Sub-domain name determination method and device, equipment and medium

Abstract

The invention relates to the technical field of network security, in particular to a sub-domain name determination method and device, equipment and a medium. In the embodiment of the invention, the business description text is generated based on the large model in combination with the enterprise identifier, the target main domain name and the website information, and the business description text is encoded into the target feature vector, so that the business information behind the target main domain name can be accurately captured; and more accurate data support can be provided for subsequent sub-domain name generation and blasting. Moreover, the embodiment of the invention also discloses a method for constructing the target sub-domain name corresponding to the target main domain name according to the sub-domain name prefixes corresponding to other main domain names similar to the target main domain name, so that the sub-domain name determination efficiency is improved, and the computing resources and time are reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a subdomain determination method, device, equipment and medium. Background Art

[0002] Subdomain blasting is a key task in the field of network security. The main goal is to discover and identify the subdomains of a website, which is of great significance for attack surface analysis, vulnerability scanning, and information collection. With the increasing complexity of the network environment and the continuous increase in security threats, subdomain blasting has become particularly important. Subdomains often carry different applications and services. Discovering these subdomains can help security experts identify potential security vulnerabilities and risk points.

[0003] Existing subdomain determination methods usually rely on a huge static dictionary that stores multiple subdomain prefixes. The electronic device constructs each subdomain based on each subdomain prefix. This method not only requires a lot of computing resources and time, but also has low processing efficiency. Summary of the invention

[0004] The present application provides a subdomain determination method, apparatus, device and medium to solve the problem that the existing subdomain determination process requires a large amount of computing resources and time, and has low processing efficiency.

[0005] In a first aspect, an embodiment of the present application provides a method for determining a subdomain name, the method comprising:

[0006] Inputting the target primary domain name to be processed, the enterprise logo corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the big model, obtaining the business description text corresponding to the target primary domain name output by the big model, and using a preset text embedding method to determine the target vector corresponding to the business description text;

[0007] Determine other primary domain names that meet the first similarity requirement with the target primary domain name according to the pre-saved vector corresponding to each candidate primary domain name and the target vector;

[0008] A target subdomain name corresponding to the target primary domain name is generated according to the saved subdomain name prefix corresponding to the other primary domain name.

[0009] In a second aspect, an embodiment of the present application further provides a subdomain name determination device, the device comprising:

[0010] A processing module, used to input the target primary domain name to be processed, the enterprise logo corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the large model, obtain the business description text corresponding to the target primary domain name output by the large model, and use a preset text embedding method to determine the target vector corresponding to the business description text; determine other primary domain names that meet the first similarity requirement with the target primary domain name according to the vector corresponding to each candidate primary domain name saved in advance and the target vector;

[0011] A construction module is used to generate a target subdomain name corresponding to the target primary domain name according to the saved subdomain name prefix corresponding to the other primary domain names.

[0012] In a third aspect, an embodiment of the present application further provides an electronic device, which includes at least a processor and a memory, and the processor is used to implement the steps of any of the above-mentioned subdomain name determination methods when executing a computer program stored in the memory.

[0013] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of any of the above-mentioned subdomain name determination methods.

[0014] In an embodiment of the present application, the electronic device inputs the target primary domain name to be processed, the enterprise logo corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the large model, obtains the business description text corresponding to the target primary domain name output by the large model, and uses a preset text embedding method to determine the target vector corresponding to the business description text; according to the vector corresponding to each candidate primary domain name and the target vector saved in advance, determine other primary domain names that meet the first similarity requirements with the target primary domain name; according to the subdomain prefixes corresponding to the other saved primary domain names, generate the target subdomain name corresponding to the target primary domain name. In an embodiment of the present application, based on the large model, combined with the enterprise logo, the target primary domain name and the website information, a business description text is generated, and the business description text is encoded into a target feature vector, so that not only the business information behind the target primary domain name can be accurately captured, but also more accurate data support can be provided for subsequent subdomain name generation and blasting. In addition, the embodiment of the present application also discloses that the target subdomain name corresponding to the target primary domain name is constructed according to the subdomain name prefixes corresponding to other primary domain names similar to the target primary domain name, which improves the efficiency of subdomain name determination and reduces computing resources and time. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0016] Figure 1 A schematic diagram of a subdomain name determination process provided in an embodiment of the present application;

[0017] Figure 2 A schematic diagram of the structure of the Bert model provided in the embodiment of the present application;

[0018] Figure 3 A flowchart of subdomain blasting provided in an embodiment of the present application;

[0019] Figure 4 A flowchart of subdomain blasting for an online process provided in an embodiment of the present application;

[0020] Figure 5 A schematic diagram of the structure of a subdomain name determination device provided in an embodiment of the present application;

[0021] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be arbitrarily combined with each other. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0023] The terms "first" and "second" in the specification and claims of the present application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the term "comprising" and any of their variations are intended to cover non-exclusive protection. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. "Multiple" in the present application can mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.

