Domain name detection method and device and electronic equipment

Abstract

The invention discloses a domain name detection method and device and electronic equipment. The method comprises the steps that multi-dimensional behavior data of a domain name to be detected are acquired, and the multi-dimensional behavior data at least comprise character information, Whois registration information, host access information, domain name resolution information and webpage display information of the domain name to be detected; determining a domain name association graph according to the multi-dimensional behavior data, and performing feature extraction on the domain name association graph to obtain a target feature vector corresponding to the domain name association graph; and processing the target feature vector by using a domain name detection model to obtain a domain name detection result, the domain name detection result being used for representing a probability value of the to-be-detected domain name belonging to the malicious domain name. According to the method and the device, the technical problems that malicious domain name detection accuracy is low and malicious domain name detection is easy to avoid due to the fact that malicious domain name detection methods in related technologies are difficult to cope with dynamically changing domain name generation algorithms and lack of comprehensive analysis of multi-dimensional behavior information are solved.

Description

Technical Field

[0001] The present application relates to the field of communication network security, and more specifically, to a domain name detection method, device and electronic equipment. Background Art

[0002] With the rapid development of the Internet, domain names are the cornerstone of network resource access, and their importance is self-evident. However, this critical infrastructure has also become the focus of cybercriminals, especially malicious domain names generated by the DGA algorithm (Domain Generation Algorithm). Due to their large number, fast generation, and easy change, they have become the preferred tool for network attack activities such as phishing, malware propagation, and command and control servers. The DGA algorithm can generate seemingly random domain names in batches. By frequently changing these domain names, attackers avoid long-term monitoring and blocking of traditional security mechanisms, which brings unprecedented challenges to the detection of real-time malicious domain names.

[0003] In related technologies, malicious domain name detection relies on anomaly list filtering and machine learning-based classifiers. The anomaly list method is based on a known list of malicious domain names, but its effectiveness is limited by the update speed and comprehensiveness. Faced with the massive new domain names generated by DGA, this method seems to be inadequate. On the other hand, although machine learning methods can classify by analyzing the domain name's character features, vowel ratio, length and other artificially designed features, feature engineering is complex and time-consuming, and it is easy for attackers to circumvent it by adjusting the DGA algorithm, resulting in a decrease in the performance of the detection model.

[0004] In recent years, deep learning technology, especially Graph Neural Network (GNN), has gradually been introduced into the field of malicious domain name detection due to its excellent performance in processing graph structured data. GNN can automatically capture high-dimensional features without the need for tedious manual feature design, significantly improving detection efficiency and accuracy. However, domain name detection methods in related technologies mostly focus on the analysis of domain name characters, and fail to fully integrate multi-dimensional behavioral information such as domain name registration, host access, IP resolution, and web page content. This limits the model's ability to fully understand malicious activities, especially in the face of the diversity and dynamic changes in DGA domain name generation. The effect is limited. In addition, for the construction and analysis of graph models for malicious domain name detection, related technologies have not yet fully utilized multi-dimensional behavioral data to construct detailed association graphs, and lack comprehensive consideration of the complex relationships between different behavioral dimensions.

[0005] Therefore, domain name detection methods in related technologies are often difficult to accurately identify and respond to emerging malicious domain name threats, especially when attackers continue to optimize DGA algorithms in an attempt to evade detection, the accuracy of malicious domain name detection is severely limited.

[0006] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0007] The embodiments of the present application provide a domain name detection method, device and electronic device to at least solve the technical problems that the malicious domain name detection method in the related art is difficult to cope with the dynamically changing domain name generation algorithm and lacks multi-dimensional behavior information for comprehensive analysis, resulting in low accuracy and easy circumvention of malicious domain name detection.

[0008] According to one aspect of an embodiment of the present application, a domain name detection method is provided, comprising: obtaining multi-dimensional behavior data of a domain name to be detected, wherein the multi-dimensional behavior data at least includes: character information, Whois registration information, host access information, domain name resolution information and web page display information of the domain name to be detected; determining a domain name association graph based on the multi-dimensional behavior data, and performing feature extraction on the domain name association graph to obtain a target feature vector corresponding to the domain name association graph, wherein the domain name association graph is used to represent an association graph between the domain name to be detected and related entities of the domain name to be detected in different dimensions; and using a domain name detection model to process the target feature vector to obtain a domain name detection result, wherein the domain name detection result is used to represent a probability value that the domain name to be detected belongs to a malicious domain name.

[0009] Optionally, the domain name association map includes at least: a character association map, a registration association map, a host access association map, a domain name resolution association map and a web page display association map, wherein the character association map is determined by character information, the registration association map is determined by Whois registration information, the host access association map is determined by host access information, the domain name resolution association map is determined by domain name resolution information, and the web page display association map is determined by web page display information.

[0010] Optionally, after determining the domain name association graph based on the multi-dimensional behavioral data, the method also includes: obtaining a first feature vector corresponding to each node in the domain name association graph, wherein the first feature vector is an initial feature vector containing attribute information of each node; converting the first feature vector through graph embedding technology to obtain a second feature vector corresponding to each node in the domain name association graph, wherein the dimensional space where the second feature vector is located is lower than the dimensional space where the first feature vector is located.

[0011] Optionally, feature extraction is performed on the domain name association graph to obtain a target feature vector corresponding to the domain name association graph, including: updating the second feature vector through a graph neural network to obtain a third feature vector; determining the attention weight of the domain name association graph through an attention mechanism; and determining the target feature vector based on the third feature vector and the attention weight.

