Generation method and device of malicious domain name sample and storage medium

Abstract

The embodiment of the invention provides a malicious domain name sample generation method and device and a storage medium, and the method comprises the steps: generating a random noise vector, carrying out the fusion of the random noise vector and a target vector through a pre-trained generative adversarial network, obtaining a fusion vector, and generating a forged malicious domain name according to the fusion vector, the target vector refers to one typical semantic vector in a plurality of predetermined typical semantic vectors; each typical semantic vector in the plurality of typical semantic vectors represents a typical semantic feature of a malicious domain name; generating a malicious domain name sample according to the forged malicious domain name and the label data; the label data is used for labeling the authenticity attribute of the forged malicious domain name; the malicious domain name sample is used for training a malicious domain name detection model. Through the method and the device, the problems of low malicious domain name sample generation efficiency and poor quality are solved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technologies, and in particular, to a method, an apparatus, and a storage medium for generating malicious domain name samples. Background Art

[0002] Domain Generation Algorithms (DGA) is a general term for a class of algorithms that can automatically generate domain names. Cyber attackers use DGA to generate a large number of domain names for their own organization and control to evade the detection of domain name blacklists by security personnel. Currently, in order to deal with the large number of malicious domain names generated by DGA, malicious domain name generation methods are used to generate a large number of malicious domain name samples to train a deep learning-based malicious domain name detection model, so that the malicious domain name detection model can identify malicious domain names.

[0003] Most of the existing malicious domain name generation methods are machine learning-based generation methods. After a series of complex preprocessing such as clustering and feature extraction of domain names in advance by learning the character features of real malicious domain names, a malicious domain name generation model can be trained, and a large number of malicious domain name samples can be generated through the trained malicious domain name generation model.

[0004] However, the malicious domain name generation model trained in the way of feature extraction is difficult to fully learn the inherent features and character sequence information of domain name characters, and the quality of the generated malicious domain name samples is poor, resulting in poor training effects of the malicious domain name detection model. Summary of the Invention

[0005] The embodiments of the present application provide a method, an apparatus, and a storage medium for generating malicious domain name samples, so as to at least solve the technical problems of low efficiency and poor quality in generating malicious domain name samples in related technologies.

[0006] According to one aspect of the embodiments of the present application, a method for generating malicious domain name samples is provided, including: generating a random noise vector, fusing the random noise vector with a target vector through a pre-trained generative adversarial network to obtain a fused vector, and generating a forged malicious domain name according to the fused vector; the target vector refers to a typical semantic vector among a plurality of pre-determined typical semantic vectors; each typical semantic vector among the plurality of typical semantic vectors represents typical semantic features of a malicious domain name; generating a malicious domain name sample according to the forged malicious domain name and label data; the label data is used to label the authenticity attribute of the forged malicious domain name; the malicious domain name sample is used to train a malicious domain name detection model.

[0007] According to another aspect of the embodiments of the present application, an apparatus for generating malicious domain name samples is further provided, including:

[0008] A malicious domain name generation module, configured to generate a random noise vector, fuse the random noise vector with a target vector through a pre-trained generative adversarial network to obtain a fused vector, and generate a forged malicious domain name according to the fused vector; the target vector refers to a typical semantic vector among a plurality of pre-determined typical semantic vectors; each typical semantic vector among the plurality of typical semantic vectors characterizes the typical semantic features of malicious domain names; a malicious domain name sample generation module, configured to generate malicious domain name samples according to the forged malicious domain name and label data; the label data is used to label the authenticity attribute of the forged malicious domain name; the malicious domain name samples are used to train a malicious domain name detection model.

[0009] According to another aspect of the embodiments of the present application, there is also provided a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps in any one of the above method embodiments when running.

[0010] According to yet another aspect of the embodiments of the present application, there is provided a computer program product or a computer program, the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the steps in any one of the above method embodiments.

[0011] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the steps in any one of the above method embodiments through the computer program.

[0012] Through the present application, a plurality of typical semantic vectors are extracted from a large number of malicious domain names in advance, a typical semantic vector is randomly determined from the plurality of typical semantic vectors as the target vector, and in the process of generating a forged malicious domain name, the random noise vector is fused with the target vector to obtain a fused vector, and a forged malicious domain name is generated according to the fused vector. The fusion of the random noise vector and the target vector not only retains the randomness in the generation process, but also injects semantic guidance, so that the generated forged malicious domain name is not only structurally close to the real malicious domain name, but more importantly, also has similarity at the semantic level, greatly simplifying the traditional preprocessing steps, and a large number of samples with specific semantic features can be generated in a short time, which greatly alleviates the problem of data collection, solves the problems of low efficiency and poor quality in the malicious domain name generation method in the related art, improves the generation efficiency and generation quality of malicious domain name samples, and enhances the training effect of the malicious domain name detection model. Description of the Drawings

[0013] Figure 1 It is a schematic diagram of an application scenario of a method for generating malicious domain name samples according to an embodiment of the present application;

