Training method of probability prediction model, and detection method and device of non-target domain name

Abstract

The application provides a probability prediction model training method, a non-target domain name detection method and device, and relates to the technical field of information security. The probability prediction model training method comprises: obtaining domain name data, preprocessing the domain name data, and obtaining an integer array of a preset length; performing word embedding on the array to obtain first domain name data; obtaining a local key feature map of the first domain name data through a convolutional neural network; obtaining a context feature of the local key feature map through a gated recurrent unit; mapping a feature space of the local key feature map and a feature space of the context feature to a one-dimensional sample label space through the convolutional neural network; obtaining a prediction probability of the first domain name data according to the sample label space, and obtaining a probability that the first domain name data is a non-target domain name through the prediction probability. Through the above method, the problem of high training and calculation difficulty caused by the machine learning model combining the convolutional neural network and the long short-term memory network can be solved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method for training a probability prediction model, and a method and device for detecting non-target domain names. Background Art

[0002] The Domain Name System (DNS) is a distributed database on the Internet that maps domain names to Internet Protocol (IP) addresses. It allows users to access the internet more conveniently without having to memorize machine-readable IP numbers. DNS services have become pervasive and essential to the internet, serving as a crucial component and the most critical infrastructure on the internet. As a core internet service, DNS security is crucial, as attacks or security flaws can cause immeasurable damage to the entire network. Beyond DNS security, the emergence of malicious software is becoming increasingly common. Domain Generation Algorithms (DGAs) are a key evasion technique used by malicious software to generate a large number of pseudo-random domain names for contacting command and control servers. Because using fixed domains or IP addresses is easily detected and blocked, many malicious software employ DGAs to switch to new domain names, thereby evading regulation without requiring regular releases or redeployment.

[0003] Existing technology uses a machine learning model that combines convolutional neural networks (CNNs) with long short-term memory (LSTM) networks for DGA detection. This model extracts both local and contextual features of domain names. However, LSTMs have a large number of parameters, making training and computation of this machine learning model difficult. Summary of the Invention

[0004] The present application provides a training method for a probability prediction model, a detection method and device for non-target domain names, which are used to solve the problem of high training and computational difficulty caused by a machine learning model that integrates a convolutional neural network and a long short-term memory network.

[0005] A first aspect of an embodiment of the present invention provides a method for training a probability prediction model, comprising:

[0006] Acquire domain name data in domain name system traffic, and pre-process the domain name data to obtain an integer array of a preset length;

[0007] Performing word embedding on the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix;

[0008] Performing feature extraction and dimensionality reduction on the first domain name data using a convolutional neural network to obtain a local key feature graph of the first domain name data;

[0009] Obtaining contextual features of the local key feature map through a gated recurrent unit;

[0010] When the task is a binary classification task, the feature space of the local key feature map and the feature space of the contextual features are mapped to a one-dimensional sample label space through the convolutional neural network; wherein the task is a binary classification task for indicating whether the first domain name data is a target domain name or a non-target domain name;

[0011] The predicted probability of the first domain name data is obtained according to the one-dimensional sample label space, so as to obtain the probability that the first domain name data is a non-target domain name through the predicted probability.

[0012] In one possible design, performing feature extraction and dimensionality reduction on the first domain name data using a convolutional neural network to obtain a local key feature map of the first domain name data includes:

[0013] Performing a convolution operation on the first domain name data through a convolutional layer of the convolutional neural network to obtain a feature map corresponding to the first domain name data;

[0014] The feature map is downsampled by the pooling layer of the convolutional neural network to obtain a local key feature map of the first domain name data.

[0015] In one possible design, the feature map is a matrix;

[0016] The downsampling operation is performed on the feature map through the pooling layer of the convolutional neural network to obtain a local key feature map of the first domain name data, including:

[0017] Moving a pooling matrix of a preset size to each position of the feature map one by one to obtain a coverage area corresponding to each position; wherein the size of each coverage area is the same as the size of the pooling matrix;

[0018] A maximum value among multiple values ​​of each of the coverage areas is obtained, and the local key feature map is obtained according to the maximum value in each of the coverage areas.

[0019] In one possible design, the domain name data includes a plurality of uppercase letters and a plurality of lowercase letters;

[0020] The preprocessing of the domain name data to obtain an integer array of a preset length includes:

[0021] Deleting duplicate data and irrelevant data in the domain name data to obtain second domain name data;

[0022] Filling the second domain name data with padding characters to obtain third domain name data; wherein the length of the third domain name data is a preset length;

[0023] Convert each of the uppercase letters in the third domain name data into a corresponding lowercase letter to obtain fourth domain name data;

[0024] Dictionary mapping is performed on the fourth domain name data to obtain an integer array of the preset length.

[0025] In one possible design, mapping the feature space of the local key feature map and the feature space of the context feature to a one-dimensional sample label space through the convolutional neural network includes:

[0026] The feature space of the local key feature map and the feature space of the context feature are mapped to a one-dimensional sample label space through the fully connected layer of the convolutional neural network.

[0027] A second aspect of an embodiment of the present invention provides a method for detecting a non-target domain name, including:

[0028] Acquire domain name data in domain name system traffic, and pre-process the domain name data to obtain an integer array of a preset length;

[0029] Performing word embedding on the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix;

[0030] When the first domain name data is neither in a preset blacklist nor in a preset whitelist, the first domain name data is input into a preset probability prediction model to obtain a predicted probability of the first domain name data, so as to determine whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability; wherein the probability prediction model is a model obtained by providing a training method for a probability prediction model according to the first aspect of an embodiment of the present invention.

[0031] In one possible design, determining, based on the predicted probability, whether the first domain name data is a target domain name or a non-target domain name includes:

[0032] If the predicted probability is less than a first preset value, the first domain name data is determined to be a target domain name; if the predicted probability is greater than a second preset value, the first domain name data is determined to be a non-target domain name; wherein the first preset value is less than the second preset value.

[0033] In one possible design, if the predicted probability is not less than the first preset value and not greater than the second preset value, the method further includes:

[0034] Obtaining an entropy value, a number of consonants, and a domain name length of the first domain name data;

[0035] If the entropy value is greater than a third preset value, the number of consonants is greater than a fourth preset value, and the domain name length is greater than a fifth preset value, the first domain name data is determined to be a target domain name; otherwise, the first domain name data is determined to be a non-target domain name.

[0036] A third aspect of an embodiment of the present invention provides a training device for a probability prediction model, comprising:

[0037] A preprocessing module, configured to obtain domain name data from domain name system traffic and preprocess the domain name data to obtain an integer array of a preset length;

[0038] a word embedding module, configured to perform word embedding on the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix;

[0039] a local feature extraction module, configured to perform feature extraction and dimensionality reduction on the first domain name data through a convolutional neural network to obtain a local key feature map of the first domain name data;

[0040] A context feature extraction module, configured to obtain context features of the local key feature map through a gated recurrent unit;

[0041] a mapping module, configured to, when the task is a binary classification task, map the feature space of the local key feature map and the feature space of the contextual features to a one-dimensional sample label space through the convolutional neural network; wherein the task is a binary classification task, and is configured to indicate whether the first domain name data is a target domain name or a non-target domain name;

[0042] The output module is configured to obtain a predicted probability of the first domain name data according to the one-dimensional sample label space, so as to obtain a probability that the first domain name data is a non-target domain name through the predicted probability.

