Malicious domain name generation method, domain name generation model training method and related equipment

Abstract

The embodiment of the application provides a malicious domain name generation method, a domain name generation model training method and related equipment, and belongs to the technical field of network security. The malicious domain name generation method comprises the following steps: extracting sequence features of a sample domain name character sequence obtained through an initial domain name generation model, and determining a sample generated domain name based on the sequence features; determining an initial parameter set of the current initial domain name generation model, performing Bayesian optimization on model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, and obtaining a trained domain name generation model; obtaining a plurality of malicious domain names to be processed, and generating a domain name character sequence based on the plurality of malicious domain names; inputting the domain name character sequence into the trained domain name generation model, and predicting a target generated domain name with the same sequence features as the malicious domain name. The application can improve the generation efficiency of the malicious domain name, and further improve the detection efficiency of the malicious domain name.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a malicious domain name generation method, a domain name generation model training method and related equipment. BACKGROUND

[0002] A malicious domain name refers to a domain name of a malicious website, and detecting a malicious domain name is of great significance to network security. A domain name generation algorithm (DGA) is a technical means for generating a large number of random or pseudo-random domain names of a command and control server (C&C). These domain names usually contain letters, numbers and connectors, and have no obvious rules in structure, so that a malicious attacker can use a DGA domain name generated by the DGA to evade security detection.

[0003] In the face of a large number of complex and unpredictable DGA domain names, the related technology needs to consume a large amount of time and computing resources to train a generative model, otherwise, the generative model cannot mine potential rules from a large number of DGA domain names, so that the related technology cannot efficiently generate an abnormal list containing similar domain names based on the currently generated DGA domain names, thereby resulting in low detection efficiency of malicious domain names. SUMMARY

[0004] The main purpose of the embodiments of the present application is to provide a malicious domain name generation method, a domain name generation model training method and related equipment, which can improve the generation efficiency of malicious domain names and thus improve the detection efficiency of malicious domain names.

[0005] To achieve the above purpose, a first aspect of the embodiments of the present application provides a malicious domain name generation method, which comprises:

[0006] obtaining a sample domain name character sequence constructed based on characters of a sample malicious domain name and a plurality of connectors, and inputting the sample domain name character sequence into an initial domain name generation model to extract sequence features of the sample domain name character sequence by the initial domain name generation model;

[0007] determining a generation probability of each preset character based on the sequence features, and determining a sample generated domain name based on the generation probability;

[0008] determining an initial parameter set of the current initial domain name generation model, performing Bayesian optimization on model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set to obtain a target parameter set;

[0009] using the target parameter set as the model parameters of the initial domain name generation model to obtain a trained domain name generation model;

[0010] obtain a plurality of malicious domain names to be processed, and generate a domain name character sequence based on the plurality of malicious domain names;

[0011] input the domain name character sequence into the trained domain name generation model, and predict a target generated domain name with the same sequence feature as the malicious domain name sequence.

[0012] In some embodiments, the sample domain name character sequence is obtained by the following steps, including:

[0013] obtain a plurality of sample malicious domain names, and use a connector to connect the first character and the last character of different sample malicious domain names to obtain a sample domain name character sequence;

[0014] Alternatively, a randomly generated short sequence is obtained;

[0015] randomly insert the short sequence into a plurality of sequentially connected characters in any sample malicious domain name to obtain an updated sample malicious domain name;

[0016] use a connector to connect the first character and the last character of different updated sample malicious domain names to obtain a sample domain name character sequence.

[0017] In some embodiments, after obtaining the sample domain name character sequence constructed based on the characters of the sample malicious domain name and the plurality of connectors, the method further includes:

[0018] setting a fixed-size sliding window on the obtained sample domain name character sequence;

[0019] sliding the sliding window based on a preset step size, and determining the characters and / or connectors located in the sliding window as an updated sample domain name character sequence.

[0020] In some embodiments, the sequence feature of the sample domain name character sequence is extracted by an initial domain name generation model, including:

[0021] extracting features from the sample domain name character sequence in a forward direction to obtain a first sequence feature representing a forward sequence dependency relationship between the plurality of domain name characters;

[0022] extracting features from the sample domain name character sequence in a reverse direction to obtain a second sequence feature representing a reverse sequence dependency relationship between the plurality of domain name characters;

[0023] fusing the first sequence feature and the second sequence feature to obtain a sequence feature corresponding to the sample domain name character sequence.

[0024] In some embodiments, the sequence feature of the sample domain name character sequence is extracted by an initial domain name generation model, further including:

[0025] update the first sequence feature based on a preset first weight to obtain an updated first sequence feature;

[0026] update the second sequence feature based on a preset second weight to obtain an updated second sequence feature;

[0027] fuse the updated first sequence feature and the updated second sequence feature to obtain a sequence feature corresponding to the sample domain name character sequence.

[0028] In some embodiments, Bayesian optimization is performed on model parameters of an initial domain name generation model based on a sample generated domain name and an initial parameter set to obtain a target parameter set, including:

[0029] obtaining a predefined target function, the target function being used to represent a negative average loss of the sample generated domain name;

[0030] constructing a Bayesian tuning model based on the sample generated domain name and the initial parameter set having the corresponding relationship, and determining a sampling function for evaluating the quality of the initial parameter set based on the Bayesian tuning model;

[0031] under the premise of optimizing the sampling function, sampling other initial parameter sets based on the Bayesian tuning model in addition to the determined sample generated domain name, and determining a new sample generated domain name when the initial domain name generation model works under the sampled initial parameter set;

[0032] until a preset iteration condition is reached, selecting the target parameter set from the initial parameter sets of the plurality of updated sample generated domain names.

[0033] In some embodiments, determining the sampling function for evaluating the quality of the initial parameter set based on the Bayesian tuning model includes:

[0034] determining a current optimal initial hyperparameter set from the plurality of existing initial hyperparameter sets;

[0035] determining mean information based on the current optimal initial hyperparameter set and a preset cumulative distribution function, and determining standard deviation information based on the current optimal initial hyperparameter set and a preset probability density function;

[0036] superimposing the mean information and the standard deviation information to construct the sampling function for evaluating the quality of the initial hyperparameter set.