[0024] The following is a description of exemplary embodiments of the present application in conjunction with the accompanying drawings, including various details of the embodiments of the present application to facilitate understanding, which should be considered as merely exemplary. Therefore, those of ordinary skill in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope of the present application. Similarly, for the sake of clarity and conciseness, the description of well-known functions and structures is omitted in the following description. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, which should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0025] Subdomain blasting is of great significance in the field of network security, as it helps to identify and defend against potential network attacks. Current subdomain blasting methods usually require comprehensive blasting of large dictionaries, which consumes a lot of computing resources and time costs, and is inefficient.

[0026] Based on this, the embodiment of the present application provides a subdomain determination method, device, equipment and medium. In the embodiment of the present application, the electronic device inputs the target primary domain name to be processed, the enterprise logo corresponding to the target primary domain name and the website information corresponding to the target primary domain name into the large model, obtains the business description text corresponding to the target primary domain name output by the large model, and uses a preset text embedding method to determine the target vector corresponding to the business description text; according to the vector corresponding to each candidate primary domain name and the target vector saved in advance, determine other primary domain names that meet the first similarity requirements with the target primary domain name; according to the subdomain prefixes corresponding to the other saved primary domain names, generate the target subdomain name corresponding to the target primary domain name.

[0027] Embodiment 1:

[0028] Figure 1 A schematic diagram of a subdomain name determination process provided in an embodiment of the present application, the process includes:

[0029] S101: Input the target primary domain name to be processed, the enterprise logo corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the big model, obtain the business description text corresponding to the target primary domain name output by the big model, and use a preset text embedding method to determine the target vector corresponding to the business description text.

[0030] A subdomain name determination method provided in an embodiment of the present application is applied to an electronic device, which may be a server, a PC, etc.

[0031] Since subdomain blasting is of great significance in the field of network security, it helps to identify and defend against potential network attacks. Current subdomain blasting methods usually require comprehensive blasting of large dictionaries, which will consume a lot of computing resources and time costs and is inefficient. To address this problem, the present application embodiment proposes an innovative subdomain blasting method (DomainCF) that combines a large model and collaborative filtering.

[0032] Specifically, the embodiment of the present application designs a domain name business coding model (DNBC-LM) based on a big model, and inputs the target primary domain name, the enterprise logo corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the big model. The big model generates a detailed business description text, and uses a text embedding method to encode these business description texts into target vectors.

[0033] Generally, in the embodiment of the present application, the enterprise identifier is the enterprise name. The website information corresponding to the target primary domain name can be obtained through crawler technology or can be pre-stored.

[0034] Specifically, the electronic device is pre-configured with an ICP database, which stores each primary domain name and the corporate identity corresponding to each primary domain name. The electronic device can determine the corporate identity corresponding to the target primary domain name to be processed based on the ICP database. And through crawler technology, determine the website information corresponding to the target primary domain name. The electronic device inputs the target primary domain name, corporate identity and website information into a large language model (LLM), and determines and outputs the business description text corresponding to the target primary domain name through the large model.

[0035] In the application embodiment, after the electronic device determines the service description text corresponding to the target primary domain name, the electronic device can use text embedding technology to convert the service description text into a target vector.

[0036] Specifically, the electronic device uses a preset text embedding method to determine the target vector corresponding to the service description text. The preset text embedding method may be to process the text using a preset embedding model, such as a Bert model.

[0037] For example, the electronic device inputs the service description text into the Bert model, and average-pools the vector output by the last layer of the Bert model to obtain a vector of 1*768 dimensions. The Bert model converts service information in text form into vector form, which is convenient for subsequent rapid retrieval.

[0038] Figure 2 The Bert model provided in the embodiment of the present application is shown in the figure. Figure 2 As shown in the figure, the BERT model includes an encoding layer, an attention layer, and an average pooling layer, wherein the attention layer consists of multiple multi-head self-attention modules and a feedforward neural network.

[0039] S102: Determine other primary domain names that meet the first similarity requirement with the target primary domain name based on the pre-saved vectors corresponding to each candidate primary domain name and the target vector; and generate a target subdomain name corresponding to the target primary domain name based on the saved subdomain name prefixes corresponding to the other primary domain names.

[0040] In the embodiment of the present application, the electronic device pre-stores the feature vector corresponding to each candidate primary domain name and the subdomain prefix corresponding to each candidate primary domain name. After the electronic device determines the target vector of the target primary domain name, the electronic device can screen other primary domain names similar to the target primary domain name according to the target vector and the vector corresponding to each stored candidate primary domain name, thereby using the subdomain prefixes corresponding to other primary domain names to construct the target subdomain name corresponding to the target primary domain name, and perform subdomain blasting on the target subdomain name.

[0041] Specifically, in an embodiment of the present application, the electronic device calculates the first similarity between the target vector and the vector corresponding to each candidate primary domain name, and determines other primary domain names corresponding to the first similarity that meets the requirement. The first similarity that meets the requirement may be a first similarity that exceeds a first preset threshold, or may be a first preset number of first similarities with the largest value. The electronic device obtains the subdomain name prefix corresponding to the other primary domain name that is saved, and generates a target subdomain name corresponding to the target primary domain name based on the subdomain name prefix.

