Random domain name detection method and device, nonvolatile storage medium and electronic equipment

Abstract

The invention discloses a random domain name detection method and device, a nonvolatile storage medium and electronic equipment. The method comprises the following steps: acquiring threat intelligence data, flow data of a communication network and domain name system analysis log data of the communication network; analyzing the log data according to the flow data and the domain name system to establish a multi-dimensional domain name portrait; determining a random domain name feature set according to the threat intelligence data and the multi-dimensional domain name portrait; incremental training is conducted on a random domain name analysis model according to the random domain name feature set, the random domain name analysis model is used for determining whether the domain name to be detected is a random domain name or not, and the random domain name analysis model comprises a basic model and a two-layer model which is connected with the basic model and composed of a long and short term memory network and an attention mechanism. The technical problem that the random domain name detection precision is not high due to the fact that the random domain name features are difficult to determine in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of network security, and in particular to a random domain name detection method, device, non-volatile storage medium and electronic device. Background Art

[0002] As network attack techniques become increasingly sophisticated, DGA (Domain Generation Algorithm) is widely used by malware to dynamically generate a large number of seemingly random domain names for communication with C2 (Command and Control) servers. This technology greatly reduces the effectiveness of traditional blacklist-based domain name detection methods because it is difficult for defenders to predict and block all generated random domain names.

[0003] Most existing DGA detection methods rely on limited static features, such as domain name length, character composition, etc., which are insufficient to cope with the flexibility and variability of DGA algorithms. In addition, due to the stealth and persistence of APT (Advanced Persistent Threat) attacks, traditional detection methods are often unable to identify and respond to these threats in real time and accurately.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a random domain name detection method, device, non-volatile storage medium and electronic device to at least solve the technical problem that the random domain name detection accuracy is low due to the difficulty in determining the random domain name features in the prior art.

[0006] According to one aspect of an embodiment of the present application, a random domain name detection method is provided, including: obtaining threat intelligence data, traffic data of a communication network, and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; establishing a multidimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multidimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; determining a random domain name feature set based on the threat intelligence data and the multidimensional domain name portrait; incrementally training a random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether a domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model, and a two-layer model consisting of a long short-term memory network and an attention mechanism connected to the basic model.

[0007] Optionally, the multidimensional domain name portrait includes a domain name language static feature portrait, a domain name structure feature portrait, a domain name statistical feature portrait, and a domain name behavior dynamic portrait; establishing a multidimensional domain name portrait based on traffic data and domain name system analysis log data includes: aggregating traffic data and domain name system analysis log data, and extracting static data features and dynamic data features of various domain names based on a preset random domain name set and a preset non-random domain name set during the aggregation process, wherein various domain names include random domain names and non-random domain names; establishing a domain name language static feature portrait based on language features in the static data features, wherein the language features include at least one of the following: the number of vowels, the number of letters after deduplication The number of digits; establishing a domain name structure feature portrait based on the language structure features in the static data features, wherein the language structure features include at least one of the following: domain name length, registration information; establishing a domain name statistical feature portrait based on the domain name statistical features in the static data features, wherein the domain name statistical features include at least one of the following: entropy of the domain name, hidden Markov model coefficient of the domain name, and Jaccard similarity coefficient of the domain name; establishing a domain name behavior dynamic portrait based on the domain name behavior dynamic features in the dynamic data features, wherein the domain name behavior dynamic features include at least one of the following: frequency of requesting domain name resolution, average outbound traffic, average return traffic, average outbound flow rate, and average return flow rate.

[0008] Optionally, determining a random domain name feature set based on threat intelligence data and multi-dimensional domain name portraits includes: determining an initial feature set of the random domain name based on threat intelligence data and multi-dimensional domain name portraits; determining an information gain index for each feature type in the initial feature set; screening each feature type based on the information gain index to obtain a preset number of feature types; and determining a random domain name feature set based on the preset number of feature types and the initial feature set.

[0009] Optionally, determining the information gain index of each feature type in the initial feature set includes: determining the total information entropy of the initial feature set; determining the sub-information entropy of each feature type; and determining the information gain index of each sub-feature type based on the total information entropy and the sub-information entropy of each sub-feature type.

[0010] Optionally, the basic model is used to perform classification prediction based on the probabilistic relationship between the domain name features of the domain name to be detected and the random domain name, so as to determine the predicted value of the domain name to be detected, and the two-layer model is used to output the prediction result of the domain name to be detected based on the predicted value, wherein the prediction result includes that the domain name to be detected is a random domain name, and that the domain name to be detected is a non-random domain name, and the domain name features include at least one of the following: static features, statistical features, structural features, and domain name resolution behavior features of the domain name, and the predicted value is used to reflect the predicted probability that the domain name to be detected is a random domain name.

[0011] Optionally, the long short-term memory network in the two-layer model includes a bidirectional long short-term memory network consisting of a forward long short-term memory network and a backward long short-term memory network, wherein the bidirectional long short-term memory network is used to simultaneously extract forward information and backward information.

