Defective domain name identification method and device based on hypergraph neural network model
Through the method based on the hypergraph neural network model, hypergraphs are constructed and self-attention mechanism and convolution module are used to solve the problem of poor domain names that are difficult to identify complex multivariate relationships in the existing technology, and higher recognition accuracy and model stability are achieved.
Patent Information
- Application Number
- CN202411315793.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-20
- Publication Date
- 2025-02-25
AI Technical Summary
It is difficult for the prior art to effectively identify bad domain names with complex and diverse relationships, and it is difficult for a simple graph to capture high-order correlations between domain names.
Using a method based on the hypergraph neural network model, the hypergraph neural network model is constructed, and the model is trained using the training set, and the self-attention mechanism and convolution module are used to mine the influencing relationship between domain names, and ultimately the identification of bad domain names is achieved.
By more accurately modeling the diverse relationships between domain names, the accuracy of bad domain name recognition is improved, information loss is avoided, and the stability and recognition accuracy of the model are improved through attention mechanism and residual convolution.
Smart Images
Figure CN119513751A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the field of information technology, and in particular relates to a method and device for identifying bad domain names based on a hypergraph neural network model. Background Art
[0002] Domain names are important Internet infrastructure and the entrance for people to access the Internet. They play an important supporting role in the normal operation of the Internet. Bad domain names refer to domain names used for websites and apps with illegal and unlawful content. The governance of bad domain names is an important part of cyberspace governance. With the development of science and technology, on the one hand, domain name registration has become more convenient, which has provided convenience to criminals to a certain extent; on the other hand, criminals have used bad domain names more covertly through technological upgrades, which has increased the difficulty of identifying bad domain names.
[0003] Graph neural networks have achieved remarkable results in node classification and have also been applied to the identification of bad domain names. Currently, the application of domain name identification on graph neural networks is mainly concentrated on simple graphs. However, due to the complex multivariate relationships between domain names (associated IP, registrar, etc.), it is not a simple pairwise relationship. Simple graphs are difficult to capture high-order relationships between data. Therefore, compared with general graph structures, hypergraphs can more accurately model the relationship between domain names. Summary of the invention
[0004] In view of the above problems, the present invention provides a method and device for identifying bad domain names based on a hypergraph neural network model.
[0005] The technical solution adopted by the present invention is as follows:
[0006] A method for identifying bad domain names based on a hypergraph neural network model comprises the following steps:
[0007] Obtain domain name data and divide the domain name data into training set and test set;
[0008] Build hypergraphs for training and test sets;
[0009] Build a hypergraph neural network model;
[0010] Use the training set to train the hypergraph neural network model;
[0011] Use the trained hypergraph neural network model to identify bad domain names on the test set.
[0012] Furthermore, the domain name data is divided into a training set and a test set, wherein the training set is the domain names in the known bad domain names and the domain name whitelist, and the test set is the domain names without labels.
[0013] Furthermore, the hypergraph includes a node set and a hyperedge set; the node set is all domain names in a test set or a training set; and the method for establishing hyperedges in the hyperedge set is: based on the resolved IP of the domain name, the ASN code to which the IP belongs, the domain name registrar, and the domain name registration entity, the association strength between the two domain names is calculated. If the association strength is greater than a set threshold, a hyperedge exists between the two domain names, otherwise, no hyperedge exists between the two domain names.
[0014] Furthermore, the correlation strength between the two domain names is calculated using the following formula:
[0015] cor(v1,v2)=ω1|asn(ip(v1)∩ip(v2))|+ω2I A (v1,v2)+ω3I B (v1,v2)
[0016] Where cor(v1,v2) is the correlation strength between the two domain names, v1 and v2 are any two domain name nodes in the node set V, ip(v1) and ip(v2) are the resolution IP sets of v1 and v2 respectively, asn(ip(v1)∩ip(v2)) is the ASN set to which the common resolution IP of domain names v1 and v2 belongs, ω1, ω2, ω3 are the set weight coefficients; I a (x) is an indicative function. If x∈a, then I a (x)=1, otherwise I a (x)=0, event A belongs to the same registrant, and event B belongs to the same registrar; if cor(v1,v2) is greater than the set threshold u, the corresponding hyperedge is generated, otherwise there is no hyperedge between the two domain name nodes.
