IP address attribution subject intelligent identification system and method based on deep learning

Abstract

The invention relates to the technical field of IP address detection, and discloses an IP address attribution subject intelligent identification system and method based on deep learning, and the method comprises the steps: firstly collecting and integrating public IP address related data which comprises a mapping relation among an IP, a domain name and an attribution subject; performing data integration and data cleaning on the data, analyzing and extracting attributes and features of the data by utilizing feature engineering, and portraying an IP (Internet Protocol), a domain name and a subject from the data of associated features, naming features, geographic positions, operators, service types and network topology; inputting the IP, the domain name and the subject after portraying into an IP affiliation subject identification model to train the identification model, and deeply mining the association among the attributes and characteristics of each dimension of the IP, the domain name and the subject; and calling the model to identify the ownership subject, integrating other IP attributes, and then outputting a final identification result. According to the method, the problems of low IP address attribution subject identification precision, slow response and difficulty in adapting to network environment change in the prior art are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of IP address detection, and in particular to a system and method for intelligently identifying an IP address owner based on deep learning. Background Art

[0002] With the rapid development of Internet technology, IP addresses, as an indispensable basic identifier in Internet communications, have become increasingly important. IP addresses are not only used to identify devices in the network, but also carry a wealth of information, such as the device's geographic location, the network it belongs to, etc. Therefore, accurately identifying the owner of an IP address is of great significance for maintaining network security, optimizing network resource allocation, and improving user experience. In the future, identifying the owner of an IP address will become an indispensable technical means.

[0003] Traditional IP address attribution identification methods mainly rely on static database queries. This method pre-builds and maintains a database containing a large number of IP addresses and corresponding attribution information. When it is necessary to identify the attribution of an IP address, a query is performed in the database. This method is simple to implement and easy to operate, and is particularly suitable for scenarios where real-time requirements are not high;

[0004] With the rapid development of the Internet and the gradual depletion of IPv4 address resources, the allocation and use of IP addresses have become increasingly complex. Traditional static database query methods face some challenges, such as information lag caused by untimely database updates, inability to accurately reflect the dynamically changing network environment, and low query accuracy due to a single data source. Therefore, it is of great practical significance to develop an efficient, accurate IP address ownership identification system that can adapt to changes in the network environment.

[0005] Therefore, to address the above problems, a deep learning-based intelligent identification system and method for the IP address owner is needed. Summary of the invention

[0006] The purpose of the present invention is to provide a system and method for intelligently identifying the subject of an IP address based on deep learning. The present invention solves the problems in the prior art of low accuracy, slow response and difficulty in adapting to changes in the network environment in identifying the subject of an IP address.

[0007] The present invention is implemented in this way. The present invention provides an intelligent identification method of an IP address attribution subject based on deep learning, which is specifically performed in the following steps:

[0008] S1: First, collect and integrate the public IP address related data, which includes the mapping relationship between IP, domain name, and the subject to which it belongs; the mapping relationship includes the association information between IP and domain name, IP and subject, domain name and subject, and the filing information related to IP, domain name and subject. The filing information includes the filing name, contact information, service type, geographic location, operator, validity period attribute information, and IP-related network topology information, including routing path and network delay data.

[0009] S2: The data in step S1 is integrated and cleaned, and then its attributes and features are analyzed and extracted using feature engineering;

[0010] Please follow the steps below:

[0011] S2.1: Data merging: Merge the collected data according to the key fields of IP, domain name, and subject to be owned to form a unified data set; and perform data deduplication: during the merging process, remove duplicate data records;

[0012] S2.2: Perform data cleaning, identify data errors, and check whether there are spelling errors, format errors, and logical errors in the data set; for example, whether the format of the IP address is correct, whether the domain name contains illegal characters, etc.

