Method for detecting early malicious traffic of Internet of Things in combination with domain name and DNS (Domain Name Server) traffic characteristics

Abstract

The invention provides an Internet of Things early-stage malicious traffic detection method combining a domain name and DNS traffic characteristics, and the method is divided into four parts: the first part is traffic capturing and filtering; the method comprises the following steps: 1, extracting DNS traffic information, 2, training a detection model, and 4, detecting malicious traffic of the Internet of Things, and specifically comprises the following steps: extracting traffic characteristics such as an Internet of Things DNS domain name and query information; dNS domain name features are learned by using a long and short term memory model with a multi-head attention mechanism, DNS traffic features are extracted by using a convolutional neural network, and detection is performed in the early stage of malicious traffic occurrence. According to the method provided by the invention, the malicious traffic of the Internet of Things can be quickly and efficiently detected in the early stage, the recognition accuracy reaches 98%, and the model training time and the detection time are short. The method for detecting the malicious traffic in the early stage is convenient for a network manager to quickly respond and protect the Internet of Things equipment.

Description

Technical Field

[0001] The present invention belongs to the technical field of cyberspace security and relates to an early malicious traffic detection method for the Internet of Things combining domain name and DNS traffic characteristics. Background Art

[0002] The Internet of Things refers to a system that connects various physical devices, sensors, software and other technologies through the network for data exchange and communication. These devices usually have the ability to sense, calculate, process and communicate, and have the ability to collect and transmit information in real time.

[0003] It is reported that in terms of regional distribution, the number of IoT devices in China exceeds 500 million, and the number of IoT devices in North America and Europe exceeds 300 million, respectively, proving that IoT technology has been widely adopted and implemented worldwide, and it is expected that the number and scale of IoT devices will continue to expand in the future. With the rapid development of its scale, the potential security issues of the devices have gradually attracted people's attention. Currently, IoT devices have serious security vulnerabilities. Due to the unique characteristics of lightweight and low-cost devices of IoT devices, their operating systems mostly use customized systems, which are rarely maintained and updated, and cannot provide sufficient protection against modern viruses and vulnerabilities. Secondly, general users will ignore the maintenance of IoT device account passwords, and attackers can easily control these IoT devices by using weak password login credentials and default account passwords. In addition, many IoT device vendors produce devices with weak authentication policies, which can be easily cracked by weak password combinations, so that attackers can use known vulnerabilities to control devices and complete attack purposes.

[0004] In order to protect IoT devices from malware attacks, existing research on IoT devices mostly relies on the statistical characteristics of malicious traffic, and identifies potential abnormal traffic by deeply mining the behavioral characteristics of abnormal traffic. However, this method mainly relies on the acquisition of complete original network traffic and the analysis of statistical characteristics, which greatly limits its ability in early detection. It requires the end of the attack flow or a certain time window to complete the detection, resulting in a certain lag in its detection results.

[0005] Therefore, the present invention filters the DNS query traffic of early malware communications in the network. The method focuses on DNS traffic, combines DNS domain name features and DNS traffic features to form a DNS query feature set, and uses deep learning to train the model, which is more conducive to real-time threat detection. At the same time, it can achieve early malicious traffic detection of the Internet of Things in a lighter way, thereby improving the efficiency of detecting infected Internet of Things devices. Summary of the invention

[0006] In order to effectively identify malicious traffic and realize early malicious traffic detection in the Internet of Things, the present invention proposes an early malicious traffic detection method for the Internet of Things that combines domain name and DNS traffic features. Aiming at the problem that it is difficult to realize early detection of malicious traffic in the Internet of Things in existing research, an early malicious traffic detection method for the Internet of Things based on attention is proposed. This method is based on the DNS query traffic in the early stage of malware communication, and converts the malicious traffic detection problem into a binary classification problem of multi-dimensional features of DNS query data packets. First, the text features of the query domain name and the header and connection features of the DNS query data packet are extracted; then, the long short-term memory neural network based on the multi-head attention mechanism is used to fully mine the distinguishable features of the domain name samples, and the convolutional neural network is used to extract the key information of the DNS query data packet; finally, the two features are spliced ​​and the feature vector is classified using a fully connected layer to realize traffic detection.

