Malicious domain name generation method, domain name generation model training method and related equipment

Abstract

The embodiment of the invention provides a malicious domain name generation method, a domain name generation model training method and related equipment, and belongs to the technical field of network security. The malicious domain name generation method comprises the following steps: extracting sequence features of an obtained sample domain name character sequence through an initial domain name generation model, and determining a sample generation domain name based on the sequence features; determining an initial parameter set of the current initial domain name generation model, and performing Bayesian optimization on model parameters of the initial domain name generation model based on the sample generation domain name and the initial parameter set to obtain a trained domain name generation model; obtaining a plurality of malicious domain names to be processed, and generating a domain name character sequence based on the plurality of malicious domain names; and inputting the domain name character sequence into the trained domain name generation model, and predicting to obtain a target generated domain name with the same feature as the malicious domain name sequence. The generation efficiency of the malicious domain name can be improved, and then the detection efficiency of the malicious domain name is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a malicious domain name generation method, a domain name generation model training method, and related equipment. Background Art

[0002] Malicious domain names refer to the domain names of malicious websites. Detecting malicious domain names is of great significance to network security. Domain Generation Algorithm (DGA) is a technical means to generate a large number of random or pseudo-random domain names of command and control (C&C) servers. These domain names usually contain letters, numbers and hyphens, and have no obvious regularity in structure, so malicious attackers can use DGA domain names generated by DGA to evade security detection.

[0003] Faced with a large number of complex, changeable and unpredictable DGA domain names, relevant technologies need to consume a lot of time and computing resources to train the generative model. Otherwise, the generative model cannot extract potential patterns from a large number of DGA domain names, resulting in the inability of relevant technologies to efficiently generate an abnormal list containing similar domain names based on the currently generated DGA domain names, which in turn leads to low detection efficiency of malicious domain names. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a malicious domain name generation method, a domain name generation model training method and related equipment, which can improve the efficiency of malicious domain name generation and thus improve the efficiency of malicious domain name detection.

[0005] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a method for generating a malicious domain name, the method comprising:

[0006] Obtaining a sample domain name character sequence constructed based on characters of the sample malicious domain name and multiple connectors, and inputting the sample domain name character sequence into an initial domain name generation model, and extracting sequence features of the sample domain name character sequence through the initial domain name generation model;

[0007] Determine the generation probability of each preset character based on the sequence feature, and determine the sample generation domain name based on the generation probability;

[0008] Determine an initial parameter set of the current initial domain name generation model, perform Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, and obtain a target parameter set;

[0009] The target parameter set is used as the model parameters of the initial domain name generation model to obtain the trained domain name generation model;

[0010] Acquire multiple malicious domain names to be processed, and generate domain name character sequences based on the multiple malicious domain names;

[0011] The domain name character sequence is input into the trained domain name generation model to predict the target generated domain name with the same characteristics as the malicious domain name sequence.

[0012] In some embodiments, the sample domain name character sequence is obtained by the following steps, comprising:

[0013] Obtain multiple sample malicious domain names, and use a connector to connect the first and last characters of different sample malicious domain names to obtain a sample domain name character sequence;

[0014] Alternatively, obtain a short randomly generated sequence;

[0015] Randomly insert a short sequence into multiple characters connected in sequence in any sample malicious domain name to obtain an updated sample malicious domain name;

[0016] Use the connector to connect the first and last characters of different updated sample malicious domain names to obtain the sample domain name character sequence.

[0017] In some embodiments, after obtaining a sample domain name character sequence constructed based on characters of the sample malicious domain name and a plurality of connectors, the method further includes:

[0018] A sliding window of a fixed size is set on the obtained sample domain name character sequence;

[0019] The sliding window is slid based on a preset step length, and the characters and / or connectors located in the sliding window are determined to be the updated sample domain name character sequence.

[0020] In some embodiments, extracting sequence features of a sample domain name character sequence through an initial domain name generation model includes:

[0021] Extract features from the sample domain name character sequence in the positive direction to obtain a first sequence feature representing the positive sequence dependency relationship between multiple domain name characters;

[0022] Extract features from the sample domain name character sequence in the reverse direction to obtain a second sequence feature representing the reverse order dependency relationship between multiple domain name characters;

[0023] The first sequence feature and the second sequence feature are integrated to obtain the sequence feature corresponding to the character sequence of the sample domain name.

[0024] In some embodiments, extracting sequence features of the sample domain name character sequence through the initial domain name generation model also includes:

[0025] The first sequence feature is updated based on a preset first weight to obtain an updated first sequence feature;

[0026] The second sequence feature is updated based on a preset second weight to obtain an updated second sequence feature;

[0027] The first sequence feature is updated and the second sequence feature is updated to obtain the sequence feature corresponding to the sample domain name character sequence.

[0028] In some embodiments, the model parameters of the initial domain name generation model are Bayesian optimized based on the sample generated domain name and the initial parameter set to obtain a target parameter set, including:

[0029] Obtain a predefined objective function, which is used to characterize the negative average loss of the sample generated domain name;

[0030] A Bayesian tuning model is constructed based on the sample generation domain name and the initial parameter set having a corresponding relationship, and a collection function for evaluating the quality of the initial parameter set is determined based on the Bayesian tuning model;

[0031] Under the premise of optimizing the acquisition function, other initial parameter sets other than the determined sample generation domain name are sampled based on the Bayesian tuning model, and the new sample generation domain name is determined when the initial domain name generation model works under the sampled initial parameter set;

[0032] When the preset iteration condition is reached, a target parameter set is selected from the initial parameter sets of the domain names generated by the multiple existing samples after updating.