[0012] Optionally, performing incremental training on a random domain name analysis model based on a random domain name feature set includes: determining a parameter value of a preset hyperparameter, wherein the parameter value of the preset hyperparameter is used to reflect the ratio between new class knowledge learned by the random domain name analysis model during the incremental training and old class knowledge learned before training; performing incremental training on the random domain name analysis model based on the random domain name feature set and the preset hyperparameter.

[0013] According to another aspect of an embodiment of the present application, a random domain name detection device is also provided, including: a first processing module, used to obtain threat intelligence data, traffic data of a communication network and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; a second processing module, used to establish a multidimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multidimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; a third processing module, used to determine a random domain name feature set based on the threat intelligence data and the multidimensional domain name portrait; a fourth processing module, used to perform incremental training on a random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name, and the random domain name model includes a basic model, and a two-layer model composed of a long short-term memory network and an attention mechanism connected to the basic model.

[0014] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, in which a program is stored, wherein when the program is running, a device where the non-volatile storage medium is located is controlled to execute a random domain name detection method.

[0015] According to another aspect of an embodiment of the present application, an electronic device is provided, including: a memory and a processor, the processor being configured to run a program stored in the memory, wherein the random domain name detection method is executed when the program is run.

[0016] According to another aspect of an embodiment of the present application, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the random domain name detection method is implemented.

[0017] In an embodiment of the present application, threat intelligence data, traffic data of a communication network, and domain name system resolution log data of a communication network are obtained, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; a multidimensional domain name portrait is established based on the traffic data and the domain name system resolution log data, wherein the multidimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; a random domain name feature set is determined based on the threat intelligence data and the multidimensional domain name portrait; a random domain name analysis model is incrementally trained based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether a domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model, and a two-layer model composed of a long short-term memory network and an attention mechanism connected to the basic model. By collecting and obtaining threat intelligence data, traffic data of a communication network, and domain name system resolution log data of a communication network, a random domain name feature set training model is determined, and whether the domain name to be detected is a random domain name is determined based on the model, the purpose of accurately determining the characteristics of random domain names is achieved, thereby achieving the technical effect of timely and effective detection of random domain names, and further solving the technical problem of low accuracy in random domain name detection caused by the difficulty in determining random domain name characteristics in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 It is a structural schematic diagram of a computer terminal (mobile device) provided according to an embodiment of the present application;

[0020] Figure 2 It is a flowchart of a random domain name detection method provided according to an embodiment of the present application;

[0021] Figure 3 It is a schematic diagram of a threat intelligence data acquisition method provided according to an embodiment of the present application;

[0022] Figure 4 It is a schematic diagram of a network framework provided according to an embodiment of the present application;

[0023] Figure 5 This is a schematic diagram of a domain name system resolution log data provided according to an embodiment of the present application;

[0024] Figure 6 It is a schematic diagram of a process of establishing a multi-dimensional domain name portrait according to an embodiment of the present application;

[0025] Figure 7It is a schematic diagram of a domain name profiling result provided according to an embodiment of the present application;

[0026] Figure 8 It is a schematic diagram of a domain name profiling result provided according to an embodiment of the present application;

[0027] Fig. 9 is a schematic diagram of domain name registration information provided according to an embodiment of the present application;

[0028] Fig.10 It is a schematic diagram of a result of profiling based on statistical characteristics provided in an embodiment of the present application;

[0029] Fig.11 It is a schematic diagram of a portrait result based on statistical characteristics provided in an embodiment of the present application;

[0030] Fig.12 It is a schematic diagram of a domain name behavior dynamic profiling result provided according to an embodiment of the present application;

[0031] Fig.13 is a schematic diagram of an initial feature set provided according to an embodiment of the present application;

[0032] Fig.14 is a schematic diagram of a feature subset selection method provided according to an embodiment of the present application;

[0033] Fig.15 It is a schematic diagram of a framework of a random domain name analysis model provided according to an embodiment of the present application;

[0034] Fig.16 It is a schematic diagram of the principle of a bidirectional long short-term memory network provided according to an embodiment of the present application;

[0035] Fig.17 It is a schematic diagram of the principle of a long short-term memory network provided according to an embodiment of the present application;

[0036] Fig.18 It is a schematic diagram of an overall process of random domain name detection provided according to an embodiment of the present application;

[0037] Fig.19 It is a schematic diagram of an overall process of random domain name detection provided according to an embodiment of the present application;

[0038] Fig. 20 is a schematic diagram of a random domain name detection result provided according to an embodiment of the present application;

[0039] Fig.21 This is a schematic diagram of a random domain name detection principle provided according to an embodiment of the present application;

[0040] Fig. 22is a schematic diagram of a random domain name detection result provided according to an embodiment of the present application;

[0041] Fig.23 It is a structural schematic diagram of a random domain name detection device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0043] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0044] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0045] DGA (Domain Generation Algorithm): A domain name generated using a certain algorithm using random characters, time, dictionary, hard coding, etc.