[0013] The mean method is used to fill missing values, detect and process outliers for missing fields or records in the data set, as shown below;

[0014]

[0015] Among them, xi represents the first i numerical values, n Represents the total number of values ​​in the data set. represents the sum of all xi from i=1 to i=n;

[0016] Perform data standardization and standardize the data; for example, convert the IP address into a unified format, standardize the domain name, etc. As shown below;

[0017]

[0018] in, x is the original data, μ is the mean, σ is the standard deviation;

[0019] Then, perform feature analysis on the IP, domain name, and subject attributes to find out the meaning, value range, and relationship of the IP, domain name, and subject attributes; perform feature extraction, and extract features based on the results of the attribute analysis;

[0020] For example, features such as network address and subnet mask can be extracted from IP address; features such as top-level domain name and second-level domain name can be extracted from domain name; features such as organization type and geographic location can be extracted from the affiliated entity.

[0021] S3: Based on the attributes and characteristics of the above data, profile the IP, domain name, and subject from the data of association characteristics, naming characteristics, geographic location, operator, service type, and network topology;

[0022] Please follow the steps below:

[0023] S3.1: First, perform correlation feature analysis. Through DNS resolution, find out the domain name corresponding to the IP address and the IP address resolved by the domain name. Domain name-subject association: Use the WHOIS database to find out the subject information of the domain name registration, including the information of the registrant and the registration institution.

[0024] S3.2: Perform naming feature analysis, analyze the domain name naming rules, domain name naming patterns, and subject naming features, analyze the subject's name, abbreviation, and alias information, and extract key information;

[0025] S3.3: Perform geographic location analysis, IP address geographic location, use IP address geographic location database (such as MaxMind GeoIP), map IP address to specific geographic location, and perform domain name and subject geographic location analysis, and determine the domain name and subject geographic location by analyzing the geographic location field in the domain name registration information and subject information;

[0026] S3.4: Perform operator analysis to obtain the IP address operator, and use the IP address operator database to map the IP address to a specific operator (such as ISP, CDN, etc.); then identify the operator information of the domain name and subject, and determine the operator of the domain name and subject by analyzing the operator field in the domain name registration information and subject information;

[0027] S3.5: Obtain the service type information of the IP address, and determine the service type (such as Web service, mail service, etc.) provided by the IP address by analyzing the traffic characteristics and port usage of the IP address; determine the service type of the domain name and subject by analyzing the service description, business type and other fields in the domain name and subject information;

[0028] S3.6: Perform network topology analysis, build a network topology map by analyzing the connection relationship and routing information between IP addresses, and then build a network topology map of domain names and entities by analyzing the association relationship and business transaction information between domain names and entities. In the process of building a network topology map, a clustering algorithm is used to group nodes including IP addresses, domain names or entities, and analyze the potential relationship or structure between them;

[0029] First, we define the similarity measure between nodes, including the Euclidean distance, as follows:

[0030]

[0031] in, x and y are two nodes, specifically the feature vector of the IP address, domain name, or subject, and n is the number of features;

[0032] Then the nodes are divided into different clusters according to the similarity measure, as follows;

[0033]

[0034] in, μj is the center of cluster Cj, xi is a node in cluster Cj;

[0035] After clustering is completed, the quality of the clusters is evaluated and the potential relationships or structures between them are analyzed.

[0036] S4: Input the profiling IP, domain name, and subject into the IP attribution subject recognition model to train the recognition model, deeply explore the association between the attributes and features of each dimension of IP, domain name, and subject, and receive the IP address query request submitted by the user;

[0037] The training of the deep learning model specifically combines the convolutional neural network CNN and the recurrent neural network RNN ​​to build a hybrid neural network architecture to process the above data of different dimensions. The specific steps are as follows:

[0038] S4.1: First, the CNN part is used to extract the association relationship features, routing path features, and character features of the domain name main information, and the CNN is used to extract the spatial features; for example, the local features of the characters are extracted through the convolution layer, and the feature dimension is reduced by the pooling layer; the convolution layer slides on the input data through the convolution kernel or filter, calculates the weighted sum of the local area, and usually adds a bias term, and applies an activation function to extract the spatial features; as shown in the following formula;

[0039]

[0040] Where yij is the value at position (i, j) in the output feature map, x(i+m)(j+n) is the value at position (i+m, j+n) in the input feature map, wmn is the weight of the convolution kernel at position (m, n), b is the bias term, and f is the activation function (e.g. ReLU).