[0037] To achieve the above object, a second aspect of the embodiments of the present application proposes a domain name generation model training method, which comprises:

[0038] The sample domain name character sequence constructed based on the characters and the plurality of connectors of the sample malicious domain name is input into an initial domain name generation model, and sequence features of the sample domain name character sequence are extracted by the initial domain name generation model;

[0039] A generation probability of each preset character is determined based on the sequence features, and a sample generated domain name is determined based on the generation probability;

[0040] An initial parameter set of the current initial domain name generation model is determined, Bayesian optimization is performed on model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, and a target parameter set is obtained;

[0041] The target parameter set is used as the model parameters of the initial domain name generation model, and a trained domain name generation model is obtained.

[0042] To achieve the above object, a third aspect of an embodiment of the present application provides a malicious domain name generation device, the device comprising:

[0043] A first acquisition module is configured to acquire a sample domain name character sequence constructed based on characters and a plurality of connectors of a sample malicious domain name, input the sample domain name character sequence into an initial domain name generation model, and extract sequence features of the sample domain name character sequence by the initial domain name generation model;

[0044] A sample generated domain name determination module is configured to determine a generation probability of each preset character based on the sequence features, and determine a sample generated domain name based on the generation probability;

[0045] A target parameter set determination module is configured to determine an initial parameter set of a current initial domain name generation model, perform Bayesian optimization on model parameters of the initial domain name generation model based on a sample generated domain name and the initial parameter set, and obtain a target parameter set;

[0046] A domain name generation model determination module is configured to use the target parameter set as the model parameters of the initial domain name generation model, and obtain a trained domain name generation model;

[0047] A second acquisition module is configured to acquire a plurality of malicious domain names to be processed, and generate a domain name character sequence based on the plurality of malicious domain names;

[0048] A target generated domain name determination module is configured to input the domain name character sequence into the trained domain name generation model, and predict a target generated domain name with the same sequence features as the malicious domain name.

[0049] To achieve the above object, a fourth aspect of the embodiment of the present application provides an electronic device, comprising a memory and a processor, the memory stores a computer program, and the processor implements the malicious domain name generation method of the first aspect or the domain name generation model training method of the second aspect when executing the computer program.

[0050] To achieve the above object, a fifth aspect of the embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the malicious domain name generation method of the first aspect or the domain name generation model training method of the second aspect.

[0051] The malicious domain name generation method, the domain name generation model training method and the related device provided by the present application, by obtaining a sample domain name character sequence constructed based on characters of a sample malicious domain name and a plurality of connectors, inputting the sample domain name character sequence into an initial domain name generation model, extracting sequence features of the sample domain name character sequence through the initial domain name generation model, determining a generation probability of each preset character based on the sequence features, and determining a sample generated domain name based on the generation probability, determining an initial parameter set of the current initial domain name generation model, performing Bayesian optimization on model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, obtaining a target parameter set, taking the target parameter set as the model parameters of the initial domain name generation model, and obtaining a trained domain name generation model, the present application intelligently selects evaluation points by performing Bayesian optimization on the initial domain name generation model, significantly reduces the number of model training, and finds a global optimal solution close to the global optimal solution in limited hyperparameter evaluation; then, a plurality of malicious domain names to be processed are obtained, and a domain name character sequence is generated based on the plurality of malicious domain names; inputting the domain name character sequence into the trained domain name generation model, and predicting a target generated domain name with the same sequence feature as the malicious domain name, in this way, by predicting the target generated domain name that may exist abnormally in advance, the forward-looking and efficiency of malicious domain name detection are improved, and the computing resource is saved. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 is an optional flowchart of the malicious domain name generation method provided by the embodiment of the present application;

[0053] Figure 2 is an optional domain name generation model training and application flowchart of the malicious domain name generation method provided by the embodiment of the present application;

[0054] Figure 3 is an optional sample domain name character sequence generation flowchart of the malicious domain name generation method provided by the embodiment of the present application;

[0055] Figure 4 isFigure 1 An optional implementation flowchart after step 101 in

[0056] Figure 5 An optional implementation flowchart in step 101 in Figure 1

[0057] Figure 6 An optional model processing and Bayesian optimization flowchart of the malicious domain name generation method provided by the embodiments of the present application;

[0058] Figure 7 An optional implementation flowchart in step 101 in Figure 1

[0059] Figure 8 An optional implementation flowchart in step 103 in Figure 1

[0060] Figure 9 An optional implementation flowchart in step 602 in Figure 8

[0061] Figure 10 An optional flowchart of the domain name generation model training method provided by the embodiments of the present application;

[0062] Figure 11 An optional flowchart of the malicious domain name generation device provided by the embodiments of the present application;

[0063] Figure 12 A hardware structure schematic diagram of the electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0064] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0065] It should be noted that although the functional modules are divided in the device schematic diagram, and the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a manner different from the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and above-described drawings are used to distinguish similar objects, and do not necessarily describe a specific order or sequence.

[0066] ​​​​Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to be limiting of this application.

[0067] A malicious domain name refers to a domain name of a malicious website, and detecting a malicious domain name is of great significance to network security. A domain name generation method is a technical means for generating a large number of random or pseudo-random domain names of a command and control server. These domain names usually contain letters, numbers and connectors, and have no obvious regularity in structure, so that a malicious attacker can use the DGA domain name generated by the DGA to evade security detection.

[0068] With the development of the Internet, the DGA has gradually become one of the commonly used technical means of malicious software. The DGA technology not only increases the difficulty of malicious software detection, but also improves the concealment and persistence of malicious behavior, bringing a serious challenge to network security. The domain names dynamically generated by this method are not only large in number, but also change rapidly, and the traditional method based on feature extraction and classification is difficult to effectively cope with.

[0069] That is, in the face of a large number of complex and unpredictable DGA domain names, the related technology needs to consume a large amount of time and computing resources to train the generative model, otherwise the generative model cannot mine potential rules from a large number of DGA domain names, so that the related technology cannot efficiently generate an abnormal list containing similar domain names based on the currently generated DGA domain names, thereby causing the detection efficiency of malicious domain names to be low.

[0070] Based on this, the embodiments of the present application provide a malicious domain name generation method, a domain name generation model training method and related equipment, which can improve the generation efficiency of malicious domain names, and further improve the detection efficiency of malicious domain names.

