Methods, devices, electronic equipment, and computer program products for detecting tunnel domain names.

Abstract

The present invention discloses a method, device, electronic device and computer program product for detecting a tunnel domain name. The method comprises: obtaining a domain name to be detected; using a first preset model to extract features of the domain name to be detected, and obtaining multiple domain name features of the domain name to be detected, wherein the first preset model at least comprises: a multivariate grammar model trained using machine learning, wherein the multivariate grammar model is used to intercept a byte segment sequence that meets a preset byte length from multiple bytes of the domain name to be detected according to a sliding window of a preset byte length, and the domain name features at least comprise: vector space features determined based on byte segments; using a second preset model to detect multiple domain name features of the domain name to be detected, and obtaining a detection result of the domain name to be detected, wherein the second preset model is an extreme gradient boosting model trained using machine learning. The present invention solves the technical problem that the existing method for detecting DNS hidden tunnels is difficult to develop.

Description

Technical Field

[0001] The present invention relates to the field of the Internet, and in particular to a method, device, electronic equipment and computer program product for detecting a tunnel domain name. Background Art

[0002] As the external network security attack and defense situation becomes more and more intense, and the bank's business management needs to be digitally transformed, it is necessary to use new digital technologies to upgrade the existing network security defense system, so as to improve the detection ability of network attacks. On the other hand, the cyberspace security situation faced by enterprises and organizations is severe, and the attacks and threats that need to be dealt with are becoming increasingly complex. These threats are highly concealed, have a long incubation period, and are persistent. The DNS protocol is an indispensable basic service in network communication, but most firewalls and intrusion detection devices have limited interception and filtering capabilities for DNS browsing, which provides favorable conditions for using the DNS protocol for covert communication, so as to use it to achieve events that threaten enterprise security, such as remote control tunnels such as zombie networks and Trojans, and external data transmission.

[0003] The existing limitations of DNS covert tunnel detection are mainly reflected in the following two aspects:

[0004] 1. Rule-based detection, lack of security intelligence: Traditional DNS covert tunnel detection mainly relies on rule matching by security devices such as intrusion prevention systems (IPS) and firewalls. It has poor generalization capabilities and is difficult to identify and capture real attack threats.

[0005] 2. High false alarm rate and passive role: Security equipment based on rule matching for detection has a large number of detection alarms for various DNS hidden tunnel malicious domain names, with a high false alarm rate, requiring a lot of manual analysis and judgment, and high labor costs for security maintenance.

[0006] Currently, the methods for modeling, analyzing and detecting DNS covert tunnels are usually implemented based on the convolutional neural network (CNN) model.

[0007] Figure 1 This is a schematic diagram of the DNS covert tunnel analysis process based on a convolutional neural network (CNN) model in the prior art. Figure 1As shown in the figure, based on the convolutional neural network (CNN) model, the DNS covert channel tool iodine generates black samples of DNS messages and white samples generated by normal DNS access through deep learning detection technology. The training of the convolutional neural network is based on the TensorFlow framework, using the Python TensorFlow library tflearn. Although this technical architecture using convolutional neural networks has good feature representation capabilities in complex data and a low risk of overfitting, from the perspective of feature engineering, convolutional neural networks require more demanding data preparation work. Convolutional neural networks require additional parameter adjustments such as missing data compensation, data type conversion, data scaling, and learning rate. In terms of parameter adjustment difficulty, the parameter adjustment difficulty of convolutional neural networks is higher, and the cost is too high. In terms of model interpretability, the feature interpretation of convolutional neural networks is difficult and cannot be analyzed more intuitively.

[0008] Therefore, the existing DNS covert tunnel detection methods have the following shortcomings:

[0009] 1. Lack of security intelligence. Existing DNS covert tunnel detection mainly relies on the matching of security equipment’s own rules, with poor generalization ability. It is relatively ineffective in the face of a wide variety of DNS covert tunnel domain names.

[0010] 2. The false positive rate of detection is high. The existing DNS covert tunnel detection method, which is mainly based on rule matching, has a high false positive rate and requires a lot of manual intervention.

[0011] 3. Difficult to develop. Some current neural network-based DNS covert tunnel detection methods have a long development cycle and high difficulty, and subsequent maintenance and iteration require more costs.

[0012] 4. The development cost is high. The DNS covert tunnel detection method based on rule matching requires frequent adjustment and modification of rules. The DNS covert tunnel detection method based on neural network has a long project development cycle. Both require a lot of development manpower costs.

[0013] With regard to the problem that the existing methods for detecting DNS covert tunnels are difficult to develop, no effective solution has been proposed yet. Summary of the invention

[0014] The embodiments of the present invention provide a method, device, electronic device and computer program product for detecting a tunnel domain name, so as to at least solve the technical problem that the existing methods for detecting DNS covert tunnels are difficult to develop.

[0015] According to one aspect of an embodiment of the present invention, a method for detecting a tunnel domain name is provided, comprising: obtaining a domain name to be detected; using a first preset model to perform feature extraction on the domain name to be detected, and obtaining multiple domain name features of the domain name to be detected, wherein the first preset model at least comprises: a multivariate grammar model trained using machine learning, the multivariate grammar model is used to intercept a byte segment sequence that meets a preset byte length from multiple bytes of the domain name to be detected according to a sliding window of a preset byte length, the byte segment sequence comprises: multiple byte segments, and the domain name features at least comprise: vector space features determined based on the byte segments; using a second preset model to detect the multiple domain name features of the domain name to be detected, and obtaining a detection result of the domain name to be detected, wherein the second preset model is an extreme gradient boosting model trained using machine learning, the extreme gradient boosting model uses a decision tree as a learner for multiple trainings to obtain multiple decision trees established in sequence, the decision tree trained each time is used to correct errors of the decision tree trained last time, and the detection result is used to indicate that the domain name to be detected belongs to a tunnel domain name, or that the domain name to be detected does not belong to a tunnel domain name.

[0016] Optionally, the first preset model also includes: a word segmentation model trained based on the Jieba word segmentation library, using the first preset model to perform feature extraction on the domain name to be detected, and obtaining multiple domain name features of the domain name to be detected includes: using the word segmentation model to perform word segmentation on the domain name to be detected to obtain multiple words to be detected, wherein the characters include at least one byte, and the words to be detected are meaningful characters or meaningless characters; among the multiple words to be detected, the words to be detected in which all characters belong to the meaningless characters are determined to be meaningless words, wherein the two ends of the meaningless word in the domain name to be detected are respectively a first meaningful word and a second meaningful word, and the characters in the first meaningful word and the second meaningful word are the meaningful characters; a first ratio between the character length in the first meaningful word and the character length in the meaningless word is summed with a second ratio between the character length in the second meaningful word and the character length in the meaningless word to obtain a character tension feature of the domain name to be detected, wherein the character tension feature is the domain name feature.