[0017] Furthermore, the hypergraph neural network model includes a node embedding module, a self-attention update module, a convolution module, and a classification module; the node embedding module is used to perform node embedding to obtain initial input features; the self-attention update module uses a self-attention mechanism to update the association matrix of the hypergraph to mine the influence relationship between nodes; the convolution module continuously updates the node features to obtain the final node features, which are used as input features of the classification module; the prediction result of the classification module and the true label are calculated through the gradient descent algorithm. The cross entropy loss function is used, and the relevant learning parameters are optimized through back propagation to convert the bad domain name identification problem into a binary classification problem, thereby training to obtain the optimal bad domain name classification model.
[0018] Furthermore, the updated association matrix obtained by the self-attention update module is as follows:
[0019]
[0020] in, is the domain name node v iFeatures, is the hyperedge e that contains the domain name node j The feature of , σ is the activation function, sim is the function for calculating the similarity between hyperedges and nodes, and W is the learnable weight matrix.
[0021] Furthermore, the hypergraph convolution propagation process of the convolution module is as follows:
[0022]
[0023] where α l , β l is a hyperparameter, D v is the node degree matrix, is the correlation matrix after being updated by the attention mechanism, D e is the hyperedge degree matrix, X (l) represents the input features of the lth layer, X (0) represents the initial input features, I is the identity matrix, W (l) is the learnable weight matrix of layer l.
[0024] In a second aspect, the present invention provides a device for identifying bad domain names based on a hypergraph neural network model, comprising:
[0025] A domain name data acquisition module is used to acquire domain name data and divide the domain name data into a training set and a test set;
[0026] Hypergraph construction module, used to build hypergraphs for training and test sets;
[0027] Hypergraph neural network model building module, used to build the hypergraph neural network model;
[0028] A hypergraph neural network model training module is used to train the hypergraph neural network model using a training set;
[0029] The bad domain name identification module is used to identify bad domain names in the test set using the trained hypergraph neural network model.
[0030] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing each step in the method of the present invention.
[0031] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the various steps of the method of the present invention are implemented.
[0032] Due to the adoption of the above scheme, the present invention has the following advantages:
[0033] 1) Through specific hyperedge construction rules, the multi-dimensional association relationship between domain names can be more accurately reflected.
[0034] 2) The use of attention mechanism and residual convolution can improve the accuracy of the final classification results to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS
[0035] Figure 1 It is a flowchart of the steps of the method for identifying bad domain names based on a hypergraph neural network model of the present invention.
[0036] Figure 2 It is a schematic diagram of the hypergraph and hypergraph neural network model of the present invention.
[0037] Figure 3 This is a module composition diagram of the bad domain name identification device based on the hypergraph neural network model of the present invention. DETAILED DESCRIPTION
[0038] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below through specific embodiments and drawings.
[0039] The main contents of the present invention include:
[0040] 1) Domain names are not simply paired, and one domain name is usually associated with multiple domain names. To better reflect the complex multivariate relationship between domain names, the present invention constructs domain name hyperedges that conform to specific rules to establish a domain name hypergraph.
[0041] 2) In order to better capture the mutual influence between domain names, the present invention introduces a self-attention mechanism to update the association matrix of the hypergraph (the elements of the association matrix are changed from 0 and 1 to self-attention scores); in order to improve the stability of the model (a model that is too deep may lead to poor classification results), a residual term is added during the propagation of the convolutional layer.
[0042] The present invention proposes a method for identifying bad domain names based on a hypergraph neural network model, the process of which is as follows: Figure 1 As shown, the following steps are included:
[0043] S101: Obtain domain name data and divide the domain name data into a training set and a test set. In this step, the domain name data is divided into a training set and a test set according to whether it has a label.
[0044] S102: Construct a hypergraph for the training set and the test set. This step constructs a hypergraph g = (V, E), where V is a node set consisting of all domain names; E is a hyperedge set, and each hyperedge is a non-empty subset of node V. Based on the resolved IP of the domain name, the ASN code to which the IP belongs, the domain name registrar, the domain name registration entity and other information, the association strength between the two domain names is calculated through a specific calculation formula. If the calculated association strength is greater than the set threshold, there is a hyperedge between the two domain names, otherwise it does not exist.
[0045] S103: Build a hypergraph neural network model. The hypergraph neural network model is mainly divided into a node embedding module, a self-attention update module, a convolution module, and a classification module. The node embedding module is used to embed nodes to obtain initial input features. The self-attention update module uses a self-attention mechanism to update the association matrix of the hypergraph, which can better describe the influence relationship between nodes. The convolution module continuously updates the node features to obtain the final node features, which are used as input features of the classification module.