[0042] The number of other primary domain names determined by the electronic device may be one or more, and is not limited here.

[0043] In the embodiment of the present application, by combining the enterprise logo, target primary domain name and website information based on the large model, a business description text is generated, and the business description text is encoded as a target feature vector, so that not only the business information behind the target primary domain name can be accurately captured, but also more accurate data support can be provided for subsequent subdomain name generation and blasting. In addition, the embodiment of the present application also discloses that the target subdomain name corresponding to the target primary domain name is constructed according to the subdomain name prefix corresponding to other primary domain names similar to the target primary domain name, which improves the efficiency of subdomain name determination and reduces computing resources and time.

[0044] Embodiment 2:

[0045] In order to improve the efficiency of subdomain name determination and reduce computing resources and time, based on the above embodiment, in the embodiment of the present application, the process of determining the candidate primary domain name includes:

[0046] Obtain the pre-saved classification corresponding to each primary domain name and the candidate vector corresponding to the classification center of each classification;

[0047] Determine the target classification center having the highest second similarity between the target vector and each candidate vector;

[0048] The primary domain name belonging to the category corresponding to the target category center is determined as the candidate primary domain name.

[0049] In an embodiment of the present application, when the electronic device determines other primary domain names similar to the target primary domain name among the candidate primary domain names, the candidate primary domain names may be all the primary domain names stored in the electronic device. However, since there are many primary domain names stored in the electronic device, in order to improve the efficiency of subdomain name determination, the electronic device may first filter out some of the stored primary domain names as candidate primary domain names.

[0050] Specifically, when the electronic device saves each primary domain name, the electronic device can classify each primary domain name. The electronic device stores the candidate vector of the classification center of each classification. The electronic device first determines the target classification to which the target primary domain name belongs based on the candidate vector of the classification center of each classification and the target vector of the target primary domain name, and determines the subdomain name contained in the target classification as the candidate subdomain name.

[0051] For example, the electronic device uses the target vector of the target primary domain name to perform similarity calculations with the candidate vectors of the classification center of each classification, determines the second similarity between the target vector and each candidate vector, and determines the classification corresponding to the second similarity with the largest value as the target classification to which the target primary domain name belongs. The electronic device can determine the first similarity between the target vector and the vector corresponding to each candidate primary domain name contained in the classification, and select the N domain names with the highest scores as other primary domain names similar to the target primary domain name. This method uses clustering to perform two-layer similarity calculations. The first time, the similarity needs to be calculated with K classification centers, and the second time, the similarity needs to be calculated with Q nodes in a certain classification. The total calculation amount K+Q is much less than m, which greatly reduces the amount of calculation.

[0052] Among them, when the electronic device classifies each primary domain name, the electronic device first collects a large number of corporate logos; then the corporate logo is input into the ICP database, and the primary domain name registered for each corporate logo can be obtained. The electronic device determines the vector corresponding to each primary domain name, and the process of determining the vector corresponding to each primary domain name is consistent with the process of determining the target vector of the target primary domain name in the above embodiment, and will not be repeated here. The electronic device sets the parameter K, and uses the Kmeans algorithm to cluster the vectors corresponding to all the primary domain names obtained, the number of clusters is K, and K categories are obtained. For each category, the electronic device determines the mean vector of the vectors of each primary domain name contained in the category as the classification center vector of the category.

[0053] Embodiment 3:

[0054] In order to improve the efficiency of subdomain determination and reduce computing resources and time, based on the above embodiments, in the embodiment of the present application, the determining of other primary domain names that meet the first similarity requirement with the target primary domain name includes:

[0055] Using a cosine similarity algorithm, determine a first similarity between the target vector and the vector corresponding to each candidate primary domain name;

[0056] A first preset number of candidate primary domain names with the highest first similarity are determined as the other primary domain names.

[0057] In an embodiment of the present application, the electronic device may use a preset similarity algorithm to determine a first similarity between a vector corresponding to a candidate primary domain name and a target vector. The preset similarity algorithm may be a cosine similarity algorithm. The electronic device may use the following formula to determine the first similarity:

[0058]

[0059] Among them, w Av is the first similarity between the target primary domain name A and the candidate primary domain name v; q Ais the target vector corresponding to the target primary domain name, q v is the vector corresponding to the candidate primary domain name.

[0060] Embodiment 4:

[0061] In order to improve the efficiency of subdomain determination and reduce computing resources and time, based on the above embodiments, in the embodiment of the present application, generating the target subdomain corresponding to the target primary domain name according to the subdomain prefix corresponding to the other primary domain name stored includes:

[0062] For each subdomain name prefix corresponding to the other main domain name, a preset connector is used to concatenate the subdomain name prefix with the target main domain name to obtain a candidate subdomain name;

[0063] Each candidate subdomain is used as the target subdomain.