[0017] Optionally, before using the first preset model to extract features of the domain name to be detected to obtain multiple domain name features of the domain name to be detected, the method also includes: obtaining a sample data set, wherein the sample data set includes: multiple domain name samples, the domain name samples are white samples or black samples, the white samples at least include: multiple preset domain names crawled from the Internet, domain name aggregations parsed from historical operation logs, multiple domain name combinations set according to first preset rules, and multiple combinations of preset phrases set according to second preset rules, and the black samples are multiple tunnel domain names created in advance using a tunnel generation tool of the domain name system; using the sample data set to train the first preset model and the second preset model.

[0018] Optionally, using the sample data set to train the first preset model and the second preset model includes: extracting the subdomain name of each of the domain name samples from the sample data set; using the subdomain names corresponding to multiple white samples and the subdomain names corresponding to multiple black samples to train the first preset model and the second preset model.

[0019] Optionally, extracting the subdomain name of each of the domain name samples from the sample data set includes: identifying the second-level and above domain names in each of the domain name samples in the sample data set; deleting the second-level and above domain names in each of the domain name samples to obtain the subdomain name corresponding to each of the domain name samples.

[0020] Optionally, after acquiring the sample data set, the method further includes: identifying, in the sample data set, a numerical byte in each of the domain name samples; and generalizing the numerical byte in the domain name sample to 0.

[0021] Optionally, before using the second preset model to detect multiple domain name features of the domain name to be detected and obtaining the detection result of the domain name to be detected, the method also includes: using a gradient boosting algorithm to perform multiple iterative training with the goal of minimizing the loss function of the second preset model; in the case of each iterative training, fitting the second preset model trained in this iteration with the residual of the second preset model trained in the previous iteration until a preset iteration end condition is reached, wherein the residual of the second preset model is the error between the predicted value generated by the second preset model based on the test sample and the true value of the test sample; when the preset iteration end condition is reached, the second preset model trained most recently is obtained, and the preset iteration end condition at least includes: the number of iterations reaches a preset number, or the loss function of the second preset model meets the preset loss condition.

[0022] According to another aspect of an embodiment of the present invention, a tunnel domain name detection device is also provided, comprising: an acquisition module, used to acquire a domain name to be detected; an extraction module, used to use a first preset model to perform feature extraction on the domain name to be detected, and obtain multiple domain name features of the domain name to be detected, wherein the first preset model at least includes: a multivariate grammar model trained using machine learning, the multivariate grammar model is used to intercept a byte segment sequence that meets a preset byte length from multiple bytes of the domain name to be detected according to a sliding window of a preset byte length, the byte segment sequence includes: multiple byte segments, and the domain name features at least include: vector space features determined based on the byte segments; a monitoring module, used to use a second preset model to detect the multiple domain name features of the domain name to be detected, and obtain a detection result of the domain name to be detected, wherein the second preset model is an extreme gradient boosting model trained using machine learning, the extreme gradient boosting model uses a decision tree as a learner for multiple trainings to obtain multiple decision trees established in sequence, the decision tree trained each time is used to correct the error of the decision tree trained last time, and the detection result is used to indicate that the domain name to be detected belongs to a tunnel domain name, or that the domain name to be detected does not belong to a tunnel domain name.

[0023] According to another aspect of an embodiment of the present invention, an electronic device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned tunnel domain name detection method through the computer program.

[0024] According to another aspect of an embodiment of the present invention, a computer program product is provided, including computer instructions, which implement the steps of the above-mentioned method for detecting a tunnel domain name when executed by a processor.

[0025] In the embodiment of the present invention, a multivariate grammar model is used to extract domain name features of the domain name to be detected, and an extreme gradient boosting model is used to perform domain name detection based on the extracted domain name features, thereby achieving the purpose of domain name detection. In addition, the development difficulty of the multivariate grammar model and the extreme gradient boosting model is much lower than the development difficulty of the convolutional neural network model, thereby achieving the technical effect of reducing the development difficulty of detecting DNS covert tunnels, thereby solving the technical problem of high development difficulty of existing methods for detecting DNS covert tunnels. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0027] Figure 1It is a schematic diagram of the DNS covert tunnel analysis process based on a convolutional neural network (CNN) model in the prior art;

[0028] Figure 2 is a flow chart of a method for detecting a tunnel domain name according to an embodiment of the present invention;

[0029] Figure 3 is a schematic diagram of a DNS covert tunnel detection method based on machine learning according to an embodiment of the present invention;

[0030] Figure 4 is a schematic diagram of subdomain extraction according to an embodiment of the present invention;

[0031] Figure 5 is a schematic diagram of calculating the spacing tension of a character string according to an embodiment of the present invention;

[0032] Figure 6 is a schematic diagram of a DNS covert tunnel model feature ratio according to an embodiment of the present invention;

[0033] Figure 7 is a schematic diagram of a tunnel domain name detection device according to an embodiment of the present invention;

[0034] Figure 8 It is a structural block diagram of a computer terminal according to an embodiment of the present invention. DETAILED DESCRIPTION

[0035] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0037] According to an embodiment of the present invention, an embodiment of a method for detecting a tunnel domain name is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0038] Figure 2 is a flow chart of a method for detecting a tunnel domain name according to an embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0039] Step S202, obtaining the domain name to be detected;

[0040] Step S204: extracting features from the domain name to be detected using a first preset model to obtain multiple domain name features of the domain name to be detected, wherein the first preset model at least includes: a multivariate grammar model trained using machine learning, the multivariate grammar model is used to intercept a byte segment sequence that meets a preset byte length from multiple bytes of the domain name to be detected according to a sliding window of a preset byte length, the byte segment sequence includes: multiple byte segments, and the domain name features at least include: vector space features determined based on the byte segments;

[0041] Step S206, using the second preset model to detect multiple domain name features of the domain name to be detected, and obtaining the detection result of the domain name to be detected, wherein the second preset model is an extreme gradient boosting model trained using machine learning, and the extreme gradient boosting model uses a decision tree as a learner for multiple trainings to obtain multiple decision trees established in sequence, and each decision tree trained is used to correct the errors of the decision tree trained last time, and the detection result is used to indicate that the domain name to be detected belongs to a tunnel domain name, or that the domain name to be detected does not belong to a tunnel domain name.

[0042] In the embodiment of the present invention, a multivariate grammar model is used to extract domain name features of the domain name to be detected, and an extreme gradient boosting model is used to perform domain name detection based on the extracted domain name features, thereby achieving the purpose of domain name detection. In addition, the development difficulty of the multivariate grammar model and the extreme gradient boosting model is much lower than the development difficulty of the convolutional neural network model, thereby achieving the technical effect of reducing the development difficulty of detecting DNS covert tunnels, thereby solving the technical problem of high development difficulty of existing methods for detecting DNS covert tunnels.

[0043] In the above step S204, the domain name to be detected includes multiple bytes, the byte segment sequence is a plurality of byte segments of a preset byte length, and each byte segment may include at least one byte.