[0012] Optionally, determining the attention weight of the domain name association graph through an attention mechanism includes: determining the number of domain name association graphs; and determining the attention weight according to the third eigenvector, the number of domain name association graphs and preset learning parameters.

[0013] Optionally, the domain name detection model is trained in the following manner: determining a first detection result and a second detection result of historical domain name data, wherein the first detection result is used to indicate the actual probability that the historical domain name data belongs to a malicious domain name, and the second detection result is used to indicate the predicted probability that the historical domain name data belongs to a malicious domain name determined by the initial domain name detection model; determining the probability difference between the first detection result and the second detection result; updating the model parameters of the initial domain name detection model according to the probability difference, and stopping the updating after the probability difference is less than a preset probability threshold, thereby obtaining a domain name detection model.

[0014] Optionally, after the target feature vector is processed using a domain name detection model to obtain a domain name detection result, the method further includes: when the domain name detection result is greater than or equal to a preset threshold, determining the domain name to be detected as a malicious domain name; when the domain name detection result is less than the preset threshold, determining the domain name to be detected as a normal domain name.

[0015] According to another aspect of an embodiment of the present application, a domain name detection device is also provided, including: an acquisition module, used to obtain multi-dimensional behavior data of a domain name to be detected, wherein the multi-dimensional behavior data at least includes: character information, Whois registration information, host access information, domain name resolution information and web page display information of the domain name to be detected; a determination module, used to determine a domain name association graph based on the multi-dimensional behavior data, and perform feature extraction on the domain name association graph to obtain a target feature vector corresponding to the domain name association graph, wherein the domain name association graph is used to represent an association graph between the domain name to be detected and related entities of the domain name to be detected in different dimensions; a processing module, used to process the target feature vector using a domain name detection model to obtain a domain name detection result, wherein the domain name detection result is used to represent the probability value that the domain name to be detected belongs to a malicious domain name.

[0016] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including: a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the above-mentioned domain name detection method.

[0017] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, wherein the non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned domain name detection method by running the computer program.

[0018] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which implement the above domain name detection method when executed by a processor.

[0019] In an embodiment of the present application, multi-dimensional behavior data of a domain name to be detected is obtained, wherein the multi-dimensional behavior data includes at least: character information, Whois registration information, host access information, domain name resolution information and web page display information of the domain name to be detected; a domain name association graph is determined based on the multi-dimensional behavior data, and features are extracted from the domain name association graph to obtain a target feature vector corresponding to the domain name association graph, wherein the domain name association graph is used to represent an association graph between the domain name to be detected and related entities of the domain name to be detected in different dimensions; a domain name detection model is used to process the target feature vector to obtain a domain name detection result, wherein the domain name detection result is used to represent the probability value that the domain name to be detected belongs to a malicious domain name, thereby achieving the purpose of accurately identifying malicious domain names by integrating multi-dimensional behavior information, thereby achieving the technical effect of improving the accuracy of domain name detection, enhancing anti-evasion capabilities and discovering hidden malicious patterns, thereby solving the technical problems of low accuracy and easy evasion of malicious domain name detection due to the difficulty of malicious domain name detection methods in related technologies in coping with dynamically changing domain name generation algorithms and lack of comprehensive analysis of multi-dimensional behavior information. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0021] Figure 1 is a hardware structure diagram of a computer terminal for implementing a domain name detection method according to an embodiment of the present application;

[0022] Figure 2 is a flow chart of a domain name detection method according to an embodiment of the present application;

[0023] Figure 3 is a schematic diagram of a malicious domain name detection process according to an embodiment of the present application;

[0024] Figure 4 It is a structural diagram of a domain name detection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] First, some nouns or terms that appear in the process of explaining the embodiments of the present application are subject to the following explanations:

[0028] Command and Control (C&C): In the field of computer security, a C&C server is a remote server controlled by an attacker to send commands to infected terminal devices and receive feedback. This server is usually hidden in legitimate network services and is used to coordinate large-scale attack operations, such as botnet activities.

[0029] Domain Generation Algorithm (DGA): A common technique used in malware to automatically generate a large number of domain names that appear legitimate but are actually used for network attacks (such as C&C communications and data leakage). The DGA algorithm can help attackers avoid the risk of being tracked or banned for relying on a single domain name, making malicious activities more covert and difficult to monitor.

[0030] Whois registration information: Whois is a standard service used to query domain name registration information, including registrant name, email address, phone number, registration date, etc. This data is very important for analyzing the legitimacy of domain names and potential malicious activities, and can help identify suspicious domain name registration behavior.

[0031] Graph Neural Network (GNN): A deep learning model that processes graph-structured data. It can learn the feature representations of nodes and edges in the graph and effectively model the relationship between entities. GNN transmits information between nodes in the graph, allowing each node to aggregate the information of its neighboring nodes for tasks such as node classification and link prediction.

[0032] Attention mechanism: A key technology in the field of deep learning, it is mainly used to enable the model to focus on the key parts of the input sequence when processing sequence data, rather than processing all inputs equally. In graph neural networks, the attention mechanism helps the model adaptively assign weights to nodes and edges, highlight important features in the graph, and improve the model's explanatory power and expressiveness.

[0033] Bipartite graph: It is a special graph structure in which nodes are divided into two disjoint sets and only form edges between nodes in different sets. For example, the host access association graph and the domain name resolution association graph are bipartite graphs, connecting domain names with hosts and domain names with IP addresses respectively.