[0064] In the embodiment of the present application, the subdomain name prefix corresponding to each main domain name stored in the electronic device is determined based on the historical subdomain name corresponding to each main domain name, and the historical subdomain name of each main domain name can be obtained from the DNS database. Since there are many historical subdomain names corresponding to each main domain name, that is, there are many subdomain name prefixes corresponding to each main domain name, in order to improve the subdomain name blasting efficiency of the electronic device, the electronic device can generate candidate subdomain names based on the subdomain name prefixes corresponding to other main domain names stored, and then select the target subdomain name for subdomain name blasting from the candidate subdomain names.

[0065] Specifically, for each subdomain prefix corresponding to other main domain names, a preset connector is used to concatenate the subdomain prefix with the target main domain name to obtain a candidate subdomain name; and each candidate subdomain name is used as the target subdomain name. The preset connector is ".".

[0066] For example, a subdomain name prefix corresponding to other main domain names is A, and the target main domain name is aaa.com, then the candidate main domain name determined by the electronic device is A.aaa.com.

[0067] Embodiment 5:

[0068] In order to improve the efficiency of subdomain determination and reduce computing resources and time, based on the above embodiments, in the embodiment of the present application, after the subdomain prefix is ​​concatenated with the target main domain name to obtain a candidate subdomain, before each candidate subdomain is used as the target subdomain, the method further includes:

[0069] Determining a score of the candidate subdomain name according to a first similarity corresponding to other main domain names to which the subdomain name prefix belongs;

[0070] Determine a second preset number of candidate subdomains with the highest scores according to the scores corresponding to each candidate subdomain;

[0071] The second preset number of candidate subdomain names with the highest scores are used to update each of the candidate subdomain names.

[0072] In an embodiment of the present application, when an electronic device selects a target subdomain for subdomain blasting from candidate subdomains, the electronic device can obtain a score for each candidate subdomain based on collaborative filtering. The higher the score, the more likely the candidate subdomain is to be a subdomain of the target main domain.

[0073] Specifically, the electronic device can determine the score of the candidate subdomain name based on the first similarity corresponding to other main domain names to which the subdomain name prefix belongs; determine a second preset number of candidate subdomain names with the highest scores based on the score corresponding to each candidate subdomain name; and use the second preset number of candidate subdomain names with the highest scores to update each candidate subdomain name.

[0074] In order to improve the efficiency of subdomain determination and reduce computing resources and time, based on the above embodiments, in the embodiment of the present application, the score of the candidate subdomain is determined according to the first similarity corresponding to other main domain names to which the subdomain prefix belongs, including:

[0075] If the subdomain name prefix belongs to at least two other main domain names, the sum of the first similarities corresponding to the at least two other main domain names is determined as the score of the candidate subdomain name;

[0076] If the subdomain prefix belongs to another subdomain, the first similarity corresponding to the other subdomain is determined as the score of the candidate subdomain.

[0077] In actual application, a subdomain prefix may belong to one or more other main domains. For example, in A.aaa.com and A.bbb.com, the subdomain prefix A belongs to other main domains aaa.com and bbb.com. Based on this, when the electronic device determines the score of each candidate subdomain, the electronic device needs to determine the score of the candidate subdomain formed by the subdomain prefix according to the first similarity corresponding to each other main domain to which the subdomain prefix belongs.

[0078] Specifically, for each subdomain prefix, if the subdomain prefix belongs to at least two other main domain names, the electronic device determines the sum of the first similarities corresponding to the at least two other main domain names as the score of the candidate subdomain; if the subdomain prefix belongs to one other subdomain, the electronic device determines the first similarity corresponding to the one other subdomain as the score of the candidate subdomain.

[0079] The electronic device may determine the score of the candidate subdomain name based on the following formula:

[0080]

[0081] Among them, w Av is the first similarity between the target primary domain name A and the candidate primary domain name v; p(A,i) is the score, i is the subdomain prefix, r vi Indicates whether the subdomain prefix belongs to the candidate primary domain v. If so, r vi =1, if not belonging, then r vi =0.

[0082] Embodiment 6:

[0083] In order to improve the efficiency of subdomain determination and reduce computing resources and time, based on the above embodiments, in the embodiment of the present application, the step of inputting the target primary domain name to be processed, the enterprise logo corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the large model includes:

[0084] Obtaining a pre-saved prompt word template, wherein the prompt word template includes a first field for writing a primary domain name, a second field for writing an enterprise logo, a third field for writing website information, and prompt words for a prompt word macro model to describe a business;

[0085] Add the target primary domain name to the first field, add the enterprise logo to the second field, and add the website information to the third field;

[0086] The added prompt word template is input into the large model.

[0087] In the embodiment of the present application, a prompt word template is pre-stored in the electronic device, wherein the prompt word template includes a first field for writing a primary domain name, a second field for writing a corporate identity, a third field for writing website information, and prompt words for the prompt word macro model to describe the business. The electronic device can input the target primary domain name to be processed, the corporate identity corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the macro model according to the prompt word template.

[0088] Specifically, in an embodiment of the present application, the electronic device obtains a pre-saved prompt word template, adds the target primary domain name to the first field, adds the corporate logo to the second field, and adds the website information to the third field; the electronic device inputs the added prompt word template into the large model.