[0044] Optionally, after extracting a byte segment sequence that meets a preset byte length from the domain name to be detected, the frequency of occurrence of each byte segment in the byte segment sequence can be counted to obtain the word frequency number, and then the byte segment whose word frequency number exceeds a preset word frequency threshold is selected; and then the vector space features are determined based on the selected byte segments.

[0045] In the above step S204, the first preset model may be a multi-grammar model, that is, an N-Gram model.

[0046] Alternatively, the N-Gram model is an algorithm based on a statistical language model. Its basic idea is to perform a sliding window operation of size N on the content of the text according to bytes, forming a sequence of byte segments of length N. Each byte segment is called a gram, and the occurrence frequency of all grams is counted to obtain the word frequency, and filtered according to a pre-set threshold to form the vector space feature of the text. Each gram is a feature vector dimension.

[0047] In the above step S204, the domain name features may include: vector space features, character tension features, word features, character features, etc.

[0048] In the above step S206, the second preset model can be an extreme gradient boosting model, that is, XGBoost (eXtreme Gradient Boosting), which is an integrated learning algorithm that is particularly suitable for solving classification, regression and sorting problems. Its principle is based on the gradient boosting framework, and XGBoost uses decision trees as basic weak learners. Decision trees are built in sequence, and each new tree tries to correct the errors of the previous tree.

[0049] Optionally, XGBoost uses a gradient boosting algorithm with the goal of minimizing the loss function. In each iteration, XGBoost trains a new model to fit the residuals of the previous model, and then adds the model to the ensemble.

[0050] Optionally, XGBoost uses regularization methods in each tree construction process, including column subsampling and leaf-wise tree growth, which help reduce overfitting and improve the generalization ability of the model. At the same time, XGBoost supports a variety of loss functions, such as square loss function (for regression problems), logarithmic loss function (for binary classification problems) and Softmax loss function (for multi-classification problems). Users can choose the appropriate loss function according to the specific problem. XGBoost uses a greedy algorithm when building a decision tree, and selects the best split by evaluating all possible split points. This node splitting strategy can be controlled by maximum gain or maximum depth.

[0051] Optionally, XGBoost builds multiple decision trees and integrates them in a gradient boosting manner to improve the performance of the model through regularization and loss function optimization. This makes XGBoost perform well in many practical applications of machine learning.

[0052] As an optional embodiment, the first preset model also includes: a word segmentation model trained based on the Jieba word segmentation library, using the first preset model to extract features of the domain name to be detected, and obtaining multiple domain name features of the domain name to be detected includes: using the word segmentation model to segment the domain name to be detected to obtain multiple words to be detected, wherein the characters include at least one byte, and the words to be detected are meaningful characters or meaningless characters; among the multiple words to be detected, the words to be detected in which all characters are meaningless characters are determined to be meaningless words, wherein the two ends of the meaningless word in the domain name to be detected are the first meaningful word and the second meaningful word, respectively, and the characters in the first meaningful word and the second meaningful word are meaningful characters; a first ratio between the character length in the first meaningful word and the character length in the meaningless word is summed with a second ratio between the character length in the second meaningful word and the character length in the meaningless word to obtain a character tension feature of the domain name to be detected, wherein the character tension feature is a domain name feature.

[0053] In the above-mentioned embodiment of the present application, a domain name to be detected is segmented based on characters to obtain multiple words to be detected, and it is identified whether the characters in the words to be detected are meaningless characters to obtain meaningful words and meaningless words, and then the ratio of the character length of the meaningful words at both ends of the meaningless word to the character length of the meaningless word is calculated respectively, and the ratio of the two is summed to obtain the character tension feature of the domain name to be detected, and the character tension feature is used as the domain name feature to realize the determination of the domain name feature.

[0054] Optionally, a character includes at least one byte. For example, in Unicode encoding, a Chinese character is 2 bytes and an English character is 1 byte.

[0055] Optionally, each character may be a byte fragment in a sequence of byte fragments.

[0056] It should be noted that the Jiaba word segmentation library is a Chinese word segmentation library commonly used in the field of NLP (natural language processing). It is implemented in Python and uses a Chinese word library to determine the association probability between Chinese characters.

[0057] As an optional embodiment, before using the first preset model to extract features of the domain name to be detected and obtaining multiple domain name features of the domain name to be detected, the method also includes: obtaining a sample data set, wherein the sample data set includes: multiple domain name samples, the domain name samples are white samples or black samples, the white samples at least include: multiple preset domain names crawled from the Internet, domain name aggregations parsed from historical operation logs, multiple domain name combinations set according to first preset rules, and multiple combinations of preset phrases set according to second preset rules, and the black samples are multiple tunnel domain names created in advance using a tunnel generation tool of the domain name system; use the sample data set to train the first preset model and the second preset model.

[0058] In the above-mentioned embodiment of the present application, before using the first preset model and the second preset model to extract features of the domain name to be detected and obtaining multiple domain name features of the domain name to be detected, it is necessary to pre-train the first preset model and the second preset model using a sample data set, wherein multiple domain name samples obtained in the sample data set are divided into white samples and black samples, the white samples are tunnel domain names, and the black samples are non-tunnel domain names, and then the training of the first preset model and the second preset model can be realized based on the sample data set.

[0059] As an optional embodiment, using the sample data set to train the first preset model and the second preset model includes: extracting the subdomain name of each domain name sample from the sample data set; using the subdomain names corresponding to multiple white samples and the subdomain names corresponding to multiple black samples to train the first preset model and the second preset model.

[0060] In the above-mentioned embodiments of the present application, since the principle of DNS tunnel communication is to build a communication tunnel with parameters carried by the subdomain name under the normal second-level domain name, that is, the tunnel domain name belongs to the subdomain name under the second-level domain name, based on this principle, before using the sample data set to train the first preset model, the domain name samples in the sample data set can be screened, and the subdomain names of each domain name sample can be extracted. Then, the first preset model and the second preset model can be trained based on the extracted subdomain names, which can improve the model training efficiency.

[0061] As an optional embodiment, extracting the subdomain name of each domain name sample from the sample data set includes: identifying the second-level and above domain names in each domain name sample in the sample data set; deleting the second-level and above domain names in each domain name sample to obtain the subdomain name corresponding to each domain name sample.

[0062] In the above-mentioned embodiments of the present application, since the principle of DNS tunnel communication is to build a communication tunnel with parameters carried by the subdomain under the normal second-level domain name, that is, the tunnel domain name belongs to the subdomain under the second-level domain name, based on this principle, before using the sample data set for model training, the domain name samples in the sample data set can be extracted from the subdomain to obtain the subdomain that can distinguish the tunnel domain name from the non-tunnel domain name, and then the first preset model and the second preset model are trained based on the subdomain, which can improve the model training efficiency and the accuracy of the trained model.

[0063] As an optional embodiment, after obtaining the sample data set, the method further includes: identifying the numerical bytes in each domain name sample in the sample data set; and generalizing the numerical bytes in the domain name sample to 0.

