Random domain name detection method and device, nonvolatile storage medium and electronic equipment

Abstract

The application discloses a random domain name detection method and device, a nonvolatile storage medium and an electronic device. The method comprises the following steps: obtaining threat intelligence data, traffic data of a communication network and domain name system resolution log data of the communication network; establishing a multidimensional domain name portrait according to the traffic data and the domain name system resolution log data; determining a random domain name feature set according to the threat intelligence data and the multidimensional domain name portrait; and performing incremental training on a random domain name analysis model according to the random domain name feature set, wherein the random domain name analysis model is used to determine whether a to-be-detected domain name is a random domain name, the random domain name analysis model comprises a basic model and a two-layer model composed of a long short-term memory network and an attention mechanism and connected with the basic model. The application solves the technical problem of low random domain name detection accuracy caused by the difficulty of determining random domain name features in the prior art.

Description

Technical Field

[0001] The present application relates to the field of network security, and more specifically, to a random domain name detection method, device, non-volatile storage medium, and electronic device. Background Art

[0002] As cyberattack techniques become increasingly sophisticated, DGA (Domain Generation Algorithm) is widely used by malware to dynamically generate large numbers of seemingly random domain names for communication with C2 (Command and Control) servers. This technique significantly reduces the effectiveness of traditional blacklist-based domain name detection methods, as it is difficult for defenders to predict and block all generated random domain names.

[0003] Existing DGA detection methods mostly rely on limited static features, such as domain name length and character composition, which are insufficient to cope with the flexibility and variability of DGA algorithms. Furthermore, given the stealthy and persistent nature of APT (Advanced Persistent Threat) attacks, traditional detection methods are often unable to accurately identify and respond to these threats in real time.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] The embodiments of the present application provide a random domain name detection method, apparatus, non-volatile storage medium, and electronic device to at least solve the technical problem of low random domain name detection accuracy caused by the difficulty in determining random domain name features in the prior art.

[0006] According to one aspect of an embodiment of the present application, a random domain name detection method is provided, comprising: obtaining threat intelligence data, traffic data of a communication network, and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; establishing a multidimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multidimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; determining a random domain name feature set based on the threat intelligence data and the multidimensional domain name portrait; and incrementally training a random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model, and a two-layer model connected to the basic model and consisting of a long short-term memory network and an attention mechanism.

[0007] Optionally, the multi-dimensional domain name portrait includes a domain name language static feature portrait, a domain name structure feature portrait, a domain name statistical feature portrait, and a domain name behavior dynamic portrait; establishing a multi-dimensional domain name portrait based on traffic data and domain name system resolution log data includes: aggregating traffic data and domain name system resolution log data, and extracting static data features and dynamic data features of various domain names based on a preset random domain name set and a preset non-random domain name set during the aggregation process, wherein various domain names include random domain names and non-random domain names; establishing a domain name language static feature portrait based on the language features in the static data features, wherein the language features include at least one of the following: the number of vowels, the number of letters after deduplication, the number of syllables, the number of syllables after deduplication ... The number of digits; establishing a domain name structure feature portrait based on the language structure features in the static data features, wherein the language structure features include at least one of the following: domain name length, registration information; establishing a domain name statistical feature portrait based on the domain name statistical features in the static data features, wherein the domain name statistical features include at least one of the following: entropy of the domain name, hidden Markov model coefficient of the domain name, and Jaccard similarity coefficient of the domain name; establishing a domain name behavior dynamic portrait based on the domain name behavior dynamic features in the dynamic data features, wherein the domain name behavior dynamic features include at least one of the following: frequency of requesting domain name resolution, average outbound traffic, average return traffic, average outbound flow rate, and average return flow rate.

[0008] Optionally, determining a random domain name feature set based on threat intelligence data and multi-dimensional domain name portraits includes: determining an initial feature set of the random domain name based on threat intelligence data and multi-dimensional domain name portraits; determining an information gain index for each feature type in the initial feature set; screening each feature type based on the information gain index to obtain a preset number of feature types; and determining a random domain name feature set based on the preset number of feature types and the initial feature set.

[0009] Optionally, determining the information gain index of each feature type in the initial feature set includes: determining the total information entropy of the initial feature set; determining the sub-information entropy of each feature type; and determining the information gain index of each sub-feature type based on the total information entropy and the sub-information entropy of each sub-feature type.

[0010] Optionally, the basic model is used to perform classification prediction based on the probabilistic relationship between the domain name features of the domain name to be detected and the random domain name, thereby determining the predicted value of the domain name to be detected, and the two-layer model is used to output the prediction result of the domain name to be detected based on the predicted value, wherein the prediction result includes that the domain name to be detected is a random domain name, and that the domain name to be detected is a non-random domain name, and the domain name features include at least one of the following: static features, statistical features, structural features, and domain name resolution behavior features of the domain name, and the predicted value is used to reflect the predicted probability that the domain name to be detected is a random domain name.

[0011] Optionally, the long short-term memory network in the two-layer model includes a bidirectional long short-term memory network consisting of a forward long short-term memory network and a backward long short-term memory network, wherein the bidirectional long short-term memory network is used to simultaneously extract forward information and backward information.

