-smoothing of graph convolutional neural networks.

[0151] In some optional implementations, the i-th layer adjustment matrix is ​​determined in the following manner:

[0152] For the i-th layer feature matrix, determining the i-th feature vector corresponding to each node of the bipartite graph;

[0153] For any node, determining the vector similarity between the i-th eigenvector of the node and the i-th eigenvectors of each node in the bipartite graph;

[0154] The i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities and preset parameters.

[0155] Since the initial feature matrix includes the initial feature vector corresponding to each node, the i-th layer feature matrix includes the i-th feature vector corresponding to each node.

[0156] Exemplarily, for the i-th layer Q*E feature matrix, the i-th feature vector of length E containing Q nodes;

[0157] Determine the vector similarity between each node and all nodes. For the main domain name, there is no vector similarity between itself and other main domain names; for the subdomain name, there is no vector similarity between itself and other subdomain names;

[0158] Furthermore, the vector similarities are compared with the preset parameters respectively, and the i-th layer adjustment matrix is ​​obtained based on all the comparison results.

[0159] In some optional implementations, obtaining the i-th layer adjustment matrix based on the comparison results of all vector similarities with preset parameters includes:

[0160] For any vector similarity, if the vector similarity is greater than the preset parameter, determining the adjustment value corresponding to the vector similarity to be the first parameter; otherwise, determining the adjustment value corresponding to the vector similarity to be the second parameter; wherein the first parameter is greater than the second parameter;

[0161] The i-th layer adjustment matrix is ​​constructed based on all adjustment values.

[0162] For example, the vector similarity between node i and node j in the i-th layer is denoted as c (i) ij , compare it with the preset parameter δ; if c (i) ij >δ, corresponding adjustment value θ (i) ij is the first parameter; if c (i) ij ≤δ, the corresponding adjustment value θ (i) ijis the second parameter.

[0163] In implementation, the first parameter may be set to 1 (the upper limit of the similarity), and the second parameter may be set to 0 (the upper limit of the similarity).

[0164] Based on all adjustment values, the Q*Q adjustment matrix θ is constructed (i) For details, please refer to Table 3:

[0165] Table 3

[0166]

[0167]

[0168] There is no corresponding adjustment value for the “-” position in the table, and the above values ​​are only examples.

[0169] The above scheme further enhances the pruning effect by constructing an adjustment matrix by selecting an upper limit value (first parameter) and a lower limit value (second parameter) of the similarity.

[0170] In some optional implementation manners, the above step S403 may be implemented by but not limited to the following methods:

[0171] Performing forward propagation on each layer of the graph convolutional neural network to obtain a trained graph convolutional neural network;

[0172] The M-th layer feature matrix of the trained graph convolutional neural network is determined as the target feature matrix.

[0173] See also Figure 5 As shown in the figure, in the graph convolutional neural network training stage, forward propagation is performed based on the training formula of each layer; the loss function loss is calculated, and the feature vector of the node is updated by back propagation;

[0174] Exemplarily, any main domain name, an associated subdomain name, and an unassociated subdomain name in the bipartite graph are taken as a combination to obtain N combinations; the loss function is calculated as follows:

[0175]

[0176] Where N is the number of combinations corresponding to the bipartite graph, u i Indicates the primary domain name corresponding to combination i, v i,pos Indicates that i Associated subdomains, v i,neg Indicates that i Unassociated subdomain, f is a preset function.

[0177] In implementation, the above f may be selected as a similarity calculation function.

[0178] Figure 6 A schematic diagram of the process of the third subdomain name blasting method provided in the embodiment of the present application is shown as follows: Figure 6 As shown, the following steps are included:

[0179] Step S601: construct a bipartite graph for the association relationship between multiple sample main domain names and multiple sample subdomain names, and determine a target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network.

[0180] The node includes the multiple sample main domain names and the multiple sample subdomain names.

[0181] The specific implementation of step S601 may refer to other embodiments and will not be described in detail here.