[0064] In the above embodiments of the present application, domain names represented by numerical bytes may exist in the domain name samples in the sample data set. The numerical bytes in the domain name samples may be uniformly generalized to 0, which can reduce the impact of the numerical bytes on the model feature representation. Then, the generalized domain name samples may be used for model training to ensure that the trained model is accurate enough.

[0065] As an optional example, a sample data set is used to train a first preset model and a second preset model, wherein the sample data set can be input into the first preset model, and the first preset model extracts domain name features from domain name samples in the sample data set to obtain sample domain name features; the extracted sample domain name features are then input into the second preset model, and the second preset model implements training of the second preset model based on the sample domain name features output by the first preset model.

[0066] As an optional embodiment, before using the second preset model to detect multiple domain name features of the domain name to be detected and obtaining the detection result of the domain name to be detected, the method also includes: using a gradient boosting algorithm to perform multiple iterative training with the goal of minimizing the loss function of the second preset model; in each iterative training, fitting the second preset model trained in this iteration with the residual of the second preset model trained in the previous iteration until the preset iteration end condition is reached, wherein the residual of the second preset model is the error between the predicted value generated by the second preset model based on the test sample and the true value of the test sample; when the preset iteration end condition is reached, the second preset model trained most recently is obtained, and the preset iteration end condition at least includes: the number of iterations reaches the preset number of times, or the loss function of the second preset model meets the preset loss condition.

[0067] In the above embodiment of the present application, the second preset model is extreme gradient. The boosted model constructs multiple decision trees and integrates them in a gradient boosting manner, and improves the performance of the model through regularization and loss function optimization. This makes XGBoost perform well in many practical applications of machine learning. On the basis of reducing the complexity and difficulty of model training, it can ensure that accurate detection results can be obtained using the trained second preset model.

[0068] The present invention also provides an optional embodiment, which provides a DNS hidden tunnel detection method based on machine learning, uses XGBoost model and N-Gram model to process DNS hidden tunnel malicious domain name data, then implements feature engineering on the data, extracts features in the data as the data set of the recognition model, and finally builds and trains the DNS hidden tunnel recognition model. Using XGBoost and other integrated learning decision tree models for modeling, while improving security intelligence capabilities and having a lower false alarm rate, the lower parameter adjustment difficulty and better model interpretation can shorten the development cycle and reduce development costs. By building a model to identify DNS hidden tunnel domain names, the generalization ability is strong, the robustness is high, and the DNS tunnel domain name can be judged more flexibly and intelligently; at the same time, a machine learning method is used to build a model for detection and analysis, which has high accuracy, generates fewer alarms, and requires less manual judgment and access, which can effectively save maintenance labor costs.

[0069] Figure 3 is a schematic diagram of a DNS covert tunnel detection method based on machine learning according to an embodiment of the present invention, such as Figure 3As shown in the figure, based on the XGBoost model and the N-Gram model, after six steps of data set collection, data preprocessing, feature extraction, model training, model iteration, and model verification, a set of DNS hidden tunnel detection methods with excellent detection capabilities, security, and intelligence was constructed. This method is suitable for DNS log detection of various DNS servers, domain control devices, and other devices. The overall execution logic of the DNS hidden tunnel detection method includes the following steps:

[0070] Step S201, data set collection.

[0071] Optionally, the data set includes: a normal domain name data set, a business common vocabulary data set, business domain name features, a production DNS resolution log, and a manually generated DNS tunnel data set.

[0072] Optionally, the normal domain name data set is based on the top 1 million domain names on the Alexa domain name rankings, removing some domain names that are not conducive to identification, totaling 987,677 entries.

[0073] Optionally, a common business vocabulary data set consists of common English words (234,632 items), internal application system abbreviations (722 items), pinyin (413 items), technical vocabulary (36 items, ipv4, ipv6, soap, xml, html, soap, etc.), and custom phrases (27 items, sogou, wps, msft, commerz, etc.), totaling 235,830 items.

[0074] Optionally, the business domain name feature consists of internal network custom domain names, cluster domain names, and other protocol communication domain names, totaling 22 items.

[0075] Optionally, DNS resolution logs are generated and set as white samples based on the domain aggregation of the intranet DNS resolution logs, totaling 266,221 records.

[0076] Alternatively, a DNS tunnel dataset is manually generated, an attack environment is built locally, and a dataset of 24,708 black samples is created based on the DNS tunnel generation tool odline.

[0077] Optionally, the data in the above data set is divided into black and white data and then subjected to subsequent processing.

[0078] Step S202: data preprocessing.

[0079] Figure 4 is a schematic diagram of a subdomain name extraction according to an embodiment of the present invention, such as Figure 4As shown, it includes: extracting subdomains from domain names in the dataset. Since the principle of DNS tunnel communication is to build a communication tunnel with parameters carried by subdomains under a normal second-level domain name, based on this principle, the domain field of the existing dataset can be decomposed into subdomains, and domain names above the second level can be deleted, leaving only subdomains, and features can be extracted using subdomains to participate in model training.

[0080] It should be noted that in the actual DNS resolution logs, there are domain names composed of IP addresses + words such as XXX.XXX.XXX.XXX.in-addr.arpa. If a large number of different IP addresses are not processed, it will affect the actual model feature representation. Therefore, the numerical values ​​in the subdomains are generalized and the numerical parts of the domain names are uniformly generalized to 0, which has the effect of strengthening the features of domainGram.

[0081] Step S203: feature extraction, which mainly uses the N-Gram model and Jieba word segmentation library.

[0082] As an optional example, in combination with the domain name rule for producing the DNS resolution log, the character features extracted from the subdomain name include: DomainGram, WordGram, word features and character features.

[0083] Optionally, extracting DomainGram includes: performing 2gram character-level word frequency statistics on the Alexa domain name + DNS domain name and using this as a reference space for all characters. Subsequent domain names will generate character mapping vectors of the same size based on this space to represent the number of word frequencies corresponding to each 2gram character. This feature represents the degree of conformity of the domain name with the preset domain name list (Alexa domain name + DNS domain name). A high value indicates that the character string conforms to the common domain name writing method.

[0084] Optionally, extracting WordGram includes: performing 2gram word frequency statistics on the word dictionary and generating a reference space, generating word frequency statistics based on the vocabulary space for the domain name, the higher the feature value is, the more the character string fits the common vocabulary and is consistent with the naming background of the subdomain name, and the subdomain name is usually composed of professional abbreviations, words, etc.

