Method, computer device, program product and medium for detecting malicious domain names

Abstract

The application discloses a method, computer equipment, program product and medium for detecting malicious domain names, and belongs to the technical field of network security. The method comprises the following steps: obtaining a domain name to be detected; determining an initial detection result of the domain name to be detected based on a pre-constructed dictionary type malicious domain name detection model; performing word segmentation processing on the domain name to be detected to obtain a word segmentation result corresponding to the domain name to be detected in the case that the initial detection result is a non-malicious domain name; and determining a target detection result of the domain name to be detected according to the word segmentation result based on a preset detection strategy. The application can realize the detection of dictionary type DGA malicious domain names through the dictionary type malicious domain name detection model, and can perform secondary detection in combination with the preset detection strategy, so that the accuracy of the detection result is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a method for detecting malicious domain names, a computer device, a program product and a medium. BACKGROUND

[0002] Domain Generation Algorithm (DDGA) is an algorithm for generating domain names using random characters and time, dictionary, hard coding, etc. The DGA algorithm is usually embedded in malware, and uses the algorithm to generate variable malicious domain names. Network attackers and botnets will use DGA algorithms to frequently change the domain names used, and only a small part of the large number of domain names registered in the domain name server are used for attack activities. These massive malicious domain names generated by algorithms and constantly updated bring great difficulty to malicious domain name detection. In addition, attackers generate new DGA domain name types by randomly splicing dictionary words, randomly splicing prefixes and suffixes, and randomly splicing pinyin, in order to counter existing detection methods. However, the traditional malicious domain name detection method cannot achieve good detection effect on these types of DGA domain names. Therefore, the existing malicious domain name detection method has the problem of low accuracy. SUMMARY

[0003] The purpose of the embodiments of the present application is to provide a method for detecting malicious domain names, a computer device, a computer program product and a machine readable storage medium, to solve the problem of low accuracy of the existing malicious domain name detection method.

[0004] In order to achieve the above-mentioned purpose, the first aspect of the embodiments of the present application provides a method for detecting malicious domain names, which comprises:

[0005] obtaining a domain name to be detected;

[0006] determining an initial detection result of the domain name to be detected based on a pre-constructed dictionary type malicious domain name detection model;

[0007] in the case of the initial detection result being a non-malicious domain name, performing word segmentation processing on the domain name to be detected to obtain a word segmentation result corresponding to the domain name to be detected;

[0008] determining a target detection result of the domain name to be detected based on a preset detection strategy according to the word segmentation result.

[0009] In the embodiments of the present application, the preset detection strategy includes at least one of a public word detection strategy, a word combination form detection strategy and a semantic association detection strategy.

[0010] In the embodiment of the present application, in the case that the preset detection strategy is the public word detection strategy, the target detection result of the domain name to be detected is determined according to the word segmentation result based on the preset detection strategy, including: matching the word segmentation result with data in a pre-constructed public word database, wherein the public word database includes trademarks, English names of institutions, pinyin names of institutions, pinyin abbreviations of names of institutions, and English abbreviations of names of institutions; in the case that the matching is successful, determining that the target detection result is a non-malicious domain name.

[0011] In the embodiment of the present application, in the case that the preset detection strategy is the word combination form detection strategy, the target detection result of the domain name to be detected is determined according to the word segmentation result based on the preset detection strategy, including: matching the word segmentation result with a pre-constructed word library, wherein the word library includes an English word library corresponding to an English dictionary and a pinyin word library corresponding to a pinyin dictionary; in the case that the matching is successful, determining that the target detection result is a non-malicious domain name.

[0012] In the embodiment of the present application, in the case that the preset detection strategy is the semantic association detection strategy and the number of word segmentation in the word segmentation result is multiple, the target detection result of the domain name to be detected is determined according to the word segmentation result based on the preset detection strategy, including: judging whether there is semantic association between the multiple word segmentation in the word segmentation result; in the case that there is semantic association between the multiple word segmentation, determining that the target detection result is a non-malicious domain name; in the case that there is no semantic association between the multiple word segmentation, determining that the target detection result is a malicious domain name.

[0013] In the embodiment of the present application, the target detection result of the domain name to be detected is determined according to the word segmentation result based on the preset detection strategy, including: constructing a reasoning thinking chain according to the public word detection strategy, the word combination form detection strategy and the semantic association detection strategy; determining the target detection result of the domain name to be detected through the reasoning thinking chain according to the word segmentation result.

