DGA domain name detection method, system and device based on dual-task learning and medium

Abstract

The invention relates to the technical field of network security detection, in particular to a DGA domain name detection method, system and device based on dual-task learning and a medium. According to the method, aiming at the No Error flow and the NXDomain flow of the DNS, the detection coverage range is wider; through extracting relation, behavior and text features, the DGA domain name can be subjected to omnibearing modeling, the defect of a single feature is avoided, meanwhile, a graph data structure is introduced to better fuse multi-dimensional features, and the method has a lower missing report rate in detection of various DGA families; a supervised learning mechanism is adopted, and a double-task learning framework of graph regularization is combined, so that the robustness of a graph neural network is improved, noise interference can be reduced, and a lower false alarm rate is achieved for analysis of pinyin type normal domain names; the method has better universality and higher precision and accuracy in an application scene of DGA detection, and has a wide application prospect.

Description

Technical Field

[0001] The present invention relates to the technical field of network security detection, and in particular to a DGA domain name detection method, system, device and medium based on dual-task learning. Background Art

[0002] With the popularity of threat intelligence detection systems, more and more malicious network activities have been forced to use algorithmically generated dynamic domain names to communicate with command and control servers. The Domain Generation Algorithm (DGA) uses random seeds to generate DGA domain names with pseudo-random strings. A single family can generate tens of thousands of domain names per day. These random domain names can successfully evade traditional detection mechanisms and are widely used in botnets, ransomware, and mining software.

[0003] The DGA algorithm can use different seeds to generate various complex domain names, and the previous blacklist protection method has become ineffective. The DGA algorithm is cracked through reverse engineering, and the command and control server communication is blocked by preemptive registration. This method is not only difficult and time-consuming to reverse, but also the number of domain names generated by the DGA algorithm is large, and the preemptive registration cost is high. At the same time, a DGA detection method based on text features and behavioral features is also proposed.

[0004] The DGA domain name detection method based on text features mainly relies on the character features and text patterns of the domain name itself for classification and detection. It includes rule-based detection: identifying DGA domain names by defining a series of features, which are usually based on the statistical laws and characteristics of known DGA domain names; machine learning-based detection: using machine learning algorithms to learn domain name features and build classification models to distinguish DGA domain names from normal domain names. This type of text and string-based detection method usually has a high processing speed and can quickly identify DGA domain names in a large number of domain names; by extracting effective text features and using advanced machine learning algorithms, a high detection accuracy rate can be achieved; it does not rely on external data sources, reducing the requirements for data integrity and real-time performance. However, due to the diversity and complexity of DGA domain name generation strategies, a single feature set and detection algorithm may not cover all situations, resulting in missed reports or false positives; in the face of new DGA domain name generation algorithms and variants, it is necessary to continuously update the feature set and training model, making it difficult to maintain the effectiveness of detection.

[0005] The DGA domain name detection method based on behavioral features focuses on the behavioral patterns of DGA domain names, rather than relying solely on the text and string features of the domain name itself. It includes traffic analysis: monitoring DNS requests in network traffic, analyzing the frequency, pattern and changes of domain name requests, identifying frequently changing domain name requests, especially those that generate a large number of domain names in a short period of time; based on behavioral pattern recognition: analyzing the behavior patterns of malware through machine learning algorithms, such as the regularity of DNS requests, the characteristics of requested domain names, etc. Establish a baseline of normal and abnormal behavior to identify potential DGA activities. This type of detection method based on behavioral features not only focuses on the characteristics of the domain name itself, but also on the behavioral patterns of domain name generation and use, providing a more comprehensive detection perspective; it can monitor network traffic and malware behavior in real time and discover new DGA activities in a timely manner; it uses machine learning algorithms to automatically identify abnormal behavior patterns and improve the intelligence level of detection. However, its computational complexity is high, and it needs to process a large amount of network traffic and behavior data, which requires high computing resources; the false alarm rate is high, and in a complex network environment, normal network behavior may be misjudged as DGA activities; it relies on external data sources, such as threat intelligence. The quality and update speed of external data sources may affect the accuracy and timeliness of detection.

[0006] Both algorithms mentioned above have the following problems: high underreporting of typical malicious DGA domain name detection and high false positive analysis of normal domain name analysis. In addition, traditional detection methods based on behavioral features often focus on the analysis of NXDomain traffic and lack the detection of DGA domain names in normal DNS traffic. In summary, it is urgent to propose a new DGA domain name detection method that covers various DNS traffic. Summary of the invention

[0007] Aiming at the problems that the existing DGA domain name detection method has high false positives and cannot detect the DGA domain name in the normally resolved DNS traffic, the present invention proposes a DGA domain name detection method, system, device and medium based on dual-task learning; the method targets the No Error traffic and NXDomain traffic of DNS, and has a wider detection coverage; by extracting relationship, behavior and text features, the DGA domain name can be modeled in an all-round way to avoid the deficiency of a single feature, and at the same time, a graph data structure is introduced to better integrate multi-dimensional features, so that a lower false negative rate is achieved in the detection of various DGA families; a supervised learning mechanism is adopted, and a dual-task learning framework combined with graph regularization is used to improve the robustness of the graph neural network, reduce noise interference, and achieve a lower false positive rate for the analysis of normal domain names of pinyin.