[0071] It should be noted that in the embodiments of the present application, when it is necessary to obtain user's basic information or information related to user's identity and user characteristics, the user's permission or consent will be obtained first, and the collection, use and processing of these data will comply with relevant laws, regulations and standards. In addition, when the embodiments of the present application need to obtain sensitive personal information of the user, the separate permission or separate consent of the user will be obtained first, and after obtaining the separate permission or separate consent of the user, the necessary data for enabling the embodiments of the present application to operate normally will be obtained, for example, when the embodiments of the present application obtain sample malicious domain names, the authorization or consent of the personnel related to the institution managing the sample malicious domain names will be obtained first, otherwise the sample malicious domain names cannot be used in the embodiments of the present application. In addition, other related data obtained by the malicious domain name generation device of the present application are all authorized data, which will not be described one by one here.

[0072] In the embodiments of the present application, the malicious domain name generation device will be described from the dimension of the malicious domain name generation device, which can be integrated in a computer device, such as a server. As shown in Figure 1 , Figure 1 is an optional flowchart of the malicious domain name generation method provided by the embodiments of the present application, Figure 1 The method in the embodiments of the present application can include but is not limited to the following steps 101 to 106. When the malicious domain name generation device executes the malicious domain name generation method, the specific process is as follows. It should be first pointed out that the order of steps 101 to 106 in the embodiments of the present application is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or increased according to actual needs. Figure 1

[0073] Step 101, obtaining a sample domain name character sequence constructed based on characters of a sample malicious domain name and a plurality of connectors, and inputting the sample domain name character sequence into an initial domain name generation model to extract sequence features of the sample domain name character sequence by the initial domain name generation model.

[0074] Step 101 will be described in detail below.

[0075] Among them, the sample malicious domain name is a domain name extracted from known malicious activities (such as phishing attacks, malicious software distribution, etc.). The sample malicious domain name usually contains some specific character patterns or structures, which can be used to deceive users or bypass security detection. The sample malicious domain name can be obtained through log analysis, information sharing platform collection, third-party acquisition, etc.

[0076] Further, the sample malicious domain name includes a plurality of sequentially connected characters, which can be letters, numbers, special characters, etc. (such as "@", "_"). Exemplarily, a certain sample malicious domain name is www.abc.com, which includes letters and special characters. Among them, the connector can be a symbol different from the characters of the sample malicious domain name, such as space, etc. The specific adjustment can be made according to the actual situation, and the embodiments of the present application do not make any limitation.

[0077] Further, the obtained sample domain name character sequence is input into the initial domain name generation model, so that the domain name generation model extracts the sequence features representing the distribution feature relationship between the plurality of characters from the sample domain name character sequence, and then facilitates the domain name generation model to generate a sample generated domain name similar to the sample malicious domain name based on the sequence features, and realizes the training of the domain name generation model.

[0078] In some embodiments, as shown in Figure 2 , Figure 2 ​is an optional domain name generation model training and application flowchart of the malicious domain name generation method provided by the embodiment of the present application, the malicious domain name generation method provided by the embodiment of the present application includes a training phase and an application phase, specifically, the training phase includes:

[0079] (1) obtaining a sample malicious domain name;

[0080] (2) processing the sample malicious domain name to obtain a sample domain name character sequence, wherein the sample domain name character sequence is constructed based on the characters and multiple connectors of the sample malicious domain name;

[0081] (3) inputting the sample domain name character sequence into an initial domain name generation model to generate a sample generated domain name with the same characteristics as the sample malicious domain name;

[0082] (4) performing Bayesian optimization on the initial domain name generation model according to the sample generated domain name and the initial hyperparameter set set by the current domain name generation model to obtain a trained domain name generation model.

[0083] In some embodiments, as shown in Figure 3 , Figure 3 is an optional sample domain name character sequence generation flowchart of the malicious domain name generation method provided by the embodiment of the present application, and the sample domain name character sequence is obtained through the following steps 201 to 204:

[0084] Step 201, obtaining a plurality of sample malicious domain names, and connecting the first character and the last character of different sample malicious domain names by using a connector to obtain a sample domain name character sequence.

[0085] Step 202, or, obtaining a randomly generated short sequence.

[0086] Step 203, randomly inserting the short sequence in the multiple sequentially connected characters of any sample malicious domain name to obtain an updated sample malicious domain name.

[0087] Step 204, connecting the first character and the last character of different updated sample malicious domain names by using a connector to obtain a sample domain name character sequence.

[0088] The steps 201 to 204 are described in detail below.

[0089] In some embodiments, in order to finally generate similar malicious domain names, it is usually necessary to analyze the features of multiple sample malicious domain names, and connect multiple sample malicious domain names by a connection symbol to obtain a sample domain name character sequence for analysis by the domain name generation model. For example, the multiple sample malicious domain names are www.xyz.com, www.tk.com, and www.ga.com, and the connection symbol is "-". By connecting the first character and the last character of different sample malicious domain names by the connection symbol, the sample domain name character sequence is obtained as www.xyz.com-www.tk.com-www.ga.com.

[0090] In some embodiments, as the transformation of malicious domain names becomes more and more diverse, in order to improve the prediction accuracy of malicious domain names, the sample malicious domain names can also be modified to increase the complexity of the sample malicious domain names, thereby helping to train the ability of the domain name generation model to process complex sample malicious domain names.

[0091] The short sequence is generated by random combination of characters. In addition, the number of characters in the short sequence is usually controlled within a certain small threshold range, so that in the subsequent process of randomly inserting the short sequence into the sample malicious domain name, the influence on the sample malicious domain name is as small as possible, while the richness of the sample domain name character sequence is as large as possible.

[0092] Further, the specific generation method of the short sequence can be set according to actual conditions, such as manually inputting the short sequence by artificial, calling a library function to generate the short sequence, or randomly generating the short sequence by a pre-set programming function, and the embodiments of the present application do not limit this.

[0093] Further, after obtaining the short sequence, the short sequence is inserted into any position of the sample malicious domain name, for example, a sample malicious domain name is test.com, and the short sequence to be inserted is a, then the short sequence a can be inserted into any A position: AtAeAsAtA.AcAoAmA, to obtain an updated sample malicious domain name. Alternatively, a sample malicious domain name can be inserted with multiple short sequences, and the embodiments of the present application do not limit this.