[0007] In order to achieve the above object, the present invention provides the following technical solutions:

[0008] An early malicious traffic detection method for the Internet of Things combining domain name and DNS traffic characteristics, comprising the following steps:

[0009] (1) Based on the perspective of early identification of malicious traffic in the Internet of Things, we start with the DNS query traffic of the Internet of Things, analyze the characteristics of the DNS query traffic, and use traffic extraction tools to screen and filter the DNS traffic;

[0010] (2) Analyze the filtered DNS traffic, select domain name features and traffic features respectively, and obtain the text features of the query domain name and the corresponding DNS query data packet header and connection features;

[0011] (3) Use deep learning methods to detect early malicious traffic in the Internet of Things, build data sets to train models, and evaluate models;

[0012] (4) Input the IoT traffic to be tested into the trained model for testing.

[0013] Furthermore, the step (1) specifically includes the following sub-steps:

[0014] (1.1) Use network analysis tools to monitor network traffic and capture packets at intermediate routers;

[0015] (1.2) Use network analysis tool commands to screen and filter DNS traffic.

[0016] Furthermore, the step (2) specifically includes the following sub-steps:

[0017] (2.1) The network traffic analysis tool analyzes the DNS query message obtained in step (1.2) to extract the timing characteristics and connection characteristics of the DNS traffic;

[0018] (2.2) Use the network traffic analysis tool ZeeK to obtain the domain name query features of the DNS query, and combine them with the features obtained in step (2.1) to form a DNS query feature set.

[0019] Further, the DNS query feature set features extracted by the present invention are shown in Table 1:

[0020] Table 1:

[0021]

[0022] Furthermore, the step (3) specifically includes the following sub-steps:

[0023] (3.1) Processing the obtained DNS query feature set and dividing it into a model training set and a test set; preprocessing the DNS query feature set obtained in step (2.2);

[0024] (3.2) For the domain name feature part, first clean the domain name text and remove non-alphanumeric characters in the domain name. Then build a dictionary of characters, a total of 38 characters, and replace each character with the corresponding index so that the text data is converted into a numerical format that the model can process. Finally, the domain name feature sequence is kept at a fixed length of 40, and the shorter sequences are filled with 0 to ensure that the length of all input sequences is consistent;

[0025] (3.3) For the DNS connection features and query features, we first use the median filling interpolation technique to fill the missing values, and use the independent hot encoding technique for non-numeric fields to convert the values ​​that cannot be recognized by the model into corresponding numerical forms. Finally, we use normalization processing for the numerical values ​​and map the data values ​​to [0,1] to eliminate the scale differences caused by the different dimensions of different features.

[0026] (3.4) Use a long short-term memory model based on an attention mechanism to fully exploit the distinguishable features of domain name samples, and use a multi-head attention mechanism to process the input text sequence. Each attention head calculates the attention score from a different subspace, assigning higher weights to important parts of the sequence, and capturing key information distributed at different positions in the sequence;

[0027] (3.5) Use a one-dimensional convolutional neural network to extract DNS traffic features. Through multi-layer convolution and pooling operations, capture key information and abnormal behaviors in the connection process. Use two convolution layers, two pooling layers, one Flatten layer, one Dropout layer and a fully connected layer to extract the selected DNS traffic features.

[0028] (3.6) The domain name text features extracted by the multi-head attention LSTM and the DNS traffic features extracted by the CNN are concatenated, and a classifier composed of a stacked fully connected layer structure consisting of three fully connected layers stacked in sequence and a softmax classification layer is used for the prediction task;

[0029] (3.7) The training set is used for model training, and the test set is used to update the model parameters; and other deep learning algorithms: LSTM and CNN are used to compare the methods used from multiple indicators.

[0030] Furthermore, the step (4) specifically includes the following sub-steps:

[0031] (4.1) The unidentified early malicious traffic of IoT is processed in the same way as (2.2) to obtain the features, and the DNS query feature set of the unidentified traffic is obtained;

[0032] (4.2) The obtained DNS query feature set is input into the model for detection, and whether it is malicious IoT traffic is determined based on the output results, thereby detecting malicious IoT traffic in the early infection stage.