[0014] Figure 2 It is a schematic flowchart of an optional method for generating malicious domain name samples according to an embodiment of the present application;

[0015] Figure 3 It is a schematic diagram of an optional method for generating forged malicious domain names according to an embodiment of the present application;

[0016] Figure 4 It is a schematic diagram of an optional method for generating typical semantic vectors according to an embodiment of the present application;

[0017] Figure 5 It is a block diagram of the structure of an optional device for generating malicious domain name samples according to an embodiment of the present application;

[0018] Figure 6 It is a block diagram of the computer system structure of an optional electronic device according to an embodiment of the present application. Detailed implementation manners

[0019] In order to enable those skilled in the art to better understand the solution of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0020] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged under appropriate circumstances so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0021] According to one aspect of the embodiments of the present application, a method for generating malicious domain name samples is provided. Optionally, in this embodiment, the above method for generating malicious domain name samples may but is not limited to be applied to, for example, Figure 1In the hardware environment including the terminal device 102 and the server 104 as shown. The server 104 can be connected to the terminal device 102 through a network and can be used to provide services (such as application services, etc.) for the terminal device 102 or the client installed on the terminal device 102. A database can be set up on the server 104 or independently of the server 104 to provide data storage services for the server 104.

[0022] The above network can include but is not limited to at least one of the following: wired network, wireless network. The above wired network can include but is not limited to at least one of the following: wide area network, metropolitan area network, local area network. The above wireless network can include but is not limited to at least one of the following: WIFI (Wireless Fidelity), Bluetooth. The terminal device 102 can be but is not limited to a PC (Personal Computer), mobile phone, tablet computer, etc. The server 104 can be but is not limited to a cloud server, server cluster or other server types.

[0023] The method for generating malicious domain name samples in the embodiments of the present application can be executed by the server 104, or can be executed by the terminal device 102, or can also be jointly executed by the server 104 and the terminal device 102. Among them, the execution of the method for generating malicious domain name samples in the embodiments of the present application by the terminal device 102 can also be executed by the client installed thereon.

[0024] In the related art, there are problems such as difficult collection of training sample data for malicious domain name detection models, uneven amounts of domain name data generated by different families, long data collection cycles, and lag in model update and evolution. To solve this problem, in the embodiments of the present application, a random noise vector is fused with a target vector to obtain a fused vector, and a forged malicious domain name is generated according to the fused vector, and it is combined with label data to form a malicious domain name sample. The generation process of the forged malicious domain name is fast, and a large number of samples with specific semantic features can be generated in a short time, which greatly alleviates the problem of data collection and shortens the data preparation time. More importantly, these samples are not simply randomly generated, but are semantically optimized, so they can effectively represent the common patterns of malicious domain names, increase the diversity and representativeness of training data, help the model learn and adapt to the structures and semantic features of various malicious domain names faster, thereby accelerating the training and update of the model, and improving the response speed and defense effect of the detection model.

[0025] Taking the execution of the method for generating malicious domain name samples in this embodiment by the server 104 as an example, Figure 2 is a schematic flowchart of an optional method for generating malicious domain name samples according to the embodiments of the present application, as Figure 2 shown, the process of this method can include the following steps:

[0026] Step S202: Generate a random noise vector, and through a pre-trained generative adversarial network, fuse the random noise vector with a target vector to obtain a fused vector, and generate a forged malicious domain name according to the fused vector; the target vector refers to a typical semantic vector among a plurality of pre-determined typical semantic vectors; each typical semantic vector among the plurality of typical semantic vectors represents the typical semantic features of a malicious domain name.

[0027] Among them, the generative adversarial network (GAN, Generative Adversarial Network) is a deep learning model composed of two sub-models - a generator and a discriminator. The generator of the GAN receives a joint input vector (the fusion of the random noise vector and the target vector) to generate forged malicious domain names, while the discriminator tries to distinguish these generated domain names from real malicious domain names. Through adversarial training, the generator is continuously optimized to generate more difficult-to-distinguish malicious domain names for enriching the training data of the malicious domain name detection model.

[0028] The random noise vector is the basic input of the generator in the generative adversarial network (GAN), which consists of random numbers conforming to the Gaussian distribution. Its purpose is to introduce uncertainty so that the generator can explore the generation space under different initial states, which helps to improve the diversity of the generated malicious domain names. In the embodiments of this application, in order to better fuse with the target vector, the dimension of the random noise vector is designed to be the same as that of the target vector, that is , where l represents the batch size, m is the maximum length of the domain name, and n is the dimension of the letter vector. This design ensures that the generator can consider both randomness and semantic guidance when processing the input.