[0034] Node2Vec: is a graph embedding algorithm that converts nodes in a graph into low-dimensional vectors, preserving the relationships and attribute information between nodes. Node2Vec generates node sequences through a random walk strategy, and then trains these sequences using the Skip-Gram model (similar to Word2Vec) to learn the vector representation of nodes.

[0035] Cross-entropy loss function: It is a commonly used loss function in supervised learning to evaluate the difference between the model's predicted probability and the actual label, especially in classification tasks. The cross-entropy loss function can guide the model to adjust the weights so that the predicted results are as close to the true label as possible.

[0036] In order to solve the problem of low efficiency of domain name detection in the related art, the embodiment of the present application provides a domain name detection method, which can be run on Figure 1 In the computer terminal shown, the computer terminal is described below.

[0037] The domain name detection method embodiment provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing a domain name detection method. Figure 1As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions connected via a wired and / or wireless network. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art can understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0038] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0039] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the domain name detection method in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned domain name detection method is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0040] The transmission module 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission module 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0041] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0042] It should be noted that, in some optional embodiments, the above Figure 1 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0043] In the above operating environment, an embodiment of the present application provides an embodiment of a domain name detection method. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0044] Figure 2 is a flow chart of a domain name detection method according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0045] Step S202, obtaining multi-dimensional behavior data of the domain name to be detected, wherein the multi-dimensional behavior data at least includes: character information, Whois registration information, host access information, domain name resolution information and web page display information of the domain name to be detected.

[0046] In the above step S202, the main focus is on collecting multi-dimensional behavior information of the domain name to be detected to ensure the comprehensiveness and depth of the analysis. Among them, obtaining multi-dimensional behavior data of the domain name to be detected includes but is not limited to:

[0047] Character information: Analyze the characters that make up the domain name, such as length, character distribution, sequence pattern, etc., to identify its possible malicious characteristics.

[0048] Whois registration information: Obtain domain name registration details, such as registration time, registrant, registration agency, etc., to assess the suspiciousness of its registration behavior.

[0049] Host access information: records the frequency and time pattern of the host's access to the domain name, and identifies abnormal or suspicious access patterns.

[0050] Domain name resolution information: Analyze DNS resolution records, including the mapping relationship between domain names and IP addresses, to detect potential malicious IP addresses.

[0051] Web page display information: Evaluate the legitimacy and security of the web page by crawling the content of the web page corresponding to the domain name, such as text, images, and keywords.

[0052] Furthermore, the collected multi-dimensional behavior data can be pre-processed, for example:

[0053] Data cleaning: Data cleaning aims to remove noise and irrelevant information from the data, for example, removing non-domain characters, standardizing domain name formats, filtering invalid or duplicate Whois data, and identifying and cleaning abnormal host access records and DNS resolution records.

[0054] Format standardization: Data from different sources may have different formats. The purpose of format standardization is to unify the format of these data to meet the requirements of model input. For example, converting dates to a unified timestamp format, unifying character encoding, and converting text data into bag-of-words or TF-IDF representations ensures that all data is understood and processed under the same framework, enhancing the parsing capabilities of the model.

[0055] Missing value filling: The collected data may contain some missing fields, especially in Whois registration information and host access information. Missing value filling can be done through a variety of strategies, such as using the mean, median, mode to fill the missing of numerical data, or using the most frequent category, prediction based on other features, etc. to fill the missing of categorical data.

[0056] Data consistency check: The last step of preprocessing is to ensure the consistency of all data, which includes checking the integrity of the data, verifying the consistency of data fields, ensuring the continuity of time series, etc. For example, checking the continuity of timestamps in host access information and ensuring that the domain name resolution record is consistent with the registration date in the Whois information. This process helps to discover anomalies and errors in the data and avoid bringing erroneous information into the analysis.

[0057] Through the above preprocessing steps, this application ensures the quality and consistency of multi-dimensional behavioral data, laying a solid foundation for subsequent association graph construction and feature extraction. Only when data cleaning, format standardization, missing value filling and consistency checking are completed properly, can the model learn meaningful features from "clean" data, effectively avoiding the adverse effects of noise and bias on model performance, thereby achieving accurate detection of malicious domain names.

[0058] Step S204, determining a domain name association graph based on the multi-dimensional behavior data, and performing feature extraction on the domain name association graph to obtain a target feature vector corresponding to the domain name association graph, wherein the domain name association graph is used to represent an association graph between the domain name to be detected and related entities of the domain name to be detected in different dimensions.

[0059] In the above step S204, after collecting multi-dimensional behavior data, the relationship between the domain name and its related entities can be represented by constructing domain name association graphs of different dimensions. The domain name association graph includes but is not limited to: character association graph, registration association graph, host access association graph, domain name resolution association graph, and web page display association graph. Furthermore, through the automatic feature learning capability of the graph neural network (GNN), feature extraction is performed on the domain name association graph, and the structured association information is converted into a low-dimensional vector representation, thereby generating a target feature vector for subsequent domain name detection and analysis.

[0060] Step S206, using the domain name detection model to process the target feature vector to obtain a domain name detection result, wherein the domain name detection result is used to indicate the probability value that the domain name to be detected is a malicious domain name.

[0061] In the above step S206, after obtaining the target feature vectors extracted from multiple behavioral dimensions, these target feature vectors are input into the pre-trained domain name detection model. The domain name detection model is a graph neural network integrated with an attention mechanism, which can perform weighted fusion of features from different views to form a comprehensive domain name representation. The domain name detection model learns this comprehensive representation and combines the fully connected layer and activation function to output a probability value, i.e., the above domain name detection result, which is used to indicate the possibility that the domain name to be detected is a malicious domain name.