[0182] Step S602: for a target main domain name among the multiple sample main domain names, determine the vector similarity between the target feature vector of the target main domain name and the target feature vectors of each sample subdomain name.

[0183] Since the target feature vector of each node reflects the characteristics of the node in the association relationship between the master and slave domain names, the target feature vector similarity between the master domain name and the subdomain names under it is relatively high;

[0184] Based on this, this embodiment determines the vector similarity between the target feature vector of each sample subdomain and the target feature vector of the target main domain.

[0185] Exemplarily, the feature vector and the target feature vector of each sample subdomain are determined; the vector similarity between the target main domain u and the sample subdomain v Among them, q u is the target feature vector of the target primary domain name u, q v is the target feature vector of the sample subdomain v.

[0186] Step S603: Determine the sample subdomain corresponding to the vector similarity exceeding the target similarity as the target subdomain.

[0187] With the above vector similarity w uv For example, if the similarity exceeds the target, the sample subdomain v is determined as the target subdomain.

[0188] In the above scheme, since the target feature vector of each node reflects the characteristics of the node in the association relationship between the master and slave domain names, the target feature vector similarity between the master domain name and the subdomain names under it is relatively high; by determining the vector similarity between the target feature vector of each sample subdomain name and the target feature vector of the target master domain name; when the vector similarity exceeds the target similarity, the target subdomain name is accurately determined.

[0189] The above-mentioned subdomain blasting method can be applied to attack surface management. Specifically, by systematically generating and testing a large number of potential subdomains, security experts can be helped to fully understand an organization's Internet assets. Many organizations may host various services under different subdomains, including web pages, APIs (call interfaces), mail servers, etc. These subdomains often become potential security vulnerabilities because of their low profile or forgetfulness. Through the subdomain blasting method of the above-mentioned embodiment, those unrecorded or neglected subdomains are identified, thereby drawing a complete attack surface picture, ensuring that each subdomain is properly protected and avoiding security incidents caused by omissions. Not only does it improve the overall security protection level, but it can also prevent attackers from discovering sensitive information or vulnerabilities within the organization through subdomains, and then launching further attacks.

[0190] The above subdomain blasting method can also be applied to penetration testing and vulnerability mining. Specifically, through subdomain blasting, penetration testers can discover hidden subdomains in the target system. These subdomains may run different applications or services, thus providing attackers with more potential attack entrances. For example, a forgotten development environment or test environment may not have strict security protection, becoming an easy entrance for attackers to break through. After discovering these subdomains, penetration testers can conduct further security tests on them to find possible vulnerabilities, such as unupdated services, default passwords, and publicly disclosed sensitive information. Through these means, security vulnerabilities can be discovered and fixed in advance, preventing attackers from using these subdomains to conduct illegal intrusions and data theft, and ultimately improving the security of the entire system.

[0191] like Figure 7 As shown, the embodiment of the present application provides a subdomain blasting device 700, which includes:

[0192] The feature encoding module 701 is used to construct a bipartite graph for the association relationship between multiple sample main domain names and multiple sample subdomain names, and determine the target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network; wherein the node includes the multiple sample main domain names and the multiple sample subdomain names;

[0193] The blasting module 702 is used to determine the target subdomain corresponding to the target main domain among the multiple sample main domains based on the target feature vector of the target main domain and the target feature vectors of each sample subdomain, and blast the target subdomain.

[0194] In some optional implementation manners, the feature encoding module 701 is specifically used to:

[0195] Determine an adjacency matrix and a degree matrix corresponding to the bipartite graph;

[0196] Based on the activation function, the adjacency matrix and the degree matrix, the initial feature matrix of the graph convolutional neural network is trained to obtain a target feature matrix; wherein the initial feature matrix includes an initial feature vector corresponding to each node;

[0197] For any node, based on the position corresponding to the node in the target feature matrix, a target feature vector corresponding to the node is determined.

