Malicious domain name studying and judging method based on search engine and generative language model

Abstract

The invention provides a malicious domain name studying and judging method based on a search engine and a generative language model, and the method comprises the steps: carrying out the deep analysis of a domain name through the search engine and the generative language model, associating internal malicious information, making a judgment, and obtaining a multi-dimensional judgment result through the combination of a model real-time analysis result and an internal information analysis result. And then auditing is carried out by auditing personnel, final domain name research and judgment result data is input into a domain name research and judgment result database, and a model training data set is extracted from the final domain name research and judgment result data at regular intervals to optimize a malicious domain name large model, so that malicious domain names are identified and researched and judged, and the accuracy and efficiency of research and judgment are improved. Compared with a traditional malicious domain name detection method, the scheme has the advantages that by combining the search engine and the generative language model, the study and judgment efficiency and accuracy are greatly improved, and the false alarm rate is reduced. According to the method, the novel malicious domain name can be effectively identified, the workload of manual analysis is reduced, and the overall network security defense capability is improved.

Description

Technical Field

[0001] The present invention relates to the field of electronic digital data technology, and in particular to a malicious domain name analysis method based on a search engine and a generative language model. Background Art

[0002] The domain name system is a key component of the Internet, but malicious domain names are often used to conduct cyber attacks and illegal activities. Traditional detection methods mainly rely on manual analysis, which is not only inefficient but also difficult to cope with the ever-changing malicious domain name strategies. Although search engines can provide a lot of information, the manual screening process is cumbersome and error-prone. Generative language models have potential in text analysis, but existing detection technologies often have high false positive rates and strict requirements on device performance. Therefore, there is an urgent need for a new method that combines search engines and generative language models to improve the efficiency and accuracy of malicious domain name analysis. Summary of the invention

[0003] The present invention aims to solve the problem of identifying and judging malicious domain names, and provides a malicious domain name judging method based on a search engine and a generative language model. The search engine and the generative language model are used to conduct in-depth analysis of domain names, associate malicious intelligence and make judgments, so as to identify and judge malicious domain names and improve the accuracy and efficiency of the judgment.

[0004] The present invention provides a malicious domain name analysis method based on a search engine and a generative language model, comprising the following steps:

[0005] S1. Obtaining original data including domain name information;

[0006] S2, preprocessing the original data to extract the domain name to be analyzed;

[0007] S3, check the validity of the domain name to be analyzed, if it is valid, proceed to step S4, if it is invalid, return to step S1;

[0008] The validity check includes: checking whether the domain name to be analyzed complies with the domain name naming rules, whether the DNS of the domain name to be analyzed is alive, and judging whether the domain name to be analyzed is valid based on the check results;

[0009] S4, by calling the domain name judgment result database to check the historical records of the domain name to be analyzed, determine whether the domain name to be analyzed has a judgment record within the time threshold, if there is a judgment record within the time threshold, then enter step S12, if there is no judgment record within the time threshold or the judgment record exceeds the time threshold, then enter step S5;

[0010] S5, calling a search engine to retrieve malicious threat intelligence related to the domain name to be analyzed in real time to obtain a search engine search result;

[0011] S6. Calling the malicious domain name big model to analyze the search engine retrieval results to obtain the model real-time analysis results, the model real-time analysis results include the malicious labels determined by the big model;

[0012] S7, calling the internal intelligence interface to query the domain name intelligence related to the domain name to be analyzed to obtain the internal intelligence analysis result, the internal intelligence analysis result includes the internal intelligence malicious label, and the internal intelligence analysis result is a non-real-time intelligence analysis result;

[0013] S8. Combining the real-time analysis results of the model with the internal intelligence analysis results to obtain a multi-dimensional judgment result;

[0014] S9. The audit platform assigns the audit task of the multi-dimensional determination results to the auditor;

[0015] S10, the auditor manually reviews the multi-dimensional judgment results, excludes false positives, marks the verified intelligence, and outputs the final domain name judgment result data. The optimization of the malicious domain name large model enters step S13, and the final domain name judgment result data is stored in the database and enters step S11;

[0016] S11, entering the final domain name determination result data into the domain name determination result database;

[0017] S12, using the final domain name analysis result data or calling the analysis record of the domain name analysis result database for actual business scenarios, providing data support for network security monitoring, threat intelligence analysis, and security incident response, and returning to step S1;

[0018] S13, regularly extracting model training data sets from the final domain name analysis result data;

[0019] S14. Optimize the malicious domain name model based on the model training set and return to step S1.