[0046] S104: Use the training set to train the hypergraph neural network model. The prediction results of the classification module and the true label are used to calculate the cross entropy loss function through the gradient descent algorithm, and the relevant learning parameters are optimized through back propagation to convert the bad domain name identification problem into a binary classification problem, and the optimal classification model is obtained through training.
[0047] S105: Use the trained hypergraph neural network model to identify bad domain names in the test set.
[0048] In one embodiment of the present invention, a method for identifying bad domain names based on a hypergraph neural network model is provided, and the specific steps are described as follows:
[0049] 1) Divide the data into a training set and a test set. The training set data includes known bad domain names (labeled as 1) and domain names in the domain whitelist (labeled as 0), and the test set includes domain name data without labels.
[0050] 2) Construct a hypergraph for the test set and the training set. Taking the test set as an example, the hypergraph of the test set is g = {V, E}, where V is a node set consisting of all the domain names in the test set, and E is a hyperedge set. The hyperedge construction rules are as follows: Let v1 and v2 be any two domain name nodes in V, let ip(v1) and ip(v2) be the resolution IP sets of v1 and v2 respectively, and asn(ip(v1)∩ip(v2)) be the ASN set to which the common resolution IP of domain names v1 and v2 belongs, that is, first take the intersection of the resolution IP set of domain name node v1 and the resolution IP set of domain name node v2, and then obtain the ASN set to which the intersection belongs, and calculate the correlation strength cor(v1, v2) between the two domain names. If cor(v1, v2) is greater than the set threshold u, the corresponding hyperedge is generated, otherwise there is no hyperedge between the two domain name nodes. The calculation formula of cor(v1, v2) is as follows:
[0051] ω1|asn(ip(v1)∩ip(v2))|+ω2I A (v1,v2)+ω3I B (v1,v2)
[0052] Among them, ω1, ω2, ω3 are the set weight coefficients; I a (x) is the indicative function, where a represents A or B in the formula, and x represents v1, v2 in the formula. If x∈a, then I a (x) = 1, otherwise 0, event A belongs to the same domain name registration subject, and event B belongs to the same registrar. The domain name registration subject is the domain name registrant, including domain name registration individuals (natural persons) and domain name registration organizations (enterprises).
[0053] 3) Build a hypergraph neural network model, which is mainly divided into node embedding module, self-attention update module, convolution module and classification module. For a given domain node v i , which is characterized by Hyperedge e containing this node j , which is characterized by The association matrix after being updated by the self-attention update module is as follows:
[0054]
[0055] Where σ is the activation function, sim is the function for calculating the similarity between hyperedges and nodes, a T represents the weight vector of the output scalar similarity value, || is the concatenation operation, and W is the learnable weight matrix.
[0056] The hypergraph convolution propagation process of the convolution module is as follows:
[0057]
[0058] where α l , β l is a hyperparameter, D v is the node degree matrix, is the correlation matrix after being updated by the attention mechanism, D e is the hyperedge degree matrix, X (l) represents the input features of the lth layer, X (0) represents the initial input features, I is the identity matrix, W (l) is the learnable weight matrix of layer l. l X (0) is the residual term, when α l = 0, indicating that there is no residual term, and the operation process can be l Set it to a smaller value, such as 0.1. Even if many hidden layers (convolutional layers) are stacked, the final node representation can still retain part of the initial input feature matrix, which is equivalent to each hidden layer having a residual connection with the initial embedding feature of the node, which can alleviate the over-smoothing problem.
[0059] 4) Use the training set data to train the model. The cross entropy loss function is selected for the classification module. The relevant learning parameters are optimized through back propagation to obtain the trained hypergraph neural network model.
[0060] 5) Use the trained neural network model to classify and predict bad domain names on the test set data.
[0061] The following is an example of a specific implementation process of a method for identifying bad domain names based on a hypergraph neural network model of the present invention:
[0062] 1) The data is divided into a training set and a test set. The training set data includes known bad domain names (labeled as 1), domain names in the domain name whitelist (labeled as 0) and their related domain name system data, and the test set is the remaining data without labels.
