Method for detecting unknown malicious domain name based on time sequence hypergraph neural network

Abstract

The application relates to the technical field of domain name detection, and discloses an unknown malicious domain name detection method based on a time sequence hypergraph neural network, which comprises the following steps: firstly, unknown domain names are extracted to obtain character features, parsing features and registration features, and feature data of multi-modal domain names are constructed; secondly, a decision tree method is used to construct different hyperedges by using the multi-modal data, convolution operation is carried out on the hypergraph formed by the hyperedges, convolution operation feature aggregation is carried out by using a hypergraph neural network, node classification is carried out by using a neural network classifier, and an LSTM model is established; thirdly, the LSTM model is used to learn dynamic and static parsing features of the domain names, and unknown malicious domain names are detected; and finally, the detection model is updated. The application combines multi-dimensional features of the domain names to depict malicious behaviors, uses a hypergraph model of high-order correlation to carry out detection, effectively updates the model, and improves the detection efficiency and accuracy of the malicious domain names.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of domain name detection, and particularly relates to an unknown malicious domain name detection method. BACKGROUND

[0002] The emergence and development of new Internet forms bring more novel network services to users, but also make Internet security defense more and more severe. Network intrusion detection is one of the main technologies for Internet security protection, which discovers network intrusion events by identifying network traffic content and behavior. Since most network attack events often need to use domain names to obtain control server addresses or resource server addresses, malicious domain name detection becomes an important content of network intrusion detection. Through the detection of malicious domain names, network intrusion events can be discovered as early as possible. At present, the commonly used schemes for network intrusion detection based on malicious domain names include: (1) traditional statistical-based and rule-matching methods, which understand knowledge and rules by analyzing statistical data. Specifically, it uses black and white list mechanism, and once a malicious domain name is identified, an alarm will be issued. (2) Machine learning-based detection methods. In order to avoid the black and white list mechanism, malicious domain names often use some domain name generation techniques, such as DGA technology. After manually extracting the features of domain names, machine learning algorithms such as K-Nearest Neighbor (KNN), hybrid clustering algorithm, Boosting algorithm, etc. are used for classification. Machine learning can help identify variant malicious domain names. (3) Deep learning algorithm detection algorithm. However, many advanced attacks often hide domain name features from multiple angles. Traditional machine learning is based on structured rule matching, and once the number of features increases, it often leads to underfitting or overfitting problems. Therefore, deep learning algorithms collect all features related to domain names, and then input the model for training. In addition, some algorithms directly input the encrypted payload into the network for training, such as multilayer perceptron, convolutional neural network, recurrent neural network, and autoencoder.

[0003] With the rapid development of new networks, the traditional Internet composition has been expanded from wired Internet to wireless Internet, Internet of Things, Internet of Vehicles, etc. New Internet protocols and technologies not only bring more network services, but also provide attackers with more attack surfaces, making network defense much more difficult. Network intrusion detection based on traditional malicious domain name technology is one of them. The generation speed and hiding methods of malicious domain names are becoming more and more automated and intelligent, making it difficult for traditional black and white list-based and traditional machine learning algorithm-based malicious domain name recognition technologies to cope with a large number of unknown and new malicious domain names. The present application proposes an unknown malicious domain name detection technology based on time sequence hypergraph neural network, which discovers potential unknown malicious domain names in Internet domain name access traffic by analyzing the similarity of existing domain names and combining domain name time sequence access features, so as to discover network intrusion attacks as early as possible.

[0004] Machine learning and deep learning only learn domain name related features in Euclidean space, have certain identification ability for known or variant malicious domain names, and are difficult to effectively learn unknown malicious domain name features. Because the malicious domain name features are not strictly Euclidean space structure relationship but non-Euclidean space structure relationship, once the relationship between the domain name features does not conform to the Euclidean space structure relationship, the traditional detection method will not be able to effectively identify it. SUMMARY

[0005] The purpose of the present application is to solve the problems existing in the prior art, and to provide a method for detecting unknown malicious domain names based on time sequence hypergraph neural network. The present application combines the multi-dimensional features of domain names to describe malicious behavior, uses a hypergraph model of high-order correlation relationship for detection, and effectively updates the model, thereby improving the detection efficiency and accuracy of malicious domain names.