[0029] The typical semantic vector refers to the vector obtained by extracting the letter semantic features from a large number of malicious domain names and converting the letter semantic features into vector representations, which represents a set of typical semantic features common in malicious domain names. The typical semantic features reflect the common patterns of malicious domain names at the semantic level, including but not limited to the usage frequency of letters, combination rules, and their context relationships in specific malicious domain name families. The typical semantic vector is used in the embodiments of this application to guide the generator to generate malicious domain names with specific semantic patterns. By fusing the random noise vector and the selected typical semantic vector (i.e., the target vector), the generator can, when generating domain names, not only focus on the randomness of the character structure but also ensure that the generated domain names are semantically consistent with the malicious domain names within a specific cluster, thereby generating more realistic and semantically informative forged malicious domain names for the training and optimization of the malicious domain name detection model.

[0030] The target vector represents the core pattern of a certain type of malicious domain name. In the embodiments of the present application, the selection of the target vector is dynamic and randomly selected from multiple typical semantic vectors each time it is generated to ensure that the generated malicious domain names can cover a variety of known malicious behavior patterns. The target vector is incorporated into the generation process of the GAN, so that the generated forged malicious domain names are not only highly similar to the real malicious domain names in terms of character structure (such as length, character type distribution, use of special characters, etc.), but also have similarity at the semantic level, thus greatly improving the quality of the generated samples and providing a more abundant, diverse and practical malicious domain name training samples for the detection model. The introduction of these training samples helps the detection model to more effectively identify and defend against new malicious domain names, thereby improving the response efficiency of the network defense system.

[0031] The fusion vector is the key input for generating malicious domain names and is composed of a random noise vector and a target vector, which is fused through linear combination or other mathematical operations. In the embodiments of the present application, the creation of the fusion vector is achieved by simply adding the random noise vector and the target vector bit by bit. However, in practice, more complex mathematical operations or weight adjustment strategies can also be adopted to better balance the importance of randomness and semantic features. The use of the fusion vector ensures that the generated malicious domain names have both the novelty brought by randomness and a certain degree of semantic correctness.

[0032] The forged malicious domain name is a vector generated by the generator according to the fusion vector and is decoded and converted into a character-form domain name for simulating real malicious activities.

[0033] Optionally, the server initializes a random noise vector with a dimension of , where l is the batch_size (for example, 128), m is the preset domain name length (for example, 20), n is the letter vector dimension (for example, 4), randomly selects one from multiple pre-determined typical semantic vectors as the target vector, and fuses the random noise vector and the target vector in an element-wise addition manner to form a fusion vector. The server inputs the fusion vector into the generator, and the generator generates a forged malicious domain name according to the fusion vector.

[0034] Step S204, generating malicious domain name samples according to the forged malicious domain names and label data; the label data is used to label the authenticity attributes of the forged malicious domain names; the malicious domain name samples are used to train the malicious domain name detection model.

[0035] Among them, in the training of the malicious domain name detection model, the labeled data is used to clearly label whether a sample belongs to a legitimate domain name (label 0) or a malicious domain name (label 1). When the generator generates forged malicious domain names, no matter how realistic these domain names are, they are uniformly labeled as malicious domain names (label 1), and together with the collected known malicious domain names (label 1 also) and legitimate domain name samples (label 0), they constitute the training data set of the malicious domain name detection model. This labeling method helps the detection model learn to distinguish the characteristics of domain names, enabling the model to effectively identify new and unknown malicious domain names based on the patterns learned during the training process.

[0036] The malicious domain name samples consist of forged malicious domain names and their corresponding labeled data, and are used to train the malicious domain name detection model. The malicious domain name detection model is used to identify whether a sample belongs to a legitimate domain name or a malicious domain name.

[0037] Optionally, the server assigns a labeled data to each forged malicious domain name, combines the forged malicious domain name with its corresponding labeled data to form a malicious domain name sample. The server collects a certain number of forged malicious domain name samples (for example, 10,000), and together with the real malicious domain names (label 1) and legitimate domain names (label 0), constructs the training data set of the malicious domain name detection model, and uses the training data set to train the malicious domain name detection model.

[0038] Through the embodiments provided by this application, multiple typical semantic vectors are extracted in advance from a large number of malicious domain names, and a typical semantic vector is randomly determined from the multiple typical semantic vectors as the target vector. During the process of generating forged malicious domain names, the random noise vector is fused with the target vector to obtain a fused vector, and the forged malicious domain name is generated according to the fused vector. The fusion of the random noise vector and the target vector not only retains the randomness in the generation process, but also injects semantic guidance, making the generated forged malicious domain names not only structurally close to real malicious domain names, but more importantly, also having similarity at the semantic level. This greatly simplifies the traditional preprocessing steps, can generate a large number of samples with specific semantic features in a short time, which greatly alleviates the problem of data collection, solves the problems of low efficiency and poor quality in the malicious domain name generation method in the related art, improves the generation efficiency and generation quality of malicious domain name samples, and enhances the training effect of the malicious domain name detection model.

[0039] In an exemplary embodiment, generating a forged malicious domain name according to the fused vector includes:

[0040] Through a generative adversarial network, a first malicious domain name vector is generated according to the fused vector; character conversion is performed on the first malicious domain name vector to obtain a forged malicious domain name.

