A method, apparatus and electronic device for brute-forcing subdomains

Abstract

This application provides a subdomain brute-force method, apparatus, and electronic device. The method includes: constructing a bipartite graph based on the association relationships between multiple sample main domains and multiple sample subdomains; determining the target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network; the nodes include multiple sample main domains and multiple sample subdomains; for a target main domain among the multiple sample main domains, determining the target subdomain corresponding to the target main domain from the multiple sample subdomains based on the target feature vector of the target main domain and the target feature vectors of each sample subdomain, and brute-forcing the target subdomain. Since the bipartite graph represents the association between nodes, using a graph convolutional neural network to encode the features of each node in the bipartite graph, the resulting target feature vector reflects the characteristics of the nodes in the association relationship between main and subdomains. Therefore, the subdomain to be brute-forced can be efficiently and accurately determined based on the target feature vector.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus and electronic device for brute-forcing subdomains. Background Technology

[0002] In the digital age, cybersecurity has become a crucial issue. Subdomain brute-force technology, as a key component of cybersecurity, is increasingly important. Subdomain brute-force is a method that uses automated technology to discover and identify all possible subdomains under a target domain. This plays an irreplaceable role in cybersecurity assessment, data breach prevention, and malware tracking.

[0003] In related technologies, subdomain brute-force attacks mainly rely on large-scale dictionary attacks, which use dictionaries to determine the subdomains corresponding to the main domain, and then brute-force these subdomains.

[0004] However, the effectiveness of the above methods depends on the completeness and accuracy of the dictionary, so it is difficult to guarantee the accuracy and efficiency of subdomain brute-force in actual operation. Summary of the Invention

[0005] This application provides a subdomain brute-force method, apparatus, and electronic device for efficient and accurate subdomain brute-force attacks.

[0006] In a first aspect, embodiments of this application provide a method for brute-forcing a first seed domain name, the method comprising:

[0007] A bipartite graph is constructed to identify the relationships between multiple sample main domains and multiple sample subdomains. The target feature vector corresponding to each node in the bipartite graph is determined based on a graph convolutional neural network. The nodes include the multiple sample main domains and the multiple sample subdomains.

[0008] For the target main domain among the multiple sample main domains, based on the target feature vector of the target main domain and the target feature vector of each sample subdomain, the target subdomain corresponding to the target main domain is determined from the multiple sample subdomains, and the target subdomain is brute-forced.

[0009] The above scheme, since the set of subdomains can characterize the business information of the corresponding main domain to a certain extent, constructs a bipartite graph between the main domain and subdomains. This bipartite graph represents the relationship between nodes. The graph convolutional neural network is used to encode the features of each node in the bipartite graph. The resulting target feature vector reflects the characteristics of the nodes in the relationship between the main and subdomains. Therefore, based on the target feature vector, the subdomains that need to be brute-forced can be determined efficiently and accurately, reducing the occurrence of omissions and false brute-force attacks, and reducing resource consumption and time costs.

[0010] In some optional implementations, the target feature vector corresponding to each node in the bipartite graph is determined based on a graph convolutional neural network, including:

[0011] Determine the adjacency matrix and degree matrix corresponding to the bipartite graph;

[0012] Based on the activation function, the adjacency matrix, and the degree matrix, the initial feature matrix of the graph convolutional neural network is trained to obtain the target feature matrix; wherein, the initial feature matrix contains the initial feature vector corresponding to each node;

[0013] For any node, the target feature vector corresponding to the node is determined based on the position of the node in the target feature matrix.

[0014] The above scheme updates the feature vector of the current node using the information of neighboring nodes through the degree matrix, and represents the influence of its own information through the adjacency matrix. Pooling operations are performed through the adjacency matrix and the degree matrix, and the graph convolutional neural network is passed layer by layer based on the activation function, the adjacency matrix, and the degree matrix to complete the training of the initial feature matrix, thereby obtaining the target feature matrix that fully learns the association between the master and slave domains. Since the initial feature matrix contains the initial feature vectors corresponding to each node, and the target feature matrix is ​​trained from the initial feature matrix, the target feature vectors that accurately represent the features of each node can be determined from the target feature matrix.

[0015] In some optional implementations, the feature matrix of the (i+1)th layer of the graph convolutional neural network is obtained based on the activation function, the adjacency matrix, the degree matrix, the adjustment matrix of the i-th layer, the feature matrix of the i-th layer, and the training parameters of the i-th layer.

[0016] Wherein, 1≤i≤M-1, M is the number of network layers in the graph convolutional neural network; the first layer feature matrix is ​​the initial feature matrix; the i-th layer adjustment matrix is ​​determined based on the i-th layer feature matrix and preset parameters.

[0017] The above scheme determines the adjustment matrix based on the feature matrix and preset parameters. Pruning is then performed using the adjustment matrix to enhance some elements and weaken others, reducing the impact of meaningless edge information on node features, thereby increasing the distinguishing features and alleviating the problem of oversmoothing in graph convolutional neural networks.

[0018] In some alternative implementations, the i-th layer adjustment matrix is ​​determined in the following manner:

[0019] For the i-th layer feature matrix, determine the i-th feature vector corresponding to each node of the bipartite graph;

[0020] For any node, determine the vector similarity between the i-th feature vector of the node and the i-th feature vector of each node in the bipartite graph;

[0021] The i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities with preset parameters.

[0022] In some optional implementations, the i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities with preset parameters, including:

[0023] For any vector similarity, if the vector similarity is greater than the preset parameter, then the adjustment value corresponding to the vector similarity is determined to be the first parameter; otherwise, the adjustment value corresponding to the vector similarity is determined to be the second parameter; wherein, the first parameter is greater than the second parameter.

[0024] The adjustment matrix of the i-th layer is constructed based on all the adjustment values.

[0025] The above scheme further enhances the pruning effect by constructing an adjustment matrix by selecting an upper limit (first parameter) and a lower limit (second parameter) for similarity.

[0026] In some optional implementations, the initial feature matrix of the graph convolutional neural network is trained to obtain the target feature matrix, including:

[0027] The graph convolutional neural network is forward-propagated through each layer to obtain the trained graph convolutional neural network.