[0062] Through the above steps S202 to S206, the purpose of integrating multi-dimensional behavior information to accurately identify malicious domain names is achieved, thereby achieving the technical effects of improving the accuracy of domain name detection, enhancing anti-evasion capabilities, and discovering hidden malicious patterns, thereby solving the technical problems of low malicious domain name detection accuracy and easy evasion due to the difficulty of malicious domain name detection methods in related technologies in coping with dynamically changing domain name generation algorithms and lack of multi-dimensional behavior information for comprehensive analysis. The following is a detailed description.

[0063] In the above step S204, the domain name association map at least includes: a character association map, a registration association map, a host access association map, a domain name resolution association map and a web page display association map, wherein the character association map is determined by character information, the registration association map is determined by Whois registration information, the host access association map is determined by host access information, the domain name resolution association map is determined by domain name resolution information, and the web page display association map is determined by web page display information.

[0064] In the embodiments of the present application, by constructing the above five association graphs, the behavioral characteristics of the domain name to be detected are comprehensively described from different dimensions, and each graph provides a perspective to observe the legitimacy of the domain name and potential malicious behavior. Subsequently, the multi-view attention graph neural network is used to extract and fuse the features of these graphs, and the weights of each view are adaptively allocated through the attention mechanism to highlight the features that are most discriminative for malicious detection. This comprehensive analysis method overcomes the limitations of single-dimensional features in traditional methods, improves the accuracy and robustness of detection, can cope with the dynamic changes of the DGA domain name generation algorithm, and provides strong technical support for the real-time detection and defense of malicious domain names. The following is a detailed analysis of the above five domain name association graphs:

[0065] The character association graph (a weighted undirected graph) is constructed from the perspective of the character composition behavior of the domain name. It focuses on the frequency of occurrence, co-occurrence relationship, and character sequence pattern of the characters in the domain name. In the graph, the nodes represent specific characters or character combinations, and the edges represent the connection or co-occurrence relationship between characters. The weight of the edge can reflect the closeness or co-occurrence frequency of the character sequence. This graph structure can help the model understand the structural characteristics of the domain name and identify possible malicious patterns, such as the random character sequence generated by the common DGA.

[0066] The registration association graph (an undirected graph) is constructed based on Whois registration information. It reflects the relationship between domain name registrants, registration time, and registrars. In the graph, nodes include domain names, registrants, and registrars, and edges represent registration relationships. This graph can reveal patterns in domain name registration behavior, such as multiple domain names being registered by the same suspicious registrant or organization, which may indicate signs of malicious activity. By analyzing the registration association graph, suspicious registration patterns can be identified, such as frequent changes in registrants or large numbers of domain names registered in a short period of time.

[0067] The host access association graph (a weighted bipartite graph) is constructed based on the host's access information to the domain name, which shows the interactive relationship between the host and the domain name. In the graph, the nodes include the domain name and the access host, the edge represents the host's access behavior to the domain name, and the weight of the edge can reflect the access frequency. Analysis of the host access association graph can identify abnormal access patterns, such as access from a large number of different geographical locations in a short period of time, or abnormal activity during the night time, which may be related to malicious activities.

[0068] The domain name resolution association graph (an undirected bipartite graph) is built based on the domain name resolution information, which describes the mapping relationship between domain names and IP addresses. In the graph, nodes include domain names and IP addresses, and edges represent DNS resolution records. By analyzing the domain name resolution association graph, it can help identify potential malicious IP addresses, such as IP addresses associated with multiple malicious or suspicious domain names, or resolution records with abnormal geographical distribution.

[0069] The web page display association graph (an undirected bipartite graph) is constructed based on the web page content obtained from the domain name. It reflects the association between web page text, keywords, images and other information and the domain name. In the graph, nodes include domain names and web page content features, and edges represent the existence or association of features. Through this graph structure, web page features related to phishing websites and malware propagation can be identified, providing important clues for comprehensively judging the malicious attributes of domain names.

[0070] Optionally, after determining the domain name association graph based on the multi-dimensional behavioral data, the method also includes: obtaining a first feature vector corresponding to each node in the domain name association graph, wherein the first feature vector is an initial feature vector containing attribute information of each node; converting the first feature vector through graph embedding technology to obtain a second feature vector corresponding to each node in the domain name association graph, wherein the dimensional space where the second feature vector is located is lower than the dimensional space where the first feature vector is located.

[0071] In the embodiment of the present application, the process of performing feature conversion on the domain name association graph is a key step in realizing the deep learning model to efficiently process graph structure data, which involves obtaining a first feature vector and generating a second feature vector through graph embedding technology. The specific process can be as follows:

[0072] First, extract the attribute information of each node from the collected multi-dimensional behavior data. This information directly reflects the characteristics of the node, such as the character length of the domain name, registration time, host access frequency, IP address geographic location, etc. These attribute information constitute the initial first feature vector, whose dimension is related to the number of extracted attributes. It is often a high-dimensional vector that can fully reflect the characteristics of the node. For different types of association graphs (character association graph, registration association graph, host access association graph, domain name resolution association graph, and web page display association graph), the composition of the first feature vector will be different to ensure the comprehensiveness and pertinence of the information.