[0041] Among them, the first malicious domain name vector is the result output by the generator based on the fusion vector, which is essentially a forged malicious domain name in vector form. The first malicious domain name vector contains the semantic features and structural information of the simulated malicious domain name, and is the direct result output by the GAN generator, which is used for the subsequent character conversion process to obtain a specific forged malicious domain name.

[0042] The first malicious domain name vector generated by the generator is in vector form and cannot be directly used. It needs to be converted into a forged malicious domain name in character form through a decoding process. There are various methods to achieve the conversion from the first malicious domain name vector to the forged malicious domain name. For example, using the Softmax function or other probability distribution functions, convert each vector in the first malicious domain name vector into a probability distribution of characters, select the character with the highest probability corresponding to each vector, and concatenate the selected characters to obtain the forged malicious domain name. Another example is to calculate the similarity between each row of the first malicious domain name vector and multiple character vectors, give different weights to the corresponding characters according to the similarity level, and finally determine the character with the highest weight as the most suitable character corresponding to that row, and concatenate the selected characters to obtain the forged malicious domain name.

[0043] Optionally, the server inputs the fusion vector into the generator of the generative adversarial network. Through the generator using its internal neural network structure, the fusion vector is converted into the first malicious domain name vector, and the first malicious domain name vector is converted into character form to obtain the forged malicious domain name.

[0044] Through this embodiment, character conversion of the first malicious domain name vector can not only convert the abstract mathematical representation into a specific character sequence, but also ensure that the generated forged malicious domain name conforms to the characteristics of the malicious domain name family in terms of semantics and structure, providing high-quality malicious domain name samples for subsequent model training and malicious domain name detection.

[0045] In an exemplary embodiment, character conversion of the first malicious domain name vector to obtain a forged malicious domain name includes:

[0046] Take each row element in the first malicious domain name vector as the current row element, and perform the following character conversion operations to obtain the character corresponding to each row element: Obtain a preset vocabulary; the preset vocabulary includes multiple first characters required to form a domain name and the first semantic vector corresponding to each first character among the multiple first characters; each first character represents a basic unit sequence of the domain name; the basic unit sequence refers to the smallest element sequence that makes up the domain name; the first semantic vector corresponding to each first character includes the context of each first character; calculate the correlation between the current row element and the first semantic vector corresponding to each first character, and determine the first character corresponding to the maximum correlation in the preset vocabulary as the character of the current row element; concatenate the characters corresponding to each row element to obtain the forged malicious domain name.

[0047] Each row element of the first malicious domain name vector is a part of the first malicious domain name vector, and each row corresponds to a character position in the future domain name. The row element itself is a vector that contains the mathematical representations associated with each character, reflecting the potential semantic features and generation probabilities of different characters at that position.

[0048] The preset vocabulary refers to a pre-organized set of characters that includes all possible multiple first characters required to form a domain name, as well as the first semantic vector corresponding to each first character. Here, the first character is a single element in the preset vocabulary, and each first character represents a basic unit sequence of the domain name. The basic unit sequence refers to the smallest element sequence that makes up the domain name, which is the smallest element sequence that makes up the domain name, that is, a single character. The basic unit sequence can be letters (a - z, A - Z), numbers (0 - 9), and common special characters in domain names such as "_", ".", and "-". For example, in the preset vocabulary, "a", "b", "c", etc. are all first characters, and each first character is the unique representation of the corresponding basic unit sequence, that is, each represents a character.

[0049] The first semantic vector corresponding to each first character refers to the multi-dimensional vector corresponding to each first character in the preset vocabulary. The first semantic vector corresponding to each first character captures the semantic information and context relationship of the corresponding first character. Here, the semantic information of the first character refers to the meaning or semantic features carried by the first character when forming a malicious domain name. Although a single character may not have rich independent semantics like a word in natural language, in a specific context (such as in a malicious domain name), the character can imply the intention or attribution of the domain name. For example, some hacker organizations tend to use specific prefixes or suffixes, or prefer certain combinations of letters. For example, the character "z" may often appear in certain specific malicious domain name families, and the first semantic vector corresponding to the character "z" can reflect this family feature and possible semantic meaning. The context relationship of each first character refers to the combination of other characters that are adjacent to or appear within a certain range when the first character appears in a malicious domain name. For example, when a character (such as "e") appears in "example", the characters (such as "x" and "m") that appear before and after it and their influence on its semantics are the context relationship of the character "e". The context relationship of each first character reflects the function of each first character in the character sequence of the domain name. For example, the character "-" may appear as a separator between the top-level domain and the sub-domain. The context relationship captured by the first semantic vector corresponding to each first character not only reflects the characteristics of the character itself but also includes the interaction pattern of the character with other characters in the sequence, which helps to generate highly realistic malicious domain name samples.

