A domain name information processing and display method based on multi-modal data fusion

Abstract

The application discloses a kind of based on multi-modal data fusion's domain name information processing and display method, comprising the following steps: S1, acquisition domain name multi-modal original data and pre-processing, generate pre-processed data sample set;S2, to pre-processed data sample set is extracted, constructs multi-modal fusion feature vector sequence;S3, constructs initial Tab Net model, outputs initial domain name risk prediction result;S4, model performance evaluation objective function is constructed;S5, introduce dragonfly optimization algorithm, search and obtain optimal Tab Net parameter combination;S6, based on optimal Tab Net parameter combination, obtain optimized Tab Net model, output final domain name risk prediction result;S7, based on final domain name risk prediction result, constructs domain name knowledge graph display structure, generates interactive atlas display result.The application fuses multi-modal feature extraction mechanism, Tab Net deep model and dragonfly optimization algorithm, realizes the intelligent prediction of domain name risk and interactive knowledge graph display optimization.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data intelligent processing and information security, and particularly relates to a domain name information processing and display method based on multi-modal data fusion. BACKGROUND

[0002] With the rapid development of Internet infrastructure and the continuous expansion of network application ecology, domain names, as the key entry for accessing Internet resources, have gradually become an important object for network space governance, information security supervision and malicious behavior identification. Especially in the context of increasingly complex network threats such as network attacks, phishing websites, malicious redirection, and botnets, how to effectively identify high-risk domain names and improve the interpretability and visualization level of domain name resolution behavior has become a research hotspot in the field of information security. Traditional domain name information processing methods mainly rely on rule matching or static black and white list comparison of structured registration information (such as registrant, registrar, registration time, etc.). Although this method is simple to implement, it lacks the ability to model unstructured information (such as WHOIS text), behavioral data (such as DNS resolution behavior, access logs), and visual content (such as web page images), and cannot fully characterize the risk characteristics of domain names in multi-dimensional information, resulting in detection results being easily affected by evasion strategies and weak generalization ability.

[0003] In recent years, driven by the development of artificial intelligence and big data analysis methods, more and more research attempts to apply machine learning models to domain name risk identification tasks. For example, traditional models such as decision trees, support vector machines, and random forests are used to classify and train domain name features; or deep learning architectures are introduced to extract deep features of domain name behavior through multilayer perceptrons and convolutional neural networks. However, these methods usually only process structured or text single modal data, lack a mechanism for modeling different data types, and are difficult to effectively integrate modal information such as images, access behavior, and time series, resulting in limited recognition accuracy.

[0004] In addition, in terms of multi-modal data processing, existing methods mostly use simple concatenation or independent modeling to combine various features, lacking a unified feature encoding and fusion framework. For example, some studies concatenate text encoding results and structured numerical values into input vectors and then directly input them into neural networks, but do not effectively filter and weight the importance differences and feature redundancies between modalities, causing unstable training processes and poor convergence results. During feature fusion, there are problems such as dimension imbalance, semantic differences, and noise pollution between modalities, and if standardization processing and feature importance filtering are not performed, overfitting or information loss may occur, reducing the model's generalization ability and practicality.

[0005] In terms of modeling algorithms, although the Tab Net model has been proposed in recent years and widely used in structured data scenarios, it has shown excellent performance in medical, financial, and risk control fields due to its advantages such as feature mask generation and sparse attention mechanism. However, there is still a lack of deep application research on combining Tab Net with multi-modal features, especially in the domain name scenario. The structural characteristics of Tab Net, such as serial decision steps, multi-step feature selection, and context accumulation mechanism, provide a good foundation for building an explainable and self-adaptive feature selection classifier. However, if it is directly applied to the fusion scenario of heterogeneous data such as text, image, and behavior, the model structure needs to be adjusted, and the weight distribution mechanism needs to be redesigned in combination with the modal attributes. The existing technology has not conducted in-depth exploration on this.

[0006] In terms of model performance optimization, current mainstream optimization methods such as grid search, random search, and Bayesian optimization are usually only suitable for models with small parameter space and strong task stability. For Tab Net and other deep structures with multiple important hyperparameters (such as learning rate, mask dimension, decision step number, and sparse coefficient), there are complex interactions between hyperparameters, and traditional optimization methods face problems such as low search efficiency and easy to fall into local optimum. In recent years, intelligent optimization algorithms such as particle swarm optimization, genetic algorithm, and firefly algorithm have emerged, which have certain global search ability but still have shortcomings in convergence speed and adaptability. Dragonfly optimization algorithm is an intelligent optimization method based on group behavior heuristic, which simulates five behavior mechanisms of dragonfly groups (separation, alignment, attraction, food guidance, and enemy avoidance), has the advantages of strong global search ability and good local fine adjustment ability, and has the potential to search for optimal solutions in high-dimensional nonlinear space. However, there is still no public literature that deeply integrates it with the Tab Net model for multi-modal risk modeling tasks.

[0007] In terms of display and explainability, existing domain name risk identification systems usually output text reports or static labels, lack interactive graph display capabilities, and are difficult to support security personnel to conduct in-depth tracing or relationship analysis on the identification results. Although some research has introduced knowledge graph methods to model domain name-related entities, it has focused on entity extraction and triple construction, and has not been linked to risk prediction results, making it difficult to intuitively reflect the source of risk and the behavior it comes from. In addition, the construction granularity of the graph, the design of edge types, and the mapping of node weights lack detailed logic and have not been customized for the specific needs of the domain name security scenario, making it difficult to meet the high requirements of explainability and visualization in real-world scenarios.

[0008] Therefore, how to provide a domain name information processing and display method based on multi-modal data fusion is a problem that needs to be solved by those skilled in the art. SUMMARY

[0009] One object of the present application is to provide a domain name information processing and display method based on multi-modal data fusion. The present application fully integrates multi-source heterogeneous data such as structured registration information, WHOIS text, DNS resolution behavior, access log and web page image, adopts feature embedding, modal standardization and Z-score fusion mechanism, combines Tab Net deep feature screening model and dragonfly optimization algorithm for risk prediction modeling and parameter adaptive tuning, and constructs an interactive domain name knowledge graph display structure, which has the advantages of high risk identification accuracy, strong model adaptability and strong display result interpretability.

[0010] According to the domain name information processing and display method based on multi-modal data fusion, the method comprises the following steps:

[0011] S1, collecting domain name multi-modal original data and preprocessing to generate a preprocessed data sample set;

[0012] S2, feature extraction is performed on the preprocessed data sample set to construct a multi-modal fusion feature vector sequence;

[0013] S3, an initial Tab Net model is constructed, a saliency screening mask is constructed for the input multi-modal feature vector sequence, attention weighting is applied to the activated fusion features, and an initial domain name risk prediction result is output;

[0014] S4, based on the initial domain name risk prediction result, a model performance evaluation objective function is constructed;

[0015] S5, a dragonfly optimization algorithm is introduced, a dragonfly individual population is initialized, each individual in the population represents a set of Tab Net hyperparameter combinations, and the optimal TabNet parameter combination is searched according to the classification performance feedback of the initial domain name risk prediction result;

[0016] S6, based on the optimal Tab Net parameter combination, an optimized Tab Net model is obtained, and a final domain name risk prediction result is output;

[0017] S7, based on the final domain name risk prediction result, a domain name knowledge graph display structure is constructed, and an interactive graph display result is generated.