[0041] S4.2: Process time series data through RNN, such as registration or filing time, expiration time, data discovery or update time of IP-related data. Capture long-term dependencies through LSTM long short-term memory network to avoid gradient disappearance, and use RNN to extract time series features;

[0042] In step S4.2, the time series features are extracted using RNN as follows;

[0043] f t =σ(W f ·[h i＝1 ,x t ]+b f )

[0044] Among them, ft is the output of the forget gate, σ is the sigmoid activation function, Wf is the weight matrix of the forget gate, ht-1 is the hidden state of the previous time step, xt is the input of the current time step, and bf is the bias term.

[0045] S4.3: concatenate the feature data extracted by CNN and RNN to form a comprehensive feature vector;

[0046] S4.4: further process the comprehensive feature vector through multiple fully connected layers, and use the comprehensive feature vector data for model training;

[0047] S4.5: Use the cross entropy loss function or the mean square error loss function, and use the Adam optimization algorithm, combined with the learning rate decay strategy to speed up the model training convergence speed; as shown below;

[0048]

[0049] Among them, y i is the true label, p i is the predicted probability;

[0050] S4.6: Add the Dropout method during the training process to randomly discard some neurons to prevent the model from overfitting; and perform incremental learning, support incremental learning, and automatically adjust parameters; when new data is added, the model can automatically adjust parameters to maintain the best performance, as shown in the following formula;

[0051] m t =β1m t-1 +(1-β1)g t

[0052]

[0053] g t represents the gradient, m t and v tare the first-order moment estimate and the second-order moment estimate of the gradient, α is the initial learning rate, β1 and β2 are the decay rates, and ∈ is a small constant added for numerical stability;

[0054] S5: Call the model to identify its owner and integrate other IP attributes to output the final identification result.

[0055] Furthermore, the present invention provides an intelligent identification system for IP address ownership based on deep learning, including a data preprocessing module for data collection and integration of public IP address related data, and after cleaning the collected data, feature extraction and dimension construction of the data using feature engineering, and finally forming training data to be input into a deep learning model for training;

[0056] And based on the extracted features, the IP, domain name, and subject are profiled in dimensions; domain name portrait dimension, subject portrait dimension;

[0057] The deep learning model training module conducts deep learning on the input IP, domain name, and subject portrait information of each dimension. Based on the naming features such as English, abbreviations, Chinese, and pinyin in the domain name and subject name, and combined with the geographical location, operator, service type, contact information, network segment mapping relationship, IP domain name subject mapping relationship and other information, the deep-level correlation between the features of each dimension is established.

[0058] The attribution subject identification module receives the IP address query request submitted by the user and calls the trained deep learning model for real-time prediction. It includes the abnormal data processing function and has an abnormal monitoring submodule to effectively identify special situations such as proxy services and VPNs. Specifically, it includes the comprehensive analysis and judgment of the geographical location of the IP address, routing path information, response time, DNS query and reverse resolution data to eliminate misjudgment caused by abnormal data;

[0059] The result output module finally presents the identification result of the IP address owner to the user in an easy-to-understand manner, including the specific information of the owner and other related information in various dimensions.

[0060] Furthermore, the present invention provides a computer-readable storage medium, which includes an embedded processing system and a stored program, and when the embedded system control program is running, any one of the above-mentioned methods for intelligently identifying the IP address owner based on deep learning is executed.

[0061] Compared with the prior art, the present invention has the following beneficial effects:

[0062] 1. Improved the recognition ability and accuracy of the model: Through multi-dimensional data integration, including official data of IP address allocation agencies, domain name registration information, network routing information, geographic location data, etc. Combined with feature engineering technology, such as extracting the associated data features of IP addresses, geographic location features, network topology features, etc., the attributes of IP addresses are described from multiple angles, thereby improving the recognition ability and accuracy of the model.