[0050] The calculation of the correlation between the current line element and each first character in the preset vocabulary can adopt various statistical methods. For example, by calculating the Pearson correlation coefficient between the current line element and the first semantic vector corresponding to each first character in the preset vocabulary, the degree and direction of the linear correlation between the two vectors are measured. The Pearson coefficient calculation formula is shown in the following formula (1):

[0051] (1)

[0052] where, is the Pearson coefficient between the two vectors, is the i-th element of each row in the first malicious domain name vector, represents the average value of each row element in the first malicious domain name vector, is the i-th element of the first semantic vector corresponding to a certain first character in the preset vocabulary, represents the average value of each row element in the first malicious domain name vector.

[0053] Optionally, Figure 3 is a schematic diagram of an optional method for generating a forged malicious domain name according to an embodiment of the present application. As Figure 3 shown, the random noise vector and the target vector are fused to obtain a fused vector, and the generator then generates a pair of malicious domain name vectors according to the fused vector. The server takes each row element in the first malicious domain name vector as the current line element, calculates the correlation between the current line element and the vector representations of all first characters in the preset vocabulary. After calculating the correlation values between the current line element and all first characters, the maximum correlation is found, and the character corresponding to the maximum correlation is the character of the current line element. The server connects the characters in the order of the line elements to obtain a forged malicious domain name.

[0054] For example, assume that the correlations between a row element in the first malicious domain name vector and each character in the preset vocabulary are as follows: the Pearson correlation coefficient of "a" is 0.8, "b" is 0.7, "c" is 0.85, "d" is 0.75, and the correlations of the remaining characters are relatively low. Then, according to the correlation magnitudes, the character corresponding to this row element will be determined as "c" because the Pearson correlation coefficient with "c" is the highest. This process is repeated for each row element in the vector. Finally, all the determined characters are connected in order to obtain a forged malicious domain name.

[0055] Through this embodiment, by calculating the correlation between each element in each row of the first malicious domain name vector and each first character in the preset vocabulary, the most matching character at each position can be quickly and accurately identified, thus avoiding complex manual feature engineering or preprocessing steps, significantly improving the efficiency of generating malicious domain name samples. At the same time, by capturing semantic features in the mathematical space, the generated domain name patterns are highly similar to real malicious domain names in terms of structure and semantics, effectively solving the problem that it is difficult for malicious domain name generation models to fully learn the internal features of domain name characters and character sequence information.

[0056] In an exemplary embodiment, the method for constructing the preset vocabulary includes the following steps:

[0057] Collect a plurality of domain names, and based on the plurality of domain names, construct an initial vocabulary; the plurality of domain names include a plurality of legitimate domain names and a plurality of malicious domain names; the initial vocabulary includes all the first characters that make up the plurality of domain names; extract a plurality of character sequences from each domain name among the plurality of domain names according to a preset sliding window, use the plurality of character sequences to train a semantic model, and after the semantic model is trained, obtain the preset vocabulary; during the training process of the semantic model, the semantic model predicts the context information of the first character in each character sequence based on each character sequence among the plurality of character sequences, and adjusts the first semantic vector of each first character in the initial vocabulary based on the context information of each first character in the initial vocabulary; after training, the semantic model outputs the finally adjusted first semantic vector of each first character to obtain the preset vocabulary.

[0058] Among them, the initial vocabulary is constructed at the initial stage of model training and contains each unique first character extracted from all the collected domain names. For example, for "example", the initial vocabulary should at least include the characters "e", "x", "a", "m", "p", "l", and "e". Note that "e" may appear twice, but only one entry is retained in the vocabulary. Before starting training, the first semantic vector corresponding to each first character is a randomly initialized vector.

[0059] The preset sliding window is a technical means for extracting context information from domain names, and its width is preset and used to extract a series of overlapping character sequences from each domain name. For example, when the preset sliding window size is 2, for example, for "example", two consecutive characters are extracted each time starting from the beginning, such as "ex", "xa", "am", etc. Different lengths of character sequences can be extracted by extracting domain names according to preset sliding windows of different sizes. For example, for "example", there can be character sequences of different lengths such as "e", "ex", "exa", "exam", "examp", "exampl", "example".

[0060] The character sequence is a continuous substring extracted from each domain name through a preset sliding window. For example, using a window size of 2, "example" can generate character sequences "ex", "xa", "am", and so on. The character sequences are used to train a semantic model, enabling the semantic model to understand the meaning and interaction of characters in different positions.