[0020] The method for analyzing and determining malicious domain names based on a search engine and a generative language model described in the present invention is, as a preferred method, in step S1, original data containing domain name information is obtained through a data source, and the data source includes: firewall logs, intrusion detection system logs, Web proxy logs, and system event logs.

[0021] The malicious domain name analysis method based on a search engine and a generative language model described in the present invention is, as a preferred method, in step S2, the preprocessing method includes: data cleaning, format conversion and removal of duplicates, and the domain name to be analyzed is extracted by a protocol parsing method, and the protocol parsing method includes parsing the HTTP request header and parsing the DNS query record.

[0022] The method for analyzing malicious domain names based on a search engine and a generative language model described in the present invention is, as a preferred method, in step S3, a method for determining whether the domain name to be analyzed complies with the domain name naming rules is: determining by length restriction and character type;

[0023] The method to determine whether the domain name DNS is alive is: whether it can be resolved to an IP address.

[0024] The malicious domain name analysis method based on a search engine and a generative language model described in the present invention is, as an optimal method, in step S4, storing historical domain name analysis results and data in a domain name analysis result database.

[0025] The malicious domain name analysis method based on a search engine and a generative language model described in the present invention is, as a preferred embodiment, in step S5, the malicious threat intelligence related to the domain name to be analyzed includes: the domain name to be analyzed is used for phishing, spreading malware, involving ransomware, and activities of APT malicious organizations;

[0026] Search engine retrieval results include information source, type, link, title and content introduction.

[0027] The method for analyzing malicious domain names based on a search engine and a generative language model described in the present invention is, as a preferred embodiment, in step S6, the malicious domain name large model includes: GLM-4-9B, Llama and ChatGPT4;

[0028] The malicious domain name model analyzes the search engine search results in combination with prompt words, where the prompt words are key information or guiding sentences provided to the malicious domain name model;

[0029] The prompt word defines the role positioning and analysis direction of the malicious domain name big model, provides reference materials for the analysis of the malicious domain name big model, and specifies the format of the final output content of the malicious domain name big model;

[0030] The role positioning and analysis direction of the malicious domain name model are as follows: as an intelligence analysis expert, analyze whether the domain name to be analyzed is related to malicious intelligence based on the search engine search results;

[0031] Reference materials for the analysis of the large model of malicious domain names include: search engine search results associated with the domain name to be analyzed;

[0032] The final output format of the malicious domain name model includes: malicious labels obtained through analysis, malicious determination reasons, reference links for malicious determination reasons, and intelligence timestamps;

[0033] The real-time analysis results of the model provide data support for the manual review in step S10.

[0034] The method for analyzing malicious domain names based on a search engine and a generative language model described in the present invention is, as an optimal method, in step S7, calling an internal intelligence interface to query domain name intelligence related to the domain name to be analyzed and supplementing threat-related information to obtain an internal intelligence analysis result, and the threat-related information includes information about malicious samples associated with the domain name and the malicious family to which it belongs.

