Method for detecting malicious domain name, computer equipment, program product and medium

Abstract

The invention discloses a method for detecting a malicious domain name, computer equipment, a program product and a medium, and belongs to the technical field of network security, and the method comprises the following steps: obtaining a domain name to be detected; determining an initial detection result of the domain name to be detected based on a pre-constructed dictionary type malicious domain name detection model; under the condition that the initial detection result is a non-malicious domain name, performing word segmentation processing on the domain name to be detected to obtain a word segmentation result corresponding to the domain name to be detected; and based on a preset detection strategy, determining a target detection result of the to-be-detected domain name according to the word segmentation result. The dictionary type DGA malicious domain names can be detected through the dictionary type malicious domain name detection model, and secondary detection is performed in combination with the preset detection strategy, so that the accuracy of the detection result is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, computer device, program product and medium for detecting malicious domain names. Background Art

[0002] The Domain Generation Algorithm (DDGA) is an algorithm that generates domain names using random characters, time, dictionary, hard coding, etc. The DGA algorithm is usually embedded in malware, and uses the algorithm to generate variable malicious domain names. Network attackers and botnets use the DGA algorithm to frequently change the domain names used, and only register a small part of the large number of domain names on the domain name server for attack activities. These massive malicious domain names generated by the algorithm and constantly updated make it extremely difficult to detect malicious domain names. In addition, in order to counter existing detection methods, attackers use methods such as random splicing of dictionary words, random splicing of prefixes and suffixes, and random splicing of pinyin to generate new DGA domain name types, and traditional malicious domain name detection methods cannot achieve good detection results for these types of DGA domain names. Therefore, the malicious domain name detection method used in the prior art has the problem of low accuracy. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a method, computer device, computer program product and machine-readable storage medium for detecting malicious domain names, so as to solve the problem of low accuracy of the malicious domain name detection method adopted in the prior art.

[0004] In order to achieve the above-mentioned purpose, the first aspect of the embodiment of the present application provides a method for detecting malicious domain names, the method comprising:

[0005] Get the domain name to be tested;

[0006] Determine the initial detection result of the domain name to be detected based on the pre-built dictionary malicious domain name detection model;

[0007] When the initial detection result is a non-malicious domain name, the domain name to be detected is segmented to obtain a segmentation result corresponding to the domain name to be detected;

[0008] Based on the preset detection strategy, the target detection result of the domain name to be detected is determined according to the word segmentation result.

[0009] In the embodiment of the present application, the preset detection strategy includes at least one of a known word detection strategy, a vocabulary combination form detection strategy, and a semantic association detection strategy.

[0010] In an embodiment of the present application, when the preset detection strategy is a well-known word detection strategy, based on the preset detection strategy, a target detection result of the domain name to be detected is determined according to the word segmentation result, including: matching the word segmentation result with data in a pre-constructed well-known word database, wherein the well-known word database includes trademarks, English names of organizations, pinyin names of organizations, pinyin abbreviations of organization names, and English abbreviations of organization names; when the match is successful, the target detection result is determined to be a non-malicious domain name.

[0011] In an embodiment of the present application, when the preset detection strategy is a vocabulary combination detection strategy, based on the preset detection strategy, a target detection result of the domain name to be detected is determined according to the word segmentation result, including: matching the word segmentation result with a pre-built vocabulary library, the vocabulary library includes an English vocabulary library corresponding to an English dictionary and a Pinyin vocabulary library corresponding to a Pinyin dictionary; when the match is successful, the target detection result is determined to be a non-malicious domain name.

[0012] In an embodiment of the present application, when the preset detection strategy is a semantic association detection strategy and the number of segmented words in the segmentation result is multiple, based on the preset detection strategy, the target detection result of the domain name to be detected is determined according to the segmentation result, including: judging whether there is a semantic association between multiple segmented words in the segmentation result; when there is a semantic association between multiple segmented words, determining that the target detection result is a non-malicious domain name; when there is no semantic association between multiple segmented words, determining that the target detection result is a malicious domain name.

[0013] In an embodiment of the present application, based on a preset detection strategy, a target detection result of the domain name to be detected is determined according to the word segmentation result, including: constructing a reasoning thinking chain according to a well-known word detection strategy, a vocabulary combination form detection strategy and a semantic association detection strategy; according to the word segmentation result, the target detection result of the domain name to be detected is determined through the reasoning thinking chain.