[0008] The specific implementation contents of the present invention are as follows: A DGA domain name detection method based on dual-task learning specifically includes the following steps: Step S1: Obtaining DNS traffic from a DNS server, and classifying the DNS traffic according to a flag response code; Step S2: extracting message features from the classified DNS traffic; Step S3: Generate node attributes according to message features, and annotate known domain name nodes according to the DGA black and white sample library to generate a three-part graph with attributes and labels; Step S4: Call the dual-task learning framework, combine the node embedding and node classification in the three-part graph, learn the graph representation to obtain a low-dimensional node embedding vector, and train to obtain a classification model for DGA domain name nodes; Step S5: extract the current cycle, calculate the node embedding vector similarity, reconstruct the intermediate adjacency matrix, and perform weighted summation with the original adjacency matrix and input it into the regularization model. The output node is hidden and used as the input of the next graph node classification model. Step S6: traverse the unknown domain name nodes in the three-part graph, obtain the binary classification probability value, and obtain the DGA detection result of the current domain name according to the set threshold.

[0009] In order to better implement the present invention, further, the step S1 specifically includes the following steps: Step S11: calling a packet capture tool to obtain DNS traffic within a random time period from the DNS server; Step S12: According to the flag response code, two types of traffic with response codes of 0 and 3 are filtered from the DNS traffic; the two types of traffic include valid traffic with successful No Error resolution and invalid traffic with non-existent NXDomain domain name.

[0010] In order to better implement the present invention, further, the message features in step S2 include relationship features, behavior features, and text features; The relationship features include client host, domain name, and resolution IP; The behavior characteristics include domain name query and response; The text features include domain name structure features, domain name behavior features, and domain name statistical features; The domain name structure characteristics include domain name length, number of subdomains, and average length of subdomains; The domain name statistical features include N-gram distribution and entropy value; The domain name behavior characteristics include the number of queries, the number of query hosts, the response code, and the number of NXDomains.

[0011] In order to better implement the present invention, further, the step S3 specifically includes the following steps: Step S31: construct a three-part graph based on the request and resolution data in the DNS traffic, where the first type of node set is the client host of the DNS request, the second type of node set is the requested DNS domain name, and the third type of node set is the IP address resolved by the DNS; Step S32: establishing an edge based on a request relationship between the client host node set and the domain name node set; establishing an edge based on a resolution relationship between the domain name node set and the resolution IP address node set; Step S33: define various attributes of the domain name node and normalize the node attributes; Step S34: assigning labels to some known domain name nodes through the DGA black and white domain name sample library; the label is used to indicate whether the category of the node is a normal domain name or a DGA domain name.

[0012] In order to better implement the present invention, further, the step S4 specifically includes the following steps: Step S41: calling a dual-task learning framework; the dual tasks include a graph node classification task and a graph regularization task; Step S42: The graph node classification task and the graph regularization task are regarded as two separate but related tasks for mutual learning. During the entire training, the graph structure of the node classification task is learned according to the classification model and combined with the graph regularization model, and the outputs of the two tasks are used as the inputs of each other respectively, and the execution is continued iteratively. Step S43: Combining the node embedding and node classification in the three-part graph, the graph representation is learned to obtain a low-dimensional node embedding vector, and the classification model of the DGA domain name node is trained.

[0013] In order to better implement the present invention, further, the step S43 specifically includes the following steps: Step S431: calling the graph convolutional neural network to perform graph representation learning to obtain a low-dimensional node embedding vector; Step S432: Select the first-order neighbors of the node in the graph and aggregate neighborhood features; Step S433: performing a convolution operation on the node feature and the neighborhood feature; Step S434: Applying the ReLU activation function after the graph convolution layer, multiple spectral convolution operations, learning the low-dimensional representation of the node, and generating the node embedding vector; Step S435: calling a multi-layer perceptron to learn the mapping relationship between node embedding and node label to complete the domain name node classification task; the multi-layer perceptron includes an input layer, three hidden layers, and an output layer, each layer is composed of multiple neurons, and each neuron includes input, weighted sum, activation function and output; Step S436: Use the node embedding vector as the input of the input layer, the ReLU activation function as the hidden layer, and the Sigmoid activation function as the output layer; use the binary cross entropy as the loss function and the Adam algorithm as the optimizer to train and obtain the classification model of the DGA domain name node.