[0012] Optionally, performing incremental training on the random domain name analysis model based on the random domain name feature set includes: determining parameter values ​​of preset hyperparameters, wherein the parameter values ​​of the preset hyperparameters are used to reflect the ratio between the new class knowledge learned by the random domain name analysis model during the incremental training process and the old class knowledge learned before training; performing incremental training on the random domain name analysis model based on the random domain name feature set and the preset hyperparameters.

[0013] According to another aspect of an embodiment of the present application, a random domain name detection device is also provided, including: a first processing module, used to obtain threat intelligence data, traffic data of a communication network, and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; a second processing module, used to establish a multidimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multidimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; a third processing module, used to determine a random domain name feature set based on the threat intelligence data and the multidimensional domain name portrait; a fourth processing module, used to perform incremental training on a random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name, and the random domain name model includes a basic model, and a two-layer model connected to the basic model consisting of a long short-term memory network and an attention mechanism.

[0014] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, in which a program is stored. When the program is running, the device where the non-volatile storage medium is located is controlled to execute the random domain name detection method.

[0015] According to another aspect of an embodiment of the present application, an electronic device is provided, including: a memory and a processor, wherein the processor is configured to run a program stored in the memory, wherein the random domain name detection method is executed when the program is run.

[0016] According to another aspect of an embodiment of the present application, a computer program product is provided, including a computer program, which implements a random domain name detection method when executed by a processor.

[0017] In an embodiment of the present application, threat intelligence data, traffic data of a communication network, and domain name system resolution log data of a communication network are obtained, wherein the threat intelligence data includes random domain name information, as well as attack behavior information and IP address information associated with the random domain name information; a multidimensional domain name portrait is established based on the traffic data and the domain name system resolution log data, wherein the multidimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; a random domain name feature set is determined based on the threat intelligence data and the multidimensional domain name portrait; a random domain name analysis model is incrementally trained based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model and a two-layer model composed of a long short-term memory network and an attention mechanism connected to the basic model. By collecting and obtaining threat intelligence data, traffic data of a communication network, and domain name system resolution log data of a communication network, a random domain name feature set training model is determined, and whether the domain name to be detected is a random domain name is determined based on the model, the purpose of accurately determining the characteristics of the random domain name is achieved, thereby achieving the technical effect of timely and effective detection of random domain names, and further solving the technical problem of low accuracy in random domain name detection caused by the difficulty in determining the characteristics of random domain names in the existing technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 This is a schematic diagram of the structure of a computer terminal (mobile device) provided according to an embodiment of the present application;

[0020] Figure 2 This is a flow chart of a random domain name detection method provided according to an embodiment of the present application;

[0021] Figure 3 This is a schematic diagram of a threat intelligence data acquisition method provided in accordance with an embodiment of the present application;

[0022] Figure 4 This is a schematic diagram of a network framework provided according to an embodiment of the present application;

[0023] Figure 5 This is a schematic diagram of domain name system resolution log data provided according to an embodiment of the present application;

[0024] Figure 6 This is a flow chart of establishing a multi-dimensional domain name portrait according to an embodiment of the present application;

[0025] Figure 7This is a schematic diagram of a domain name profiling result provided according to an embodiment of the present application;

[0026] Figure 8 This is a schematic diagram of a domain name profiling result provided according to an embodiment of the present application;

[0027] Figure 9 This is a schematic diagram of domain name registration information provided according to an embodiment of the present application;

[0028] Figure 10 This is a schematic diagram of a profile result based on statistical characteristics provided in an embodiment of the present application;

[0029] Figure 11 This is a schematic diagram of a profile result based on statistical characteristics provided in an embodiment of the present application;

[0030] Figure 12 This is a schematic diagram of a domain name behavior dynamic profiling result provided according to an embodiment of the present application;

[0031] Figure 13 is a schematic diagram of an initial feature set provided according to an embodiment of the present application;

[0032] Figure 14 is a schematic diagram of a feature subset selection method provided according to an embodiment of the present application;

[0033] Figure 15 This is a schematic diagram of a framework of a random domain name analysis model provided according to an embodiment of the present application;

[0034] Figure 16 1 is a schematic diagram of the principle of a bidirectional long short-term memory network provided according to an embodiment of the present application;

[0035] Figure 17 1 is a schematic diagram of the principle of a long short-term memory network provided according to an embodiment of the present application;

[0036] Figure 18 This is a schematic diagram of an overall process of random domain name detection provided according to an embodiment of the present application;

[0037] Figure 19 This is a schematic diagram of an overall process of random domain name detection provided according to an embodiment of the present application;

[0038] Figure 20 This is a schematic diagram of a random domain name detection result provided according to an embodiment of the present application;

[0039] Figure 21 This is a schematic diagram of a random domain name detection principle provided according to an embodiment of the present application;

[0040] Figure 22is a schematic diagram of a random domain name detection result provided according to an embodiment of the present application;

[0041] Figure 23 4 is a structural diagram of a random domain name detection device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0043] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0044] In order to better understand the embodiments of the present application, the technical terms involved in the embodiments of the present application are explained as follows:

[0045] DGA (Domain Generation Algorithm): A domain name generated using a certain algorithm using random characters, time, dictionary, hard coding, etc.