[0014] In an embodiment of the present application, a domain name to be detected is segmented to obtain a segmentation result corresponding to the domain name to be detected, including: extracting a second-level domain name of the domain name to be detected; performing segmentation on the second-level domain name by forward maximum-length greedy matching to obtain a first segmentation result; performing segmentation on the second-level domain name by reverse maximum-length greedy matching to obtain a second segmentation result; and determining the smaller one of the first segmentation result and the second segmentation result in terms of the number of segmentations as the segmentation result of the domain name to be detected.

[0015] In an embodiment of the present application, construction of a dictionary-type malicious domain name detection model includes: obtaining a dictionary-type malicious domain name dataset and a dictionary-type benign domain name dataset; annotating the data in the dictionary-type malicious domain name dataset and the dictionary-type benign domain name dataset, respectively, and processing the data according to the input format of a preset base large model to obtain training data; fine-tuning the preset base large model according to the training data to obtain a dictionary-type malicious domain name detection model.

[0016] A second aspect of an embodiment of the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the above-mentioned method for detecting malicious domain names when executing the computer program.

[0017] A third aspect of an embodiment of the present application provides a machine-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the above-mentioned method for detecting malicious domain names is implemented.

[0018] A fourth aspect of an embodiment of the present application provides a computer program product, including a computer program, which implements the above-mentioned method for detecting malicious domain names when executed by a processor.

[0019] The above technical solution obtains the domain name to be detected, and then determines the initial detection result of the domain name to be detected based on the pre-built dictionary-type malicious domain name detection model. Then, when the initial detection result is a malicious domain name, the domain name to be detected is segmented to obtain the segmentation result corresponding to the domain name to be detected. Finally, based on the preset detection strategy, the target detection result of the domain name to be detected is determined according to the segmentation result. The present application can detect dictionary-type DGA malicious domain names through the dictionary-type malicious domain name detection model, and perform secondary detection in combination with the preset detection strategy, which is conducive to improving the accuracy of the detection results.

[0020] Other features and advantages of the embodiments of the present application will be described in detail in the subsequent specific implementation section. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the following specific implementations, they are used to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the accompanying drawings:

[0022] Figure 1 A flowchart of a method for detecting malicious domain names provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation methods described herein are only used to illustrate and explain the embodiments of the present application, and are not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0024] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative position relationship, movement status, etc. between the components under a certain specific posture (as shown in the accompanying drawings). If the specific posture changes, the directional indication will also change accordingly.

[0025] In addition, if there are descriptions involving "first", "second", etc. in the embodiments of the present application, the descriptions of "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0026] Figure 1 A flowchart of a method for detecting malicious domain names provided in an embodiment of the present application is shown below. Figure 1 As shown, an embodiment of the present application provides a method for detecting malicious domain names, which is described by taking the method applied to a processor as an example. The method may include the following steps.

[0027] Step S101, obtaining the domain name to be detected.

[0028] Step S102, based on the pre-built dictionary malicious domain name detection model, determine the initial detection result of the domain name to be detected.

[0029] Step S103, when the initial detection result is a non-malicious domain name, the domain name to be detected is segmented to obtain a segmentation result corresponding to the domain name to be detected.

[0030] Step S104: Based on a preset detection strategy, a target detection result of the domain name to be detected is determined according to the word segmentation result.

[0031] Specifically, the domain name to be detected can be obtained through user input, network request or other methods. Furthermore, the domain name to be detected is input into a pre-built dictionary-type malicious domain name detection model, and the domain name to be detected is preliminarily judged by the dictionary-type malicious domain name detection model to output an initial detection result, which may be a malicious domain name or a benign domain name. In one example, the dictionary-type malicious domain name detection model can be constructed based on the features of known malicious domain names, such as specific words or character combinations that make up malicious domain names, so that a preliminary result of whether the domain name is malicious can be quickly given. In another example, the dictionary-type malicious domain name detection model can be constructed based on a base large model, and the base large model is trained with a collected training data set to obtain the dictionary-type malicious domain name detection model. The training data set may include a malicious domain name data set, and the malicious domain name data set includes typical dictionary-type malicious domain names. The above data can be obtained through open source channels.