[0073] Secondly, since directly processing high-dimensional feature vectors is computationally inefficient and may contain redundant information, it is necessary to convert the first feature vector into a lower-dimensional second feature vector through graph embedding technology. Among them, graph embedding technology such as Node2Vec is a method of mapping nodes in a graph to a low-dimensional vector space, which retains the relationship and attribute information between nodes. In the graph embedding process, a random walk strategy is usually used to generate node sequences, and then these sequences are trained using models such as the Skip-Gram model to learn the vector representation of the node, that is, the second feature vector. This process allows the model to adaptively learn node features based on the local neighborhood structure and global graph structure of the node, thereby retaining important behavioral information in a low-dimensional space.

[0074] Through graph embedding technology, the first eigenvector of each node is converted to the second eigenvector. This conversion process not only reduces the dimension of the eigenvector, but also enhances the expressiveness of the feature by learning the association relationship and node attributes between nodes. The dimensional space where the second eigenvector is located is lower than the space of the first eigenvector. It is usually a carefully designed and trained low-dimensional vector space that can more effectively capture the intrinsic properties of the node and the structural information of the graph. The specific embedding function is as follows:

[0075]

[0076] In the formula, G i represents the i-th domain name association graph, V i Represents G i The number of nodes in H, Embed represents the embedding operation, d represents the embedding dimension, and H i represents the embedding matrix.

[0077] This conversion from high-dimensional feature vectors to low-dimensional feature vectors is the key to the efficient processing of deep learning-based graph neural networks (GNNs). Low-dimensional feature vectors not only save computing resources, but also enable GNNs to better aggregate and propagate features. In the subsequent malicious domain name detection process, the second feature vector is weighted and fused through the multi-view attention mechanism to form a unified and highly discriminative domain name representation, which significantly improves the accuracy and efficiency of malicious domain name detection.

[0078] Optionally, feature extraction is performed on the domain name association graph to obtain target feature data corresponding to the domain name association graph, including: updating the second feature vector through a graph neural network to obtain a third feature vector; determining the attention weight of the domain name association graph through an attention mechanism; and determining the target feature vector based on the third feature vector and the attention weight.

[0079] Furthermore, the attention weight of the domain name association graph is determined by the attention mechanism, including: determining the number of domain name association graphs; and determining the attention weight according to the third eigenvector, the number of domain name association graphs and preset learning parameters.

[0080] In the embodiment of the present application, the process of extracting features from the domain name association graph to obtain the target feature vector is achieved by combining the graph neural network (GNN) and the attention mechanism. This process is crucial to improving the accuracy and efficiency of malicious domain name detection. The specific process can be as follows:

[0081] First, the features are updated through the graph neural network (GNN). Specifically, after the graph embedding technology converts the high-dimensional first feature vector into a low-dimensional second feature vector, the GNN further updates these feature vectors to reflect the relationship between the nodes in their local neighborhood. Among them, GNN transmits and aggregates information between the nodes of the graph, so that each node can learn the characteristics of its neighboring nodes, thereby updating its feature representation and obtaining the third feature vector. This process can be iterated for multiple layers, making the feature representation of the node richer and more comprehensive, and able to capture the deep relationship in the graph structure. The specific feature update formula is as follows:

[0082]

[0083] In the formula, Represents the feature vector of node v at layer l, that is, the second feature vector mentioned above, represents the feature vector of node v at the l+1th layer, i.e., the third feature vector mentioned above, deg(v) and deg(u) represent the degrees of node v and node u, i.e., the number of edges connected to the node; represents the symmetric normalization factor, which is used to eliminate the influence of node degree on feature aggregation; W (l)represents the weight of the lth layer, and σ represents the ReLU activation function.

[0084] Secondly, after the feature vector is updated, the attention mechanism is used to determine the contribution of different views (i.e. different types of association graphs) to the final decision. The attention weight reflects the importance of each graph in the comprehensive analysis, allowing the model to adaptively focus on the most relevant graph structure information, thereby enhancing the accuracy of detection.

[0085] It should be noted that in this application, five different domain name association graphs have been defined, including character association graph, Whois registration information association graph, host access association graph, domain name resolution association graph and web page display association graph. Therefore, the number of domain name association graphs is fixed to 5. The specific attention calculation formula is as follows:

[0086]

[0087] In the formula, α i represents the attention weight of the i-th association map; M = 5 represents the total number of domain association maps; tanh represents the hyperbolic tangent activation function, which is used to map features to a specific range; represents the feature representation of v in the i-th association graph; W a 、b a , q represents the trainable preset learning parameters.

[0088] Finally, after obtaining the third eigenvector and attention weight, the third eigenvectors of different views are weighted and fused according to their attention weights to obtain a comprehensive target eigenvector. This vector is a combination of feature information of multiple association graphs through the multi-view attention GNN technology, aiming to capture the comprehensive characteristics of domain names in different dimensional behaviors, so as to more accurately judge the malicious attributes of domain names. The specific formula can be as follows:

[0089]

[0090] In the formula, h v represents the above target feature vector.

[0091] For the fused target feature vector, the final prediction probability can be obtained by calculating through the fully connected layer and activation function in the domain name detection model. The specific formula is as follows:

[0092]

[0093] In the formula, represents the domain name detection result, that is, the final malicious domain name prediction probability; σ c represents the Sigmoid activation function, which is defined as; w and b represent the weight and bias parameters of the classifier.

[0094] Through the above steps, this application not only uses graph neural networks to extract rich node features from the graph structure, but also introduces an attention mechanism to weight features of different dimensions, and finally obtains a target feature vector that can fully reflect the multi-dimensional behavior information of the domain name. This process is the core of the entire malicious domain name detection method. It enables the model to more accurately identify and distinguish malicious and non-malicious domain names, improves the robustness and efficiency of detection, and provides an innovative solution for the field of network security.