[0046] APT (Advanced Persistent Threat): also known as advanced persistent threat, advanced persistent threat, etc., refers to a hidden and persistent computer intrusion process, usually carefully planned by certain personnel and targeting specific targets.

[0047] NetFlow: is a widely used traffic data statistics standard used to monitor and record all traffic in and out of interfaces.

[0048] DNS (Domain Name System): A distributed database on the Internet that maps domain names to IP addresses, allowing users to access the Internet more conveniently without having to remember IP addresses that can be read directly by machines.

[0049] NXDOMAIN (Non-Existent Domain, rcode=3): is a special response type, indicating that the queried domain name does not exist in the DNS database.

[0050] The DGA algorithm consists of two parts: a seed (algorithm input) and an algorithm. Algorithms are generally based on hashing, arithmetic, dictionaries, and permutations and combinations. The DGA domain name communication principle is that the client generates a large number of candidate random domain names through the DGA algorithm and queries them through a domain name server. The attacker and malware run the same DGA algorithm to generate the same list of candidate domain names. When the attack is ready, a small number of these domain names are selected for registration, allowing the client malware to establish communication with the C2 server.

[0051] Existing DGA detection methods mostly rely on limited static features, such as domain name length and character composition, which are insufficient to cope with the flexibility and variability of DGA algorithms. Furthermore, given the stealthy and persistent nature of APT (Advanced Persistent Threat) attacks, traditional detection methods are often unable to accurately identify and respond to these threats in real time.

[0052] In addition, with the explosive growth of network traffic, especially in carrier networks, traditional traffic analysis and threat detection methods are becoming increasingly difficult to process massive Netflow data and DNS resolution logs, making it difficult to detect potential DGA domain names and APT activities in a timely manner.

[0053] Specifically, existing random domain name detection methods have the following problems:

[0054] 1. The random domain names generated by DGA are difficult to predict, making traditional rule-based detection methods ineffective.

[0055] 2. Random domain names generated by DGA have diverse language, structural, statistical, and behavioral characteristics, which are difficult to fully cover with a single detection method.

[0056] 3. In large-scale network environments, the amount of Netflow data and DNS resolution records is huge, posing a challenge to real-time analysis and processing.

[0057] 4. The long-term and covert nature of APT attacks requires detection systems to have higher intelligence and adaptability.

[0058] In order to solve the above problems, relevant solutions are provided in the embodiments of the present application, which are described in detail below.

[0059] According to an embodiment of the present application, a method embodiment of a random domain name detection method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0060] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal (or mobile device) for implementing a random domain name detection method. Figure 1 As shown, the computer terminal 10 (or mobile device 10) may include one or more (illustrated as 102a, 102b, ..., 102n) processors 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0061] It should be noted that the one or more processors 102 and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuitry may be a single independent processing module, or may be incorporated in whole or in part into any of the other components of the computer terminal 10 (or mobile device). As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0062] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the random domain name detection method in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implementing the above-mentioned random domain name detection method. The memory 104 may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0063] The transmission device 106 is configured to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by the communications provider of the computer terminal 10. In one embodiment, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, the transmission device 106 may be a radio frequency (RF) module, which is configured to communicate with the Internet wirelessly.

[0064] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 (or mobile device).

[0065] In the above operating environment, the embodiment of the present application provides a random domain name detection method, such as Figure 2 As shown, the method includes the following steps:

[0066] Step S202: Acquire threat intelligence data, traffic data of the communication network, and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information.

[0067] Optionally, Figure 3 The following shows how threat intelligence data is obtained: Figure 3As shown in the figure, the detection system works in conjunction with the threat intelligence center to collect threat intelligence on DGA domain names and DGA C2 IP addresses across the entire network. When DGA behavior is detected, the system automatically detects the DGA domain name and resolves the IP address, extracts important information for retention, and adds the domain name to the reputation list, enabling the continuous updating and expansion of the DGA domain name and C2 IP database. The system also generates a network threat intelligence report on the DGA domain name resolution and C2 server IP address, as well as a table of local DGA domain name threat intelligence. The table stores suspicious DGA domain names (i.e., random domain name information), the corresponding family, the C2 server IP address (i.e., the attack behavior information and IP address information associated with the random domain name information), and the source of the intelligence.

[0068] Optionally, Figure 4 A network framework diagram is shown, such as Figure 4 As shown in FIG, traffic data of the communication network is collected at a sampling ratio of 5000:1 on the backbone network and the metropolitan area network CR.

[0069] Optionally, on the telecommunications side, that is, on the infrastructure of the network operator, the domain name system resolution logs of the entire communication network are carefully recorded and collected. Figure 5 shows the DNS resolution log data, such as Figure 5 As shown, the DNS resolution log (i.e., domain name system resolution log) contains detailed information about each DNS query, including but not limited to the client IP, resolved domain name, resolution type, resolution time, resolution IP address, returned resolution result, and source port.

[0070] Step S204: establishing a multi-dimensional domain name portrait based on traffic data and domain name system parsing log data, wherein the multi-dimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions.