[0014] In order to better implement the present invention, further, step S5 specifically includes the following steps: Step S51: extract the current cycle, obtain the node embedding vector generated by the graph node classification task, calculate the weighted cosine similarity, obtain the similarity between the two nodes, and combine the threshold mechanism to select the connection edges in the graph reconstruction process to reconstruct the first intermediate adjacency matrix; Step S52: performing weighted summation on the first intermediate adjacency matrix and the adjacency matrix of the original graph to obtain the input of the graph regularization model; Step S53: using a graph neural network model, combined with a regularized loss function, and using a model optimization algorithm to train a graph regularized model; Step S54: using the smoothing regularization term, the sparse regularization term and the graph structure regularization term as the loss function; Step S55: Use the gradient descent optimization algorithm to minimize the loss function and update the parameters of the graph regularization model; Step S56: The output node hidden representation is combined with the graph reconstruction process to obtain a second intermediate adjacency matrix; the intermediate adjacency matrix is ​​weightedly summed with the original adjacency matrix and used as the input of the graph node classification task in the next cycle.

[0015] Based on the above-mentioned DGA domain name detection method based on dual-task learning, in order to better realize the present invention, further, a DGA domain name detection system based on dual-task learning is proposed, which is used to execute the above-mentioned DGA domain name detection method based on dual-task learning; it includes a data acquisition unit, a feature selection unit, a feature representation unit, a dual-task learning classification unit, a graph regularization unit, and a detection unit; The data collection unit is used to obtain DNS traffic from the DNS server and classify the DNS traffic according to the flag bit response code; The feature selection unit is used to extract message features from the classified DNS traffic; The feature representation unit is used to generate node attributes according to the message features, and to mark known domain name nodes according to the DGA black and white sample library to generate a three-part graph with attributes and labels; The dual-task learning classification unit is used to call the dual-task learning framework, combine the node embedding and node classification in the three-part graph, and learn the low-dimensional node embedding vector to train the classification model of the DGA domain name node; The graph regularization unit is used to extract the current cycle, calculate the node embedding vector similarity, reconstruct the intermediate adjacency matrix and perform weighted summation with the original adjacency matrix to input into the regularization model, and output the hidden node as the input of the next graph node classification model; The detection unit is used to traverse the unknown domain name nodes in the three-part graph, obtain the binary classification probability value, and obtain the DGA detection result of the current domain name according to the set threshold.

[0016] Based on the above-mentioned DGA domain name detection method based on dual-task learning, in order to better realize the present invention, further, an electronic device is proposed, including a memory and a processor; a computer program is stored on the memory; when the computer program is executed on the processor, the above-mentioned DGA domain name detection method based on dual-task learning is implemented.

[0017] Based on the above-mentioned DGA domain name detection method based on dual-task learning, in order to better realize the present invention, further, a computer-readable storage medium is proposed, on which computer instructions are stored; when the computer instructions are executed on the above-mentioned electronic device, the above-mentioned DGA domain name detection method based on dual-task learning is implemented.

[0018] The present invention has the following beneficial effects: The present invention targets the No Error traffic and NXDomain traffic of DNS, and has a wider detection coverage; by extracting relations, behaviors, and text features, it enables comprehensive modeling of DGA domain names, avoiding the insufficiency of single features, and at the same time introduces a graph data structure to better integrate multidimensional features, which has a lower false negative rate in the detection of various DGA families; adopts a supervised learning mechanism, combined with a dual-task learning framework of graph regularization, improves the robustness of the graph neural network, can reduce noise interference, and has a lower false positive rate for the analysis of normal domain names of pinyin. The present invention has better universality, higher precision and accuracy in the application scenarios of DGA detection, and has broad application prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A schematic diagram of the process of the DGA domain name detection method based on dual-task learning provided by the present invention.

[0020] Figure 2 A schematic diagram of a three-part graph for domain name request resolution provided by the present invention. DETAILED DESCRIPTION

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. It should be understood that the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, and therefore should not be regarded as limiting the scope of protection. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technical personnel in this field without making creative work are within the scope of protection of the present invention.

[0022] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "disposed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be an indirect connection through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0023] Embodiment 1: This embodiment proposes a DGA domain name detection method based on dual-task learning, which specifically includes the following steps: Step S1: Obtain DNS traffic from a DNS server, and classify the DNS traffic according to a flag response code.