[0028] The feature matrix of the Mth layer of the trained graph convolutional neural network is determined as the target feature matrix.

[0029] In some alternative implementations, the adjacency matrix is ​​determined in the following manner:

[0030] For any node in the bipartite graph, determine the first element corresponding to the node based on whether the node is associated with any other node in the bipartite graph;

[0031] The adjacency matrix is ​​constructed based on the first element corresponding to all nodes;

[0032] The degree matrix is ​​determined in the following manner:

[0033] For any node in the bipartite graph, the second element corresponding to the node is determined based on the number of nodes associated with the node in the bipartite graph;

[0034] The degree matrix is ​​constructed based on the second element corresponding to all nodes.

[0035] In some optional implementations, determining the target subdomain corresponding to the target main domain from the plurality of sample subdomains based on the target feature vector of the target main domain and the target feature vectors of each sample subdomain includes:

[0036] Determine the vector similarity between the target feature vector of the target main domain and the target feature vectors of each sample subdomain;

[0037] The sample subdomains corresponding to vector similarities exceeding the target similarity are determined as the target subdomains.

[0038] The above scheme, since the target feature vector of each node reflects the characteristics of the node in the association relationship between the main domain and the subdomains, has a high similarity between the target feature vectors of the main domain and its subdomains. By determining the vector similarity between the target feature vector of each sample subdomain and the target feature vector of the target main domain, the target subdomain can be accurately identified when the vector similarity exceeds the target similarity.

[0039] Secondly, embodiments of this application provide a first seed domain name brute-force device, the device comprising:

[0040] The feature encoding module is used to construct a bipartite graph based on the association relationships between multiple sample main domains and multiple sample subdomains, and to determine the target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network; wherein, the node includes the multiple sample main domains and the multiple sample subdomains.

[0041] The brute-force module is used to determine the target subdomain corresponding to the target main domain from the multiple sample subdomains based on the target feature vector of the target main domain and the target feature vector of each sample subdomain, and to brute-force the target subdomain.

[0042] In some optional implementations, the feature encoding module is specifically used for:

[0043] Determine the adjacency matrix and degree matrix corresponding to the bipartite graph;

[0044] Based on the activation function, the adjacency matrix, and the degree matrix, the initial feature matrix of the graph convolutional neural network is trained to obtain the target feature matrix; wherein, the initial feature matrix contains the initial feature vector corresponding to each node;

[0045] For any node, the target feature vector corresponding to the node is determined based on the position of the node in the target feature matrix.

[0046] In some optional implementations, the feature matrix of the (i+1)th layer of the graph convolutional neural network is obtained based on the activation function, the adjacency matrix, the degree matrix, the adjustment matrix of the i-th layer, the feature matrix of the i-th layer, and the training parameters of the i-th layer.

[0047] Wherein, 1≤i≤M-1, M is the number of network layers in the graph convolutional neural network; the first layer feature matrix is ​​the initial feature matrix; the i-th layer adjustment matrix is ​​determined based on the i-th layer feature matrix and preset parameters.

[0048] In some optional implementations, the feature encoding module is used to determine the i-th layer adjustment matrix in the following manner:

[0049] For the i-th layer feature matrix, determine the i-th feature vector corresponding to each node of the bipartite graph;

[0050] For any node, determine the vector similarity between the i-th feature vector of the node and the i-th feature vector of each node in the bipartite graph;

[0051] The i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities with preset parameters.

[0052] In some optional implementations, the feature encoding module is specifically used for:

[0053] For any vector similarity, if the vector similarity is greater than the preset parameter, then the adjustment value corresponding to the vector similarity is determined to be the first parameter; otherwise, the adjustment value corresponding to the vector similarity is determined to be the second parameter; wherein, the first parameter is greater than the second parameter.

[0054] The adjustment matrix of the i-th layer is constructed based on all the adjustment values.

[0055] In some optional implementations, the feature encoding module is specifically used for:

[0056] The graph convolutional neural network is forward-propagated through each layer to obtain the trained graph convolutional neural network.

[0057] The feature matrix of the Mth layer of the trained graph convolutional neural network is determined as the target feature matrix.

[0058] In some optional implementations, the feature encoding module is used to determine the adjacency matrix in the following manner:

[0059] For any node in the bipartite graph, determine the first element corresponding to the node based on whether the node is associated with any other node in the bipartite graph;

[0060] The adjacency matrix is ​​constructed based on the first element corresponding to all nodes;

[0061] The feature encoding module is used to determine the degree matrix in the following manner:

[0062] For any node in the bipartite graph, the second element corresponding to the node is determined based on the number of nodes associated with the node in the bipartite graph;

[0063] The degree matrix is ​​constructed based on the second element corresponding to all nodes.

[0064] In some optional implementations, the blasting module is specifically used for:

[0065] Determine the vector similarity between the target feature vector of the target main domain and the target feature vectors of each sample subdomain;

[0066] The sample subdomains corresponding to vector similarities exceeding the target similarity are determined as the target subdomains.

[0067] Thirdly, embodiments of this application provide an electronic device, including at least one processor and at least one memory, wherein the memory stores a computer program, and when the program is executed by the processor, the processor performs any of the subdomain brute-force methods described in the first aspect.

[0068] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program executable by a processor, which, when run on the processor, causes the processor to execute any of the subdomain brute-force methods described in the first aspect. Attached Figure Description

[0069] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0070] Figure 1 A flowchart illustrating the first seed domain name brute-force method provided in this application embodiment;

[0071] Figure 2 A two-part diagram provided for an embodiment of this application;

[0072] Figure 3 This is a schematic diagram of the target subdomain provided in the embodiments of this application;

[0073] Figure 4A flowchart illustrating the second seed domain name brute-force method provided in this application embodiment;

[0074] Figure 5 This is a schematic diagram of graph convolutional neural network training provided in an embodiment of this application;

[0075] Figure 6 A flowchart illustrating the third seed domain name brute-force method provided in this application embodiment;

[0076] Figure 7 This is a schematic diagram of the subdomain blasting device provided in the embodiments of this application;

[0077] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0078] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0079] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0080] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the term "connection" should be interpreted broadly. For example, it can refer to a direct connection, an indirect connection through an intermediate medium, or a connection within two devices. Those skilled in the art can understand the specific meaning of the above term in this application based on the specific circumstances.