[0071] Optionally, Figure 6 A flowchart of establishing a multi-dimensional domain name portrait is shown. Figure 6 As shown, combining large-scale DNS resolution logs (i.e., domain name system resolution log data) and Netflow data (i.e., traffic data), the data is preprocessed and aggregated, and then static data features and dynamic behavior features are extracted to build a multidimensional domain name profile. Preprocessing includes cleaning illegal and abnormal data, deduplicating records, and standardizing them. Features extracted through data feature engineering include: domain name registration information, registration organization, DNS record type, domain name resolution IP address ownership, resolution IP open ports, domain name vowel sequence, domain name entropy, special characters, NXDOMAIN, and upstream and downstream traffic.

[0072] In the technical solution provided in step S204, the multi-dimensional domain name portrait includes a domain name language static feature portrait, a domain name structure feature portrait, a domain name statistical feature portrait, and a domain name behavior dynamic portrait; establishing a multi-dimensional domain name portrait based on traffic data and domain name system parsing log data includes: aggregating traffic data and domain name system parsing log data, and extracting static data features and dynamic data features of various domain names based on a preset random domain name set and a preset non-random domain name set during the aggregation process, wherein various domain names include random domain names and non-random domain names; establishing a domain name language static feature portrait based on the language features in the static data features, wherein the language features include at least one of the following: the number of vowels , the number of letters and digits after deduplication; establish a domain name structure feature portrait based on the language structure features in the static data features, wherein the language structure features include at least one of the following: domain name length, registration information; establish a domain name statistical feature portrait based on the domain name statistical features in the static data features, wherein the domain name statistical features include at least one of the following: entropy of the domain name, hidden Markov model coefficient of the domain name, and Jaccard similarity coefficient of the domain name; establish a domain name behavior dynamic portrait based on the domain name behavior dynamic features in the dynamic data features, wherein the domain name behavior dynamic features include at least one of the following: frequency of requesting domain name resolution, average outbound traffic, average return traffic, average outbound flow rate, and average return flow rate.

[0073] Optionally, constructing a static feature profile of the domain name language includes profiling language features such as the number of vowels in the domain name, the number of letters and numbers after deduplication, and the length of characters. The common dga_post-tovar-goz and dga_cryptolock zombie family DGA domain names (i.e., a preset random domain name set) and normal TOP1000 domain names (i.e., a preset non-random domain name set) are used for profiling. Figure 7 and Figure 8 The results of profiling the domain name are shown, such as Figure 7 and Figure 8 As shown, DGA domain names have obvious aggregation effects and are clearly distinguished from normal domain names.

[0074] Optionally, constructing a domain name structure feature profile includes profiling the domain name length, registration agency, registration country and other registration information. Figure 9 Domain name registration information is displayed, and a domain name length portrait result is shown.

[0075] Optionally, constructing a domain name statistical feature portrait includes profiling statistical characteristics such as the entropy of the domain name, the hidden Markov model coefficient of the domain name, and the Jaccard similarity coefficient of the domain name. Figure 10 The results of profiling based on statistical characteristics are shown.

[0076] Optionally, building a dynamic profile of domain name behavior includes a NetFlow flow profile for domain name resolution from the host to the domain name server, including the frequency of domain name resolution requests, average outbound traffic, average return traffic, average outbound flow rate, and average return flow rate. Figure 11 The results of a packet size and traffic profile are shown.

[0077] Optionally, building a dynamic profile of domain name behavior includes statistical profiling of the number and time it takes for a host to resolve a DGA domain name to a domain name resolution server. Profiling the number of IP addresses accessing the DGA domain name from a macro-network perspective. Profiling customers based on dimensions such as the access carrier, location, and geographic location of the destination IP address. Profiling customer access applications based on the domain name and registrar information. Figure 12 The figure shows the result of a dynamic profiling of domain name behavior.

[0078] Step S206: Determine a random domain name feature set based on threat intelligence data and multi-dimensional domain name portraits.

[0079] In the technical solution provided in step S206, determining the feature set of a random domain name based on threat intelligence data and a multi-dimensional domain name portrait includes: determining the initial feature set of the random domain name based on the threat intelligence data and the multi-dimensional domain name portrait; determining the information gain index of each feature type in the initial feature set; screening each feature type based on the information gain index to obtain a preset number of feature types; and determining the feature set of the random domain name based on the preset number of feature types and the initial feature set.

[0080] Optionally, Figure 13 The figure shows a 44-dimensional initial feature set determined by feature engineering based on the static characteristics of domain names and dynamic characteristics of domain name resolution behavior, coupled with threat intelligence and user portraits.

[0081] In the technical solution provided in step S206, determining the information gain index of each feature type in the initial feature set includes: determining the total information entropy of the initial feature set; determining the sub-information entropy of each feature type; and determining the information gain index of each sub-feature type based on the total information entropy and the sub-information entropy of each sub-feature type.

[0082] Optionally, the information gain of all attributes is calculated, and the top 20 (i.e., a preset number) dimensions with the largest information gain are selected as the feature subset of the algorithm model. Figure 14 The feature subset selection method based on information gain metric is shown, as Figure 14 As shown, the method steps are as follows:

[0083] 1. Calculate the total information entropy of a given sample Among them, P i Any sample belongs to C iThe probability of i / s estimated, where s i Indicates that it belongs to category C i The number of samples, s represents the total number of samples, C i represents the i-th category.