[0043] A fourth aspect of an embodiment of the present invention provides a non-target domain name detection device, including:

[0044] A preprocessing module, configured to obtain domain name data from domain name system traffic and preprocess the domain name data to obtain an integer array of a preset length;

[0045] a word embedding module, configured to perform word embedding on the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix;

[0046] A probability prediction module is used to input the first domain name data into a preset probability prediction model when the first domain name data is neither in a preset blacklist nor in a preset whitelist, to obtain a predicted probability of the first domain name data, so as to determine whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability; wherein the probability prediction model is a model obtained by providing a training device for a probability prediction model according to the third aspect of an embodiment of the present invention.

[0047] A fifth aspect of an embodiment of the present invention provides an electronic device, comprising: a processor and a memory communicatively connected to the processor;

[0048] The memory stores computer-executable instructions;

[0049] The processor executes the computer-executable instructions stored in the memory to implement the probability prediction model training method provided by the first aspect of the embodiment of the present invention or the non-target domain name detection method provided by the second aspect of the embodiment of the present invention.

[0050] The sixth aspect of the embodiments of the present invention provides a computer-readable storage medium, which stores computer-executable instructions to implement the training method of the probability prediction model provided in the first aspect of the embodiments of the present invention or the detection method of the non-target domain name provided in the second aspect of the embodiments of the present invention.

[0051] A seventh aspect of an embodiment of the present invention provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the training method of the probability prediction model provided in the first aspect of the embodiment of the present invention or the detection method of the non-target domain name provided in the second aspect of the embodiment of the present invention.

[0052] The present application provides a method for training a probability prediction model, a method for detecting non-target domain names, and an apparatus. The method for training the probability prediction model includes: obtaining domain name data in domain name system traffic, and preprocessing the domain name data to obtain an integer array of a preset length; performing word embedding on the integer array to obtain first domain name data, wherein the first domain name data is a low-dimensional dense matrix; performing feature extraction and dimensionality reduction on the first domain name data through a convolutional neural network to obtain a local key feature map of the first domain name data; obtaining context features of the local key feature map through a gated recurrent unit; when the task is a binary classification task, mapping the feature space of the local key feature map and the feature space of the context features to a one-dimensional sample label space through a convolutional neural network, wherein the task is a binary classification task for indicating whether the first domain name data is a target domain name or a non-target domain name; obtaining a predicted probability of the first domain name data based on the one-dimensional sample label space, so as to obtain the probability of the first domain name data being a non-target domain name through the predicted probability. Based on the above method, the following technical effects are achieved: convolutional neural networks are used to extract local feature information from domain name data, and gated recurrent units are used to extract contextual information from domain name data. Based on local feature information and contextual information, more accurate output can be obtained; through word embedding, the input discrete domain name data can be converted into a low-dimensional dense matrix, so that the neural network can better understand the input data in subsequent tasks; contextual feature extraction through gated recurrent units can reduce the difficulty of model training and make it easier to calculate. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0054] Figure 1 Schematic diagram of the training process of the probability prediction model provided in the embodiment of the present application Figure 1 ;

[0055] Figure 2 Schematic diagram of the training process of the probability prediction model provided in the embodiment of the present application Figure 2 ;

[0056] Figure 3 Schematic diagram of the process of detecting non-target domain names provided in the embodiment of the present application Figure 1 ;

[0057] Figure 4 Schematic diagram of the process of detecting non-target domain names provided in the embodiment of the present application Figure 2 ;

[0058] Figure 5 A schematic diagram of the structure of a training device for a probability prediction model provided in an embodiment of the present application;

[0059] Figure 6 A schematic diagram of the structure of a non-target domain name detection device provided in an embodiment of the present application;

[0060] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] In the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with substantially the same functions and effects. Those skilled in the art will understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit differences. It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described in this application as "exemplary" or "for example" should not be interpreted as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete way. In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more.

[0062] It should be noted that the "at..." in the embodiments of the present application can be the instant when a certain situation occurs, or it can be a period of time after the situation occurs, and the embodiments of the present application do not specifically limit this. In addition, the model training method provided in the embodiments of the present application is only an example, and the model training method can also include more or less content.

[0063] To facilitate a clear description of the technical solutions of the embodiments of the present application, some of the terms and technologies involved in the embodiments of the present application are briefly introduced below:

[0064] Convolutional neural networks (CNNs) are a type of feedforward neural network and one of the most successful algorithms in deep learning. They have been widely used in large-scale image processing tasks. In addition to image processing, CNNs can also be applied to text classification. CNNs come in three types: one-dimensional, two-dimensional, and three-dimensional. One-dimensional CNNs are primarily used for tasks like sequence data processing, two-dimensional CNNs for text recognition, and three-dimensional CNNs for medical image and video processing. The overall structure of a convolutional neural network consists of an input layer, a convolution layer, a pooling layer, a fully connected layer and an output layer connected in sequence. The convolution layer and the pooling layer can appear repeatedly in the hidden layer. The function of the convolution layer is to extract features of the input data. Specifically, the convolution layer contains multiple convolution kernels, which are similar to the neurons of the feedforward neural network. Each element of the convolution kernel corresponds to a weight coefficient and a bias. Each neuron in the convolution layer is connected to the neuron in the previous layer. When working, the convolution layer will regularly scan the input features to extract the features of the input data; the main function of the pooling layer is to select the features processed by the convolution layer, and reduce and filter the features; the fully connected layer can perform nonlinear integration of the features extracted by the previous layers, and then pass the integrated results to the final output layer; the main function of the output layer is to receive the data from the hidden layer and give the final classification results of the model. The output layer constrains the output results through the activation function.

[0065] Gated Recurrent Unit: A type of recurrent neural network. Like the Long Short-Term Memory (LSTM) network, it was proposed to address issues such as long-term memory and gradients in backpropagation. Three gates are introduced in the LSTM network to control the network. The input gate controls the input value and is responsible for selectively updating the memory unit; the forget gate controls the memory value and can determine which information is discarded from the unit state; and the output gate controls the output value and determines the hidden state of the output. Compared to the complex LSTM network, the GRU has only two gates. To streamline the internal structure and improve computational efficiency, the GRU integrates the input, forget, and output gate structures of the LSTM network into an update gate and a reset gate. The reset gate determines how the new input information is combined with the previous memory; the update gate defines the amount of previous memory retained until the current time step.

[0066] DNSSEC:

[0067] 1) Domain Name System Security Extensions (DNSSEC) are cryptographic signatures added to DNS records, helping to ensure the security of data transmitted over Internet Protocol (IP) networks. DNSSEC arose because the original DNS architecture lacked any security measures at the protocol level, making it possible for attackers to redirect users to fraudulent websites. Therefore, the industry introduced the DNSSEC portal, which adds a layer of authenticity and integrity protection to DNS responses.