[0032] Furthermore, since dictionary malicious domain names are similar to normal domain names, in order to prevent misjudgment, when the initial detection result indicates that the domain name to be detected is a non-malicious domain name, the domain name to be detected can be segmented and decomposed into smaller units (such as words or letter combinations) to analyze the composition of the domain name in more detail and obtain the segmentation result of the domain name to be detected. Then, according to the preset detection strategy, the domain name is analyzed more deeply in combination with the segmentation result to finally determine whether the domain name to be detected is a malicious domain name and obtain the target detection result of the domain name to be detected. In one example, the preset detection strategy may include weight allocation of segmentation results, sensitivity analysis of specific vocabulary, rationality check of domain name structure, etc.

[0033] In this way, through the three steps of preliminary detection, word segmentation processing and in-depth analysis, the detection scope is gradually narrowed and the detection accuracy is improved, thereby effectively identifying malicious domain names. This method combines the advantages of dictionary matching and semantic analysis to improve the efficiency and accuracy of malicious domain name detection.

[0034] The above technical solution obtains the domain name to be detected, and then determines the initial detection result of the domain name to be detected based on the pre-built dictionary-type malicious domain name detection model, and then, when the initial detection result is a non-malicious domain name, performs word segmentation processing on the domain name to be detected to obtain the word segmentation result corresponding to the domain name to be detected, and finally determines the target detection result of the domain name to be detected based on the word segmentation result based on the preset detection strategy. The present application can detect dictionary-type DGA malicious domain names through the dictionary-type malicious domain name detection model, and perform secondary detection in combination with the preset detection strategy, which is conducive to improving the accuracy of the detection results.

[0035] In an embodiment of the present application, performing word segmentation processing on a domain name to be detected to obtain a word segmentation result corresponding to the domain name to be detected may include: extracting a second-level domain name of the domain name to be detected; performing word segmentation processing on the second-level domain name by forward maximum-length greedy matching to obtain a first word segmentation result; performing word segmentation processing on the second-level domain name by reverse maximum-length greedy matching to obtain a second word segmentation result; and determining the smaller of the first word segmentation result and the second word segmentation result as the word segmentation result of the domain name to be detected.

[0036] It can be understood that in order to accurately segment the domain name to be detected, the embodiment of the present application adopts a method combining forward maximum length greedy matching and reverse maximum length greedy matching. Specifically, the second-level domain name part is extracted from the domain name to be detected. The second-level domain name is usually located before the top-level domain name and immediately after the main domain name. It can be an important part of the website and is used to represent the specific content or function of the website. Then, the extracted second-level domain name is segmented using the forward maximum length greedy matching algorithm. The algorithm starts from the first character of the second-level domain name and tries to match the longest vocabulary until no longer vocabulary can be matched. Then, the algorithm continues to perform the next match from the beginning of the remaining characters until the entire second-level domain name is segmented to obtain the first segmentation result. Similarly, the reverse maximum length greedy matching algorithm starts from the last character of the second-level domain name and performs vocabulary matching in reverse to obtain the second segmentation result.

[0037] Furthermore, considering that in most cases, the result with fewer segmented words is more likely to retain the integrity of the vocabulary and the coherence of the semantics, in order to balance the accuracy and stability of the segmented word results, the result with fewer segmented words in the first segmented word result and the second segmented word result is selected as the final output, thereby reducing the possibility of segmentation errors.

[0038] In this way, by combining the forward maximum length greedy matching method and the reverse maximum length greedy matching method, accurate word segmentation processing can be performed on the domain name to be detected, and a stable and reliable word segmentation result can be obtained, which provides strong support for subsequent detection and analysis work.

[0039] In the embodiment of the present application, the preset detection strategy may include at least one of a well-known word detection strategy, a vocabulary combination form detection strategy, and a semantic association detection strategy.

[0040] Specifically, the embodiments of the present application provide multiple preset detection strategies, including a well-known word detection strategy, a vocabulary combination detection strategy, and a semantic association detection strategy. When performing secondary detection on the domain name to be detected, one of the above strategies can be used for detection, or multiple detection strategies can be combined for detection to improve the accuracy of the detection results.