[0033] In some embodiments, determining an acquisition function for evaluating the quality of an initial parameter set based on a Bayesian tuning model includes:

[0034] Determine the current optimal initial hyperparameter set from multiple existing initial hyperparameter sets;

[0035] Determine mean information based on the current optimal initial hyperparameter set and a preset cumulative distribution function, and determine standard deviation information based on the current optimal initial hyperparameter set and a preset probability density function;

[0036] By superimposing the mean information and the standard deviation information, we construct an acquisition function for evaluating the quality of the initial hyperparameter set.

[0037] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes a domain name generation model training method, the domain name generation model training method comprising:

[0038] Obtaining a sample domain name character sequence constructed based on characters of the sample malicious domain name and multiple connectors, and inputting the sample domain name character sequence into an initial domain name generation model, and extracting sequence features of the sample domain name character sequence through the initial domain name generation model;

[0039] Determine the generation probability of each preset character based on the sequence feature, and determine the sample generation domain name based on the generation probability;

[0040] Determine an initial parameter set of the current initial domain name generation model, perform Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, and obtain a target parameter set;

[0041] The target parameter set is used as the model parameters of the initial domain name generation model to obtain the trained domain name generation model.

[0042] To achieve the above-mentioned purpose, a third aspect of an embodiment of the present application proposes a malicious domain name generation device, the device comprising:

[0043] A first acquisition module is used to acquire a sample domain name character sequence constructed based on characters of the sample malicious domain name and multiple connectors, and input the sample domain name character sequence into an initial domain name generation model to extract sequence features of the sample domain name character sequence through the initial domain name generation model;

[0044] A sample generation domain name determination module is used to determine the generation probability of each preset character based on the sequence feature, and determine the sample generation domain name based on the generation probability;

[0045] Determine the target parameter set module, determine the initial parameter set of the current initial domain name generation model, perform Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, and obtain the target parameter set;

[0046] Determine a domain name generation model module, which is used to use the target parameter set as the model parameters of the initial domain name generation model to obtain a trained domain name generation model;

[0047] A second acquisition module is used to acquire multiple malicious domain names to be processed and generate a domain name character sequence based on the multiple malicious domain names;

[0048] The target generated domain name module is determined to input the domain name character sequence into the trained domain name generation model to predict the target generated domain name with the same characteristics as the malicious domain name sequence.

[0049] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the malicious domain name generation method described in the first aspect or the domain name generation model training method described in the second aspect.

[0050] To achieve the above-mentioned purpose, the fifth aspect of an embodiment of the present application proposes a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the malicious domain name generation method described in the first aspect or the domain name generation model training method described in the second aspect.

[0051] The malicious domain name generation method, domain name generation model training method and related equipment proposed in the present application obtain a sample domain name character sequence constructed based on characters of a sample malicious domain name and multiple connectors, and input the sample domain name character sequence into an initial domain name generation model, extract sequence features of the sample domain name character sequence through the initial domain name generation model; determine the generation probability of each preset character based on the sequence features, and determine the sample generation domain name based on the generation probability; determine an initial parameter set of the current initial domain name generation model, perform Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generation domain name and the initial parameter set to obtain a target parameter set; and optimize the target parameter set. The number set is used as the model parameter of the initial domain name generation model to obtain the trained domain name generation model; the application intelligently selects the evaluation points by Bayesian optimization of the initial domain name generation model, significantly reduces the number of model training times, and achieves finding a solution close to the global optimal solution in limited hyperparameter evaluations; then, multiple malicious domain names to be processed are obtained, and domain name character sequences are generated based on the multiple malicious domain names; the domain name character sequence is input into the trained domain name generation model, and a target generated domain name with the same characteristics as the malicious domain name sequence is predicted. In this way, by predicting the target generated domain name that may be abnormal in advance, the foresight and efficiency of malicious domain name detection are improved, and computing resources are saved. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is an optional flow chart of the malicious domain name generation method provided in the embodiment of the present application;

[0053] Figure 2 It is an optional domain name generation model training and application flow chart of the malicious domain name generation method provided in the embodiment of the present application;

[0054] Figure 3 This is an optional sample domain name character sequence generation flow chart of the malicious domain name generation method provided in the embodiment of the present application;

[0055] Figure 4 yes Figure 1 An optional implementation flowchart after step 101 in ;

[0056] Figure 5 yes Figure 1 An optional implementation flowchart of step 101 in ;

[0057] Figure 6 It is an optional model processing and Bayesian optimization flow chart of the malicious domain name generation method provided in the embodiment of the present application;

[0058] Figure 7 yes Figure 1 Another optional implementation flowchart of step 101 in ;

[0059] Figure 8 yes Figure 1 An optional implementation flowchart of step 103 in ;

[0060] Fig. 9 yes Figure 8 An optional implementation flowchart of step 602 in FIG. 1 ;

[0061] Fig.10 This is an optional flowchart of the domain name generation model training method provided in an embodiment of the present application;

[0062] Fig.11 This is an optional flow chart of the malicious domain name generation device provided in the embodiment of the present application;

[0063] Fig.12 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0065] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0066] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0067] Malicious domain names refer to the domain names of malicious websites. Detecting malicious domain names is of great significance to network security. Domain name generation method is a technical means to generate a large number of random or pseudo-random domain names of command and control servers. These domain names usually contain letters, numbers and hyphens, and there is no obvious regularity in structure, so malicious attackers can use DGA domain names generated by DGA to evade security detection.

[0068] With the development of the Internet, DGA has gradually become one of the common technical means of malware. DGA technology not only increases the difficulty of malware detection, but also increases the concealment and persistence of malicious behavior, bringing severe challenges to network security. The domain names dynamically generated by this method are not only huge in number, but also change rapidly. Traditional methods based on feature extraction and classification are difficult to deal with effectively.

[0069] In other words, faced with a large number of complex, changeable and unpredictable DGA domain names, relevant technologies need to consume a lot of time and computing resources to train the generative model. Otherwise, the generative model cannot extract potential patterns from a large number of DGA domain names, resulting in the inability of relevant technologies to efficiently generate an abnormal list containing similar domain names based on the currently generated DGA domain names, which in turn leads to low detection efficiency of malicious domain names.