[0068] 2) DNSSEC is a security extension based on the DNS protocol. The main idea is to add cryptographic signatures to DNS records to provide source authentication and data integrity for the DNS resolution process. In specific implementation, DNSSEC uses public key infrastructure ( , PKI) to verify data integrity and authenticity. The domain name owner or administrator generates a public-private key pair. The public key is stored in the DNS record, while the private key is kept confidential. When responding to a DNS request, the domain name server calculates a digest of the response and encrypts it with the private key to generate a signature. After receiving the response and signature, the queryer simply decrypts the digest value with the public key and compares it with the calculated digest of the corresponding content. This process ensures the integrity of the DNS request and the identity of the data source.

[0069] 3) DNSSEC provides a security enhancement for the domain name system, providing a verification mechanism for the origin identity, integrity, and tampering during transmission of domain names. However, it does not guarantee the encryption or availability of DNS data. Furthermore, while DNSSEC provides trusted and secure DNS communication, it is not fully supported by the entire domain name system. This is primarily due to the vast size of the domain name system. From the root to the top-level domain (TLD) and subdomains, DNSSEC support cannot be guaranteed at all nodes. Therefore, DNSSEC is implemented for compatibility with the existing domain name system, automatically skipping DNSSEC requests and verification if DNS does not support DNSSEC.

[0070] DoT protocol: DoT protocol (DNS over TLS, DoT) is based on the Transport Layer Security Protocol ( TLS is a standard for encrypting DNS queries and ensuring their privacy and security. The TLS protocol is a widely used security encryption protocol. Compared with the traditional DNS protocol, the TLS protocol itself has achieved confidentiality and integrity. Compared with the DNSSEC protocol, DoT has confidentiality. In addition, compared with DNS encryption tools such as DNSCrypt, DoT has formed a request for comment ( However, the application of DoT requires client support, and most mainstream browsers do not support DNS over TLS.

[0071] DoH protocol: DoH protocol (DNS over HTTPS, DoH) refers to encapsulating DNS queries in Secure Hypertext Transfer Protocol ( , HTTPS) protocol, by using an encrypted HTTPS connection to perform DNS queries, the purpose of this practice is to improve user privacy and security, and it also helps prevent DNS hijacking and snooping. Unlike DoT, DoH uses HTTPS instead of TLS to encrypt DNS queries, which means that the DNS query will be encapsulated in the HTTPS request, using the encryption mechanism of HTTPS to protect the data transmission process. By combining DNS queries with HTTPS communication, DoH can take advantage of the existing Web infrastructure, making it easier to deploy and use in various network environments. In actual applications, the DoH client uses the HTTPS GET or POST method to encode a single DNS query as an HTTPS request. When the HTTPS method is GET, the request parameter "dns" is the content of the DNS request, encoded using base64; when the HTTPS method is POST, the DNS query is included in the message body of the HTTPS request, and the request header Content-Type indicates the type of request.

[0072] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0073] The technical solution of the present invention is described in detail below with reference to specific embodiments. The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments. The embodiments of the present invention will be described below with reference to the accompanying drawings.

[0074] In order to clearly understand the technical solution of the present application, the solution of the prior art is first introduced in detail.

[0075] Existing techniques use a machine learning model that combines convolutional neural networks with long short-term memory networks for DGA detection. This model extracts both local and contextual features of domain name data. However, the large number of parameters in long short-term memory networks makes training and computation of this machine learning model difficult.

[0076] Therefore, in order to solve the problem of the difficulty in training and computing the machine learning model caused by the fusion of convolutional neural networks and long short-term memory networks for DGA detection, the study found that in order to solve this problem, ① input domain name data and preprocess it; ② extract the local key feature map of the domain name data through the convolutional neural network; ③ extract the context features of the local key features through the gated recurrent unit; ④ output the results based on the local key feature map and the context features of the local key features.

[0077] Specifically, domain name data in domain name system traffic is obtained, and the domain name data is preprocessed to obtain an integer array of a preset length;

[0078] Performing word embedding on the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix;

[0079] Perform feature extraction and dimensionality reduction on the first domain name data through a convolutional neural network to obtain a local key feature map of the first domain name data;

[0080] Through the gated recurrent unit, the context features of the local key feature map are obtained;

[0081] When the task is a binary classification task, the feature space of the local key feature map and the feature space of the context feature are mapped to a one-dimensional sample label space through a convolutional neural network; wherein the task is a binary classification task, which is used to indicate whether the first domain name data is a target domain name or a non-target domain name;

[0082] According to the one-dimensional sample label space, the predicted probability of the first domain name data is obtained, so as to obtain the probability that the first domain name data is a non-target domain name through the predicted probability.

[0083] The training method of the probability prediction model of the embodiment of the present invention is based on the principle of the above-mentioned working condition preset conditions. The present invention combines a convolutional neural network with a gated recurrent unit, uses the convolutional neural network to extract local key feature maps, uses the gated recurrent unit to extract context features, and then obtains the final result output based on the local key feature maps and context features. The machine learning model that integrates the convolutional neural network and the gated recurrent unit is used. Compared with the long short-term memory network, the gated recurrent unit has fewer parameters, thus avoiding the problem of greater training and computational difficulty caused by the machine learning model that integrates the convolutional neural network and the long short-term memory network.

[0084] Based on the above creative findings, the technical solution of the present application is proposed.

[0085] The following describes the application scenarios of the training method for the probability prediction model provided by the embodiment of the present invention.

[0086] The training method of the probability prediction model of this solution is applicable to a variety of scenarios: in enterprise network security, it can be used to protect the internal enterprise network from non-benign websites and phishing attacks, and prevent the leakage of sensitive data; in network traffic filtering, it can block access to non-benign or inappropriate content by intercepting and analyzing DNS requests, thereby improving network security and compliance; in preventing non-benign software infection, it can block non-benign software from communicating or downloading through DNS requests, reducing infection; in data protection and privacy, it can ensure the privacy of users when accessing the Internet and prevent data from being stolen or tracked; in network traffic monitoring, it can analyze and monitor network traffic to identify abnormal activities and potential security threats.

[0087] The embodiments of the present application are introduced below with reference to the accompanying drawings.

[0088] Figure 1 Schematic diagram of the training process of the probability prediction model provided in the embodiment of the present application Figure 1 , the model training method provided in this embodiment includes the following steps:

[0089] S101: Acquire domain name data in domain name system traffic, and pre-process the domain name data to obtain an integer array of a preset length.

[0090] In this embodiment, the model's input layer is used to obtain domain name data. After obtaining domain name data, the first step in machine learning modeling is data preprocessing, which is crucial for improving data quality and adaptability. Converting domain name data into an integer array of a preset length simplifies the model's input processing and training. Furthermore, fixed-length input speeds up data loading and processing.

[0091] S102: Perform word embedding on the integer array to obtain first domain name data.

[0092] In this embodiment, the first domain name data is a low-dimensional dense matrix. Word embedding is performed via the model's embedding layer. Converting the integer array of a preset length obtained after preprocessing to an integer array of a preset length facilitates neural network operations.

[0093] The embedding layer learns to map each integer index into a dense, continuous vector space. This mapping places similar words closer together in the vector space, better capturing the semantic relationships between words. During model training, these embedding vectors are optimized along with the network weights, enabling the model to better understand the input data in subsequent tasks.