[0024] The step S1 specifically includes the following steps: Step S11: calling a packet capture tool to obtain DNS traffic within a random time period from the DNS server; Step S12: According to the flag response code, two types of traffic with response codes of 0 and 3 are filtered from the DNS traffic; the two types of traffic include valid traffic with successful No Error resolution and invalid traffic with non-existent NXDomain domain name.

[0025] Step S2: Extract message features from the classified DNS traffic. The message features in step S2 include relationship features, behavior features, and text features; The relationship features include client host, domain name, and resolution IP; The behavior characteristics include domain name query and response; The text features include domain name structure features, domain name behavior features, and domain name statistical features; The domain name structure characteristics include domain name length, number of subdomains, and average length of subdomains; The domain name statistical features include N-gram distribution and entropy value; The domain name behavior characteristics include the number of queries, the number of query hosts, the response code, and the number of NXDomains.

[0026] Step S3: Generate node attributes according to the message features, and annotate known domain name nodes according to the DGA black and white sample library to generate a three-part graph with attributes and labels.

[0027] The step S3 specifically comprises the following steps: Step S31: construct a three-part graph based on the request and resolution data in the DNS traffic, where the first type of node set is the client host of the DNS request, the second type of node set is the requested DNS domain name, and the third type of node set is the IP address resolved by the DNS; Step S32: establishing an edge based on a request relationship between the client host node set and the domain name node set; establishing an edge based on a resolution relationship between the domain name node set and the resolution IP address node set; Step S33: define various attributes of the domain name node and normalize the node attributes; Step S34: assigning labels to some known domain name nodes through the DGA black and white domain name sample library; the label is used to indicate whether the category of the node is a normal domain name or a DGA domain name.

[0028] Step S4: Call the dual-task learning framework, combine the node embedding and node classification in the three-part graph, learn the graph representation to obtain a low-dimensional node embedding vector, and train the classification model of the DGA domain name node.

[0029] The step S4 specifically comprises the following steps: Step S41: calling a dual-task learning framework; the dual tasks include a graph node classification task and a graph regularization task; Step S42: The graph node classification task and the graph regularization task are regarded as two separate but related tasks for mutual learning. During the entire training, the graph structure of the node classification task is learned according to the classification model and combined with the graph regularization model, and the outputs of the two tasks are used as the inputs of each other respectively, and the execution is continued iteratively. Step S43: Combining the node embedding and node classification in the three-part graph, the graph representation is learned to obtain a low-dimensional node embedding vector, and the classification model of the DGA domain name node is trained.

[0030] The step S43 specifically includes the following steps: Step S431: calling the graph convolutional neural network to perform graph representation learning to obtain a low-dimensional node embedding vector; Step S432: Select the first-order neighbors of the node in the graph and aggregate neighborhood features; Step S433: performing a convolution operation on the node feature and the neighborhood feature; Step S434: Applying the ReLU activation function after the graph convolution layer, multiple spectral convolution operations, learning the low-dimensional representation of the node, and generating the node embedding vector; Step S435: calling a multi-layer perceptron to learn the mapping relationship between node embedding and node label to complete the domain name node classification task; the multi-layer perceptron includes an input layer, three hidden layers, and an output layer, each layer is composed of multiple neurons, and each neuron includes input, weighted sum, activation function and output; Step S436: Use the node embedding vector as the input of the input layer, the ReLU activation function as the hidden layer, and the Sigmoid activation function as the output layer; use the binary cross entropy as the loss function and the Adam algorithm as the optimizer to train and obtain the classification model of the DGA domain name node.

[0031] Step S5: extract the current cycle, calculate the similarity of the node embedding vector, reconstruct the intermediate adjacency matrix and add the weighted sum with the original adjacency matrix to input into the regularization model, output the node hidden and serve as the input of the next graph node classification model.

[0032] The step S5 specifically comprises the following steps: Step S51: extract the current cycle, obtain the node embedding vector generated by the graph node classification task, calculate the weighted cosine similarity, obtain the similarity between the two nodes, and combine the threshold mechanism to select the connection edges in the graph reconstruction process to reconstruct the first intermediate adjacency matrix; Step S52: performing weighted summation on the first intermediate adjacency matrix and the adjacency matrix of the original graph to obtain the input of the graph regularization model; Step S53: using a graph neural network model, combined with a regularized loss function, and using a model optimization algorithm to train a graph regularized model; Step S54: using the smoothing regularization term, the sparse regularization term and the graph structure regularization term as the loss function; Step S55: Use the gradient descent optimization algorithm to minimize the loss function and update the parameters of the graph regularization model; Step S56: The output node hidden representation is combined with the graph reconstruction process to obtain a second intermediate adjacency matrix; the intermediate adjacency matrix is ​​weightedly summed with the original adjacency matrix and used as the input of the graph node classification task in the next cycle.