[0018] Optionally, the preprocessed data sample set includes a structured registration information field after format unification processing, a WHOIS text field after null value cleaning, DNS resolution record data after noise filtering and timestamp normalization processing, normalized access log behavior original field, and web page image data after size normalization and uniform encoding format conversion;

[0019] The structured registration information fields include domain name, registration time, registrar, registration duration, privacy protection flag, DNS record type, resolution status code, and registration status code;

[0020] The WHOIS text field encoding information includes the encoding results of the registrant's name, registration email, registration organization, and address information text content after word segmentation and embedding processing;

[0021] The DNS resolution record data includes resolution time, resolution type, TTL value, resolution result IP, and response status code.

[0022] Optionally, S2 specifically represents:

[0023] S21. Numerically encode the structured registration information fields, mapping registration time, registration duration, registration status, and DNS record type to numerical features according to field type, and generating a structured feature matrix;

[0024] S22. Use the bag-of-words model to encode the WHOIS text field for word frequency and construct a word-sample sparse matrix.

[0025] S23. Calculate behavioral statistical characteristics of DNS resolution record data, including query frequency, average TTL, number of IP changes and abnormal response rate, and generate a behavioral characteristic matrix.

[0026] S24. Extract behavior vectors from the access log fields, including the number of accesses per unit time, the number of source IPs, and the access time dispersion, and construct an access behavior feature matrix;

[0027] S25. Use an image embedding model to extract image representations from webpage image data and generate an image feature matrix;

[0028] S26. Concatenate the structured feature matrix, term-sample sparse matrix, behavior feature matrix, access behavior feature matrix, and image feature matrix column by column to form a fusion feature matrix. Standardize the fusion feature matrix and use the Z-score standardization method to convert each column of features into a standard normal distribution with a mean of 0 and a variance of 1 to obtain the multimodal fusion feature vector sequence X.

[0029] Optionally, S3 specifically represents:

[0030] S31. Define the initial Tab Net model structure, including the input layer, feature transformation encoding layer, multiple cascaded decision step modules, feature mask generation module, sparse attention mechanism module, information accumulation module, and output layer. Each module is connected layer by layer to build a complete structure.

[0031] S32. Initialize the model input layer, setting the input data to a multimodal fusion feature vector sequence X;

[0032] S33. Construct a feature transformation coding layer, using a shared fully connected subnetwork FC. e The input multimodal fusion feature vector sequence X is mapped to the latent space to generate the encoding matrix E;

[0033] S34. Set up a decision step module containing L cascaded steps, perform a weighted fusion operation on the output of all decision steps, and obtain the final representation matrix;

[0034] S35. Construct an output layer structure, perform forward prediction on the final representation matrix, and output the initial domain name risk prediction result, which includes a domain name risk classification label vector, a risk score vector, and a feature importance vector.

[0035] Optionally, S34 specifically represents:

[0036] S341. Receive the feature vector sequence X of the previous layer's progressive representation and multimodal fusion, and output the current step's feature mask matrix M through the modality-aware feature mask generation module. (l) ;

[0037] S342. The generated feature mask matrix M... (l) The multimodal fusion feature vector sequence X is multiplied element-wise to form the modal features activated in the current step;

[0038] S343. Input the modal features activated in the current step into the decision step feature transformation network. Using a domain name scenario-specific non-shared network structure, perform independent mapping on the structured field, WHOIS text field, and DNS behavior field, and then merge them to construct the embedded feature representation of the current step:

[0039]

[0040] Among them, H (l) This represents the feature embedding representation for the first decision step, where Concat(·) is the vector concatenation operation, and W... s The weight matrix is ​​a structured feature transformation matrix. W represents the activation feature vector of the structured mode in the current decision step. t Transform the weight matrix for text features. W is the activation feature vector of the text modality in the current decision step. b Transform the weight matrix for behavioral features. This represents the activation feature vector of the behavioral mode in the current decision step;

[0041] S344. Input the current step's embedded feature representation into the sparse attention mechanism module to construct a cross-modal association channel, identify combined risks, and output a context-enhanced representation.

[0042] S345. The context-enhanced representation is weighted and fused with the previous layer's progressive representation to form the current step's progressive representation. The progressive representation output by the decision step is spliced ​​or weighted and fused to obtain the final representation matrix.

[0043] Optionally, S4 specifically represents:

[0044] S41. Extract the risk classification label results from the initial domain risk prediction results, and calculate the classification performance index based on the risk classification label results and the actual labels:

[0045]

[0046] in, Let represent the classification performance loss term, n represent the total number of domain name samples to be processed in the input batch, i represent the domain name sample index, C represent the total number of domain name risk classifications, c represent the domain name risk classification index, and w represent the classification performance loss term. c For class weights, y i p represents the true label of the i-th sample. i，c This represents the probability that the i-th sample is predicted to be of class c;

[0047] S42. Constructing model structure complexity metrics:

[0048]

[0049] in, Let α1 represent the model complexity loss term, α1 represent the parameter regularization coefficient, L represent the total number of decision steps, and 1 represent the decision step index. Let α1 represent the first layer weight matrix in the first decision step, and α2 represent the layer depth penalty coefficient.

[0050] S43. Constructing a feature sparsity index:

[0051]

[0052] in, represents the feature sparsity loss term, ω is the importance weight vector of the input features, and ||||1 represents the summation of the absolute values ​​of all elements in the vector;

[0053] S44. Combined construction of model performance evaluation objective function:

[0054]

[0055] Where J is the objective function for evaluating model performance, λ1 is the classification loss weight coefficient, λ2 is the model complexity loss weight coefficient, and λ3 is the feature sparsity loss weight coefficient.

[0056] Optionally, the real labels include three categories of labels generated by comprehensively judging the completeness and credibility of the domain name's registration information, the frequency and stability of DNS resolution behavior, and the multi-dimensional features of abnormal request patterns in the access logs through a preset rule system.