[0094] In this model, the length of the embedding layer input sequence is 75, and the input vocabulary size is 41. Through the embedding layer function provided by the Keras network library in the TensorFlow platform, each word is embedded in a 128-dimensional vector space, and the resulting character embedding vector sequence is output to the convolutional neural network for feature extraction.

[0095] S103: Perform feature extraction and dimensionality reduction on the first domain name data through a convolutional neural network to obtain a local key feature map of the first domain name data.

[0096] In this embodiment, the function of the convolutional neural network is to extract local key features from the domain name data.

[0097] S104: Obtain context features of the local key feature graph through a gated recurrent unit.

[0098] In this embodiment, the gated recurrent unit (GRU) is a type of recurrent neural network that can be used to extract contextual features from data and performs well in processing and predicting sequence data. Similar to long-term short-term memory (LSTM) networks, GRUs can achieve the same effect as LSTM networks in solving the long-range dependency problem of RNNs. The update gate of the GRU can be viewed as a combination of the input gate and forget gate of the LSTM network. The update gate controls the degree of control introduced at the previous moment, while the reset gate controls the degree to which the previous state is replaced with the candidate set.

[0099] After using a convolutional neural network to extract features and reduce the dimensionality of the vector sequence, a gated recurrent unit with 128 neurons performs further contextual feature extraction on the data. Finally, the results of the gated recurrent unit layer are output to the output layer.

[0100] S105. When the task is a binary classification task, the feature space of the local key feature map and the feature space of the context feature are mapped to a one-dimensional sample label space through a convolutional neural network.

[0101] In this embodiment, this is achieved through the fully connected layer of a convolutional neural network. The fully connected layer is typically located at the end of the entire convolutional neural network. It is responsible for expanding the feature map (matrix) obtained by the final convolution layer into a one-dimensional vector and providing input to the classifier, thereby achieving an end-to-end learning process. Each node in a fully connected layer is connected to all nodes in the previous layer, hence the name "fully connected layer." Due to its fully connected nature, the fully connected layer generally has the most parameters.

[0102] The fully connected layer integrates local key feature maps and contextual features into a global representation for final classification or regression. By flattening the feature maps and performing linear transformations, it helps the model capture higher-level abstract features and achieve the final decision.

[0103] Specifically, the fully connected layer integrates the feature space of the local key feature map and the feature space of the contextual features to obtain an integrated feature vector. This feature vector is then mapped to the target task label space, and this target task label space is input to the output layer for final classification. The task is a binary classification task, used to indicate whether the first domain data is a target domain or a non-target domain. Here, the target domain is a DGA domain; the non-target domain is a non-DGA domain, i.e., a benign domain.

[0104] In the algorithm designed in this application, in the fully connected layer, tanh is used as the activation function to map the feature space calculated by the previous layers to the target task label space, and input it to the output layer for final classification.

[0105] While mapping the feature space calculated by the previous layer to the sample label space, the convolutional layer can also reduce the influence of feature position on the classification results, thereby improving the robustness of the entire network.

[0106] S106: Obtain a predicted probability of the first domain name data according to the one-dimensional sample label space, so as to obtain a probability that the first domain name data is a non-target domain name through the predicted probability.

[0107] In this embodiment, the output layer is the last layer in the neural network model and is responsible for generating the model's final output. It maps the feature representations of the previous layers into the final prediction results or decisions. The form of the output layer will vary depending on the task and network structure.

[0108] In a binary classification task, the output layer usually has only one node, and the activation function is sigmoid, and the output is a predicted probability between 0 and 1, which represents the probability that the first domain name data is a non-target domain name.

[0109] The application provides a probability prediction model training method, a non-target domain name detection method and device. The probability prediction model training method comprises: obtaining domain name data in domain name system traffic, and preprocessing the domain name data to obtain an integer array of a preset length; performing word embedding on the integer array to obtain first domain name data, wherein the first domain name data is a low-dimensional dense matrix; performing feature extraction and dimension reduction on the first domain name data through a convolutional neural network to obtain a local key feature map of the first domain name data; obtaining context features of the local key feature map through a gated recurrent unit; when the task is a binary classification task, mapping the feature space of the local key feature map and the feature space of the context features to a one-dimensional sample label space through the convolutional neural network, wherein the task is a binary classification task, indicating whether the first domain name data is a target domain name or a non-target domain name; obtaining a prediction probability of the first domain name data according to the one-dimensional sample label space, so as to obtain the probability that the first domain name data is a non-target domain name through the prediction probability. Based on the above method, the following technical effects are achieved: the convolutional neural network is used to extract local feature information in the domain name data, and the gated recurrent unit is used to extract context information in the domain name data. Based on the local feature information and the context information, a more accurate output can be obtained. Through word embedding, the input discrete domain name data can be converted into a low-dimensional dense matrix, so that the neural network can better understand the input data in subsequent tasks. The context feature extraction through the gated recurrent unit can reduce the training difficulty of the model and is easier to calculate.

[0110] Figure 2 Flowchart of the probability prediction model training method provided by the embodiment of the application Figure 2 As shown in Figure 2 , the probability prediction model training method provided by the embodiment is further refined on the basis of the probability prediction model training method provided by the previous embodiment of the application. Therefore, the probability prediction model training method provided by the embodiment comprises the following steps:

[0111] S201, after obtaining the domain name data in the domain name system traffic, deleting the repeated data and irrelevant data in the domain name data to obtain second domain name data.

[0112] In this embodiment, the second domain name data is the domain name data after deleting the repeated data and irrelevant data. The function of S201 is to clean the obtained domain name data to avoid the influence of repeated data and irrelevant data on the output result.

[0113] S202, fill the second domain name data by filling characters to obtain third domain name data.

[0114] In this embodiment, the length of the third domain name data is a preset length. The character filling is performed on the domain name data after deleting the repeated data and irrelevant data, so as to reach the preset length. The domain name data with the preset length can simplify the input processing and training process of the model, and can also speed up the data loading and processing speed. Specifically, in this embodiment, the domain name data is a string, and the preset length is 75, that is, the third domain name data is a string with a length of 75.

[0115] S203, convert each capital letter in the third domain name data into a corresponding lowercase letter to obtain fourth domain name data.

[0116] In this embodiment, the domain name data is a string, and includes a plurality of capital letters and a plurality of lowercase letters. All the capital letters in the string are converted into lowercase letters to obtain the fourth domain name data, that is, the fourth domain name data is a string with a length of 75 and all lowercase letters.

[0117] S204, dictionary mapping is performed on the fourth domain name data to obtain an integer array with a preset length.

[0118] In this embodiment, the string is converted into an integer array because the integer array is usually easier to be processed by a computer than the string data. Therefore, this processing manner can simplify the input of the model, and further improve the computing efficiency.

[0119] S205, word embedding is performed on the integer array to obtain the first domain name data.

[0120] In this embodiment, the first domain name data is a low-dimensional dense matrix. The effect and manner of S205 are similar to those of 102 in the previous embodiment of the application, and will not be described here.