[0035] The method for analyzing malicious domain names based on a search engine and a generative language model described in the present invention is, as a preferred method, in step S9, the audit platform defines the priority of the audit task and assigns the audit task to the auditor, and the basis for setting the priority is the urgency of the intelligence and / or the potential harm;

[0036] When the malicious labels of the internal intelligence and the malicious labels determined by the large model are both malicious, it is credible intelligence, and the domain name to be analyzed is a malicious domain name. When the manual review is performed in step S10, a 10% random check is conducted;

[0037] When only one of the malicious labels of the internal intelligence and the malicious label determined by the large model is malicious, it is listed as questionable intelligence, and all of them are reviewed during the manual review process in step S10;

[0038] When the malicious labels of internal intelligence and the malicious labels determined by the large model are both non-malicious, it is credible intelligence and the domain name to be analyzed is a non-malicious domain name;

[0039] In step S10, the auditor reviews the accuracy of the malicious labels determined by the big model and the malicious labels of the internal intelligence. The accuracy of the malicious labels determined by the big model can be judged by tracing the process of obtaining the real-time analysis results of the model, and the accuracy of the malicious labels of the internal intelligence can be judged by confirming the accuracy and credibility of the intelligence with internal personnel.

[0040] The method for malicious domain name analysis based on search engine and generative language model described in the present invention is, as a preferred embodiment, in step S13, the model training data set includes prompt words, search engine search results and final domain name analysis result data;

[0041] In step S14, the model training data set is fine-tuned using Lora, where 80% is used for training and 20% is used for testing the model accuracy.

[0042] The present invention provides a malicious domain name analysis method based on a search engine and a generative language model, comprising the following steps:

[0043] S1: Obtain input data, such as domain name-related log data, and obtain original data containing domain name information from source channels such as log files of security devices.

[0044] S2: Preliminary extraction of domain names

[0045] Perform preliminary processing on the original data in s1, parse it through HTTP, DNS and other protocols, extract the domain name, and submit the domain name data to S3.

[0046] S3: Domain name validity verification

[0047] The validity of the domain name is confirmed by checking whether the domain name complies with the domain name naming specifications and whether it is still alive. Invalid data will not proceed to the next step, and valid domain name data will be submitted to S4 for processing.

[0048] S4: Domain name history check

[0049] The resource "Domain Name Analysis Result Database" is called. This database stores historical data such as domain name analysis results. This database is called to check whether there are historical records that do not exceed the time threshold. If so, it goes to S12, otherwise it goes to S5.

[0050] S5: Domain Search

[0051] Multiple search engines are called through the interface to search for malicious threat intelligence related to domain names in real time. The search results will be collected and passed to the next stage S6.

[0052] S6: "Malicious Domain Name Big Model" Analyze Domain Names

[0053] This phase uses advanced big data analysis models and calls the fine-tuned and optimized "malicious domain name big model" to conduct in-depth analysis of the domain name search results collected in the S5 phase. The analysis results will include specific domain names, intelligence timestamps, research conclusions, conclusion basis, and related reference links, and the analysis results will be submitted to S7.

[0054] S7: Internal intelligence interface query

[0055] The system will call the internal intelligence interface to query other intelligence data related to the target domain name.

[0056] S8: Integrate real-time search intelligence and non-real-time intelligence interface intelligence to obtain multi-dimensional judgment results

[0057] At this stage, the system will integrate the real-time search intelligence output by S6 and the non-real-time intelligence obtained through the internal intelligence interface in S7 to form a comprehensive multi-dimensional judgment result, and the data will be passed to S9.

[0058] S9: Audit platform assigns audit tasks

[0059] According to the workflow and actual business needs, the system defines the audit priority and assigns the task to the corresponding auditor, ensuring that key intelligence can be processed in a timely manner.

[0060] S10: Manual review and output of final domain name analysis result data

[0061] Professional security intelligence personnel will conduct a detailed review of the multi-dimensional judgment results generated in the S8 stage, eliminate false positives, and mark the verified intelligence.

[0062] S11: Database of domain name analysis results

[0063] The domain name intelligence data that has been manually reviewed and confirmed to be correct in the S10 stage will be entered into the "Domain Name Analysis Result Database" for subsequent queries and business applications.

[0064] S12: Actual business scenario use

[0065] In actual business scenarios involving domain name intelligence analysis, the system will call the "Domain Name Analysis Result Database" and related resources to provide relevant data support.

[0066] S13: Training dataset extraction

[0067] Model training datasets are regularly extracted from manually corrected precision data.