[0033] Step S6: traverse the unknown domain name nodes in the three-part graph, obtain the binary classification probability value, and obtain the DGA detection result of the current domain name according to the set threshold.

[0034] Working principle: This embodiment supports the detection of NXDomain and No Error type messages in DNS traffic at the same time. It combines text features and behavioral features and adopts a graph neural network model with a dual-task framework. It has obvious advantages in noise resistance and better detection accuracy for DGA domain names.

[0035] Embodiment 2: This embodiment is based on the above embodiment 1. Figure 1 , Figure 2 As shown, a specific embodiment is described in detail.

[0036] This embodiment first collects two types of DNS traffic and extracts three major types of features to construct a three-part graph of request resolution relationships, and attributes and labels the graph; then a dual-task learning framework is adopted to regard graph node classification and graph regularization as two separate but related tasks for mutual learning, and finally the detection results of unknown domain name nodes are obtained, which specifically includes the following steps.

[0037] Step S1: DNS traffic data collection.

[0038] Use network packet capture tools to collect traffic from the DNS server within a certain period of time; you can also directly use a third-party public DNS traffic data set. Then filter out two types of traffic with response codes 0 and 3 in the flag bit, which are valid traffic with No Error resolution success and invalid traffic with NXDomain domain name non-existence. Store the DNS traffic data in pcap format for subsequent feature analysis.

[0039] Normal white samples and DGA black samples. Get 10 million popular domain names provided by DomCop as whitelist data for domain names.

[0040] We obtained DGA family samples from the DGArchive database. We also used the open source code of DGA and combined it with random seeds to generate a large number of DGA samples. The two methods together covered a total of 109 DGA families, including 99 random DGA families and 10 typical DGA families. Typical families include suppobox, banjori, beebone, volatilecedar, matsnu, gozi, pzid, rovnix, cryptowall, and pizd. We collected a total of 110 million DGA domain names as blacklist data for domain names.

[0041] Step S2: DGA feature extraction.

[0042] The three major categories and six minor categories of features of DGA domain names are extracted, namely: relationship features include client host, domain name, and resolution IP; behavior features include domain name query and response; text features include domain name structural features and statistical features.

[0043] Domain name structure characteristics: domain name length, number of subdomains, average length of subdomains; Domain name statistical characteristics: N-gram distribution, entropy value; Domain name behavior characteristics: number of queries, number of query hosts, response code, and number of NXDomains.

[0044] Step S3: Graph feature representation.

[0045] The request resolution relationship between the client host, domain name, and resolution IP is used to construct a three-part graph, such as Figure 2 The text features and behavioral features of the DGA domain name are combined to generate the node attributes in the graph, and the known domain name nodes in the graph are annotated through the DGA black and white sample library to generate a three-part graph with attributes and labels.

[0046] A three-part graph is constructed using the request and resolution data in DNS traffic. The first node set is the client host of the DNS request, the second node set is the requested DNS domain name, and the third node set is the IP address resolved by DNS. There is no direct connection between the nodes in the same set. The client host node is marked by the source IP address in the DNS request message; the domain name node is extracted from the A and AAAA records of the DNS request message; the resolution IP node is extracted from the A and AAAA records of the DNS response message.

[0047] There are two types of relationship edges between nodes: an edge based on the request relationship is established between the client host node set and the domain name node set; an edge based on the resolution relationship is established between the domain name node set and the resolution IP address node set. For the domain name node that returns NXDomain, if the resolution relationship edge cannot be successfully established, the DNS query response code is marked in the attributes of the domain name node to indicate the success or failure of the resolution.

[0048] Define various attributes for domain name nodes, including structural features, statistical features, and behavioral features of domain names. Normalize node attributes. Use the DGA black and white sample library to assign a label to each known domain name node. The label indicates whether the node is a normal domain name or a DGA domain name for subsequent supervised learning.

[0049] Step S4: Dual-task learning.

[0050] A dual-task learning framework is adopted, where task one is graph node classification and task two is graph regularization. Graph node classification and graph regularization are regarded as two separate but related tasks for mutual learning. During the entire training, the outputs of the two tasks are used as the input of each other, and the execution is continuously iterated, which effectively improves the accuracy of DGA domain node classification.

[0051] The classification model is used to learn the graph structure of the node classification task, and the graph regularization model is used to enhance the robustness of the graph neural network. The two models use their respective outputs as each other's input and continue to iterate. The mutual learning between the models facilitates the generation of higher-quality graph structure data and effectively improves the accuracy of domain name node classification.

[0052] The node embedding and node classification in the three-part graph are jointly learned in an end-to-end manner. The graph representation learning is performed through the graph convolutional neural network to obtain a low-dimensional node embedding vector; the classification model of the DGA domain name node is trained by combining the labeled domain name data with the multi-layer perceptron.