[0121] S206, convolution operation is performed on the first domain name data by a convolution layer of a convolutional neural network to obtain a feature map corresponding to the first domain name data.

[0122] In this embodiment, the convolution layer is a very important hierarchical structure in the convolutional neural network, and the basic idea is to extract local features of the input data through convolution operation, and use these features for next processing and analysis. The convolution operation usually uses a filter or convolution kernel to scan the input data and generates a corresponding feature map.

[0123] S207, a preset size of the pooling matrix is moved to each position of the feature map one by one, the maximum value of a plurality of values in each coverage area is obtained after obtaining the coverage area corresponding to each position, and the local key feature map is obtained according to the maximum value in each coverage area.

[0124] In this embodiment, the size of each coverage area is the same as the size of the pooling matrix, and this part of the processing is completed by the pooling layer in the convolutional neural network.

[0125] The pooling layer is another important layer in the convolutional neural network, and its main function is to perform down-sampling operation on the input feature map, reduce the dimension of the feature map, reduce the number of parameters, and prevent overfitting. Common pooling methods include maximum pooling and average pooling, which respectively select the maximum value or average value in each small window of the feature map as the output of the small window, thereby obtaining a new pooling feature. The input feature map is down-sampled to half the original size. The pooling operation usually reduces the size of the feature map, thereby further reducing the calculation amount. The pooling method adopted in this application is maximum pooling.

[0126] In the algorithm designed in this paper, the convolutional neural network is composed of a convolution layer with a convolution kernel size of 3 and a filter size of 128, and a maximum pooling layer with a maximum pooling window size of 2. This convolutional neural network extracts and reduces the dimension of the low-dimensional dense matrix processed by the embedding layer, and outputs the feature map to the gated recurrent unit layer.

[0127] S208, the context feature of the local key feature map is obtained through the gated recurrent unit.

[0128] In this embodiment, the effect and method of the gated recurrent unit in S208 are similar to those of the gated recurrent unit in S104 in the previous embodiment of the application, and will not be repeated here.

[0129] S209, when the task is a binary classification task, the feature space of the local key feature map and the feature space of the context feature are mapped to a one-dimensional sample label space through the convolutional neural network.

[0130] In this embodiment, the effect and method of S209 are similar to those of S105 in the previous embodiment of the application, and will not be repeated here.

[0131] S210, according to the one-dimensional sample label space, the prediction probability of the first domain name data is obtained, so as to obtain the probability that the first domain name data is a non-target domain name through the prediction probability.

[0132] In this embodiment, the effect and method of S210 are similar to those of S106 in the previous embodiment of the application, and will not be repeated here.

[0133] This embodiment records system-related data, primarily the key content of non-benign DNS requests, blacklists, and other information, and is responsible for database reading, writing, and management. Specifically, a SQLite database is used to store relevant information. SQLite is a powerful, lightweight, embedded relational database management system. Compared to other databases, SQLite requires less configuration, installation, and management. The database primarily contains three tables: non-benign DNS log, blacklist, and whitelist. The field format of the dns_log table is shown in Table 1.

[0134] Table 1

[0135]

[0136] The white_list table field format is shown in Table 2.

[0137] Table 2

[0138]

[0139] The black_list table field format is shown in Table 3.

[0140] Table 3

[0141]

[0142] In terms of DGA algorithm detection, a control experiment was conducted between a deep learning model based on CNN-GRU and a machine learning model based on manually extracted features. The experimental results show that the DGA detection technology designed and implemented in this application that combines CNN and GRU is significantly superior to other algorithms in the control experiment in terms of accuracy, precision, recall rate, F1 value and other indicators, and has better performance.

[0143] From a model design perspective, the deep learning model combining CNN and GRU can automatically learn valid features from input data and perform automatic feature extraction without manual feature extraction. The deep learning model's multiple hidden layers enable it to learn more abstract, higher-level features and handle more complex problems. The GRU layer in the algorithm performs well in processing and predicting sequence data, and can better extract contextual features from domain name data, thereby improving the model's detection performance.

[0144] In terms of system design and implementation, this application builds a secure DNS gateway system that can detect and intercept potential threats. The secure DNS gateway supports the use of machine learning algorithms to detect DNS response messages and detect whether the device is under DGA domain name attack. If a DGA domain name is detected, the system will record relevant threat logs and intercept the detected DGA domain name according to the configuration of the defense rules. At the privacy protection level, the DNS security gateway can proxy DNS requests and issue secure DNS queries to upstream DNS servers to enhance the security and privacy of DNS requests. In summary, the design and implementation of a secure DNS gateway based on machine learning has important research significance for improving network security, protecting user privacy, responding to non-benign software threats, improving network management efficiency, and promoting the application of machine learning in network security.

[0145] The present application provides a training method for a probability prediction model, a detection method and device for non-target domain names. Based on the training method of the probability prediction model, the following technical effects are achieved: a convolutional neural network is used to extract local feature information in domain name data, and a gated recurrent unit is used to extract context information in the domain name data. Based on the local feature information and context information, a more accurate output can be obtained; by performing word embedding, the input discrete domain name data can be converted into a low-dimensional dense matrix, so that the neural network can better understand the input data in subsequent tasks; context feature extraction through the gated recurrent unit can reduce the difficulty of model training and make it easier to calculate; by deriving the predicted probability that the domain name data is a DGA domain name and performing potential DGA interception based on the predicted probability, it plays an important role in improving network security, protecting user privacy, responding to non-benign software threats, improving network management efficiency, and promoting the application of machine learning in network security; through model training and use, the effective features of the input data can be automatically learned and automatic feature extraction can be performed, thereby avoiding the problem of manual feature extraction.

[0146] Figure 3 Schematic diagram of the process of detecting non-target domain names provided in the embodiment of the present application Figure 1 ,like Figure 3 As shown, the method for detecting non-target domain names provided in this embodiment includes the following steps:

[0147] S301: Acquire domain name data in domain name system traffic, and pre-process the domain name data to obtain an integer array of a preset length.

[0148] In this embodiment, the effects and methods of S301 are similar to those of S101 in the first embodiment of the present invention, and are not described in detail here.

[0149] S302: Perform word embedding on the integer array to obtain first domain name data.

[0150] In this embodiment, the first domain name data is a low-dimensional dense matrix. The effects and methods of S302 are similar to those of S102 in the first embodiment of the present invention, and are not described in detail here.

[0151] S303. When the first domain name data is neither in a preset blacklist nor in a preset whitelist, the first domain name data is input into a preset probability prediction model to obtain a predicted probability of the first domain name data, so as to determine whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability.

[0152] In this embodiment, blacklist and whitelist detection is the first domain name detection performed. When the DNS security gateway system is initialized, the blacklist and whitelist in the database are converted into regular expressions and loaded into memory. When checking the first domain name data, it first determines whether the first domain name data is on the blacklist. If so, it is immediately subjected to DGA domain name processing. Otherwise, it is determined whether the first domain name data is on the whitelist. If so, no further detection is performed.

[0153] The blacklist is dynamically updated based on the target domain name, while the whitelist is composed of pre-set domain names. Specifically, the initial whitelist consists of domains with relatively high Alexa rankings, while the blacklist is dynamically updated based on detected DGA domain names. Furthermore, the system supports user-defined additions, deletions, modifications, and queries to the blacklist and whitelist.