[0084] 2. Calculate the information entropy of each attribute in is a subset S j The middle category is C i The probability of the sample, k is the total number of samples, subset S j is a sample subset divided according to different values ​​of attribute A, s mj Under the j-th value of attribute A, it belongs to category C m The number of samples.

[0085] 3. Calculate the information gain of each attribute Gain(A)=I(s1,s2,…,s m )-E(A).

[0086] Obviously, the smaller E(A) is, the larger the value of Gain(A) is, which means that the selection of test attribute A provides more information for classification, and the smaller the degree of uncertainty in classification after selecting A.

[0087] 4. Select the top 20 (preset number) dimensions with the largest information gain as the feature subset, output the training samples, and retain the feature information and feature values ​​corresponding to the screened feature types.

[0088] Step S208: Incrementally train the random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name. The random domain name analysis model includes a basic model and a two-layer model connected to the basic model, which is composed of a long short-term memory network and an attention mechanism.

[0089] In the technical solution provided in step S208, the basic model is used to perform classification prediction based on the probabilistic relationship between the domain name features of the domain name to be detected and the random domain name, thereby determining the predicted value of the domain name to be detected, and the two-layer model is used to output the prediction result of the domain name to be detected based on the predicted value, wherein the prediction result includes that the domain name to be detected is a random domain name, and that the domain name to be detected is a non-random domain name, the domain name features include at least one of the following: static features, statistical features, structural features, and domain name resolution behavior features of the domain name, and the predicted value is used to reflect the predicted probability that the domain name to be detected is a random domain name.

[0090] Optionally, Figure 15 A framework diagram of a random domain name analysis model is shown, such as Figure 15As shown, the random domain name analysis model utilizes a hierarchical system and incremental learning technologies. The basic model performs classification predictions based on the probabilistic relationship between the static, statistical, and structural characteristics of a domain name, domain name resolution behavior, and the DGA. The basic model uses 5-fold cross-validation, with 4-fold of the training set used as training data and the remaining 1-fold used as test data. Each cross-validation step uses the model generated from the training data to predict the test data, and the predictions are concatenated to form the training set for the second-layer model. The second-layer model utilizes a bidirectional long short-term memory (BiLSTM) network and an attention mechanism (ATT) along with incremental learning to achieve adaptive and automatic adjustment of features and fusion models.

[0091] In the technical solution provided in step S208, the long short-term memory network in the two-layer model includes a bidirectional long short-term memory network composed of a forward long short-term memory network and a backward long short-term memory network, wherein the bidirectional long short-term memory network is used to simultaneously extract forward information and backward information.

[0092] Optionally, Figure 16 shows the schematic diagram of the bidirectional long short-term memory network (BiLSTM), Figure 17 The schematic diagram of the long short-term memory network LSTM is shown as Figure 16 and 17 As shown, forward and backward information can be extracted at the same time. ω1 and ω2 belong to the weight vectors in the weight matrix of the forward layer, ω3 and ω5 belong to the weight vectors in the weight matrix of the backward layer, ω4 and ω6 belong to the weight vectors in the weight matrix of the output layer, h t is the forward output, x t is the current input, h t-1 is the hidden state of the previous time step, h' t is the backward output, h' t+1 is the hidden state of the next time step, o t is the final output, w f is the weight matrix of the forget gate, b t is the bias, i t is the activation value of the input gate, is the candidate cell state, C t is the cell state at the current time step.

[0093] The calculation formulas for each layer are as follows:

[0094] For bidirectional LSTM networks:

[0095] h t =f(w1x t +w2h t-1 )

[0096] h' t =f(w3xt +w5h' t+1 )

[0097] o t =g(w4h t +w6h' t )

[0098] For LSTM networks:

[0099] f t =σ(w f x t +w t h t-1 +b t )

[0100] i t =σ(w i x t +w i h t-1 +b i )

[0101]

[0102]

[0103] o t =σ(W o x t +W o h t-1 +b o )

[0104] h t =o t tanh(c t )

[0105] By designing an effective model update method and exploring the inductive preferences of the model after incremental updates, we can further adjust the incremental model:

[0106]

[0107] in, is the loss function, which is used to measure the difference between the model prediction and the actual result, Y b-1 =Y0∪…Y b-1 Refers to the set of all old categories, S k Represents the predicted probability of the kth class, which is obtained by processing the output of the model through the softmax function.

[0108] f (b-1) (x) refers to the model after training in the previous stage. The model parameters are frozen and not updated. Refers to the loss of the model on new tasks, which aims to help the model learn new categories. As the regularization loss, φ(x) is the feature extraction function of the model.

[0109] Since the old model f (b-1) (x) is obtained from training in the previous stage and can better reflect the characteristics of the old category. The new model f(x) outputs the same prediction results as the old model for the same sample. By aligning the prediction probabilities of the new and old models on the old category, the new model maintains the same discriminative ability as the old model on the old category, thus resisting catastrophic forgetting.