[0046] APT (Advanced Persistent Threat): Also known as advanced persistent threat, advanced persistent threat, etc., refers to a hidden and persistent computer intrusion process, usually carefully planned by certain personnel and targeting specific targets.

[0047] NetFlow: is a widely used traffic data statistics standard used to monitor and record all traffic in and out of an interface.

[0048] DNS (Domain Name System): A distributed database on the Internet that maps domain names to IP addresses, allowing users to access the Internet more conveniently without having to remember IP addresses that can be directly read by machines.

[0049] NXDOMAIN (Non-Existent Domain, rcode=3): is a specific response type, indicating that the queried domain name does not exist in the DNS database.

[0050] The DGA algorithm consists of two parts, the seed (algorithm input) and the algorithm. The algorithm is generally based on hash, arithmetic, dictionary, permutation and combination, etc. The principle of DGA domain name communication is that the client generates a large number of candidate random domain names through the DGA algorithm and queries them through the domain name server. The attacker and the malware run the same DGA algorithm to generate the same list of candidate domain names. When an attack is needed, a small number of them are selected for registration, and the client malware can then establish communication with the C2 server.

[0051] Most existing DGA detection methods rely on limited static features, such as domain name length, character composition, etc., which are insufficient to cope with the flexibility and variability of DGA algorithms. In addition, due to the stealth and persistence of APT (Advanced Persistent Threat) attacks, traditional detection methods are often unable to identify and respond to these threats in real time and accurately.

[0052] In addition, with the explosive growth of network traffic, especially in operator networks, traditional traffic analysis and threat detection methods have become increasingly difficult to process massive Netflow data and DNS resolution logs, making it difficult to detect potential DGA domain names and APT activities in a timely manner.

[0053] Specifically, the existing random domain name detection method has the following problems:

[0054] 1. The random domain names generated by DGA are difficult to predict, making traditional rule-based detection methods ineffective.

[0055] 2. The random domain names generated by DGA have diverse language, structural, statistical and behavioral characteristics, which cannot be fully covered by a single detection method.

[0056] 3. In large network environments, the amount of Netflow data and DNS resolution records is huge, which poses a challenge to real-time analysis and processing.

[0057] 4. The long-term and hidden nature of APT attacks requires the detection system to have higher intelligence and adaptability.

[0058] In order to solve the above problems, relevant solutions are provided in the embodiments of the present application, which are described in detail below.

[0059] According to an embodiment of the present application, a method embodiment of a random domain name detection method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0060] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing a random domain name detection method. Figure 1 As shown, the computer terminal 10 (or mobile device 10) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0061] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0062] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the random domain name detection method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned random domain name detection method is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0063] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0064] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0065] Under the above operating environment, the embodiment of the present application provides a random domain name detection method, such as Figure 2 As shown, the method comprises the following steps:

[0066] Step S202, acquiring threat intelligence data, traffic data of the communication network, and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information.

[0067] Optionally, Figure 3 The following shows how threat intelligence data can be obtained: Figure 3As shown in the figure, the detection system is linked with the threat intelligence center to collect DGA domain names and DGA C2 IP threat intelligence from the entire network. When DGA behavior is detected, the DGA domain name and IP resolution can be automatically detected, important information can be extracted for retention, and the domain name can be added to the reputation list to achieve continuous updating and expansion of the DGA domain name and C2 IP library; the network threat intelligence report of the DGA domain name resolution C2 server IP, and the table of local DGA domain name threat intelligence, which stores the DGA suspicious domain name (i.e. random domain name information), the corresponding family, the C2 server IP (i.e. the attack behavior information and IP address information associated with the random domain name information) and the source of intelligence.

[0068] Optionally, Figure 4 A network framework diagram is shown, such as Figure 4 As shown, traffic data of the communication network is collected at a sampling ratio of 5000:1 on the backbone network and the metropolitan area network CR.

[0069] Optionally, on the telecommunications side, ie, the infrastructure of the network operator, the domain name system resolution logs of the entire communication network are carefully recorded and collected. Figure 5 shows the DNS resolution log data, such as Figure 5 As shown, the DNS resolution log (i.e., the domain name system resolution log) contains detailed information for each DNS query, including but not limited to the client IP, resolved domain name, resolution type, resolution time, resolution IP address, returned resolution result, and source port, etc.

[0070] Step S204, establishing a multi-dimensional domain name portrait based on the traffic data and the domain name system analysis log data, wherein the multi-dimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions.

[0071] Optionally, Figure 6 A flowchart of establishing a multi-dimensional domain name profile is shown. Figure 6 As shown in the figure, combined with the DNS resolution log of the big network (i.e., domain name system resolution log data) and Netflow data (i.e., traffic data), the data is preprocessed and converged and fitted, and then static data features and dynamic behavior features are extracted to establish a multi-dimensional domain name portrait, where preprocessing includes cleaning illegal and abnormal data, deduplication and standardization of records. The features extracted by data feature engineering include: domain name registration information, registration organization, DNS record type, domain name resolution IP address ownership, resolution IP open port, domain name vowel sequence, domain name entropy, special characters, NXDOMAIN, upstream and downstream traffic, etc.