[0154] When the first domain name data is neither on the blacklist nor on the whitelist, the first domain name data is input into a preset probability prediction model to obtain a predicted probability for the first domain name data, thereby determining whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability. In this embodiment, the probability prediction model is a model obtained by the probability prediction model training method of the first or second embodiment described above.

[0155] When the domain name data is neither on the blacklist nor the whitelist, the probability prediction model is used to perform a probability check on the domain name data. The model is trained using the functions provided by the Tensorflow2 framework. The trained model and its parameters are saved to disk in the SaveModel format for easy use by the monitoring module. After the Domain Name System Gateway service is started, the model is loaded into memory using the load_model method in the Tensorflow framework. Each time a probability check on the domain name data is performed, the domain name data is preprocessed and then input into the model for prediction. The model's prediction result is a value between 0 and 1, representing the probability that the domain name predicted by the model is a non-target domain name. When this value is less than 0.1, the domain name data is considered a domain name generated by the domain name generation algorithm and appropriate handling is taken.

[0156] When the input domain name data is detected as the target domain name, that is, when the detection result indicates that the domain name data in the traffic is a DGA domain name, the domain name data will be intercepted or redirected. When intercepting, a domain name system response packet with a response status code of "REFUSED" is constructed and returned to the client. When redirecting, a response packet is constructed with the IP address pre-configured by the client and returned to the client. In this scenario, if a user accesses the DGA domain name via the web, the user will be redirected to the designated website, thereby achieving an alert effect.

[0157] The DNS traffic interception function is primarily implemented using the Python socket library. The socket library is a foundational library for network programming, providing functions such as sending and receiving data. By intercepting DNS traffic destined for the gateway on port 53 of the host where the gateway is deployed, the traffic proxy module creates a new thread and calls process_request() to inspect and filter the traffic, making a request to the upstream DNS server. Finally, the response traffic is sent back to the client, completing a DNS response.

[0158] If the detection result shows that the domain name data in the traffic is a non-target domain name, the traffic will not be filtered. Instead, ordinary DNS traffic proxy or secure DNS traffic proxy will be performed according to the pre-configured settings.

[0159] Ordinary DNS traffic proxy: After the DNS traffic passes the detection, the resolve() function in the dns.resolver library is called to perform a DNS query on the pre-configured upstream DNS server. After obtaining the response from the upstream server, the result is encapsulated into a DNS response packet and then returned to the client.

[0160] Secure DNS traffic proxy: After configuring the secure DNS traffic proxy mode, the domain name data is detected and the domain name and record type in the DNS traffic are extracted to construct a uniform resource locator pointing to the upstream DoH server ( , URL), and perform a DoH query, repackage the query result into a DNS response packet, and then return it to the client.

[0161] The technical effect of the embodiment of the present application is: through the trained fusion convolutional neural network and gated recurrent unit machine learning model, it is possible to automatically learn the effective features of the input data and perform automatic feature extraction, thereby avoiding the problem of manual feature extraction.

[0162] Figure 4 Schematic diagram of the process of detecting non-target domain names provided in the embodiment of the present application Figure 2 .like Figure 4 As shown, the non-target domain name detection method provided in this embodiment is a further refinement of the non-target domain name detection method provided in the previous embodiment of the present invention. The non-target domain name detection method provided in this embodiment includes the following steps:

[0163] S401: Acquire domain name data in domain name system traffic, and pre-process the domain name data to obtain an integer array of a preset length.

[0164] In this embodiment, the effects and methods of S401 are similar to those of S301 in the previous embodiment of the present invention, and are not described in detail here.

[0165] S402: Perform word embedding on the integer array to obtain first domain name data.

[0166] In this embodiment, the first domain name data is a low-dimensional dense matrix. The effect and method of S402 are similar to those of S302 in the previous embodiment of the present invention, and will not be repeated here.

[0167] S403: When the first domain name data is neither in the preset blacklist nor in the preset whitelist, input the first domain name data into a preset probability prediction model to obtain a predicted probability of the first domain name data.

[0168] In this embodiment, the training and implementation of the probability prediction model in S403 are similar to the effects and methods of S303 in the previous embodiment of the present invention, and will not be repeated here.

[0169] S404: If the predicted probability is less than a first preset value, determine the first domain name data as a target domain name; if the predicted probability is greater than a second preset value, determine the first domain name data as a non-target domain name.

[0170] Specifically, in this embodiment, the first preset value is 0.1 and the second preset value is 0.2. If the obtained prediction probability is less than 0.1, the first domain name data is a DGA domain name; if the obtained prediction probability is greater than 0.2, the first domain name data is a non-DGA domain name.

[0171] S405: If the predicted probability is not less than the first preset value and not greater than the second preset value, obtain the entropy value, the number of consonants, and the domain name length of the first domain name data.

[0172] In this embodiment, if the predicted probability is not less than 0.1 and not greater than 0.2, the traditional DGA detection method is used as a supplementary means to the other two detection methods. The traditional DGA detection method mainly detects domain names by analyzing domain name characteristics. This method mainly detects domain names based on three indicators: domain name entropy, number of consonants, and domain name length.

[0173] S406. If the entropy value is greater than the third preset value, the number of consonants is greater than the fourth preset value, and the domain name length is greater than the fifth preset value, determine that the first domain name data is the target domain name; otherwise, determine that the first domain name data is a non-target domain name.

[0174] Specifically, in this embodiment, the third preset value is 3.8, the fourth preset value is 7, and the fifth preset value is 12. When the entropy value of the first domain name data is greater than 3.8, the number of consonants is greater than 7, and the domain name length is greater than 12, the first domain name data can be considered a DGA domain name and corresponding processing can be performed.

[0175] The technical effect of the embodiment of the present application is: when performing DGA domain name detection through a trained machine learning model that integrates a convolutional neural network and a gated recurrent unit, the predicted probability of the domain name data is used to determine whether the domain name data is a target domain name or a non-target domain name, with high computational efficiency.

[0176] Figure 5 This is a schematic diagram of the structure of the training device for the probability prediction model provided in the embodiment of the present application. Figure 5 As shown, in this embodiment, the probability prediction model training device 500 can be located in an electronic device. The probability prediction model training device 500 includes:

[0177] A preprocessing module 501 is used to obtain domain name data in domain name system traffic and preprocess the domain name data to obtain an integer array of a preset length;

[0178] A word embedding module 502 is configured to perform word embedding on an integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix;

[0179] A local feature extraction module 503 is configured to perform feature extraction and dimensionality reduction on the first domain name data using a convolutional neural network to obtain a local key feature graph of the first domain name data;

[0180] A context feature extraction module 504 is configured to obtain context features of a local key feature map through a gated recurrent unit;

[0181] A mapping module 505 is configured to map the feature space of the local key feature map and the feature space of the contextual features to a one-dimensional sample label space through a convolutional neural network when the task is a binary classification task; wherein the task is a binary classification task, and is configured to indicate whether the first domain name data is a target domain name or a non-target domain name;

[0182] The output module 506 is configured to obtain a predicted probability of the first domain name data according to the one-dimensional sample label space, so as to obtain a probability that the first domain name data is a non-target domain name through the predicted probability.

