Domain name intelligent detection method and system, readable storage medium and computer

Abstract

The invention provides an intelligent domain name detection method and system, a readable storage medium and a computer. The method comprises the following steps: carrying out vector fusion on character vectors converted from character features of domain names to obtain domain name vectors; sequentially carrying out convolution and pooling processing on the domain name vector by utilizing a convolutional neural network model to obtain feature data; performing data fusion on the word-level features and the feature data of each domain name, and inputting the fused features and feature data into a convolutional neural network model for data processing to obtain a first feature map; respectively inputting the feature data and the word-level features into a domain name processing model to output a second feature map; and performing model optimization on the domain name processing model by using a fusion feature map of the first feature map and the second feature map to obtain a domain name processing optimization model, and performing domain name detection on the domain name to be detected through the domain name processing optimization model. According to the method, the detection capability of malicious domain names is improved through the domain name processing optimization model, and the domain name detection efficiency and precision are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a domain name intelligent detection method, system, readable storage medium and computer. Background Art

[0002] With the rapid development of the Internet, the risks and impacts faced by network security are becoming more and more severe. Malicious domain names, as one of the network security issues, can spread viruses and steal information on the Internet, causing serious harm to the Internet and personal information.

[0003] In order to protect network security, most companies and organizations will use various methods to detect and prevent malicious domain name attacks. The current malicious domain name detection method usually filters the domain name feature combination based on the domain name blacklist rules and uses the domain name similarity to identify malicious domain names. Although this method has a fast detection rate, its corresponding accuracy often does not meet the requirements of companies and organizations, and this method relies too much on the domain name blacklist, which makes it impossible to detect higher forms of malicious domain names. Summary of the invention

[0004] Based on this, the purpose of the present invention is to provide a domain name intelligent detection method, system, readable storage medium and computer to at least solve the deficiencies in the above-mentioned technology.

[0005] The present invention proposes a domain name intelligent detection method, comprising: Obtaining character features of all domain names from the domain name data set, and converting the character features of each domain name into a character vector using a vector conversion algorithm, and performing vector fusion on each character vector to obtain a corresponding domain name vector; Constructing a convolutional neural network model, and using the convolutional neural network model to sequentially perform convolution and pooling processing on the domain name vector to obtain corresponding feature data; Obtain word-level features of each of the domain names, fuse the word-level features with the feature data, and input the results into the convolutional neural network model for data processing to obtain a corresponding first feature graph; Constructing a domain name processing model, and inputting the feature data and the word-level feature into the domain name processing model respectively, so as to output a corresponding second feature graph; The first feature map and the second feature map are fused to obtain a fused feature map, and the domain name processing model is optimized using the fused feature map to obtain a domain name processing optimization model. Domain name detection is performed on the domain name to be detected through the domain name processing optimization model to obtain a detection result.

[0006] Furthermore, the steps of converting the character features of each domain name into a character vector using a vector conversion algorithm and fusing each character vector to obtain a corresponding domain name vector include: Unifying the characters of each domain name, and extracting characters from each domain name to obtain a number of letters, numbers, and special characters corresponding to each domain name; Using an unsupervised vector model to transform the letters, the numbers and the special characters to obtain a plurality of transformation vectors, defining a length threshold of the transformation vectors, and processing each of the transformation vectors according to the length threshold to obtain a plurality of character vectors; All character vectors of each domain name are merged to obtain the domain name vector corresponding to each domain name.

[0007] Furthermore, the steps of building a convolutional neural network model include: An initial network model is defined, and a convolution kernel of the initial network model is set to a multi-channel convolution, and a domain name extraction algorithm of the initial network model is optimized to obtain an initial network optimization model; The deep learning algorithm of the initial network optimization model is optimized, and a feature matrix of the input features of the initial network optimization model is defined. An attention mechanism is introduced into the initial network optimization model according to the defined feature matrix to construct a convolutional neural network model.

