Unknown malicious domain name detection method based on time sequence hypergraph neural network

Abstract

The invention relates to the technical field of domain name detection, and discloses an unknown malicious domain name detection method based on a time sequence hypergraph neural network, which comprises the following steps: firstly, extracting character features, analysis features and registration features of an unknown domain name, and constructing feature data of a multi-modal domain name; the method comprises the following steps of: constructing a multi-modal data model, constructing different hyperedges by using a decision tree method and utilizing the multi-modal data, carrying out convolution operation on a hypergraph formed by the hyperedges, carrying out convolution operation feature aggregation by using a hypergraph neural network, carrying out node classification through a classifier of the neural network, and establishing an LSTM (Long Short Term Memory) model; learning the dynamic and static analysis characteristics of the domain name through an LSTM model, and detecting an unknown malicious domain name; and finally, updating the detection model. According to the method, the malicious behaviors are described in combination with the multi-dimensional features of the domain names, the hypergraph model of the high-order incidence relation is used for detection, meanwhile, the model is effectively updated, and the detection efficiency and accuracy of the malicious domain names are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of domain name detection, and in particular to a method for detecting unknown malicious domain names. Background Art

[0002] The emergence and development of new Internet forms have brought more novel network services to users, but also made Internet security defense more and more severe. Network intrusion detection is one of the main technologies for Internet security protection. It detects network intrusion events by identifying network traffic content and behavior. Since most network attack events often require the use of domain names to obtain control server addresses or resource server addresses, malicious domain name detection has become an important part of network intrusion detection. By detecting malicious domain names, network intrusion events can be discovered as early as possible. Currently, the commonly used solutions for network intrusion detection based on malicious domain names include: (1) Traditional statistical and rule matching methods, which understand knowledge and rules by analyzing statistical data. Specifically, it uses the blacklist and whitelist mechanism, and once a malicious domain name is identified, an alarm will be issued. (2) Detection methods based on machine learning. In order to evade the blacklist and whitelist mechanism, malicious domain names often use certain domain name generation technologies, such as DGA technology. After manually extracting the features of the domain name, machine learning algorithms are used for classification, such as K-nearest neighbor algorithm (KNN), hybrid clustering algorithm, Boosting algorithm, etc. Machine learning can help to identify variant malicious domain names. (3) Deep learning algorithm detection algorithm. However, many advanced attacks often hide domain name features from multiple angles. Traditional machine learning is based on structured rule matching. Once the number of features increases, it often leads to underfitting or overfitting problems. For this reason, deep learning algorithms collect all features related to domain names and then input them into the model for training. In addition, there are some algorithms that directly input encrypted payloads into the network for training. Such algorithms include multi-layer perceptrons, convolutional neural networks, recurrent neural networks, autoencoders, etc.

[0003] With the rapid development of new networks, the traditional Internet has expanded from wired Internet to wireless Internet, Internet of Things, Internet of Vehicles, etc. New Internet protocols and technologies not only bring more network services, but also provide attackers with more attack surfaces, which greatly increases the difficulty of network defense. Traditional network intrusion detection based on malicious domain name technology is one of them. The generation speed and hiding methods of malicious domain names are becoming more and more automated and intelligent, which makes it difficult for traditional malicious domain name identification technologies based on black and white lists and traditional machine learning algorithms to cope with a large number of unknown and new malicious domain name detections. This discovery proposes an unknown malicious domain name detection technology based on a temporal hypergraph neural network. By summarizing and analyzing the similarity of existing domain names and combining the temporal access characteristics of domain names, unknown malicious domain names potential in Internet domain name access traffic are discovered, so as to achieve the effect of discovering network intrusion attacks as early as possible.