[0089] The embodiments of the present application have the following advantages over the prior art:

[0090] 1. When performing domain name and subdomain name mining, existing methods usually require a comprehensive blasting of a huge subdomain name dictionary, which not only consumes a lot of computing resources and time, but also leads to low efficiency. The embodiment of the present application, by combining a collaborative filtering algorithm, can recommend as effective subdomain names as possible for blasting for different domain names. The embodiment of the present application uses a large model and a clustering algorithm to pre-process and cluster domain names in the offline stage, and only needs to calculate the similarity of specific cluster clusters in the online stage, thereby greatly reducing the number of subdomain names that need to be blasted. Through this optimization, the embodiment of the present application significantly reduces the amount of calculation and resource consumption, and improves the efficiency of domain name and subdomain name mining.

[0091] 2. The current methods cannot effectively discover the business information behind the domain name. Most of the existing domain name and subdomain name mining methods rely on static rules and dictionary matching, which cannot deeply understand the business meaning behind the domain name, resulting in low accuracy and relevance of the recommendation results. The embodiment of the present application borrows a large model, combines the company name, main domain name and website information, generates a business description text, and uses the Bert model to encode the text-based business description text into a vector. This innovative domain name business encoding method can not only accurately capture the business information behind the main domain name, but also use these business features to perform similarity calculations and clustering during the recommendation process, thereby recommending more relevant and more effective subdomain names. This recommendation mechanism based on business information significantly improves the success rate and accuracy of subdomain name blasting.

[0092] Embodiment 7:

[0093] Based on the above embodiments, in practice, the embodiments of the present application can be implemented and used in multiple scenarios. The specific embodiments are listed as follows:

[0094] 1. Attack surface management.

[0095] Subdomain blasting technology plays a vital role in attack surface management. By systematically generating and testing a large number of potential subdomains, this technology can help security experts fully understand an organization's Internet assets. Many organizations may host various services under different subdomains, including web pages, APIs, mail servers, etc. These subdomains often become potential security vulnerabilities because they are low-key or forgotten. Through subdomain blasting, unrecorded or overlooked subdomains can be identified, thus drawing a complete picture of the attack surface. The security team can then evaluate these subdomains to ensure that each subdomain is properly protected and avoid security incidents caused by omissions. This not only improves the overall security protection level, but also prevents attackers from discovering sensitive information or vulnerabilities within the organization through subdomains, and then launching further attacks.

[0096] Implementation step 1: Collect the main domain name, ICP data and website crawler data.

[0097] Implementation step 2: parse and encode each main domain name to obtain the vector of each main domain name, then cluster the vectors to obtain the cluster center and the corresponding vector, and store the cluster center and the corresponding vector and the vector of the main domain name in the database.

[0098] Implementation step three: For each main domain name that needs to be blasted, the method provided in the above embodiment is used to determine the target subdomain name corresponding to the main domain name, and the target subdomain name is blasted to obtain the final existing subdomain name.

[0099] Implementation step 4: Provide the real subdomains to the company's security experts, who will analyze those undocumented or overlooked subdomains to draw a complete picture of the attack surface. Evaluate the subdomains to ensure that each subdomain is properly protected to avoid security incidents caused by omissions.

[0100] 2. Penetration testing and vulnerability mining

[0101] Subdomain blasting technology is also an indispensable tool in the process of penetration testing and vulnerability mining. Through subdomain blasting, penetration testers can discover hidden subdomains in the target system. These subdomains may run different applications or services, thus providing attackers with more potential attack entrances. For example, a forgotten development environment or test environment may not have strict security protection, becoming an easy entrance for attackers to break through. After discovering these subdomains, penetration testers can conduct further security tests on them to find possible vulnerabilities, such as unupdated services, default passwords, and publicly disclosed sensitive information. Through these means, security vulnerabilities can be discovered and fixed in advance, preventing attackers from using these subdomains to conduct illegal intrusions and data theft, and ultimately improving the security of the entire system.

[0102] Implementation step 1: Collect the main domain name, ICP data and website crawler data.

[0103] Implementation step 2: parse and encode each main domain name to obtain the vector of each main domain name, then cluster the vectors to obtain the cluster center and the corresponding vector, and store the cluster center and the corresponding vector and the vector of the main domain name in the database.

[0104] Implementation step three: For each main domain name that needs to be blasted, the method provided in the above embodiment is used to determine the target subdomain name corresponding to the main domain name, and the target subdomain name is blasted to obtain the final existing subdomain name.

[0105] Implementation step 4: Through subdomain blasting, penetration testers can discover hidden subdomains in the target system. After discovering these subdomains, penetration testers can conduct further security tests on them to find possible vulnerabilities, such as unupdated services, default passwords, and public sensitive information. After that, penetration testers will shut down the asset, fix the vulnerability, and improve the security of the system.

[0106] Figure 3 The flowchart of subdomain blasting provided in the embodiment of the present application is as follows: Figure 3 As shown, the process includes an offline process and an online process, wherein the offline process includes first encoding a large number of main domain names into a feature vector respectively, and the online process includes inputting the main domain name, obtaining the feature vector of the main domain name, and calculating the target subdomain name corresponding to the main domain name, and performing subdomain blasting on the target subdomain name.