[0033] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the method for detecting early malicious traffic in the Internet of Things that combines domain name and DNS traffic characteristics is implemented.

[0034] A computer-readable storage medium stores computer instructions, which, when executed by a processor, implement the method for detecting early malicious traffic in the Internet of Things that combines domain name and DNS traffic characteristics.

[0035] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0036] (1) The present invention can effectively identify malware traffic in the early stage of malware attack, with a detection accuracy of more than 98%, and can detect malicious traffic in the Internet of Things at the early infection stage.

[0037] (2) Compared with the conventional method of using complete malicious traffic of IoT, the present invention is more lightweight and effectively improves the efficiency of detecting malicious traffic of IoT.

[0038] (3) This paper proposes a new feature selection measurement method, which innovatively combines the DNS query domain name and DNS query traffic characteristics of the Internet of Things to identify malicious traffic in the Internet of Things. The proposed feature extraction and selection method improves the model efficiency.

[0039] (4) Compared with the current mainstream model, the method of the present invention shortens the training time by nearly half while maintaining the same average detection accuracy, precision and other indicators, greatly saving training time and detection time; and compared with the model with similar training time, the method of the present invention improves the detection accuracy, precision and other indicators by 1%. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 Identification framework diagram;

[0041] Figure 2 Comparison of accuracy of each model in ablation experiment;

[0042] Figure 3 Confusion matrix results of an early malicious traffic detection method for IoT combining domain name and DNS traffic features;

[0043] Figure 4 Compare with other mainstream models in terms of training time and accuracy;

[0044] Figure 5 Comparison of detection time with other mainstream models. DETAILED DESCRIPTION

[0045] The technical solution provided by the present invention will be described in detail below in conjunction with specific embodiments. It should be understood that the following specific implementation methods are only used to illustrate the present invention and are not used to limit the scope of the present invention.

[0046] Embodiment 1: The present invention proposes an IoT early malicious traffic detection method combining domain name and DNS traffic characteristics. The detection framework diagram is as follows: Figure 1 As shown in the figure, it is divided into four parts. The first part is to filter DNS traffic. Specifically, from the perspective of early identification of malicious traffic in the Internet of Things, starting from the DNS query traffic and domain name of the Internet of Things, the DNS traffic is obtained by filtering and filtering using traffic extraction tools. The second part is to extract features from DNS traffic. Specifically, the Zeek tool is used to batch parse DNS traffic packets to obtain key log files, including detailed information of DNS queries and network connection details, so as to reveal abnormal DNS activities caused by malware or data leakage. The third part uses deep learning methods to detect early malicious traffic in the Internet of Things. Specifically, the long short-term memory model with attention mechanism is used to mine the distinguishable features of domain name samples, and the convolutional neural network is used to extract DNS traffic features to distinguish normal traffic from malicious Internet of Things DNS traffic. The fourth part is to detect early malicious traffic in the Internet of Things. Specifically, the Internet of Things traffic to be detected is input into the model for detection.

[0047] Specifically, an efficient detection method for early malicious traffic in the Internet of Things includes the following steps:

[0048] (1) Deploy traffic extraction tools at key network nodes to filter and screen IoT DNS traffic.

[0049] The specific process of this step is as follows:

[0050] (1.1) Deploy packet capture tools at key nodes such as intermediate routers, such as Wireshark and Tshark, to capture data packets in network traffic in real time.

[0051] (1.2) Use the Tshark tool command to filter and obtain DNS traffic. Run the command: "tshark-Y "dns" -T fields-e dns.qry.name-e dns.qry.type-e frame.time-r [pcap] > dns.pcap".

[0052] (2) Extract features from DNS traffic to obtain key log files, including detailed information on DNS queries and network connections, to reveal abnormal DNS activities caused by malware or data leaks.