[0053] Graph representation learning.

[0054] There are many nodes and edges in the domain name three-part graph, and the generated model is large. If matrix decomposition is used directly for DGA domain name detection, it will bring huge computational complexity. Graph representation learning reduces the dimensionality of the complex original domain name three-part graph to facilitate the subsequent machine learning algorithm to classify DGA domain name nodes. Graph representation learning can be performed through a graph convolutional neural network (GCN) to obtain a low-dimensional node embedding vector.

[0055] Node message passing: Node embedding is generated by aggregating the neighborhood information of the node, which can make full use of the attribute information contained in the node to calculate the forward update of the current node in the three-part graph. All first-order neighbors of the node in the graph are selected to aggregate the neighborhood features; the aggregation function is a filter function about the eigenvalues ​​of the Laplacian matrix of the graph, and the product of the node's own features and the filter function is the spectral convolution operation on the graph. Through multiple spectral convolution operations, the attribute information of the node is integrated into the final generated vector, and the low-dimensional representation of the node is learned to generate the node embedding vector.

[0056] Activation function: ReLU has become the standard choice for convolutional neural networks because it can speed up the training of neural networks and improve the convergence of the network. The ReLU activation function is applied after the graph convolution layer to increase the expressive power of the model.

[0057] Graph pooling layer: downsamples the output of the graph convolution layer to reduce the number of nodes in the large graph structure, thereby reducing the amount of calculation and parameters. Average pooling is used to select the average value in the graph convolution area as the output.

[0058] Graph node classification.

[0059] The five-layer perceptron is used to learn the mapping relationship between node embedding and node label, so as to complete the classification task of domain name nodes. The five-layer perceptron structure includes: an input layer, three hidden layers, and an output layer. Each layer is composed of multiple neurons, and each neuron contains: input, weighted sum, activation function, and output.

[0060] The number of neurons in each layer is: 128 in the input layer, 64 in the first hidden layer, 32 in the second hidden layer, 16 in the third hidden layer, and 2 in the output layer.

[0061] The input content of the input layer comes from the node embedding vector generated by graph representation learning; the hidden layer uses the ReLU activation function; and the output layer uses the Sigmoid activation function.

[0062] Parameter update is performed after training is completed. The actual output value of the current network is compared with the expected output value using the binary cross entropy loss function to calculate the error value. Then, the parameters are updated using layer-by-layer back propagation combined with the gradient descent algorithm. The optimizer uses the Adam algorithm.

[0063] Step S5: Graph regularization.

[0064] The node embedding vector of the graph classification model in the current cycle is extracted, and the intermediate adjacency matrix is ​​reconstructed after node similarity calculation. The original critical matrix and the intermediate adjacency matrix are weighted and summed, and then passed as input to the graph regularization model. Three types of graph regularization terms are used to optimize the graph structure. Finally, the output node hidden representation is passed through the graph reconstruction process and combined with the original adjacency matrix as the input of the next graph node classification model.

[0065] Input: Get the node embedding vector generated by the graph node classification task, and calculate the similarity between two nodes through weighted cosine similarity. Combined with the threshold mechanism, select the connecting edges in the graph reconstruction process, and then reconstruct the first intermediate adjacency matrix. The first intermediate adjacency matrix is ​​weighted and summed with the adjacency matrix of the original graph to form the input of the graph regularization model.

[0066] Training: Use the graph neural network model, combined with the regularized loss function, and use the model optimization algorithm to train the graph regularization model. Loss function: Includes smoothing regularization terms, sparse regularization terms, and graph structure regularization terms to ensure that the model learns robust feature representations. Model optimization: Use the gradient descent optimization algorithm to minimize the loss function and update the parameters of the graph regularization model.

[0067] Output: The output node hidden representation is used to obtain the second intermediate adjacency matrix through the graph reconstruction process. This matrix is ​​weighted and summed with the original adjacency matrix and used as the input for the graph node classification task in the next cycle.

[0068] Step S6: Domain name node detection result.

[0069] After the entire training is completed, the unlabeled domain name nodes in the three-part graph are traversed to obtain the binary classification probability value of the node. If it is greater than the specified threshold, the sample can be determined to be a DGA domain name.

[0070] Working principle: This embodiment targets DNS No Error traffic and NXDomain traffic, and has a wider detection coverage; by extracting relationships, behaviors, and text features, it enables comprehensive modeling of DGA domain names, avoiding the shortcomings of single features, and at the same time introduces graph data structures to better integrate multi-dimensional features, which has a lower false negative rate in the detection of various DGA families; adopts a supervised learning mechanism, combined with a dual-task learning framework of graph regularization, improves the robustness of the graph neural network, can reduce noise interference, and has a lower false positive rate for the analysis of normal domain names of pinyin. This embodiment has better universality, higher precision and accuracy in the application scenarios of DGA detection, and has broad application prospects.