[0014] In the embodiment of the present application, the domain name to be detected is subjected to word segmentation processing to obtain a word segmentation result corresponding to the domain name to be detected, including: extracting a second-level domain name of the domain name to be detected; performing word segmentation processing on the second-level domain name through forward maximum length greedy matching to obtain a first word segmentation result; performing word segmentation processing on the second-level domain name through reverse maximum length greedy matching to obtain a second word segmentation result; determining the smaller one of the number of word segmentation in the first word segmentation result and the second word segmentation result as the word segmentation result of the domain name to be detected.

[0015] In the embodiment of the present application, the construction of the dictionary type malicious domain name detection model comprises: obtaining a dictionary type malicious domain name data set and a dictionary type benign domain name data set; labeling the data in the dictionary type malicious domain name data set and the dictionary type benign domain name data set respectively, and processing the data according to the input format of the preset base large model to obtain training data; and fine-tuning the preset base large model according to the training data to obtain the dictionary type malicious domain name detection model.

[0016] The second aspect of the embodiment of the present application provides a computer device comprising a memory and a processor, the memory stores a computer program, and the processor implements the method for detecting malicious domain names described above when executing the computer program.

[0017] The third aspect of the embodiment of the present application provides a machine readable storage medium, the machine readable storage medium stores programs or instructions, and the programs or instructions are executed by the processor to implement the method for detecting malicious domain names described above.

[0018] The fourth aspect of the embodiment of the present application provides a computer program product comprising a computer program, and the computer program is executed by the processor to implement the method for detecting malicious domain names described above.

[0019] The above technical solution, by obtaining a domain name to be detected, then determining the initial detection result of the domain name to be detected based on the pre-constructed dictionary type malicious domain name detection model, then performing word segmentation processing on the domain name to be detected in the case that the initial detection result is a malicious domain name to obtain the word segmentation result corresponding to the domain name to be detected, and finally determining the target detection result of the domain name to be detected based on the preset detection strategy according to the word segmentation result. The present application can detect the dictionary type DGA malicious domain name through the dictionary type malicious domain name detection model, and perform secondary detection combined with the preset detection strategy, which is conducive to improving the accuracy of the detection result.

[0020] Other features and advantages of the embodiments of the present application will be described in detail in the following specific implementation part. BRIEF DESCRIPTION OF DRAWINGS

[0021] The accompanying drawings are included to provide a further understanding of the embodiments of the present application, and constitute a part of the specification, and are used together with the following specific implementation to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the drawings:

[0022] Figure 1 A flowchart of a method for detecting malicious domain names provided by the embodiments of the present application is shown. DETAILED DESCRIPTION

[0023] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. It should be understood that the specific implementation described herein is only used to explain and illustrate the embodiments of the present application, and is not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0024] It should be noted that if the embodiments of the present application involve directional indications (such as up, down, left, right, front, back, etc.), the directional indications are only used to explain the relative positional relationship, motion condition, etc. between components in a certain posture (as shown in the drawings), and if the certain posture changes, the directional indications also change accordingly.

[0025] In addition, if the embodiments of the present application involve descriptions such as "first", "second", etc., the descriptions of "first", "second", etc. are only for description purposes, and cannot be understood as indicating or implying the relative importance of the indicated technical features or implicitly indicating the number of the indicated technical features. Therefore, the features limited by "first", "second" can explicitly or implicitly include at least one of the features. In addition, the technical solutions of each embodiment can be combined with each other, but it must be based on the fact that a person of ordinary skill in the art can realize it, and when the combination of technical solutions contradicts each other or cannot be realized, it should be considered that the combination of technical solutions does not exist, and is also not within the scope of protection claimed by the present application.

[0026] Figure 1 A flowchart of a method for detecting malicious domain names provided by the embodiments of the present application is shown. As shown in Figure 1 The method for detecting malicious domain names provided by the embodiments of the present application is described by taking a processor as an example. The method can include the following steps.

[0027] Step S101, obtaining a domain name to be detected.

[0028] Step S102, determining an initial detection result of the domain name to be detected based on a pre-constructed dictionary-based malicious domain name detection model.

[0029] Step S103, in the case that the initial detection result is a non-malicious domain name, performing a word segmentation processing on the domain name to be detected to obtain a word segmentation result corresponding to the domain name to be detected.

[0030] Step S104, determining a target detection result of the domain name to be detected based on a preset detection strategy according to the word segmentation result.