[0004] Machine learning and deep learning only learn the domain name related features in the Euclidean space. They have a certain ability to identify known or mutated malicious domain names, but it is difficult to effectively learn the features of unknown malicious domain names. This is because the malicious domain name features are not strictly Euclidean space structural relationships but non-Euclidean space structural relationships. Once the relationship between domain name features does not conform to the Euclidean space structural relationship, traditional detection methods will not be able to effectively identify them. Summary of the invention

[0005] The purpose of the present invention is to solve the above-mentioned problems in the prior art and provide a method for detecting unknown malicious domain names based on a temporal hypergraph neural network. The present invention combines the multi-dimensional features of domain names to characterize malicious behavior, uses a hypergraph model of high-order associations for detection, and effectively updates the model, thereby improving the detection efficiency and accuracy of malicious domain names.

[0006] The present invention is achieved by the following technical solution: comprising the following steps: S1: Extract character features, parsing features and registration features of unknown domain names to construct feature data of multimodal domain names; S2: Use the decision tree method to build different hyperedges using multimodal data, and then perform convolution operations on the hypergraph formed by the hyperedges. Perform convolution operations on multiple DNS requests for the same domain name before and after a period of time, multiple domain name requests together, that is, the correlation between the same domain name before and after the time, the correlation between different domain names accessed at the same time, and the temporal characteristics of the domain name access frequency; S3: The acquired information is trained in a hypergraph neural network, multiple similar domain names are connected together to build hyperedges, and hyperedges are combined together to form a hypergraph. The hypergraph neural network is then used to perform convolution operations and feature aggregation. Finally, the nodes are classified through the neural network classifier, and an LSTM model is established. S4: Use the LSTM model to learn the dynamic and static parsing features of domain names and detect unknown malicious domain names; S5: Update the detection model. When updating the detection model, use the weights of the trained hypergraph part of the model for the hypergraph part, retrain the classifier part of the model, obtain a new training model, and deploy it online.

[0007] Furthermore, in step S1, the characteristic data includes the domain name string length, the number of domain name strings, the proportion of digits in the domain name, and the information entropy of the domain name obtained by dividing the number of digits in the domain name by the domain name string length; and the entropy value calculated using the frequency of occurrence of each character in the domain name.

[0008] Furthermore, the DNS request information includes the registrant of the domain name, the name of the individual or enterprise that registered the domain name, the registrar of the domain name, the registered domain name merchant, the registration time of the domain name, the date of registration of the domain name, the expiration time of the domain name, the date of expiration of the domain name, the DNS server of the domain name, the DNS server used to resolve the domain name, the status of the domain name, the status information of the domain name resolution, the contact email address of the domain name, the email address of the domain name contact person, and the contact phone number of the domain name contact person. The six features of year, month, day, hour, minute, and second are identified for the registration time of the domain name, the date of registration of the domain name, the expiration time of the domain name, and the date of expiration of the domain name, and the other features are represented by their corresponding numbers.

[0009] The domain name resolution information in the DNS data packet includes the IP information of the domain name resolution, the alias CNAME information of the domain name resolution, the domain name mail exchange server address MX information, and the default TTL information of the domain name. The default TTL information of the domain name directly uses the numerical value, and the other features are represented by their corresponding numbers.

[0010] Furthermore, step S3 is specifically performed according to the following steps: S 3.1 :First, data preprocessing is performed, the acquired data is grouped and encoded, and the same group of data is treated as a whole sample for data processing; S 3.2 :Function extraction is then performed to extract DNS multimodal features from a set of data, hyperedges are constructed for the extracted features of different categories, decision trees are constructed for classification, and all samples of leaf nodes classified by the decision tree are divided into the same hyperedges; S 3.3 : Different weights are assigned to the hyperedges constructed with different modal features, and then the Laplacian matrix is ​​extracted from the matrix of the hypergraph and the following convolution operation is defined, as shown in formula (1); Formula (1)

[0011] Among them, X represents the feature matrix of the input node, H is the hypergraph matrix, represents the vertex degree matrix, represents the edge degree matrix, represents the learning parameters;

[0012] S 3.4:Integrate the time series behavior features with the hypergraph neural network, design the interval t, and use the captured data nodes to build a hypergraph every time t; set the time window T, T contains multiple t; determine whether there are the same nodes in the previous and next hypergraphs in the time window T. If so, establish LSTM models for these nodes. To establish the LSTM model, first learn the node features of the hypergraph in each time window, and then update the time feature dimension of the LSTM model for the nodes.