[0094] Further, for the obtained multiple sample malicious domain names, some sample malicious domain names are selected to insert the short sequence, or all sample malicious domain names are updated by inserting the short sequence, and the specific setting is according to actual conditions. After obtaining the updated sample malicious domain name, the first character and the last character of different updated sample malicious domain names are connected by a connection symbol to obtain a sample domain name character sequence.

[0095] In some embodiments, as shown in FIG. 5, the domain name generation model is trained by using the sample domain name character sequence as the training data. Figure 4 Figure 4 is Figure 1 ​An optional implementation flowchart after step 101 in the method, after obtaining the sample domain name character sequence constructed based on the characters and multiple connectors of the sample malicious domain name, further comprises the following steps 301 to 302:

[0096] Step 301, setting a fixed-size sliding window on the obtained sample domain name character sequence.

[0097] Step 302, sliding the sliding window based on a preset step length, and determining the characters and / or connectors located in the sliding window as an updated sample domain name character sequence.

[0098] The following describes steps 301 to 302 in detail.

[0099] The sliding window is a window used to slide on the target sequence with a fixed size, so as to extract continuous elements with a preset length from the sample domain name character sequence. For example, if the size of the sliding window is 3, it will extract 3 elements from the starting position of the text; then, it will move one bit (preset step length) to the right, continue to extract the current 3 elements located in the sliding window, and so on. The updated sample domain name character sequence is input into the initial domain name generation model for subsequent processing.

[0100] That is, by setting a fixed-size sliding window and sliding on the sample domain name character sequence based on a preset step length, an updated sample domain name character sequence is obtained. In this way, the number of characters processed each time is limited by the fixed-size sliding window, avoiding indiscriminate traversal of the entire sequence, thereby reducing the amount of calculation and improving the processing efficiency.

[0101] It should be noted that the window size and step length can be adaptively adjusted according to actual conditions, so as to flexibly adapt to sample domain name character sequences of different lengths without additional preprocessing of the sequence.

[0102] Step 102, determining the generation probability of each preset character based on the sequence features, and determining the sample generated domain name based on the generation probability.

[0103] In some embodiments, the obtained sample domain name character sequence is input into the initial domain name generation model. In this embodiment, the domain name generation model is a Bidirectional Long Short-Term Memory (BiLSTM) network. BiLSTM is an improved recurrent neural network that can process sequential data and maintain long-term memory, thus better capturing the contextual relationships within the sequential data. Of course, the domain name generation model can also be a neural network model, a generative adversarial network model, etc., and the specific model can be selected according to the actual situation. This embodiment does not impose any limitations on this. Furthermore, the domain name generation model without Bayesian optimization is the initial domain name generation model.

[0104] The preset characters are used to characterize the characters that the sample generated domain name output by the domain name generation model may include. For example, if the sample generated domain name is set to consist only of letters and numbers, then letters and numbers are preset characters. Of course, the preset characters may also include special characters. The preset characters are adaptively adjusted according to the actual prediction situation, and this application embodiment does not impose any restrictions on this.

[0105] Furthermore, the domain name generation model determines the generation probability of each preset character based on sequence features. Typically, the character with the highest generation probability is selected as the most likely output character at the current sequence position, and this process continues until all characters at all sequence positions are confirmed, resulting in the sample generated domain name. It can be understood that the sample generated domain name is a similar domain name that the initial domain name generation model predicts might be generated by malware that generates the sample malicious domain name based on the sequence features of the sample domain name's character sequence.

[0106] The following explains how to extract sequence features from the character sequences of sample domain names, and how to determine the generated domain names of the samples based on the sequence features:

[0107] In some embodiments, such as Figure 5 As shown, Figure 5 yes Figure 1 An optional implementation flowchart in step 101 extracts sequence features of the sample domain name character sequence through the initial domain name generation model, including the following steps 401 to 403:

[0108] Step 401: Extract features from the sample domain name character sequence from the positive direction to obtain the first sequence features representing the positive order dependency relationship between multiple domain name characters.

[0109] Step 402: Extract features from the sample domain name character sequence from the reverse direction to obtain the second sequence features that represent the reverse order dependency relationship between multiple domain name characters.

[0110] In step 403, the first sequence feature and the second sequence feature are fused to obtain a sequence feature corresponding to the sample domain name character sequence.

[0111] The steps 401 to 403 are described in detail below.

[0112] As shown in Figure 6 , Figure 6 is an optional model processing and Bayesian optimization flowchart of the malicious domain name generation method provided by the embodiment of the application, the obtained sample domain name character sequence is taken as the input of the Bi LSTM model, and the following processing is performed.

[0113] (1) Embedding layer: mapping the sample domain name character sequence into a corresponding vector representation;

[0114] (2) Forward LSTM layer: processing the sample domain name character sequence from left to right (forward direction) in the forward time order to extract the first sequence feature representing the forward sequence dependency relationship between multiple domain name characters;

[0115] (3) Backward LSTM layer: processing the sample domain name character sequence from right to left (reverse direction) in the reverse time order to extract the second sequence feature representing the reverse sequence dependency relationship between multiple domain name characters; by capturing the forward and reverse time dependencies in the sample domain name character sequence, the accuracy and coherence of the finally generated sample generated domain name are improved;

[0116] (4) Connection layer: connecting the hidden states of the forward LSTM layer and the backward LSTM layer at each time step to form a combined hidden state (sequence feature) containing bidirectional information;

[0117] (5) LSTM layer: an additional LSTM layer is also provided in the Bi LSTM model to further integrate the bidirectional time dependencies of the combined hidden state;

[0118] (6) Fully connected layer: the fully connected layer maps the final hidden state of the LSTM layer to a set of output probabilities. Each output represents the probability distribution of possible characters at each time step, which is necessary for generating the next character in the domain name sequence;

[0119] (7) Output layer: the Softmax layer receives the logical values (logits) of the output and converts them into a probability distribution over the character set, where logits refer to the original, unprocessed scores or scores of the output layer; the probability distribution represents the possibility of each character becoming the next character in the generated domain name. The formula of applying Softmax to logits is shown in the following formula <1>:

[0120]

[0121] where z t，c is the logit of the corresponding character at time step t, P(x t = c|h t ) is the probability that character c becomes the next character; exp is the exponential function.