[0031] Specifically, the domain name to be detected can be obtained through user input, network request or other means. Further, the domain name to be detected is input into a pre-constructed dictionary-based malicious domain name detection model, and the domain name to be detected is preliminarily judged by the dictionary-based malicious domain name detection model to output an initial detection result, which can be a malicious domain name or a benign domain name. In one example, the dictionary-based malicious domain name detection model can be constructed based on the characteristics of known malicious domain names, such as specific words or character combinations that make up malicious domain names, etc., so that a preliminary result of whether the domain name is malicious can be quickly given. In another example, the dictionary-based malicious domain name detection model can be constructed based on a base large model, and the base large model is trained by a collected training data set to obtain the dictionary-based malicious domain name detection model. The training data set can include a malicious domain name data set, and the malicious domain name data set includes typical dictionary-based malicious domain names. The above data can be obtained through an open source channel.

[0032] Further, since the dictionary-based malicious domain name is similar to the normal domain name, in order to prevent misjudgment, in the case where the initial detection result indicates that the domain name to be detected is a non-malicious domain name, the domain name to be detected can be subjected to word segmentation processing, and the domain name to be detected is decomposed into smaller units such as words or letter combinations, so as to more carefully analyze the composition of the domain name to obtain the word segmentation result of the domain name to be detected. Then, according to a preset detection strategy, the domain name is analyzed in combination with the word segmentation result to finally determine whether the domain name to be detected is a malicious domain name, and the target detection result of the domain name to be detected is obtained. In one example, the preset detection strategy can include weight allocation of the word segmentation result, sensitivity analysis of specific words, reasonableness check of domain name structure, etc.

[0033] In this way, through the three steps of preliminary detection, word segmentation processing and in-depth analysis, the detection range is gradually narrowed and the detection accuracy is improved, so as to effectively identify malicious domain names. This method combines the advantages of dictionary matching and semantic analysis, and improves the efficiency and accuracy of malicious domain name detection.

[0034] The above technical solution, by obtaining the domain name to be detected, then determining the initial detection result of the domain name to be detected based on the pre-constructed dictionary-based malicious domain name detection model, then in the case where the initial detection result is a non-malicious domain name, performing word segmentation processing on the domain name to be detected to obtain the word segmentation result corresponding to the domain name to be detected, and finally determining the target detection result of the domain name to be detected based on the preset detection strategy according to the word segmentation result. The present application can detect dictionary-based DGA malicious domain names through the dictionary-based malicious domain name detection model, and perform secondary detection combined with the preset detection strategy, which is beneficial to improve the accuracy of the detection result.

[0035] In the embodiment of the present application, the domain name to be detected is subjected to word segmentation processing to obtain a word segmentation result corresponding to the domain name to be detected, which can include: extracting a second-level domain name of the domain name to be detected; performing word segmentation processing on the second-level domain name by forward maximum length greedy matching to obtain a first word segmentation result; performing word segmentation processing on the second-level domain name by reverse maximum length greedy matching to obtain a second word segmentation result; and determining the smaller one of the number of words in the first word segmentation result and the second word segmentation result as the word segmentation result of the domain name to be detected.

[0036] It can be understood that, in order to accurately perform word segmentation processing on the domain name to be detected, the embodiment of the present application adopts a method combining forward maximum length greedy matching and reverse maximum length greedy matching. Specifically, the second-level domain name part of the domain name to be detected is extracted. The second-level domain name is usually located before the top-level domain name and immediately follows the main domain name, and it can be an important part of a website, used to represent the specific content or function of the website. Then, the extracted second-level domain name is subjected to word segmentation processing using the forward maximum length greedy matching algorithm, which starts from the first character of the second-level domain name and attempts to match the longest word until it can no longer match a longer word. Then, the algorithm continues to perform the next matching from the beginning of the remaining characters until the entire second-level domain name is segmented, to obtain a first word segmentation result. Similarly, the reverse maximum length greedy matching algorithm starts from the last character of the second-level domain name and performs word matching in reverse, to obtain a second word segmentation result.

[0037] Further, considering that in most cases, the result with fewer words is more likely to retain the integrity of the words and the coherence of the semantics, in order to balance the accuracy and stability of the word segmentation result, the result with fewer words in the first word segmentation result and the second word segmentation result is selected as the final output. Thus, the possibility of word segmentation errors is reduced.

[0038] In this way, by combining the forward maximum length greedy matching and the reverse maximum length greedy matching, accurate word segmentation processing is performed on the domain name to be detected, and a stable and reliable word segmentation result can be obtained, which provides strong support for subsequent detection and analysis work.

[0039] In the embodiment of the present application, the preset detection strategy can include at least one of a commonly known word detection strategy, a word combination form detection strategy, and a semantic association detection strategy.