[0008] Furthermore, the step of fusing the word-level features and the feature data and inputting the data into the convolutional neural network model for data processing to obtain the corresponding first feature graph includes: Performing word segmentation processing on the word-level features, and combining a preset domain name vocabulary with the word-level features after the word segmentation processing to obtain a combined feature; The combined feature is fused with the feature data to obtain corresponding fused data, and the fused data is input into the convolutional neural network model for data processing to obtain a corresponding first feature map.

[0009] Furthermore, the steps of constructing the domain name processing model include: Constructing a domain name detection model, and making the depth of the convolution kernel of the domain name detection model correspond to the depth of the input feature matrix and the output feature rectangle of the domain name detection model, so as to obtain a domain name detection optimization model; The domain name detection optimization model is subjected to label smoothing processing, and the convolution kernel of the global average pooling layer of the domain name detection optimization model is compressed to obtain a domain name processing model.

[0010] The present invention also provides a domain name intelligent detection system, comprising: A vector processing module, used to obtain character features of all domain names from the domain name data set, and use a vector conversion algorithm to convert the character features of each domain name into a character vector, and perform vector fusion on each character vector to obtain a corresponding domain name vector; A first model building module is used to build a convolutional neural network model, and use the convolutional neural network model to sequentially perform convolution and pooling processing on the domain name vector to obtain corresponding feature data; A data processing module, used for obtaining word-level features of each of the domain names, fusing the word-level features with the feature data and inputting the data into the convolutional neural network model for data processing to obtain a corresponding first feature graph; A second model building module, used to build a domain name processing model, and input the feature data and the word-level feature into the domain name processing model respectively to output a corresponding second feature graph; The domain name detection module is used to fuse the first feature map and the second feature map to obtain a fused feature map, and use the fused feature map to optimize the domain name processing model to obtain a domain name processing optimization model, and use the domain name processing optimization model to perform domain name detection on the domain name to be detected to obtain a detection result.

[0011] Furthermore, the vector processing module includes: A character extraction unit, used to unify the characters of each domain name and extract characters from each domain name to obtain a number of letters, numbers and special characters corresponding to each domain name; a vector processing unit, configured to transform the letters, the numbers and the special characters using an unsupervised vector model to obtain a plurality of transformation vectors, define a length threshold of the transformation vectors, and process each of the transformation vectors according to the length threshold to obtain a plurality of character vectors; The vector fusion unit is used to fuse all character vectors of each domain name to obtain the domain name vector corresponding to each domain name.

[0012] Furthermore, the first model building module includes: An algorithm optimization unit, used to define an initial network model, set the convolution kernel of the initial network model to a multi-channel convolution, and optimize the domain name extraction algorithm of the initial network model to obtain an initial network optimization model; The first model building unit is used to optimize the deep learning algorithm of the initial network optimization model and define a feature matrix of the input features of the initial network optimization model, and introduce an attention mechanism into the initial network optimization model according to the defined feature matrix to construct a convolutional neural network model.

[0013] Furthermore, the domain name detection module includes: A feature combination unit, used to perform word segmentation processing on the word-level feature, and combine a preset domain name vocabulary with the word-level feature after the word segmentation processing to obtain a combined feature; A data fusion unit is used to fuse the combined feature with the feature data to obtain corresponding fused data, and input the fused data into the convolutional neural network model for data processing to obtain a corresponding first feature map.

[0014] The present invention also provides a readable storage medium on which a computer program is stored. When the program is executed by a processor, the above-mentioned domain name intelligent detection method is implemented.

[0015] The present invention also provides a computer, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned domain name intelligent detection method when executing the computer program.