[0072] In the technical solution provided in step S204, the multi-dimensional domain name portrait includes a domain name language static feature portrait, a domain name structure feature portrait, a domain name statistical feature portrait, and a domain name behavior dynamic portrait; establishing a multi-dimensional domain name portrait based on traffic data and domain name system analysis log data includes: aggregating traffic data and domain name system analysis log data, and extracting static data features and dynamic data features of various domain names based on a preset random domain name set and a preset non-random domain name set during the aggregation process, wherein various domain names include random domain names and non-random domain names; establishing a domain name language static feature portrait based on language features in the static data features, wherein the language features include at least one of the following: the number of vowels: , the number of letters and digits after deduplication; establishing a domain name structure feature portrait based on the language structure features in the static data features, wherein the language structure features include at least one of the following: domain name length, registration information; establishing a domain name statistical feature portrait based on the domain name statistical features in the static data features, wherein the domain name statistical features include at least one of the following: entropy of the domain name, hidden Markov model coefficient of the domain name, and Jaccard similarity coefficient of the domain name; establishing a domain name behavior dynamic portrait based on the domain name behavior dynamic features in the dynamic data features, wherein the domain name behavior dynamic features include at least one of the following: frequency of requesting domain name resolution, average outbound traffic, average return traffic, average outbound flow rate, and average return flow rate.

[0073] Optionally, constructing a static feature profile of the domain name language includes profiling language features such as the number of vowels in the domain name, the number of letters and numbers after deduplication, and the length of characters. Profiling is performed through common dga_post-tovar-goz and dga_cryptolock zombie family DGA domain names (i.e., a preset random domain name set) and normal TOP1000 domain names (i.e., a preset non-random domain name set). Figure 7 and Figure 8 The results of profiling the domain name are shown, such as Figure 7 and Figure 8 As shown, DGA domain names have obvious aggregation effects and are clearly distinguished from normal domain names.

[0074] Optionally, constructing a domain name structure feature profile includes profiling the domain name length, registration agency, registration country and other registration information of the domain name. Fig. 9 Domain name registration information is displayed, and a domain name length portrait result is shown.

[0075] Optionally, constructing a domain name statistical feature portrait includes profiling statistical characteristics such as the entropy of the domain name, the hidden Markov model coefficient of the domain name, and the Jaccard similarity coefficient of the domain name. Fig.10 The results of profiling based on statistical characteristics are shown.

[0076] Optionally, constructing a dynamic profile of domain name behavior includes a NetFlow profile for domain name resolution from the host to the domain name server, including the frequency of domain name resolution requests, the average outbound traffic, the average return traffic, the average outbound flow rate, and the average return flow rate. Fig.11 The results of a packet size and traffic profile are shown.

[0077] Optionally, constructing a dynamic profile of domain name behavior includes statistically profiling the number and time of DGA domain name resolution from the host to the domain name resolution server. Profiling the number of IP addresses accessing the DGA domain name from the perspective of the big network. Profiling customers from the dimensions of the access destination IP access operator, location, geographic location, etc. Profiling customer access applications from the access domain name and registrar information. Fig.12 The result of a dynamic profile of domain name behavior is shown.

[0078] Step S206, determining a random domain name feature set based on threat intelligence data and multi-dimensional domain name portraits.

[0079] In the technical solution provided in step S206, determining a random domain name feature set based on threat intelligence data and multi-dimensional domain name portraits includes: determining an initial feature set of a random domain name based on threat intelligence data and multi-dimensional domain name portraits; determining an information gain index for each feature type in the initial feature set; screening each feature type based on the information gain index to obtain a preset number of feature types; and determining a random domain name feature set based on the preset number of feature types and the initial feature set.

[0080] Optionally, Fig.13 It shows the 44-dimensional initial feature set determined by implementing feature engineering processing based on the static characteristics of domain names and dynamic characteristics of domain name resolution behavior, coupling threat intelligence and user portraits.

[0081] In the technical solution provided in step S206, determining the information gain index of each feature type in the initial feature set includes: determining the total information entropy of the initial feature set; determining the sub-information entropy of each feature type; and determining the information gain index of each sub-feature type based on the total information entropy and the sub-information entropy of each sub-feature type.

[0082] Optionally, the information gain of all attributes is calculated, and the top 20 (ie, a preset number) dimensions with the largest information gain are selected as the feature subset of the algorithm model. Fig.14 The feature subset selection method based on information gain metric is shown, as Fig.14 As shown, the method steps are as follows:

[0083] 1. Calculate the total information entropy of a given sample Among them, P i Any sample belongs to C iThe probability of i / s estimated, where s i Indicates that it belongs to category C i The number of samples, s represents the total number of samples, C i represents the i-th category.