[0040] Specifically, the embodiment of the present application provides a plurality of preset detection strategies, including a commonly known word detection strategy, a word combination form detection strategy, and a semantic association detection strategy. When performing secondary detection on the domain name to be detected, one of the above strategies can be used for detection, or multiple detection strategies can be combined for detection, to improve the accuracy of the detection result.

[0041] In one example, the known word database can include commonly used words and characters in malicious domain names, which are usually closely related to malicious behaviors, such as "phishing" (phishing), "malware" (malware), etc. Thus, by judging whether the words or characters in the known word database exist in the domain name to be detected, it can be further detected whether the domain name is a malicious domain name. In another example, the known word database can include trademarks, English names of institutions, pinyin of names of institutions, pinyin abbreviations of names of institutions, and English abbreviations of names of institutions, etc. Thus, secondary detection according to the known word database can prevent misjudgment. It can be understood that the specific data type in the known word database can be determined according to the detection requirement.

[0042] It can be understood that the word combination form detection strategy focuses on the combination mode and structural features of the words in the domain name. In one example, considering that malicious domain names often use specific word combination forms to confuse or bypass security detection, the word combination form of known malicious domain names can be analyzed, such as the connection mode between words, the use of special characters, etc. According to the analysis results, corresponding detection rules or models are constructed, and in the detection process, these rules or models are applied to evaluate whether the word combination form of the domain name to be detected is suspicious. In another example, for dictionary type malicious domain names, since the word combination form of the dictionary DGA domain name is different from the combination form of English words or Chinese character pinyin, it cannot be completely matched with existing English words or pinyin. Thus, by judging the word combination form of the English words in the word combination of the domain name to be detected, it can be judged whether the domain name to be detected is a malicious domain name.

[0043] It can be understood that the semantic association detection strategy uses natural language processing technology to analyze the semantic association between the words in the domain name. Since the dictionary type malicious domain name in the malicious domain name is formed by randomly splicing dictionary words, there is no semantic association between the words. Thus, by detecting whether there is a semantic association between the words in the word segmentation result of the domain name to be detected, it can be judged whether the domain name to be detected is a malicious domain name.

[0044] Thus, secondary detection by the above prediction detection strategy can further improve the accuracy of the detection result.

[0045] In the embodiment of the present application, when the preset detection strategy is the public word detection strategy, determining the target detection result of the domain name to be detected according to the word segmentation result based on the preset detection strategy can include: matching the word segmentation result with data in a pre-constructed public word database, wherein the public word database includes trademarks, English names of institutions, pinyin names of institutions, pinyin abbreviations of names of institutions, and English abbreviations of names of institutions; and when the matching is successful, determining that the target detection result is a non-malicious domain name.

[0046] Specifically, the public word database can include trademarks, English names of institutions, pinyin names of institutions, pinyin abbreviations of names of institutions, and English abbreviations of names of institutions. When the preset detection strategy is set to the public word detection strategy, the word segmentation result of the domain name to be detected can be matched with data in the pre-constructed public word database, and the target detection result of the domain name to be detected is determined according to the matching result. In one example, if a certain word or character combination in the word segmentation result completely matches a certain entry in the database, it is considered a successful match. In this case, the processor tends to consider that the domain name to be detected is related to a legal institution or brand, and therefore determines its target detection result as a non-malicious domain name. In another example, if the word or character combination in the word segmentation result does not match any entry in the database, it is considered a failed match. In this case, the processor can directly determine that the target detection result of the domain name to be detected is a malicious domain name, or can further apply other detection strategies, such as the word combination form detection strategy or the semantic association detection strategy, for further judgment.

[0047] It can be understood that the public word database can be updated at a set period to ensure that it contains the latest trademarks, institution names, etc.

[0048] In this way, by applying the public word detection strategy and combining the pre-constructed public word database, the system can effectively screen out domain names related to legal institutions or brands and determine their target detection results as non-malicious domain names, thereby improving the accuracy of the detection results.

[0049] In the embodiment of the present application, when the preset detection strategy is the word combination form detection strategy, determining the target detection result of the domain name to be detected according to the word segmentation result based on the preset detection strategy can include: matching the word segmentation result with a pre-constructed word library, wherein the word library includes an English word library corresponding to an English dictionary and a pinyin word library corresponding to a pinyin dictionary; and when the matching is successful, determining that the target detection result is a non-malicious domain name.