[0016] The domain name intelligent detection method, system, readable storage medium and computer of the present invention extract character features and word-level features of all domain names in a domain name data set, process the two types of features separately, and fuse the two obtained feature maps to obtain a fused feature map, use a label smoothing method to prevent overfitting of the model during training, improve the generalization ability of the model, use the fused feature map to optimize the domain name processing model to obtain a domain name processing optimization model, use the domain name processing optimization model to perform domain name detection on the domain name to be detected to obtain a detection result, and improve the detection ability of malicious domain names through the domain name processing optimization model, thereby significantly improving the efficiency and accuracy of domain name detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a flow chart of a domain name intelligent detection method in a first embodiment of the present invention; Figure 2 for Figure 1 Detailed flow chart of step S101; Figure 3 for Figure 1 Detailed flow chart of step S102; Figure 4 for Figure 1 Detailed flow chart of step S103; Figure 5 for Figure 1 Detailed flow chart of step S104; Figure 6 is a structural block diagram of a domain name intelligent detection system in a second embodiment of the present invention; Figure 7FIG. 4 is a structural block diagram of a computer in a third embodiment of the present invention.

[0018] The following specific implementation manner will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0019] In order to facilitate the understanding of the present invention, the present invention will be described more fully below with reference to the relevant drawings. Several embodiments of the present invention are given in the drawings. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein. On the contrary, the purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive.

[0020] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which the present invention belongs. The terms used herein in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. The term "and / or" used herein includes any and all combinations of one or more of the related listed items.

[0021] Embodiment 1 See also Figure 1 , which shows a domain name intelligent detection method in a first embodiment of the present invention, and the method specifically includes steps S101 to S105: S101, obtaining character features of all domain names from a domain name data set, and converting the character features of each domain name into a character vector using a vector conversion algorithm, and performing vector fusion on each character vector to obtain a corresponding domain name vector; For further information, see Figure 2 , the step S101 specifically includes steps S1011 to S1013: S1011, unifying the characters of each domain name, and extracting characters from each domain name to obtain a number of letters, numbers, and special characters corresponding to each domain name; S1012, using an unsupervised vector model to transform the letters, the numbers, and the special characters to obtain a plurality of transformation vectors, and defining a length threshold of the transformation vectors, and processing each of the transformation vectors according to the length threshold to obtain a plurality of character vectors; S1013, merging all character vectors of each domain name to obtain a domain name vector corresponding to each domain name.

[0022] In a specific implementation, characters of all domain names are obtained from a pre-stored domain name data set. Since domain names cannot distinguish between uppercase and lowercase letters, all uppercase letters of the domain names are converted to lowercase letters before data processing, and the letters, numbers, and special characters appearing in the domain name data are distinguished, such as separators "·", hyphens "-", etc. The unsupervised vector model (in this embodiment, the model uses the FastText algorithm model, and in some optional embodiments, the model can also be the GloVe algorithm model, the CBOW model, the Skip-gram model, etc.) is used to transform the above-obtained characters, numbers, and special characters to obtain corresponding transformation vectors; Specifically, the length threshold of the vector is defined as 65, the conversion vector obtained above is compared with the length threshold, the conversion vector smaller than the length threshold is filled with a zero vector to obtain the corresponding character vector, and all the character vectors of each domain name are merged to obtain the domain name vector corresponding to each domain name.

[0023] S102, constructing a convolutional neural network model, and using the convolutional neural network model to sequentially perform convolution and pooling processing on the domain name vector to obtain corresponding feature data; For further information, see Figure 3 , the step S102 specifically includes steps S1021~S1022: S1021, defining an initial network model, setting a convolution kernel of the initial network model to a multi-channel convolution, and optimizing a domain name extraction algorithm of the initial network model to obtain an initial network optimization model; S1022, optimizing the deep learning algorithm of the initial network optimization model, defining a feature matrix of the input features of the initial network optimization model, and introducing an attention mechanism into the initial network optimization model according to the defined feature matrix to construct a convolutional neural network model.

[0024] In the specific implementation, an initial network model is defined (in this embodiment, the initial network model can be an HMM model, an N-gram model, etc.), and the convolution kernel of the initial network model is set to a multi-channel convolution of 2, 3, 4 to extract the correlation between the characters in the domain name, thereby reducing the feature sparsity problem of the initial network model, thereby avoiding the problem of abnormal feature extraction due to excessive dimensions, and obtaining an initial network optimization model; Specifically, the deep learning algorithm of the initial network optimization model (in this embodiment, the deep learning algorithm is a recurrent neural network algorithm) is optimized, and the past and future features of the initial network optimization model are optimized using a bidirectional long short-term memory network algorithm to achieve forward and reverse processing of the character sequence: ; In the formula, express The output of the initial network optimization model after the deep learning algorithm is optimized at this moment. express The forward output of the initial network optimization model before the deep learning algorithm is optimized. express The reverse output of the initial network optimization model before the deep learning algorithm is optimized. represents the weight, express Bias of time.