[0095] In the above step S206, the domain name detection model is trained in the following manner: determining a first detection result and a second detection result of the historical domain name data, wherein the first detection result is used to indicate the actual probability that the historical domain name data belongs to a malicious domain name, and the second detection result is used to indicate the predicted probability that the historical domain name data belongs to a malicious domain name determined by the initial domain name detection model; determining the probability difference between the first detection result and the second detection result; updating the model parameters of the initial domain name detection model according to the probability difference, and stopping the updating after the probability difference is less than a preset probability threshold, thereby obtaining the domain name detection model.

[0096] In the embodiment of the present application, the method for training the domain name detection model adopts a supervised learning process based on historical domain name data, and iteratively optimizes the model parameters by comparing the difference between the model prediction probability and the actual malicious probability until the model converges to an acceptable performance level. The specific process can be as follows:

[0097] First, determine the first detection result and the second detection result of the historical domain name data. The first detection result is the true probability that the historical domain name data belongs to a malicious domain name, which is usually derived from a known malicious domain name database or a data set manually annotated by experts. The second detection result is the probability of belonging to a malicious domain name obtained by predicting the historical domain name data through an initial domain name detection model. The initial model is based on a graph neural network, an attention mechanism, or other deep learning components, but its prediction accuracy may be low at the beginning of training and needs to be optimized through subsequent training processes.

[0098] Secondly, determine the probability difference between the first detection result and the second detection result. Specifically, during the training process of the initial domain name detection model, the model will make a prediction based on the characteristics of the historical domain name data to obtain the second detection result. Then, the model calculates the difference between the first detection result and the second detection result, and this difference is usually quantified as the value of the loss function. The loss function can be a cross entropy loss, mean square error, or other form of function to measure the inconsistency between the model prediction and the true label. The specific loss function L is as follows:

[0099]

[0100] Where Vlabel Represents the label set of historical domain name data; y v represents the true probability of node v, that is, the first detection result mentioned above; y v' Represents the predicted probability of node v, that is, the second detection result mentioned above.

[0101] Furthermore, the model parameters of the initial domain name detection model are updated based on the probability difference. Specifically, based on the probability difference between the first detection result and the second detection result, the model uses a back propagation algorithm to update the model parameters. The back propagation algorithm calculates the gradient of the loss function relative to the model parameters and adjusts these parameters to reduce the loss, thereby improving the prediction performance of the model. This process is repeated until the loss reduction caused by the adjustment of the model parameters is less than a preset probability threshold, indicating that the model has converged.

[0102] In the process of iteratively updating model parameters, the model will gradually "learn" how to extract useful features from historical domain name data and accurately predict its malicious attributes. As training progresses, the model's predicted probability will become closer and closer to the actual malicious probability of historical data, thereby improving the overall performance of the detection model.

[0103] Finally, the update stops when the probability difference is less than the preset probability threshold. The preset probability threshold is a stop condition for model training, which is used to determine whether the model has achieved sufficiently good performance. When the predicted probability difference caused by the update of model parameters is less than this threshold, the model is considered to have converged and the training process will stop. The choice of the preset probability threshold depends on the specific application scenario and the expectation of model performance. Usually, a reasonable value can be determined through experiments.

[0104] Through the above training process, the domain name detection model in this application can learn effective strategies for identifying malicious domain names from historical data, which not only improves the accuracy of detection, but also enhances the generalization ability of the model, enabling it to effectively deal with emerging malicious domain name patterns, especially those generated by DGA (domain name generation algorithm). This iterative training method based on probability differences is a key step to improve model performance and ensure its reliability.

[0105] Optionally, after the target feature vector is processed using a domain name detection model to obtain a domain name detection result, the method further includes: when the domain name detection result is greater than or equal to a preset threshold, determining the domain name to be detected as a malicious domain name; when the domain name detection result is less than the preset threshold, determining the domain name to be detected as a normal domain name.

[0106] In the embodiment of the present application, after processing the target feature vector using the trained domain name detection model, the domain name detection result obtained is a probability value, which indicates the possibility that the domain name to be detected is a malicious domain name. Based on this probability value, the present application provides a decision mechanism for classifying the domain name to be detected as a malicious domain name or a normal domain name.

[0107] Specifically, when the domain name detection result is greater than or equal to the preset threshold, the domain name to be detected is judged as a malicious domain name. This means that the model predicts that the malicious attribute of the domain name exceeds the defined threshold, so there is a high probability that it is malicious. When the domain name detection result is less than the preset threshold, the domain name to be detected is judged as a normal domain name. This means that the malicious probability predicted by the model is lower than the preset security standard, so the domain name is considered normal or safe.

[0108] The preset threshold is a probability dividing line set according to the model training results and business needs, which is used to distinguish malicious domain names from normal domain names. This threshold directly affects the accuracy and recall rate of detection. A higher threshold will reduce the false alarm rate (the probability of mistakenly identifying a normal domain name as a malicious domain name), but may increase the false alarm rate (the probability of failing to identify a real malicious domain name). On the contrary, a lower threshold will improve the comprehensiveness of detection, but may increase false alarms. Therefore, the setting of the preset threshold needs to comprehensively consider security policies, business impacts, and detection performance.

[0109] After determining the classification of the domain name to be detected (malicious or normal), a series of follow-up actions can be taken. For domain names that are determined to be malicious, it may be necessary to add them to the abnormal list, block user access or conduct further in-depth analysis. For normal domain names, they can be allowed to access normally or undergo regular monitoring. In addition, for detection results close to the threshold, manual review or other rules can be used for secondary judgment to reduce the possibility of misjudgment.