[0050] Specifically, when the preset detection strategy is selected as the word combination form detection strategy, the word segmentation result can be matched with a pre-constructed word library, which includes an English word library corresponding to an English dictionary and a pinyin word library corresponding to a pinyin dictionary, i.e., widely recognized and standardized English words and pinyin words, and then the target detection result of the domain name to be detected is determined according to the matching result. In an example, if a certain word or character combination in the word segmentation result is completely matched with a certain entry in the word library, or meets a preset matching rule, such as partial matching, fuzzy matching, etc., it is considered as a successful match; in this case, the processor tends to consider that the word combination of the domain name to be detected is standardized and common, and thus determines the target detection result of the domain name to be detected as a non-malicious domain name. In another example, if the word or character combination in the word segmentation result does not match any entry in the word library, or the matching degree is lower than the preset matching rule, it is considered as a failed match; in this case, the processor can directly determine that the target detection result of the domain name to be detected is a malicious domain name, or can further apply other detection strategies, such as the word combination form detection strategy or the semantic association detection strategy, for further judgment.

[0051] In this way, by applying the word combination form detection strategy and combining the pre-constructed word library, it can be effectively evaluated whether the word combination of the domain name to be detected is standardized and common, so as to preliminarily judge whether it is a non-malicious domain name.

[0052] In the embodiments of the present application, in the case where the preset detection strategy is the semantic association detection strategy and the number of word segmentation results is multiple, based on the preset detection strategy, the target detection result of the domain name to be detected is determined according to the word segmentation result, which can include: judging whether there is a semantic association between the multiple word segmentation results in the word segmentation result; in the case where there is a semantic association between the multiple word segmentation results, determining that the target detection result is a non-malicious domain name; in the case where there is no semantic association between the multiple word segmentation results, determining that the target detection result is a malicious domain name.

[0053] Specifically, when the preset detection strategy is selected as the semantic association detection strategy, and the segmentation result of the domain name to be detected contains multiple segmented words, the processor can analyze whether there is a semantic association between the segmented words, and then determine the target detection result of the domain name to be detected according to the judgment result of the semantic association. In an example, the common sense knowledge base can be used to check whether there is a known association or relationship between the segmented words, and natural language processing technology, machine learning algorithm or rule-based method can be used to analyze the semantic association between the words. If there is a significant semantic association between the multiple segmented words in the segmentation result, the system tends to consider that the domain name to be detected has a reasonable semantic structure, and thus determines the target detection result of the domain name to be detected as a non-malicious domain name. If there is a lack of obvious semantic association between the words in the segmentation result, or the formed sentence or phrase is unreasonable or chaotic in context, the system may consider that the domain name to be detected has potential malicious behavior, and thus determines the target detection result of the domain name to be detected as a malicious domain name.

[0054] In this way, by applying the semantic association detection strategy and combining the analysis of the association between the words in the segmentation result, the system can effectively evaluate the semantic reasonableness of the domain name to be detected, and thus further determine whether it is a non-malicious domain name or a malicious domain name.

[0055] In the embodiments of the present application, based on the preset detection strategy, the target detection result of the domain name to be detected is determined according to the segmentation result, which can include: constructing a reasoning thought chain according to the commonly known word detection strategy, the word combination form detection strategy and the semantic association detection strategy; determining the target detection result of the domain name to be detected through the reasoning thought chain according to the segmentation result.

[0056] It can be understood that the embodiments of the present application can use a base large model to implement the above-mentioned malicious domain name detection method. In order to more comprehensively determine the target detection result of the domain name to be detected, a reasoning thought chain can be constructed in the base large model by combining multiple detection strategies, such as the commonly known word detection strategy, the word combination form detection strategy and the semantic association detection strategy, and the target detection result of the domain name to be detected is determined through the reasoning thought chain according to the segmentation result. In combination with the above three strategies, a reasoning thought chain is constructed, which contains a series of logical judgment steps for gradually analyzing the segmentation result of the domain name to be detected. For example, first, the commonly known word detection strategy is used to detect the segmentation result, to determine whether the domain name to be detected belongs to the commonly known word, and if so, the target detection result is determined as a non-malicious domain name. If not, then the word combination form detection strategy is used to analyze the combination form of the segmentation result, to check whether they follow common grammar and collocation rules, and if not, the target detection result is determined as a malicious domain name. If so, the semantic association detection strategy is further used to evaluate the semantic association between the words in the segmentation result, to determine whether there is a semantic association between the segmented words, and if so, the target detection result is determined as a malicious domain name, otherwise the target detection result is determined as a malicious domain name.