[0183] The training device of the probability prediction model provided in this embodiment can execute Figure 1 The technical solution of the training method embodiment of the probability prediction model shown in the figure has the same implementation principle and technical effect as Figure 1 The training method embodiments of the probability prediction model shown are similar and will not be described in detail here.

[0184] At the same time, the training device for the probability prediction model provided by the present invention further refines the training device for the probability prediction model 500 based on the training device for the probability prediction model provided in the previous embodiment.

[0185] Optionally, in this embodiment, the preprocessing module 501 is specifically configured to:

[0186] The domain name data includes a plurality of uppercase letters and a plurality of lowercase letters, and duplicate data and irrelevant data in the domain name data are deleted to obtain second domain name data;

[0187] Filling the second domain name data with padding characters to obtain third domain name data; wherein the length of the third domain name data is a preset length;

[0188] Convert each uppercase letter in the third domain name data into a corresponding lowercase letter to obtain fourth domain name data;

[0189] Perform dictionary mapping on the fourth domain name data to obtain an integer array of a preset length.

[0190] Optionally, in this embodiment, the local feature extraction module 503 is specifically configured to:

[0191] Performing a convolution operation on the first domain name data through a convolutional layer of a convolutional neural network to obtain a feature map corresponding to the first domain name data;

[0192] The feature map is downsampled through the pooling layer of the convolutional neural network to obtain a local key feature map of the first domain name data.

[0193] Optionally, when the local feature extraction module 503 performs a downsampling operation on the feature map through the pooling layer of the convolutional neural network to obtain the local key feature map of the first domain name data, the feature map is a matrix;

[0194] A pooling matrix of a preset size is moved to each position of the feature map one by one to obtain a coverage area corresponding to each position; wherein the size of each coverage area is the same as the size of the pooling matrix;

[0195] The maximum value among multiple values ​​of each coverage area is obtained, and a local key feature map is obtained according to the maximum value in each coverage area.

[0196] Optionally, in this embodiment, the mapping module 505 is specifically configured to:

[0197] Through the fully connected layer of the convolutional neural network, the feature space of the local key feature map and the feature space of the context feature are mapped to the one-dimensional sample label space.

[0198] The training device of the probability prediction model provided in this embodiment can execute Figure 1 and Figure 2 The technical solution of the training method embodiment of the probability prediction model shown in the figure has the same implementation principle and technical effect as Figure 1 and Figure 2 The training method embodiments of the probability prediction model shown are similar and will not be described in detail here.

[0199] Figure 6 This is a schematic diagram of the structure of the non-target domain name detection device provided in the embodiment of the present application. Figure 6 As shown, in this embodiment, the non-target domain name detection device 600 can be located in an electronic device. The non-target domain name detection device 600 includes:

[0200] A preprocessing module 601 is used to obtain domain name data in domain name system traffic and preprocess the domain name data to obtain an integer array of a preset length;

[0201] A word embedding module 602 is configured to perform word embedding on an integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix;

[0202] The probability prediction module 603 is used to input the first domain name data into a preset probability prediction model when the first domain name data is neither in a preset blacklist nor in a preset whitelist, to obtain the predicted probability of the first domain name data, so as to determine whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability; wherein the probability prediction model is a model obtained by a probability prediction model training device.

[0203] The non-target domain name detection device provided in this embodiment can execute Figure 3 The technical solution of the non-target domain name detection method shown in the figure has the same implementation principle and technical effect as Figure 3 The embodiments of the detection method for non-target domain names are similar and will not be described in detail here.

[0204] Meanwhile, the non-target domain name detection device provided by the present invention further refines the non-target domain name detection device 600 based on the non-target domain name detection device provided by the previous embodiment.

[0205] Optionally, in this embodiment, when the probability prediction module 603 determines whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability, if the predicted probability is less than a first preset value, the first domain name data is determined to be a target domain name; if the predicted probability is greater than a second preset value, the first domain name data is determined to be a non-target domain name; wherein the first preset value is less than the second preset value.

[0206] Optionally, in this embodiment, if the predicted probability is not less than the first preset value and not greater than the second preset value, the method further includes:

[0207] Obtaining the entropy value, number of consonants, and domain name length of the first domain name data;

[0208] If the entropy value is greater than the third preset value, the number of consonants is greater than the fourth preset value, and the domain name length is greater than the fifth preset value, the first domain name data is determined to be the target domain name; otherwise, the first domain name data is determined to be a non-target domain name.

[0209] The non-target domain name detection device provided in this embodiment can execute Figure 3 and Figure 4 The technical solution of the embodiment of the detection method of non-target domain name shown in the figure has the same implementation principle and technical effect as Figure 3 and Figure 4 The embodiments of the detection method for non-target domain names shown are similar and will not be described in detail here.

[0210] Figure 7This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. This electronic device is intended for use with various electronic devices that can execute a probabilistic prediction model training method or a non-target domain name detection method, such as a microcomputer, a single-chip microcomputer, and other suitable computers. The components shown herein, their connections and relationships, and their functions are provided for illustrative purposes only and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0211] like Figure 7 As shown, the electronic device 70 includes: at least one processor 701 and a memory 702. The electronic device 70 also includes a communication component 703. The processor 701, the memory 702 and the communication component 703 are connected via a bus 704.

[0212] During the specific implementation process, at least one processor 701 executes the computer execution instructions stored in the memory 702, so that at least one processor 701 executes the probability prediction model training method or non-target domain name detection method executed by the electronic device side as above.

[0213] The specific implementation process of the processor 701 can refer to the above-mentioned probability prediction model training method embodiment or non-target domain name detection method embodiment. The implementation principles and technical effects are similar and will not be repeated here in this embodiment.

[0214] In the above embodiment, it should be understood that the processor 701 may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. The general-purpose processor 701 may be a microprocessor or any conventional processor. The steps of the method disclosed in the present invention may be directly implemented by a hardware processor or implemented by a combination of hardware and software modules in the processor.

[0215] The memory 702 may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk storage.

[0216] Bus 704 can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. Bus 704 can be classified as an address bus, a data bus, a control bus, etc. For ease of illustration, the bus 704 in the drawings of this application is not limited to a single bus or a single type of bus.

[0217] The above-mentioned functions implemented by the electronic device and the main control device have introduced the solutions provided by the embodiments of the present invention. It can be understood that in order to implement the above-mentioned functions, the electronic device or the main control device includes hardware structures and / or software modules corresponding to the execution of each function. In combination with the units and algorithm steps of the various examples described in the embodiments disclosed in the embodiments of the present invention, the embodiments of the present invention can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the technical solution of the embodiments of the present invention.

[0218] The present application also provides a computer-readable storage medium, which stores computer-executable instructions. When a processor executes the computer-executable instructions, the above-mentioned probability prediction model training method or non-target domain name detection method is implemented.