[0110] Figure 3 is a schematic diagram of a malicious domain name detection process provided according to an embodiment of the present application, such as Figure 3As shown in the figure, the process starts with collecting and preprocessing the multi-dimensional behavior data of the domain name, including the character composition of the domain name, Whois registration information, host access records, IP resolution history and web page content features, and constructing the graph structure of five different views: character association graph, Whois information association graph, host access association graph, IP resolution association graph and page information association graph. Subsequently, the node attributes in each view are converted into a low-dimensional second feature vector through graph embedding technology to facilitate model processing. Next, the second feature vector is extracted and updated using a graph neural network to generate a more abstract third feature vector. On this basis, the attention mechanism is introduced to calculate the attention weight of each view to determine the relative importance of each view in the comprehensive analysis. By fusing the third feature vector with the corresponding attention weight, the target feature vector is obtained, which comprehensively reflects the characteristics of the domain name in multi-dimensional behavior. Finally, the target feature vector is input into a well-trained domain name detection model, which obtains the domain name detection result by processing the feature vector. If the detection result is greater than or equal to the preset threshold, the domain name to be detected is determined to be a malicious domain name; otherwise, it is determined to be a normal domain name. The entire process demonstrates how the present invention uses a combination of multi-dimensional behavioral information and deep learning technology to achieve efficient and accurate detection of DGA (domain generation algorithm) malicious domain names, significantly improving network security protection capabilities.

[0111] In the embodiments of the present application, by integrating the multi-dimensional behavioral information of the domain name, a variety of domain name association graphs are constructed to comprehensively capture the characteristics of the domain name from different perspectives, and further use the multi-view attention graph neural network technology to automatically extract and weight the important information in these association graphs, significantly improving the accuracy and robustness of feature representation. Compared with traditional abnormal list filtering and machine learning methods based on single features, the present application significantly improves the accuracy and efficiency of malicious domain name detection, can respond to the diversity and dynamic changes of malicious domain name generation methods in a timely manner, reduces false positives and false negatives, and enhances the security protection capabilities of the system. Through the comprehensive analysis of automatic feature extraction and multi-view attention mechanisms, the present application also reduces the complexity of manual intervention and improves the generalization ability of the model, which is of great significance to network attacks, especially the real-time monitoring and defense of DGA malicious domain names, and provides an innovative and effective solution for the field of network security.

[0112] According to an embodiment of the present application, a domain name detection device is provided. It should be noted that the domain name detection device of the embodiment of the present application can be used to execute the domain name detection method provided in the embodiment of the present application. The domain name detection device provided in the embodiment of the present application is introduced below.

[0113] Figure 4 is a structural diagram of a domain name detection device provided according to an embodiment of the present application. Figure 4 As shown, the device comprises:

[0114] The acquisition module 40 is used to acquire multi-dimensional behavior data of the domain name to be detected, wherein the multi-dimensional behavior data at least includes: character information, Whois registration information, host access information, domain name resolution information and web page display information of the domain name to be detected;

[0115] A determination module 42 is used to determine a domain name association graph based on the multi-dimensional behavior data, and perform feature extraction on the domain name association graph to obtain a target feature vector corresponding to the domain name association graph, wherein the domain name association graph is used to represent an association graph between the domain name to be detected and related entities of the domain name to be detected in different dimensions;

[0116] The processing module 44 is used to process the target feature vector using the domain name detection model to obtain a domain name detection result, wherein the domain name detection result is used to indicate the probability value that the domain name to be detected is a malicious domain name.

[0117] Through the acquisition module 40, determination module 42 and processing module 44 in the above-mentioned domain name detection device, the purpose of integrating multi-dimensional behavior information to accurately identify malicious domain names is achieved, thereby achieving the technical effects of improving domain name detection accuracy, enhancing anti-circumvention capabilities and discovering hidden malicious patterns, thereby solving the technical problems of low malicious domain name detection accuracy and easy circumvention due to the malicious domain name detection method in the related technology being difficult to cope with the dynamically changing domain name generation algorithm and lacking multi-dimensional behavior information for comprehensive analysis.

[0118] In the domain name detection device provided in the embodiment of the present application, the determination module is also used to obtain a first feature vector corresponding to each node in the domain name association graph, wherein the first feature vector is an initial feature vector containing attribute information of each node; the first feature vector is transformed by graph embedding technology to obtain a second feature vector corresponding to each node in the domain name association graph, wherein the dimensional space where the second feature vector is located is lower than the dimensional space where the first feature vector is located.

[0119] In the domain name detection device provided in the embodiment of the present application, the determination module is also used to update the second feature vector through the graph neural network to obtain a third feature vector; determine the attention weight of the domain name association graph through the attention mechanism; and determine the target feature vector based on the third feature vector and the attention weight.

[0120] In the domain name detection device provided in the embodiment of the present application, the determination module is also used to determine the number of domain name association graphs; and determine the attention weight based on the third eigenvector, the number of domain name association graphs and preset learning parameters.

[0121] In the domain name detection device provided in the embodiment of the present application, the processing module is also used to determine a first detection result and a second detection result of historical domain name data, wherein the first detection result is used to indicate the actual probability that the historical domain name data belongs to a malicious domain name, and the second detection result is used to indicate the predicted probability that the historical domain name data belongs to a malicious domain name determined by an initial domain name detection model; determine the probability difference between the first detection result and the second detection result; update the model parameters of the initial domain name detection model according to the probability difference, and stop updating after the probability difference is less than a preset probability threshold, so as to obtain a domain name detection model.