[0122] In some embodiments, as Figure 7 illustrated, Figure 7 is Figure 1 another optional implementation flowchart in step 101, the sequence features of the sample domain name character sequence are extracted by the initial domain name generation model, and the following steps 501 to 503 are further included:

[0123] Step 501, updating the first sequence feature based on a preset first weight to obtain an updated first sequence feature.

[0124] Step 502, updating the second sequence feature based on a preset second weight to obtain an updated second sequence feature.

[0125] Step 503, fusing the updated first sequence feature and the updated second sequence feature to obtain the sequence feature corresponding to the sample domain name character sequence.

[0126] The steps 501 to 503 are described in detail as follows.

[0127] The first weight is used to represent the importance of the first sequence feature in the sequence feature, and the second weight is used to represent the importance of the second sequence feature in the sequence feature. The demand for the features extracted by the positive sequence and the reverse sequence may be different in different application scenarios of the domain name generation model. The first sequence feature and the second sequence feature are updated by the first weight and the second weight respectively, which can train the attention degree of the domain name generation model to the feature information in different application scenarios, thereby improving the flexibility of determining the sequence feature.

[0128] Further, after obtaining the updated first sequence feature based on the first weight and obtaining the updated second sequence feature based on the second weight, the sequence feature corresponding to the sample domain name character sequence is obtained by fusing the updated first sequence feature and the updated second sequence feature. The fusion in step 503 is similar to the fusion in step 403, which will not be described here.

[0129] Step 103, determining an initial parameter set of the current initial domain name generation model, performing Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set to obtain a target parameter set.

[0130] The step 103 is described in detail as follows.

[0131] The initial parameter set refers to a set of hyperparameters set by the initial domain name generation model when processing the sample domain name character sequence to generate the sample generated domain name. The set of hyperparameters includes multiple hyperparameters, such as a learning rate, a training round number, a hidden layer dimension, a sliding window size, a batch size, a regularization parameter, and a momentum parameter. It should be noted that the specific hyperparameters included in the set of hyperparameters can be set according to actual conditions, and the embodiments of the present application do not limit this.

[0132] Further, the model parameters that affect the output results of the domain name generation model include two types: one is a parameter, and the other is a hyperparameter. The numerical calculation of the parameter is determined by a set of interpretable mathematical processes, and after the method is selected, the determination process basically does not require human intervention. Therefore, the final target parameter set adjusted by the embodiments of the present application actually refers to the set of hyperparameters. Because the types of hyperparameters are various, and an optimal solution cannot be given by a rigorous mathematical process, the adjustment of the hyperparameters is usually realized by manual intervention in the related art. It can be understood that manual parameter adjustment requires related technical personnel to have a deep understanding of the problem and the model, and therefore the process of parameter adjustment is usually time-consuming and inefficient.

[0133] Further, in another implementation method of the related art, the target parameter set is determined from a huge search space by automatic parameter adjustment. However, such a method consumes a considerable amount of training time and computing resources. Multiple hyperparameters usually have mutual dependency relationships, and therefore it is very difficult to find the best combination in a high-dimensional parameter space. Based on this, the embodiments of the present application propose to optimize the initial domain name generation model by using a Bayesian hyperparameter optimization method, to find a global optimal solution close to the global optimal solution by constructing a surrogate model of the objective function (a Bayesian optimization model) and intelligently selecting evaluation points based on the acquisition function, and to significantly reduce the number of model training times.

[0134] In some embodiments, as shown in FIG. 6, Figure 8 is an optional implementation flowchart of step 103 in FIG. 1, based on the sample generated domain name and the initial parameter set, the model parameters of the initial domain name generation model are subjected to Bayesian optimization to obtain the target parameter set, including the following steps 601 to 604: Figure 8 Figure 1 Step 601: Obtain a pre-defined objective function, which is used to represent the negative average loss of the sample generated domain name.

[0135] Step 602: Based on the sample generated domain name and the initial parameter set that have a corresponding relationship, a Bayesian optimization model is constructed, and based on the Bayesian optimization model, an acquisition function for evaluating the quality of the initial parameter set is determined.

[0136] Step 602: Based on the sample generated domain name and the initial parameter set that have a corresponding relationship, a Bayesian optimization model is constructed, and based on the Bayesian optimization model, an acquisition function for evaluating the quality of the initial parameter set is determined.

[0137] ​Step 603, under the premise of optimizing the acquisition function, sampling other initial parameter sets except the determined sample generation domain name based on the Bayesian optimization model, and determining a new sample generation domain name of the initial domain name generation model under the working of the sampled initial parameter set.

[0138] Step 604, until the preset iteration condition is reached, selecting a target parameter set from the initial parameter sets of the plurality of updated existing sample generation domain names.

[0139] In some embodiments, as shown in Figure 9 , Figure 9 is Figure 8 an optional implementation flowchart of step 602 in the method, determining an acquisition function for evaluating the quality of the initial parameter set based on the Bayesian optimization model, including the following steps 701 to 703:

[0140] Step 701, determining a current optimal initial hyperparameter set from a plurality of existing initial hyperparameter sets.

[0141] Step 702, determining mean information based on the current optimal initial hyperparameter set and a preset cumulative distribution function, and determining standard deviation information based on the current optimal initial hyperparameter set and a preset probability density function.

[0142] Step 703, superimposing the mean information and the standard deviation information to construct the acquisition function for evaluating the quality of the initial hyperparameter set.

[0143] The following describes steps 601 to 604 and steps 701 to 703 in detail.