[0084] 2. Calculate the information entropy of each attribute in It is a subset S j The middle category is C i The probability of a sample, k is the total number of samples, subset S j is the sample subset divided according to different values ​​of attribute A, s mj is the value of attribute A that belongs to category C. m The number of samples.

[0085] 3. Calculate the information gain of each attribute Gain(A)=I(s1,s2,…,s m )-E(A).

[0086] Obviously, the smaller E(A) is, the larger the value of Gain(A) is, which means that the more information the test attribute A provides for classification, and the smaller the uncertainty of classification after selecting A.

[0087] 4. Select the top 20 (i.e., the preset number) dimensions with the largest information gain as the feature subset, output the training samples, and retain the feature information and feature values ​​corresponding to the screened feature types.

[0088] Step S208, incrementally training the random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model and a two-layer model composed of a long short-term memory network and an attention mechanism connected to the basic model.

[0089] In the technical solution provided in step S208, the basic model is used to perform classification prediction based on the probability relationship between the domain name features of the domain name to be detected and the random domain name, so as to determine the prediction value of the domain name to be detected, and the two-layer model is used to output the prediction result of the domain name to be detected based on the prediction value, wherein the prediction result includes that the domain name to be detected is a random domain name, and that the domain name to be detected is a non-random domain name, and the domain name features include at least one of the following: static features, statistical features, structural features, and domain name resolution behavior features of the domain name, and the prediction value is used to reflect the prediction probability that the domain name to be detected is a random domain name.

[0090] Optionally, Fig.15 A framework diagram of a random domain name analysis model is shown, such as Fig.15As shown in the figure, the random domain name analysis model applies technologies such as hierarchical system and incremental learning. The basic model classifies and predicts the probability relationship between the static features, statistical features, structural features, domain name resolution behavior features and DGA of the domain name. The basic model performs 5-fold cross-validation. For the training set, 4 folds are taken as training data and the other fold is taken as test data. Each cross-validation predicts the test data based on the model generated by training the training data, and the predicted values ​​are spliced ​​together as the training set of the second-layer model. The second-layer model uses a bidirectional long short-term memory network (BiLSTM) and an attention mechanism (ATT) as well as incremental learning to achieve feature and fusion model adaptation and automatic adjustment.

[0091] In the technical solution provided in step S208, the long short-term memory network in the two-layer model includes a bidirectional long short-term memory network composed of a forward long short-term memory network and a backward long short-term memory network, wherein the bidirectional long short-term memory network is used to simultaneously extract forward information and backward information.

[0092] Optionally, Fig.16 shows the schematic diagram of the bidirectional long short-term memory network (BiLSTM), Fig.17 The schematic diagram of the long short-term memory network LSTM is shown as Fig.16 and 17 As shown, forward and backward information can be extracted simultaneously. ω1 and ω2 belong to the weight vectors in the weight matrix in the forward layer, ω3 and ω5 belong to the weight vectors in the weight matrix in the backward layer, ω4 and ω6 belong to the weight vectors in the weight matrix in the output layer, and h t is the forward output, x t is the current input, h t-1 is the hidden state of the previous time step, h' t is the backward output, h' t+1 is the hidden state of the next time step, o t is the final output, w f is the weight matrix of the forget gate, b t is the bias, i t is the activation value of the input gate, is the candidate cell state, C t is the cell state at the current time step.

[0093] The calculation formulas for each layer are as follows:

[0094] For bidirectional LSTM networks:

[0095] h t =f(w1x t +w2h t-1 )

[0096] h' t =f(w3xt +w5h' t+1 )

[0097] o t =g(w4h t +w6h' t )

[0098] For LSTM networks:

[0099] f t =σ(w f x t +w t h t-1 +b t )

[0100] i t =σ(w i x t +w i h t-1 +b i )

[0101]

[0102]

[0103] o t =σ(W o x t +W o h t-1 +b o )

[0104] h t =o t tanh(c t )

[0105] By designing an effective model updating method and exploring the inductive preferences of the model after incremental updating, we further adjust the incremental model:

[0106]

[0107] in, is the loss function, which is used to measure the difference between the model prediction and the actual result, Y b-1 =Y0∪…Y b-1 refers to the set of all old categories, S k Represents the predicted probability of the kth class, which is obtained by processing the output of the model through the softmax function.

[0108] f (b-1) (x) refers to the model after training in the previous stage. The model parameters are frozen and not updated. Refers to the loss of the model on new tasks, which aims to help the model learn new categories. As a regularization loss, φ(x) is the feature extraction function of the model.

[0109] Since the old model f (b-1) (x) is obtained by training in the previous stage and can better reflect the characteristics of the old category. The new model f(x) outputs the same prediction results as the old model for the same sample. By aligning the prediction probabilities of the new and old models on the old category, the new model maintains the same discrimination ability as the old model on the old category, thereby resisting catastrophic forgetting.