[0061] A semantic model refers to a machine learning model used to understand and capture the semantic features of the characters in a domain name and their context features in a specific sequence. These features often reflect the specific patterns and strategies adopted by hackers when constructing malicious domain names. For example, the semantic model can be Word2Vec or other similar models. Specifically, through the training process, the semantic model learns how to predict the context information of a single character based on the character sequence, that is, the other characters around the character in the sequence, and converts the semantic information of the character into a vector representation, so that each character is not only regarded as a symbol but also contains the meaning it may carry in different sequences and its relevance to other characters. During the training process of the semantic model, the semantic model adjusts the first semantic vector of each first character in the initial vocabulary based on the context information of each first character in the initial vocabulary to improve the accuracy of predicting context words. The semantic model undergoes multiple iterations to optimize the character vectors. Each iteration attempts to predict the context word based on the current character vectors and adjusts the vectors to reduce the prediction error. After the semantic model is trained, each first character has an optimized first semantic vector representation. For example, for "example", the character "e" may have a vector [0.1, 0.5, 0.3, 0.2], the character "x" has [0.6, -0.2, 0.7, 0.1], etc. Concatenating the first semantic vectors of each first character in the domain name can obtain the vector representation corresponding to the domain name. For example, concatenating the vectors of each character in "example" forms a second malicious domain name vector for "example". If the vector dimension of each character is 4, then the first semantic vector representations of each first character in "example" will be [0.1,0.5, 0.3, 0.2], [0.6, -0.2, 0.7, 0.1], [0.3, 0.2, 0.4, 0.5], [0.2, 0.3, 0.5,0.6], [0.5, 0.4, 0.7, 0.3], [0.7, 0.2, 0.6, 0.4], [0.1, 0.5, 0.3, 0.2]. To obtain the vector representation of the entire "example" domain name, the above character vectors can be averaged or weighted averaged to reflect the semantic information of the entire word. After the above processing, a vector that synthesizes all the semantic information of the characters in "example" is obtained. This vector can be used for subsequent clustering analysis and GAN network training to generate similar malicious domain name samples.

[0062] Optionally, the server collects multiple domain names, including legitimate domain names from Alexa rankings and known malicious domain names, to form a large domain name dataset; constructs an initial vocabulary that contains all unique characters (first characters) that appear in the dataset, such as a-z, A-Z, 0-9, "_", ".", "-"; defines a preset sliding window size, extracts multiple character sequences from each domain name as training samples, and the window moves bit by bit to cover the characters in the domain name; uses the extracted character sequences to train a semantic model. During the training process, the semantic model predicts the context information of the first character in each character sequence, that is, the characters that appear before and after the first character in the sequence. According to the predicted context information, the first semantic vector of each first character in the initial vocabulary is adjusted. Through multiple iterations of training, the vector representation is optimized. After the training is completed, the semantic model outputs the adjusted first semantic vector of each first character, and this vector set constitutes a preset vocabulary, that is, the preset vocabulary.

[0063] Through this embodiment, by using a preset sliding window to extract character sequences from each domain name, it is possible to capture the position dependence and combination patterns of characters in the sequence, allowing the semantic model to not only learn the independent features of characters but also understand their context relationships in the sequence, solving the problem in the related art that it is difficult to fully learn the intrinsic features of domain name characters and character sequence information; during the training of the semantic model, by predicting the context information of the first character in each character sequence to dynamically adjust the first semantic vector of each first character, the generated forged malicious domain names are not only similar to the real malicious domain names in terms of character structure but also maintain consistency at the semantic level, greatly improving the simulation degree and diversity of the generated samples; after the training is completed, the semantic model outputs the finally adjusted set of first semantic vectors, that is, the preset vocabulary, which contains optimized character semantic information and can be used for subsequent malicious domain name generation tasks. By integrating the learned deep semantic features into the preset vocabulary, the generative adversarial network can follow more refined and complex rules when generating malicious domain names, thereby generating higher-quality training samples, effectively improving the training efficiency and effect of the malicious domain name detection model.

[0064] In an exemplary embodiment, the above method for generating malicious domain name samples further includes:

[0065] Obtain multiple real malicious domain names, and convert the multiple real malicious domain names into multiple second malicious domain name vectors; the multiple real malicious domain names and the multiple second malicious domain name vectors are in one-to-one correspondence; cluster the multiple second malicious domain name vectors to obtain multiple typical semantic vectors.

[0066] Among them, a real malicious domain name refers to a large number of domain names that have been confirmed as real malicious ones collected from known network threat intelligence databases, malware behavior analysis reports, and historical interception records. The multiple real malicious domain names collected are converted into numerical vector representations through embedding technology to obtain multiple second malicious domain name vectors, that is, each character in the real malicious domain name is converted into its corresponding vector representation, and then the semantic information of the entire domain name is integrated into a vector representation through a certain aggregation method (such as averaging, weighted summation, etc.), namely the so-called second malicious domain name vector. It can be understood that the second malicious domain name vector refers to the vector form obtained by converting the entire real malicious domain name, while the first malicious domain name vector refers to the initial vector representation obtained by converting the first character. Each second malicious domain name vector corresponds to a real malicious domain name, and each second malicious domain name vector contains the semantic information and character sequence characteristics of the domain name.

[0067] Cluster the multiple second malicious domain name vectors to identify malicious domain name clusters with common semantic features. The typical semantic vectors are extracted from each cluster, representing the common characteristics of the malicious domain names in the cluster.

[0068] Optionally, the server obtains multiple real malicious domain names that have been confirmed as malicious from the network threat intelligence database and the security database, performs vectorization processing on each received real malicious domain name to obtain the vector representation corresponding to each malicious domain name, that is, the second malicious domain name vector; cluster all the second malicious domain name vectors, and after clustering is completed, obtain multiple malicious domain name clusters, and determine the central vectors of the multiple malicious domain name clusters as multiple typical semantic vectors.