[0070] Based on this, the embodiments of the present application provide a malicious domain name generation method, a domain name generation model training method and related equipment, which can improve the efficiency of malicious domain name generation and thus improve the efficiency of malicious domain name detection.

[0071] It should be noted that in the embodiments of the present application, when it comes to information related to user characteristics such as user basic information or user identity, the user's permission or consent will be obtained first, and the collection, use and processing of these data will comply with relevant laws, regulations and standards. In addition, when the embodiments of the present application need to obtain sensitive personal information of the user, the user's separate permission or consent will be obtained first. After the user's separate permission or consent is clearly obtained, the necessary data for the normal operation of the embodiments of the present application will be obtained. For example, when obtaining sample malicious domain names, the embodiments of the present application will first obtain the authorization or consent of the relevant personnel of the organization that manages these sample malicious domain names, otherwise the sample malicious domain names that cannot be applied to the embodiments of the present application will be obtained. In addition, the other relevant data obtained by the malicious domain name generation device of the present application are all authorized data, which will not be repeated here one by one.

[0072] In the embodiment of the present application, the malicious domain name generation device will be described from the perspective of the malicious domain name generation device, which can be integrated into a computer device, such as a server. Figure 1 As shown, Figure 1 is an optional flowchart of the malicious domain name generation method provided in the embodiment of the present application. Figure 1 The method may include but is not limited to the following steps 101 to 106. When the malicious domain name generating device executes the malicious domain name generating method, the specific process is as follows. It should be noted that the present embodiment Figure 1 The order of step 101 to step 106 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs.

[0073] Step 101, obtain a sample domain name character sequence constructed based on characters of a sample malicious domain name and multiple connectors, input the sample domain name character sequence into an initial domain name generation model, and extract sequence features of the sample domain name character sequence through the initial domain name generation model.

[0074] The following is a detailed description of step 101.

[0075] The sample malicious domain names are domain names extracted from known malicious activities (such as phishing attacks, malware distribution, etc.). The sample malicious domain names usually contain some specific character patterns or structures, which may be used to deceive users or bypass security detection. The sample malicious domain names can be obtained through log analysis, information sharing platform collection, third-party acquisition, etc.

[0076] Furthermore, the sample malicious domain name includes multiple characters connected in sequence, and the characters may be letters, numbers, special characters, etc. (such as "@", "_"). For example, a sample malicious domain name is www.abc.com, which includes letters and special characters. Among them, the connector may be a symbol that is different from the characters of the sample malicious domain name, such as a space, etc., and may be adaptively adjusted according to actual conditions, and the embodiments of the present application do not limit this.

[0077] Furthermore, the obtained sample domain name character sequence is input into the initial domain name generation model, so that the domain name generation model can extract sequence features that characterize the distribution feature relationship between multiple characters from the sample domain name character sequence, thereby facilitating the domain name generation model to generate sample generated domain names similar to the sample malicious domain names based on the sequence features, thereby realizing the training of the domain name generation model.

[0078] In some embodiments, Figure 2 As shown, Figure 2This is an optional domain name generation model training and application flow chart of the malicious domain name generation method provided in the embodiment of the present application. The malicious domain name generation method proposed in the embodiment of the present application includes a training phase and an application phase. Specifically, the training phase includes:

[0079] (1) Obtain sample malicious domain names;

[0080] (2) Processing the sample malicious domain name to obtain a sample domain name character sequence, wherein the sample domain name character sequence is constructed based on characters of the sample malicious domain name and multiple connectors;

[0081] (3) Inputting the sample domain name character sequence into the initial domain name generation model to generate a sample generated domain name with the same characteristics as the sample malicious domain name;

[0082] (4) Based on the sample generated domain name and the initial hyperparameter set of the current domain name generation model, the initial domain name generation model is Bayesian optimized to obtain a trained domain name generation model.

[0083] In some embodiments, Figure 3 As shown, Figure 3 This is an optional sample domain name character sequence generation flow chart of the malicious domain name generation method provided in the embodiment of the present application. The sample domain name character sequence is obtained by following steps 201 to 204:

[0084] Step 201, obtain multiple sample malicious domain names, use a connector to connect the first character and the last character of different sample malicious domain names, and obtain a sample domain name character sequence.

[0085] Step 202, alternatively, obtain a randomly generated short sequence.

[0086] Step 203: randomly insert a short sequence into a plurality of sequentially connected characters in any sample malicious domain name to obtain an updated sample malicious domain name.

[0087] Step 204: Use a connector to connect the first character and the last character of different updated sample malicious domain names to obtain a sample domain name character sequence.

[0088] Steps 201 to 204 are described in detail below.

[0089] In some embodiments, in order to finally generate similar malicious domain names, it is usually necessary to perform feature analysis on multiple sample malicious domain names, and connect multiple sample malicious domain names through connectors to obtain a sample domain name character sequence that is convenient for domain name generation model analysis. Exemplarily, multiple sample malicious domain names are: www.xyz.com, www.tk.com, www.ga.com, and the connector is "-"; the connector is used to connect the first character and the last character of different sample malicious domain names, and the sample domain name character sequence is: www.xyz.com-www.tk.com-www.ga.com.

[0090] In some embodiments, since malicious domain names are becoming more and more diverse, in order to improve the prediction accuracy of malicious domain names, sample malicious domain names may also be modified to increase the complexity of the sample malicious domain names, thereby helping to train the domain name generation model to handle complex sample malicious domain names.

[0091] Among them, the short sequence is generated by a random combination of characters. In addition, the number of characters in the short sequence is usually controlled within a certain small range threshold, so that in the subsequent process of randomly inserting the short sequence into the sample malicious domain name, the update change impact on the sample malicious domain name can be minimized while maximizing the richness of the sample domain name character sequence.