[0219] The computer-readable storage medium mentioned above can be implemented by any type of volatile or non-volatile memory device, or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The computer-readable storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0220] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. The readable storage medium may also be an integral part of the processor. The processor and the readable storage medium may reside in an application-specific integrated circuit (ASIC). The processor and the readable storage medium may also reside as discrete components in an electronic device or a host control device.

[0221] Memory 702 is a non-transitory computer-readable storage medium provided by the present invention. The non-transitory computer-readable storage medium of the present invention stores computer instructions for causing a computer to execute the method for training a probability prediction model or the method for detecting non-target domain names provided by the present invention.

[0222] The memory 702 is a non-transitory computer-readable storage medium that can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as the program instructions / modules corresponding to the model training method or the program instructions / modules corresponding to the domain name detection method in the embodiment of the present invention (for example, Figure 5 The preprocessing module 501, word embedding module 502, local feature extraction module 503, context feature extraction module 504, mapping module 505, output module 506 or Figure 6 The processor 701 executes the non-transient software programs, instructions, and modules stored in the memory 702 to perform various functional applications and data processing, thereby implementing the probability prediction model training method or the non-target domain name detection method in the above method embodiment.

[0223] At the same time, this embodiment also provides a computer program product. When the instructions in the computer program product are executed by a processor, the probability prediction model training method or non-target domain name detection method of the above embodiment can be executed.

[0224] Those skilled in the art will readily recognize other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art not disclosed in the present invention. The specification and examples are to be considered as exemplary only, with the true scope and spirit of the present invention being indicated by the claims.

[0225] It should be understood that the embodiments of the present invention are not limited to the precise structures described above and shown in the drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the embodiments of the present invention is limited only by the appended claims.

Claims

1. A method for training a probability prediction model, characterized in that: include: Obtaining domain name data in domain name system traffic and preprocessing the domain name data to obtain an integer array of a preset length; Performing word embedding on the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix; Performing feature extraction and dimensionality reduction on the first domain name data using a convolutional neural network to obtain a local key feature graph of the first domain name data; Obtaining contextual features of the local key feature map through a gated recurrent unit; When the task is a binary classification task, the feature space of the local key feature map and the feature space of the contextual features are mapped to a one-dimensional sample label space through the convolutional neural network; wherein the task is a binary classification task for indicating whether the first domain name data is a target domain name or a non-target domain name; The predicted probability of the first domain name data is obtained according to the one-dimensional sample label space, so as to obtain the probability that the first domain name data is a non-target domain name through the predicted probability.

2. The method for training a probability prediction model according to claim 1, wherein: The step of performing feature extraction and dimensionality reduction on the first domain name data by using a convolutional neural network to obtain a local key feature graph of the first domain name data includes: Performing a convolution operation on the first domain name data through a convolutional layer of the convolutional neural network to obtain a feature map corresponding to the first domain name data; The feature map is downsampled by the pooling layer of the convolutional neural network to obtain a local key feature map of the first domain name data.

3. The method for training a probability prediction model according to claim 2, wherein: The feature map is a matrix; The downsampling operation is performed on the feature map through the pooling layer of the convolutional neural network to obtain a local key feature map of the first domain name data, including: Moving a pooling matrix of a preset size to each position of the feature map one by one to obtain a coverage area corresponding to each position; wherein the size of each coverage area is the same as the size of the pooling matrix; A maximum value among multiple values ​​of each of the coverage areas is obtained, and the local key feature map is obtained according to the maximum value in each of the coverage areas.

4. The method for training a probability prediction model according to claim 1, wherein: The domain name data includes a number of uppercase letters and a number of lowercase letters; The preprocessing of the domain name data to obtain an integer array of a preset length includes: Deleting duplicate data and irrelevant data in the domain name data to obtain second domain name data; Filling the second domain name data with padding characters to obtain third domain name data; wherein the length of the third domain name data is a preset length; Convert each of the uppercase letters in the third domain name data into a corresponding lowercase letter to obtain fourth domain name data; Dictionary mapping is performed on the fourth domain name data to obtain an integer array of the preset length.

5. The method for training a probability prediction model according to claim 1, wherein: Mapping the feature space of the local key feature map and the feature space of the context feature to a one-dimensional sample label space through the convolutional neural network includes: The feature space of the local key feature map and the feature space of the context feature are mapped to a one-dimensional sample label space through the fully connected layer of the convolutional neural network.

6. A method for detecting non-target domain names, characterized in that: include: Acquire domain name data in domain name system traffic, and pre-process the domain name data to obtain an integer array of a preset length; Performing word embedding on the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix; When the first domain name data is neither in a preset blacklist nor in a preset whitelist, the first domain name data is input into a preset probability prediction model to obtain a predicted probability of the first domain name data, so as to determine whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability; wherein the probability prediction model is a model obtained by the training method of the probability prediction model described in any one of claims 1 to 5.

7. The method for detecting non-target domain names according to claim 6, wherein: The determining, based on the predicted probability, whether the first domain name data is a target domain name or a non-target domain name includes: If the predicted probability is less than a first preset value, the first domain name data is determined to be a target domain name; if the predicted probability is greater than a second preset value, the first domain name data is determined to be a non-target domain name; wherein the first preset value is less than the second preset value.

8. The method for detecting non-target domain names according to claim 7, wherein: If the predicted probability is not less than the first preset value and not greater than the second preset value, the method further includes: Obtaining an entropy value, a number of consonants, and a domain name length of the first domain name data; If the entropy value is greater than a third preset value, the number of consonants is greater than a fourth preset value, and the domain name length is greater than a fifth preset value, the first domain name data is determined to be a target domain name; otherwise, the first domain name data is determined to be a non-target domain name.

9. A training device for a probability prediction model, characterized in that: include: A preprocessing module, configured to obtain domain name data from domain name system traffic and preprocess the domain name data to obtain an integer array of a preset length; a word embedding module, configured to perform word embedding on the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix; a local feature extraction module, configured to perform feature extraction and dimensionality reduction on the first domain name data through a convolutional neural network to obtain a local key feature map of the first domain name data; A context feature extraction module, configured to obtain context features of the local key feature map through a gated recurrent unit; a mapping module, configured to, when the task is a binary classification task, map the feature space of the local key feature map and the feature space of the contextual features to a one-dimensional sample label space through the convolutional neural network; wherein the task is a binary classification task, and is configured to indicate whether the first domain name data is a target domain name or a non-target domain name; The output module is configured to obtain a predicted probability of the first domain name data according to the one-dimensional sample label space, so as to obtain a probability that the first domain name data is a non-target domain name through the predicted probability.

10. A device for detecting non-target domain names, characterized in that: include: A preprocessing module, configured to obtain domain name data from domain name system traffic and preprocess the domain name data to obtain an integer array of a preset length; a word embedding module, configured to perform word embedding on the integer array to obtain first domain name data; wherein the first domain name data is a low-dimensional dense matrix; A probability prediction module is used to input the first domain name data into a preset probability prediction model when the first domain name data is neither in a preset blacklist nor in a preset whitelist, to obtain a predicted probability of the first domain name data, so as to determine whether the first domain name data is a target domain name or a non-target domain name based on the predicted probability; wherein the probability prediction model is a model obtained by the training device of the probability prediction model described in claim 9.

Images