[0053] The specific process in this step is as follows:

[0054] (2.1) Use Zeek network traffic analysis tool to analyze the traffic packets in depth. Run the command: "zeek-r [dns.pcap]>conn.log, dns.log" to get the key log files dns.log and conn.log. The dns.log file records the detailed information of the DNS query, including the query timestamp, domain name, query type, response code, etc. The conn.log file records the details of the network connection, such as the start and end time of the connection, the source and destination IP addresses and ports, the protocol type, the connection status, etc.

[0055] (2.2) Based on the log files obtained in (2.1), extract and construct a DNS query feature set. The specific process includes traversing each record in dns.log and conn.log, finding the corresponding key fields and adding them to the DNS feature list. The specific fields and corresponding meanings of the extracted DNS query feature set are shown in Table 2

[0056] Table 2:

[0057]

[0058] (3) After the DNS query feature set is completed and obtained, the feature set is used as a data set and divided into a training set and a test set. A long short-term memory model based on an attention mechanism is used to fully mine the distinguishable features of domain name samples, and a convolutional neural network is used to extract DNS traffic features. Finally, the two features are concatenated and the feature vector is classified using a fully connected layer to achieve traffic detection.

[0059] The specific process in this step is as follows:

[0060] (3.1) The obtained DNS query feature set is processed in the same way as the training and test sets.

[0061] (3.2) Domain name feature part: First, the domain name text is cleaned, including removing non-alphanumeric characters in the domain name, such as underscores, hyphens, and other special symbols, to reduce the noise of the input data. A dictionary is constructed for the characters, totaling 38 characters. Each character is replaced with the corresponding index, so that the text data is converted into a numerical format that the model can process. Considering the diversity of character lengths, the input feature sequence is kept at a fixed length of 40, and the shorter sequences are padded with 0 to ensure that the length of all input sequences is consistent.

[0062] (3.3) DNS connection features and query features. For the features selected in Table 2, we first use the median filling interpolation technique to fill in the missing values. For non-numeric fields, we use the independent hot encoding technique to convert values ​​that cannot be recognized by the model into corresponding numerical forms. Finally, we use normalization processing for the numerical values ​​and map the data values ​​to [0, 1] to eliminate the scale differences caused by the different dimensions of different features.

[0063] (3.4) In the model part, a long short-term memory model based on an attention mechanism is used to fully exploit the distinguishable features of domain name samples. Specifically, a multi-head attention mechanism is used to effectively capture the time series dependencies and key information in domain name text data. A convolutional neural network is used to extract DNS traffic features.

[0064] Specifically, the LSTM model based on the multi-head attention mechanism can more effectively capture the time series dependency and key information in the domain name text data. First, the domain name character feature obtained after the preprocessing in step (2) is input into the word embedding layer, and the domain name feature is mapped to a higher dimension. A high-dimensional domain name feature representation with a fixed dimension is obtained by mapping through a word embedding layer. Then, the domain name text data is processed in parallel through different attention heads, and each attention head focuses on capturing different aspects of the data, such as semantic depth and contextual connection. The attention calculation formula is as follows:

[0065]

[0066] Where Q is the query matrix, K is the key matrix, V is the value matrix, and d K is the dimension of the key vector, and softmax(·) is the normalized exponential function. The multi-head attention mechanism introduces multiple subspace representations based on self-attention. The specific calculation formulas are shown in the following two formulas:

[0067] head i =Attention(QW i Q ,KW i K ,VW i V )

[0068] MultiHead(Q,K,V)=Concat(head1,…,head h )

[0069] Among them, QWi i Q , W i K and VW i V It is a learnable weight matrix used to convert the input into the appropriate dimension. After the query domain name text vector passes through the multi-head attention channel, it is input into the LSTM layer to further enhance the model's memory ability for text sequence data. LSTM effectively manages information flow through its unique gating mechanism, that is, it filters out unnecessary short-term noise while retaining long-term dependency information. It is particularly suitable for processing DNS query data that requires long-term memory and complex time-dependent resolution.

[0070] Specifically, a one-dimensional convolutional neural network is used to analyze the connection features and query features extracted from DNS traffic, capturing key information and abnormal behaviors in the connection process. Through multi-layer convolution and pooling operations, the model can extract key features from high-dimensional data. The present invention uses two convolutional layers, two pooling layers, one Flatten layer, one Dropout layer, and a fully connected layer to extract the selected DNS traffic features.