[0057] Optionally, S5 specifically represents:

[0058] S51. Set the objective function of the dragonfly optimization algorithm as the model performance evaluation objective function J, and initialize the dragonfly population, with the position vector P of each individual in the population. i This represents a set of Tab Net hyperparameter combinations to be optimized;

[0059] S52. Construct an interaction model among individuals in the population. In each iteration, calculate the update vector for each dragonfly individual i based on the following five behavioral mechanisms:

[0060]

[0061] in, Let be the update vector for the i-th dragonfly individual in the current iteration, and s be the weight factor for the separation behavior. Let represent the average backward distance vector between dragonfly individual i and its neighbors, and 'a' be the weighting factor for the permutation behavior. Let c represent the directional relationship between individual i and the neighborhood center, and c be the weighting factor for attraction behavior. This indicates the direction of an individual's movement towards the center of the neighboring community, where f is a weighting factor guided by the food source. Let represent the food source guidance vector, and e be the weighting factor for enemy avoidance behavior. This indicates the direction in which an individual evacuates from an area with poor current assessment results; ω is the inertia factor. This represents the historical directional inertia, and t represents the current iteration round number.

[0062] S53. Update the individual position according to the update vector to obtain a new parameter combination, and use it to train the initial TabNet model to obtain the risk prediction result under the current combination and calculate the corresponding performance evaluation value.

[0063] S54. In each iteration, sort the objective function values ​​of all dragonfly individuals, update the position of the best individual in the current population, and use it as the food source guide vector for the next iteration.

[0064] S55. Terminate the search if the global optimal solution converges, and output the optimal parameter combination P.* Optimal parameter combination P * This includes the optimal learning rate, optimal mask dimension, optimal number of decision steps, optimal attention mechanism configuration, and optimal regularization coefficient.

[0065] Optionally, S6 specifically represents:

[0066] S61, Receive the optimal parameter combination P output by the Dragonfly Optimization Algorithm. * ;

[0067] S62, Based on the optimal parameter combination P * By setting the learning rate, feature mask dimension, decision steps, hidden layer dimension, and weighting coefficients of the performance objective function of the Tab Net model, the optimized Tab Net model can be obtained.

[0068] S63. Input the multimodal fusion feature vector sequence X into the optimized Tab Net model, perform multi-step feature mask generation, modal feature transformation, attention enhancement and state accumulation operations to obtain the final output representation;

[0069] S64. Generate the final risk prediction result based on the output representation. The final risk prediction result includes domain name risk classification label, domain name risk score value and feature importance weight vector.

[0070] Optionally, S7 specifically represents:

[0071] S71. Integrate the final risk prediction results with the structured registration information, WHOIS text field, DNS resolution record and access log field.

[0072] S72. Construct a graph node set, which includes domain name entity nodes, registrant name nodes, IP address nodes, DNS resolution behavior nodes, and risk label nodes. Each type of node has a unique identifier and attribute fields.

[0073] S73. Construct a graph edge set, the edge set including the "registered in" edge between the registrant name and the domain name, the "resolved to" edge between the domain name and the IP address, the "access source" edge between the IP address and the DNS behavior, the "association tag" edge between the domain name and the risk tag, and the "triggered by feature" edge between the feature field and the risk tag;

[0074] S74. Set the domain risk score as the visible weight parameter of the domain entity node, and set the node color type according to the domain risk classification label, where green corresponds to normal, red corresponds to malicious, and yellow corresponds to suspected.

[0075] S75. The above nodes and edges are arranged in a visual manner using a graph layout method based on the force-oriented algorithm, generating an interactive graph display interface. The interface allows users to click on nodes to view detailed information such as structured registration information, WHOIS fields, DNS behavior logs, and trigger risk characteristics.

[0076] The beneficial effects of this invention are:

[0077] First, unlike existing domain name information processing methods that typically rely solely on structured registration information or single-modal data for static analysis, this invention proposes a domain name information processing and display method based on multimodal data fusion. By jointly modeling five modalities—structured registration information, WHOIS text, DNS behavior logs, access behavior, and webpage images—it fully explores the semantic features and behavioral patterns of domain names across different dimensions. By encoding, standardizing, and constructing feature vectors for each modality of data, and then using the Z-score method to uniformly fuse them into a standard input matrix, it effectively solves problems such as inconsistent dimensions, distribution, and semantic misalignment among multi-source heterogeneous data, significantly improving feature representation capabilities and model generalization performance. Compared to traditional identification methods that rely solely on structured features or static rules, this invention can comprehensively assess domain name risk characteristics from multiple angles and modalities, exhibiting higher coverage and stronger robustness.

[0078] Secondly, in terms of risk prediction model construction, this invention innovatively introduces a TabNet deep structure as the main architecture for modeling multimodal features. Combined with modality-aware feature masks, sparse attention mechanisms, and a progressive decision-step optimization process, it achieves adaptive selection and context-enhanced representation of different modal features. By embedding structured fields, text fields, and behavioral fields using a domain-specific non-shared sub-network structure, it effectively improves the model's ability to perceive modal semantic differences. The sparse attention mechanism guides the model to focus on high-weighted combined features, avoiding redundant interference and improving model training efficiency and interpretability. Compared to existing general deep learning models that directly concatenate inputs or share parameters for training, this invention introduces a modality difference perception mechanism at the structural design level, further improving the accuracy and interpretability of domain risk identification.

[0079] Furthermore, regarding model optimization, this invention is the first to deeply integrate the Dragonfly Optimization Algorithm with the Tab Net model, constructing a high-dimensional parameter search space driven by individual dragonfly behaviors. Combined with the domain name risk prediction task, a triple objective function of classification accuracy, model complexity, and feature sparsity is constructed to comprehensively guide the search and optimization of the parameter space. The Dragonfly Algorithm, by simulating five behavioral mechanisms of group separation, arrangement, attraction, food guidance, and enemy avoidance, possesses significant global search and local convergence capabilities, effectively escaping local optima traps and quickly obtaining optimal hyperparameter combinations suitable for different task scenarios. Compared with traditional grid search or genetic algorithms, it has higher optimization efficiency and more stable convergence. Combining the structural characteristics of the Tab Net model, this invention improves model prediction accuracy and training robustness through an intelligent optimization process, significantly enhancing the system's adaptability in complex dynamic data environments.

[0080] In terms of display and interactive analysis, this invention constructs an interactive knowledge graph display structure centered on risk prediction results. For the first time, it integrates five types of nodes—domain entities, registration information, IP behavior, access logs, and risk tags—and their associated edges into a graph format, forming a visual representation of the entire domain lifecycle data. By introducing color mapping, visible weights for risk scoring, and polygonal design, the richness of the graph structure's expression and its information traceability are enhanced. Users can quickly view the registrant information, DNS behavior, access source, and key characteristics triggering risks for a domain by clicking on graph nodes, improving analysis efficiency and decision-making accuracy. Compared to traditional static table output methods, the graph interaction mechanism provided by this invention improves the interpretability of results while also enhancing the system's usability and scalability in practical applications.