[0122] In the domain name detection device provided in the embodiment of the present application, the processing module is also used to determine the domain name to be detected as a malicious domain name when the domain name detection result is greater than or equal to a preset threshold; when the domain name detection result is less than the preset threshold, determine the domain name to be detected as a normal domain name.

[0123] An embodiment of the present application further provides an electronic device, including: a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the above-mentioned domain name detection method.

[0124] It should be noted that the above electronic equipment is used to execute Figure 2 The domain name detection method shown, therefore the relevant explanations and instructions in the above domain name detection method are also applicable to the electronic device and will not be repeated here.

[0125] An embodiment of the present application further provides a non-volatile storage medium, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned domain name detection method by running the computer program.

[0126] It should be noted that the above non-volatile storage medium is used to execute Figure 2 The domain name detection method shown in the figure, therefore the relevant explanations in the above domain name detection method are also applicable to the non-volatile storage medium, and will not be repeated here.

[0127] The embodiment of the present application also provides a computer program product, including computer instructions, which implement the above-mentioned domain name detection method when executed by a processor.

[0128] It should be noted that the above-mentioned computer program product is used to execute Figure 2 The domain name detection method shown in the figure, therefore the relevant explanations and instructions in the above domain name detection method are also applicable to the computer program product, and will not be repeated here.

[0129] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0130] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0131] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0132] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0133] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0134] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly or all or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc., which can store program code.

[0135] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A domain name detection method, characterized in that: include: Acquire multi-dimensional behavior data of the domain name to be detected, wherein the multi-dimensional behavior data at least includes: character information, Whois registration information, host access information, domain name resolution information and web page display information of the domain name to be detected; Determine a domain name association graph according to the multi-dimensional behavior data, and perform feature extraction on the domain name association graph to obtain a target feature vector corresponding to the domain name association graph, wherein the domain name association graph is used to represent an association graph between the domain name to be detected and related entities of the domain name to be detected in different dimensions; The target feature vector is processed by using a domain name detection model to obtain a domain name detection result, wherein the domain name detection result is used to represent a probability value that the domain name to be detected is a malicious domain name.

2. The method according to claim 1, characterized in that The domain name association map at least includes: a character association map, a registration association map, a host access association map, a domain name resolution association map and a web page display association map, wherein the character association map is determined by the character information, the registration association map is determined by the Whois registration information, the host access association map is determined by the host access information, the domain name resolution association map is determined by the domain name resolution information, and the web page display association map is determined by the web page display information.

3. The method according to claim 1, characterized in that After determining the domain name association graph according to the multi-dimensional behavior data, the method further includes: Acquire a first feature vector corresponding to each node in the domain name association graph, wherein the first feature vector is an initial feature vector including attribute information of each node; The first feature vector is transformed by using a graph embedding technology to obtain a second feature vector corresponding to each node in the domain name association graph, wherein the dimensional space where the second feature vector is located is lower than the dimensional space where the first feature vector is located.

4. The method according to claim 3, characterized in that Extracting features from the domain name association graph to obtain a target feature vector corresponding to the domain name association graph includes: The second eigenvector is updated by using a graph neural network to obtain a third eigenvector; Determining the attention weight of the domain name association graph through an attention mechanism; The target feature vector is determined according to the third feature vector and the attention weight.

5. The method according to claim 4, characterized in that The attention weight of the domain name association graph is determined by an attention mechanism, including: Determining the number of the domain name association graphs; The attention weight is determined according to the third eigenvector, the number of the domain name association graph and a preset learning parameter.

6. The method according to claim 1, characterized in that The domain name detection model is trained in the following way: Determine a first detection result and a second detection result of the historical domain name data, wherein the first detection result is used to indicate a real probability that the historical domain name data belongs to a malicious domain name, and the second detection result is used to indicate a predicted probability that the historical domain name data belongs to a malicious domain name determined by an initial domain name detection model; determining a probability difference between the first test result and the second test result; The model parameters of the initial domain name detection model are updated according to the probability difference, and the updating is stopped after the probability difference is less than a preset probability threshold, so as to obtain the domain name detection model.

7. The method according to claim 1, characterized in that After the target feature vector is processed by using a domain name detection model to obtain a domain name detection result, the method further includes: When the domain name detection result is greater than or equal to a preset threshold, determining the domain name to be detected as a malicious domain name; When the domain name detection result is less than the preset threshold, the domain name to be detected is determined as a normal domain name.

8. A domain name detection device, characterized in that: include: An acquisition module, used to acquire multi-dimensional behavior data of the domain name to be detected, wherein the multi-dimensional behavior data at least includes: character information, Whois registration information, host access information, domain name resolution information and web page display information of the domain name to be detected; A determination module, configured to determine a domain name association graph based on the multi-dimensional behavior data, and perform feature extraction on the domain name association graph to obtain a target feature vector corresponding to the domain name association graph, wherein the domain name association graph is used to represent an association graph between the domain name to be detected and related entities of the domain name to be detected in different dimensions; The processing module is used to process the target feature vector using a domain name detection model to obtain a domain name detection result, wherein the domain name detection result is used to represent the probability value that the domain name to be detected is a malicious domain name.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the memory is used to store program instructions; The processor is connected to the memory and is used to execute the domain name detection method described in any one of claims 1 to 7.

10. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the domain name detection method according to any one of claims 1 to 7 by running the computer program.

11. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the domain name detection method described in any one of claims 1 to 7 is implemented.

Images