[0057] In this way, by integrating multiple detection strategies and constructing an inference thought chain, we can more comprehensively analyze the word segmentation results of the domain name to be detected, and determine its target detection result accordingly. This method helps to improve the accuracy and reliability of detection, and provides more powerful support for the field of network security.

[0058] In the embodiments of the present application, the construction of the dictionary-based malicious domain name detection model can include: obtaining a dictionary-based malicious domain name data set and a dictionary-based benign domain name data set; labeling the data in the dictionary-based malicious domain name data set and the dictionary-based benign domain name data set respectively, and processing the data according to the input format of the preset base large model to obtain training data; fine-tuning the preset base large model according to the training data to obtain the dictionary-based malicious domain name detection model.

[0059] Specifically, the dictionary-based malicious domain name data set contains domain names known or suspected to be malicious, which usually have certain dictionary characteristics and are generated by DGA domain name types such as random concatenation of dictionary words, random concatenation of prefixes and suffixes, and random concatenation of pinyin. It is usually a combination of completely unrelated or even fabricated words. The dictionary-based benign domain name data set contains domain names composed of dictionary words, which usually have certain semantic logic. Further, for each domain name, it needs to be labeled to determine whether it is a malicious domain name or a benign domain name. In order to meet the input requirements of the preset base large model, the data needs to be formatted and preprocessed, including converting the domain name to a specific encoding format, removing unnecessary characters, adjusting the size and shape of the data, etc., to obtain training data.

[0060] Further, the base large model is selected, and the preset base large model is a model that has been trained and has strong representation ability, such as BERT, GPT, etc. These models are usually trained on large-scale corpora and can capture the complex features of language. The training data, i.e. the labeled and processed dictionary-based malicious domain name data set and benign domain name data set, is used to fine-tune the preset base large model. Fine-tuning is achieved by further training the model on the malicious domain name detection task to enable it to recognize and distinguish between malicious domain names and benign domain names. During the fine-tuning process, the performance of the model needs to be continuously evaluated, and the model needs to be optimized according to the evaluation results to finally obtain the dictionary-based malicious domain name detection model.

[0061] In this way, by fine-tuning the preset base large model with the dictionary-based malicious domain name data set and the dictionary-based benign domain name data set, a dictionary-based malicious domain name detection model with excellent performance can be constructed, which can effectively identify dictionary-based malicious domain names.

[0062] In an embodiment of the present application, considering that the only difference between the dictionary DGA domain name in the DGA malicious domain name and the normal domain name is the combination of characters, the combination of characters of the normal domain name usually has certain semantic logic for the user to have memory and distinguishability, and is generally a combination of words. The dictionary DGA domain name is a combination of completely irrelevant or even made-up words, and has no semantic and logical coherence. In view of this, an embodiment of the present application proposes a dictionary type DGA domain name detection method based on large language model semantic discrimination, which is mainly used for detecting DGA malicious domain names based on dictionary combination, including single word random splicing domain name (such as apple-road.net), English prefix and suffix random splicing domain name (such as multinefeness-misuropance.name), pinyin random splicing domain name (such as chang-ken.com) and other forms of DGA malicious domain name detection. This type of DGA malicious domain name has a very high similarity with the domain name described by normal words or pinyin, and cannot rely on existing artificial intelligence technologies such as machine learning and deep learning to solve, and using blacklist, threat intelligence and other means has a lag. In the present embodiment, the dictionary type DGA domain name detection method based on large language model semantic discrimination can include the following steps.

[0063] Step 1: Select a base large model for the current task.

[0064] The base large model refers to a pre-trained model with a large number of parameters. The model is pre-trained on a large amount of text training data and has strong natural language processing function. Such models usually cannot be trained by individuals or small-scale organizations, and can be fine-tuned based on open source base large models to meet the unique needs of some scenarios. The base large model selected in the present application should perform well in both Chinese and English processing.

[0065] Step 2: Select appropriate domain name training data.