[0068] S14: Fine-tune and optimize the “Malicious Domain Name Model”

[0069] Fine-tune and optimize the "malicious domain name model" to improve the accuracy of malicious judgments.

[0070] The present invention has the following advantages:

[0071] Compared with traditional malicious domain name detection methods, this solution greatly improves the efficiency and accuracy of research and judgment by combining search engines and generative language models, and reduces the false alarm rate. This method can effectively identify new malicious domain names, reduce the workload of manual analysis, and improve the overall network security defense capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 This is a flowchart of a malicious domain name analysis method based on search engines and generative language models. DETAILED DESCRIPTION

[0073] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments.

[0074] Example 1

[0075] like Figure 1 As shown, a malicious domain name analysis method based on a search engine and a generative language model includes the following steps:

[0076] S1: Get input data, such as domain name related log data

[0077] This phase involves extracting raw data containing domain name information from various security device log files and other relevant data sources. These data sources may include but are not limited to firewall logs, intrusion detection system logs, web proxy logs, system event logs, etc. Through automated scripts or tools, these log files are captured regularly to ensure the real-time and integrity of the data, providing a solid data foundation for subsequent domain name analysis.

[0078] Processing example:

[0079] For example, the following log data is captured from the system as input:

[0080] GET / reDuh.aspx? action=checkPort&port=42000HTTP / 1.1User-Agent:Java / 1.8.0_251

[0081] Host:nsjdhmdjs.comAccept:text / html,image / gif,image / jpeg,*;q=.2,* / *;q=.2Connection:keep-alive

[0082] S2: Preliminary extraction of domain names

[0083] In this phase, the raw data collected in the S1 phase is preprocessed, including data cleaning, format conversion, and duplicate removal. Protocol parsing technologies such as HTTP request headers and DNS query records are used to accurately extract domain name information from the logs. During the extraction process, the system automatically identifies and excludes invalid or erroneous records to ensure the quality of domain name data submitted to the S3 phase.

[0084] Processing example:

[0085] For example, based on log data:

[0086] GET / reDuh.aspx? action=checkPort&port=42000HTTP / 1.1User-Agent:Java / 1.8.0_251

[0087] Host:nsjdhmdjs.comAccept:text / html,image / gif,image / jpeg,*;q=.2,* / *;q=.2Connection:keep-alive

[0088] Extract the domain name:

[0089] nsjdhmdjs.com

[0090] S3: Domain name validity verification

[0091] In this phase, the extracted domain names are checked for validity, including whether the domain names comply with international domain name naming rules (such as length restrictions, character types, etc.) and whether the domain name's survival status can be confirmed through DNS queries (such as whether it can be resolved to an IP address). For invalid or non-compliant domain name data, the system will log and mark them, and only submit valid domain name data to the next processing phase.

[0092] Processing example:

[0093] For example, checking the nsjdhmdjs.com domain name, we get the following results:

[0094] Comply with domain name naming rules: Yes

[0095] Is the domain name DNS alive: alive

[0096] Is the domain name valid: Valid

[0097] S4: Domain name history check

[0098] At this stage, the system will call the "Domain Name Research and Judgment Result Database", which stores historical domain name research and judgment results and related data. Through the set time threshold, check whether the current domain name has a research and judgment record in the past period of time. If there is a relevant record, the system will directly enter the S12 stage based on the historical data to avoid duplication of work; if not, continue to the next step of search and analysis.

[0099] Processing example:

[0100] ①No relevant records exist:

[0101] For example, if the domain name nsjdhmdjs.com is checked and no historical records are found, the next step is to search and analyze.

[0102] ②Relevant records exist

[0103] Domain name: nsjdhmdjs.com

[0104] Timestamp: 20230503

[0105] (1) If the timestamp exceeds the set time threshold, the next step of search and analysis will be entered

[0106] (2) The timestamp does not exceed the set time threshold and enters the S12 stage. Business scenario application

[0107] S5: Domain Search

[0108] Through the pre-set interface, the system will call multiple well-known search engines to retrieve malicious threat intelligence related to the domain name in real time. This intelligence may include but is not limited to domain names used for phishing, spreading malware, involving ransomware, APT (advanced persistent threat) malicious organizations and other activities. The search results will be recorded in detail, including the source of intelligence, type, related description, etc., and passed to the next stage.