[0025] Furthermore, a feature matrix of the initial network optimization model is defined, and an attention mechanism is introduced into the initial network optimization model according to the defined feature matrix. First, the attention weight value of the output feature of the initial network optimization model is calculated, and the attention weight value is converted and normalized using the Softmax function and converted into a corresponding probability distribution, and weighted processing is performed using the attention weight, thereby constructing a convolutional neural network model.

[0026] Specifically, the domain name vector is sequentially convolved and pooled using the convolution algorithm and pooling algorithm in the constructed convolutional neural network model to obtain corresponding feature data.

[0027] S103, obtaining word-level features of each of the domain names, fusing the word-level features with the feature data, and inputting the data into the convolutional neural network model for data processing to obtain a corresponding first feature graph; For further information, see Figure 4 , the step S103 specifically includes steps S1031~S1032: S1031, performing word segmentation processing on the word-level feature, and combining a preset domain name vocabulary with the word-level feature after the word segmentation processing to obtain a combined feature; S1032, fusing the combined feature with the feature data to obtain corresponding fused data, and inputting the fused data into the convolutional neural network model for data processing to obtain a corresponding first feature map.

[0028] In the specific implementation, the word-level features of each domain name obtained are segmented, and after the word segmentation, they are processed using the set word-level dimension threshold, and the word-level features with a dimension less than 30 are feature-filled to obtain the word-level features after segmentation. The preset domain name vocabulary is combined with the word-level features after segmentation to form a vocabulary with a single character or word, and it is vectorized with the feature data obtained above to obtain the corresponding final vector (i.e., fused data).

[0029] Specifically, the final vector obtained above is input into the convolutional neural network model for data processing, and a one-dimensional convolution is used to perform a convolution operation on the final vector, wherein the convolution kernel only moves downward to extract the local correlation of the final vector, and finally the extracted feature map, i.e., the first feature map, is obtained.

[0030] S104, constructing a domain name processing model, and inputting the feature data and the word-level feature into the domain name processing model respectively, to output a corresponding second feature graph; For further information, see Figure 5 , the step S104 specifically includes steps S1041-S1042: S1041, constructing a domain name detection model, and making the depth of the convolution kernel of the domain name detection model correspond to the depth of the input feature matrix and the output feature rectangle of the domain name detection model, so as to obtain a domain name detection optimization model; S1042, performing label smoothing processing on the domain name detection optimization model, and compressing the convolution kernel of the global average pooling layer of the domain name detection optimization model to obtain a domain name processing model.

[0031] In the specific implementation, a domain name detection model is constructed, in which: Indicates the character length of the input domain name. Indicates the dimension of the input domain name characters, represents the convolution kernel size, Represents the number of output channels. The depth of the convolution kernel of the domain name detection model constructed above corresponds to the depth of its input feature matrix and output feature matrix. The size is , each convolution branch uses 128 convolution kernels to perform convolution operations on the input to obtain 128 66X1 feature maps, thereby obtaining a domain name detection optimization model; Specifically, the Focal Loss loss function is used to train the domain name detection optimization model, and the label smoothing factor and the number of categories are constructed. The label smoothing factor and the number of categories are used to perform label smoothing on the domain name detection optimization model, so that the domain name detection optimization model does not overfit and improves the robustness and generalization ability of the model.