[0041] Among them, the known word detection strategy can be detected based on a pre-built known word database. In one example, the known word database may include words and characters commonly used in malicious domain names. These words and character combinations are usually closely related to malicious behavior, such as "phishing" (phishing), "malware" (malware), etc. In this way, by judging whether there are words or characters in the known word database in the domain name to be detected, it is possible to further detect whether the domain name is a malicious domain name. In another example, the known word database may include well-known words such as trademarks, English names of organizations, pinyin names of organizations, pinyin abbreviations of organization names, and English abbreviations of organization names. In this way, secondary detection based on the known word database can prevent misjudgment. It can be understood that the specific data type in the known word database can be determined according to the detection requirements.

[0042] It can be understood that the vocabulary combination form detection strategy focuses on the combination mode and structural characteristics of words in the domain name. In one example, considering that malicious domain names often use specific vocabulary combinations to confuse or bypass security detection, it is possible to analyze the vocabulary combination forms of known malicious domain names, such as the connection mode between words, the use of special characters, etc., and build corresponding detection rules or models based on the analysis results. In the detection process, these rules or models are applied to evaluate whether the vocabulary combination form of the domain name to be detected is suspicious. In another example, for dictionary-type malicious domain names, since the vocabulary combination form of the dictionary DGA domain name is different from the combination form of English words or Chinese pinyin, it is usually impossible to completely match the existing English vocabulary or pinyin. Therefore, it is possible to determine whether the domain name to be detected is a malicious domain name by judging the vocabulary combination form of English in the vocabulary combination of the domain name to be detected.

[0043] It can be understood that the semantic association detection strategy uses natural language processing technology to analyze the semantic association between the words in the group of tested domain names. Since the dictionary-type malicious domain names in the malicious domain names are randomly spliced ​​by dictionary words, there is no semantic association between the word segments. Therefore, it is possible to determine whether the domain name to be tested is a malicious domain name by detecting whether there is a semantic association between the word segments in the word segmentation results of the domain name to be tested.

[0044] In this way, performing secondary testing through the above-mentioned predictive detection strategy can further improve the accuracy of the test results.

[0045] In an embodiment of the present application, when the preset detection strategy is a well-known word detection strategy, based on the preset detection strategy, determining the target detection result of the domain name to be detected according to the word segmentation result can include: matching the word segmentation result with data in a pre-constructed well-known word database, wherein the well-known word database includes trademarks, English names of organizations, pinyin names of organizations, pinyin abbreviations of organization names, and English abbreviations of organization names; when the match is successful, determining that the target detection result is a non-malicious domain name.

[0046] Specifically, the public word database may include trademarks, English names of institutions, pinyin of institution names, pinyin abbreviations of institution names, and public words for the abbreviations of institution names in English. When the preset detection strategy is set to the public word detection strategy, the word segmentation result of the domain name to be detected can be matched with the data in the pre-built public word database, and the target detection result of the domain name to be detected is determined according to the matching result. In one example, if a certain word or character combination in the word segmentation result completely matches an entry in the database, it is considered to be a successful match. In this case, the processor tends to believe that the domain name to be detected is related to a legitimate institution or brand, and therefore determines its target detection result as a non-malicious domain name. In another example, if the word or character combination in the word segmentation result does not match any entry in the database, it is considered to be a failed match. In this case, the processor can directly determine that the target detection result of the domain name to be detected is a malicious domain name, or can further apply other detection strategies, such as a word combination form detection strategy or a semantic association detection strategy, to further judge.

[0047] It is understandable that the publicly known term database can be updated according to a set period to ensure that it contains the latest information such as trademarks, organization names, etc.

[0048] In this way, by applying the well-known word detection strategy and combining it with the pre-built well-known word database, the system can effectively screen out domain names related to legitimate organizations or brands, and determine their target detection results as non-malicious domain names to improve the accuracy of the detection results.

[0049] In an embodiment of the present application, when the preset detection strategy is a vocabulary combination detection strategy, based on the preset detection strategy, determining the target detection result of the domain name to be detected according to the word segmentation result may include: matching the word segmentation result with a pre-constructed vocabulary library, the vocabulary library including an English vocabulary library corresponding to an English dictionary and a Pinyin vocabulary library corresponding to a Pinyin dictionary; when the match is successful, determining that the target detection result is a non-malicious domain name.