[0006] The present application is implemented by the following technical solutions: comprising the following steps:

[0007] S1: extracting character features, parsing features and registration features of unknown domain names, and constructing feature data of multi-modal domain names;

[0008] S2: using a decision tree method to construct different hyperedges using multi-modal data, and then performing convolution operation on the hypergraph formed by the hyperedges; the convolution operation is performed on the time sequence features of multiple DNS requests existing before and after a certain period of time for the same domain name, multiple domain names together requesting, the correlation of the same domain name existing before and after a certain period of time, the correlation of different domain names accessing at the same time, and domain name access frequency;

[0009] S3: training the acquired information in a hypergraph neural network, connecting multiple similar domain names together to construct a hyperedge, combining the hyperedges together to form a hypergraph, and then performing convolution operation feature aggregation using the hypergraph neural network, finally classifying the nodes through the neural network classifier, and establishing an LSTM model;

[0010] S4: learning the dynamic and static parsing features of the domain name through the LSTM model, and detecting unknown malicious domain names;

[0011] S5: updating the detection model, when updating the detection model, using the trained weight of the hypergraph part of the model for the hypergraph part of the model, retraining the classifier part of the model, obtaining a new training model and deploying it online for use.

[0012] Furthermore, in step S1, the character feature data includes the domain name string length, the number of domain name strings, the proportion of digits in the domain name, and the information entropy of the domain name obtained by dividing the number of digits in the domain name by the domain name string length; and the entropy value calculated using the frequency of occurrence of each character in the domain name.

[0013] Furthermore, the DNS request information includes the domain name registrant, the name of the individual or enterprise that registered the domain name, the domain name registrar, the domain name merchant, the domain name registration time, the domain name registration date, the domain name expiration time, the domain name expiration date, the domain name DNS server, the DNS server used to resolve the domain name, the domain name status, domain name resolution status information, the domain name contact email address, the domain name contact email address, and the domain name contact phone number. The six features of the domain name registration time, domain name registration date, domain name expiration time, and domain name expiration date are identified, and the other features are represented by their corresponding numbers.

[0014] The domain name resolution information in the DNS data packet includes the IP information of the domain name resolution, the alias CNAME information of the domain name resolution, the domain name mail exchange server address MX information, and the default TTL information of the domain name. The default TTL information of the domain name directly uses the numerical value, and the other features are represented by their corresponding numbers.

[0015] Furthermore, step S3 is specifically performed according to the following steps:

[0016] S 3.1 : First, data preprocessing is performed, the acquired data is grouped and encoded, and the same group of data is treated as a whole sample for data processing;

[0017] S 3.2 : Then perform feature extraction, extract DNS multimodal features from a set of data, construct hyperedges for the extracted features of different classes, build decision trees for classification, and divide all samples of the leaf nodes of the decision tree classification into the same hyperedge;

[0018] S 3.3 : Assign different weights to the hyperedges constructed with different modal features, then extract the Laplacian matrix from the matrix of the hypergraph and define the following convolution operation, as shown in formula (1);

[0019]

[0020] Formula (1)

[0021] Among them, X represents the feature matrix of the input node, H is the hypergraph matrix, represents the vertex degree matrix, represents the degree matrix of the edge, represents the learning parameters;

[0022] S 3.4 :Integrate temporal behavior features with hypergraph neural networks, design an interval t, and use the captured data nodes to build a hypergraph every time t; set a time window T, which contains multiple t; determine whether there are identical nodes in the previous and next hypergraphs in the time window T. If so, establish LSTM models for these nodes. To establish the LSTM model, first learn the node features of the hypergraph in each time window, and then update the time feature dimension of the LSTM model for the nodes.

[0023] When building the LSTM model, we sampled data with a time window of 1 minute and a total time length of 1 hour from the preprocessed data for training. We sampled 5N data in each time window and constructed a hypergraph of size N. We used a 5-fold cross-validation method on the 5N data, with 4N data as the training set and the remaining 1N as the validation set. Among them, N samples were taken for model training.

[0024] After the model training is completed, it is deployed and used online. When new data is generated, malicious domain names are detected in real time.

[0025] Compared with the prior art, the present invention has the following beneficial effects:

[0026] 1. It combines the multi-dimensional characteristics of domain names to characterize malicious behavior and uses a hypergraph model of high-order associations for detection. At the same time, it effectively updates the model to improve the efficiency and accuracy of malicious domain name detection.

[0027] 2. By summarizing and analyzing the similarities of existing domain names and combining them with the domain name time-series access characteristics, we can discover unknown malicious domain names potentially in Internet domain name access traffic, thereby achieving the effect of discovering network intrusion attacks as early as possible. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 is a flow chart of the method of the present invention;

[0029] Figure 2 This is a schematic diagram of the hypergraph neural network training of the present invention;

[0030] Figure 3 A schematic diagram of establishing an LSTM model by establishing nodes through the same nodes of the present invention. DETAILED DESCRIPTION

[0031] The present invention is further described in detail below with reference to the accompanying drawings:

[0032] refer to Figures 1-3 As shown, the unknown malicious domain name detection method based on the temporal hypergraph neural network provided by the present invention includes the following steps: Figure 1 As shown:

[0033] S1: Extracting the character features, parsing features and registration features of unknown domain names, and constructing multi-modal domain name feature data; network communication parses the domain name, and the parsing behavior can reflect the attack features.