[0081] Furthermore, the overall process of this invention achieves a closed-loop system of "multimodal acquisition - deep fusion modeling - intelligent parameter optimization - visual map display," possessing significant advantages such as high automation in the modeling process, strong recognition accuracy, and intuitive and easy-to-use display methods. This method can not only effectively identify high-risk domain behaviors such as spoofed domains, phishing websites, and suspicious redirects, but also provide security operations personnel with comprehensive and intuitive data support and decision-making basis. The overall system has strong deployability, engineering feasibility, and practical adaptability, possessing broad application prospects and promotional value. Attached Figure Description

[0082] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0083] Figure 1 This is a flowchart of a domain name information processing and display method based on multimodal data fusion proposed in this invention;

[0084] Figure 2 This is a diagram of the TabNet model structure in a domain name information processing and display method based on multimodal data fusion proposed in this invention.

[0085] Figure 3 This is a flowchart illustrating the optimization process of the Dragonfly optimization algorithm for Tab Net parameters in a domain name information processing and display method based on multimodal data fusion proposed in this invention. Detailed Implementation

[0086] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0087] refer to Figures 1-3 A method for processing and displaying domain name information based on multimodal data fusion includes the following steps:

[0088] S1. Collect the original multimodal domain name data and preprocess it to generate a preprocessed data sample set;

[0089] S2. Extract features from the preprocessed data sample set and construct a multimodal fusion feature vector sequence;

[0090] S3. Construct an initial Tab Net model, build a saliency screening mask for the input multimodal feature vector sequence, apply attention weighting to the activated fusion features, and output the initial domain name risk prediction result;

[0091] S4. Based on the initial domain name risk prediction results, construct the objective function for model performance evaluation;

[0092] S5. Introduce the dragonfly optimization algorithm, initialize the dragonfly individual population, and each individual in the population represents a set of Tab Net hyperparameter combinations. Based on the classification performance feedback from the initial domain name risk prediction results, search for the optimal Tab Net parameter combination.

[0093] S6. Based on the optimal Tab Net parameter combination, the optimized Tab Net model is obtained, and the final domain name risk prediction result is output.

[0094] S7. Based on the final domain name risk prediction results, construct a domain name knowledge graph display structure and generate an interactive graph display result.

[0095] This invention provides a domain name information processing and display method based on multimodal data fusion. It overcomes the limitations of traditional domain name identification, which relies on single structured features and static rule judgments. By introducing a collaborative mechanism of multi-source heterogeneous data fusion, TabNet feature selection modeling, and the Dragonfly optimization algorithm, it achieves high-precision modeling and adaptive optimization of the model structure for domain name risk identification. Combined with an interactive knowledge graph display structure, the system not only improves the interpretability of the identification results but also enhances the visualization and analysis capabilities of risk association paths. This method possesses advantages such as high processing efficiency, strong risk identification capabilities, and flexible deployment in practical applications, demonstrating broad prospects and promotional value in cybersecurity applications.

[0096] In this embodiment, the preprocessed data sample set includes structured registration information fields after format unification, WHOIS text fields after null value cleaning, DNS resolution record data after noise filtering and timestamp normalization, normalized access log behavior original fields, and web page image data after size normalization and unified encoding format conversion.

[0097] The structured registration information fields include domain name, registration time, registrar, registration duration, privacy protection flag, DNS record type, resolution status code, and registration status code;

[0098] The WHOIS text field encoding information includes the encoding results of the registrant's name, registration email, registration organization, and address information text content after word segmentation and embedding processing;

[0099] The DNS resolution record data includes resolution time, resolution type, TTL value, resolution result IP, and response status code.

[0100] This invention provides a domain name information processing method based on multimodal data fusion, which overcomes the limitations of traditional methods that rely solely on structured fields or single data sources. By introducing preprocessing mechanisms such as format unification, noise filtering, normalization, and embedding encoding, it systematically integrates multimodal data including structured registration information, WHOIS text, DNS resolution records, access logs, and webpage images to construct a high-quality fused sample set. This method effectively improves feature completeness and data consistency, providing a richer and more reliable input foundation for subsequent risk identification and modeling. While enhancing the model's expressive power, it also improves identification accuracy and processing stability, demonstrating good adaptability and engineering practical value.

[0101] In this embodiment, S2 specifically represents:

[0102] S21. Numerically encode the structured registration information fields, mapping registration time, registration duration, registration status, and DNS record type to numerical features according to field type, and generating a structured feature matrix;

[0103] S22. Use the bag-of-words model to encode the WHOIS text field for word frequency and construct a word-sample sparse matrix.

[0104] S23. Calculate behavioral statistical characteristics of DNS resolution record data, including query frequency, average TTL, number of IP changes and abnormal response rate, and generate a behavioral characteristic matrix.

[0105] S24. Extract behavior vectors from the access log fields, including the number of accesses per unit time, the number of source IPs, and the access time dispersion, and construct an access behavior feature matrix;

[0106] S25. Use an image embedding model to extract image representations from webpage image data and generate an image feature matrix;

[0107] S26. Concatenate the structured feature matrix, term-sample sparse matrix, behavior feature matrix, access behavior feature matrix, and image feature matrix column by column to form a fusion feature matrix. Standardize the fusion feature matrix and use the Z-score standardization method to convert each column of features into a standard normal distribution with a mean of 0 and a variance of 1 to obtain the multimodal fusion feature vector sequence X.

[0108] This invention fully explores the deep information structure of domain name registration, resolution, access, and webpage content by constructing a multimodal feature extraction mechanism encompassing four categories: structured, textual, behavioral, and image features. A high-dimensional feature matrix is ​​generated through numerical mapping, bag-of-words encoding, statistical extraction, and image embedding, and then uniformly processed using the Z-score standardization method, effectively solving the problems of data distribution differences and scale inconsistencies between modalities. The fused vector sequence after concatenating multi-source features possesses higher information density and representational power, providing a robust, standardized, and scalable input foundation for subsequent risk prediction models, significantly improving the model's accuracy, stability, and generalization performance, and demonstrating good practical application value.

[0109] In this embodiment, S3 specifically represents:

[0110] S31. Define the initial Tab Net model structure, including the input layer, feature transformation encoding layer, multiple cascaded decision step modules, feature mask generation module, sparse attention mechanism module, information accumulation module, and output layer. Each module is connected layer by layer to build a complete structure.

[0111] S32. Initialize the model input layer, setting the input data to a multimodal fusion feature vector sequence X;

[0112] S33. Construct a feature transformation coding layer, using a shared fully connected subnetwork FC. eThe input multimodal fusion feature vector sequence X is mapped to the latent space to generate the encoding matrix E;

[0113] S34. Set up a decision step module containing L cascaded steps, perform a weighted fusion operation on the output of all decision steps, and obtain the final representation matrix;

[0114] S35. Construct an output layer structure, perform forward prediction on the final representation matrix, and output the initial domain name risk prediction result, which includes a domain name risk classification label vector, a risk score vector, and a feature importance vector.