[0013] When establishing the LSTM model, data with a time window of 1 minute and a total time length of 1 hour are sampled from the preprocessed data for training. 5N data are sampled in each time window to build a hypergraph of size N. A 5-fold cross-validation method is used in the 5N data, of which 4N data are used as training sets and the remaining 1N are used as validation sets. Among them, samples N of 10,000 are taken for model training.

[0014] After the model training is completed, it is deployed and used online. When new data is generated, malicious domain names are detected in real time.

[0015] Compared with the prior art, the beneficial effects of the present invention include: 1. The multi-dimensional features of domain names are combined to characterize malicious behaviors, and a hypergraph model of high-order associations is used for detection. At the same time, the model is effectively updated to improve the detection efficiency and accuracy of malicious domain names.

[0016] 2. By summarizing and analyzing the similarities of existing domain names and combining them with the domain name time access characteristics, we can discover unknown malicious domain names potentially in the Internet domain name access traffic, so as to achieve the effect of discovering network intrusion attacks as early as possible. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 is a flow chart of the method of the present invention; Figure 2 A schematic diagram of the hypergraph neural network training of the present invention; Figure 3 A schematic diagram of establishing an LSTM model by establishing nodes through the same nodes of the present invention. DETAILED DESCRIPTION

[0018] The present invention is further described in detail below in conjunction with the accompanying drawings: refer to Figure 1-3 As shown, the unknown malicious domain name detection method based on the temporal hypergraph neural network provided by the present invention includes the following steps: Figure 1 As shown: S1: Extract character features, parsing features and registration features of unknown domain names to construct feature data of multimodal domain names; parse domain names through network communication, and the parsing behavior can reflect attack characteristics.

[0019] S2: Use the decision tree method to build different hyperedges using multimodal data, and then perform convolution operations on the hypergraph formed by the hyperedges. Perform convolution operations on multiple DNS requests for the same domain name before and after a period of time, multiple domain name requests together, that is, the correlation between the same domain name before and after the time, the correlation between different domain names accessed at the same time, and the temporal characteristics of the domain name access frequency; S3: The acquired information is trained in a hypergraph neural network, multiple similar domain names are connected together to build hyperedges, and hyperedges are combined together to form a hypergraph. The hypergraph neural network is then used to perform convolution operations and feature aggregation. Finally, the nodes are classified through the neural network classifier, and an LSTM model is established. S4: Use the LSTM model to learn the dynamic and static parsing features of domain names and detect unknown malicious domain names; S5: Update the detection model. When updating the detection model, use the weights of the trained hypergraph part of the model for the hypergraph part, retrain the classifier part of the model, obtain a new training model, and deploy it online.

[0020] In this embodiment, in step S1, since the attacker uses a program to generate a large number of malicious domain names, such features can be reflected through the domain name character string. The feature data includes the length of the domain name character string, the number of domain name character strings, the proportion of digits in the domain name, and the information entropy of the domain name divided by the number of digits in the domain name by the length of the domain name character string; and the entropy value calculated by the frequency of occurrence of each character in the domain name.

[0021] In this embodiment, the registration information of the domain name in the DNS data packet, in order to implement the attack, the attacker usually registers a batch of similar domain names for IP resolution, wherein the DNS request information includes the registrant of the domain name, the name of the individual or enterprise that registered the domain name, the registrar of the domain name, the registered domain name merchant, the registration time of the domain name, the date of registration of the domain name, the expiration time of the domain name, the date of expiration of the domain name, the DNS server of the domain name, the DNS server used to resolve the domain name, the status of the domain name, the status information of the domain name resolution, the contact email of the domain name, the email of the domain name contact person, and the contact phone number of the domain name contact person. Among them, the registration time of the domain name, the date of registration of the domain name, the expiration time of the domain name, and the expiration date of the domain name are identified as six features of year, month, day, hour, minute, and second, and other features are represented by their corresponding numbers.