[0063] 2) Construct hypergraphs for the test set and training set (see Figure 2 ). Taking the test set as an example, the test set hypergraph is g = {V, E}, where V is the node set consisting of all the domain names of the test set, and E is the hyperedge set. j ∈E is a non-empty subset of V, H is the incidence matrix of the hypergraph, if the domain node v i Included in the hyperedge j In, h ij =1, otherwise 0, that is Node v i The degree of the node v i The number of hyperedges, that is The node degree matrix is denoted as Dv , super edge e j The degree of the hyperedge e j The number of nodes included, i.e. The hyperedge degree matrix is denoted as D e .
[0064] 3) The specific construction rules of the hyperedge are as follows: Let v1 and v2 be any two domain name nodes in V, let ip(v1) and ip(v2) be the resolution IP sets of v1 and v2 respectively, asn(ip(v1)∩ip(v2)) be the ASN set to which the common resolution IP of domain names v1 and v2 belongs, calculate the correlation strength cor(v1,v2) between the two domain names, if cor(v1,v2) is greater than the set threshold u, then generate the corresponding edge, otherwise there is no edge between the two domain name nodes, the calculation formula of cor(v1,v2) is as follows:
[0065] ω1|asn(ip(v1)∩ip(v2))|+ω2I A (v1,v2)+ω3I B (v1,v2)
[0066] Where ω1, ω2, ω3 are known weights; I a (x) is an indicative function. If x∈a, then I a (x) = 1, otherwise 0, event A belongs to the same registrant, and event B belongs to the same registrar.
[0067] 4) Input the test set data into the node embedding module and the self-attention update module respectively to obtain the initial input feature X and the updated association matrix The updated correlation matrix elements are in is the domain name node v i Features, is the hyperedge e that contains this node j The feature of , σ is the activation function, sim is the function for calculating the similarity between hyperedges and nodes, and W is the learnable weight matrix.
[0068] 5) The convolution module consists of multiple repeated convolutional layers, which is responsible for continuously updating the input initial node features to obtain the final node embedding features. The propagation process is as follows:
[0069]
[0070] where α l , β l is a hyperparameter, D v is the node degree matrix, is the correlation matrix updated by the attention mechanism, D e is the hyperedge degree matrix, X(l) represents the input features of the lth layer, X (0) =X, I is the unit matrix, W (l) is the learnable weight matrix of layer l.
[0071] 6) Bad domain name identification is a binary classification problem. After obtaining the final embedded feature Z of the node, it is input into the classification module to obtain the domain name category probability. The transmission process can be expressed as:
[0072]
[0073] in It is the domain name category prediction probability result. Sofmax maps the result to the range of 0-1. W and b are learnable parameters.
[0074] 7) Use the training set data for training, calculate the loss function through the gradient descent algorithm, and optimize the learning related parameters through back propagation to obtain the trained graph neural network model. The loss function is the cross loss function.
[0075] 8) Use the trained neural network model to classify each node in the test set and identify bad domain names.
[0076] The key points of the present invention are:
[0077] 1) According to the information of domain name resolution IP, ASN code to which IP belongs, domain name registrar, and domain name registration entity, a well-designed domain name association strength formula is used to determine whether there is a hyperedge between two domain names. The hypergraph constructed in this way can more accurately describe the multivariate relationship between domain names and avoid the loss of original information caused by the forced conversion of multivariate relationships into binary relationships.
[0078] 2) By introducing the self-attention mechanism to update the hypergraph association matrix, the influence relationship between domain name nodes can be better mined (the element values of the association matrix are changed from 0 and 1 to attention scores); the introduction of residual terms in the convolutional propagation process can enhance the stability of the model and improve the recognition accuracy.
[0079] Another embodiment of the present invention provides a bad domain name identification device based on a dynamic heterogeneous graph, such as Figure 3 As shown, the device comprises:
[0080] A domain name data acquisition module 201 is used to acquire domain name data and divide the domain name data into a training set and a test set;
[0081] A hypergraph construction module 202, used to construct a hypergraph for a training set and a test set;
[0082] A hypergraph neural network model building module 203 is used to build a hypergraph neural network model;
[0083] A hypergraph neural network model training module 204 is used to train the hypergraph neural network model using a training set;
[0084] The bad domain name identification module 205 is used to identify bad domain names in the test set using the trained hypergraph neural network model.
[0085] The specific implementation process of each module refers to the above description of the method of the present invention.
[0086] In the above embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, and the division of the modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the parameters mentioned in the above embodiments can be replaced with other parameters within a reasonable range according to actual applications.
[0087] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program codes.
[0088] For example, one embodiment of the present invention provides a computer device, which includes a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing each step in the method of the present invention.