[0050] Specifically, when the preset detection strategy is selected as a vocabulary combination form detection strategy, the word segmentation result can be matched with a pre-built vocabulary library, which contains an English vocabulary library corresponding to an English dictionary and a Pinyin vocabulary library corresponding to a Pinyin dictionary, that is, widely recognized and standardized English vocabulary and Pinyin vocabulary, and then the target detection result of the domain name to be detected is determined according to the matching result. In one example, if a certain vocabulary or character combination in the word segmentation result completely matches an entry in the vocabulary library, or satisfies the preset matching rules, such as partial matching, fuzzy matching, etc., it is considered to be a successful match; in this case, the processor tends to believe that the vocabulary combination of the domain name to be detected is standardized and common, so its target detection result is determined as a non-malicious domain name. In another example, if the vocabulary or character combination in the word segmentation result does not match any entry in the vocabulary library, or the matching degree is lower than the preset matching rule, it is considered to be a match failure; in this case, the processor can directly determine that the target detection result of the domain name to be detected is a malicious domain name, or can further apply other detection strategies, such as vocabulary combination form detection strategy or semantic association detection strategy, for further judgment.

[0051] In this way, by applying the word combination detection strategy and combining it with the pre-built word library, it is possible to effectively evaluate whether the word combination of the domain name to be detected is standardized and common, so as to preliminarily determine whether it is a non-malicious domain name.

[0052] In an embodiment of the present application, when the preset detection strategy is a semantic association detection strategy and the number of segmented words in the segmentation result is multiple, based on the preset detection strategy, determining the target detection result of the domain name to be detected according to the segmentation result, may include: judging whether there is a semantic association between multiple segmented words in the segmentation result; when there is a semantic association between multiple segmented words, determining that the target detection result is a non-malicious domain name; when there is no semantic association between multiple segmented words, determining that the target detection result is a malicious domain name.

[0053] Specifically, when the preset detection strategy is selected as a semantic association detection strategy, and the word segmentation result of the domain name to be detected contains multiple word segmentations, the processor can analyze whether there is a semantic association between these word segmentations, and then determine the target detection result of the domain name to be detected based on the judgment result of the semantic association. In one example, a common sense knowledge base can be used to check whether there is a known association or relationship between the word segmentations, and natural language processing technology, machine learning algorithms, or rule-based methods can be used to analyze the semantic association between words. If there is a significant semantic association between multiple word segmentations in the word segmentation results, the system tends to believe that the domain name to be detected has a reasonable semantic structure, and therefore determines its target detection result as a non-malicious domain name. If there is a lack of obvious semantic association between the words in the word segmentation results, or the sentences or phrases formed appear unreasonable or confusing in the context, the system may believe that the domain name to be detected has potential malicious behavior, and therefore determines its target detection result as a malicious domain name.

[0054] In this way, by applying the semantic association detection strategy and combining the lexical association analysis in the word segmentation results, the system can effectively evaluate the semantic rationality of the domain name to be detected, and further determine whether it is a non-malicious domain name or a malicious domain name.

[0055] In an embodiment of the present application, based on a preset detection strategy, determining a target detection result of the domain name to be detected according to the word segmentation result may include: constructing a reasoning thinking chain according to a well-known word detection strategy, a vocabulary combination form detection strategy and a semantic association detection strategy; and determining the target detection result of the domain name to be detected through the reasoning thinking chain according to the word segmentation result.

[0056] It can be understood that the embodiment of the present application can use the base large model to implement the above-mentioned malicious domain name detection method. In order to more comprehensively determine the target detection result of the domain name to be detected, a variety of detection strategies can be combined, such as the well-known word detection strategy, the vocabulary combination form detection strategy and the semantic association detection strategy, to build a reasoning thinking chain in the base large model, and determine the target detection result of the domain name to be detected through the reasoning thinking chain according to the word segmentation result. Combining the above three strategies, a reasoning thinking chain is constructed, which contains a series of logical judgment steps for gradually analyzing the word segmentation results of the domain name to be detected. For example, first, the word segmentation results are detected using the well-known word detection strategy to determine whether the domain name to be detected belongs to the well-known words. If so, the target detection result is determined to be a non-malicious domain name. If not, then the word segmentation results are analyzed in combination form using the vocabulary combination form detection strategy to check whether they follow common grammar and collocation rules. If not, the target detection result is determined to be a malicious domain name. If they are consistent, the semantic connection between the words in the word segmentation results is further evaluated through the semantic association detection strategy to determine whether there is a semantic association between the word segmentations. If so, the target detection result is determined to be a malicious domain name, otherwise, the target detection result is determined to be a malicious domain name.