[0081] Subdomain brute-force is a method that uses automated technology to discover and identify all possible subdomains under a target domain. It plays an irreplaceable role in network security assessment, data breach prevention, and malware tracking.

[0082] In related technologies, subdomain brute-force attacks mainly rely on large-scale dictionary attacks, which use dictionaries to determine the subdomains corresponding to the main domain, and then brute-force these subdomains.

[0083] However, the effectiveness of the above methods depends on the completeness and accuracy of the dictionary, so it is difficult to guarantee the accuracy and efficiency of subdomain brute-force in actual operation.

[0084] In view of this, embodiments of this application propose a subdomain brute-force method, apparatus, and electronic device. The method includes: constructing a bipartite graph based on the association relationships between multiple sample main domains and multiple sample subdomains; determining the target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network; wherein, the node includes the multiple sample main domains and the multiple sample subdomains; for a target main domain among the multiple sample main domains, determining the target subdomain corresponding to the target main domain from the multiple sample subdomains based on the target feature vector of the target main domain and the target feature vector of each sample subdomain, and brute-forcing the target subdomain.

[0085] The above scheme, since the set of subdomains can characterize the business information of the corresponding main domain to a certain extent, constructs a bipartite graph between the main domain and subdomains. This bipartite graph represents the relationship between nodes. The graph convolutional neural network is used to encode the features of each node in the bipartite graph. The resulting target feature vector reflects the characteristics of the nodes in the relationship between the main and subdomains. Therefore, based on the target feature vector, the subdomains that need to be brute-forced can be determined efficiently and accurately, reducing the occurrence of omissions and false brute-force attacks, and reducing resource consumption and time costs.

[0086] The technical solution of this application and how it solves the above-mentioned technical problems will be described in detail below with reference to the accompanying drawings and specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0087] Figure 1 A flowchart illustrating the first seed domain name brute-force method provided in this application embodiment is shown below. Figure 1 As shown, it includes the following steps:

[0088] Step S101: Construct a bipartite graph for the association relationships between multiple sample main domains and multiple sample subdomains, and determine the target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network.

[0089] The nodes include the plurality of sample main domains and the plurality of sample subdomains.

[0090] During implementation, a large number of company names were collected to determine their corresponding main domain names and historical subdomain names, which were then used as samples.

[0091] For example, entering a company name into the Internet Content Provider (ICP) database will yield the company's registered main domain name; entering the main domain name into the Domain Name System (DNS) will yield the main domain name's historical subdomains (subdomains with established relationships). DNS data is specific to the ISP, and there may be other subdomains under the main domain name that are not associated in the DNS.

[0092] Since a set of subdomains can, to some extent, characterize the business information of the corresponding main domain, a bipartite graph can be constructed between the main domain and subdomains. This bipartite graph represents the relationships between nodes. Both the main domain and subdomains are nodes in the bipartite graph. If there are X main domains and Y subdomain nodes, the total number of nodes in the bipartite graph is Q = X + Y.

[0093] In a bipartite graph, all vertices can be divided into two disjoint subsets, such that every edge in the graph connects vertices between these two subsets, without connecting vertices within the same subset. Furthermore, a graph convolutional neural network is used to encode the features of each node in the bipartite graph. The resulting target feature vector reflects the characteristics of the nodes in the master-slave domain association relationship.

[0094] See Figure 2 As shown, there are three main domains: A, B, and C; and four subdomains: a, b, c, and d. Main domain A is associated with subdomains a and b; main domain B is associated with subdomains b and c; and main domain C is associated with subdomains c and d. Each domain is a node in a bipartite graph. When a subdomain belongs to a main domain, there is an edge connecting the two nodes; that is, there is an edge connecting the associated nodes.

[0095] Figure 2 This is an exemplary illustration of a bipartite graph between main and subdomains; in practice, there may be more main and subdomains.

[0096] Step S102: For the target main domain among the multiple sample main domains, based on the target feature vector of the target main domain and the target feature vector of each sample subdomain, determine the target subdomain corresponding to the target main domain from the multiple sample subdomains, and brute-force the target subdomain.

[0097] See Figure 3 As shown, taking the main domain A as the target main domain as an example, in Figure 2 Based on the bipartite diagram shown, a subordinate subdomain c that is not associated with the main domain A was also identified.

[0098] The above Figure 3 This is merely an illustrative example. The target main domain can be the main domain corresponding to any brute-force target. It may or may not have unrelated subordinate subdomains. This embodiment will not provide examples of each of these.

[0099] The above scheme, since the set of subdomains can characterize the business information of the corresponding main domain to a certain extent, constructs a bipartite graph between the main domain and subdomains. This bipartite graph represents the relationship between nodes. The graph convolutional neural network is used to encode the features of each node in the bipartite graph. The resulting target feature vector reflects the characteristics of the nodes in the relationship between the main and subdomains. Therefore, based on the target feature vector, the subdomains that need to be brute-forced can be determined efficiently and accurately, reducing the occurrence of omissions and false brute-force attacks, and reducing resource consumption and time costs.

[0100] Figure 4 This is a flowchart illustrating the second seed domain brute-force method provided in this application embodiment, as shown below. Figure 4 As shown, it includes the following steps:

[0101] Step S401: Construct a bipartite graph for the relationships between multiple sample main domains and multiple sample subdomains.

[0102] The specific implementation of step S401 can be found in other embodiments, and will not be repeated here.

[0103] Step S402: Determine the adjacency matrix and degree matrix corresponding to the bipartite graph.

[0104] In implementation, for a bipartite graph, the feature vector of the current node is updated using the information of neighboring nodes through the degree matrix, and the influence of its own information is represented through the adjacency matrix; pooling operations are performed using the adjacency matrix and the degree matrix.

[0105] Based on this, the adjacency matrix and degree matrix of the bipartite graph are determined before training.

[0106] Step S403: Based on the activation function, the adjacency matrix, and the degree matrix, train the initial feature matrix of the graph convolutional neural network to obtain the target feature matrix.