[0092] Furthermore, the short sequence is obtained by manual input, or a library function is called to generate the short sequence, or a pre-set programming function is used to randomly generate the short sequence. The specific generation method of the short sequence can be set according to actual conditions, and the embodiments of the present application do not limit this.

[0093] Furthermore, after obtaining the short sequence, the short sequence is inserted at any position of the sample malicious domain name. For example, if a sample malicious domain name is test.com and the short sequence to be inserted is a, then the short sequence a can be inserted into any of the following A positions: AtAeAsAtA.AcAoAmA, to obtain an updated sample malicious domain name. Alternatively, a sample malicious domain name can be inserted with multiple short sequences, which is not limited in the present embodiment.

[0094] Furthermore, for the obtained multiple sample malicious domain names, some sample malicious domain names are selected to insert the short sequence, or all sample malicious domain names are inserted and updated, which is set according to the actual situation. After obtaining the updated sample malicious domain names, the first character and the last character of different updated sample malicious domain names are connected by a connector to obtain a sample domain name character sequence.

[0095] In some embodiments, Figure 4 As shown, Figure 4 yes Figure 1An optional implementation flowchart after step 101 in the embodiment of the present invention further includes the following steps 301 to 302 after obtaining a sample domain name character sequence constructed based on characters of the sample malicious domain name and multiple connectors:

[0096] Step 301: Set a sliding window of a fixed size on the acquired sample domain name character sequence.

[0097] Step 302: Slide the sliding window based on a preset step size to determine that the characters and / or connectors within the sliding window are the updated sample domain name character sequence.

[0098] Steps 301 to 302 are described in detail below.

[0099] The sliding window is a window that slides on the target sequence with a fixed size so as to extract continuous elements of a preset length from the sample domain name character sequence. For example, if the size of the sliding window is 3, it will extract 3 elements from the beginning of the text; then, it will move one position to the right (preset step size) and continue to extract the current 3 elements in the sliding window, and so on. The updated sample domain name character sequence is then input into the initial domain name generation model for subsequent processing.

[0100] That is, by setting a sliding window of fixed size and sliding on the sample domain name character sequence based on a preset step length, an updated sample domain name character sequence is obtained. In this way, the number of characters processed each time is limited by a sliding window of fixed size, avoiding indiscriminate traversal of the entire sequence, thereby reducing the amount of calculation and improving processing efficiency.

[0101] It should be noted that the window size and step size can be adaptively adjusted according to actual conditions to flexibly adapt to sample domain name character sequences of different lengths without the need for additional preprocessing of the sequence.

[0102] Step 102: determining the generation probability of each preset character based on the sequence feature, and determining the sample generation domain name based on the generation probability.

[0103] In some embodiments, the obtained sample domain name character sequence is input into the initial domain name generation model. The domain name generation model in the embodiment of the present application is a bidirectional long short-term memory network (Bidirectional Long Short-Term Memory, BiLSTM). Among them, BiLSTM is an improved recurrent neural network, which can process sequence data and maintain long-term memory, so as to better capture the contextual relationship in the sequence data. Of course, the domain name generation model can also be a neural network model, a generative adversarial network model, etc., which can be selected according to actual conditions, and the embodiment of the present application does not limit this. In addition, the domain name generation model that has not been adjusted by Bayesian optimization is the initial domain name generation model.

[0104] The preset characters are used to represent the characters that may be included in the sample generated domain name output by the domain name generation model. For example, if the sample generated domain name is set to be composed of only letters and numbers, then letters and numbers are both preset characters; of course, the preset characters may also include special characters, and the preset characters are adaptively adjusted according to the actual prediction situation, and the embodiments of the present application do not limit this.

[0105] Furthermore, the domain name generation model determines the generation probability of each preset character according to the sequence characteristics. Usually, the character with the highest generation probability is selected as the most likely output character at the current sequence position, until all characters at the sequence positions are confirmed, and the sample generated domain name is obtained. It can be understood that the sample generated domain name is a similar domain name that may be generated by the malware that generates the sample malicious domain name, which is predicted by the initial domain name generation model based on the sequence characteristics of the sample domain name character sequence.

[0106] The following explains how to extract sequence features from the character sequence of the sample domain name, and how to determine the sample generated domain name based on the sequence features:

[0107] In some embodiments, Figure 5 As shown, Figure 5 yes Figure 1 An optional implementation flowchart of step 101 in the embodiment of the present invention, extracting sequence features of a sample domain name character sequence through an initial domain name generation model, includes the following steps 401 to 403:

[0108] Step 401 , extracting features from a sample domain name character sequence from a positive direction to obtain a first sequence feature representing a positive sequence dependency relationship between a plurality of domain name characters.

[0109] Step 402: extract features from the sample domain name character sequence in the reverse direction to obtain a second sequence feature representing the reverse sequence dependency relationship between multiple domain name characters.

[0110] Step 403: The first sequence feature and the second sequence feature are integrated to obtain a sequence feature corresponding to the character sequence of the sample domain name.

[0111] Steps 401 to 403 are described in detail below.