[0057] In this way, by integrating multiple detection strategies and building a chain of reasoning, we can more comprehensively analyze the segmentation results of the domain name to be detected and determine its target detection results accordingly. This method helps to improve the accuracy and reliability of detection and provide more powerful support for the field of network security.

[0058] In an embodiment of the present application, construction of a dictionary-type malicious domain name detection model may include: obtaining a dictionary-type malicious domain name dataset and a dictionary-type benign domain name dataset; annotating the data in the dictionary-type malicious domain name dataset and the dictionary-type benign domain name dataset, respectively, and processing the data according to the input format of a preset base large model to obtain training data; and fine-tuning the preset base large model according to the training data to obtain a dictionary-type malicious domain name detection model.

[0059] Specifically, the dictionary malicious domain name dataset contains domain names that are known or suspected to be malicious. These domain names usually have certain dictionary features and are DGA domain name types generated by random splicing of dictionary words, random splicing of prefixes and suffixes, random splicing of pinyin, etc. They are usually completely irrelevant or even a combination of made-up words. The dictionary benign domain name dataset contains domain names composed of dictionary words, which usually have certain semantic logic. Furthermore, for each domain name, it is necessary to label it to clarify whether it is a malicious domain name or a benign domain name. At the same time, in order to meet the input requirements of the preset base model, the data needs to be formatted and preprocessed, including converting the domain name into a specific encoding format, removing unnecessary characters, adjusting the size and shape of the data, etc., to obtain training data.

[0060] Further, a base large model is selected. The preset base large model is a pre-trained model with strong representation capabilities, such as BERT, GPT, etc. These models are usually trained on large-scale corpora and can capture the complex characteristics of language. The preset base large model is fine-tuned using the training data, that is, the dictionary malicious domain name dataset and benign domain name dataset that have been annotated and processed. Fine-tuning is achieved by further training the model on the malicious domain name detection task so that it can identify and distinguish malicious domain names from benign domain names. During the fine-tuning process, it is necessary to continuously evaluate the performance of the model and optimize the model based on the evaluation results to finally obtain a dictionary malicious domain name detection model.

[0061] In this way, by fine-tuning the preset base model with dictionary-type malicious domain name datasets and dictionary-type benign domain name datasets, a dictionary-type malicious domain name detection model with excellent performance can be constructed, which can effectively identify dictionary-type malicious domain names.

[0062] In a specific embodiment of the present application, considering that the only difference between dictionary-type DGA domain names and normal domain names in DGA malicious domain names is the difference in character combinations, the character combinations of normal domain names usually have certain semantic logic in order to make users memorable and recognizable, and are generally word combinations. However, dictionary-type DGA domain names are completely irrelevant or even combinations of made-up words, and have no semantic and logical coherence at all. In this regard, a specific embodiment of the present application proposes a dictionary-type DGA domain name detection method based on semantic resolution of a large language model, which is mainly used to detect DGA malicious domain names based on dictionary combinations, including domain names with random word splicing (e.g., apple-road.net), domain names with random English prefixes and suffixes (e.g., multinefeness-misuropance.name), domain names with random pinyin splicing (e.g., chang-ken.com), and other forms of DGA malicious domain names for detection. This type of DGA malicious domain name is extremely similar to the domain name described by normal words or pinyin, and cannot be solved by existing artificial intelligence technologies such as machine learning and deep learning, and the use of blacklists, threat intelligence, and other means is lagging. In this specific embodiment, the dictionary type DGA domain name detection method based on large language model semantic resolution may include the following steps.

[0063] Step 1: Select the large base model for the current task.

[0064] The base model refers to a pre-trained model with large-scale parameters. This model has powerful natural language processing capabilities by pre-training on massive text training data. This type of model is usually incapable of training by individuals or small-scale organizations. It can usually be fine-tuned based on the open source base model to meet the unique needs of some scenarios. The base model selected in this application should perform well in both Chinese and English processing capabilities.

[0065] Step 2: Select appropriate domain training data.