[0115] This invention introduces a structured TabNet model architecture to achieve deep modeling of multimodal fusion features and adaptive selection of feature importance. The model includes an input layer, a feature transformation encoding layer, a concatenated decision step module, and a feature mask generation and sparse attention mechanism module. It can dynamically select key feature regions during training, effectively suppressing redundant information interference. An information accumulation mechanism further enhances the model's ability to express complex patterns, ultimately outputting risk classification labels, scores, and feature importance vectors, achieving high-precision and highly interpretable risk prediction. This structure possesses advantages such as end-to-end training capability, strong scalability, and high convergence efficiency, significantly improving the intelligence and practicality of domain name risk modeling.

[0116] In this embodiment, S34 specifically represents:

[0117] S341. Receive the feature vector sequence X of the previous layer's progressive representation and multimodal fusion, and output the current step's feature mask matrix M through the modality-aware feature mask generation module. (l) ;

[0118] S342. The generated feature mask matrix M... (l) The multimodal fusion feature vector sequence X is multiplied element-wise to form the modal features activated in the current step;

[0119] S343. Input the modal features activated in the current step into the decision step feature transformation network. Using a domain name scenario-specific non-shared network structure, perform independent mapping on the structured field, WHOIS text field, and DNS behavior field, and then merge them to construct the embedded feature representation of the current step:

[0120]

[0121] Among them, H (l) Let W be the feature embedding representation for the l-th decision step, and Concat(·) be the vector concatenation operation. s The weight matrix is ​​a structured feature transformation matrix. W represents the activation feature vector of the structured mode in the current decision step.t Transform the weight matrix for text features. W is the activation feature vector of the text modality in the current decision step. b Transform the weight matrix for behavioral features. This represents the activation feature vector of the behavioral mode in the current decision step;

[0122] S344. Input the current step's embedded feature representation into the sparse attention mechanism module to construct a cross-modal association channel, identify combined risks, and output a context-enhanced representation.

[0123] S345. The context-enhanced representation is weighted and fused with the previous layer's progressive representation to form the current step's progressive representation. The progressive representation output by the decision step is spliced ​​or weighted and fused to obtain the final representation matrix.

[0124] This invention enhances the Tab Net model's ability to distinguish and represent multimodal features by introducing modality-aware feature masks and a non-shared network structure. In each decision step, key modal features are dynamically activated through a masking mechanism, and structured, textual, and behavioral sub-networks are modeled independently, achieving accurate capture of different data semantics. A sparse attention mechanism further constructs cross-modal associations, identifies potential combined risk factors, and improves the model's depth in modeling complex risk features. Context enhancement and progressive fusion strategies enable progressive optimization of representations across layers, ultimately constructing a high-information-density representation matrix, significantly improving the accuracy and interpretability of risk identification, and demonstrating good practical value and scalability.

[0125] In this embodiment, S4 specifically represents:

[0126] S41. Extract the risk classification label results from the initial domain risk prediction results, and calculate the classification performance index based on the risk classification label results and the actual labels:

[0127]

[0128] in, Let represent the classification performance loss term, n represent the total number of domain name samples to be processed in the input batch, i represent the domain name sample index, c represent the total number of domain name risk categories, and c represent the domain name risk category index. c For class weights, y i p represents the true label of the i-th sample. i，c This represents the probability that the i-th sample is predicted to be of class c;

[0129] S42. Constructing model structure complexity metrics:

[0130]

[0131] in, Let α1 represent the model complexity loss term, α1 represent the parameter regularization coefficient, L represent the total number of decision steps, and 1 represent the decision step index. Let α1 represent the first layer weight matrix in the first decision step, and α2 represent the layer depth penalty coefficient.

[0132] S43. Constructing a feature sparsity index:

[0133]

[0134] in, represents the feature sparsity loss term, ω is the importance weight vector of the input features, and ||||1 represents the summation of the absolute values ​​of all elements in the vector;

[0135] S44. Combined construction of model performance evaluation objective function:

[0136]

[0137] Where J is the objective function for evaluating model performance, λ1 is the classification loss weight coefficient, λ2 is the model complexity loss weight coefficient, and λ3 is the feature sparsity loss weight coefficient.

[0138] This invention systematically optimizes the expressive power and structural stability of risk prediction models by constructing a multi-dimensional model performance evaluation system that includes classification performance, structural complexity, and feature sparsity. Through refined classification loss function design, the model's matching accuracy to true labels is improved; combined with structural complexity indicators, regularization is introduced to control model size and avoid overfitting; simultaneously, feature sparsity indicators guide the model to focus on high-value features, improving generalization ability and training efficiency. The multi-objective weighted fusion performance evaluation function provides a scientific search basis for subsequent dragonfly optimization, enabling the model to achieve a balance between accuracy, simplicity, and interpretability, significantly improving overall prediction quality and system robustness.

[0139] In this embodiment, the real label includes three categories of label results generated by comprehensively judging the completeness and credibility of the domain name registration information, the frequency and stability of DNS resolution behavior, and the multi-dimensional features of abnormal request patterns in the access log through a preset rule system.

[0140] This invention introduces a real label construction mechanism that combines registration information, parsed behavior, and access log features. It generates three-category label results using a rule system, which effectively improves the credibility and discriminative power of training data, provides higher-quality supervision signals for model learning, and enhances the accuracy and stability of risk identification.

[0141] In this embodiment, S5 specifically represents:

[0142] S51. Set the objective function of the dragonfly optimization algorithm as the model performance evaluation objective function J, and initialize the dragonfly population, with the position vector P of each individual in the population. i This represents a set of Tab Net hyperparameter combinations to be optimized;

[0143] S52. Construct an interaction model among individuals in the population. In each iteration, calculate the update vector for each dragonfly individual i based on the following five behavioral mechanisms:

[0144]

[0145] in, Let be the update vector for the i-th dragonfly individual in the current iteration, and s be the weight factor for the separation behavior. Let represent the average backward distance vector between dragonfly individual i and its neighbors, and 'a' be the weighting factor for the permutation behavior. Let c represent the directional relationship between individual i and the neighborhood center, and c be the weighting factor for attraction behavior. This indicates the direction of an individual's movement towards the center of the neighboring community, where f is a weighting factor guided by the food source. Let represent the food source guidance vector, and e be the weighting factor for enemy avoidance behavior. This indicates the direction in which an individual evacuates from an area with poor current assessment results; ω is the inertia factor. This represents the historical directional inertia, and t represents the current iteration round number.

[0146] S53. Update the individual position according to the update vector to obtain a new parameter combination, and use it to train the initial TabNet model to obtain the risk prediction result under the current combination and calculate the corresponding performance evaluation value.