[0110] In the technical solution provided in step S208, incremental training of the random domain name analysis model based on the random domain name feature set includes: determining the parameter value of the preset hyperparameter, wherein the parameter value of the preset hyperparameter is used to reflect the ratio between the new class knowledge learned by the random domain name analysis model during the incremental training process and the old class knowledge learned before training; incremental training of the random domain name analysis model based on the random domain name feature set and the preset hyperparameter.

[0111] Optionally, the hyperparameter λ is used to balance learning new classes and retaining old class knowledge. λ = 0 indicates that the model only focuses on learning new classes. In this case, training will suffer from catastrophic forgetting. λ = 1 means that the model only considers retaining old class knowledge and cannot learn new class knowledge. Therefore, setting It represents the ratio of the number of old classes to the number of new classes.

[0112] Optionally, Figure 18 and Figure 19 The overall process is shown as Figure 18 and 19 As shown, this method utilizes threat intelligence, large-scale Netflow, DNS resolution logs and other data, based on language features such as domain name character type, structural features such as domain name length, domain name character entropy statistical features, geographic location of the IP returned by domain name resolution, service port and time, domain name resolution NXDOMAIN, and behavioral features such as the speed of requesting domain name resolution. It couples threat intelligence and innovates static and dynamic multi-dimensional feature fusion, deep data mining, and horizontal logical relationship mining to achieve multi-dimensional feature mining and domain name behavior profiling. Based on autonomous incremental learning technology, an innovative super-fusion analysis model is used, and the best sample incremental training is used for feature and model adaptation and optimization to achieve dynamic detection and accurate identification of DGA domain names. It has the following main advantages:

[0113] 1: Leveraging large-scale DNS resolution logs, threat intelligence, Netflow, and other data, we implement multi-dimensional feature mining that combines static and dynamic features such as the language, structure, statistics, behavior, and threat intelligence of user-resolved domain names, thereby constructing a multi-dimensional domain name portrait. Innovative multi-dimensional mining of DGA domain name features: Based on language features such as the type of domain name characters, structural features such as domain name length, statistical features of domain name character entropy, the geographic location of the IP address returned by domain name resolution, behavioral features such as NXDOMAIN in domain name resolution, and the speed of domain name resolution requests, as well as threat intelligence, we innovate static and dynamic multi-dimensional feature fusion, deep feature synthesis, deep data mining, horizontal logical relationships, and contextual anomaly feature mining to achieve multi-dimensional feature mining and DGA domain name portraits. This maximizes the amount of information retained about DGA domain name resolution behavior features, resolving the problem of manual feature analysis failing to identify group characteristics.

[0114] 2. The autonomous incremental learning super-convergent analysis model, based on multi-dimensional domain name feature data, uses autonomous incremental learning and optimal sample incremental training to perform feature and model adaptation and optimization, enabling dynamic detection and accurate identification of DGA domain names. A primary model comprehensively analyzes and classifies the probabilistic relationship between DGA domain name resolution behavior. The prediction results and various features serve as inputs for a secondary model. Combined with the existing network's basic data stream, innovative autonomous incremental learning achieves feature and fusion model adaptation and automatic optimization, enabling dynamic detection and accurate identification of DGA domain name resolution behavior. This performance outperforms typical machine learning classification models, with an accuracy rate of 99.9%.

[0115] Optionally, Figure 20 and Figure 21 The random domain name detection results and principles are shown, such as Figure 20 and Figure 21 As shown in the figure, the domain name data is sequentially input into the embedding layer, the long short-term memory network layer, the fully connected layer, and the activation layer to output the prediction result.

[0116] Through the above steps, a random domain name detection method and device based on a random domain name analysis model can be implemented. Figure 22 A random domain name detection result is shown, such as Figure 21 As shown in Figure 2, 984,377 positive samples (DGA domain names) and 1,265,290 negative samples (non-DGA domain names) were extracted from threat intelligence and DGA domain names reported by the competent authorities and normal domain names used in the current network. The confusion matrix, precision and recall rate indicators obtained after classification and identification by the model algorithm are shown in Figure 2. Figure 22 As shown, this model has high accuracy and recall values, and the model accurately detects and identifies DGA domain names. The method of the embodiment of the present application can be applied to detect botnets and APT attacks within the province, effectively detecting and handling threats. Specifically, the embodiment of the method of the present application has the following advantages:

[0117] (1) Development technology is easy to implement: Based on general big data development technology, it fully utilizes existing large network resources, with zero device deployment and zero configuration on the user side, thus improving customer perception.

[0118] (2) The method is standardized and universal in the industry: It is applicable to the detection of common DGA domain names, APT attacks, etc. in the domestic operator industry, and supports rapid and accurate detection of DGA domain names, APT attacks, etc. under IPv6 network conditions.

[0119] (3) Under the existing public Internet network security threat management and critical period security environment, security products can be exported in the future to realize enterprise security income.

[0120] The embodiment of the present application provides a random domain name detection device, Figure 23 is a structural diagram of the device, such as Figure 23 As shown, the device includes a first processing module 230, which is used to obtain threat intelligence data, traffic data of the communication network and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; a second processing module 232, which is used to establish a multidimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multidimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; a third processing module 234, which is used to determine a random domain name feature set based on the threat intelligence data and the multidimensional domain name portrait; a fourth processing module 236, which is used to perform incremental training on a random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name, and the random domain name model includes a basic model and a two-layer model composed of a long short-term memory network and an attention mechanism connected to the basic model.