[0063] 2. Improve the adaptability of the model to complex network environments: By transforming and expanding existing data, more training samples are generated to enhance the robustness and generalization ability of the model. At the same time, through the built-in anomaly detection submodule, it can identify and process abnormal data, such as IP location deviation caused by proxy servers, VPNs, etc.

[0064] 3. Significantly shorten response time and improve query efficiency: The system uses an efficient deep learning framework and optimization algorithm, which can quickly respond to user query requests in real-time scenarios. It also supports distributed computing. By decomposing tasks into multiple computing nodes for parallel processing, the time for data processing and model prediction can be significantly shortened. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. It is understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0066] Figure 1 is a flow chart of the method of the present invention;

[0067] Figure 2 It is a system structure diagram of the present invention. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the invention claimed for protection, but is only for selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention.

[0069] See also Figure 1-Figure 2 The present invention provides a system and method for intelligently identifying an IP address subject based on deep learning, which is specifically performed in the following steps:

[0070] S1: First, collect and integrate the public IP address related data, which includes the mapping relationship between IP, domain name, and subject; the mapping relationship includes the association information between IP and domain name, IP and subject, domain name and subject, and the filing information related to IP, domain name and subject. The filing information includes the filing name, contact information, service type, geographic location, operator, validity period attribute information, and IP-related network topology information, including routing path and network delay data. The data specifically includes the following table 1;

[0071] Table 1 IP address related features extracted from the data

[0072]

[0073] S2: The data in step S1 is integrated and cleaned, and then its attributes and features are analyzed and extracted using feature engineering;

[0074] Please follow the steps below:

[0075] S2.1: Data merging: Merge the collected data according to the key fields of IP, domain name, and subject to be owned to form a unified data set; and perform data deduplication: during the merging process, remove duplicate data records;

[0076] S2.2: Perform data cleaning, identify data errors, and check whether there are spelling errors, format errors, and logical errors in the data set; for example, whether the format of the IP address is correct, whether the domain name contains illegal characters, etc.

[0077] The mean method is used to fill missing values, detect and process outliers for missing fields or records in the data set, as shown below;

[0078]

[0079] Among them, xi represents the i-th value in the data set, and n represents the total number of values ​​in the data set. represents the sum of all xi from i=1 to i=n;

[0080] Perform data standardization and standardize the data; for example, convert the IP address into a unified format, standardize the domain name, etc. As shown below;

[0081]

[0082] Among them, x is the original data, μ is the mean, and σ is the standard deviation;

[0083] Then, perform feature analysis on the IP, domain name, and subject attributes to find out the meaning, value range, and relationship of the IP, domain name, and subject attributes; perform feature extraction, and extract features based on the results of the attribute analysis;

[0084] For example, features such as network address and subnet mask can be extracted from IP address; features such as top-level domain name and second-level domain name can be extracted from domain name; features such as organization type and geographic location can be extracted from the affiliated entity.

[0085] S3: Based on the attributes and characteristics of the above data, profile the IP, domain name, and subject from the data of association characteristics, naming characteristics, geographic location, operator, service type, and network topology; the dimensions of IP profile are shown in Table 2;

[0086] Table 2 IP portrait dimensions are shown in Table

[0087]

[0088] The domain name portrait dimensions are shown in Table 3;

[0089] Table 3 Domain name portrait dimension table

[0090]

[0091]

[0092] The subject portrait dimensions are shown in Table 4;

[0093] Table 4 Subject portrait dimension table

[0094]

[0095] Please follow the steps below:

[0096] S3.1: First, perform correlation feature analysis. Through DNS resolution, find out the domain name corresponding to the IP address and the IP address resolved by the domain name. Domain name-subject association: Use the WHOIS database to find out the subject information of the domain name registration, including the information of the registrant and the registration institution.