[0109] Processing example:

[0110] For example, the search results for nsjdhmdjs.com are as follows:

[0111] [{'Link':

[0112] 'https: / / www.hivepro.com / wp-content / uploads / 2023 / 05 / Dragon-Breath-APT-Evolves-with-Double-DLL-Sideloading_TA2023216.pd f',

[0113] 'Title':'THREATADVISORY-HivePro',

[0114] 'Content introduction':'May 8, 2023—Attack began: 2023. Actor: Dragon Breath APT (aka Golden Eye Dog & APT-Q-27). Affected Products: Telegram, LetsVPN, and WhatsApp for Windows. 8 pages'}, {... omitted...}]

[0115] S6: "Malicious Domain Name Big Model" Analyze Domain Names

[0116] This phase uses advanced big data analysis models, calls the fine-tuned and optimized "malicious domain name large model" capabilities, and combines prompt words to conduct in-depth analysis of domain name search results collected in the S5 phase, aiming to extract valuable intelligence information from a large amount of data. The analysis results will record in detail the specific domain name, intelligence timestamp, research conclusion, conclusion basis, and related reference links, providing detailed data support for subsequent manual review.

[0117] Processing example:

[0118] For example, after analyzing the nsjdhmdjs.com domain name in this step, the following judgment results will be output:

[0119] Domain name: nsjdhmdjs.com

[0120] Malicious Tags: Malicious

[0121] Malicious reason: The nsjdhmdjs.com domain is related to DragonBreathAPT (aka GoldenEyeDog & APT-Q-27) and is used for malicious activities.

[0122] Reference link for reasons for malicious determination:

[0123] https: / / www.hivepro.com / wp-content / uploads / 2023 / 05 / Dragon-Breath-APT-Evolves-with-Double-DLL-Sideloading_TA2023216.pdf https: / / www.scmagazine.com / native / a-doubled-dragon-breath-adds-new-air-to-dll-sideloading-attacks

[0124] https: / / news.sophos.com / en-us / 2023 / 05 / 03 / doubled-dll-sidelo ading-dragon-breath /

[0125] https: / / github.com / sophoslabs / IoCs / blob / master / double-drago n-breath-iocs.csv"

[0126] Intelligence timestamp: 20230503

[0127] Examples of prompt words:

[0128] #Role and output requirements:

[0129] You are an intelligence analysis expert. Based on the web search results, you can determine the domain name {specific domain name}

[0130] Is it related to malicious intelligence?

[0131] #Web Search Results

[0132] {Specific web page results}

[0133] #Web search results content format

[0134] The general structure is [{'url':xxxx,'title':

[0135] xxx,'content':xxx},{'url':xxxx,'title':

[0136] xxx,'content':xxx},] format of web page search results, the url, title, and content in each dictionary are related data relationships, and the url is extracted in accordance with this related data relationship

[0137] #You need to output the standard json format, the string value must be wrapped in double quotes

[0138] {"malicious label":"malicious / non-malicious / unknown"

[0139] "Reason for malicious judgment":"Reason for malicious judgment / none"

[0140] "Reference link for malicious determination": [URL of the webpage link in the webpage search results that you use as the basis for determining maliciousness. This link must be related to the determination reason content / none]

[0141] "Intelligence timestamp": The date field used as the main basis for judgment. It is extracted from the malicious web page URL link or web page content. If the extraction fails, 00000000 is output. If there are multiple times, the earliest time is used. For example, the format of January 2, 2023 is output as 20230102}

[0142] S7: Internal intelligence interface query

[0143] The system calls the internal intelligence interface to query other intelligence data related to the target domain name, and further supplements threat-related information such as information about malicious samples associated with the domain name and the malicious family to which it belongs. These data will help security analysts have a more comprehensive understanding of the potential threats of the domain name.