[0032] Furthermore, the outputs of the parallel convolution branches for extracting domain name word-level features in the above-mentioned domain name detection optimization model are spliced ​​with the parallel convolution branches for extracting domain name character-level features, which are twice the number of parallel convolution branches of domain name word-level features. Convolution operation is performed again using a convolution kernel of size 1 to obtain 128 66X1 feature maps, and then each feature map is subjected to global average pooling processing to reduce redundant parameters. Only one convolution kernel of size 1 is used to perform convolution operation on it to output a unique feature, thereby compressing the convolution kernel of the global average pooling layer, and using a lightweight global average pooling layer to reduce the number of parameters to obtain a domain name processing model.

[0033] Furthermore, the domain name processing model performs domain name processing on the feature data and word-level features obtained above, thereby outputting a corresponding second feature map.

[0034] S105, fusing the first feature map and the second feature map to obtain a fused feature map, and using the fused feature map to perform model optimization on the domain name processing model to obtain a domain name processing optimization model, and performing domain name detection on the domain name to be detected by using the domain name processing optimization model to obtain a detection result.

[0035] In a specific implementation, the first feature map and the second feature map obtained above are feature fused to obtain a corresponding fused feature map, and the fused feature map is used to optimize the domain name processing model. All domain name features contained in the fused feature map (in this embodiment, the domain name features include malicious domain names and legitimate domain names) are divided into a training set according to a preset ratio, and the training set is input into the domain name processing model for learning and training, so that the domain name processing model learns more domain name features, thereby improving the detection ability of the model and obtaining a domain name processing optimization model. The domain name processing optimization model is used to perform domain name detection on the domain name to be detected to obtain a detection result.

[0036] In summary, the domain name intelligent detection method in the above embodiment of the present invention extracts character features and word-level features of all domain names in the domain name data set, processes the two types of features separately, and fuses the two feature maps to obtain a fused feature map, adopts a label smoothing method to prevent overfitting of the model during the training process, improves the generalization ability of the model, uses the fused feature map to optimize the domain name processing model to obtain a domain name processing optimization model, uses the domain name processing optimization model to perform domain name detection on the domain name to be detected to obtain a detection result, and improves the detection ability of malicious domain names through the domain name processing optimization model, and significantly improves the efficiency and accuracy of domain name detection.

[0037] Embodiment 2 Another aspect of the present invention is to provide a domain name intelligent detection system. Figure 6, which shows a domain name intelligent detection system in a second embodiment of the present invention, and the system includes: The vector processing module 11 is used to obtain the character features of all domain names from the domain name data set, and use the vector conversion algorithm to convert the character features of each domain name into a character vector, and perform vector fusion on each character vector to obtain a corresponding domain name vector; Furthermore, the vector processing module 11 includes: A character extraction unit, used to unify the characters of each domain name and extract characters from each domain name to obtain a number of letters, numbers and special characters corresponding to each domain name; a vector processing unit, configured to transform the letters, the numbers and the special characters using an unsupervised vector model to obtain a plurality of transformation vectors, define a length threshold of the transformation vectors, and process each of the transformation vectors according to the length threshold to obtain a plurality of character vectors; The vector fusion unit is used to fuse all character vectors of each domain name to obtain the domain name vector corresponding to each domain name.

[0038] The first model building module 12 is used to build a convolutional neural network model, and use the convolutional neural network model to sequentially perform convolution and pooling processing on the domain name vector to obtain corresponding feature data; Furthermore, the first model building module 12 includes: An algorithm optimization unit, used to define an initial network model, set the convolution kernel of the initial network model to a multi-channel convolution, and optimize the domain name extraction algorithm of the initial network model to obtain an initial network optimization model; The first model building unit is used to optimize the deep learning algorithm of the initial network optimization model and define a feature matrix of the input features of the initial network optimization model, and introduce an attention mechanism into the initial network optimization model according to the defined feature matrix to construct a convolutional neural network model.

[0039] A data processing module 13 is used to obtain word-level features of each of the domain names, fuse the word-level features with the feature data, and input the data into the convolutional neural network model for data processing to obtain a corresponding first feature graph; A second model building module 14 is used to build a domain name processing model, and input the feature data and the word-level feature into the domain name processing model respectively to output a corresponding second feature graph; The domain name detection module 15 is used to fuse the first feature map and the second feature map to obtain a fused feature map, and use the fused feature map to optimize the domain name processing model to obtain a domain name processing optimization model, and use the domain name processing optimization model to perform domain name detection on the domain name to be detected to obtain a detection result.