[0089] For example, one embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the steps of the method of the present invention are implemented.
[0090] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and implement it accordingly. It can be understood by those skilled in the art that various replacements, changes and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the contents disclosed in the embodiments of this specification, and the scope of protection of the present invention shall be subject to the scope defined in the claims.
Claims
1. A method for identifying bad domain names based on a hypergraph neural network model, characterized in that: The following steps are involved: Obtain domain name data and divide the domain name data into training set and test set; Build hypergraphs for training and test sets; Build a hypergraph neural network model; Use the training set to train the hypergraph neural network model; Use the trained hypergraph neural network model to identify bad domain names on the test set.
2. The method according to claim 1, characterized in that The domain name data is divided into a training set and a test set, wherein the training set is the known bad domain names and the domain names in the domain name whitelist, and the test set is the domain names without labels.
3. The method according to claim 1, characterized in that The hypergraph includes a node set and a hyperedge set; the node set is all domain names in a test set or a training set; the method for establishing a hyperedge in the hyperedge set is: based on the resolved IP of the domain name, the ASN code to which the IP belongs, the domain name registrar, and the domain name registration entity, the association strength between the two domain names is calculated. If the association strength is greater than a set threshold, a hyperedge exists between the two domain names, otherwise, no hyperedge exists between the two domain names.
4. The method according to claim 3, characterized in that The strength of association between the two domain names is calculated using the following formula: <h2 style=";text-align:left;direction:ltr">cor(v1,v2)=ω1|asn(ip(v1)∩ip(v2))|+ω2I<h2 style=";text-align:left;direction:ltr"> A <h2 style=";text-align:left;direction:ltr"> (v1, v2)+ω3I<h2 style=";text-align:left;direction:ltr"> B <h2 style=";text-align:left;direction:ltr"> (v1, v2) Where cor(v1, v2) is the correlation strength between the two domain names, v1 and v2 are any two domain name nodes in the node set V, ip(v1) and ip(v2) are the resolution IP sets of v1 and v2 respectively, asn(ip(v1)∩ip(v2)) is the ASN set to which the common resolution IP of domain names v1 and v2 belongs, ω1, ω2, ω3 are the set weight coefficients; I a (x) is an indicative function. If x∈a, then I a (x)=1, otherwise I a (x)=0, event A belongs to the same registrant, and event B belongs to the same registrar; if cor(v1, v2) is greater than the set threshold u, a corresponding hyperedge is generated, otherwise there is no hyperedge between the two domain name nodes.
5. The method according to claim 1, characterized in that The hypergraph neural network model includes a node embedding module, a self-attention update module, a convolution module, and a classification module; the node embedding module is used to embed nodes to obtain initial input features; the self-attention update module uses a self-attention mechanism to update the association matrix of the hypergraph to mine the influence relationship between nodes; the convolution module continuously updates the node features to obtain the final node features, which are used as input features of the classification module; The cross entropy loss function is calculated by the gradient descent algorithm between the prediction results of the classification module and the true label, and the related parameters are optimized through back propagation to transform the bad domain name identification problem into a binary classification problem, so as to train the optimal bad domain name classification model.
6. The method according to claim 5, characterized in that The updated association matrix obtained by the self-attention update module is as follows: in, is the domain name node v i Features, is the hyperedge e that contains the domain name node j The feature of , σ is the activation function, sim is the function for calculating the similarity between hyperedges and nodes, and W is the learnable weight matrix.
7. The method according to claim 6, characterized in that The hypergraph convolution propagation process of the convolution module is as follows: where α l , β l is a hyperparameter, D v is the node degree matrix, is the correlation matrix after being updated by the attention mechanism, D e is the hyperedge degree matrix, X (l) represents the input features of the lth layer, X (0) represents the initial input features, I is the identity matrix, W (l) is the learnable weight matrix of layer l.
8. A device for identifying bad domain names based on a hypergraph neural network model, characterized in that: include: A domain name data acquisition module is used to acquire domain name data and divide the domain name data into a training set and a test set; Hypergraph construction module, used to build hypergraphs for training and test sets; Hypergraph neural network model building module, used to build the hypergraph neural network model; A hypergraph neural network model training module is used to train the hypergraph neural network model using a training set; The bad domain name identification module is used to identify bad domain names in the test set using the trained hypergraph neural network model.
9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program comprises instructions for executing the method according to any one of claims 1 to 7.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the method according to any one of claims 1 to 7 is implemented.