[0112] like Figure 6 As shown, Figure 6 This is an optional model processing and Bayesian optimization flowchart of the malicious domain name generation method provided in the embodiment of the present application. The obtained sample domain name character sequence is used as the input of the Bi LSTM model, and the following processing is performed:

[0113] (1) Embedding layer: maps the sample domain name character sequence into the corresponding vector representation;

[0114] (2) Forward LSTM layer: Processes the sample domain name character sequence from left to right (positive direction) in forward time order, and extracts the first sequence features that represent the positive order dependency relationship between multiple domain name characters;

[0115] (3) Backward LSTM layer: Processes the sample domain name character sequence from right to left (in reverse direction) in reverse time order, and extracts the second sequence features that characterize the reverse order dependency relationship between multiple domain name characters; by capturing the forward and reverse time dependencies in the sample domain name character sequence, it helps improve the accuracy and coherence of the final generated sample generated domain name;

[0116] (4) Connection layer: The hidden states of the forward LSTM layer and the backward LSTM layer are connected at each time step to form a combined hidden state (sequence feature) containing bidirectional information;

[0117] (5) LSTM layer: An additional LSTM layer is set in the Bi LSTM model to further integrate the bidirectional temporal dependency of the combined hidden state;

[0118] (6) Fully connected layer: The fully connected layer maps the final hidden state of the LSTM layer to a set of output probabilities. Each output represents the probability distribution of possible characters at each time step, which is necessary to generate the next character in the domain name sequence;

[0119] (7) Output layer: The normalized exponential function (Softmax) layer receives the output logical values ​​(logits) and converts them into probability distributions over the character set, where logits refers to the original, unprocessed scores or scores of the output layer; the probability distribution represents the probability of each character becoming the next character in the generated domain name. The formula for Softmax applied to logits is as follows: <1> As shown:

[0120]

[0121] Among them, z t，c is the logit of the corresponding character at time step t, P(x t =c|h t ) is the probability that character c will become the next character; exp is the exponential function.

[0122] In some embodiments, Figure 7 As shown, Figure 7 yes Figure 1 Another optional implementation flowchart of step 101 in the above embodiment, extracting sequence features of the sample domain name character sequence through the initial domain name generation model, also includes the following steps 501 to 503:

[0123] Step 501: Update the first sequence feature based on a preset first weight to obtain an updated first sequence feature.

[0124] Step 502: Update the second sequence feature based on a preset second weight to obtain an updated second sequence feature.

[0125] Step 503: The first sequence feature is updated and the second sequence feature is updated to obtain a sequence feature corresponding to the character sequence of the sample domain name.

[0126] Steps 501 to 503 are described in detail below.

[0127] The first weight is used to characterize the importance of the first sequence feature in the sequence feature, and the second weight is used to characterize the importance of the second sequence feature in the sequence feature. The domain name generation model may have different requirements for the features extracted from the positive sequence and the reverse sequence in different application scenarios. By updating the first sequence feature and the second sequence feature through the first weight and the second weight respectively, the domain name generation model can be trained to pay attention to the feature information in different application scenarios, thereby improving the flexibility of determining the sequence features.

[0128] Further, after obtaining the updated first sequence feature based on the first weight and obtaining the updated second sequence feature based on the second weight, the sequence feature corresponding to the sample domain name character sequence is obtained by fusing the updated first sequence feature and the updated second sequence feature. The specific implementation of the fusion in step 503 is similar to that in step 403, and will not be repeated here.

[0129] Step 103, determining an initial parameter set of the current initial domain name generation model, performing Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, and obtaining a target parameter set.

[0130] The following is a detailed description of step 103.

[0131] The initial parameter set refers to the hyperparameter set set by the initial domain name generation model when processing the sample domain name character sequence to generate the sample generated domain name. The hyperparameter set includes multiple hyperparameters, such as learning rate, number of training rounds, hidden layer dimension, sliding window size, batch size, regularization parameter, momentum parameter, etc. It should be noted that the hyperparameters specifically included in the hyperparameter set can be set according to actual conditions, and the embodiments of the present application do not limit this.

[0132] Furthermore, the model parameters that affect the output results of the domain name generation model include two categories: one is parameters, and the other is hyperparameters. The numerical calculation of the parameters is determined by a set of explainable mathematical processes. After the method is selected, the determination process basically does not require human participation. Therefore, the target parameter set finally adjusted in the embodiment of the present application actually refers to the hyperparameter set. Due to the wide variety of hyperparameters and the inability to give the optimal solution through a rigorous mathematical process, the relevant technology often uses manual participation to adjust the hyperparameters. It is understandable that manual parameter adjustment requires relevant technical personnel to have an in-depth understanding of the problem and model, so the parameter adjustment process is usually time-consuming and inefficient.

[0133] Furthermore, in another implementation method of the related art, the target parameter set is determined from a huge search space by automatic parameter adjustment. However, this method consumes considerable training time and computing resources. Multiple hyperparameters usually have interdependencies, so it is very difficult to find the best combination in a high-dimensional parameter space. Based on this, the embodiment of the present application proposes to optimize the initial domain name generation model using a Bayesian hyperparameter optimization method, by constructing an alternative model of the objective function (Bayesian tuning model) and intelligently selecting evaluation points through the acquisition function, which significantly reduces the number of model training times and achieves a solution close to the global optimal solution in a limited number of hyperparameter evaluations.

[0134] In some embodiments, Figure 8 As shown, Figure 8 yes Figure 1 An optional implementation flowchart of step 103 in the example, performing Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set to obtain a target parameter set, includes the following steps 601 to 604:

[0135] Step 601, obtaining a predefined objective function, where the objective function is used to characterize the negative average loss of domain names generated by samples.

[0136] Step 602: construct a Bayesian tuning model based on the sample generation domain name and the initial parameter set that have a corresponding relationship, and determine a collection function for evaluating the quality of the initial parameter set based on the Bayesian tuning model.

[0137] Step 603, under the premise of optimizing the acquisition function, sample other initial parameter sets outside the determined sample generation domain name based on the Bayesian tuning model, and determine the new sample generation domain name when the initial domain name generation model works under the sampled initial parameter set.

[0138] Step 604, until the preset iteration condition is reached, a target parameter set is selected from the initial parameter sets of the domain names generated by the multiple existing samples after the update.

[0139] In some embodiments, Fig. 9 As shown, Fig. 9 yes Figure 8 An optional implementation flowchart of step 602 in the embodiment of the present invention, determining an acquisition function for evaluating the quality of an initial parameter set based on a Bayesian tuning model, includes the following steps 701 to 703:

[0140] Step 701, determining the current optimal initial hyperparameter set from multiple existing initial hyperparameter sets.