[0147] S54. In each iteration, sort the objective function values ​​of all dragonfly individuals, update the position of the best individual in the current population, and use it as the food source guide vector for the next iteration.

[0148] S55. Terminate the search if the global optimal solution converges, and output the optimal parameter combination P. * Optimal parameter combination P * This includes the optimal learning rate, optimal mask dimension, optimal number of decision steps, optimal attention mechanism configuration, and optimal regularization coefficient.

[0149] This invention introduces the Dragonfly Optimization Algorithm to adaptively search for key hyperparameters of the TabNet model, constructing an optimization function aimed at improving classification performance, model complexity, and feature sparsity, thereby systematically enhancing the model's prediction performance and structural rationality. The Dragonfly Optimization Algorithm simulates five group behaviors among individuals: separation, alignment, attraction, food guidance, and enemy avoidance, dynamically updating parameter combinations. It possesses the advantages of strong global search capabilities and high local fine-tuning ability. Through multiple rounds of iteration to select the optimal individual and guide subsequent search directions, it effectively overcomes the limitations of traditional grid search and genetic algorithms in high-dimensional parameter spaces, significantly improving model training efficiency and final performance, and enhancing the system's robustness and adaptability in complex environments.

[0150] In this embodiment, S6 specifically refers to:

[0151] S61, Receive the optimal parameter combination P output by the Dragonfly Optimization Algorithm. * ;

[0152] S62, Based on the optimal parameter combination P * By setting the learning rate, feature mask dimension, decision steps, hidden layer dimension, and weighting coefficients of the performance objective function of the Tab Net model, the optimized Tab Net model can be obtained.

[0153] S63. Input the multimodal fusion feature vector sequence X into the optimized Tab Net model, perform multi-step feature mask generation, modal feature transformation, attention enhancement and state accumulation operations to obtain the final output representation;

[0154] S64. Generate the final risk prediction result based on the output representation. The final risk prediction result includes domain name risk classification label, domain name risk score value and feature importance weight vector.

[0155] This invention utilizes the optimal hyperparameter combination output by the Dragonfly optimization algorithm to finely configure core parameters such as learning rate, mask dimension, and decision steps of the Tab Net model, constructing a high-performance risk prediction model. The optimized model, combining multi-step mask generation, modal feature transformation, sparse attention, and state accumulation mechanisms, can accurately model deep-level interactions between multimodal features, enhancing the model's ability to express complex domain behavior features. The final generated risk classification labels, scores, and feature importance weights not only improve prediction accuracy and stability but also provide a solid foundation for subsequent interpretability analysis and graph visualization, significantly enhancing the system's practical value and deployment effectiveness.

[0156] In this embodiment, S7 specifically refers to:

[0157] S71. Integrate the final risk prediction results with the structured registration information, WHOIS text field, DNS resolution record and access log field.

[0158] S72. Construct a graph node set, which includes domain name entity nodes, registrant name nodes, IP address nodes, DNS resolution behavior nodes, and risk label nodes. Each type of node has a unique identifier and attribute fields.

[0159] S73. Construct a graph edge set, the edge set including the "registered in" edge between the registrant name and the domain name, the "resolved to" edge between the domain name and the IP address, the "access source" edge between the IP address and the DNS behavior, the "association tag" edge between the domain name and the risk tag, and the "triggered by feature" edge between the feature field and the risk tag;

[0160] S74. Set the domain risk score as the visible weight parameter of the domain entity node, and set the node color type according to the domain risk classification label, where green corresponds to normal, red corresponds to malicious, and yellow corresponds to suspected.

[0161] S75. The above nodes and edges are arranged in a visual manner using a graph layout method based on the force-oriented algorithm, generating an interactive graph display interface. The interface allows users to click on nodes to view detailed information such as structured registration information, WHOIS fields, DNS behavior logs, and trigger risk characteristics.

[0162] This invention constructs a knowledge graph display structure based on domain name risk prediction results, enabling the visualization and interactive tracing of data analysis results. The system constructs domain names, registrants, IP addresses, DNS behavior, and risk tags as graph nodes, connecting various entities with semantic edges to clearly demonstrate the association path between domain name behavior and risk. Risk levels are distinguished by node color, and node weights are set by scoring values. An intuitive graph view is generated using a force-directed layout algorithm. Users can click on nodes to view detailed features and log information, significantly improving the interpretability and analytical efficiency of the model output, and enhancing the system's practicality, transparency, and security response capabilities.

[0163] Example 1:

[0164] To verify the feasibility of this invention in practice, it was applied to an intelligent upgrade project of a network security data analysis system. The goal was to identify risks, analyze behaviors, and visualize results for a large number of active domain names, thereby solving the problems of difficult multimodal data fusion, insufficient model recognition accuracy, and lack of interpretability in the traditional domain name risk identification process.

[0165] This system is deployed in a large-scale backbone network data flow monitoring environment, accessing multiple data sources including DNS resolution records, WHOIS registration information, user access logs, and webpage image snapshots. The average daily data volume exceeds 4TB, encompassing millions of DNS requests, hundreds of thousands of registration fields, tens of millions of access behavior records, and hundreds of thousands of webpage screenshots. The system first encodes structured registration information fields, such as registration time and registration status, into numerical features; WHOIS text is encoded into a term-sample sparse matrix using word segmentation and a TF-IDF model; DNS resolution behavior statistics such as query frequency, IP switching rate, and response status are extracted; access logs extract features such as the number of accesses per unit time, the number of source IPs, and the dispersion of access time; and webpage images are compressed into fixed-length image vectors using a pre-trained image embedding network.

[0166] The five modal features mentioned above were uniformly standardized using Z-score and then concatenated into a fusion feature matrix, which was used as input data to train the initial Tab Net model. In the initial training phase, the model's overall F1-score was around 82%, and its accuracy in identifying the "suspected risk" class was relatively low, exhibiting problems of classification ambiguity and unclear feature representation. To improve model performance, this invention further introduces the Dragonfly optimization algorithm, which automatically optimizes several key hyperparameters of Tab Net by constructing a multi-objective function targeting classification performance, model complexity, and feature sparsity. After more than a hundred iterations of optimization, it finally converges to a set of optimal parameter combinations, including learning rate, mask dimension, number of decision steps, attention sparsity weights, and regularization coefficients. Under this configuration, the optimized Tab Net model achieved an F1-score of over 89% on the validation set, particularly improving its ability to identify the "suspected risk" class in intermediate states by approximately 8%, significantly enhancing the model's judgment ability in scenarios with ambiguous boundaries.