[0034] S2: Use the decision tree method to construct different hyper-edges using multi-modal data, and then perform convolution operation on the hypergraph formed by the hyper-edges. For multiple DNS requests existing before and after a certain period of time for the same domain name, multiple domain names are requested together, the correlation between the same domain name before and after the existence time, the correlation of different domain names accessed at the same time, and the time sequence features of domain name access frequency are convolved.

[0035] S3: Train the hypergraph neural network on the obtained information, connect multiple similar domain names together to construct hyper-edges, combine the hyper-edges together to form a hypergraph, and then use the hypergraph neural network to perform convolution operation and feature aggregation. Finally, the nodes are classified by the neural network classifier, and an LSTM model is established.

[0036] S4: Learn the static and dynamic parsing features of the domain name through the LSTM model, and detect unknown malicious domain names.

[0037] S5: Update the detection model. When updating the detection model, use the trained weight of the hypergraph part of the model to retrain the classifier part of the model, obtain a new training model, and deploy it online for use.

[0038] In step S1 of the embodiment, since the attacker uses a program to generate a large number of malicious domain names, the domain name string can reflect such features. The character feature data includes the length of the domain name string, the number of domain name strings, the proportion of numbers in the domain name, and the information entropy of the number of domain names divided by the length of the domain name string. And the entropy value calculated from the frequency of each character in the domain name.

[0039] In this embodiment, the registration information of the domain name in the DNS data packet, the attacker usually registers a batch of similar domain names to perform IP resolution in order to achieve the attack. The DNS request information includes the registrant of the domain name, the individual or enterprise name of the registered domain name, the registrar of the domain name, the domain name registrar, the registration time of the domain name, the registration date of the domain name, the expiration time of the domain name, the expiration date of the domain name, the DNS server of the domain name, the DNS server used to resolve the domain name, the status of the domain name, the status information of the domain name resolution, the contact mailbox of the domain name, the mailbox of the domain name contact, and the contact telephone of the domain name contact. Among them, the registration time of the domain name, the registration date of the domain name, the expiration time of the domain name and the expiration date of the domain name are identified as six features of year, month, day, hour, minute and second, and other features are represented by their corresponding number.

[0040] The resolution information of the domain name in the DNS packet includes IP information of domain name resolution, alias CNAME information of domain name resolution, domain name mail exchange server address MX information, and default TTL information of the domain name, wherein the default TTL information of the domain name directly uses a numerical value, and the rest of the features use corresponding numbers to represent.

[0041] Further, as Figure 2 , step S3 is specifically performed according to the following steps:

[0042] S 3.1 : First, data preprocessing is performed, and the obtained data groups are encoded, and the same group of data is taken as a whole sample for data processing;

[0043] S 3.2 : Then, feature extraction is performed, DNS multi-modal features are extracted from a group of data, different types of features are constructed into hyper-edges, decision trees are respectively constructed for classification, and all samples of the leaf nodes of the decision tree classification are divided into the same hyper-edges;

[0044] S 3.3 : Different weights are given to the hyper-edges constructed by different modal features, and then the Laplacian matrix is extracted from the matrix of the hypergraph and defined as follows Convolution operation, such as formula (1);

[0045]

[0046] Formula (1)

[0047] Wherein, X represents the feature matrix of the input node, H is the hypergraph matrix, represents the vertex degree matrix, represents the edge degree matrix, represents the learning parameter;

[0048] S 3.4 : When the domain name appears at a certain time point, similar domain names at the same time are aggregated. Then, as time goes on, the learned historical features are passed down. The application fuses the time sequence behavior features with the hypergraph neural network, designs an interval t, and constructs a hypergraph using the captured data nodes every t; a time window T is set, and T contains multiple t; it is judged whether there are same nodes in the front and rear hypergraphs in the time window T, and if there are, an LSTM model is established for these nodes. The LSTM model first learns the node features in each time window hypergraph, and then updates the time feature dimension of the node by the LSTM model.

[0049] As Figure 3When the LSTM model is established, a time window of 1 minute is sampled from the preprocessed data, and data with a total length of 1 hour is trained, 5N data are sampled in each time window, a hypergraph with a size of N is constructed, and a 5-fold cross-validation method is used in the 5N data, 4N data are used as a training set, and the remaining 1N is used as a validation set; wherein N is 10000.

[0050] After the model training is completed, the model is deployed online, and when new data is generated, real-time detection of malicious domain names is performed.

[0051] The malicious domain name has a degree of distinction with the benign domain name in the semantic features, registration features, resolution features and other static resolution behaviors, and the malicious domain name is different from the benign domain name in the dynamic resolution features of the access time. Since the hypergraph and the LSTM time sequence model learn the dynamic and static resolution features of the domain name, the model trained by the present application has the detection capability for unknown malicious domain names.