[0040] Furthermore, the domain name detection module 15 includes: A feature combination unit, used to perform word segmentation processing on the word-level feature, and combine a preset domain name vocabulary with the word-level feature after the word segmentation processing to obtain a combined feature; A data fusion unit is used to fuse the combined feature with the feature data to obtain corresponding fused data, and input the fused data into the convolutional neural network model for data processing to obtain a corresponding first feature map.

[0041] The functions or operation steps implemented when the above modules and units are executed are generally the same as those in the above method embodiments, and will not be repeated here.

[0042] The domain name intelligent detection system provided in the embodiment of the present invention has the same implementation principle and technical effects as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the system embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0043] Embodiment 3 The present invention also provides a computer, see Figure 7 , shown is a computer in the third embodiment of the present invention, including a memory 10, a processor 20, and a computer program 30 stored in the memory 10 and executable on the processor 20. When the processor 20 executes the computer program 30, the above-mentioned domain name intelligent detection method is implemented.

[0044] The memory 10 includes at least one type of readable storage medium, which includes a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the memory 10 may be an internal storage unit of a computer, such as a hard disk of the computer. In other embodiments, the memory 10 may also be an external storage device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card, etc. Further, the memory 10 may also include both an internal storage unit of the computer and an external storage device. The memory 10 may be used not only to store application software and various types of data installed in the computer, but also to temporarily store data that has been output or is to be output.

[0045] Among them, in some embodiments, the processor 20 can be an electronic control unit (Electronic Control Unit, abbreviated as ECU, also known as a vehicle computer), a central processing unit (Central Processing Unit, CPU), a controller, a microcontroller, a microprocessor or other data processing chip, used to run the program code stored in the memory 10 or process data, such as executing access restriction programs, etc.

[0046] It should be pointed out that Figure 7 The structure shown does not constitute a limitation on the computer. In other embodiments, the computer may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0047] The embodiment of the present invention further provides a readable storage medium on which a computer program is stored. When the program is executed by a processor, the domain name intelligent detection method as described above is implemented.

[0048] Those skilled in the art will appreciate that the logic and / or steps represented in the flowchart or otherwise described herein, for example, may be considered as an ordered list of executable instructions for implementing logical functions, and may be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For purposes of this specification, "computer-readable medium" may be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0049] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0050] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or a combination thereof: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0051] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0052] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A domain name intelligent detection method, characterized in that: include: Obtaining character features of all domain names from the domain name data set, and converting the character features of each domain name into a character vector using a vector conversion algorithm, and performing vector fusion on each character vector to obtain a corresponding domain name vector; Constructing a convolutional neural network model, and using the convolutional neural network model to sequentially perform convolution and pooling processing on the domain name vector to obtain corresponding feature data; Obtain word-level features of each of the domain names, fuse the word-level features with the feature data, and input the results into the convolutional neural network model for data processing to obtain a corresponding first feature graph; Constructing a domain name processing model, and inputting the feature data and the word-level feature into the domain name processing model respectively, so as to output a corresponding second feature graph; The first feature map and the second feature map are fused to obtain a fused feature map, and the domain name processing model is optimized using the fused feature map to obtain a domain name processing optimization model. Domain name detection is performed on the domain name to be detected through the domain name processing optimization model to obtain a detection result.

2. The domain name intelligent detection method according to claim 1, characterized in that: The steps of converting the character features of each domain name into a character vector by using a vector conversion algorithm and fusing the character vectors to obtain a corresponding domain name vector include: Unifying the characters of each domain name, and extracting characters from each domain name to obtain a number of letters, numbers, and special characters corresponding to each domain name; Using an unsupervised vector model to transform the letters, the numbers and the special characters to obtain a plurality of transformation vectors, defining a length threshold of the transformation vectors, and processing each of the transformation vectors according to the length threshold to obtain a plurality of character vectors; All character vectors of each domain name are merged to obtain the domain name vector corresponding to each domain name.