[0107] exist Figure 3 On the basis of Figure 4 The flowchart of the subdomain blasting of the online process provided by the embodiment of the present application is as follows: Figure 4 As shown, input the main domain name A, obtain the feature vector A of the main domain name, use the feature vector to calculate the similarity with each cluster center of the cluster, and obtain the cluster Ki to which the main domain name belongs. Extract all the feature vectors in cluster Ki, calculate the similarity with the feature vector A of the main domain name A again, and select the N main domain names with the highest scores as similar domain names of the main domain name A. Obtain the subdomain prefixes corresponding to the N main domain names from the DNS database, and form candidate subdomains. Filter out the target subdomain from the candidate subdomains, and perform subdomain blasting on the target subdomain.

[0108] Embodiment 8:

[0109] Based on the above embodiments, Figure 5 A schematic diagram of a subdomain name determination device provided in an embodiment of the present application, the device comprising:

[0110] Processing module 501 is used to input the target primary domain name to be processed, the enterprise logo corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the big model, obtain the business description text corresponding to the target primary domain name output by the big model, and use a preset text embedding method to determine the target vector corresponding to the business description text; determine other primary domain names that meet the first similarity requirement with the target primary domain name according to the vector corresponding to each candidate primary domain name stored in advance and the target vector;

[0111] The construction module 502 is used to generate a target subdomain name corresponding to the target primary domain name according to the saved subdomain name prefix corresponding to the other primary domain name.

[0112] In a possible implementation, the processing module 501 is specifically used to obtain the pre-saved classification corresponding to each primary domain name and the candidate vector corresponding to the classification center of each classification; determine each target classification center whose second similarity between the target vector and each candidate vector meets the requirements; and determine the primary domain name belonging to the classification corresponding to each target classification center as the candidate primary domain name.

[0113] In a possible implementation, the processing module 501 is specifically configured to use a cosine similarity algorithm to determine a first similarity between the target vector and a vector corresponding to each candidate primary domain name; and determine a first preset number of candidate primary domain names with the highest first similarity as the other primary domain names.

[0114] In a possible implementation, the construction module 502 is specifically used to use a preset connector to concatenate each subdomain prefix corresponding to the other primary domain name with the target primary domain name to obtain a candidate subdomain name; and use each candidate subdomain name as the target subdomain name.

[0115] In a possible implementation, the construction module 502 is further used to determine the score of the candidate subdomain according to the first similarity corresponding to other primary domain names to which the subdomain prefix belongs; determine a second preset number of candidate subdomains with the highest scores according to the score corresponding to each candidate subdomain; and use the second preset number of candidate subdomains with the highest scores to update each candidate subdomain.

[0116] In a possible implementation, the construction module 502 is specifically configured to, if the subdomain prefix belongs to at least two other main domains, determine the sum of the first similarities corresponding to the at least two other main domains as the score of the candidate subdomain; if the subdomain prefix belongs to one other subdomain, determine the first similarity corresponding to the one other subdomain as the score of the candidate subdomain.

[0117] In a possible implementation, the processing module 501 is specifically used to obtain a pre-saved prompt word template, wherein the prompt word template includes a first field for writing a primary domain name, a second field for writing a corporate logo, a third field for writing website information, and prompt words for a prompt word macro model to describe the business; add the target primary domain name to the first field, add the corporate logo to the second field, and add the website information to the third field; and input the added prompt word template into the macro model.

[0118] Embodiment 9:

[0119] Based on the above embodiments, the present application also provides an electronic device, Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, it includes: a processor 601, a communication interface 602, a memory 603 and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 communicate with each other through the communication bus 604;

[0120] The memory 603 stores a computer program. When the program is executed by the processor 601, the processor 601 performs the following steps:

[0121] Inputting the target primary domain name to be processed, the enterprise logo corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the big model, obtaining the business description text corresponding to the target primary domain name output by the big model, and using a preset text embedding method to determine the target vector corresponding to the business description text;

[0122] Determine other primary domain names that meet the first similarity requirement with the target primary domain name according to the pre-saved vector corresponding to each candidate primary domain name and the target vector;

[0123] A target subdomain name corresponding to the target primary domain name is generated according to the saved subdomain name prefix corresponding to the other primary domain name.

[0124] In a possible implementation manner, the process of determining the candidate primary domain name includes:

[0125] Obtain the pre-saved classification corresponding to each primary domain name and the candidate vector corresponding to the classification center of each classification;

[0126] Determine each target classification center for which the second similarity between the target vector and each candidate vector meets the requirement;

[0127] The primary domain name belonging to the category corresponding to each target classification center is determined as the candidate primary domain name.

[0128] In a possible implementation manner, determining other primary domain names that meet the first similarity requirement with the target primary domain name includes:

[0129] Using a cosine similarity algorithm, determine a first similarity between the target vector and the vector corresponding to each candidate primary domain name;

[0130] A first preset number of candidate primary domain names with the highest first similarity are determined as the other primary domain names.