[0198] In some optional implementations, the i+1th layer feature matrix of the graph convolutional neural network is obtained based on the activation function, the adjacency matrix, the degree matrix, the i-th layer adjustment matrix, the i-th layer feature matrix, and the i-th layer training parameters;

[0199] Among them, 1≤i≤M-1, M is the number of network layers in the graph convolutional neural network; the first layer feature matrix is ​​the initial feature matrix; the i-th layer adjustment matrix is ​​determined based on the i-th layer feature matrix and preset parameters.

[0200] In some optional implementation manners, the feature encoding module 701 is used to determine the i-th layer adjustment matrix in the following manner:

[0201] For the i-th layer feature matrix, determining the i-th feature vector corresponding to each node of the bipartite graph;

[0202] For any node, determining the vector similarity between the i-th eigenvector of the node and the i-th eigenvectors of each node in the bipartite graph;

[0203] The i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities and preset parameters.

[0204] In some optional implementation manners, the feature encoding module 701 is specifically used to:

[0205] For any vector similarity, if the vector similarity is greater than the preset parameter, determining the adjustment value corresponding to the vector similarity to be the first parameter; otherwise, determining the adjustment value corresponding to the vector similarity to be the second parameter; wherein the first parameter is greater than the second parameter;

[0206] The i-th layer adjustment matrix is ​​constructed based on all adjustment values.

[0207] In some optional implementation manners, the feature encoding module 701 is specifically used to:

[0208] Performing forward propagation on each layer of the graph convolutional neural network to obtain a trained graph convolutional neural network;

[0209] The M-th layer feature matrix of the trained graph convolutional neural network is determined as the target feature matrix.

[0210] In some optional implementations, the feature encoding module 701 is used to determine the adjacency matrix in the following manner:

[0211] For any node in the bipartite graph, determining a first element corresponding to the node based on whether the node is associated with each node in the bipartite graph;

[0212] Constructing the adjacency matrix based on the first elements corresponding to all nodes;

[0213] The feature encoding module 701 is used to determine the degree matrix in the following manner:

[0214] For any node in the bipartite graph, determining a second element corresponding to the node based on the number of nodes associated with the node in the bipartite graph;

[0215] The degree matrix is ​​constructed based on the second elements corresponding to all nodes.

[0216] In some optional implementations, the blasting module 702 is specifically used to:

[0217] Determine the vector similarity between the target feature vector of the target main domain name and the target feature vectors of each sample subdomain name;

[0218] The sample subdomain corresponding to the vector similarity exceeding the target similarity is determined as the target subdomain.

[0219] Since the device is the device in the method in the embodiment of the present application, and the principle of solving the problem by the device is similar to that of the method, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0220] Based on the same technical concept, the embodiment of the present application also provides an electronic device 800, such as Figure 8 As shown, it includes at least one processor 801 and a memory 802 connected to the at least one processor. The specific connection medium between the processor 801 and the memory 802 is not limited in the embodiment of the present application. Figure 8 For example, the processor 801 and the memory 802 are connected via a bus 803. The bus can be divided into an address bus, a data bus, a control bus, etc. For convenience of representation, Figure 8 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0221] Among them, the processor 801 is the control center of the electronic device, which can use various interfaces and lines to connect various parts of the electronic device, and realize data processing by running or executing instructions stored in the memory 802 and calling data stored in the memory 802. Optionally, the processor 801 may include one or more processing units, and the processor 801 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes the issuance of instructions. It is understandable that the above-mentioned modem processor may not be integrated into the processor 801. In some embodiments, the processor 801 and the memory 802 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on independent chips.

[0222] Processor 801 can be a general-purpose processor, such as a CPU, a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the embodiment of the subdomain blasting method can be directly embodied as a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

[0223] The memory 802 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 802 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 802 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 802 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0224] In the embodiment of the present application, the memory 802 stores a computer program. When the program is executed by the processor 801, the processor 801 executes:

[0225] Constructing a bipartite graph for the association relationship between multiple sample main domain names and multiple sample subdomain names, and determining a target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network; wherein the nodes include the multiple sample main domain names and the multiple sample subdomain names;

[0226] For a target main domain name among the multiple sample main domain names, based on a target feature vector of the target main domain name and a target feature vector of each sample subdomain name, a target subdomain name corresponding to the target main domain name is determined from the multiple sample subdomain names, and the target subdomain name is blasted.