[0110] In the technical solution provided in step S208, incremental training of the random domain name analysis model based on the random domain name feature set includes: determining the parameter value of the preset hyperparameter, wherein the parameter value of the preset hyperparameter is used to reflect the ratio between the new class knowledge learned by the random domain name analysis model during the incremental training and the old class knowledge learned before the training; incremental training of the random domain name analysis model based on the random domain name feature set and the preset hyperparameter.

[0111] Optionally, the hyperparameter λ is used to balance learning new classes and keeping old class knowledge. λ = 0 means that the model only focuses on how to learn new classes. In this case, the training will suffer from catastrophic forgetting. λ = 1 means that the model only considers keeping old class knowledge and cannot learn new class knowledge. Therefore, it is set It represents the ratio of the number of old classes to the number of new classes.

[0112] Optionally, Fig.18 and Fig.19 The overall process is shown as Fig.18 and 19 As shown, this method uses threat intelligence, large-scale Netflow, DNS resolution log and other data, based on language features such as domain name character type, structural features such as domain name length, domain name character entropy value statistical features, the geographic location of the IP returned by the domain name resolution, service port and time, domain name resolution NXDOMAIN, domain name resolution speed and other behavioral features, coupled with threat intelligence, innovative static and dynamic combination of multi-dimensional feature fusion, data deep mining, horizontal logical relationship mining, to achieve multi-dimensional feature mining and domain name behavior profiling. Based on autonomous incremental learning technology, innovative super-fusion analysis model, using the best sample incremental training for feature and model adaptation and tuning, to achieve dynamic detection and accurate identification of DGA domain names. It has the following main advantages:

[0113] 1: Using the DNS resolution log, threat intelligence, Netflow and other data of the big network, we can realize the multi-dimensional feature mining combining static and dynamic features such as user resolution domain name language, structure, statistics, behavior, threat intelligence, etc., and build a multi-dimensional domain name portrait. Innovative multi-dimensional mining of DGA domain name features: Based on language features such as domain name character type, structural features such as domain name length, statistical features of domain name character entropy value, geographic location of IP returned by domain name resolution, domain name resolution NXDOMAIN, behavioral features such as request domain name resolution speed, and threat intelligence, we innovate static and dynamic multi-dimensional feature fusion, deep feature synthesis, data deep mining, horizontal logical relationship, and contextual abnormal feature mining to realize multi-dimensional feature mining and DGA domain name portrait, maximize the retention of DGA domain name resolution behavior feature information, and solve the problem that manual feature analysis cannot discover group characteristics.

[0114] 2: Autonomous incremental learning super fusion analysis model, based on the multi-dimensional feature data of domain names, through autonomous incremental learning, using the best sample incremental training to perform feature, model adaptation and tuning, to achieve dynamic detection and accurate identification of DGA domain names. Use the primary model to comprehensively analyze and classify the probability relationship of DGA domain name resolution behavior, and use the prediction results and various features as the input of the secondary model. Combined with the basic data flow of the existing network, innovative autonomous incremental learning is used to achieve feature and fusion model adaptation and automatic tuning, to achieve dynamic detection and accurate identification of DGA domain name resolution behavior, and the effect is better than the general machine learning classification model, with an accuracy rate of 99.9%.

[0115] Optionally, Fig. 20 and Fig.21 The random domain name detection results and principles are shown, such as Fig. 20 and Fig.21 As shown in the figure, the domain name data is sequentially input into the embedding layer, the long short-term memory network layer, the fully connected layer, and the activation layer to output the prediction result.

[0116] Through the above steps, a random domain name detection method and device based on a random domain name analysis model can be implemented. Fig. 22 A random domain name detection result is shown, such as Fig.21 As shown in Figure 1, 984,377 positive samples (DGA domain names) and 1,265,290 negative samples (non-DGA domain names) were extracted from the DGA domain names reported by the threat intelligence and the competent authorities and the normal domain names used in the current network. The confusion matrix, accuracy and recall rate indicators obtained after classification and identification by the model algorithm are shown in Figure 1. Fig. 22 As shown, the model has high accuracy and recall values, and the model DGA domain name detection and recognition is accurate. The method of the embodiment of the present application can be applied to the detection of zombie worms and APT attacks in the province, and effectively detect and deal with threats. Specifically, the embodiment of the method of the present application has the following advantages:

[0117] (1) Development technology is easy to implement: Based on general big data development technology, it fully utilizes existing large-scale network resources, with zero device deployment and zero configuration on the user side, thus improving customer perception.

[0118] (2) The method is standardized and universal in the industry: It is applicable to the detection of common DGA domain names and APT attacks in the domestic operator industry, and supports rapid and accurate detection of DGA domain names and APT attacks under IPv6 network conditions.

[0119] (3) Under the existing public Internet network security threat management and critical period security environment, security products can be exported in the future to realize enterprise security income.