[0066] Specifically, the domain name training data can include dictionary type DGA domain name data and domain names that can be formed by word splicing in normal domain names. The training data is divided into multiple sets, including: a set A corresponding to dictionary type DGA malicious domain names, a set B1 corresponding to domain names composed of word splicing in 1 million Alexa domain names, a set B2 corresponding to Chinese vocabulary pinyin domain names, and a set B3 corresponding to common words with prefixes and suffixes in English articles. The typical dictionary type DGA malicious domain name training set is marked as the training domain name set A, for example: ilecixance-antibafuxant.net, lookhurt.com, threetold.org, awardsbookcasio.net, etc. The Alexa 1 million domain name set is selected, and the domain names that obviously use recognizable word splicing in the set are screened as the normal domain name training set, which is marked as the training domain name set B1. Only the second-level domain names are selected, for example: facebook, microsoft, linkedin, steamcommunity, stackoverflow, etc. A certain number of commonly used Chinese vocabulary, for example, the top 20,000 commonly used Chinese vocabulary, can be selected, which can be from authoritative materials such as modern Chinese dictionaries, and converted into pinyin form as the training domain name set B2. For example: wen-ming, he-xie, zhi-dao, hui-huang, etc. A certain number of English articles are selected, from which common prefixes, suffixes, and words including conjunctions such as ‘-’ are extracted, for example: anti-war, two-thirds, counter-strike, etc., as the training set B3.

[0067] Step 3: Fine-tuning of the large model.

[0068] The SFT (Supervised fine-tuning) method is used to fine-tune the large model selected in step 1. The model is trained on labeled data to learn the natural language features and internal reasoning logic of the data.

[0069] Substep 3.1: Preprocessing of training data into the format required by the fine-tuned model.

[0070] Sub-step 3.2: Select a large model supervised fine-tuning method for large model fine-tuning training based on the training data generated in sub-step 3.1, divide the training data into a training data set, a validation data set, and a test data set, select a model loading method, and set training parameters. Detect the training loss value during the training process until it meets the design requirements or reaches the maximum training step. At the same time, the output results of the validation data set can be observed during the training process, and if the output meets the expectations, the training can also be stopped in advance. After stopping the training, load the low-rank adapter parameter file generated by the model to test whether the trained model meets the requirements on the test set.

[0071] Step 4: Perform word segmentation processing on the domain name to be detected.

[0072] The forward and reverse maximum length greedy matching method is used to segment the domain name to be detected, correctly searching for the prefix, suffix, and longest matching correct word or pinyin of the domain name string. Perform forward and backward (i.e. from the head to the tail of the string and from the tail to the head of the string) twice traversal matching, and take the least number of segmented words as the final segmentation result. Among them, for the word type, the word table in the regular English dictionary can be used for matching, the prefix and suffix can be matched using English prefixes and suffixes, and the pinyin can be matched using standard Chinese pinyin.

[0073] Example: For the domain name steamcommunity.com, the second-level domain name is steamcommunity, and the segmentation that can be taken is [steam, comm, unity] and [steam, community], taking the result with the least number [steam, community].

[0074] Step 5: Construct a suitable prompt reasoning chain.

[0075] In order to improve the accuracy of large model detection and reduce the false positive rate, a prompt thought chain (Chain-of-Thought) is constructed to enhance the recognition ability of the large model after fine-tuning training for dictionary type DGA domain names. The example domain name is denoted as "domain".

[0076] Sub-step 5.1: Construct prompt1: "Is domain a known company identifier, trademark, idiomatic expression, English or pinyin abbreviation of a company or government agency, initial abbreviation, etc." If the large model answers "yes", the process ends and it is determined as a non-dictionary type DGA malicious domain name, if the large model answers "no", then enter sub-step 5.2;

[0077] Sub-step 5.2: Construct prompt2: "Are the words segmented by domain in the form of combination of English words or Chinese pinyin?" If the large model answers "no", the process ends, and it is determined that the domain name is a dictionary type DGA malicious domain name. If the large model answers "yes", sub-step 5.3 is entered;

[0078] Sub-step 5.3: Construct prompt3: "Are there semantic associations between the words segmented by domain?", if the large model answers "yes", the process ends, and it is determined that the domain name is a non-dictionary type DGA malicious domain name. If the large model answers "no", it is determined that the domain name is a dictionary type DGA domain name.

[0079] Sub-step 5.4: For the DGA malicious domain name determined by the large model to be a dictionary type, manual research and judgment can be performed according to the "reason" field description output by the large model. For the domain name determined by manual research and judgment to be a large model identification error, the error output data can be re-entered into step 2 for correction.

[0080] In this way, the base large model can be used to detect some dictionary or pinyin concatenation type malicious domain names, which can effectively deal with this type of malicious DGA domain name.

[0081] The embodiment of the present application also provides a computer device, which comprises a memory and a processor. The memory stores a computer program, and the processor implements the method for detecting a malicious domain name in the above embodiment when executing the computer program.

[0082] The embodiment of the present application also provides a machine readable storage medium, which stores a program or instruction. The program or instruction is executed by a processor to implement the method for detecting a malicious domain name in the above embodiment.