[0022] The domain name resolution information in the DNS data packet includes the IP information of the domain name resolution, the alias CNAME information of the domain name resolution, the domain name mail exchange server address MX information, and the default TTL information of the domain name. The default TTL information of the domain name directly uses the numerical value, and the other features are represented by their corresponding numbers.

[0023] Further, such as Figure 2 Step S3 is specifically performed as follows: S 3.1 :First, data preprocessing is performed, the acquired data is grouped and encoded, and the same group of data is treated as a whole sample for data processing; S 3.2 :Function extraction is then performed to extract DNS multimodal features from a set of data, hyperedges are constructed for the extracted features of different categories, decision trees are constructed for classification, and all samples of leaf nodes classified by the decision tree are divided into the same hyperedges; S 3.3 : Different weights are assigned to the hyperedges constructed with different modal features, and then the Laplacian matrix is ​​extracted from the matrix of the hypergraph and the following convolution operation is defined, as shown in formula (1); Formula (1)

[0024] Among them, X represents the feature matrix of the input node, H is the hypergraph matrix, represents the vertex degree matrix, represents the edge degree matrix, represents the learning parameters;

[0025] S 3.4 :When a domain name appears at a certain point in time, similar domain names at the same time are aggregated. Then, as time goes by, the historical features learned by itself are passed on. The present invention integrates the temporal behavior features with the hypergraph neural network, designs the interval t, and uses the captured data nodes to build a hypergraph every time t; sets a time window T, where T contains multiple t; determines whether there are identical nodes in the previous and next hypergraphs in the time window T, and if so, establishes LSTM models for these nodes. To establish the LSTM model, firstly, the node features of the hypergraph in each time window are learned, and then the time feature dimension of the LSTM model is updated for the nodes.

[0026] like Figure 3 When building the LSTM model, data with a time window of 1 minute and a total time length of 1 hour are sampled from the preprocessed data for training. 5N data are sampled in each time window to build a hypergraph of size N. A 5-fold cross-validation method is used in the 5N data, of which 4N data are used as training sets and the remaining 1N are used as validation sets; among them, samples N of 10,000 are taken for model training.

[0027] After the model training is completed, it is deployed and used online. When new data is generated, malicious domain names are detected in real time.

[0028] Malicious domain names are distinguishable from benign domain names in static resolution behaviors such as semantic features, registration features, and resolution features. At the same time, malicious domain names are different from benign domain names in dynamic resolution features of access time. Since the hypergraph and LSTM time series model learn the dynamic and static resolution features of domain names, the model trained by the present invention has the ability to detect unknown malicious domain names.

[0029] The above technical solution is only one implementation mode of the present invention. For those skilled in the art, it is easy to make various types of improvements or modifications based on the principles disclosed in the present invention, and it is not limited to the technical solution described in the above specific embodiments of the present invention. Therefore, the above description is only preferred and does not have a restrictive meaning.

Claims

1. The unknown malicious domain name detection method based on temporal hypergraph neural network is characterized by: The following steps are involved: S1: Extract character features, parsing features and registration features of unknown domain names to construct feature data of multimodal domain names; S2: Use the decision tree method to build different hyperedges using multimodal data, and then perform convolution operations on the hypergraph formed by the hyperedges. Perform convolution operations on multiple DNS requests for the same domain name before and after a period of time, multiple domain name requests together, that is, the correlation between the same domain name before and after the time, the correlation between different domain names accessed at the same time, and the temporal characteristics of the domain name access frequency; S3: The acquired information is trained in a hypergraph neural network, multiple similar domain names are connected together to build hyperedges, and hyperedges are combined together to form a hypergraph. The hypergraph neural network is then used to perform convolution operations and feature aggregation. Finally, the nodes are classified through the neural network classifier, and an LSTM model is established. S4: Use the LSTM model to learn the dynamic and static parsing features of domain names and detect unknown malicious domain names; S5: Update the detection model.