[0069] Through this embodiment, after converting multiple real malicious domain names into multiple second malicious domain name vectors, cluster the multiple second malicious domain name vectors to discover and summarize the common characteristics of different malicious domain name families, and finally extract a typical semantic vector from each cluster, representing the comprehensive semantic information of the malicious domain names in the cluster. Through cluster analysis, the typical characteristics of the malicious domain name family can be efficiently summarized, rather than simply relying on the local information of a single domain name; the typical semantic vectors obtained after clustering can provide a clear semantic guidance for the subsequent GAN generation process, enabling the targeted generation of malicious domain names highly similar to a specific family, thus solving the problem that it is difficult for the malicious domain name generation model to fully learn the internal characteristics of domain name characters and character sequence information.

[0070] In an exemplary embodiment, each real malicious domain name among the multiple real malicious domain names includes multiple second characters. The second character refers to the basic unit sequence that makes up the real malicious domain name, including lowercase letters (a - z), uppercase letters (A - Z), numbers (0 - 9), underscores (_), dots (.), and dashes (-).

[0071] In some embodiments, each real malicious domain name is used as the current malicious domain name, and the following conversion operations are performed to obtain a plurality of second malicious domain name vectors:

[0072] 1. Match each second character among the plurality of second characters in the current malicious domain name with each first character in the preset vocabulary; the preset vocabulary includes a plurality of first characters required for constructing a domain name and the first semantic vector corresponding to each first character among the plurality of first characters; each first character represents a basic unit sequence of the domain name; the basic unit sequence refers to the smallest element sequence that makes up the domain name; the first semantic vector corresponding to each first character includes the context of each first character.

[0073] Among them, the preset vocabulary, the first character, the first semantic vector, and the basic unit sequence have been explained in the above embodiments and will not be elaborated here.

[0074] 2. Determine the first semantic vector corresponding to the first character that matches each second character as the second semantic vector corresponding to each second character; based on the second semantic vector corresponding to each second character, determine the second malicious domain name vector corresponding to the current malicious domain name.

[0075] Optionally, the server splits the current malicious domain name into second characters, matches each second character with the preset vocabulary (including the first character and its semantic vector), and through the matching, finds the corresponding first character and its first semantic vector of each second character in the preset vocabulary, and directly determines the found first semantic vector as the second semantic vector of the corresponding second character; through an aggregation operation (such as averaging, weighted summation), integrate the second semantic vectors of all second characters in the current malicious domain name to construct a second malicious domain name vector representing the semantic features of the entire current malicious domain name.

[0076] Through this embodiment, the construction process of the second malicious domain name vector is based on the preset vocabulary. The preset vocabulary is obtained through the training of a large number of legal and malicious domain names and contains extensive semantic information of domain name construction. The second malicious domain name vector generated through the preset vocabulary contains the semantic information and context relationship of the first characters in the malicious domain name. Clustering such a plurality of second malicious domain name vectors, the obtained plurality of typical semantic vectors can reflect the internal characteristics of domain name characters and character sequence information, enabling the generative adversarial network to more accurately simulate forged malicious domain names with structures and semantics close to real malicious domain names, improving the quality of forged malicious domain names.

[0077] In an exemplary embodiment, clustering the plurality of second malicious domain name vectors to obtain a plurality of typical semantic vectors includes the following steps:

[0078] 1. Determine multiple cluster centers and calculate the distances between each of the multiple second malicious domain name vectors and the multiple cluster centers; the number of multiple cluster centers is the same as the number of multiple typical semantic vectors.

[0079] Optionally, Figure 4 is a schematic diagram of an optional method for generating typical semantic vectors according to an embodiment of the present application. As Figure 4 shown, the server sets the value of k according to the specific scenario. In this embodiment, the value of k is set to one-tenth of the multiple second malicious domain name vectors. The K-Means++ method is used to initialize the center points. Randomly select 1 second malicious domain name vector from the multiple second malicious domain name vectors as the cluster center. For each of the remaining second malicious domain name vectors, calculate the distance between it and the selected cluster center, and take the second malicious domain name vector with the farthest distance as the next cluster center. For the second malicious domain name vectors other than the selected cluster centers, calculate the distance between them and the selected cluster centers again until k cluster centers are selected. The server calculates the distances between each of the multiple second malicious domain name vectors and the multiple cluster centers. Among them, the distance calculation formula can be calculated using the function shown in the following formula (2):

[0080] (2)

[0081] where dis(u,v) is the Euclidean distance between two sample u,v vectors, and represent the i-th column of vector u and vector v.

[0082] 2. Assign each second malicious domain name vector to the cluster of the cluster center closest to each second malicious domain name vector to obtain multiple clusters.

[0083] 3. Calculate the mean value of each of the multiple clusters, take the mean value of each cluster as the new cluster center, and based on the new cluster center, return to the step of calculating the distances between each of the multiple second malicious domain name vectors and the multiple cluster centers and continue to execute until the preset stability condition is met. Determine the mean value of each cluster after meeting the preset stability condition as the typical semantic vector corresponding to each cluster, and obtain multiple typical semantic vectors.