[0097] S3.2: Perform naming feature analysis, analyze the domain name naming rules, domain name naming patterns, and subject naming features, analyze the subject's name, abbreviation, and alias information, and extract key information;

[0098] S3.3: Perform geographic location analysis, IP address geographic location, use IP address geographic location database (such as MaxMind GeoIP), map IP address to specific geographic location, and perform domain name and subject geographic location analysis, and determine the domain name and subject geographic location by analyzing the geographic location field in the domain name registration information and subject information;

[0099] S3.4: Perform operator analysis to obtain the IP address operator, and use the IP address operator database to map the IP address to a specific operator (such as ISP, CDN, etc.); then identify the operator information of the domain name and subject, and determine the operator of the domain name and subject by analyzing the operator field in the domain name registration information and subject information;

[0100] S3.5: Obtain the service type information of the IP address, and determine the service type (such as Web service, mail service, etc.) provided by the IP address by analyzing the traffic characteristics and port usage of the IP address; determine the service type of the domain name and subject by analyzing the service description, business type and other fields in the domain name and subject information;

[0101] S3.6: Perform network topology analysis, build a network topology map by analyzing the connection relationship and routing information between IP addresses, and then build a network topology map of domain names and entities by analyzing the association relationship and business transaction information between domain names and entities. In the process of building a network topology map, a clustering algorithm is used to group nodes including IP addresses, domain names or entities, and analyze the potential relationship or structure between them;

[0102] First, we define the similarity measure between nodes, including the Euclidean distance, as follows:

[0103]

[0104] in, x and y are two nodes, specifically the feature vector of the IP address, domain name, or subject, and n is the number of features;

[0105] Then the nodes are divided into different clusters according to the similarity measure, as follows;

[0106]

[0107] in, μj is the center of cluster Cj, xi is a node in cluster Cj;

[0108] After clustering is completed, the quality of the clusters is evaluated and the potential relationships or structures between them are analyzed.

[0109] S4: Input the profiling IP, domain name, and subject into the IP attribution subject recognition model to train the recognition model, deeply explore the association between the attributes and features of each dimension of IP, domain name, and subject, and receive the IP address query request submitted by the user;

[0110] The training of the deep learning model specifically combines the convolutional neural network CNN and the recurrent neural network RNN ​​to build a hybrid neural network architecture to process the above data of different dimensions. The specific steps are as follows:

[0111] S4.1: First, the CNN part is used to extract the association relationship features, routing path features, and character features of the domain name main information, and the CNN is used to extract the spatial features; for example, the local features of the characters are extracted through the convolution layer, and the feature dimension is reduced by the pooling layer; the convolution layer slides on the input data through the convolution kernel or filter, calculates the weighted sum of the local area, and usually adds a bias term, and applies an activation function to extract the spatial features; as shown in the following formula;

[0112]

[0113] Where yij is the value at position (i, j) in the output feature map, x(i+m)(j+n) is the value at position (i+m, j+n) in the input feature map, wmn is the weight of the convolution kernel at position (m, n), b is the bias term, and f is the activation function (e.g. ReLU).

[0114] S4.2: Process time series data through RNN, such as registration or filing time, expiration time, data discovery or update time of IP-related data. Capture long-term dependencies through LSTM long short-term memory network to avoid gradient disappearance, and use RNN to extract time series features;

[0115] In step S4.2, the time series features are extracted using RNN as follows;

[0116] f t =σ(W f ·[h t＝1 ,x t ]+b f )

[0117] Among them, ft is the output of the forget gate, σ is the sigmoid activation function, Wf is the weight matrix of the forget gate, ht-1 is the hidden state of the previous time step, xt is the input of the current time step, and bf is the bias term.