[0107] The initial feature matrix contains the initial feature vectors corresponding to each node.

[0108] In implementation, the initial feature vectors corresponding to all nodes are combined to obtain the initial feature matrix. For example, if there are X main domains and Y subdomain nodes, the total number of nodes in the bipartite graph is Q = X + Y. Each of the Q nodes corresponds to an initial feature vector of length E, which is combined to obtain an initial feature matrix of length Q*E. This embodiment does not impose specific limitations on the initial feature vectors; preset values ​​can be used as elements in the initial feature vectors.

[0109] The graph convolutional neural network is implemented layer by layer based on activation functions, adjacency matrices, and degree matrices to complete the training of the initial feature matrix, thereby obtaining the target feature matrix that fully learns the association between master and slave domains.

[0110] Step S404: For any node, determine the target feature vector corresponding to the node based on the position of the node in the target feature matrix.

[0111] Since the initial feature matrix contains the initial feature vectors corresponding to each node, and the target feature matrix is ​​obtained by training the initial feature matrix, the target feature vectors that accurately represent the features of each node can be determined from the target feature matrix.

[0112] For example, the first row of the initial feature matrix contains the initial feature vector of the main domain A, and the first row of the target feature matrix contains the target feature vector of the main domain A; the fourth row of the initial feature matrix contains the initial feature vector of the subdomain a, and the fourth row of the target feature matrix contains the target feature vector of the subdomain a...

[0113] Step S405: For the target main domain among the multiple sample main domains, based on the target feature vector of the target main domain and the target feature vector of each sample subdomain, determine the target subdomain corresponding to the target main domain from the multiple sample subdomains, and brute-force the target subdomain.

[0114] The specific implementation of step S405 can be found in other embodiments, and will not be repeated here.

[0115] The above scheme updates the feature vector of the current node using the information of neighboring nodes through the degree matrix, and represents the influence of its own information through the adjacency matrix. Pooling operations are performed through the adjacency matrix and the degree matrix, and the graph convolutional neural network is passed layer by layer based on the activation function, the adjacency matrix, and the degree matrix to complete the training of the initial feature matrix, thereby obtaining the target feature matrix that fully learns the association between the master and slave domains. Since the initial feature matrix contains the initial feature vectors corresponding to each node, and the target feature matrix is ​​trained from the initial feature matrix, the target feature vectors that accurately represent the features of each node can be determined from the target feature matrix.

[0116] In some optional implementations, determining the adjacency matrix in step S402 above can be achieved in, but is not limited to, the following ways:

[0117] For any node in the bipartite graph, determine the first element corresponding to the node based on whether the node is associated with any other node in the bipartite graph;

[0118] The adjacency matrix is ​​constructed based on the first element corresponding to all nodes.

[0119] In practice, since the initial feature matrix contains the initial feature vectors corresponding to each node, that is, the initial feature matrix is ​​obtained by combining the initial feature vectors corresponding to all nodes. For example, if there are X main domains and Y subdomain nodes, the total number of nodes in the bipartite graph is Q = X + Y; Q nodes each have an initial feature vector of length E, which are combined to obtain the initial feature matrix Q*E.

[0120] If an adjacency matrix is ​​directly built based on the association between each main domain and each subdomain, the adjacency matrix will be X*Y and will not be able to directly participate in subsequent calculations.

[0121] Based on this, this embodiment determines the association between each node and all other nodes; for a main domain, it has no association with itself or any other main domain; for a subdomain, it has no association with itself or any other subdomain.

[0122] For example, the first element between node i and node j is denoted as a. ij If there is a connection, then a ij If the value is 1, then a is unrelated. ij The value is 0. Based on the first element, a Q*Q adjacency matrix A is constructed, as shown in Table 1:

[0123] Table 1

[0124] <![CDATA[a1]]> <![CDATA[a2]]> …… <![CDATA[a Q ]]> <![CDATA[a1]]> 0 <![CDATA[a2]]> 0 …… 0 <![CDATA[a Q ]]> 0

[0125] The value of the first element in a missing position in the table needs to be determined based on the association relationship.

[0126] In practice, the static adjacency matrix can be determined in the above way, or the adjacency matrix can be dynamically adjusted, such as constructing an initial adjacency matrix (the first-level adjacency matrix) based on the first element corresponding to all nodes.

[0127] The adjacency matrix of layer i is obtained by multiplying the adjacency matrix of layer i+1 with the first matrix. The first matrix can be set according to the actual application.

[0128] In some optional implementations, the degree of determination matrix in step S402 above can be implemented in, but is not limited to, the following ways:

[0129] For any node in the bipartite graph, the second element corresponding to the node is determined based on the number of nodes associated with the node in the bipartite graph;

[0130] The degree matrix is ​​constructed based on the second element corresponding to all nodes.

[0131] In practice, since the initial feature matrix contains the initial feature vectors corresponding to each node, that is, the initial feature matrix is ​​obtained by combining the initial feature vectors corresponding to all nodes. For example, if there are X main domains and Y subdomain nodes, the total number of nodes in the bipartite graph is Q = X + Y; Q nodes each have an initial feature vector of length E, which are combined to obtain the initial feature matrix Q*E.

[0132] Since there are Q nodes in a bipartite graph, we can directly generate a Q*Q degree matrix by treating each node as a row and a column.

[0133] Unlike adjacency matrices, degree matrices are not based on whether nodes are associated with each other, but rather on the number of associated nodes for each node, i.e., the number of out-degrees / in-degrees. They only have practical meaning when all rows and columns belong to the same node. Therefore, a degree matrix is ​​a diagonal matrix.

[0134] For example, the second element between row node i and column node j is denoted as b. ij i and j are the same as b ij This corresponds to the number of associated nodes of node i itself. Based on the second element, a Q*Q degree matrix D is constructed, as shown in Table 2.

[0135] Table 2

[0136] <![CDATA[b1]]> <![CDATA[b2]]> …… <![CDATA[b Q ]]> <![CDATA[b1]]> 2 - - - <![CDATA[b2]]> - 3 - - …… - - …… - <![CDATA[b Q ]]> - - - 2

[0137] There is no corresponding second element at the position marked with "-" in the table.