[0144] As shown in Figure 6 , the input sample domain name character sequence is processed by using the BiLSTM model while being subjected to Bayesian optimization, specifically including:

[0145] (1) defining the objective function: since Bayesian optimization only supports finding the maximum value of the objective function, but cannot directly find the minimum value, the negative average loss of the sample generation domain name output by the BiLSTM model is taken as the objective function f(x) for optimization, wherein x represents each hyperparameter combination (initial parameter set) in the training process; wherein, the Bayesian optimization regards the objective function as a black box function, when the loss function of the BiLSTM has multiple local optima, the Bayesian optimization can intelligently avoid the local optima and search for the global optimum;

[0146] (2) Construct a surrogate model (Bayesian optimization model): Bayesian optimization uses a Gaussian process (GP) surrogate model to model the relationship between the initial hyperparameter set and the objective function (negative average loss); if the domain name generation model generates a sample generated domain name U under the condition that the initial parameter set U is set, it is said that the initial parameter set U and the sample generated domain name U have a corresponding relationship;

[0147] In this way, the embodiment of the application intelligently evaluates the next initial hyperparameter set through the surrogate model; specifically, the Gaussian process is a non-parametric Bayesian model that measures the similarity between different input points through a covariance function (kernel function), and after some observations are given, it can predict the target function distribution on unobserved points; the covariance function is usually expressed as formula <2> as follows:

[0148] k(x i , x j ) = Cov(f(x i ), f(x j )) <2>

[0149] Where x i represents the i-th observation point (initial hyperparameter set) x j represents the j-th observation point.

[0150] (3) Determine the acquisition function: the GP surrogate model can only provide predictions for the target function, so Bayesian optimization needs an acquisition function to determine the next evaluation point; the embodiment of the application selects the expected improvement (EI) as the acquisition function, where the goal of EI is to find the hyperparameter combination that maximizes the improvement of the current optimal solution, which is shown in formula <3> as follows:

[0151]

[0152] Where f(x) is the predicted value of the target function at the current point, f(x + ) is the known current optimal initial hyperparameter set after processing by the domain name generation model, σ(x) is the predicted standard deviation, Φ and φ are the preset cumulative distribution function (CDF) and the preset probability density function (PDF) of the normal distribution, respectively; is the mean information, is the standard deviation information, and the mean information and the standard deviation information are superimposed to obtain the acquisition function for evaluating the quality of the initial hyperparameter set.

[0153] (4) Select the next sampling point: in each step of Bayesian optimization, based on the prediction of the GP surrogate model and the acquisition function, select the initial hyperparameter set with the highest acquisition function value as the next sampling point; by selecting the observation point most likely to be improved, Bayesian optimization can find the global optimal solution in a limited number of evaluations.

[0154] (5) Update the surrogate model: once the result of the new initial hyperparameter set (sample generation domain name) is determined, Bayesian optimization adds the result to the GP surrogate model and re-trains it to update the GP surrogate model. This enables the surrogate model to more accurately approximate the target function until the preset iteration condition is reached, and the target parameter set is selected from the initial parameter sets of the multiple existing sample generation domain names after updating.

[0155] Step 104, taking the target parameter set as the model parameter of the initial domain name generation model to obtain the trained domain name generation model.

[0156] The step 104 is described in detail below.

[0157] It can be understood that the target parameter set is obtained after multiple iterations and optimization, and it can achieve better performance under a given target function. In this case, taking the target parameter set as the model parameter of the initial domain name generation model to obtain the trained domain name generation model has excellent malicious domain name prediction capability.

[0158] Step 105, obtaining a plurality of malicious domain names to be processed, and generating a domain name character sequence based on the plurality of malicious domain names.

[0159] Step 106, inputting the domain name character sequence into the trained domain name generation model to predict a target generation domain name with the same characteristics as the malicious domain name sequence.

[0160] The steps 105 to 106 are described in detail below.

[0161] In some embodiments, as shown in Figure 2 the malicious domain name generation method also includes an application stage. Specifically, the application stage includes:

[0162] (1) Obtain a malicious domain name;

[0163] (2) Process the malicious domain name using the domain name generation model determined in step 101 to obtain a domain name character sequence, wherein the domain name character sequence is constructed based on the characters of the malicious domain name and a plurality of connection symbols;

[0164] (3) Input the domain name character sequence into the trained domain name generation model to generate target generated domain names with the same characteristics as malicious domain names, and collect multiple target generated domain names to obtain an abnormal list;

[0165] (4) Detect domain names in the target network based on the anomaly list, and block domain names that may be abnormal. The target network...

[0166] It is understood that the embodiments of this application implement Bayesian optimization on the domain name generation model, enabling the optimized domain name generation model to efficiently explore the hyperparameter space, reducing the need for manual intervention, and enhancing the robustness of the overall model. Furthermore, experimental results show that the malicious domain name generation method proposed in these embodiments has significant potential in detecting and intercepting malicious domain names. Therefore, the apparatus using the malicious domain name generation method proposed in these embodiments becomes an important tool for strengthening network security defenses against botnets and other malware threats.

[0167] Furthermore, compared to methods that rely on manually extracted features and historical data labels, traditional methods are easily affected by changes in data distribution, leading to an inability to effectively predict unknown DGA domains. However, the Bayesian-optimized domain generation model obtained in this application can directly generate potential malicious domains by learning the distribution characteristics of DGA domains, thereby pre-constructing anomaly lists. This method not only reduces the false positive rate but also improves the foresight and efficiency of malicious domain detection, while saving computational resources.

[0168] In the field of cybersecurity, attackers often continuously update DGA (Distributed Domain Name Allocation) to upgrade malware, making the real-time update speed of DGA domains increasingly faster. This application's embodiments, through Bayesian optimization of the Bi LSTM model, can find the optimal hyperparameter combination in fewer iterations, thus significantly reducing experimental time and resource consumption. In practical applications, by rapidly constructing anomaly lists to predict and generate potential malicious domains (target generated domains) in advance, and by automatically optimizing hyperparameters to improve the efficiency and accuracy of the domain name generation process model, it provides strong technical support for cybersecurity defense.

[0169] like Figure 10 As shown, Figure 10 This is an optional flowchart of the domain name generation model training method provided in this application embodiment. The domain name generation model training method includes the following steps 801 to 804:

[0170] Step 801: Obtain the sample domain name character sequence constructed based on the characters of the sample malicious domain name and multiple connectors, and input the sample domain name character sequence into the initial domain name generation model to extract the sequence features of the sample domain name character sequence through the initial domain name generation model.

[0171] Step 802, determine the generation probability of each preset character based on the sequence characteristics, and determine the sample generated domain name based on the generation probability.