[0227] In some optional implementation manners, the processor 801 specifically performs:

[0228] Determine an adjacency matrix and a degree matrix corresponding to the bipartite graph;

[0229] Based on the activation function, the adjacency matrix and the degree matrix, the initial feature matrix of the graph convolutional neural network is trained to obtain a target feature matrix; wherein the initial feature matrix includes an initial feature vector corresponding to each node;

[0230] For any node, based on the position corresponding to the node in the target feature matrix, a target feature vector corresponding to the node is determined.

[0231] In some optional implementations, the i+1th layer feature matrix of the graph convolutional neural network is obtained based on the activation function, the adjacency matrix, the degree matrix, the i-th layer adjustment matrix, the i-th layer feature matrix, and the i-th layer training parameters;

[0232] Among them, 1≤i≤M-1, M is the number of network layers in the graph convolutional neural network; the first layer feature matrix is ​​the initial feature matrix; the i-th layer adjustment matrix is ​​determined based on the i-th layer feature matrix and preset parameters.

[0233] In some optional implementations, the i-th layer adjustment matrix is ​​determined in the following manner:

[0234] For the i-th layer feature matrix, determining the i-th feature vector corresponding to each node of the bipartite graph;

[0235] For any node, determining the vector similarity between the i-th eigenvector of the node and the i-th eigenvectors of each node in the bipartite graph;

[0236] The i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities and preset parameters.

[0237] In some optional implementation manners, the processor 801 specifically performs:

[0238] For any vector similarity, if the vector similarity is greater than the preset parameter, determining the adjustment value corresponding to the vector similarity to be the first parameter; otherwise, determining the adjustment value corresponding to the vector similarity to be the second parameter; wherein the first parameter is greater than the second parameter;

[0239] The i-th layer adjustment matrix is ​​constructed based on all adjustment values.

[0240] In some optional implementation manners, the processor 801 specifically performs:

[0241] Performing forward propagation on each layer of the graph convolutional neural network to obtain a trained graph convolutional neural network;

[0242] The M-th layer feature matrix of the trained graph convolutional neural network is determined as the target feature matrix.

[0243] In some optional implementation manners, the processor 801 specifically performs:

[0244] For any node in the bipartite graph, determining a first element corresponding to the node based on whether the node is associated with each node in the bipartite graph;

[0245] Constructing the adjacency matrix based on the first elements corresponding to all nodes;

[0246] The processor 801 specifically performs:

[0247] For any node in the bipartite graph, determining a second element corresponding to the node based on the number of nodes associated with the node in the bipartite graph;

[0248] The degree matrix is ​​constructed based on the second elements corresponding to all nodes.

[0249] In some optional implementation manners, the processor 801 specifically performs:

[0250] Determine the vector similarity between the target feature vector of the target main domain name and the target feature vectors of each sample subdomain name;

[0251] The sample subdomain corresponding to the vector similarity exceeding the target similarity is determined as the target subdomain.

[0252] Since the electronic device is the electronic device in the method in the embodiment of the present application, and the principle of solving the problem by the electronic device is similar to that of the method, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0253] Based on the same technical concept, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer program executable by a processor. When the program runs on the processor, the processor executes the steps of the above-mentioned subdomain blasting method.

[0254] In some optional embodiments, various aspects of the subdomain blasting method provided by the present application can also be implemented in the form of a program product, which contains computer-executable instructions. When the program product is run on a computer device, the computer-executable instructions are used to enable the computer device to execute the steps of the subdomain blasting method according to various exemplary embodiments of the present application described above in this specification.