[0138] In practice, the static degree matrix can be determined in the above way, or the degree matrix can be dynamically adjusted, such as constructing an initial degree matrix (the first-level degree matrix) based on the second element corresponding to all nodes.

[0139] The i+1th level degree matrix is ​​obtained by multiplying the i-th level degree matrix with the second matrix. The second matrix can be set according to the actual application.

[0140] In some optional implementations, the feature matrix of the (i+1)th layer of the graph convolutional neural network is obtained based on the activation function, the adjacency matrix, the degree matrix, the adjustment matrix of the i-th layer, the feature matrix of the i-th layer, and the training parameters of the i-th layer.

[0141] Wherein, 1≤i≤M-1, M is the number of network layers in the graph convolutional neural network; the first layer feature matrix is ​​the initial feature matrix; the i-th layer adjustment matrix is ​​determined based on the i-th layer feature matrix and preset parameters.

[0142] In this embodiment, the feature matrix of the first layer of the graph convolutional neural network is the initial feature matrix H. (1) ;

[0143] The second-layer feature matrix is ​​the initial feature matrix based on the activation function σ, adjacency matrix A, degree matrix D, and the first-layer adjustment matrix θ. (1) Initial characteristic matrix H (1) and the training parameters W of the first layer (1) Obtained;

[0144] The third-layer feature matrix is ​​the initial feature matrix based on the activation function σ, adjacency matrix A, degree matrix D, and the second-layer adjustment matrix θ. (2) The second layer feature matrix H (2) and the training parameters W of the second layer (2) Obtained;

[0145] The feature matrices of other layers are also determined in the same way as described above, and will not be repeated here.

[0146] For example, the training formula for the (i+1)th layer is:

[0147] H (i+1) =σ{[D -1 / 2 (θ (i) *A)D -1 / 2 H (i) W (i)}; where H (i+1) Let σ be the feature matrix of the (i+1)th layer, σ be the activation function, A be the adjacency matrix, D be the degree matrix, and θ be the feature matrix of the (i+1)th layer. (i) For the adjustment matrix of the i-th layer, H (i) Let W be the feature matrix of the i-th layer. (i) These are the training parameters for the i-th layer;

[0148] D -1 / 2 AD -1 / 2 This is a pooling operation. A represents the influence of its own information, and D uses information from neighboring nodes to update the current node's feature vector. Taking the square root of D maintains data standardization; taking the reciprocal of D indicates that nodes with higher usage frequency have less influence on other nodes. θ (i) Multiplying directly with A represents direct pruning of A; multiplying with D represents direct pruning of A. -1 / 2 AD -1 / 2 Multiplication represents the pruning of the pooled matrix.

[0149] The above training formula is merely an illustrative example. In practice, θ can be adjusted according to the actual length of each matrix. (i) The embodiment does not specifically limit the placement of the object.

[0150] The above scheme determines the adjustment matrix based on the feature matrix and preset parameters. Pruning is then performed using the adjustment matrix to enhance some elements and weaken others, reducing the impact of meaningless edge information on node features, thereby increasing the distinguishing features and alleviating the problem of oversmoothing in graph convolutional neural networks.

[0151] In some alternative implementations, the i-th layer adjustment matrix is ​​determined in the following manner:

[0152] For the i-th layer feature matrix, determine the i-th feature vector corresponding to each node of the bipartite graph;

[0153] For any node, determine the vector similarity between the i-th feature vector of the node and the i-th feature vector of each node in the bipartite graph;

[0154] The i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities with preset parameters.

[0155] Since the initial feature matrix contains the initial feature vectors corresponding to each node, the i-th layer feature matrix contains the i-th feature vectors corresponding to each node.

[0156] For example, for the i-th layer Q*E feature matrix, there are Q nodes containing the i-th feature vector of length E;

[0157] Determine the vector similarity between each node and all other nodes. For the main domain, there is no vector similarity with itself or other main domains; for subdomains, there is no vector similarity with itself or other subdomains.

[0158] Furthermore, the vector similarity is compared with the preset parameters, and the adjustment matrix of the i-th layer is obtained based on all the comparison results.

[0159] In some optional implementations, the i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities with preset parameters, including:

[0160] For any vector similarity, if the vector similarity is greater than the preset parameter, then the adjustment value corresponding to the vector similarity is determined to be the first parameter; otherwise, the adjustment value corresponding to the vector similarity is determined to be the second parameter; wherein, the first parameter is greater than the second parameter.

[0161] The adjustment matrix of the i-th layer is constructed based on all the adjustment values.

[0162] For example, the vector similarity between node i and node j in the i-th layer is denoted as c. (i) ij Compare it with the preset parameter δ; if c (i) ij >δ, corresponding adjustment value θ (i) ij The first parameter is c; if c (i) ij ≤δ, corresponding adjustment value θ (i) ijThis is the second parameter.

[0163] In practice, the first parameter can be set to 1 (the upper limit of similarity), and the second parameter can be set to 0 (the upper limit of similarity).

[0164] Based on all the adjustment values, the Q*Q adjustment matrix θ is constructed. (i) For details, please refer to Table 3:

[0165] Table 3

[0166]

[0167]

[0168] There is no corresponding adjustment value for the "-" position in the table; the values ​​above are merely illustrative examples.

[0169] The above scheme further enhances the pruning effect by constructing an adjustment matrix by selecting an upper limit (first parameter) and a lower limit (second parameter) for similarity.

[0170] In some optional implementations, step S403 above can be implemented in, but is not limited to, the following ways:

[0171] The graph convolutional neural network is forward-propagated through each layer to obtain the trained graph convolutional neural network.

[0172] The feature matrix of the Mth layer of the trained graph convolutional neural network is determined as the target feature matrix.

[0173] See Figure 5 As shown, during the training phase of the graph convolutional neural network, forward propagation is performed based on the training formulas of each layer; the loss function is calculated, and backpropagation is used to update the feature vectors of the nodes.

[0174] For example, taking any primary domain, an associated subdomain, and an unassociated subdomain in a bipartite graph as a combination yields N possible combinations; the loss function is calculated using the following formula:

[0175]

[0176] Where N is the number of combinations corresponding to the bipartite graph, u i Indicates the main domain name corresponding to combination i, v i,pos Indicates with u i Associated subdomain, v i,neg Indicates with u i For unassociated subdomains, f is a default function.