[0120] The present application embodiment provides a random domain name detection device, Fig.23 is a schematic diagram of the structure of the device, such as Fig.23 As shown, the device includes a first processing module 230, which is used to obtain threat intelligence data, traffic data of the communication network and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; a second processing module 232, which is used to establish a multi-dimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multi-dimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; a third processing module 234, which is used to determine a random domain name feature set based on the threat intelligence data and the multi-dimensional domain name portrait; a fourth processing module 236, which is used to perform incremental training on a random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name, and the random domain name model includes a basic model, and a two-layer model composed of a long short-term memory network and an attention mechanism connected to the basic model.

[0121] In some embodiments of the present application, a multidimensional domain name portrait includes a domain name language static feature portrait, a domain name structure feature portrait, a domain name statistical feature portrait, and a domain name behavior dynamic portrait; establishing a multidimensional domain name portrait based on traffic data and domain name system analysis log data includes: aggregating traffic data and domain name system analysis log data, and extracting static data features and dynamic data features of various domain names based on a preset random domain name set and a preset non-random domain name set during the aggregation process, wherein various domain names include random domain names and non-random domain names; establishing a domain name language static feature portrait based on language features in the static data features, wherein the language features include at least one of the following: the number of vowels, the number of The number of alphanumeric characters after the repetition; establishing a domain name structure feature portrait based on the language structure features in the static data features, wherein the language structure features include at least one of the following: domain name length, registration information; establishing a domain name statistical feature portrait based on the domain name statistical features in the static data features, wherein the domain name statistical features include at least one of the following: entropy of the domain name, hidden Markov model coefficient of the domain name, and Jaccard similarity coefficient of the domain name; establishing a domain name behavior dynamic portrait based on the domain name behavior dynamic features in the dynamic data features, wherein the domain name behavior dynamic features include at least one of the following: frequency of requesting domain name resolution, average outbound traffic, average return traffic, average outbound flow rate, and average return flow rate.

[0122] In some embodiments of the present application, determining a random domain name feature set based on threat intelligence data and a multidimensional domain name portrait includes: determining an initial feature set of the random domain name based on threat intelligence data and a multidimensional domain name portrait; determining an information gain index for each feature type in the initial feature set; screening each feature type based on the information gain index to obtain a preset number of feature types; and determining a random domain name feature set based on the preset number of feature types and the initial feature set.

[0123] In some embodiments of the present application, determining the information gain index of each feature type in the initial feature set includes: determining the total information entropy of the initial feature set; determining the sub-information entropy of each feature type; and determining the information gain index of each sub-feature type based on the total information entropy and the sub-information entropy of each sub-feature type.

[0124] In some embodiments of the present application, the basic model is used to perform classification prediction based on the probabilistic relationship between the domain name features of the domain name to be detected and the random domain name, so as to determine the predicted value of the domain name to be detected, and the two-layer model is used to output the prediction result of the domain name to be detected based on the predicted value, wherein the prediction result includes that the domain name to be detected is a random domain name, and that the domain name to be detected is a non-random domain name, and the domain name features include at least one of the following: static features, statistical features, structural features, and domain name resolution behavior features of the domain name, and the predicted value is used to reflect the predicted probability that the domain name to be detected is a random domain name.

[0125] In some embodiments of the present application, the long short-term memory network in the two-layer model includes a bidirectional long short-term memory network composed of a forward long short-term memory network and a backward long short-term memory network, wherein the bidirectional long short-term memory network is used to simultaneously extract forward information and backward information.

[0126] In some embodiments of the present application, incremental training of a random domain name analysis model based on a random domain name feature set includes: determining a parameter value of a preset hyperparameter, wherein the parameter value of the preset hyperparameter is used to reflect the ratio between new class knowledge learned by the random domain name analysis model during the incremental training and old class knowledge learned before training; incremental training of the random domain name analysis model based on the random domain name feature set and the preset hyperparameter.

[0127] It should be noted that each module in the above-mentioned random domain name detection can be a program module (for example, a set of program instructions that implement a certain specific function) or a hardware module. For the latter, it can be expressed in the following forms, but is not limited to this: each of the above-mentioned modules is expressed in the form of a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0128] An embodiment of the present application provides a non-volatile storage medium, in which a program is stored, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the following random domain name detection method: obtaining threat intelligence data, traffic data of a communication network, and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; establishing a multi-dimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multi-dimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; determining a random domain name feature set based on the threat intelligence data and the multi-dimensional domain name portrait; and incrementally training a random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model, and a two-layer model composed of a long short-term memory network and an attention mechanism connected to the basic model.

[0129] An embodiment of the present application provides an electronic device, including: a memory and a processor, the processor being used to run a program stored in the memory, wherein the following random domain name detection method is executed when the program is running: obtaining threat intelligence data, traffic data of a communication network, and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; establishing a multidimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multidimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; determining a random domain name feature set based on the threat intelligence data and the multidimensional domain name portrait; performing incremental training on a random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether a domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model, and a two-layer model connected to the basic model and consisting of a long short-term memory network and an attention mechanism.