[0066] Specifically, domain name training data may include dictionary type DGA domain name data and domain names in normal domain names that may be formed by word splicing. The training data is divided into multiple sets, including: set A corresponding to dictionary type DGA malicious domain names, set B1 corresponding to domain names composed of word splicing in the public Alexa 1 million domain names, set B2 corresponding to Chinese vocabulary pinyin domain names, and set B3 corresponding to words containing prefixes and suffixes commonly found in English articles. Typical dictionary type DGA malicious domain name training set, marked as training domain name set A, for example: ilecixance-antibafuxant.net, lookhurt.com, threetold.org, awardsbookcasio.net, etc. Select the Alexa 1 million domain name set, and screen the domain names that obviously use recognizable word splicing as the normal domain name training set, marked as training domain name set B1. Only select secondary domain names, for example: facebook, microsoft, linkedin, steamcommunity, stackoverflow, etc. Select a certain number of commonly used Chinese words, such as the first 20,000 commonly used Chinese words, which can be sourced from authoritative materials such as modern Chinese dictionaries, and convert them into pinyin form as training domain name set B2. For example: wen-ming, he-xie, zhi-dao, hui-huang, etc. Select a certain number of English articles, extract common prefixes, suffixes, and common words including hyphens '-', such as anti-war, two-thirds, counter-strike, etc., as training set B3.

[0067] Step 3: Fine-tune the large model.

[0068] The SFT (Supervised fine-tuning) method is used to fine-tune the large model selected in step 1. The model learns the natural language features and intrinsic reasoning logic of the data by training on labeled data.

[0069] Sub-step 3.1: Preprocess the training data and organize it into the format required for fine-tuning the model.

[0070] Sub-step 3.2: For the training data generated in sub-step 3.1, select the large model supervised fine-tuning method to perform large model fine-tuning training, divide the training data into training data set, validation data set, and test data set, select the model loading method, and set the training parameters. Check the training loss value during the training process until it meets the design requirements or reaches the maximum number of training steps. At the same time, you can observe the output results of the validation data set during the training process. If the output meets expectations, you can also stop training in advance. After stopping training, load the low-rank adapter parameter file generated by the model and test whether the training model meets the requirements on the test set.

[0071] Step 4: Perform word segmentation on the domain name to be detected.

[0072] The forward and reverse maximum length greedy matching methods are used to segment the domain name to be tested, and the prefix, suffix, and the longest correct word or pinyin that can be matched are correctly searched for the domain name string. Two traversal matches are performed in the forward and reverse directions (i.e., from the beginning to the end of the string and from the end to the beginning of the string), and the one with the least number of segmented words is taken as the final segmentation result. Among them, the word type can be matched with the word list in the regular English dictionary, the prefix and suffix can be matched with the English prefix and suffix, and the pinyin can be matched with the standard Chinese pinyin.

[0073] Example: For the domain name steamcommunity.com, the second-level domain name is steamcommunity. The possible word segmentations are [steam, comm, unity] and [steam, community], and the result with the least number is [steam, community].

[0074] Step 5: Construct a suitable prompt reasoning chain.

[0075] In order to improve the accuracy of large model detection and reduce the false alarm rate, a prompt chain of thought is constructed to enhance the ability of the large model after training and fine-tuning to recognize dictionary type DGA domain names. The example domain name is recorded as "domain".

[0076] Sub-step 5.1: Construct prompt1: "Does the domain belong to a known company logo, trademark, idiom, English or phonetic abbreviation of a company or government agency, initials, etc." If the big model answers "yes", the process ends and it is determined to be a non-dictionary type DGA malicious domain name. If the big model answers "no", go to sub-step 5.2;

[0077] Sub-step 5.2: Construct prompt2: "Does the word segmented by domain conform to the combination of English words or Chinese pinyin?" If the big model answers "no", the process ends and it is determined to be a dictionary type DGA malicious domain name. If the big model answers "yes", go to sub-step 5.3;

[0078] Sub-step 5.3: Construct prompt3: "Are there semantic associations between the words in the domain segmentation?" If the big model answers "yes", the process ends and it is determined to be a non-dictionary type DGA malicious domain name. If the big model answers "no", it is determined to be a dictionary type DGA domain name.

[0079] Sub-step 5.4: For DGA malicious domain names that are determined by the big model to be dictionary type, manual analysis can be performed based on the description of the "reason" field output by the big model. For those that are determined to be recognized incorrectly by the big model after manual analysis, step 2 can be re-entered to add the erroneous output data to the training data set for correction.

[0080] In this way, using the base large model to detect malicious domain names of dictionary or pinyin splicing type can effectively deal with this type of malicious DGA domain names.