[0177] In practice, the above f can be a similarity calculation function.

[0178] Figure 6 This is a flowchart illustrating the third seed domain brute-force method provided in this application embodiment, as shown below. Figure 6 As shown, it includes the following steps:

[0179] Step S601: Construct a bipartite graph for the association relationships between multiple sample main domains and multiple sample subdomains, and determine the target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network.

[0180] The nodes include the plurality of sample main domains and the plurality of sample subdomains.

[0181] The specific implementation of step S601 can be found in other embodiments, and will not be repeated here.

[0182] Step S602: For the target main domain among the multiple sample main domains, determine the vector similarity between the target feature vector of the target main domain and the target feature vector of each sample subdomain.

[0183] Since the target feature vectors of each node reflect the characteristics of the node in the association relationship between the main domain and its subdomains, the target feature vectors of the main domain and its subdomains have a high degree of similarity.

[0184] Based on this, this embodiment determines the vector similarity between the target feature vector of each sample subdomain and the target feature vector of the target main domain.

[0185] For example, the feature vectors and target feature vectors of each sample subdomain are determined; the vector similarity between the target main domain u and the sample subdomain v is calculated. Where, q u Let q be the target feature vector of the target domain name u. v Let v be the target feature vector of the sample subdomain.

[0186] Step S603: The sample subdomains corresponding to vector similarities exceeding the target similarity are determined as the target subdomains.

[0187] Using the aforementioned vector similarity w uv For example, if the similarity exceeds the target, the sample subdomain v will be identified as the target subdomain.

[0188] The above scheme, since the target feature vector of each node reflects the characteristics of the node in the association relationship between the main domain and the subdomains, has a high similarity between the target feature vectors of the main domain and its subdomains. By determining the vector similarity between the target feature vector of each sample subdomain and the target feature vector of the target main domain, the target subdomain can be accurately identified when the vector similarity exceeds the target similarity.

[0189] The subdomain brute-force method described above can be applied to attack surface management. Specifically, by systematically generating and testing a large number of potential subdomains, it helps security experts gain a comprehensive understanding of an organization's internet assets. Many organizations may host various services, including websites, APIs (interfaces for API calls), mail servers, etc., under different subdomains. These subdomains often become potential security vulnerabilities due to their low profile or being overlooked. The subdomain brute-force method described above identifies those unrecorded or ignored subdomains, thereby creating a complete attack surface map and ensuring that each subdomain receives appropriate security protection, avoiding security incidents caused by oversight. This not only improves the overall security level but also prevents attackers from discovering sensitive information or vulnerabilities within the organization through subdomains, thus preventing further attacks.

[0190] The subdomain brute-force method described above can also be applied to penetration testing and vulnerability discovery. Specifically, through subdomain brute-force, penetration testers can discover hidden subdomains within the target system. These subdomains may be running different applications or services, thus providing attackers with more potential entry points. For example, a forgotten development or testing environment may lack robust security measures, becoming an easy entry point for attackers. After discovering these subdomains, penetration testers can conduct further security testing to look for potential vulnerabilities, such as outdated services, default passwords, or publicly available sensitive information. Through these methods, security vulnerabilities can be identified and patched in advance, preventing attackers from using these subdomains for unauthorized intrusion and data theft, ultimately improving the overall security of the system.

[0191] like Figure 7 As shown in the figure, this application embodiment provides a subdomain brute-force device 700, which includes:

[0192] The feature encoding module 701 is used to construct a bipartite graph based on the association relationship between multiple sample main domains and multiple sample subdomains, and to determine the target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network; wherein, the node includes the multiple sample main domains and the multiple sample subdomains.

[0193] The brute-force module 702 is used to determine the target subdomain corresponding to the target main domain from the multiple sample subdomains based on the target feature vector of the target main domain and the target feature vector of each sample subdomain, and to brute-force the target subdomain.

[0194] In some optional implementations, the feature encoding module 701 is specifically used for:

[0195] Determine the adjacency matrix and degree matrix corresponding to the bipartite graph;

[0196] Based on the activation function, the adjacency matrix, and the degree matrix, the initial feature matrix of the graph convolutional neural network is trained to obtain the target feature matrix; wherein, the initial feature matrix contains the initial feature vector corresponding to each node;

[0197] For any node, the target feature vector corresponding to the node is determined based on the position of the node in the target feature matrix.

[0198] In some optional implementations, the feature matrix of the (i+1)th layer of the graph convolutional neural network is obtained based on the activation function, the adjacency matrix, the degree matrix, the adjustment matrix of the i-th layer, the feature matrix of the i-th layer, and the training parameters of the i-th layer.

[0199] Wherein, 1≤i≤M-1, M is the number of network layers in the graph convolutional neural network; the first layer feature matrix is ​​the initial feature matrix; the i-th layer adjustment matrix is ​​determined based on the i-th layer feature matrix and preset parameters.

[0200] In some optional implementations, the feature encoding module 701 is used to determine the i-th layer adjustment matrix in the following manner:

[0201] For the i-th layer feature matrix, determine the i-th feature vector corresponding to each node of the bipartite graph;

[0202] For any node, determine the vector similarity between the i-th feature vector of the node and the i-th feature vector of each node in the bipartite graph;

[0203] The i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities with preset parameters.

[0204] In some optional implementations, the feature encoding module 701 is specifically used for:

[0205] For any vector similarity, if the vector similarity is greater than the preset parameter, then the adjustment value corresponding to the vector similarity is determined to be the first parameter; otherwise, the adjustment value corresponding to the vector similarity is determined to be the second parameter; wherein, the first parameter is greater than the second parameter.

[0206] The adjustment matrix of the i-th layer is constructed based on all the adjustment values.

[0207] In some optional implementations, the feature encoding module 701 is specifically used for:

[0208] The graph convolutional neural network is forward-propagated through each layer to obtain the trained graph convolutional neural network.

[0209] The feature matrix of the Mth layer of the trained graph convolutional neural network is determined as the target feature matrix.