[0071] The other parts of this embodiment are the same as those of the above-mentioned embodiment 1, and thus will not be described in detail.

[0072] Embodiment 3: Based on any one of the above-mentioned embodiments 1-2, this embodiment proposes a DGA domain name detection system based on dual-task learning, which is used to perform the above-mentioned AA; it includes a data acquisition unit, a feature selection unit, a feature representation unit, a dual-task learning classification unit, a graph regularization unit, and a detection unit; The data collection unit is used to obtain DNS traffic from the DNS server and classify the DNS traffic according to the flag bit response code; The feature selection unit is used to extract message features from the classified DNS traffic; The feature representation unit is used to generate node attributes according to the message features, and to mark known domain name nodes according to the DGA black and white sample library to generate a three-part graph with attributes and labels; The dual-task learning classification unit is used to call the dual-task learning framework, combine the node embedding and node classification in the three-part graph, and learn the low-dimensional node embedding vector to train the classification model of the DGA domain name node; The graph regularization unit is used to extract the current cycle, calculate the node embedding vector similarity, reconstruct the intermediate adjacency matrix and perform weighted summation with the original adjacency matrix to input into the regularization model, and output the hidden node as the input of the next graph node classification model; The detection unit is used to traverse the unknown domain name nodes in the three-part graph, obtain the binary classification probability value, and obtain the DGA detection result of the current domain name according to the set threshold.

[0073] This embodiment further proposes an electronic device, including a memory and a processor; a computer program is stored in the memory; when the computer program is executed on the processor, the above-mentioned DGA domain name detection method based on dual-task learning is implemented.

[0074] This embodiment further proposes a computer-readable storage medium, on which computer instructions are stored; when the computer instructions are executed on the above-mentioned electronic device, the above-mentioned DGA domain name detection method based on dual-task learning is implemented.

[0075] The other parts of this embodiment are the same as any one of the above-mentioned embodiments 1-2, so they will not be repeated here.

[0076] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A DGA domain name detection method based on dual-task learning, characterized in that: The specific steps include: Step S1: Obtaining DNS traffic from a DNS server, and classifying the DNS traffic according to a flag bit response code; Step S2: extracting message features from the classified DNS traffic; Step S3: Generate node attributes according to message features, and annotate known domain name nodes according to the DGA black and white sample library to generate a three-part graph with attributes and labels; Step S4: Call the dual-task learning framework, combine the node embedding and node classification in the three-part graph, learn the graph representation to obtain a low-dimensional node embedding vector, and train to obtain a classification model for DGA domain name nodes; Step S5: extract the current cycle, calculate the node embedding vector similarity, reconstruct the intermediate adjacency matrix, and perform weighted summation with the original adjacency matrix and input it into the regularization model. The output node is hidden and used as the input of the next graph node classification model. Step S6: traverse the unknown domain name nodes in the three-part graph, obtain the binary classification probability value, and obtain the DGA detection result of the current domain name according to the set threshold.

2. According to the dual-task learning-based DGA domain name detection method of claim 1, it is characterized in that: The step S1 specifically includes the following steps: Step S11: calling a packet capture tool to obtain DNS traffic within a random time period from the DNS server; Step S12: According to the flag response code, two types of traffic with response codes of 0 and 3 are filtered from the DNS traffic; the two types of traffic include valid traffic with successful No Error resolution and invalid traffic with non-existent NXDomain domain name.

3. The DGA domain name detection method based on dual-task learning according to claim 1 is characterized in that: The message features in step S2 include relationship features, behavior features, and text features; The relationship features include client host, domain name, and resolution IP; The behavior characteristics include domain name query and response; The text features include domain name structure features, domain name behavior features, and domain name statistical features; The domain name structure characteristics include domain name length, number of subdomains, and average length of subdomains; The domain name statistical features include N-gram distribution and entropy value; The domain name behavior characteristics include the number of queries, the number of query hosts, the response code, and the number of NXDomains.

4. The DGA domain name detection method based on dual-task learning according to claim 1, characterized in that: The step S3 specifically comprises the following steps: Step S31: construct a three-part graph based on the request and resolution data in the DNS traffic, where the first type of node set is the client host of the DNS request, the second type of node set is the requested DNS domain name, and the third type of node set is the IP address resolved by the DNS; Step S32: establishing an edge based on a request relationship between the client host node set and the domain name node set; establishing an edge based on a resolution relationship between the domain name node set and the resolution IP address node set; Step S33: define various attributes of the domain name node and normalize the node attributes; Step S34: assigning labels to some known domain name nodes through the DGA black and white domain name sample library; the label is used to indicate whether the category of the node is a normal domain name or a DGA domain name.