[0144] Processing example:

[0145] For example, the domain name nsjdhmdjs.com will be analyzed in this step and the following judgment result will be output: Domain name: nsjdhmdjs.com

[0146] Malicious Tags: Malicious

[0147] Malware family: Dragon Breath APT

[0148] S8: Integrate real-time search intelligence and non-real-time intelligence interface intelligence to obtain multi-dimensional judgment results.

[0149] At this stage, the system will integrate the real-time search intelligence output by S6 and the non-real-time intelligence obtained through the internal intelligence interface in S7 to form a comprehensive multi-dimensional judgment result. This integration improves the accuracy and comprehensiveness of intelligence through cross-validation and correlation analysis, provides a scientific decision-making basis for the review process, and passes the integrated data to S9.

[0150] Processing example:

[0151] Domain name: nsjdhmdjs.com

[0152] Comply with domain name naming rules: Yes

[0153] Is the domain name DNS alive: alive

[0154] Is the domain name valid: Valid

[0155] The big model determines the malicious label: malicious

[0156] Reason for the large model's malicious determination: The nsjdhmdjs.com domain is related to the Dragon Breath APT (aka Golden Eye Dog & APT-Q-27) and is used for malicious activities.

[0157] Reference link for large model determination reasons:

[0158] https: / / www.hivepro.com / wp-content / uploads / 2023 / 05 / Dragon-Breath-APT-Evolves-with-Double-DLL-Sideloading_TA2023216.pdf https: / / www.scmagazine.com / native / a-doubled-dragon-breath-adds-new-air-to-dll-sideloading-attacks

[0159] https: / / news.sophos.com / en-us / 2023 / 05 / 03 / doubled-dll-sidelo ading-dragon-breath /

[0160] https: / / github.com / sophoslabs / IoCs / blob / master / double-drago n-breath-iocs.csv"

[0161] Internal Intelligence Malicious Tags: Malicious

[0162] Insider Intelligence: Dragon Breath APT

[0163] S9: Audit platform assigns audit tasks

[0164] According to the workflow of the audit platform and actual business needs, the system will automatically prioritize audit tasks and assign tasks to corresponding auditors. Priority setting may be based on factors such as the urgency of intelligence and the potential harm, to ensure that key intelligence can be processed in a timely manner.

[0165] Processing example:

[0166] (1) Both the "internal intelligence malicious label" and the "big model determined malicious label" are malicious and are listed as credible intelligence. The domain name is determined to be malicious. During the manual review stage, a 10% random check will be conducted.

[0167] (2) If one of the “internal intelligence malicious label” and “large model determined malicious label” is malicious, it will be listed as suspicious intelligence and the domain name will be determined to be malicious. During the manual review stage, all will be reviewed.

[0168] (3) Both the “malicious label based on internal intelligence” and the “malicious label determined by the large model” are non-malicious, and the domain name is determined to be non-malicious;

[0169] S10: Manual review and output of final domain name analysis result data

[0170] Professional security intelligence personnel will conduct a detailed review of the multi-dimensional judgment results generated in the S8 stage, eliminate false positives through professional knowledge and technical means, and mark the verified intelligence. This step ensures the reliability and practicality of the final judgment results and provides high-quality intelligence data for subsequent business applications.

[0171] Processing example:

[0172] ① Accuracy review of “big model determines malicious labels”:

[0173] Based on the large model judgment reason reference link, such as https: / / news.sophos.com / en-us / 2023 / 05 / 03 / doubled-dll-sidelo ading-dragon-breath / , it is confirmed that the domain name nsjdhmdjs.com is indeed associated with Dragon Breath APT, the intelligence is valid, and nsjdhmdjs.com is confirmed to be malicious.

[0174] ② Review of the accuracy of “malicious internal intelligence labels”:

[0175] Based on internal intelligence sources, find relevant personnel to confirm the accuracy and credibility of the intelligence.