[0071] The convolution layer is used to perform convolution operations on the input data through a set of learned filters to extract local features from the DNS traffic data. The maximum pooling is used to divide the input data area into several rectangular areas and output the maximum value of each area to capture feature representations at a more abstract level and reduce the spatial dimension of the feature map, thereby improving the computational efficiency of the model. The Flatten layer converts the multi-dimensional DNS features output by the convolution layer into a one-dimensional vector. The process can be simply expressed by the following formula:

[0072] Flatten(D,H,W)=Vector(D·H·W)

[0073] Where D, H, and W represent the sizes of different dimensions. The Dropout layer randomly discards a portion of the neuron data in the network to prevent the model from overfitting. Finally, the fully connected layer is used to perform weighted summation on the output DNS feature vector of the dropout layer to achieve the mapping from feature extraction to decision output.

[0074] Finally, the classification module concatenates the two features and uses a fully connected layer to classify the feature vectors to achieve traffic detection. The output feature vectors of the multi-head attention LSTM and CNN come from two different dimensions. The present invention concatenates the domain name text features extracted by the multi-head attention LSTM and the DNS traffic features extracted by CNN to form a vector set containing the two features. A classifier composed of a stacked fully connected layer structure consisting of three fully connected layers stacked in sequence and a softmax classification layer is used for the prediction task. The expression after feature fusion is as follows:

[0075] merge=Concatenate(A,B)

[0076] Among them, A and B are two sets of features, and merge is the feature representation after the features are concatenated. The fully connected layer extracts and integrates the concatenated feature vectors and converts them to lower dimensions while ensuring the retention of key information. The features are then handed over to the softmax function to map the feature vector to the [0,1] interval, and the output of the entire vector is normalized to obtain the final prediction result.

[0077] The model hyperparameters used in the present invention are set as follows: The hyperparameter settings of the model include the following: 80 rounds were carried out during the model training process, the batch size was 32, and the learning rate was 0.0001. The model adopts the Dropout mechanism, the coefficient is set to 0.3, Adam is selected as the optimizer, and sparse classification cross entropy is used as the loss function. In the LSTM layer based on the multi-head attention mechanism, the input dimension is set to 95, the word embedding dimension is 100, the number of attention heads is 10, and the hidden unit size and output dimension are both 128. In the one-dimensional convolutional neural network part, two convolutional layers are used, both using 64 filters, the kernel size is 2, and the activation function is ReLU. Pooling layers are used after the two convolutional layers, respectively, with a window size and a step size of 3. The convolutional neural network layer finally uses a fully connected layer as the feature output layer, with an output dimension of 16 and an activation function of softmax(). The outputs of the multi-head attention LSTM and CNN are fused using the feature fusion layer Concatenate(). In the classification module, three fully connected layers are used as hidden layers, and the first two fully connected layers are followed by RELU as the activation function. The last fully connected layer is connected with softmax as the activation function to obtain the final output.

[0078] The specific ablation experiment results are as follows Figure 2 shown.

[0079] (3.5) Evaluate the accuracy, training and detection time of the IoT early malicious traffic detection method that combines domain name and DNS traffic characteristics. Compared with the current mainstream model, the method of the present invention greatly reduces the training time and test time when the detection accuracy and other indicators are the same. The test time is reduced by nearly 100 times. The reason is that compared with other models, this model only selects DNS traffic, which improves the efficiency of the model. Similarly, compared with the model that only uses DNS traffic, the accuracy of this model is improved by 1% when the training time is similar. The specific detection results and time are as follows: Figure 3 , Figure 4 , Figure 5 shown.

[0080] (4) Early detection of malicious traffic in the IoT

[0081] This step specifically includes the following processes:

[0082] (4.1) The unidentified early malicious traffic of IoT is processed in the same way as (2.2) to obtain the DNS query feature set of the unidentified traffic.