[0255] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0256] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0257] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0258] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0259] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0260] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A subdomain blasting method, characterized in that: The method includes: Constructing a bipartite graph for the association relationship between multiple sample main domain names and multiple sample subdomain names, and determining a target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network; wherein the nodes include the multiple sample main domain names and the multiple sample subdomain names; For a target main domain name among the multiple sample main domain names, based on a target feature vector of the target main domain name and a target feature vector of each sample subdomain name, a target subdomain name corresponding to the target main domain name is determined from the multiple sample subdomain names, and the target subdomain name is blasted.

2. The method according to claim 1, characterized in that Determining a target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network includes: Determine an adjacency matrix and a degree matrix corresponding to the bipartite graph; Based on the activation function, the adjacency matrix and the degree matrix, the initial feature matrix of the graph convolutional neural network is trained to obtain a target feature matrix; wherein the initial feature matrix includes an initial feature vector corresponding to each node; For any node, based on the position corresponding to the node in the target feature matrix, a target feature vector corresponding to the node is determined.

3. The method according to claim 2, characterized in that The i+1th layer feature matrix of the graph convolutional neural network is obtained based on the activation function, the adjacency matrix, the degree matrix, the i-th layer adjustment matrix, the i-th layer feature matrix and the i-th layer training parameters; Among them, 1≤i≤M-1, M is the number of network layers in the graph convolutional neural network; the first layer feature matrix is ​​the initial feature matrix; the i-th layer adjustment matrix is ​​determined based on the i-th layer feature matrix and preset parameters.

4. The method according to claim 3, characterized in that The i-th layer adjustment matrix is ​​determined by: For the i-th layer feature matrix, determining the i-th feature vector corresponding to each node of the bipartite graph; For any node, determining the vector similarity between the i-th eigenvector of the node and the i-th eigenvectors of each node in the bipartite graph; The i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities and preset parameters.

5. The method according to claim 4, characterized in that The i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities and preset parameters, including: For any vector similarity, if the vector similarity is greater than the preset parameter, determining the adjustment value corresponding to the vector similarity to be the first parameter; otherwise, determining the adjustment value corresponding to the vector similarity to be the second parameter; wherein the first parameter is greater than the second parameter; The i-th layer adjustment matrix is ​​constructed based on all adjustment values.

6. The method according to claim 3, characterized in that The initial feature matrix of the graph convolutional neural network is trained to obtain a target feature matrix, including: Performing forward propagation on each layer of the graph convolutional neural network to obtain a trained graph convolutional neural network; The M-th layer feature matrix of the trained graph convolutional neural network is determined as the target feature matrix.

7. The method according to claim 2, characterized in that The adjacency matrix is ​​determined by: For any node in the bipartite graph, determining a first element corresponding to the node based on whether the node is associated with each node in the bipartite graph; Constructing the adjacency matrix based on the first elements corresponding to all nodes; The degree matrix is ​​determined by: For any node in the bipartite graph, determining a second element corresponding to the node based on the number of nodes associated with the node in the bipartite graph; The degree matrix is ​​constructed based on the second elements corresponding to all nodes.

8. The method according to claim 1, characterized in that Determining a target subdomain corresponding to the target main domain name from the multiple sample subdomain names based on the target feature vector of the target main domain name and the target feature vectors of each sample subdomain name includes: Determine the vector similarity between the target feature vector of the target main domain name and the target feature vectors of each sample subdomain name; The sample subdomain corresponding to the vector similarity exceeding the target similarity is determined as the target subdomain.

9. A subdomain blasting device, characterized in that: The device includes: A feature encoding module, used to construct a bipartite graph for the association relationship between multiple sample main domain names and multiple sample subdomain names, and determine a target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network; wherein the nodes include the multiple sample main domain names and the multiple sample subdomain names; The blasting module is used to determine the target subdomain corresponding to the target main domain among the multiple sample main domain names based on the target feature vector of the target main domain name and the target feature vectors of each sample subdomain name from the multiple sample subdomain names, and blast the target subdomain name.

10. An electronic device, characterized in that: The method comprises at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor executes the method according to any one of claims 1 to 8.

Images