[0176] S11: Database of domain name analysis results

[0177] The domain name intelligence data that has been manually reviewed and confirmed to be correct in the S10 stage will be entered into the "Domain Name Research and Judgment Result Database". The update and maintenance of the database ensures the timeliness and accuracy of the intelligence, and facilitates subsequent inquiries and business applications.

[0178] S12: Actual business scenario use

[0179] In actual business scenarios involving domain name intelligence analysis, the system will call the "domain name analysis result database" and related resources to provide data support for network security monitoring, threat intelligence analysis, security incident response, etc. Through the application of this intelligence, network security threats can be effectively identified and defended, and the security protection capabilities of the business can be enhanced.

[0180] S13: Training dataset extraction

[0181] Model training data sets are regularly extracted from the manually corrected accurate data. The extracted training data sets mainly include the original domain name search results and the malicious label data after manual review and determination. The general format is as follows:

[0182] [{"instruction":"Specific prompt words'",

[0183] "input":"Web search results 1",

[0184] "output":"Malicious label 1 after manual review"},

[0185] {"instruction":"Specific prompt words'",

[0186] "input":"Web search results 2",

[0187] "output":"Malicious tags 2 after manual review"}].

[0188] S14: Fine-tune and optimize the “Malicious Domain Name Model”

[0189] Select an open source standard large model as the base model. The base model can include but is not limited to: GLM-4-9B, Llama, ChatGPT4. Based on the extracted training data set, fine-tune and optimize the "malicious domain name large model" to improve the accuracy of malicious judgment. Select lora fine-tuning as the fine-tuning method, of which 80% of the data is used for training and 20% of the data is used to test the model accuracy.

[0190] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A method for identifying malicious domain names based on a search engine and a generative language model, characterized by: The following steps are involved: S1. Obtaining original data including domain name information; S2, preprocessing the original data to extract the domain name to be analyzed; S3, checking the validity of the domain name to be analyzed, if it is valid, proceed to step S4, if it is invalid, return to step S1; The validity check includes: checking whether the domain name to be analyzed complies with the domain name naming rules, whether the DNS of the domain name to be analyzed is alive, and judging whether the domain name to be analyzed is valid according to the check result; S4, by calling the domain name judgment result database to check the historical record of the domain name to be analyzed, determine whether the domain name to be analyzed has a judgment record within the time threshold, if there is a judgment record within the time threshold, proceed to step S12, if there is no judgment record within the time threshold or the judgment record exceeds the time threshold, proceed to step S5; S5, calling a search engine to retrieve malicious threat intelligence related to the domain name to be analyzed in real time to obtain a search engine search result; S6, calling the malicious domain name big model to analyze the search engine retrieval result to obtain the model real-time analysis result, wherein the model real-time analysis result includes the malicious label determined by the big model; S7, calling the internal intelligence interface to query the domain name intelligence related to the domain name to be analyzed to obtain the internal intelligence analysis result, the internal intelligence analysis result includes the internal intelligence malicious label, and the internal intelligence analysis result is a non-real-time intelligence analysis result; S8, combining the real-time analysis result of the model and the internal intelligence analysis result to obtain a multi-dimensional determination result; S9. The audit platform assigns the audit task of the multi-dimensional determination result to the auditor; S10, the auditor manually reviews the multi-dimensional judgment results, excludes false positives, marks the verified intelligence and outputs the final domain name judgment result data, the optimization of the malicious domain name large model enters step S13, and the final domain name judgment result data is stored in the database and enters step S11; S11, entering the final domain name determination result data into the domain name determination result database; S12, using the final domain name determination result data or the determination record of calling the domain name determination result database for actual business scenarios to provide data support for network security monitoring, threat intelligence analysis, and security incident response, and returning to step S1; S13, regularly extracting a model training data set from the final domain name determination result data; S14. Optimize the malicious domain name model based on the model training set, and return to step S1.

2. According to claim 1, a malicious domain name analysis method based on a search engine and a generative language model is characterized by: In step S1, original data including domain name information is obtained through a data source, and the data source includes: a firewall log, an intrusion detection system log, a Web proxy log, and a system event log.