[0131] In a possible implementation manner, generating the target subdomain name corresponding to the target primary domain name according to the saved subdomain name prefix corresponding to the other primary domain name includes:

[0132] For each subdomain name prefix corresponding to the other main domain name, a preset connector is used to concatenate the subdomain name prefix with the target main domain name to obtain a candidate subdomain name;

[0133] Each candidate subdomain is used as the target subdomain.

[0134] In a possible implementation manner, after concatenating the subdomain prefix with the target primary domain name to obtain a candidate subdomain name, before using each candidate subdomain name as the target subdomain name, the method further includes:

[0135] Determining a score of the candidate subdomain name according to a first similarity corresponding to other main domain names to which the subdomain name prefix belongs;

[0136] Determine a second preset number of candidate subdomains with the highest scores according to the scores corresponding to each candidate subdomain;

[0137] The second preset number of candidate subdomain names with the highest scores are used to update each of the candidate subdomain names.

[0138] In a possible implementation manner, determining the score of the candidate subdomain name according to the first similarity corresponding to other primary domain names to which the subdomain name prefix belongs includes:

[0139] If the subdomain name prefix belongs to at least two other main domain names, the sum of the first similarities corresponding to the at least two other main domain names is determined as the score of the candidate subdomain name;

[0140] If the subdomain prefix belongs to another subdomain, the first similarity corresponding to the other subdomain is determined as the score of the candidate subdomain.

[0141] In a possible implementation manner, inputting the target primary domain name to be processed, the enterprise identifier corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the large model includes:

[0142] Obtaining a pre-saved prompt word template, wherein the prompt word template includes a first field for writing a primary domain name, a second field for writing an enterprise logo, a third field for writing website information, and prompt words for a prompt word macro model to describe a business;

[0143] Add the target primary domain name to the first field, add the enterprise logo to the second field, and add the website information to the third field;

[0144] The added prompt word template is input into the large model.

[0145] Since the principle of solving the problem by the above electronic device is similar to the subdomain name determination method, the implementation of the above electronic device can refer to the embodiment of the method, and the repeated parts will not be repeated.

[0146] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The communication interface 602 is used for communication between the above electronic device and other devices. The memory may include a random access memory (RAM) and may also include a non-volatile memory (NVM), such as at least one disk storage. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0147] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (Network Processor, NP), etc.; it can also be a digital signal processing processor (Digital Signal Processing, DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0148] Embodiment 10:

[0149] On the basis of the above embodiments, an embodiment of the present invention further provides a computer-readable storage medium, in which a computer program executable by a processor is stored. When the program runs on the processor, the processor implements the following steps when executing:

[0150] Inputting the target primary domain name to be processed, the enterprise logo corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the big model, obtaining the business description text corresponding to the target primary domain name output by the big model, and using a preset text embedding method to determine the target vector corresponding to the business description text;

[0151] Determine other primary domain names that meet the first similarity requirement with the target primary domain name according to the pre-saved vector corresponding to each candidate primary domain name and the target vector;

[0152] A target subdomain name corresponding to the target primary domain name is generated according to the saved subdomain name prefix corresponding to the other primary domain name.

[0153] In a possible implementation manner, the process of determining the candidate primary domain name includes:

[0154] Obtain the pre-saved classification corresponding to each primary domain name and the candidate vector corresponding to the classification center of each classification;

[0155] Determine each target classification center for which the second similarity between the target vector and each candidate vector meets the requirement;

[0156] The primary domain name belonging to the category corresponding to each target classification center is determined as the candidate primary domain name.

[0157] In a possible implementation manner, determining other primary domain names that meet the first similarity requirement with the target primary domain name includes:

[0158] Using a cosine similarity algorithm, determine a first similarity between the target vector and the vector corresponding to each candidate primary domain name;

[0159] A first preset number of candidate primary domain names with the highest first similarity are determined as the other primary domain names.

[0160] In a possible implementation manner, generating the target subdomain name corresponding to the target primary domain name according to the saved subdomain name prefix corresponding to the other primary domain name includes:

[0161] For each subdomain name prefix corresponding to the other main domain name, a preset connector is used to concatenate the subdomain name prefix with the target main domain name to obtain a candidate subdomain name;

[0162] Each candidate subdomain is used as the target subdomain.

[0163] In a possible implementation manner, after concatenating the subdomain prefix with the target primary domain name to obtain a candidate subdomain name, before using each candidate subdomain name as the target subdomain name, the method further includes:

[0164] Determining a score of the candidate subdomain name according to a first similarity corresponding to other main domain names to which the subdomain name prefix belongs;

[0165] Determine a second preset number of candidate subdomains with the highest scores according to the scores corresponding to each candidate subdomain;

[0166] The second preset number of candidate subdomain names with the highest scores are used to update each of the candidate subdomain names.