[0167] To further enhance the interpretability of the identification results, this invention constructs a knowledge graph display structure centered on domain names during the model output stage. This structure binds predicted risk scores and classification labels to corresponding trigger feature fields. The graph also includes entity nodes such as registrant information, DNS resolution IPs, and access source behavior. Nodes are linked through edge types such as "registered in," "resolved to," "access source," and "trigger risk." The system uses color and node weight linkage to highlight high-risk domain names. Users can click on the graph to deeply examine the domain's behavioral trajectory and associated abnormal fields. In actual testing, this graph structure enabled operators to successfully locate multiple domains with abnormal scores and suspicious behavioral paths. These included several sites that impersonated brand names for redirection, exhibiting abnormally concentrated access times, frequent DNS IP switching, and highly similar webpage images. These sites were tagged as high-risk and pushed for action in the system, significantly improving the efficiency of tracing and analysis.

[0168] To verify the recognition performance and efficiency, the method of this invention was also compared and evaluated with the traditional random forest + multimodal concatenation method. Three rounds of parallel detection were performed using the same data samples and evaluation label set, and quantitative comparisons were conducted across multiple dimensions. The results are shown in the table below:

[0169] Table 1. Comparison of the effectiveness of the method of the present invention and traditional methods in domain name risk identification scenarios.

[0170] Serial number Comparison dimension Method of the present application Traditional method 1 Total number of domain name processing 1,000,000 1,000,000 2 Daily processing speed (pieces) 85,000 60,000 3 F1-score (overall) 89.3％ 80.7％ 4 Accuracy rate 91.5％ 83.2％ 5 Recall rate 86.2％ 78.9％ 6 Malicious class recognition rate 93.1％ 85.4％ 7 Suspected class recognition rate 81.4％ 70.2％ 8 Average processing delay (seconds) 1.83 3.97 9 Average risk score difference ±0.04 ±0.11 10 Explainability user score 9.1 / 10 6.8 / 10

[0171] As can be seen from the comparative data in Table 1 above, in large-scale domain name risk identification applications, the present invention outperforms traditional methods in terms of identification accuracy, processing efficiency, and interpretability. Specifically, in terms of overall identification performance, the F1-score of the present invention reaches 89.3%, which is nearly 9 percentage points higher than the traditional random forest method. The accuracy and recall rates also increase to 91.5% and 86.2%, respectively, effectively enhancing the model's ability to discriminate in real and complex scenarios, especially for the more accurate and comprehensive identification of malicious and suspected domain names.

[0172] In terms of processing power, the method of this invention can process 85,000 domain name samples per day, which is more than 40% faster than traditional methods. The average processing latency per sample is 1.83 seconds, significantly lower than the 3.97 seconds of traditional methods. This efficiency improvement stems from the introduction of a feature mask-based sparse attention mechanism and an optimized Tab Net structure into the model structure, which can quickly locate high-value features and reduce redundant computation. Simultaneously, the Dragonfly optimization algorithm is used for automatic parameter tuning, ensuring the model maintains good response speed and computational stability during large-scale data processing.

[0173] In identifying "suspected" samples, this invention achieves an identification rate of 81.4%, an improvement of over 11% compared to traditional methods, effectively solving the problem of unstable classification of samples with ambiguous boundaries in traditional methods. Simultaneously, this invention constructs a knowledge graph display structure based on risk scoring and trigger features, visualizing node colors and risk weights to enable users to quickly understand the model output, improving the transparency and operability of the results. In user satisfaction ratings, this invention achieves an interpretability score of 9.1, while traditional methods only score 6.8.

[0174] In summary, this invention achieves faster processing speed and stronger result interpretation capabilities while maintaining high-precision identification, significantly improving the application effect and value of the system in practical network security scenarios.

[0175] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for processing and displaying domain name information based on multimodal data fusion, characterized in that, Includes the following steps: S1. Collect the original multimodal domain name data and preprocess it to generate a preprocessed data sample set; S2. Extract features from the preprocessed data sample set and construct a multimodal fusion feature vector sequence; S3. Construct an initial Tab Net model, build a saliency screening mask for the input multimodal feature vector sequence, apply attention weighting to the activated fusion features, and output the initial domain name risk prediction result; S4. Based on the initial domain name risk prediction results, construct the objective function for model performance evaluation; S5. Introduce the dragonfly optimization algorithm, initialize the dragonfly individual population, and each individual in the population represents a set of Tab Net hyperparameter combinations. Based on the classification performance feedback from the initial domain name risk prediction results, search for the optimal Tab Net parameter combination. S6. Based on the optimal Tab Net parameter combination, the optimized Tab Net model is obtained, and the final domain name risk prediction result is output. S7. Based on the final domain name risk prediction results, construct a domain name knowledge graph display structure and generate an interactive graph display result; S5 specifically includes: S51. Set the objective function of the Dragonfly optimization algorithm as the model performance evaluation objective function. And initialize the dragonfly population, including the position vector of each individual in the population. This represents a set of Tab Net hyperparameter combinations to be optimized; S52. Construct an interaction model among individuals in the population. In each iteration, for each dragonfly individual... The update vector is calculated based on the following five behavioral mechanisms: ； in, For the first The update vector of each dragonfly in the current iteration. As a weighting factor for the separation behavior, Represents individual dragonflies The average backward distance vector between the neighbor and its neighbors. As the weighting factor for the permutation behavior, Represents an individual The directional relationship with the neighboring center As a weighting factor for attracting behavior, This indicates the direction of an individual's movement toward the center of their neighboring community. Weighting factors guided by food source. This represents the food source guidance vector. Weighting factors for enemy avoidance behavior. This indicates the direction in which an individual will withdraw from an area where the current assessment indicates poor performance. Inertia factor Indicating historical directional inertia, Indicates the current iteration round number; S53. Update the individual position according to the update vector to obtain a new parameter combination, and use it to train the initial Tab Net model to obtain the risk prediction result under the current combination and calculate the corresponding performance evaluation value. S54. In each iteration, sort the objective function values ​​of all dragonfly individuals, update the position of the best individual in the current population, and use it as the food source guide vector for the next iteration. S55. Terminate the search if the global optimal solution converges, and output the optimal parameter combination. Optimal parameter combination This includes the optimal learning rate, optimal mask dimension, optimal number of decision steps, optimal attention mechanism configuration, and optimal regularization coefficient.

2. The domain name information processing and display method based on multimodal data fusion according to claim 1, characterized in that, The preprocessed data sample set includes structured registration information fields after format unification, WHOIS text fields after null value cleaning, DNS resolution record data after noise filtering and timestamp normalization, normalized access log behavior raw fields, and web page image data after size normalization and unified encoding format conversion. The structured registration information fields include domain name, registration time, registrar, registration duration, privacy protection flag, DNS record type, resolution status code, and registration status code; The WHOIS text field encoding information includes the encoding results of the registrant's name, registration email, registration organization, and address information text content after word segmentation and embedding processing; The DNS resolution record data includes resolution time, resolution type, TTL value, resolution result IP, and response status code.