[0083] The embodiment of the present application also provides a computer program product, which comprises a computer program. The computer program is executed by a processor to implement the method for detecting a malicious domain name in the above embodiment. Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system or a computer program product. Therefore, the present application can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0084] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

[0085] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

[0086] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks.

[0087] In one typical configuration, the computing device includes one or more processors (CPU's), input / output interfaces, network interfaces, and memory.

[0088] The memory can include non-persistent memory and / or persistent memory, such as flash memory, read-only memory (ROM), and / or volatile or non-volatile random access memory (RAM), among others. The memory is an example of computer-readable media.

[0089] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can implement information storage by any method or technology. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0090] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusions, so that a process, method, article or apparatus that includes a list of elements does not only include those elements, but also includes other elements not explicitly listed, or further includes elements inherent in such a process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0091] The above only is an embodiment of the present application, and is not used to limit the present application. For those skilled in the art, the present application can have various changes and variations. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A method for detecting a malicious domain name, characterized by, The method comprises: acquiring a domain name to be detected; determining an initial detection result of the domain name to be detected based on a pre-constructed dictionary type malicious domain name detection model; in the case where the initial detection result is a non-malicious domain name, performing word segmentation processing on the domain name to be detected to obtain a word segmentation result corresponding to the domain name to be detected; determining a target detection result of the domain name to be detected according to the word segmentation result based on a preset detection strategy, the preset detection strategy comprising a well-known word detection strategy, a word combination form detection strategy and a semantic association detection strategy; the construction of the dictionary type malicious domain name detection model comprises: acquiring a dictionary type malicious domain name data set and a dictionary type benign domain name data set; labeling the data in the dictionary type malicious domain name data set and the dictionary type benign domain name data set respectively, and processing the data according to the input format of a preset base large model to obtain training data; fine-tuning the preset base large model according to the training data to obtain the dictionary type malicious domain name detection model.

2. The method of claim 1, wherein, in the case where the preset detection strategy is the well-known word detection strategy, the determining of the target detection result of the domain name to be detected according to the word segmentation result based on the preset detection strategy comprises: matching the word segmentation result with the data in a pre-constructed well-known word database, wherein the well-known word database comprises trademarks, English names of institutions, pinyin names of institutions, pinyin abbreviations of names of institutions and English abbreviations of names of institutions; in the case where the matching is successful, determining that the target detection result is a non-malicious domain name.

3. The method of claim 1, wherein, in the case where the preset detection strategy is the word combination form detection strategy, the determining of the target detection result of the domain name to be detected according to the word segmentation result based on the preset detection strategy comprises: matching the word segmentation result with a pre-constructed word library, the word library comprising an English word library corresponding to an English dictionary and a pinyin word library corresponding to a pinyin dictionary; in the case where the matching is successful, determining that the target detection result is a non-malicious domain name.

4. The method of claim 1, wherein, in the case where the preset detection strategy is the semantic association detection strategy and the number of word segmentation results is multiple, the determining of the target detection result of the domain name to be detected according to the word segmentation result based on the preset detection strategy comprises: judging whether there is semantic association between the multiple word segmentation results; in the case where there is semantic association between the multiple word segmentation results, determining that the target detection result is a non-malicious domain name; in the case where there is no semantic association between the multiple word segmentation results, determining that the target detection result is a malicious domain name.

5. The method of claim 1, wherein, the determining of the target detection result of the domain name to be detected according to the word segmentation result based on the preset detection strategy comprises: constructing a reasoning thinking chain according to the well-known word detection strategy, the word combination form detection strategy and the semantic association detection strategy; determining the target detection result of the domain name to be detected through the reasoning thinking chain according to the word segmentation result.

6. The method of claim 1, wherein, the word segmentation processing on the domain name to be detected to obtain the word segmentation result corresponding to the domain name to be detected comprises: extracting a second level domain name of the domain name to be detected; The secondary domain name is processed by forward maximum length greedy matching to obtain a first segmentation result; The secondary domain name is processed by reverse maximum length greedy matching to obtain a second segmentation result; The smaller one of the number of segmentations in the first segmentation result and the second segmentation result is determined as the segmentation result of the domain name to be detected.

7. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that, The processor executes the computer program to implement the method for detecting malicious domain names according to any one of claims 1 to 6.

8. A machine-readable storage medium having stored thereon a program or instmctions, characterized in that, The program or the instructions are executed by the processor to implement the method for detecting malicious domain names according to any one of claims 1 to 6.

9. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the method for detecting malicious domain names according to any one of claims 1 to 6.

Images