[0167] In a possible implementation manner, determining the score of the candidate subdomain name according to the first similarity corresponding to other primary domain names to which the subdomain name prefix belongs includes:

[0168] If the subdomain name prefix belongs to at least two other main domain names, the sum of the first similarities corresponding to the at least two other main domain names is determined as the score of the candidate subdomain name;

[0169] If the subdomain prefix belongs to another subdomain, the first similarity corresponding to the other subdomain is determined as the score of the candidate subdomain.

[0170] In a possible implementation manner, inputting the target primary domain name to be processed, the enterprise identifier corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the large model includes:

[0171] Obtaining a pre-saved prompt word template, wherein the prompt word template includes a first field for writing a primary domain name, a second field for writing an enterprise logo, a third field for writing website information, and prompt words for a prompt word macro model to describe a business;

[0172] Add the target primary domain name to the first field, add the enterprise logo to the second field, and add the website information to the third field;

[0173] The added prompt word template is input into the large model.

[0174] Since the principle of solving the problem by the above computer program product is similar to that of the subdomain name determination method, the implementation of the above computer program product can refer to the implementation of the method, and the repeated parts will not be repeated.

[0175] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0176] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0177] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0178] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0179] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for determining a subdomain, characterized in that: The method comprises: Inputting the target primary domain name to be processed, the enterprise logo corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the big model, obtaining the business description text corresponding to the target primary domain name output by the big model, and using a preset text embedding method to determine the target vector corresponding to the business description text; Determine other primary domain names that meet the first similarity requirement with the target primary domain name according to the pre-saved vector corresponding to each candidate primary domain name and the target vector; A target subdomain name corresponding to the target primary domain name is generated according to the saved subdomain name prefix corresponding to the other primary domain name.

2. The method according to claim 1, characterized in that The process of determining the candidate primary domain name includes: Obtain the pre-saved classification corresponding to each primary domain name and the candidate vector corresponding to the classification center of each classification; Determine each target classification center for which the second similarity between the target vector and each candidate vector meets the requirement; The primary domain name belonging to the category corresponding to each target classification center is determined as the candidate primary domain name.

3. The method according to claim 1 or 2, characterized in that: The determining of other primary domain names that meet the first similarity requirement with the target primary domain name includes: Using a cosine similarity algorithm, determine a first similarity between the target vector and the vector corresponding to each candidate primary domain name; A first preset number of candidate primary domain names with the highest first similarity are determined as the other primary domain names.

4. The method according to claim 1, characterized in that Generating the target subdomain name corresponding to the target primary domain name according to the saved subdomain name prefix corresponding to the other primary domain name includes: For each subdomain name prefix corresponding to the other main domain name, a preset connector is used to concatenate the subdomain name prefix with the target main domain name to obtain a candidate subdomain name; Each candidate subdomain is used as the target subdomain.

5. The method according to claim 4, characterized in that After concatenating the subdomain prefix with the target main domain name to obtain a candidate subdomain, each candidate subdomain is used as the target subdomain, and the method further includes: Determining a score of the candidate subdomain name according to a first similarity corresponding to other main domain names to which the subdomain name prefix belongs; Determine a second preset number of candidate subdomains with the highest scores according to the scores corresponding to each candidate subdomain; The second preset number of candidate subdomain names with the highest scores are used to update each of the candidate subdomain names.

6. The method according to claim 5, characterized in that Determining the score of the candidate subdomain name according to the first similarity corresponding to other main domain names to which the subdomain name prefix belongs includes: If the subdomain name prefix belongs to at least two other main domain names, the sum of the first similarities corresponding to the at least two other main domain names is determined as the score of the candidate subdomain name; If the subdomain prefix belongs to another subdomain, the first similarity corresponding to the other subdomain is determined as the score of the candidate subdomain.

7. The method according to claim 1, characterized in that The step of inputting the target primary domain name to be processed, the enterprise identification corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the large model includes: Obtaining a pre-saved prompt word template, wherein the prompt word template includes a first field for writing a primary domain name, a second field for writing an enterprise logo, a third field for writing website information, and prompt words for a prompt word macro model to describe a business; Add the target primary domain name to the first field, add the enterprise logo to the second field, and add the website information to the third field; The added prompt word template is input into the large model.

8. A subdomain determination device, characterized in that: The device comprises: A processing module, used to input the target primary domain name to be processed, the enterprise logo corresponding to the target primary domain name, and the website information corresponding to the target primary domain name into the large model, obtain the business description text corresponding to the target primary domain name output by the large model, and use a preset text embedding method to determine the target vector corresponding to the business description text; determine other primary domain names that meet the first similarity requirement with the target primary domain name according to the vector corresponding to each candidate primary domain name saved in advance and the target vector; A construction module is used to generate a target subdomain name corresponding to the target main domain name according to the saved subdomain name prefix corresponding to the other main domain names.

9. An electronic device, characterized in that: The electronic device comprises at least a processor and a memory, and the processor is used to implement the steps of the subdomain determination method according to any one of claims 1 to 7 when executing a computer program stored in the memory.

10. A computer-readable storage medium, characterized in that: It stores a computer program, which, when executed by a processor, implements the steps of the subdomain name determination method as claimed in any one of claims 1 to 7.

Images