[0085] Optionally, extracting word features includes: performing Jieba segmentation on subdomains according to words in the word data set to obtain word quantity features (word_size). Calculating the number of words and the number of non-words to obtain the ratio of the two, and calculating the viscosity of each word based on the word spacing (some meaningless characters appear in consecutive words, which can be understood and segmented from a human perspective, and to a certain extent supplement the features when WordGram cannot supplement custom vocabulary) to finally calculate the character chaos feature (chaotic_degree), the calculation formula is:

[0086]

[0087] Figure 5 is a schematic diagram of calculating the spacing tension of a string according to an embodiment of the present invention, such as Figure 5 As shown in the figure, for a segmented string list, the meaningless string must be on the left and right of a meaningful string, so we only need to calculate the sum of the lengths of the meaningful characters and the ratio of the meaningless characters, and sum them up to get a character tension feature that represents the overall viscosity of the string. This feature can remove part of the feature weight in WordGram to a certain extent, and increase the fault tolerance for newly added internal application systems and business abbreviations.

[0088] Optionally, extracting character features includes: extracting characters such as length, number of vowels, number of consonants, information entropy, number length ratio, number_ratio_length, number of unique characters, number of chaotic characters, etc. from the domain name.

[0089] Figure 6 is a schematic diagram of a DNS covert tunnel model feature ratio according to an embodiment of the present invention, such as Figure 6 As shown, a total of 11 feature values ​​are important in model training.

[0090] Step S204: model training.

[0091] Since the integrated learning decision tree model has the advantages of easy parameter adjustment, simple feature engineering preparation, and high model interpretability on medium and large data volumes, this application chooses the XGBoost (Extreme Gradient Boosting) model.

[0092] In the above embodiment of the present application, the Alexa domain name data set is mixed with the DNS tunnel domain name to divide the training set and the test set in a ratio of 9:1, and the XGBoost model implemented in Python is used for cross-validation training. Call the PythonXGBoost library for training, first use the XGBClassifier method to initialize the XGB model, input learning_rate (learning rate), n_estimators (number of weak classifiers), max_depth (maximum depth of the tree), min_child_weight (minimum number of samples on leaf nodes), subsample (the proportion of data in the total training set during training), colsample_bytree (the proportion of features in all features during training), gamma (penalty term coefficient), reg_alpha (the first-order term coefficient of the regular term of the model loss function), reg_lambda (the second-order term coefficient of the regular term of the model loss function) and several initial parameters.

[0093] Optionally, after initializing the model, the fit(x_train,y_train) function is used to train the model, where x_train is the feature matrix, y_train is the label, and the features use the domain name features mentioned in step S203. Then, the predict function is used to score and predict the test set, and finally the initial model is obtained.

[0094] Optionally, the prediction results of the business DNS resolution domain name using the initial model are combined with the Alexa domain name and the DNS covert tunnel domain name as a new round of model training data set, and the training set and test set are also divided into 9:1. The final result shows that the prediction accuracy of the DNS covert tunnel domain name is above 95%, and the summoning rate is above 98%.

[0095] Table 1 is a schematic diagram of the model prediction results. As shown in Table 1, the number of correct detections of domain names that are actually normal domain names and detected as normal domain names is: 93217; the number of correct detections of domain names that are actually tunnel domain names and detected as tunnel domain names is: 20222; the number of false positives of domain names that are actually normal domain names and detected as tunnel domain names is: 4893; the number of missed positives of domain names that are actually tunnel domain names and detected as tunnel domain names is: 20222.

[0096] Table 1

[0097] The actual domain name is normal The actual domain name of the tunnel Detected as a normal domain name TP:93217 FN: 2388 Detected as a tunnel domain FP:4893 TN:20222

[0098] Optionally, based on Table 1 above, the accuracy and recall of the model prediction are calculated, where the accuracy and recall are as follows:

[0099]

[0100] Step S205, model iteration.

[0101] Optionally, based on the prediction results of the first two steps and the importance of features fed back by feature engineering, add vocabulary datasets, adjust Alexa domain name datasets, and supplement vocabulary. Use the prediction results of daily business DNS domain name data as training data, mix black and white samples for iterative training, and manually intervene when model indicators drop to correct black and white samples and prediction results.

[0102] Step S206: model verification.

[0103] Optionally, the trained model is put into the production environment for operation. After a period of stable operation, the model is tested with simulated requests. The simulated requests are divided into 4 groups by the tool, with 10 in each group, for a total of 40 DNS Tunnel domain names, 39 of which are accurately identified, with a detection rate of 97.5%. The results of repeated deployment are consistent, which is consistent with the model indicators.

[0104] The above-mentioned embodiment of the present application adopts a machine learning method based on the XGBoost model and the N-Gram model to construct a model, and uses the XGBoost integrated learning decision tree model for modeling. Compared with the traditional method of DNS hidden tunnel detection based on security device rule matching and convolutional neural network model. While improving security intelligence capabilities and having a lower false alarm rate, the lower difficulty of adjusting parameters can shorten the development cycle and reduce development costs. In addition, compared horizontally with the method of DNS hidden tunnel detection based on the convolutional neural network model, the machine learning method based on the XGBoost model and the N-Gram model has better model interpretability and simpler feature engineering preparation when the model quality is not much different, which can be quickly iterated and developed, saving development labor costs.

[0105] The above-mentioned embodiments of the present application lack security intelligence and generalization capabilities compared to the traditional network security analysis scenarios based on security device rule matching to detect DNS covert tunnels. The technical solution provided by the present application adopts a machine learning method based on the XGBoost model and the N-Gram model to build a DNS covert tunnel detection model, enable security intelligence, and continuously iterate the model during continuous business operations, which can efficiently detect various types of DNS covert tunnel attack behaviors.

[0106] The above-mentioned embodiments of the present application adopt the design of XGBoost integrated learning decision tree model, which makes the preparation work and parameter adjustment of feature engineering less difficult, can effectively reduce development time and development costs, and at the same time, the better model interpretability reduces the difficulty of feature modification.

[0107] The above-mentioned embodiments of the present application adopt a method of combining multi-dimensional features to construct feature engineering, and use a method of combining character class features, Ngram word frequency features (DomainGram, WordGram), and word features, so that the features can better express the essence of the problem, improve the model performance, and make more accurate predictions, so that the model has excellent robustness.

[0108] According to an embodiment of the present invention, a tunnel domain name detection device embodiment is also provided. It should be noted that the tunnel domain name detection device can be used to execute the tunnel domain name detection method in the embodiment of the present invention, and the tunnel domain name detection method in the embodiment of the present invention can be executed in the tunnel domain name detection device.

[0109] Figure 7 is a schematic diagram of a tunnel domain name detection device according to an embodiment of the present invention, such as Figure 7 As shown, the device may include: an acquisition module 72, which is used to acquire a domain name to be detected; an extraction module 74, which is used to use a first preset model to perform feature extraction on the domain name to be detected, and obtain multiple domain name features of the domain name to be detected, wherein the first preset model at least includes: a multivariate grammar model trained using machine learning, the multivariate grammar model is used to intercept a byte segment sequence that meets the preset byte length from multiple bytes of the domain name to be detected according to a sliding window of a preset byte length, the byte segment sequence includes: multiple byte segments, and the domain name features at least include: vector space features determined based on the byte segments; a monitoring module 76, which is used to use a second preset model to detect multiple domain name features of the domain name to be detected, and obtain a detection result of the domain name to be detected, wherein the second preset model is an extreme gradient boosting model trained using machine learning, the extreme gradient boosting model uses a decision tree as a learner for multiple trainings to obtain multiple decision trees established in sequence, each decision tree trained is used to correct the error of the decision tree trained last time, and the detection result is used to indicate that the domain name to be detected belongs to the tunnel domain name, or that the domain name to be detected does not belong to the tunnel domain name.