[0052] The above technical solution is only one embodiment of the present application, and for those skilled in the art, on the basis of the principles disclosed in the present application, various types of improvements or modifications can be easily made, and the technical solution described in the above embodiment is not limited to the present application, therefore the above description is only preferred, and is not limited in nature.

Claims

1. The unknown malicious domain name detection method based on temporal hypergraph neural network is characterized by: The following steps are involved: S1: Extract character features, parsing features, and registration features of unknown domain names to construct feature data of multimodal domain names; S2: Use a decision tree approach to construct different hyperedges using multimodal data. Then, perform a convolution operation on the hypergraph formed by these hyperedges. This convolution operation is performed on multiple DNS requests for the same domain name over a period of time, requests for multiple domain names together (i.e., correlation between the same domain name before and after a certain time period), correlation between different domain names accessed at the same time, and the temporal characteristics of domain name access frequency. S3: The acquired information is trained on a hypergraph neural network. Multiple similar domain names are connected to form hyperedges. Hyperedges are combined to form a hypergraph. The hypergraph neural network is then used to perform convolution operations on feature aggregation. Finally, the neural network classifier is used to classify nodes and build an LSTM model. S 3.1 : First, data preprocessing is performed, the acquired data is grouped and encoded, and the same group of data is treated as a whole sample for data processing; S 3.2 : Then perform feature extraction, extract DNS multimodal features from a set of data, construct hyperedges for the extracted features of different classes, build decision trees for classification, and divide all samples of the leaf nodes of the decision tree classification into the same hyperedge; S 3.3 : Assign different weights to the hyperedges constructed with different modal features, then extract the Laplacian matrix from the hypergraph matrix and define the convolution operation; S 3.4 : Fusion of temporal behavior features with hypergraph neural networks. Design an interval t, and construct a hypergraph using captured data nodes every time t. Set a time window T, which contains multiple ts. Determine whether there are identical nodes in the previous and next hypergraphs within the time window T. If so, establish LSTM models for these nodes. S4: Use the LSTM model to learn the dynamic and static parsing features of domain names and detect unknown malicious domain names; S5: Update the detection model.

2. The method for detecting unknown malicious domain names based on a temporal hypergraph neural network according to claim 1 is characterized in that: In step S1, the character feature data includes the domain name string length, the number of domain name strings, the proportion of digits in the domain name, and the information entropy of the domain name obtained by dividing the number of digits in the domain name by the domain name string length; and the entropy value calculated using the frequency of occurrence of each character in the domain name.

3. The method for detecting unknown malicious domain names based on a temporal hypergraph neural network according to claim 1 is characterized in that: The DNS request information includes the domain name registrant, the name of the individual or company that registered the domain name, the domain name registrar, the registered domain name merchant, the domain name registration time, the domain name registration date, the domain name expiration time, the domain name expiration date, the domain name DNS server, the DNS server used to resolve the domain name, the domain name status, the domain name resolution status information, the domain name contact email address, the domain name contact email address, and the domain name contact phone number.

4. The method for detecting unknown malicious domain names based on a temporal hypergraph neural network according to claim 3 is characterized in that: The domain name registration time, domain name registration date, domain name expiration time and domain name expiration date are identified as six features: year, month, day, hour, minute and second. Other features are represented by their corresponding numbers.

5. The method for detecting unknown malicious domain names based on a temporal hypergraph neural network according to claim 1 is characterized in that: The domain name resolution information in the DNS data packet includes the IP information of the domain name resolution, the alias CNAME information of the domain name resolution, the domain name mail exchange server address MX information, and the default TTL information of the domain name. The default TTL information of the domain name directly uses the numerical value, and the other features are represented by their corresponding numbers.

6. The method for detecting unknown malicious domain names based on a temporal hypergraph neural network according to claim 1, wherein: In step S 3.4 In the process of building an LSTM model, the node features of the hypergraph in each time window are first learned, and then the time feature dimension of the LSTM model is updated for the nodes.

7. The method for detecting unknown malicious domain names based on a temporal hypergraph neural network according to claim 1, wherein: When building the LSTM model, we sampled data from the preprocessed data with a time window of 1 minute and a total time length of 1 hour for training. We sampled 5N data in each time window and constructed a hypergraph of size N. We used a 5-fold cross-validation method on the 5N data, with 4N data as the training set and the remaining 1N as the validation set. After the model training is completed, it is deployed and used online. When new data is generated, malicious domain names are detected in real time.

8. The method for detecting unknown malicious domain names based on a temporal hypergraph neural network according to claim 7 is characterized in that: in, Take N as 10,000 samples for model training.

9. The method for detecting unknown malicious domain names based on a temporal hypergraph neural network according to claim 1, wherein: In step S5, when the detection model is updated, the weights of the trained hypergraph part are used for the hypergraph part of the model, and the classifier part of the model is retrained to obtain a new training model and deploy it online.

Images