[0141] Step 702: Determine mean information based on the current optimal initial hyperparameter set and a preset cumulative distribution function, and determine standard deviation information based on the current optimal initial hyperparameter set and a preset probability density function.

[0142] Step 703: superimpose the mean information and the standard deviation information to construct an acquisition function for evaluating the quality of the initial hyperparameter set.

[0143] The following is a detailed description of steps 601 to 604 and steps 701 to 703.

[0144] like Figure 6 As shown in the figure, the Bi LSTM model is used to process the input sample domain name character sequence and perform Bayesian optimization on it, including:

[0145] (1) Define the objective function: Since Bayesian optimization only supports finding the maximum value of the objective function but cannot directly find the minimum value, the embodiment of the present application optimizes the negative average loss of the sample generated domain name output by the BiLSTM model as the objective function f(x), where x represents each hyperparameter combination (initial parameter set) in the training process; Bayesian optimization regards the objective function as a black box function. When the loss function of BiLSTM has multiple local optima, Bayesian optimization can intelligently avoid the local optimum and search for the global optimum;

[0146] (2) Constructing a surrogate model (Bayesian tuning model): Bayesian optimization uses a Gaussian process (GP) surrogate model to model the relationship between the initial hyperparameter set and the objective function (negative average loss); if the domain name generation model generates a sample generation domain name U under the condition of setting the initial parameter set U, then it is said that there is a corresponding relationship between the initial parameter set U and the sample generation domain name U;

[0147] In this way, the embodiment of the present application intelligently evaluates the next initial hyperparameter set through the alternative model; specifically, the Gaussian process is a non-parametric Bayesian model that measures the similarity between different input points through a covariance function (kernel function), which can predict the distribution of the target function at unobserved points given some observations; the covariance function is usually expressed as follows <2> :

[0148] k(x i , x j )=Cov(f(x i ), f(x j )) <2>

[0149] Among them, x i represents the i-th observation point (initial hyperparameter set) x j represents the jth observation point.

[0150] (3) Determine the acquisition function: The GP surrogate model can only provide predictions for the objective function, so Bayesian optimization requires an acquisition function to determine the next evaluation point. The embodiment of the present application selects the expected improvement (EI) as the acquisition function, where the goal of EI is to find the hyperparameter combination that maximizes the improvement of the current optimal solution, as shown in the following formula: <3> As shown:

[0151]

[0152] Among them, f(x) is the predicted value of the objective function at the current point, f(x + ) is the currently known optimal initial hyperparameter set after being processed by the domain name generation model, σ(x) is the predicted standard deviation, Φ and φ are the preset cumulative distribution function (CDF) and the preset probability density function (PDF) of the normal distribution, respectively; is the mean information, is the standard deviation information. By superimposing the mean information and the standard deviation information, we get the acquisition function used to evaluate the quality of the initial hyperparameter set.

[0153] (4) Select the next sampling point: In each step of Bayesian optimization, the initial hyperparameter set with the highest acquisition function value is selected as the next sampling point based on the prediction of the GP surrogate model and the acquisition function; by selecting the observation point most likely to be improved, Bayesian optimization can find the global optimal solution within a limited number of evaluations.

[0154] (5) Update the surrogate model: Once the result of the new initial hyperparameter set (sample generated domain name) is determined, Bayesian optimization adds the result to the GP surrogate model and retrains it to update the GP surrogate model. This enables the surrogate model to more accurately approximate the objective function until the preset iteration condition is reached, and the target parameter set is selected from the initial parameter set of multiple existing sample generated domain names after the update.

[0155] Step 104: Use the target parameter set as model parameters of the initial domain name generation model to obtain a trained domain name generation model.

[0156] Step 104 is described in detail below.

[0157] It is understandable that the target parameter set is obtained after multiple iterations and optimizations, and it can achieve better performance under a given objective function. In this case, the target parameter set is used as the model parameters of the initial domain name generation model, and the trained domain name generation model has excellent malicious domain name prediction capabilities.

[0158] Step 105, obtaining multiple malicious domain names to be processed, and generating a domain name character sequence based on the multiple malicious domain names.

[0159] Step 106, input the domain name character sequence into the trained domain name generation model, and predict a target generated domain name with the same characteristics as the malicious domain name sequence.

[0160] Steps 105 and 106 are described in detail below.

[0161] In some embodiments, Figure 2 As shown, the malicious domain name generation method proposed in the embodiment of the present application also includes an application stage. Specifically, the application stage includes:

[0162] (1) Obtain malicious domain names;

[0163] (2) using the domain name generation model determined in step 101 to process the malicious domain name to obtain a domain name character sequence, wherein the domain name character sequence is constructed based on characters of the malicious domain name and multiple connectors;

[0164] (3) Inputting the domain name character sequence into the trained domain name generation model to generate a target generated domain name with the same characteristics as the malicious domain name, and collecting multiple target generated domain names to obtain an abnormal list;

[0165] (4) Detect domain names in the target network based on the abnormal list and intercept domain names that may be abnormal.

[0166] It can be understood that the embodiment of the present application implements Bayesian optimization on the domain name generation model, so that the optimized domain name generation model can efficiently explore the hyperparameter space, reduce the need for manual intervention, and enhance the robustness of the overall model. In addition, the experimental results show that the malicious domain name generation method proposed in the embodiment of the present application has significant potential in detecting and intercepting malicious domain names. Furthermore, the device using the malicious domain name generation method proposed in the embodiment of the present application has become an important tool for strengthening network security defense against botnets and other malware threats.