[0083] (4.2) The obtained DNS query feature set is input into the model for detection, and the model determines whether it is malicious traffic.

[0084] Embodiment 2: An electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for detecting early malicious traffic in the Internet of Things combining domain name and DNS traffic characteristics is implemented.

[0085] Embodiment 3: A computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implements the method for early malicious traffic detection in the Internet of Things that combines domain name and DNS traffic characteristics.

[0086] The technical means disclosed in the scheme of the present invention are not limited to the technical means disclosed in the above-mentioned implementation mode, but also include technical schemes composed of any combination of the above-mentioned technical features. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications are also regarded as the protection scope of the present invention.

Claims

1. An IoT early malicious traffic detection method combining domain name and DNS traffic characteristics, characterized in that: The steps include: (1) Based on the perspective of early identification of malicious IoT traffic, we start with the IoT DNS query traffic and use traffic extraction tools to screen and filter the DNS traffic; (2) Analyze the filtered DNS traffic, select domain name features and traffic features respectively, and obtain the text features of the query domain name and the corresponding DNS query data packet header and connection features; (3) Use deep learning methods to detect early malicious traffic in the Internet of Things, build data sets to train models, and evaluate models; (4) Input the IoT traffic to be tested into the trained model for testing.

2. The method for early malicious traffic detection in the Internet of Things combining domain name and DNS traffic characteristics according to claim 1 is characterized in that: Step (1) uses a traffic extraction tool to screen and filter DNS traffic; specifically includes the following sub-steps: (1.1) Use network analysis tools to monitor network traffic and capture packets at intermediate routers; (1.2) Use network analysis tool commands to screen and filter DNS traffic; Step (2) analyzes the filtered DNS traffic; specifically includes the following sub-steps: (2.1) The network traffic analysis tool analyzes the DNS query message obtained in step (1.2) to extract the timing characteristics and connection characteristics of the DNS traffic; (2.2) Use the network traffic analysis tool ZeeK to obtain the domain name query features of the DNS query, and combine them with the features obtained in step (2.1) to form a DNS query feature set.

3. The method for early malicious traffic detection in the Internet of Things combining domain name and DNS traffic characteristics according to claim 2 is characterized in that: The features extracted from the DNS query feature set in step (2.2) are shown in the following table:

4. The method for early malicious traffic detection in the Internet of Things combining domain name and DNS traffic characteristics according to claim 3 is characterized in that: Step (3) specifically includes the following sub-steps: (3.1) Process the obtained DNS query feature set and divide it into a set for model training and a set for testing; Preprocess the DNS query feature set obtained in step (2.2); (3.2) For the domain name feature part, first clean the domain name text, remove non-alphanumeric characters in the domain name, and build a dictionary of characters, a total of 38 characters, replace each character with the corresponding index so that the text data is converted into a numerical format that the model can process. Finally, the domain name feature sequence is kept at a fixed length of 40, and the shorter sequence is filled with 0 to ensure that the length of all input sequences is consistent; (3.3) For the DNS connection features and query features, we first use the median filling interpolation technique to fill the missing values, and use the independent hot encoding technique for non-numeric fields to convert the values ​​that cannot be recognized by the model into corresponding numerical forms. Finally, we use normalization processing for the numerical values ​​and map the data values ​​to [0,1] to eliminate the scale differences caused by the different dimensions of different features. (3.4) Use a long short-term memory model based on an attention mechanism to fully exploit the distinguishable features of domain name samples, and use a multi-head attention mechanism to process the input text sequence. Each attention head calculates the attention score from a different subspace, assigning higher weights to important parts of the sequence, and capturing key information distributed at different positions in the sequence; (3.5) Use a one-dimensional convolutional neural network to extract DNS traffic features. Through multi-layer convolution and pooling operations, capture key information and abnormal behaviors in the connection process. Use two convolution layers, two pooling layers, one Flatten layer, one Dropout layer and a fully connected layer to extract the selected DNS traffic features. (3.6) The domain name text features extracted by the multi-head attention LSTM and the DNS traffic features extracted by the CNN are concatenated, and a classifier composed of a stacked fully connected layer structure consisting of three fully connected layers stacked in sequence and a softmax classification layer is used for the prediction task; (3.7) The preprocessed training set is used for model training, and the test set is used to update the model parameters; and other deep learning algorithms: LSTM and CNN are used to compare the methods used from multiple indicators.