3. The domain name information processing and display method based on multimodal data fusion according to claim 1, characterized in that, S2 specifically includes: S21. Numerically encode the structured registration information fields, mapping registration time, registration duration, registration status, and DNS record type to numerical features according to field type, and generating a structured feature matrix; S22. Use the bag-of-words model to encode the WHOIS text field for word frequency and construct a word-sample sparse matrix. S23. Calculate behavioral statistical characteristics of DNS resolution record data, including query frequency, average TTL, number of IP changes and abnormal response rate, and generate a behavioral characteristic matrix. S24. Extract behavior vectors from the access log fields, including the number of accesses per unit time, the number of source IPs, and the access time dispersion, and construct an access behavior feature matrix; S25. Use an image embedding model to extract image representations from webpage image data and generate an image feature matrix; S26. Concatenate the structured feature matrix, term-sample sparse matrix, behavior feature matrix, access behavior feature matrix, and image feature matrix column-wise to form a fused feature matrix. Standardize the fused feature matrix by using the Z-score standardization method to convert each column of features into a standard normal distribution with a mean of 0 and a variance of 1, thus obtaining a multimodal fused feature vector sequence. .

4. The domain name information processing and display method based on multimodal data fusion according to claim 1, characterized in that, S3 specifically includes: S31. Define the initial Tab Net model structure, including the input layer, feature transformation encoding layer, multiple cascaded decision step modules, feature mask generation module, sparse attention mechanism module, information accumulation module, and output layer. Each module is connected layer by layer to build a complete structure. S32. Initialize the model input layer, setting the input data to a multimodal fusion feature vector sequence. ; S33. Construct a feature transformation coding layer, using a shared fully connected subnetwork. The input multimodal fusion feature vector sequence Mapping to the latent space generates an encoding matrix. ; S34, Settings include A series of decision-making step modules are connected, and a weighted fusion operation is performed on the outputs of all decision steps to obtain the final representation matrix; S35. Construct an output layer structure, perform forward prediction on the final representation matrix, and output the initial domain name risk prediction result, which includes a domain name risk classification label vector, a risk score vector, and a feature importance vector.

5. The domain name information processing and display method based on multimodal data fusion according to claim 4, characterized in that, S34 specifically includes: S341, Receive the sequence of feature vectors from the previous layer's progressive representation and multimodal fusion. The modality-aware feature mask generation module outputs the feature mask matrix for the current step. ; S342. The generated feature mask matrix... With multimodal fusion feature vector sequence Perform element-wise multiplication to form the modal features activated in the current step; S343. Input the modal features activated in the current step into the decision step feature transformation network. Using a domain name scenario-specific non-shared network structure, perform independent mapping on the structured field, WHOIS text field, and DNS behavior field, and then merge them to construct the embedded feature representation of the current step: ； in, For the first Feature embedding representation of each decision step This is a vector concatenation operation. The weight matrix is ​​a structured feature transformation matrix. This represents the activation feature vector of the structured mode in the current decision step. Transform the weight matrix for text features. This represents the activation feature vector of the text modality in the current decision step. Transform the weight matrix for behavioral features. This represents the activation feature vector of the behavioral mode in the current decision step; S344. Input the current step's embedded feature representation into the sparse attention mechanism module to construct a cross-modal association channel, identify combined risks, and output a context-enhanced representation. S345. The context-enhanced representation is weighted and fused with the previous layer's progressive representation to form the current step's progressive representation. The progressive representation output by the decision step is spliced ​​or weighted and fused to obtain the final representation matrix.

6. The domain name information processing and display method based on multimodal data fusion according to claim 1, characterized in that, S4 specifically includes: S41. Extract the risk classification label results from the initial domain risk prediction results, and calculate the classification performance index based on the risk classification label results and the actual labels: ； in, This represents the classification performance loss term. This indicates the total number of domain name samples to be processed in the input batch. This represents a sample index of domain names. This represents the total number of categories indicating domain name risk. A classification index representing domain name risks. For category weights, Indicates the first The true label of each sample Indicates the first The sample was predicted as the first... The probability of a class; S42. Constructing model structure complexity metrics: ； in, This represents the model complexity loss term. This represents the regularization coefficient of the parameter. Indicates the total number of decision steps. Indicates the decision step index, Indicates the first The first layer of weight matrix in each decision step Indicates the layer depth penalty coefficient; S43. Constructing a feature sparsity index: ； in, Represents the feature sparsity loss term. The input feature importance weight vector, This represents the summation of the absolute values ​​of all elements in the vector; S44. Combined construction of model performance evaluation objective function: ； in, The objective function for evaluating model performance is... These are the classification loss weight coefficients. These are the weighting coefficients for model complexity loss. , where is the feature sparsity loss weight coefficient.

7. The domain name information processing and display method based on multimodal data fusion according to claim 6, characterized in that, The real labels include three categories of labels generated by comprehensively judging the completeness and credibility of the domain name registration information, the frequency and stability of DNS resolution behavior, and the abnormal request patterns in the access logs through a preset rule system.

8. The domain name information processing and display method based on multimodal data fusion according to claim 1, characterized in that, S6 specifically includes: S61, Receive the optimal parameter combination output by the Dragonfly optimization algorithm. ; S62, Based on optimal parameter combination By setting the learning rate, feature mask dimension, decision steps, hidden layer dimension, and weighting coefficients of the performance objective function of the Tab Net model, the optimized Tab Net model can be obtained. S63. Fuse multimodal feature vector sequences The input is fed into the optimized Tab Net model, which performs multi-step feature mask generation, modality transformation, attention enhancement and state accumulation operations to obtain the final output representation. S64. Generate the final risk prediction result based on the output representation. The final risk prediction result includes domain name risk classification label, domain name risk score value and feature importance weight vector.

9. The domain name information processing and display method based on multimodal data fusion according to claim 1, characterized in that, S7 specifically refers to: S71. Integrate the final risk prediction results with the structured registration information, WHOIS text field, DNS resolution record and access log field. S72. Construct a graph node set, which includes domain name entity nodes, registrant name nodes, IP address nodes, DNS resolution behavior nodes, and risk label nodes. Each type of node has a unique identifier and attribute fields. S73. Construct a graph edge set, the edge set including the "registered at" edge between the registrant name and the domain name, the "resolved to" edge between the domain name and the IP address, the "access source" edge between the IP address and the DNS behavior, the "associated label" edge between the domain name and the risk label, and the "triggered by feature" edge between the feature field and the risk label; S74. Set the domain risk score as the visible weight parameter of the domain entity node, and set the node color type according to the domain risk classification label, where green corresponds to normal, red corresponds to malicious, and yellow corresponds to suspected. S75. The above nodes and edges are arranged in a visual manner using a graph layout method based on the force-oriented algorithm, generating an interactive graph display interface. The interface allows users to click on nodes to view detailed information such as structured registration information, WHOIS fields, DNS behavior logs, and trigger risk characteristics.

Images