3. The domain name intelligent detection method according to claim 1, characterized in that: The steps to build a convolutional neural network model include: An initial network model is defined, and a convolution kernel of the initial network model is set to a multi-channel convolution, and a domain name extraction algorithm of the initial network model is optimized to obtain an initial network optimization model; The deep learning algorithm of the initial network optimization model is optimized, and a feature matrix of the input features of the initial network optimization model is defined. An attention mechanism is introduced into the initial network optimization model according to the defined feature matrix to construct a convolutional neural network model.

4. The domain name intelligent detection method according to claim 1, characterized in that: The step of fusing the word-level features and the feature data and inputting them into the convolutional neural network model for data processing to obtain the corresponding first feature graph includes: Performing word segmentation processing on the word-level features, and combining a preset domain name vocabulary with the word-level features after the word segmentation processing to obtain a combined feature; The combined feature is fused with the feature data to obtain corresponding fused data, and the fused data is input into the convolutional neural network model for data processing to obtain a corresponding first feature map.

5. The domain name intelligent detection method according to claim 1, characterized in that: The steps to build a domain name processing model include: Constructing a domain name detection model, and making the depth of the convolution kernel of the domain name detection model correspond to the depth of the input feature matrix and the output feature rectangle of the domain name detection model, so as to obtain a domain name detection optimization model; The domain name detection optimization model is subjected to label smoothing processing, and the convolution kernel of the global average pooling layer of the domain name detection optimization model is compressed to obtain a domain name processing model.

6. A domain name intelligent detection system, characterized in that: include: A vector processing module, used to obtain character features of all domain names from the domain name data set, and use a vector conversion algorithm to convert the character features of each domain name into a character vector, and perform vector fusion on each character vector to obtain a corresponding domain name vector; A first model building module is used to build a convolutional neural network model, and use the convolutional neural network model to sequentially perform convolution and pooling processing on the domain name vector to obtain corresponding feature data; A data processing module, used for obtaining word-level features of each of the domain names, fusing the word-level features with the feature data and inputting the data into the convolutional neural network model for data processing to obtain a corresponding first feature graph; A second model building module, used to build a domain name processing model, and input the feature data and the word-level feature into the domain name processing model respectively to output a corresponding second feature graph; The domain name detection module is used to fuse the first feature map and the second feature map to obtain a fused feature map, and use the fused feature map to optimize the domain name processing model to obtain a domain name processing optimization model, and use the domain name processing optimization model to perform domain name detection on the domain name to be detected to obtain a detection result.

7. The domain name intelligent detection system according to claim 6, characterized in that: The vector processing module comprises: A character extraction unit, used to unify the characters of each domain name and extract characters from each domain name to obtain a number of letters, numbers and special characters corresponding to each domain name; a vector processing unit, configured to transform the letters, the numbers and the special characters using an unsupervised vector model to obtain a plurality of transformation vectors, define a length threshold of the transformation vectors, and process each of the transformation vectors according to the length threshold to obtain a plurality of character vectors; The vector fusion unit is used to fuse all character vectors of each domain name to obtain the domain name vector corresponding to each domain name.

8. The domain name intelligent detection system according to claim 6, characterized in that: The first model building module includes: An algorithm optimization unit, used to define an initial network model, set the convolution kernel of the initial network model to a multi-channel convolution, and optimize the domain name extraction algorithm of the initial network model to obtain an initial network optimization model; The first model building unit is used to optimize the deep learning algorithm of the initial network optimization model and define a feature matrix of the input features of the initial network optimization model, and introduce an attention mechanism into the initial network optimization model according to the defined feature matrix to construct a convolutional neural network model.

9. A readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the domain name intelligent detection method according to any one of claims 1 to 5 is implemented.

10. A computer comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the domain name intelligent detection method according to any one of claims 1 to 5 is implemented.

Images