[0121] In some embodiments of the present application, a multi-dimensional domain name portrait includes a domain name language static feature portrait, a domain name structure feature portrait, a domain name statistical feature portrait, and a domain name behavior dynamic portrait; establishing a multi-dimensional domain name portrait based on traffic data and domain name system parsing log data includes: aggregating traffic data and domain name system parsing log data, and extracting static data features and dynamic data features of various domain names based on a preset random domain name set and a preset non-random domain name set during the aggregation process, wherein various domain names include random domain names and non-random domain names; establishing a domain name language static feature portrait based on the language features in the static data features, wherein the language features include at least one of the following: the number of vowels, the number of The number of repeated letters and digits; establishing a domain name structure feature portrait based on the language structure features in the static data features, wherein the language structure features include at least one of the following: domain name length, registration information; establishing a domain name statistical feature portrait based on the domain name statistical features in the static data features, wherein the domain name statistical features include at least one of the following: entropy of the domain name, hidden Markov model coefficient of the domain name, and Jaccard similarity coefficient of the domain name; establishing a domain name behavior dynamic portrait based on the domain name behavior dynamic features in the dynamic data features, wherein the domain name behavior dynamic features include at least one of the following: frequency of requesting domain name resolution, average outbound traffic, average return traffic, average outbound flow rate, and average return flow rate.

[0122] In some embodiments of the present application, determining a random domain name feature set based on threat intelligence data and a multidimensional domain name portrait includes: determining an initial feature set of the random domain name based on threat intelligence data and a multidimensional domain name portrait; determining an information gain index for each feature type in the initial feature set; screening each feature type based on the information gain index to obtain a preset number of feature types; and determining a random domain name feature set based on the preset number of feature types and the initial feature set.

[0123] In some embodiments of the present application, determining the information gain index of each feature type in the initial feature set includes: determining the total information entropy of the initial feature set; determining the sub-information entropy of each feature type; and determining the information gain index of each sub-feature type based on the total information entropy and the sub-information entropy of each sub-feature type.

[0124] In some embodiments of the present application, the basic model is used to perform classification prediction based on the probabilistic relationship between the domain name features of the domain name to be detected and the random domain name, thereby determining the predicted value of the domain name to be detected, and the two-layer model is used to output the prediction result of the domain name to be detected based on the predicted value, wherein the prediction result includes that the domain name to be detected is a random domain name, and that the domain name to be detected is a non-random domain name, the domain name features include at least one of the following: static features, statistical features, structural features, and domain name resolution behavior features of the domain name, and the predicted value is used to reflect the predicted probability that the domain name to be detected is a random domain name.

[0125] In some embodiments of the present application, the long short-term memory network in the two-layer model includes a bidirectional long short-term memory network consisting of a forward long short-term memory network and a backward long short-term memory network, wherein the bidirectional long short-term memory network is used to simultaneously extract forward information and backward information.

[0126] In some embodiments of the present application, incremental training of a random domain name analysis model based on a random domain name feature set includes: determining parameter values ​​of preset hyperparameters, wherein the parameter values ​​of the preset hyperparameters are used to reflect the ratio between the new class knowledge learned by the random domain name analysis model during the incremental training process and the old class knowledge learned before training; and incremental training of the random domain name analysis model based on the random domain name feature set and the preset hyperparameters.

[0127] It should be noted that the various modules in the above-mentioned random domain name detection can be program modules (for example, a set of program instructions that implement a certain specific function) or hardware modules. For the latter, it can be expressed in the following forms, but is not limited to this: the expression form of each of the above-mentioned modules is a processor, or the functions of each of the above-mentioned modules are implemented by a processor.

[0128] An embodiment of the present application provides a non-volatile storage medium, in which a program is stored, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the following random domain name detection method: obtaining threat intelligence data, traffic data of a communication network and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; establishing a multi-dimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multi-dimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; determining a random domain name feature set based on the threat intelligence data and the multi-dimensional domain name portrait; performing incremental training on a random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model and a two-layer model connected to the basic model and composed of a long short-term memory network and an attention mechanism.

[0129] An embodiment of the present application provides an electronic device, comprising: a memory and a processor, the processor being configured to run a program stored in the memory, wherein the following random domain name detection method is executed when the program is run: obtaining threat intelligence data, traffic data of a communication network, and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; establishing a multidimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multidimensional domain name portrait is configured to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; determining a random domain name feature set based on the threat intelligence data and the multidimensional domain name portrait; and incrementally training a random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is configured to determine whether the domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model, and a two-layer model connected to the basic model and consisting of a long short-term memory network and an attention mechanism.

[0130] An embodiment of the present application provides a computer program product, including a computer program, which implements the following random domain name detection method when executed by a processor: obtaining threat intelligence data, traffic data of a communication network, and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; establishing a multidimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multidimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; determining a random domain name feature set based on the threat intelligence data and the multidimensional domain name portrait; and incrementally training a random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model and a two-layer model connected to the basic model and composed of a long short-term memory network and an attention mechanism.