[0110] It should be noted that the acquisition module 72 in this embodiment can be used to execute step S202 in the embodiment of the present application, the extraction module 74 in this embodiment can be used to execute step S204 in the embodiment of the present application, and the monitoring module 76 in this embodiment can be used to execute step S206 in the embodiment of the present application. The examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiments.

[0111] In the embodiment of the present invention, a multivariate grammar model is used to extract domain name features of the domain name to be detected, and an extreme gradient boosting model is used to perform domain name detection based on the extracted domain name features, thereby achieving the purpose of domain name detection. In addition, the development difficulty of the multivariate grammar model and the extreme gradient boosting model is much lower than the development difficulty of the convolutional neural network model, thereby achieving the technical effect of reducing the development difficulty of detecting DNS covert tunnels, thereby solving the technical problem of high development difficulty of existing methods for detecting DNS covert tunnels.

[0112] As an optional embodiment, the first preset model also includes: a word segmentation model trained based on the Jieba word segmentation library, and the extraction module includes: a word segmentation unit, which is used to use the word segmentation model to segment the domain name to be detected to obtain multiple words to be detected, wherein the characters include at least one byte, and the words to be detected are meaningful characters or meaningless characters; a first determination unit, which is used to determine, among the multiple words to be detected, a word to be detected in which all characters are meaningless characters as a meaningless word, wherein the two ends of the meaningless word in the domain name to be detected are respectively a first meaningful word and a second meaningful word, and the characters in the first meaningful word and the second meaningful word are meaningful characters; a second determination unit, which is used to sum a first ratio between the character length in the first meaningful word and the character length in the meaningless word and a second ratio between the character length in the second meaningful word and the character length in the meaningless word to obtain a character tension feature of the domain name to be detected, wherein the character tension feature is a domain name feature.

[0113] As an optional embodiment, the device also includes: an acquisition submodule, which is used to obtain a sample data set before using the first preset model to extract features of the domain name to be detected and obtaining multiple domain name features of the domain name to be detected, wherein the sample data set includes: multiple domain name samples, the domain name samples are white samples or black samples, the white samples at least include: multiple preset domain names crawled from the Internet, domain name aggregations parsed from historical operation logs, multiple domain name combinations set according to the first preset rules, and multiple combinations of preset phrases set according to the second preset rules, and the black samples are multiple tunnel domain names created in advance using the tunnel generation tool of the domain name system; a training submodule, which is used to train the first preset model and the second preset model using the sample data set.

[0114] As an optional embodiment, the training submodule includes: an extraction subunit, used to extract the subdomain name of each domain name sample from the sample data set; a training subunit, used to train the first preset model and the second preset model using the subdomain names corresponding to multiple white samples and the subdomain names corresponding to multiple black samples.

[0115] As an optional embodiment, the extraction subunit includes: an identification subunit, used to identify the second-level and above domain names in each domain name sample in the sample data set; a deletion subunit, used to delete the second-level and above domain names in each domain name sample to obtain the subdomain name corresponding to each domain name sample.

[0116] As an optional embodiment, the device also includes: an identification subunit, which is used to identify the numerical bytes in each domain name sample in the sample data set after obtaining the sample data set; and a generalization subunit, which is used to generalize the numerical bytes in the domain name sample to 0.

[0117] As an optional embodiment, the device also includes: an iteration submodule, which is used to use the second preset model to detect multiple domain name features of the domain name to be detected, and before obtaining the detection result of the domain name to be detected, use the gradient boosting algorithm to perform multiple iterative training with the goal of minimizing the loss function of the second preset model; a fitting submodule, which is used to fit the second preset model trained in this iteration with the residual of the second preset model trained in the previous iteration in each iterative training until the preset iteration end condition is reached, wherein the residual of the second preset model is the error between the predicted value generated by the second preset model based on the test sample and the true value of the test sample. When the preset iteration end condition is reached, the second preset model trained most recently is obtained, and the preset iteration end condition at least includes: the number of iterations reaches the preset number of times, or the loss function of the second preset model meets the preset loss condition.

[0118] An embodiment of the present invention may provide an electronic device, which may be a computer terminal, and the computer terminal may be any computer terminal device in a computer terminal group. Optionally, in this embodiment, the computer terminal may also be replaced by a terminal device such as a mobile terminal.

[0119] Optionally, in this embodiment, the computer terminal may be located in at least one network device among a plurality of network devices of the computer network.

[0120] In this embodiment, the computer terminal can execute the following steps of the tunnel domain name detection method: obtaining a domain name to be detected; using a first preset model to perform feature extraction on the domain name to be detected to obtain multiple domain name features of the domain name to be detected, wherein the first preset model at least includes: a multivariate grammar model trained using machine learning, the multivariate grammar model is used to intercept a byte segment sequence that meets the preset byte length from multiple bytes of the domain name to be detected according to a sliding window of a preset byte length, the byte segment sequence includes: multiple byte segments, and the domain name features at least include: vector space features determined based on the byte segments; using a second preset model to detect multiple domain name features of the domain name to be detected to obtain a detection result of the domain name to be detected, wherein the second preset model is an extreme gradient boosting model trained using machine learning, the extreme gradient boosting model uses a decision tree as a learner for multiple trainings to obtain multiple decision trees established in sequence, each decision tree trained is used to correct the error of the decision tree trained last time, and the detection result is used to indicate that the domain name to be detected belongs to the tunnel domain name, or that the domain name to be detected does not belong to the tunnel domain name.

[0121] Figure 8 is a structural block diagram of a computer terminal according to an embodiment of the present invention. Figure 8 As shown, the computer terminal 800 may include: one or more (only one is shown in the figure) processors 802 , and a memory 804 .

[0122] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the method and device for detecting the tunnel domain name in the embodiment of the present invention. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, the above-mentioned method for detecting the tunnel domain name is realized. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the terminal 800 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0123] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: obtain the domain name to be detected; use the first preset model to extract features of the domain name to be detected to obtain multiple domain name features of the domain name to be detected, wherein the first preset model at least includes: a multivariate grammar model trained using machine learning, the multivariate grammar model is used to intercept a byte segment sequence that meets the preset byte length from multiple bytes of the domain name to be detected according to a sliding window of a preset byte length, the byte segment sequence includes: multiple byte segments, and the domain name features at least include: vector space features determined based on the byte segments; use the second preset model to detect multiple domain name features of the domain name to be detected to obtain a detection result of the domain name to be detected, wherein the second preset model is an extreme gradient boosting model trained using machine learning, the extreme gradient boosting model uses a decision tree as a learner for multiple trainings to obtain multiple decision trees established in sequence, each decision tree trained is used to correct the errors of the decision tree trained last time, and the detection result is used to indicate that the domain name to be detected belongs to a tunnel domain name, or that the domain name to be detected does not belong to a tunnel domain name.