[0167] In addition, compared with the need to rely on manually extracted features and labels of historical data, traditional methods are easily affected by changes in data distribution, which leads to the inability to effectively predict unknown DGA domain names. The domain name generation model trained by Bayesian optimization obtained in the embodiment of the present application can directly generate possible malicious domain names by learning the distribution characteristics of DGA domain names, thereby building a domain name anomaly list in advance. This method can not only reduce the false alarm rate, but also improve the foresight and efficiency of malicious domain name detection, saving computing resources.

[0168] In the field of network security, attackers often upgrade malware by constantly updating DGA, making the real-time update speed of DGA domain names faster and faster. The embodiment of the present application can find the optimal hyperparameter combination in fewer iterations by performing Bayesian optimization on the Bi LSTM model, thereby significantly reducing experimental time and resource consumption. In practical applications, by quickly building an abnormal list to predict and generate potential malicious domain names (target generated domain names) in advance, and by improving the efficiency and accuracy of the domain name prediction process model through automated hyperparameter optimization, it provides strong technical support for network security defense.

[0169] like Fig.10 As shown, Fig.10 This is an optional flow chart of the domain name generation model training method provided in an embodiment of the present application. The domain name generation model training method includes the following steps 801 to 804:

[0170] Step 801, obtain a sample domain name character sequence constructed based on characters of a sample malicious domain name and multiple connectors, input the sample domain name character sequence into an initial domain name generation model, and extract sequence features of the sample domain name character sequence through the initial domain name generation model.

[0171] Step 802: determining the generation probability of each preset character based on the sequence feature, and determining the sample generation domain name based on the generation probability.

[0172] Step 803, determine the initial parameter set of the current initial domain name generation model, perform Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, and obtain a target parameter set.

[0173] Step 804: Use the target parameter set as model parameters of the initial domain name generation model to obtain a trained domain name generation model.

[0174] Among them, the specific implementation of steps 801 to 804 is similar to that of steps 101 to 104, and will not be repeated here.

[0175] like Fig.11 As shown, Fig.11 This is an optional flow chart of a malicious domain name generation device provided in an embodiment of the present application. The malicious domain name generation device includes the following modules 901 to 906:

[0176] The first acquisition module 901 is used to obtain a sample domain name character sequence constructed based on characters of the sample malicious domain name and multiple connectors, and input the sample domain name character sequence into an initial domain name generation model to extract sequence features of the sample domain name character sequence through the initial domain name generation model.

[0177] The sample generated domain name determination module 902 is used to determine the generation probability of each preset character based on the sequence feature, and determine the sample generated domain name based on the generation probability.

[0178] The target parameter set determination module 903 determines the initial parameter set of the current initial domain name generation model, performs Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, and obtains the target parameter set.

[0179] The domain name generation model determination module 904 is used to use the target parameter set as the model parameters of the initial domain name generation model to obtain the trained domain name generation model.

[0180] The second acquisition module 905 is used to acquire multiple malicious domain names to be processed and generate a domain name character sequence based on the multiple malicious domain names.

[0181] The target generated domain name determination module 906 is used to input the domain name character sequence into the trained domain name generation model to predict a target generated domain name with the same characteristics as the malicious domain name sequence.

[0182] The malicious domain name generation method, domain name generation model training method and related equipment proposed in the present application obtain a sample domain name character sequence constructed based on characters of a sample malicious domain name and multiple connectors, and input the sample domain name character sequence into an initial domain name generation model, extract sequence features of the sample domain name character sequence through the initial domain name generation model; determine the generation probability of each preset character based on the sequence features, and determine the sample generation domain name based on the generation probability; determine an initial parameter set of the current initial domain name generation model, perform Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generation domain name and the initial parameter set to obtain a target parameter set; and optimize the target parameter set. The number set is used as the model parameter of the initial domain name generation model to obtain the trained domain name generation model; the application intelligently selects the evaluation points by Bayesian optimization of the initial domain name generation model, significantly reduces the number of model training times, and achieves finding a solution close to the global optimal solution in limited hyperparameter evaluations; then, multiple malicious domain names to be processed are obtained, and domain name character sequences are generated based on the multiple malicious domain names; the domain name character sequence is input into the trained domain name generation model, and a target generated domain name with the same characteristics as the malicious domain name sequence is predicted. In this way, by predicting the target generated domain name that may be abnormal in advance, the foresight and efficiency of malicious domain name detection are improved, and computing resources are saved.

[0183] The specific implementation of the malicious domain name generation device is basically the same as the specific implementation of the malicious domain name generation method mentioned above, and will not be repeated here.

[0184] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned malicious domain name generation method or domain name generation model training method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0185] like Fig.12 As shown, Fig.12 : is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application, the electronic device includes:

[0186] The processor 1001 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0187] The memory 1002 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 1002 can store an operating system and other applications. When the technical solution provided in the embodiments of this specification is implemented by software or firmware, the relevant program code is stored in the memory 1002, and the processor 1001 calls and executes the malicious domain name generation method or domain name generation model training method proposed in the embodiments of this application;

[0188] Input / output interface 1003, used to implement information input and output;

[0189] The communication interface 1004 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0190] A bus 1005 , which transmits information between various components of the device (e.g., the processor 1001 , the memory 1002 , the input / output interface 1003 , and the communication interface 1004 );

[0191] The processor 1001 , the memory 1002 , the input / output interface 1003 and the communication interface 1004 are connected to each other in communication within the device via the bus 1005 .

[0192] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned malicious domain name generation method or domain name generation model training method.