5. The DGA domain name detection method based on dual-task learning according to claim 1, characterized in that: The step S4 specifically comprises the following steps: Step S41: calling a dual-task learning framework; the dual tasks include a graph node classification task and a graph regularization task; Step S42: The graph node classification task and the graph regularization task are regarded as two separate but related tasks for mutual learning. During the entire training, the graph structure of the node classification task is learned according to the classification model and combined with the graph regularization model, and the outputs of the two tasks are used as the inputs of each other respectively, and the execution is continued iteratively. Step S43: Combining the node embedding and node classification in the three-part graph, the graph representation is learned to obtain a low-dimensional node embedding vector, and the classification model of the DGA domain name node is trained.

6. A DGA domain name detection method based on dual-task learning according to claim 5, characterized in that: The step S43 specifically includes the following steps: Step S431: calling the graph convolutional neural network to perform graph representation learning to obtain a low-dimensional node embedding vector; Step S432: Select the first-order neighbors of the node in the graph and aggregate neighborhood features; Step S433: performing a convolution operation on the node feature and the neighborhood feature; Step S434: Applying the ReLU activation function after the graph convolution layer, multiple spectral convolution operations, learning the low-dimensional representation of the node, and generating the node embedding vector; Step S435: calling a multi-layer perceptron to learn the mapping relationship between node embedding and node label to complete the domain name node classification task; the multi-layer perceptron includes an input layer, three hidden layers, and an output layer, each layer is composed of multiple neurons, and each neuron includes input, weighted sum, activation function and output; Step S436: Use the node embedding vector as the input of the input layer, the ReLU activation function as the hidden layer, and the Sigmoid activation function as the output layer; use the binary cross entropy as the loss function and the Adam algorithm as the optimizer to train and obtain the classification model of the DGA domain name node.

7. The DGA domain name detection method based on dual-task learning according to claim 1, characterized in that: The step S5 specifically comprises the following steps: Step S51: extract the current cycle, obtain the node embedding vector generated by the graph node classification task, calculate the weighted cosine similarity, obtain the similarity between the two nodes, and combine the threshold mechanism to select the connection edges in the graph reconstruction process to reconstruct the first intermediate adjacency matrix; Step S52: performing weighted summation on the first intermediate adjacency matrix and the adjacency matrix of the original graph to obtain the input of the graph regularization model; Step S53: using a graph neural network model, combined with a regularized loss function, and using a model optimization algorithm to train a graph regularized model; Step S54: using the smoothing regularization term, the sparse regularization term and the graph structure regularization term as the loss function; Step S55: Use the gradient descent optimization algorithm to minimize the loss function and update the parameters of the graph regularization model; Step S56: The output node hidden representation is combined with the graph reconstruction process to obtain a second intermediate adjacency matrix; the intermediate adjacency matrix is ​​weightedly summed with the original adjacency matrix and used as the input of the graph node classification task in the next cycle.

8. A DGA domain name detection system based on dual-task learning, used to execute the DGA domain name detection method based on dual-task learning as claimed in claim 1; characterized in that: It includes a data acquisition unit, a feature selection unit, a feature representation unit, a dual-task learning classification unit, a graph regularization unit, and a detection unit; The data collection unit is used to obtain DNS traffic from the DNS server and classify the DNS traffic according to the flag bit response code; The feature selection unit is used to extract message features from the classified DNS traffic; The feature representation unit is used to generate node attributes according to the message features, and to annotate known domain name nodes according to the DGA black and white sample library to generate a three-part graph with attributes and labels; The dual-task learning classification unit is used to call the dual-task learning framework, combine the node embedding and node classification in the three-part graph, and learn the low-dimensional node embedding vector to train the classification model of the DGA domain name node; The graph regularization unit is used to extract the current cycle, calculate the node embedding vector similarity, reconstruct the intermediate adjacency matrix and perform weighted summation with the original adjacency matrix to input into the regularization model, and output the hidden node as the input of the next graph node classification model; The detection unit is used to traverse the unknown domain name nodes in the three-part graph, obtain the binary classification probability value, and obtain the DGA detection result of the current domain name according to the set threshold.

9. An electronic device, characterized in that: The invention comprises a memory and a processor; the memory stores a computer program; when the computer program is executed on the processor, the DGA domain name detection method based on dual-task learning as described in any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions; when the computer instructions are executed on the electronic device according to claim 9, the DGA domain name detection method based on dual-task learning according to any one of claims 1 to 7 is implemented.

Images