[0130] An embodiment of the present application provides a computer program product, including a computer program, which implements the following random domain name detection method when executed by a processor: obtaining threat intelligence data, traffic data of a communication network, and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; establishing a multidimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multidimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; determining a random domain name feature set based on the threat intelligence data and the multidimensional domain name portrait; incrementally training a random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether a domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model, and a two-layer model connected to the basic model and composed of a long short-term memory network and an attention mechanism.

[0131] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0132] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0133] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0134] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0135] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the relevant technology or all or part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk, etc. Various media that can store program codes.

[0136] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A random domain name detection method, characterized in that: include: Acquire threat intelligence data, traffic data of a communication network, and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; Establishing a multi-dimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multi-dimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; Determining a random domain name feature set based on the threat intelligence data and the multi-dimensional domain name portrait; The random domain name analysis model is incrementally trained according to the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model and a two-layer model composed of a long short-term memory network and an attention mechanism connected to the basic model.

2. The random domain name detection method according to claim 1, characterized in that: The multi-dimensional domain name portrait includes a domain name language static feature portrait, a domain name structure feature portrait, a domain name statistical feature portrait, and a domain name behavior dynamic portrait; Establishing a multi-dimensional domain name profile based on the traffic data and the domain name system resolution log data includes: Aggregate the traffic data and the domain name system resolution log data, and extract static data features and dynamic data features of various domain names according to a preset random domain name set and a preset non-random domain name set during the aggregation process, wherein the various domain names include the random domain names and the non-random domain names; The domain name language static feature portrait is established based on the language features in the static data features, wherein the language features include at least one of the following: the number of vowels, the number of letters and numbers after deduplication; The domain name structure feature portrait is established based on the language structure feature in the static data feature, wherein the language structure feature includes at least one of the following: domain name length, registration information; The domain name statistical feature portrait is established according to the domain name statistical features in the static data features, wherein the domain name statistical features include at least one of the following: entropy of the domain name, hidden Markov model coefficient of the domain name, and Jaccard similarity coefficient of the domain name; The dynamic profile of domain name behavior is established based on the dynamic characteristics of domain name behavior in the dynamic data characteristics, wherein the dynamic characteristics of domain name behavior include at least one of the following: frequency of requesting domain name resolution, average outbound traffic, average return traffic, average outbound flow rate, and average return flow rate.

3. The random domain name detection method according to claim 1, characterized in that: Determining a random domain name feature set based on the threat intelligence data and the multi-dimensional domain name portrait includes: Determining an initial feature set of the random domain name based on the threat intelligence data and the multi-dimensional domain name portrait; Determining the information gain index of each feature type in the initial feature set; Screening each feature type according to the information gain index to obtain a preset number of feature types; The random domain name feature set is determined according to the preset number of feature types and the initial feature set.

4. The random domain name detection method according to claim 3, characterized in that: Determining the information gain index of each feature type in the initial feature set includes: Determining the total information entropy of the initial feature set; Determining the sub-information entropy of each feature type; According to the total information entropy and the sub-information entropy of each sub-feature type, an information gain index of each sub-feature type is determined.

5. The random domain name detection method according to claim 1, characterized in that: The basic model is used to perform classification prediction based on the probability relationship between the domain name features of the domain name to be detected and the random domain name, so as to determine the predicted value of the domain name to be detected. The two-layer model is used to output the prediction result of the domain name to be detected based on the predicted value, wherein the prediction result includes that the domain name to be detected is a random domain name, and that the domain name to be detected is a non-random domain name. The domain name features include at least one of the following: static features, statistical features, structural features, and domain name resolution behavior features of the domain name. The predicted value is used to reflect the predicted probability that the domain name to be detected is a random domain name.

6. The random domain name detection method according to claim 1, characterized in that: The long short-term memory network in the two-layer model includes a bidirectional long short-term memory network composed of a forward long short-term memory network and a backward long short-term memory network, wherein the bidirectional long short-term memory network is used to simultaneously extract forward information and backward information.

7. The random domain name detection method according to claim 1, characterized in that: Incrementally training the random domain name analysis model according to the random domain name feature set includes: Determine a parameter value of a preset hyperparameter, wherein the parameter value of the preset hyperparameter is used to reflect the ratio between the new class knowledge learned by the random domain name analysis model during the incremental training and the old class knowledge learned before the training; Incrementally train the random domain name analysis model according to the random domain name feature set and the preset hyperparameters.

8. A random domain name detection device, characterized in that: include: A first processing module is used to obtain threat intelligence data, traffic data of a communication network, and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; A second processing module is used to establish a multi-dimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multi-dimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; A third processing module is used to determine a random domain name feature set based on the threat intelligence data and the multi-dimensional domain name portrait; The fourth processing module is used to perform incremental training on the random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model and a two-layer model composed of a long short-term memory network and an attention mechanism connected to the basic model.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the random domain name detection method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is used to run a program stored in the memory, wherein the program executes the random domain name detection method according to any one of claims 1 to 7 when running.

11. A computer program product, characterized in that The invention comprises a computer program, which implements the random domain name detection method according to any one of claims 1 to 7 when being executed by a processor.

Images