[0124] Optionally, the first preset model also includes: a word segmentation model trained based on the Jieba word segmentation library, and the above-mentioned processor can also execute the program code of the following steps: use the word segmentation model to segment the domain name to be detected to obtain multiple words to be detected, wherein the characters include at least one byte, and the words to be detected are meaningful characters or meaningless characters; among the multiple words to be detected, the words to be detected in which all characters are meaningless characters are determined to be meaningless words, wherein the two ends of the meaningless word in the domain name to be detected are the first meaningful word and the second meaningful word, respectively, and the characters in the first meaningful word and the second meaningful word are meaningful characters; sum a first ratio between the character length in the first meaningful word and the character length in the meaningless word and a second ratio between the character length in the second meaningful word and the character length in the meaningless word to obtain a character tension feature of the domain name to be detected, wherein the character tension feature is a domain name feature.

[0125] Optionally, the processor may also execute the program code of the following steps: obtaining a sample data set, wherein the sample data set includes: a plurality of domain name samples, the domain name samples are white samples or black samples, the white samples include at least: a plurality of preset domain names crawled from the Internet, a domain name aggregation parsed from a historical operation log, a plurality of domain name combinations set according to a first preset rule, and a plurality of preset phrase combinations set according to a second preset rule, and the black samples are a plurality of tunnel domain names created in advance using a tunnel generation tool of a domain name system; and using the sample data set to train a first preset model and a second preset model.

[0126] Optionally, the processor may also execute the following program code: extracting the subdomain of each domain sample from the sample data set; training the first preset model and the second preset model using the subdomains corresponding to multiple white samples and the subdomains corresponding to multiple black samples.

[0127] Optionally, the processor may also execute the following program code: in the sample data set, identify the second-level and above domain names in each domain name sample; delete the second-level and above domain names in each domain name sample to obtain the subdomain name corresponding to each domain name sample.

[0128] Optionally, the processor may further execute program code of the following steps: in the sample data set, identifying the numerical bytes in each domain name sample; and generalizing the numerical bytes in the domain name sample to 0.

[0129] Optionally, the processor may also execute the program code of the following steps: using a gradient boosting algorithm, performing multiple iterative training with the goal of minimizing the loss function of the second preset model; in each iterative training, fitting the second preset model trained in this iteration with the residual of the second preset model trained in the previous iteration until a preset iteration end condition is reached, wherein the residual of the second preset model is the error between the predicted value generated by the second preset model based on the test sample and the true value of the test sample; when the preset iteration end condition is reached, obtaining the second preset model trained most recently, the preset iteration end condition at least includes: the number of iterations reaches a preset number, or the loss function of the second preset model meets the preset loss condition.

[0130] By adopting the embodiment of the present invention, a tunnel domain name detection scheme is provided. In the embodiment of the present invention, a multivariate grammar model is used to extract domain name features of a domain name to be detected, and an extreme gradient boosting model is used to perform domain name detection according to the extracted domain name features, thereby achieving the purpose of domain name detection, and the development difficulty of the multivariate grammar model and the extreme gradient boosting model is much lower than the development difficulty of the convolutional neural network model, achieving the technical effect of reducing the development difficulty of detecting DNS covert tunnels, thereby solving the technical problem of high development difficulty of existing methods for detecting DNS covert tunnels.

[0131] It can be understood by those skilled in the art that Figure 8 The structure shown is for illustration only, and the computer terminal may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a handheld computer, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Figure 8 The structure of the electronic device is not limited. For example, the computer terminal 800 may also include Figure 8More or fewer components (such as network interfaces, display devices, etc.) shown in, or having Figure 8 Different configurations are shown.

[0132] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a computer program. The computer program can be stored in a non-volatile medium. The non-volatile storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0133] The embodiment of the present invention further provides a non-volatile storage medium. Optionally, in this embodiment, the non-volatile storage medium can be used to store the program code executed by the tunnel domain name detection method provided in the above embodiment.

[0134] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0135] Optionally, in this embodiment, the non-volatile storage medium is configured to store program codes for executing the following steps: obtaining a domain name to be detected; using a first preset model to perform feature extraction on the domain name to be detected to obtain multiple domain name features of the domain name to be detected, wherein the first preset model at least includes: a multivariate grammar model trained using machine learning, the multivariate grammar model is used to intercept a byte segment sequence that meets a preset byte length from multiple bytes of the domain name to be detected according to a sliding window of a preset byte length, the byte segment sequence includes: multiple byte segments, and the domain name features at least include: vector space features determined based on the byte segments; using a second preset model to detect multiple domain name features of the domain name to be detected to obtain a detection result of the domain name to be detected, wherein the second preset model is an extreme gradient boosting model trained using machine learning, the extreme gradient boosting model uses a decision tree as a learner for multiple trainings to obtain multiple decision trees established in sequence, each decision tree trained is used to correct the errors of the decision tree trained last time, and the detection result is used to indicate that the domain name to be detected belongs to a tunnel domain name, or that the domain name to be detected does not belong to a tunnel domain name.

[0136] Optionally, in this embodiment, the first preset model also includes: a word segmentation model trained based on the Jieba word segmentation library, and the non-volatile storage medium is configured to store a program code for executing the following steps: using the word segmentation model to segment the domain name to be detected to obtain multiple words to be detected, wherein the characters include at least one byte, and the words to be detected are meaningful characters or meaningless characters; among the multiple words to be detected, the words to be detected in which all characters are meaningless characters are determined to be meaningless words, wherein the two ends of the meaningless word in the domain name to be detected are the first meaningful word and the second meaningful word, respectively, and the characters in the first meaningful word and the second meaningful word are meaningful characters; a first ratio between the character length in the first meaningful word and the character length in the meaningless word is summed with a second ratio between the character length in the second meaningful word and the character length in the meaningless word to obtain a character tension feature of the domain name to be detected, wherein the character tension feature is a domain name feature.

[0137] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: obtaining a sample data set, wherein the sample data set includes: multiple domain name samples, the domain name samples are white samples or black samples, the white samples at least include: multiple preset domain names crawled from the Internet, domain name aggregations parsed from historical operation logs, multiple domain name combinations set according to first preset rules, and multiple combinations of preset phrases set according to second preset rules, and the black samples are multiple tunnel domain names created in advance using a tunnel generation tool of the domain name system; use the sample data set to train the first preset model and the second preset model.

[0138] Optionally, in this embodiment, the non-volatile storage medium is configured to store program codes for executing the following steps: extracting subdomains of each domain name sample from a sample data set; training a first preset model and a second preset model using subdomains corresponding to multiple white samples and subdomains corresponding to multiple black samples.