[0131] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0132] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0133] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0134] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0135] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the relevant technology or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0136] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A random domain name detection method, characterized in that: include: Obtaining threat intelligence data, traffic data of a communication network, and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; Establishing a multi-dimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multi-dimensional domain name portrait is used to reflect the characteristics of random domain names and non-random domain names in multiple dimensions; Determining a random domain name feature set based on the threat intelligence data and the multi-dimensional domain name portrait; The random domain name analysis model is incrementally trained based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model and a two-layer model composed of a long short-term memory network and an attention mechanism connected to the basic model.

2. The random domain name detection method according to claim 1, characterized in that: The multi-dimensional domain name portrait includes a domain name language static feature portrait, a domain name structure feature portrait, a domain name statistical feature portrait, and a domain name behavior dynamic portrait; Establishing a multi-dimensional domain name profile based on the traffic data and the domain name system resolution log data includes: aggregating the traffic data and the domain name system resolution log data, and extracting static data features and dynamic data features of various domain names based on a preset set of random domain names and a preset set of non-random domain names during the aggregation process, wherein the various domain names include the random domain names and the non-random domain names; The domain name language static feature portrait is established based on the language features in the static data features, wherein the language features include at least one of the following: the number of vowels, the number of letters and numbers after deduplication; The domain name structure feature portrait is established based on the language structure feature in the static data feature, wherein the language structure feature includes at least one of the following: domain name length, registration information; Establishing the domain name statistical feature portrait based on the domain name statistical features in the static data features, wherein the domain name statistical features include at least one of the following: entropy of the domain name, hidden Markov model coefficient of the domain name, and Jaccard similarity coefficient of the domain name; The domain name behavior dynamic portrait is established based on the domain name behavior dynamic characteristics in the dynamic data characteristics, wherein the domain name behavior dynamic characteristics include at least one of the following: frequency of requesting domain name resolution, average outbound traffic, average return traffic, average outbound flow rate, and average return flow rate.

3. The random domain name detection method according to claim 1, characterized in that: Determining a random domain name feature set based on the threat intelligence data and the multi-dimensional domain name portrait includes: Determining an initial feature set for the random domain name based on the threat intelligence data and the multi-dimensional domain name portrait; Determining an information gain index for each feature type in the initial feature set; Screening each feature type according to the information gain index to obtain a preset number of feature types; The random domain name feature set is determined according to the preset number of feature types and the initial feature set.

4. The random domain name detection method according to claim 3, characterized in that: Determining the information gain index of each feature type in the initial feature set includes: Determining the total information entropy of the initial feature set; Determining the sub-information entropy of each feature type; An information gain index of each sub-feature type is determined according to the total information entropy and the sub-information entropy of each sub-feature type.

5. The random domain name detection method according to claim 1, characterized in that: The basic model is used to perform classification prediction based on the probabilistic relationship between the domain name features of the domain name to be detected and the random domain name, thereby determining the predicted value of the domain name to be detected. The two-layer model is used to output the prediction result of the domain name to be detected based on the predicted value, wherein the prediction result includes that the domain name to be detected is a random domain name and that the domain name to be detected is a non-random domain name. The domain name features include at least one of the following: static features, statistical features, structural features, and domain name resolution behavior features of the domain name. The predicted value is used to reflect the predicted probability that the domain name to be detected is a random domain name.

6. The random domain name detection method according to claim 1, wherein: The long short-term memory network in the two-layer model includes a bidirectional long short-term memory network consisting of a forward long short-term memory network and a backward long short-term memory network, wherein the bidirectional long short-term memory network is used to simultaneously extract forward information and backward information.

7. The random domain name detection method according to claim 1, characterized in that: Incrementally training the random domain name analysis model based on the random domain name feature set includes: Determining a parameter value of a preset hyperparameter, wherein the parameter value of the preset hyperparameter is used to reflect the ratio between the new class knowledge learned by the random domain name analysis model during the incremental training process and the old class knowledge learned before the training; Incremental training is performed on the random domain name analysis model based on the random domain name feature set and the preset hyperparameters.

8. A random domain name detection device, characterized in that: include: a first processing module, configured to obtain threat intelligence data, traffic data of a communication network, and domain name system resolution log data of the communication network, wherein the threat intelligence data includes random domain name information, and attack behavior information and IP address information associated with the random domain name information; a second processing module, configured to create a multi-dimensional domain name portrait based on the traffic data and the domain name system resolution log data, wherein the multi-dimensional domain name portrait is configured to reflect characteristics of random domain names and non-random domain names in multiple dimensions; A third processing module is configured to determine a random domain name feature set based on the threat intelligence data and the multi-dimensional domain name portrait; The fourth processing module is used to incrementally train the random domain name analysis model based on the random domain name feature set, wherein the random domain name analysis model is used to determine whether the domain name to be detected is a random domain name, and the random domain name analysis model includes a basic model and a two-layer model composed of a long short-term memory network and an attention mechanism connected to the basic model.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute the random domain name detection method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: A memory and a processor, wherein the processor is configured to run a program stored in the memory, wherein the program executes the random domain name detection method according to any one of claims 1 to 7 when running.

11. A computer program product, characterized in that The invention comprises a computer program, which implements the random domain name detection method according to any one of claims 1 to 7 when being executed by a processor.

Images