[0118] S4.3: concatenate the feature data extracted by CNN and RNN to form a comprehensive feature vector;

[0119] S4.4: further process the comprehensive feature vector through multiple fully connected layers, and use the comprehensive feature vector data for model training;

[0120] S4.5: Use the cross entropy loss function or the mean square error loss function, and use the Adam optimization algorithm, combined with the learning rate decay strategy to speed up the model training convergence speed; as shown below;

[0121]

[0122] Among them, y i is the true label, p i is the predicted probability;

[0123] S4.6: Add the Dropout method during the training process to randomly discard some neurons to prevent the model from overfitting; and perform incremental learning, support incremental learning, and automatically adjust parameters; when new data is added, the model can automatically adjust parameters to maintain the best performance, as shown in the following formula;

[0124] m t =β1m t-1 +(1-β1)g t

[0125]

[0126] g t represents the gradient, m t and v t are the first-order moment estimate and the second-order moment estimate of the gradient, α is the initial learning rate, β1 and β2 are the decay rates, and ∈ is a small constant added for numerical stability;

[0127] S5: Call the model to identify its owner and integrate other IP attributes to output the final identification result.

[0128] In this embodiment, for example, the received portrait information of a certain IP is shown in Table 5:

[0129] Table 5 Example portrait information table

[0130] Serial number Fields value 1 IP address 103.33.203.11 2 Associated domain name mr3.cloud.qingyun.cn 3 Location Beijing 4 Operators China Unicom

[0131] The received portrait information of a certain domain name is shown in Table 6:

[0132] Table 6 Domain name profile

[0133] Serial number Fields value 1 domain name mr3.cloud.qingyun.cn 2 Associate IP 103.33.203.11 3 Naming Features cloud,qinyun 4 Hosting Services Cloud services (based on the domain name feature "cloud" label)

[0134] The portrait information of a subject is shown in Table 7:

[0135] Table 7 Subject portrait table

[0136]

[0137] Through deep learning methods, we establish the associations of various dimensions between IP, domain name and subject, including: learning and establishing the association between the subject name "Qingyun" and the "qingyun" in the IP-associated domain name in Chinese and Pinyin, learning and establishing the association between the subject's geographical location (Beijing) and the IP geographical location (Beijing). We learn and establish the association between the subject and the domain name on the bearer service (cloud service). In this way, through deep learning, we establish the association between the IP-associated domain name and the subject of Qingyun Network Technology Co., Ltd. from multiple dimensions such as geographical location, naming features, and bearer services, and then indirectly establish the association between IP and subject through the mapping relationship between IP and domain name.

[0138] In this embodiment, the present invention provides an intelligent identification system for IP address ownership based on deep learning, including a data preprocessing module, which performs data collection and integration of public IP address related data, and after cleaning the collected data, uses feature engineering to extract features and construct dimensions for these data, and finally forms training data to be input into a deep learning model for training;

[0139] And based on the extracted features, the IP, domain name, and subject are profiled in dimensions; domain name portrait dimension, subject portrait dimension;

[0140] The deep learning model training module conducts deep learning on the input IP, domain name, and subject portrait information of each dimension. Based on the naming features such as English, abbreviations, Chinese, and pinyin in the domain name and subject name, and combined with the geographical location, operator, service type, contact information, network segment mapping relationship, IP domain name subject mapping relationship and other information, the deep-level correlation between the features of each dimension is established.

[0141] The attribution subject identification module receives the IP address query request submitted by the user and calls the trained deep learning model for real-time prediction. It includes the abnormal data processing function and has an abnormal monitoring submodule to effectively identify special situations such as proxy services and VPNs. Specifically, it includes the comprehensive analysis and judgment of the geographical location of the IP address, routing path information, response time, DNS query and reverse resolution data to eliminate misjudgment caused by abnormal data;

[0142] The result output module finally presents the identification result of the IP address owner to the user in an easy-to-understand manner, including the specific information of the owner and other related information in various dimensions.

[0143] In this embodiment, the present invention provides a computer-storable medium, which includes an embedded processing system and a stored program. When the embedded system control program is running, any one of the above-mentioned methods for intelligently identifying the IP address owner based on deep learning is executed.