3. According to claim 1, a malicious domain name analysis method based on a search engine and a generative language model is characterized by: In step S2, the preprocessing method includes: data cleaning, format conversion and deduplication, and the domain name to be analyzed is extracted by a protocol parsing method, and the protocol parsing method includes parsing the HTTP request header and parsing the DNS query record.

4. According to claim 1, a malicious domain name analysis method based on a search engine and a generative language model is characterized by: In step S3, the method for judging whether the domain name to be analyzed complies with the domain name naming rules is: judging by length limit and character type; The method to determine whether the domain name DNS is alive is: whether it can be resolved to an IP address.

5. According to claim 1, a malicious domain name analysis method based on a search engine and a generative language model is characterized by: In step S4, the domain name analysis result database stores historical domain name analysis results and data.

6. According to claim 1, a malicious domain name analysis method based on a search engine and a generative language model is characterized by: In step S5, the malicious threat intelligence related to the domain name to be analyzed includes: the domain name to be analyzed is used for phishing, spreading malware, involving ransomware, and activities of APT malicious organizations; The search engine retrieval results include information source, type, link, title and content introduction.

7. According to claim 1, a malicious domain name analysis method based on a search engine and a generative language model is characterized by: In step S6, the malicious domain name large model includes: GLM-4-9B, Llama and ChatGPT4; The malicious domain name big model analyzes the search engine retrieval results in combination with prompt words, wherein the prompt words are key information or guiding sentences provided to the malicious domain name big model; The prompt word defines the role positioning and analysis direction of the malicious domain name big model, provides reference materials for analyzing the malicious domain name big model, and specifies the format of the final output content of the malicious domain name big model; The role positioning and analysis direction of the malicious domain name big model are: as an intelligence analysis expert, analyzing whether the domain name to be analyzed is associated with malicious intelligence based on the search engine retrieval results; The reference materials for the malicious domain name large model analysis include: search engine search results associated with the domain name to be analyzed; The format of the final output content of the malicious domain name model includes: malicious tags obtained through analysis, malicious determination reasons, reference links to malicious determination reasons, and intelligence timestamps; The real-time analysis results of the model provide data support for the manual review in step S10.

8. According to claim 1, a malicious domain name identification method based on a search engine and a generative language model is characterized by: In step S7, the internal intelligence interface is called to query the domain name intelligence related to the domain name to be analyzed and supplement the threat-related information to obtain the internal intelligence analysis result, and the threat-related information includes information about the domain name associated with the malicious sample and the malicious family to which it belongs.

9. The method for identifying malicious domain names based on a search engine and a generative language model according to claim 1, characterized in that: In step S9, the audit platform defines the priority of the audit task and assigns the audit task to the auditor, and the priority is set based on the urgency of the intelligence and / or the potential harm; When the malicious labels of the internal intelligence and the malicious labels determined by the large model are both malicious, it is credible intelligence, and the domain name to be analyzed is a malicious domain name. When the manual review is performed in step S10, a 10% spot check is performed; When only one of the malicious labels of the internal intelligence and the malicious label determined by the large model is malicious, it is listed as questionable intelligence, and all of them are reviewed during the manual review process in step S10; When the malicious labels of the internal intelligence and the malicious labels determined by the large model are both non-malicious, it is credible intelligence, and the domain name to be analyzed is a non-malicious domain name; In step S10, the auditor reviews the accuracy of the malicious labels determined by the big model and the malicious labels of the internal intelligence. The accuracy of the malicious labels determined by the big model can be judged by tracing the process of obtaining the real-time analysis results of the model, and the accuracy of the malicious labels of the internal intelligence can be judged by confirming the accuracy and credibility of the intelligence with internal personnel.

10. According to claim 1, a malicious domain name identification method based on a search engine and a generative language model is characterized by: In step S13, the model training data set includes prompt words, the search engine search results and the final domain name analysis result data; In step S14, the model training data set is fine-tuned using Lora, where 80% is used for training and 20% is used for testing the model accuracy.

Images