[0210] In some optional implementations, the feature encoding module 701 is used to determine the adjacency matrix in the following manner:

[0211] For any node in the bipartite graph, determine the first element corresponding to the node based on whether the node is associated with any other node in the bipartite graph;

[0212] The adjacency matrix is ​​constructed based on the first element corresponding to all nodes;

[0213] The feature encoding module 701 is used to determine the degree matrix in the following manner:

[0214] For any node in the bipartite graph, the second element corresponding to the node is determined based on the number of nodes associated with the node in the bipartite graph;

[0215] The degree matrix is ​​constructed based on the second element corresponding to all nodes.

[0216] In some optional implementations, the blasting module 702 is specifically used for:

[0217] Determine the vector similarity between the target feature vector of the target main domain and the target feature vectors of each sample subdomain;

[0218] The sample subdomains corresponding to vector similarities exceeding the target similarity are determined as the target subdomains.

[0219] Since this device is the same as the device in the method of this application embodiment, and the principle of the device in solving the problem is similar to that of the method, the implementation of the device can be referred to the implementation of the method, and the repeated parts will not be described again.

[0220] Based on the same technical concept, this application also provides an electronic device 800, such as... Figure 8 As shown, it includes at least one processor 801 and a memory 802 connected to at least one processor. In this embodiment, the specific connection medium between the processor 801 and the memory 802 is not limited. Figure 8 Taking the connection between the processor 801 and the memory 802 via bus 803 as an example, the bus can be divided into address bus, data bus, control bus, etc. For ease of illustration, Figure 8 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0221] The processor 801 is the control center of the electronic device. It can connect to various parts of the electronic device through various interfaces and lines, and performs data processing by running or executing instructions stored in the memory 802 and calling data stored in the memory 802. Optionally, the processor 801 may include one or more processing units. The processor 801 may integrate an application processor and a modem processor. The application processor mainly handles the operating system, user interface, and application programs, while the modem processor mainly handles issuing instructions. It is understood that the modem processor may not be integrated into the processor 801. In some embodiments, the processor 801 and the memory 802 may be implemented on the same chip; in some embodiments, they may also be implemented on separate chips.

[0222] Processor 801 can be a general-purpose processor, such as a CPU, digital signal processor, application-specific integrated circuit (ASIC), field-programmable gate array or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, capable of implementing or executing the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the subdomain brute-force method can be directly manifested as being executed by a hardware processor, or being executed by a combination of hardware and software modules within the processor.

[0223] Memory 802, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer-executable programs, and modules. Memory 802 may include at least one type of storage medium, such as flash memory, hard disk, multimedia card, card-type memory, random access memory (RAM), static random access memory (SRAM), programmable read-only memory (PROM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), magnetic storage, magnetic disk, optical disk, etc. Memory 802 can be any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but is not limited thereto. In the embodiments of this application, memory 802 can also be a circuit or any other device capable of implementing storage functions for storing program instructions and / or data.

[0224] In this embodiment, the memory 802 stores a computer program, which, when executed by the processor 801, causes the processor 801 to perform the following:

[0225] A bipartite graph is constructed to identify the relationships between multiple sample main domains and multiple sample subdomains. The target feature vector corresponding to each node in the bipartite graph is determined based on a graph convolutional neural network. The nodes include the multiple sample main domains and the multiple sample subdomains.

[0226] For the target main domain among the multiple sample main domains, based on the target feature vector of the target main domain and the target feature vector of each sample subdomain, the target subdomain corresponding to the target main domain is determined from the multiple sample subdomains, and the target subdomain is brute-forced.

[0227] In some alternative implementations, processor 801 specifically performs:

[0228] Determine the adjacency matrix and degree matrix corresponding to the bipartite graph;

[0229] Based on the activation function, the adjacency matrix, and the degree matrix, the initial feature matrix of the graph convolutional neural network is trained to obtain the target feature matrix; wherein, the initial feature matrix contains the initial feature vector corresponding to each node;

[0230] For any node, the target feature vector corresponding to the node is determined based on the position of the node in the target feature matrix.

[0231] In some optional implementations, the feature matrix of the (i+1)th layer of the graph convolutional neural network is obtained based on the activation function, the adjacency matrix, the degree matrix, the adjustment matrix of the i-th layer, the feature matrix of the i-th layer, and the training parameters of the i-th layer.

[0232] Wherein, 1≤i≤M-1, M is the number of network layers in the graph convolutional neural network; the first layer feature matrix is ​​the initial feature matrix; the i-th layer adjustment matrix is ​​determined based on the i-th layer feature matrix and preset parameters.

[0233] In some alternative implementations, the i-th layer adjustment matrix is ​​determined in the following manner:

[0234] For the i-th layer feature matrix, determine the i-th feature vector corresponding to each node of the bipartite graph;

[0235] For any node, determine the vector similarity between the i-th feature vector of the node and the i-th feature vector of each node in the bipartite graph;

[0236] The i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities with preset parameters.

[0237] In some alternative implementations, processor 801 specifically performs:

[0238] For any vector similarity, if the vector similarity is greater than the preset parameter, then the adjustment value corresponding to the vector similarity is determined to be the first parameter; otherwise, the adjustment value corresponding to the vector similarity is determined to be the second parameter; wherein, the first parameter is greater than the second parameter.

[0239] The adjustment matrix of the i-th layer is constructed based on all the adjustment values.

[0240] In some alternative implementations, processor 801 specifically performs:

[0241] The graph convolutional neural network is forward-propagated through each layer to obtain the trained graph convolutional neural network.

[0242] The feature matrix of the Mth layer of the trained graph convolutional neural network is determined as the target feature matrix.

[0243] In some alternative implementations, processor 801 specifically performs:

[0244] For any node in the bipartite graph, determine the first element corresponding to the node based on whether the node is associated with any other node in the bipartite graph;

[0245] The adjacency matrix is ​​constructed based on the first element corresponding to all nodes;

[0246] Processor 801 executes the following:

[0247] For any node in the bipartite graph, the second element corresponding to the node is determined based on the number of nodes associated with the node in the bipartite graph;

[0248] The degree matrix is ​​constructed based on the second element corresponding to all nodes.