[0139] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: in a sample data set, identifying the second-level and above domain names in each domain name sample; deleting the second-level and above domain names in each domain name sample to obtain the subdomain name corresponding to each domain name sample.

[0140] Optionally, in this embodiment, the non-volatile storage medium is configured to store program codes for executing the following steps: in a sample data set, identifying the numerical bytes in each domain name sample; and generalizing the numerical bytes in the domain name sample to 0.

[0141] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: using a gradient boosting algorithm, performing multiple iterative training with the goal of minimizing the loss function of the second preset model; in the case of each iterative training, fitting the second preset model trained in this iteration with the residual of the second preset model trained in the previous iteration until a preset iteration end condition is reached, wherein the residual of the second preset model is the error between the predicted value generated by the second preset model based on the test sample and the true value of the test sample; when the preset iteration end condition is reached, obtaining the second preset model trained most recently, the preset iteration end condition at least includes: the number of iterations reaches a preset number, or the loss function of the second preset model meets the preset loss condition.

[0142] The embodiment of the present invention further provides a computer program product, including a computer program. Optionally, in this embodiment, when the computer program is executed by a processor, the steps of the method for detecting a tunnel domain name provided in the above embodiment are implemented.

[0143] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0144] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0145] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0146] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0147] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0148] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a non-volatile storage medium, including several instructions for a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned non-volatile storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0149] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for detecting a tunnel domain name, characterized in that: include: Get the domain name to be tested; Using a first preset model to extract features from the domain name to be detected, to obtain multiple domain name features of the domain name to be detected, wherein the first preset model at least includes: a multivariate grammar model trained using machine learning, the multivariate grammar model is used to intercept a byte segment sequence that meets a preset byte length from multiple bytes of the domain name to be detected according to a sliding window of a preset byte length, the byte segment sequence includes: multiple byte segments, and the domain name features at least include: vector space features determined based on the byte segments; A second preset model is used to detect multiple domain name features of the domain name to be detected to obtain a detection result of the domain name to be detected, wherein the second preset model is an extreme gradient boosting model trained using machine learning, and the extreme gradient boosting model uses a decision tree as a learner for multiple trainings to obtain multiple decision trees established in sequence, and each decision tree trained is used to correct errors in the decision tree trained last time, and the detection result is used to indicate that the domain name to be detected belongs to a tunnel domain name, or that the domain name to be detected does not belong to a tunnel domain name.

2. The method according to claim 1, characterized in that The first preset model further includes: a word segmentation model trained based on the Jieba word segmentation library, using the first preset model to extract features of the domain name to be detected, and obtaining multiple domain name features of the domain name to be detected includes: Using the word segmentation model to segment characters in the domain name to be detected, to obtain a plurality of words to be detected, wherein the characters include at least one byte, and the words to be detected are meaningful characters or meaningless characters; Among the multiple words to be detected, the word to be detected in which all characters belong to the meaningless characters is determined as a meaningless word, wherein the two ends of the meaningless word in the domain name to be detected are respectively a first meaningful word and a second meaningful word, and the characters in the first meaningful word and the second meaningful word are the meaningful characters; A first ratio between the character length in the first meaningful word and the character length in the meaningless word is summed with a second ratio between the character length in the second meaningful word and the character length in the meaningless word to obtain a character tension feature of the domain name to be detected, wherein the character tension feature is the domain name feature.

3. The method according to claim 1, characterized in that Before extracting features of the domain name to be detected using the first preset model to obtain multiple domain name features of the domain name to be detected, the method further includes: Acquire a sample data set, wherein the sample data set includes: a plurality of domain name samples, the domain name samples are white samples or black samples, the white samples at least include: a plurality of preset domain names crawled from the Internet, a domain name aggregation parsed from a historical operation log, a plurality of domain name combinations set according to a first preset rule, and a plurality of preset phrase combinations set according to a second preset rule, and the black samples are a plurality of tunnel domain names created in advance by using a tunnel generation tool of a domain name system; The first preset model and the second preset model are trained using the sample data set.

4. The method according to claim 3, characterized in that Using the sample data set to train the first preset model and the second preset model includes: Extracting the subdomain of each domain name sample from the sample data set; The first preset model and the second preset model are trained by using the subdomains corresponding to the plurality of white samples and the subdomains corresponding to the plurality of black samples.

5. The method according to claim 4, characterized in that Extracting the subdomain of each domain name sample from the sample data set includes: In the sample data set, identifying the second-level and above domain names in each of the domain name samples; The second-level and above domain names in each of the domain name samples are deleted to obtain the subdomain name corresponding to each of the domain name samples.

6. The method according to claim 3, characterized in that After obtaining the sample data set, the method further includes: In the sample data set, identifying the numeric bytes in each of the domain name samples; The numeric bytes in the domain name sample are generalized to 0.

7. The method according to claim 1, characterized in that Before using the second preset model to detect the multiple domain name features of the domain name to be detected to obtain the detection result of the domain name to be detected, the method further includes: Using a gradient boosting algorithm, multiple iterations of training are performed with the goal of minimizing the loss function of the second preset model; In the case of each iterative training, the residual of the second preset model trained in the current iteration is fitted with the residual of the second preset model trained in the previous iteration until the preset iteration end condition is reached, wherein the residual of the second preset model is the error between the predicted value generated by the second preset model based on the test sample and the true value of the test sample. When the preset iteration end condition is reached, the second preset model trained most recently is obtained, and the preset iteration end condition includes at least: the number of iterations reaches the preset number, or the loss function of the second preset model meets the preset loss condition.

8. A tunnel domain name detection device, characterized in that: include: An acquisition module is used to obtain the domain name to be detected; An extraction module is used to extract features of the domain name to be detected using a first preset model to obtain multiple domain name features of the domain name to be detected, wherein the first preset model at least includes: a multivariate grammar model trained using machine learning, the multivariate grammar model is used to intercept a byte segment sequence that meets a preset byte length from multiple bytes of the domain name to be detected according to a sliding window of a preset byte length, the byte segment sequence includes: multiple byte segments, and the domain name features at least include: vector space features determined based on the byte segments; A monitoring module is used to use a second preset model to detect multiple domain name features of the domain name to be detected, and obtain a detection result of the domain name to be detected, wherein the second preset model is an extreme gradient boosting model trained using machine learning, and the extreme gradient boosting model uses a decision tree as a learner for multiple trainings to obtain multiple decision trees established in sequence, and each decision tree trained is used to correct the errors of the decision tree trained last time, and the detection result is used to indicate that the domain name to be detected belongs to a tunnel domain name, or that the domain name to be detected does not belong to a tunnel domain name.

9. An electronic device comprising a memory and a processor, characterized in that: The memory stores a computer program, and the processor is configured to execute the tunnel domain name detection method according to any one of claims 1 to 7 through the computer program.

10. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the steps of the method for detecting a tunnel domain name described in any one of claims 1 to 7 are implemented.

Images