[0144] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention has various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for intelligently identifying the IP address owner based on deep learning, characterized in that: Please follow the steps below: S1: First, collect and integrate the public IP address related data, which includes the mapping relationship between IP, domain name, and the subject of ownership; S2: The data in step S1 is integrated and cleaned, and then its attributes and features are analyzed and extracted using feature engineering; S3: Based on the attributes and characteristics of the above data, profile the IP, domain name, and subject from the data of association characteristics, naming characteristics, geographic location, operator, service type, and network topology; S4: Input the profiling IP, domain name, and subject into the IP attribution subject recognition model to train the recognition model, deeply explore the association between the attributes and features of each dimension of IP, domain name, and subject, and receive the IP address query request submitted by the user; S5: Call the model to identify its owner and integrate other IP attributes to output the final identification result.

2. According to claim 1, a method for intelligently identifying the IP address owner based on deep learning, characterized in that: In step S1, the mapping relationship includes the association information between IP and domain name, IP and subject, domain name and subject, and the filing information related to IP, domain name and subject. The filing information includes the filing name, contact information, service type, geographic location, operator, validity period attribute information, and IP-related network topology information, specifically including routing path and network delay data.

3. According to claim 1, a method for intelligently identifying the IP address subject based on deep learning, characterized in that: In step S2, the following steps are specifically performed: S2.1: Data merging: Merge the collected data according to the key fields of IP, domain name, and subject to be owned to form a unified data set; and perform data deduplication: during the merging process, remove duplicate data records; S2.2: Perform data cleaning, identify data errors, and check whether there are spelling errors, format errors, and logical errors in the data set; The mean method is used to fill missing values, detect and process outliers for missing fields or records in the data set, as shown below; Among them, xi represents the first i numerical values, n Represents the total number of values ​​in the data set. Indicates from i＝ 1 arrive i＝n all xi of and; Perform data standardization and standardize the data; as follows; in, x is the original data, μ is the mean, σ is the standard deviation; Then perform feature analysis on the IP, domain name, and attribution subject attributes to analyze the meaning, value range, and relationship of the IP, domain name, and attribution subject attributes; and perform feature extraction to extract features based on the results of the attribute analysis.

4. According to claim 1, a method for intelligently identifying an IP address owner based on deep learning, characterized in that: In step S3, the following steps are specifically performed: S3.1: First, perform correlation feature analysis. Through DNS resolution, find out the domain name corresponding to the IP address and the IP address resolved by the domain name. Domain name-subject association: Use the WHOIS database to find out the subject information of the domain name registration, including the information of the registrant and the registration institution. S3.2: Perform naming feature analysis, analyze the domain name naming rules, domain name naming patterns, and subject naming features, analyze the subject's name, abbreviation, and alias information, and extract key information; S3.3: Perform geographic location analysis, IP address geographic location, use the IP address geographic location database to map the IP address to a specific geographic location, and perform the geographic location of the domain name and subject, and determine the geographic location of the domain name and subject by analyzing the geographic location field in the domain name registration information and subject information; S3.4: Perform operator analysis to obtain the IP address operator, and use the IP address operator database to map the IP address to a specific operator; then identify the operator information of the domain name and subject, and determine the operator of the domain name and subject by analyzing the operator field in the domain name registration information and subject information; S3.5: Obtain the service type information of the IP address, determine the service type provided by the IP address by analyzing the traffic characteristics and port usage of the IP address; determine the service type of the domain name and subject by analyzing the service description, business type and other fields in the domain name and subject information; S3.6: Conduct network topology analysis. Build a network topology map by analyzing the connection relationship and routing information between IP addresses. Then build a network topology map of domain names and entities by analyzing the association relationship and business transaction information between domain names and entities.

5. According to claim 4, a method for intelligently identifying the IP address owner based on deep learning is characterized in that: In the process of constructing a network topology graph, clustering algorithms are used to group nodes including IP addresses, domain names or entities, and analyze the potential relationships or structures between them; First, we define the similarity measure between nodes, including the Euclidean distance, as follows: in, x and y are two nodes, specifically the feature vector of the IP address, domain name, or subject, and n is the number of features; Then the nodes are divided into different clusters according to the similarity measure, as follows; in, μj It is a cluster C j The center of xi It is a cluster C j Nodes in After clustering is completed, the quality of the clusters is evaluated and the potential relationships or structures between them are analyzed.