[0193] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0194] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0195] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0196] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0197] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0198] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0199] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0200] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0201] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0202] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0203] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0204] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A method for generating a malicious domain name, characterized in that: The malicious domain name generation method comprises: Obtaining a sample domain name character sequence constructed based on characters of the sample malicious domain name and a plurality of connectors, and inputting the sample domain name character sequence into an initial domain name generation model, and extracting sequence features of the sample domain name character sequence through the initial domain name generation model; Determine the generation probability of each preset character based on the sequence feature, and determine the sample generation domain name based on the generation probability; Determine an initial parameter set of the current initial domain name generation model, and perform Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set to obtain a target parameter set; Using the target parameter set as model parameters of the initial domain name generation model to obtain a trained domain name generation model; Acquire multiple malicious domain names to be processed, and generate a domain name character sequence based on the multiple malicious domain names; The domain name character sequence is input into the trained domain name generation model to predict a target generated domain name with the same characteristics as the malicious domain name sequence.

2. The method for generating a malicious domain name according to claim 1, characterized in that: The sample domain name character sequence is obtained by the following steps, which include: Acquire multiple sample malicious domain names, and use the connector to connect the first character and the last character of different sample malicious domain names to obtain a character sequence of the sample domain name; Alternatively, obtain a short randomly generated sequence; randomly inserting the short sequence into a plurality of sequentially connected characters in any of the sample malicious domain names to obtain an updated sample malicious domain name; The connector is used to connect the first character and the last character of different updated sample malicious domain names to obtain the sample domain name character sequence.

3. The method for generating a malicious domain name according to claim 1, characterized in that: After obtaining the sample domain name character sequence constructed based on the characters of the sample malicious domain name and multiple connectors, the method further includes: Setting a sliding window of a fixed size on the obtained sample domain name character sequence; The sliding window is slid based on a preset step length, and the characters and / or the connectors located in the sliding window are determined to be an updated sample domain name character sequence.

4. The method for generating a malicious domain name according to claim 1, characterized in that: The extracting the sequence features of the sample domain name character sequence through the initial domain name generation model includes: Extracting features from the sample domain name character sequence in a positive direction to obtain a first sequence feature representing a positive sequence dependency relationship between a plurality of domain name characters; Extracting features from the sample domain name character sequence in the reverse direction to obtain a second sequence feature representing a reverse order dependency relationship between a plurality of domain name characters; The first sequence feature and the second sequence feature are integrated to obtain the sequence feature corresponding to the sample domain name character sequence.

5. The method for generating a malicious domain name according to claim 4, characterized in that: The extracting the sequence features of the sample domain name character sequence through the initial domain name generation model also includes: The first sequence feature is updated based on a preset first weight to obtain an updated first sequence feature; Updating the second sequence feature based on a preset second weight to obtain an updated second sequence feature; The updated first sequence feature and the updated second sequence feature are merged to obtain the sequence feature corresponding to the sample domain name character sequence.

6. The method for generating a malicious domain name according to claim 1, characterized in that: The generating domain name based on the sample and the initial parameter set performs Bayesian optimization on the model parameters of the initial domain name generating model to obtain a target parameter set, including: Obtaining a predefined objective function, where the objective function is used to characterize the negative average loss of the sample generated domain name; Building a Bayesian tuning model based on the sample generation domain name and the initial parameter set that have a corresponding relationship, and determining an acquisition function for evaluating the quality of the initial parameter set based on the Bayesian tuning model; Under the premise of optimizing the acquisition function, sampling other initial parameter sets other than the determined sample generation domain name based on the Bayesian tuning model, and determining a new sample generation domain name when the initial domain name generation model works under the sampled initial parameter set; When the preset iteration condition is reached, a target parameter set is selected from the initial parameter sets of the domain names generated by the multiple existing samples after updating.

7. The method for generating a malicious domain name according to claim 6, characterized in that: The step of determining an acquisition function for evaluating the quality of the initial parameter set based on the Bayesian tuning model comprises: Determine a current optimal initial hyperparameter set from the existing multiple initial hyperparameter sets; Determine mean information based on the current optimal initial hyperparameter set and a preset cumulative distribution function, and determine standard deviation information based on the current optimal initial hyperparameter set and a preset probability density function; The mean information and the standard deviation information are superimposed to construct the acquisition function for evaluating the quality of the initial hyperparameter set.

8. A domain name generation model training method, characterized in that: The domain name generation model training method comprises: Obtaining a sample domain name character sequence constructed based on characters of the sample malicious domain name and a plurality of connectors, and inputting the sample domain name character sequence into an initial domain name generation model, and extracting sequence features of the sample domain name character sequence through the initial domain name generation model; Determine the generation probability of each preset character based on the sequence feature, and determine the sample generation domain name based on the generation probability; Determine an initial parameter set of the current initial domain name generation model, and perform Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set to obtain a target parameter set; The target parameter set is used as the model parameters of the initial domain name generation model to obtain a trained domain name generation model.

9. A malicious domain name generating device, characterized in that: The device comprises: A first acquisition module is used to acquire a sample domain name character sequence constructed based on characters of the sample malicious domain name and a plurality of connectors, and input the sample domain name character sequence into an initial domain name generation model, and extract sequence features of the sample domain name character sequence through the initial domain name generation model; A sample generation domain name determination module is used to determine the generation probability of each preset character based on the sequence feature, and determine the sample generation domain name based on the generation probability; A target parameter set determination module is used to determine an initial parameter set of the current initial domain name generation model, and to perform Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set to obtain a target parameter set; Determine a domain name generation model module, which is used to use the target parameter set as the model parameters of the initial domain name generation model to obtain a trained domain name generation model; A second acquisition module is used to acquire multiple malicious domain names to be processed, and generate a domain name character sequence based on the multiple malicious domain names; A target generated domain name module is determined, which is used to input the domain name character sequence into the trained domain name generation model to predict a target generated domain name with the same characteristics as the malicious domain name sequence.

10. An electronic device, characterized in that: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the malicious domain name generation method described in any one of claims 1 to 7 or the domain name generation model training method described in claim 8 when executing the computer program.

11. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the malicious domain name generation method described in any one of claims 1 to 7 is implemented or the domain name generation model training method described in claim 8 is implemented.

Images