[0081] An embodiment of the present application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the method for detecting malicious domain names in the above embodiment when executing the computer program.

[0082] An embodiment of the present application also provides a machine-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the method for detecting malicious domain names in the above-mentioned embodiment is implemented.

[0083] The present application also provides a computer program product, including a computer program, which implements the method for detecting malicious domain names in the above-mentioned embodiment when executed by a processor. It should be understood by those skilled in the art that the embodiments of the present application can be provided as methods, systems or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0084] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0085] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0086] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0087] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0088] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0089] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0090] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0091] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for detecting malicious domain names, characterized in that: The method comprises: Get the domain name to be tested; Determine the initial detection result of the domain name to be detected based on the pre-built dictionary malicious domain name detection model; In the case where the initial detection result is a non-malicious domain name, performing word segmentation processing on the domain name to be detected to obtain a word segmentation result corresponding to the domain name to be detected; Based on a preset detection strategy, a target detection result of the domain name to be detected is determined according to the word segmentation result.

2. The method according to claim 1, characterized in that The preset detection strategy includes at least one of a known word detection strategy, a vocabulary combination form detection strategy and a semantic association detection strategy.

3. The method according to claim 1, characterized in that In the case where the preset detection strategy is the well-known word detection strategy, the step of determining the target detection result of the domain name to be detected based on the preset detection strategy and the word segmentation result includes: Matching the word segmentation result with data in a pre-constructed database of known words, wherein the database of known words includes trademarks, English names of organizations, Pinyin names of organizations, Pinyin abbreviations of organization names, and English abbreviations of organization names; In the event of a successful match, the target detection result is determined to be a non-malicious domain name.

4. The method according to claim 2, characterized in that: In the case where the preset detection strategy is the vocabulary combination form detection strategy, the step of determining the target detection result of the domain name to be detected based on the preset detection strategy and the word segmentation result includes: Matching the word segmentation result with a pre-built word library, the word library includes an English word library corresponding to an English dictionary and a Pinyin word library corresponding to a Pinyin dictionary; In the event of a successful match, the target detection result is determined to be a non-malicious domain name.

5. The method according to claim 2, characterized in that: In the case where the preset detection strategy is the semantic association detection strategy and the word segmentation result has a plurality of word segments, the step of determining the target detection result of the domain name to be detected based on the word segmentation result based on the preset detection strategy includes: Determine whether there is a semantic association between multiple segmented words in the segmented word result; In the case where there is a semantic association between the multiple participles, determining that the target detection result is a non-malicious domain name; When there is no semantic association between the multiple word segments, the target detection result is determined to be a malicious domain name.

6. The method according to claim 2, characterized in that The step of determining the target detection result of the domain name to be detected based on the preset detection strategy and the word segmentation result includes: Constructing a reasoning thinking chain according to the well-known word detection strategy, the vocabulary combination form detection strategy and the semantic association detection strategy; According to the word segmentation result, the target detection result of the domain name to be detected is determined through the reasoning chain.

7. The method according to claim 1, characterized in that The performing word segmentation processing on the domain name to be detected to obtain a word segmentation result corresponding to the domain name to be detected includes: Extracting the secondary domain name of the domain name to be detected; Performing word segmentation processing on the second-level domain name through forward maximum-length greedy matching to obtain a first word segmentation result; Performing word segmentation processing on the secondary domain name through reverse maximum length greedy matching to obtain a second word segmentation result; The one with the smaller number of segmented words between the first segmented result and the second segmented result is determined as the segmented result of the domain name to be detected.

8. The method according to claim 1, characterized in that The construction of the dictionary malicious domain name detection model includes: Obtain dictionary-type malicious domain name datasets and dictionary-type benign domain name datasets; Respectively labeling the data in the dictionary-type malicious domain name data set and the dictionary-type benign domain name data set, and processing the data according to the input format of the preset base large model to obtain training data; The preset base large model is fine-tuned according to the training data to obtain the dictionary-type malicious domain name detection model.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the method for detecting a malicious domain name according to any one of claims 1 to 8 is implemented.

10. A machine-readable storage medium storing a program or an instruction, characterized in that: When the program or the instruction is executed by a processor, the method for detecting malicious domain names according to any one of claims 1 to 8 is implemented.

11. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the computer program implements the method for detecting malicious domain names according to any one of claims 1 to 8.

Images