[0172] Step 803, determine the initial parameter set of the current initial domain name generation model, perform Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, and obtain the target parameter set.

[0173] Step 804, take the target parameter set as the model parameters of the initial domain name generation model, and obtain the trained domain name generation model.

[0174] Among them, the steps 801 to 804 are similar to the specific embodiments of steps 101 to 104, which will not be repeated here.

[0175] As shown in Figure 11 , Figure 11 is an optional flowchart of the malicious domain name generation device provided by the embodiments of the application, which includes the following modules 901 to 906:

[0176] The first acquisition module 901 is configured to acquire a sample domain name character sequence constructed based on characters of a sample malicious domain name and multiple connectors, and input the sample domain name character sequence into an initial domain name generation model to extract sequence characteristics of the sample domain name character sequence through the initial domain name generation model.

[0177] The sample generated domain name determination module 902 is configured to determine the generation probability of each preset character based on the sequence characteristics, and determine the sample generated domain name based on the generation probability.

[0178] The target parameter set determination module 903 is configured to determine the initial parameter set of the current initial domain name generation model, perform Bayesian optimization on the model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, and obtain the target parameter set.

[0179] The domain name generation model determination module 904 is configured to take the target parameter set as the model parameters of the initial domain name generation model, and obtain the trained domain name generation model.

[0180] The second acquisition module 905 is configured to acquire a plurality of malicious domain names to be processed, and generate a domain name character sequence based on the plurality of malicious domain names.

[0181] The target generated domain name determination module 906 is configured to input the domain name character sequence into the trained domain name generation model, and predict a target generated domain name with the same sequence characteristics as the malicious domain name.

[0182] The malicious domain name generation method, the domain name generation model training method and the related device provided in the application obtain a sample domain name character sequence constructed based on characters of a sample malicious domain name and multiple connectors, input the sample domain name character sequence into an initial domain name generation model, and extract sequence features of the sample domain name character sequence through the initial domain name generation model; the generation probability of each preset character is determined based on the sequence features, and a sample generated domain name is determined based on the generation probability; the initial parameter set of the current initial domain name generation model is determined, the model parameters of the initial domain name generation model are subjected to Bayesian optimization based on the sample generated domain name and the initial parameter set, and a target parameter set is obtained; the target parameter set is used as the model parameters of the initial domain name generation model, and a trained domain name generation model is obtained; the application intelligently selects an evaluation point by performing Bayesian optimization on the initial domain name generation model, significantly reduces the number of model training times, and finds a global optimal solution close to the limited hyperparameter evaluation; then, multiple malicious domain names to be processed are obtained, and domain name character sequences are generated based on the multiple malicious domain names; the domain name character sequences are input into the trained domain name generation model, and a target generated domain name with the same sequence feature as the malicious domain name is predicted, so that the target generated domain name that may exist abnormally is predicted in advance, the forward-looking and efficiency of malicious domain name detection are improved, and the computing resource is saved.

[0183] The specific implementation of the malicious domain name generation device is basically the same as that of the above-mentioned malicious domain name generation method, and will not be repeated here.

[0184] The application embodiment further provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor implements the above-mentioned malicious domain name generation method or domain name generation model training method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a vehicle-mounted computer, etc.

[0185] As shown in Figure 12 , the hardware structure of the electronic device provided in the application embodiment is shown in Figure 12 , which includes:

[0186] The processor 1001 can be implemented in a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, etc., and is used to execute related programs to implement the technical solutions provided in the application embodiment.

[0187] The memory 1002 can be implemented in the form of a read only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM), etc. The memory 1002 can store an operating system and other application programs. When the technical solutions provided by the embodiments of the present specification are implemented by software or firmware, the related program codes are stored in the memory 1002 and are called and executed by the processor 1001 to perform the malicious domain name generation method or the domain name generation model training method proposed in the embodiments of the present application;

[0188] The input / output interface 1003 is configured to realize information input and output.

[0189] The communication interface 1004 is configured to realize the communication interaction between the device and other devices. The communication can be realized by a wired manner (for example, a USB, a network cable, etc.) or a wireless manner (for example, a mobile network, WIFI, Bluetooth, etc.).

[0190] The bus 1005 is configured to transmit information between various components (for example, the processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004) of the device.

[0191] The processor 1001, the memory 1002, the input / output interface 1003, and the communication interface 1004 are connected to each other through the bus 1005 to realize the communication connection between the device.

[0192] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the malicious domain name generation method or the domain name generation model training method.

[0193] The memory is a non-transitory computer readable storage medium, which can be used to store non-transitory software programs and non-transitory computer executable programs. In addition, the memory can include a high-speed random access memory and can also include a non-transitory memory, for example, at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory remotely arranged relative to the processor. These remote memories can be connected to the processor through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0194] The embodiments described in the specification are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of technology and the appearance of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0195] Those skilled in the art can understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and can include more or fewer steps than shown in the figures, or combine certain steps, or different steps.

[0196] The device embodiments described above are only schematic, and the units described as separate components can or can not be physically separate, i.e., can be located in one place, or can be distributed on multiple network units. Part or all of the modules can be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0197] Those skilled in the art can understand that all or some of the steps in the above disclosed method, the functional modules / units in the system and the device can be implemented as software, firmware, hardware and their appropriate combinations.

[0198] The terms "first", "second", "third", "fourth" and the like (if any) in the specification of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0199] It should be understood that, in the application, "at least one" refers to one or more, and "multiple" refers to two or more. "And / or" is used to describe the association relationship of the associated objects, which means that there can be three relationships, for example, "A and / or B" can represent three cases of only A, only B, and A and B existing at the same time, wherein A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after it. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b or c can represent a, b, c, "a and b", "a and c", "b and c", or "a and b and c", wherein a, b, and c can be single or multiple.

[0200] In several embodiments provided in the application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative, for example, the division of the above units is only a logical function division, and actual implementation can have another division manner, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed units can be indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0201] The units described above as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or they can be distributed on multiple network units. According to actual needs, some or all of the units can be selected to achieve the purpose of the embodiment scheme.

[0202] In addition, each functional unit in each embodiment of the application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0203] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application, essentially or in other words, the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes multiple instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program storage media.