5. The method for early malicious traffic detection in the Internet of Things combining domain name and DNS traffic characteristics according to claim 4 is characterized in that: In step (3.4), the LSTM model based on the multi-head attention mechanism can more effectively capture the time series dependency and key information in the domain name text data. First, the domain name character features obtained after the preprocessing in step (2) are input into the word embedding layer, and the domain name features are mapped to a higher dimension to obtain a high-dimensional domain name feature representation. Then, the domain name text data is processed in parallel through different attention heads. The attention calculation formula is as follows: Among them, Q represents the query matrix, K represents the key matrix, V represents the value matrix, and d K is the dimension of the key vector, softmax(·) is the normalized exponential function, and the multi-head attention mechanism introduces multiple subspace representations based on self-attention. The specific calculation formulas are shown in the following two formulas: head i =Attention(QW i Q ,KW i K ,VW i V ) MultiHead(Q,K,V)=Concat(head1,…,head h ) Among them, QW i Q , W i K and VW i V It is a learnable weight matrix used to convert the input into an appropriate dimension. After the query domain name text vector passes through the multi-head attention channel, it is input into the LSTM layer to further enhance the model's memory ability for text sequence data.

6. The method for early malicious traffic detection in the Internet of Things combining domain name and DNS traffic characteristics according to claim 5 is characterized in that: In step (3.5), the convolution layer is used to perform convolution operations on the input data through a set of learned filters to extract local features in the DNS traffic data, and use maximum pooling to divide the input data area into several rectangular areas and output the maximum value of each area to capture feature representations at a more abstract level and reduce the spatial dimension of the feature map, thereby improving the computational efficiency of the model. The Flatten layer converts the DNS multi-dimensional features output by the convolution layer into a one-dimensional vector. The process is simply expressed by the following formula: Flatten(D,H,W)=Vector(D·H·W) Among them, D, H, and W represent the sizes of different dimensions respectively. Then the Dropout layer randomly discards part of the neuron data in the network to prevent the model from overfitting. Finally, the fully connected layer is used to perform weighted summation on the output DNS feature vector of the dropout layer to achieve the mapping from feature extraction to decision output.

7. The method for early malicious traffic detection in the Internet of Things combining domain name and DNS traffic characteristics according to claim 6 is characterized in that: In step (3.6), two features are concatenated and the feature vector is classified using a fully connected layer to achieve traffic detection. The output feature vectors of the multi-head attention LSTM and CNN come from two different dimensions. A classifier composed of a stacked fully connected layer structure consisting of three fully connected layers stacked in sequence and a softmax classification layer is used for the prediction task. The expression after feature fusion is as follows: merge=Concatenate(A,B) Among them, A and B are two sets of features, merge is the feature representation after splicing the features, the fully connected layer extracts and integrates the spliced ​​feature vectors, and converts them into lower dimensions while ensuring the retention of key information. The features are then handed over to the softmax function to map the feature vector to the [0,1] interval, and the output of the entire vector is normalized to obtain the final prediction result.

8. The method for early malicious traffic detection in the Internet of Things combining domain name and DNS traffic characteristics according to claim 3 is characterized in that: Step (4) specifically includes the following sub-steps: (4.1) The unidentified early malicious traffic of IoT is processed in the same way as (2.2) to obtain the features, and the DNS query feature set of the unidentified traffic is obtained; (4.2) The obtained DNS query feature set is input into the model for detection, and whether it is malicious IoT traffic is determined based on the output results, thereby detecting malicious IoT traffic in the early infection stage.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method for early malicious traffic detection in the Internet of Things combining domain name and DNS traffic characteristics as described in any one of claims 1 to 8 above is implemented.

10. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instruction is executed by the processor, the method for early malicious traffic detection in the Internet of Things combining domain name and DNS traffic characteristics as described in any one of claims 1-8 is implemented.

Images