6. According to claim 1, a method for intelligently identifying an IP address owner based on deep learning, characterized in that: In step S4, the training of the deep learning model specifically combines the convolutional neural network CNN and the recurrent neural network RNN ​​to construct a hybrid neural network architecture to process the above data of different dimensions, which is specifically performed in the following steps: S4.1: First, the CNN part is used to extract the association features, routing path features, and character features of the domain name main information, and the CNN is used to extract the spatial features; S4.2: Process time series data through RNN; capture long-term dependencies through LSTM long short-term memory network to avoid gradient disappearance, and use RNN to extract time series features; S4.3: concatenate the feature data extracted by CNN and RNN to form a comprehensive feature vector; S4.4: further process the comprehensive feature vector through multiple fully connected layers, and use the comprehensive feature vector data for model training; S4.5: Use the cross entropy loss function or the mean square error loss function, and use the Adam optimization algorithm, combined with the learning rate decay strategy to speed up the convergence of model training; S4.6: Add the Dropout method during the training process to randomly discard some neurons to prevent the model from overfitting; and perform incremental learning, support incremental learning, and automatically adjust parameters.

7. The method for intelligently identifying the IP address owner based on deep learning according to claim 6 is characterized in that: In step S4.1, the convolution layer slides over the input data through the convolution kernel or filter, calculates the weighted sum of the local area, and usually adds a bias term, and applies an activation function to extract spatial features; As follows; Among them, yij is the value of position (i, j) in the output feature map, x(i+m)(j+n) is the value of position (i+m,j+n) in the input feature map, wmn is the weight of the convolution kernel at position (m,n), b is the bias term, and f is the activation function.

8. The method for intelligently identifying the IP address owner based on deep learning according to claim 6 is characterized in that: In step S4.2, the time series features are extracted using RNN as follows; f t =σ(W f ·[h t＝1 ,x t ]+b f ) Among them, ft is the output of the forget gate, σ is the sigmoid activation function, Wf is the weight matrix of the forget gate, ht-1 is the hidden state of the previous time step, xt is the input of the current time step, and bf is the bias term.

9. An intelligent identification system for IP address ownership based on deep learning, characterized in that: It includes a data preprocessing module, which collects data and integrates public IP address-related data. After cleaning the collected data, it uses feature engineering to extract features and construct dimensions for these data, and finally forms training data to be input into the deep learning model for training; And based on the extracted features, dimensional profiling of IP, domain name, and subject is performed; Domain name portrait dimension and subject portrait dimension; The deep learning model training module conducts deep learning on the input IP, domain name, and subject portrait information of each dimension. Based on the naming features such as English, abbreviations, Chinese, and pinyin in the domain name and subject name, and combined with the geographical location, operator, service type, contact information, network segment mapping relationship, IP domain name subject mapping relationship and other information, the deep-level correlation between the features of each dimension is established. The attribution subject identification module receives the IP address query request submitted by the user and calls the trained deep learning model for real-time prediction. It includes the abnormal data processing function and has an abnormal monitoring submodule to effectively identify special situations such as proxy services and VPNs. Specifically, it includes the comprehensive analysis and judgment of the geographical location of the IP address, routing path information, response time, DNS query and reverse resolution data to eliminate misjudgment caused by abnormal data; The result output module finally presents the identification result of the IP address owner to the user in an easy-to-understand manner, including the specific information of the owner and other related information in various dimensions.

10. A computer storable medium, characterized in that: The computer-readable storage medium includes an embedded processing system and a stored program, and when the embedded system control program is running, a method for intelligently identifying an IP address owner based on deep learning as described in any one of claims 1 to 8 is executed.

Images