2. The unknown malicious domain name detection method based on temporal hypergraph neural network according to claim 1 is characterized in that: In step S1, the characteristic data includes the domain name string length, the number of domain name strings, the proportion of digits in the domain name, and the information entropy of the domain name obtained by dividing the number of digits in the domain name by the domain name string length; and the entropy value calculated by the frequency of occurrence of each character in the domain name.

3. The unknown malicious domain name detection method based on temporal hypergraph neural network according to claim 1 is characterized in that: The DNS request information includes the domain name registrant, the name of the individual or company that registered the domain name, the domain name registrar, the registered domain name merchant, the domain name registration time, the domain name registration date, the domain name expiration time, the domain name expiration date, the domain name DNS server, the DNS server used to resolve the domain name, the domain name status, the domain name resolution status information, the domain name contact email, the domain name contact email, and the domain name contact phone number.

4. The unknown malicious domain name detection method based on temporal hypergraph neural network according to claim 3 is characterized in that: The domain name registration time, domain name registration date, domain name expiration time and domain name expiration date are identified as year, month, day, hour, minute and second. Other features are represented by their corresponding numbers.

5. The unknown malicious domain name detection method based on temporal hypergraph neural network according to claim 1 is characterized in that: The domain name resolution information in the DNS data packet includes the IP information of the domain name resolution, the alias CNAME information of the domain name resolution, the domain name mail exchange server address MX information, and the default TTL information of the domain name. The default TTL information of the domain name directly uses the numerical value, and the other features are represented by their corresponding numbers.

6. The unknown malicious domain name detection method based on temporal hypergraph neural network according to claim 1 is characterized in that: In step S3, the following steps are specifically performed: S 3.1 :First, data preprocessing is performed, the acquired data is grouped and encoded, and the same group of data is treated as a whole sample for data processing; S 3.2 :Function extraction is then performed to extract DNS multimodal features from a set of data, hyperedges are constructed for the extracted features of different categories, decision trees are constructed for classification, and all samples of leaf nodes classified by the decision tree are divided into the same hyperedges; S 3.3 :Assign different weights to the hyperedges constructed with different modal features, then extract the Laplacian matrix from the matrix of the hypergraph and define the following convolution operation, as shown in formula (1) Formula (1) Among them, X represents the feature matrix of the input node, H is the hypergraph matrix, represents the vertex degree matrix, represents the edge degree matrix, represents the learning parameters; S 3.4 :Integrate the time series behavior features with the hypergraph neural network, design the interval t, and use the captured data nodes to build a hypergraph every time t; set the time window T, T contains multiple t; determine whether there are the same nodes in the previous and next hypergraphs in the time window T, and if so, establish LSTM models for these nodes.

7. The unknown malicious domain name detection method based on temporal hypergraph neural network according to claim 6 is characterized in that: In step S 3.4 In the process of building an LSTM model, the node features of the hypergraph in each time window are first learned, and then the time feature dimension of the LSTM model is updated for the nodes.

8. The unknown malicious domain name detection method based on temporal hypergraph neural network according to claim 7 is characterized in that: When building the LSTM model, we sampled data with a time window of 1 minute and a total time length of 1 hour from the preprocessed data for training. We sampled 5N data in each time window and built a hypergraph of size N. We used a 5-fold cross-validation method on the 5N data, with 4N data as the training set and the remaining 1N as the validation set. After the model training is completed, it is deployed and used online. When new data is generated, malicious domain names are detected in real time.

9. The unknown malicious domain name detection method based on temporal hypergraph neural network according to claim 8 is characterized in that: in, Take samples N of 10,000 for model training.

10. The unknown malicious domain name detection method based on temporal hypergraph neural network according to claim 1 is characterized in that: In step S5, when the detection model is updated, the weights of the trained hypergraph part are used for the hypergraph part of the model, and the classifier part of the model is retrained to obtain a new training model and deploy it online.

Images