[0204] The preferred embodiments of the embodiments of the present application are described above with reference to the accompanying drawings, and are not limited to the scope of the embodiments of the present application. Any modifications, equivalent replacements and improvements made by those skilled in the art without departing from the scope and essence of the embodiments of the present application shall be within the scope of the embodiments of the present application.

Claims

1. A method for generating a malicious domain name, characterized by, The malicious domain name generation method comprises: obtaining a sample domain name character sequence constructed based on characters of sample malicious domain names and multiple connectors, and inputting the sample domain name character sequence into an initial domain name generation model to extract sequence features of the sample domain name character sequence through the initial domain name generation model; determining a generation probability of each preset character based on the sequence features, and determining a sample generated domain name based on the generation probability; determining an initial parameter set of the initial domain name generation model, performing Bayesian optimization on model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set to obtain a target parameter set; using the target parameter set as the model parameters of the initial domain name generation model to obtain a trained domain name generation model; obtaining multiple malicious domain names to be processed, and generating domain name character sequences based on the multiple malicious domain names; inputting the domain name character sequences into the trained domain name generation model to predict target generated domain names with the same sequence features as the malicious domain names. 2.The method of claim 1, wherein, The sample domain name character sequence is obtained by the following steps, which comprise: obtaining multiple sample malicious domain names, connecting the first character and the last character of different sample malicious domain names by using the connector to obtain the sample domain name character sequence; alternatively, obtaining a randomly generated short sequence; randomly inserting the short sequence in multiple sequentially connected characters of any sample malicious domain name to obtain an updated sample malicious domain name; connecting the first character and the last character of different updated sample malicious domain names by using the connector to obtain the sample domain name character sequence. 3.The method of claim 1, wherein, After the sample domain name character sequence constructed based on characters of sample malicious domain names and multiple connectors is obtained, the method further comprises: setting a fixed-size sliding window on the obtained sample domain name character sequence; sliding the sliding window based on a preset step to determine the characters and / or the connectors located in the sliding window as an updated sample domain name character sequence. 4.The method of claim 1, wherein, The sequence features of the sample domain name character sequence extracted through the initial domain name generation model comprise: performing feature extraction on the sample domain name character sequence from a positive direction to obtain first sequence features representing positive sequence dependency relationships between multiple domain name characters; performing feature extraction on the sample domain name character sequence from a reverse direction to obtain second sequence features representing reverse sequence dependency relationships between multiple domain name characters; fusing the first sequence features and the second sequence features to obtain the sequence features corresponding to the sample domain name character sequence. 5.The method of claim 4, wherein, The sequence features of the sample domain name character sequence extracted through the initial domain name generation model further comprise: updating the first sequence features based on a preset first weight to obtain updated first sequence features; updating the second sequence features based on a preset second weight to obtain updated second sequence features; fusing the updated first sequence features and the updated second sequence features to obtain the sequence features corresponding to the sample domain name character sequence. 6.The method of claim 1, wherein, The Bayesian optimization is performed on model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, to obtain a target parameter set, including: obtaining a predefined objective function, the objective function being used to represent a negative average loss of the sample generated domain name; constructing a Bayesian optimization model based on the sample generated domain name and the initial parameter set, and determining a sampling function for evaluating the quality of the initial parameter set based on the Bayesian optimization model; under the premise of optimizing the sampling function, sampling other initial parameter sets based on the Bayesian optimization model in addition to the determined sample generated domain name, and determining a new sample generated domain name when the initial domain name generation model works under the sampled initial parameter set; until a preset iteration condition is reached, selecting a target parameter set from the initial parameter sets of the plurality of updated sample generated domain names. 7.The method of claim 6, wherein, The Bayesian optimization is performed on model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, to obtain a target parameter set, including: determining a current optimal initial hyperparameter set from the plurality of initial hyperparameter sets; determining mean information based on the current optimal initial hyperparameter set and a preset cumulative distribution function, and determining standard deviation information based on the current optimal initial hyperparameter set and a preset probability density function; superimposing the mean information and the standard deviation information to construct the sampling function for evaluating the quality of the initial hyperparameter set. 8.A domain name generation model training method, characterized by, The domain name generation model training method includes: obtaining a sample domain name character sequence constructed based on characters of a sample malicious domain name and a plurality of connectors, and inputting the sample domain name character sequence into an initial domain name generation model to extract sequence features of the sample domain name character sequence through the initial domain name generation model; determining a generation probability of each preset character based on the sequence features, and determining a sample generated domain name based on the generation probability; determining an initial parameter set of the initial domain name generation model, performing Bayesian optimization on model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, to obtain a target parameter set; using the target parameter set as the model parameters of the initial domain name generation model to obtain a trained domain name generation model.

9. A malicious domain name generating apparatus characterized by comprising: The device includes: a first obtaining module configured to obtain a sample domain name character sequence constructed based on characters of a sample malicious domain name and a plurality of connectors, and input the sample domain name character sequence into an initial domain name generation model to extract sequence features of the sample domain name character sequence through the initial domain name generation model; a sample generated domain name determining module configured to determine a generation probability of each preset character based on the sequence features, and determine a sample generated domain name based on the generation probability; a target parameter set determining module configured to determine an initial parameter set of the initial domain name generation model, perform Bayesian optimization on model parameters of the initial domain name generation model based on the sample generated domain name and the initial parameter set, to obtain a target parameter set; A domain name generation model module is configured to take the target parameter set as model parameters of an initial domain name generation model to obtain a trained domain name generation model. A second acquisition module is configured to acquire a plurality of malicious domain names to be processed, and generate domain name character sequences based on the plurality of malicious domain names. A target generated domain name module is configured to input the domain name character sequences into the trained domain name generation model to predict a target generated domain name with the same sequence feature as the malicious domain name.

10. An electronic device, comprising: The electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the malicious domain name generation method of any one of claims 1 to 7 or the domain name generation model training method of claim 8 when executing the computer program.

11. A computer-readable storage medium storing a computer program, wherein the computer program comprises the following steps of: The computer program is executed by the processor to implement the malicious domain name generation method of any one of claims 1 to 7 or the domain name generation model training method of claim 8. The computer program is executed by the processor to implement the malicious domain name generation method of any one of claims 1 to 7 or the domain name generation model training method of claim 8.

Images