[0249] In some alternative implementations, processor 801 specifically performs:

[0250] Determine the vector similarity between the target feature vector of the target main domain and the target feature vectors of each sample subdomain;

[0251] The sample subdomains corresponding to vector similarities exceeding the target similarity are determined as the target subdomains.

[0252] Since the electronic device is the same as the electronic device in the method of this application embodiment, and the principle of the electronic device in solving the problem is similar to that of the method, the implementation of the electronic device can refer to the implementation of the method, and the repeated parts will not be described again.

[0253] Based on the same technical concept, embodiments of this application also provide a computer-readable storage medium storing a computer program executable by a processor, which, when run on the processor, causes the processor to perform the steps of the above-described subdomain brute-force method.

[0254] In some alternative implementations, various aspects of the subdomain brute-force method provided in this application can also be implemented as a program product containing computer-executable instructions. When the program product is run on a computer device, the computer-executable instructions are used to cause the computer device to perform the steps of the subdomain brute-force method according to the various exemplary embodiments of this application described above.

[0255] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0256] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0257] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0258] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0259] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0260] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A subdomain brute-force method, characterized in that, The method includes: A bipartite graph is constructed to identify the relationships between multiple sample main domains and multiple sample subdomains. The target feature vector corresponding to each node in the bipartite graph is determined based on a graph convolutional neural network. The nodes include the multiple sample main domains and the multiple sample subdomains. For the target main domain among the multiple sample main domains, based on the target feature vector of the target main domain and the target feature vector of each sample subdomain, the target subdomain corresponding to the target main domain is determined from the multiple sample subdomains, and the target subdomain is brute-forced. The target feature vector corresponding to each node in the bipartite graph is determined based on a graph convolutional neural network, including: Determine the adjacency matrix and degree matrix corresponding to the bipartite graph; Based on the activation function, the adjacency matrix, and the degree matrix, the initial feature matrix of the graph convolutional neural network is trained to obtain the target feature matrix; wherein, the initial feature matrix contains the initial feature vector corresponding to each node; For any node, the target feature vector corresponding to the node is determined based on the position of the node in the target feature matrix; Based on the target feature vector of the target main domain and the target feature vectors of each sample subdomain, the target subdomain corresponding to the target main domain is determined from the plurality of sample subdomains, including: Determine the vector similarity between the target feature vector of the target main domain and the target feature vectors of each sample subdomain; The sample subdomains corresponding to vector similarities exceeding the target similarity are determined as the target subdomains.

2. The method as described in claim 1, characterized in that, The feature matrix of the (i+1)th layer of the graph convolutional neural network is obtained based on the activation function, the adjacency matrix, the degree matrix, the adjustment matrix of the i-th layer, the feature matrix of the i-th layer, and the training parameters of the i-th layer. Wherein, 1≤i≤M-1, M is the number of network layers in the graph convolutional neural network; the first layer feature matrix is ​​the initial feature matrix; the i-th layer adjustment matrix is ​​determined based on the i-th layer feature matrix and preset parameters.

3. The method as described in claim 2, characterized in that, The i-th layer adjustment matrix is ​​determined in the following manner: For the i-th layer feature matrix, determine the i-th feature vector corresponding to each node of the bipartite graph; For any node, determine the vector similarity between the i-th feature vector of the node and the i-th feature vector of each node in the bipartite graph; The i-th layer adjustment matrix is ​​obtained based on the comparison results of all vector similarities with preset parameters.

4. The method as described in claim 3, characterized in that, The adjustment matrix of the i-th layer is obtained based on the comparison results of all vector similarities with preset parameters, including: For any vector similarity, if the vector similarity is greater than the preset parameter, then the adjustment value corresponding to the vector similarity is determined to be the first parameter; otherwise, the adjustment value corresponding to the vector similarity is determined to be the second parameter; wherein, the first parameter is greater than the second parameter; The adjustment matrix of the i-th layer is constructed based on all the adjustment values.

5. The method as described in claim 2, characterized in that, The initial feature matrix of the graph convolutional neural network is trained to obtain the target feature matrix, including: The graph convolutional neural network is forward-propagated through each layer to obtain the trained graph convolutional neural network. The feature matrix of the Mth layer of the trained graph convolutional neural network is determined as the target feature matrix.

6. The method as described in claim 1, characterized in that, The adjacency matrix is ​​determined in the following way: For any node in the bipartite graph, determine the first element corresponding to the node based on whether the node is associated with any other node in the bipartite graph; The adjacency matrix is ​​constructed based on the first element corresponding to all nodes; The degree matrix is ​​determined in the following manner: For any node in the bipartite graph, the second element corresponding to the node is determined based on the number of nodes associated with the node in the bipartite graph; The degree matrix is ​​constructed based on the second element corresponding to all nodes.

7. A subdomain brute-force device, characterized in that, The device includes: The feature encoding module is used to construct a bipartite graph based on the association relationships between multiple sample main domains and multiple sample subdomains, and to determine the target feature vector corresponding to each node in the bipartite graph based on a graph convolutional neural network; wherein, the node includes the multiple sample main domains and the multiple sample subdomains. The brute-force module is used to determine the target subdomain corresponding to the target main domain from the multiple sample subdomains based on the target feature vector of the target main domain and the target feature vector of each sample subdomain, and to brute-force the target subdomain. The feature encoding module is specifically used for: Determine the adjacency matrix and degree matrix corresponding to the bipartite graph; Based on the activation function, the adjacency matrix, and the degree matrix, the initial feature matrix of the graph convolutional neural network is trained to obtain the target feature matrix; wherein, the initial feature matrix contains the initial feature vector corresponding to each node; For any node, the target feature vector corresponding to the node is determined based on the position of the node in the target feature matrix; The explosive module is specifically used for: Determine the vector similarity between the target feature vector of the target main domain and the target feature vectors of each sample subdomain; The sample subdomains corresponding to vector similarities exceeding the target similarity are determined as the target subdomains.

8. An electronic device, characterized in that, It includes at least one processor and at least one memory, wherein the memory stores a computer program that, when executed by the processor, causes the processor to perform the method as described in any one of claims 1 to 6.

Images