[0084] Among them, the preset stability condition refers to the judgment criterion for terminating the clustering algorithm, usually that the change of the cluster center is less than the set threshold or the number of iterations reaches the upper limit, indicating that the clustering process tends to be stable and no longer changes significantly.

[0085] Optionally, for the second malicious domain name vectors in each cluster, recalculate the mean of each cluster, use the mean of each cluster as the new cluster center, and re - execute the process of allocating the second malicious domain name vectors and updating the cluster centers of the clusters until the change in the cluster centers of each cluster tends to be stable. After each cluster converges, the cluster center point of each cluster is the mean of all the second malicious domain name vectors in that cluster. This mean vector represents the typical semantic features of all the second malicious domain name vectors in that cluster, that is, the target vector, which is used for the subsequent task of generating forged malicious domain names.

[0086] Through this embodiment, selecting the second malicious domain name vectors that are far from each other as the initial cluster centers instead of completely randomly selecting the initial cluster centers can avoid the possibility of concentrating in some local areas in the initial stage of the clustering process, ensure the exploration of the global optimal solution of the clustering process, and improve the representativeness of the final clustering result; continuously update the cluster centers to the mean of all members of each cluster until the preset stability condition is met, which ensures that the cluster centers can dynamically adapt to the internal structure of the data set, and avoids unstable clustering results caused by improper selection of the initial centers or changes in data distribution. Through continuous iteration, the cluster centers will gradually converge to the positions representing the best semantic features of the data in the cluster, thus generating higher - quality typical semantic vectors; through clustering, malicious domain names with similar semantic characteristics can be grouped together, and the obtained cluster center vector (i.e., the typical semantic vector) can better generalize the commonalities of this group of malicious domain names, especially their internal features and sequence information at the semantic level. In this way, even when facing malicious domain names from different families, their respective characteristics can be quickly identified through clustering analysis.

[0087] In an exemplary embodiment, the generative adversarial network includes a generator and a discriminator. The generator receives a joint input vector (a fusion of a random noise vector and a target vector) to generate forged malicious domain names, while the discriminator attempts to distinguish these generated domain names from real malicious domain names.

[0088] Among them, the network structure of the generator is an input layer, two hidden layers, and an output layer. The data of the input layer is a random noise vector that conforms to a Gaussian distribution, with a dimension of , where l is the batch size, m is the domain name length, domain names shorter than m are filled with "_", and domain names exceeding m characters will be truncated, and n is the dimension of the letter vector. The activation function used in the hidden layer is the rectified linear unit RELU (Rectified Linear Unit) shown in the following formula (3), and the number of neurons in the hidden layer is adjusted according to the specific scenario.

[0089] (3)

[0090] The number of neurons in the output layer is n, and the activation function is the hyperbolic tangent function tanh shown in the following formula (4).

[0091] (4)

[0092] At the input layer of the generator, a random noise vector is mixed with the target vector obtained by clustering to form a fusion vector, so as to optimize the semantic features of malicious domain names. The generator generates a first malicious domain name vector according to the fusion vector, and the dimension is 。

[0093] The network structure of the discriminator is an input layer (with a dimension of ), two hidden layers, and an output layer. The data in the input layer are the real malicious domain name vector and the first malicious domain name vector generated by the generator. The number of neurons in the hidden layer is set according to the specific scenario. The output layer uses the softmax activation function shown in the following formula (5) to perform a binary classification, which is divided into 0 and 1, indicating whether the data passes the discrimination of the discriminator. 1 represents that the domain name represented by the first malicious domain name vector is considered a real malicious domain name, and 0 represents that the domain name represented by the first malicious domain name vector is considered a forged malicious domain name.

[0094] (5)

[0095] Among them, is the i-th element in the input vector z of the output layer, and K is the dimension of the input vector z of the output layer.

[0096] In some embodiments, the method for generating malicious domain name samples further includes:

[0097] 1. Generate a first historical random noise vector, fuse the first historical random noise vector with the target vector to obtain a first historical fusion vector, input the first historical fusion vector into the initial generator to obtain a first historical forged malicious domain name vector; use the real malicious domain name vector and the first historical forged malicious domain name vector as training samples respectively, and input the training samples into the initial discriminator to obtain a first binary classification judgment result; the first binary classification judgment result represents whether the training sample is a vector of a real malicious domain name.

[0098] Among them, the initial generator refers to a pre-established generator that has not been trained, and its model parameters are fixed. During the process of training the initial discriminator, the model parameters of the initial generator remain unchanged.

[0099] The first historical random noise vector is the basic input of the initial generator, which consists of random numbers conforming to the Gaussian distribution. Its purpose is to introduce uncertainty, enabling the generator to explore the generation space under different initial states, which helps to improve the diversity of generated malicious domain names. In this embodiment, in order to better fuse with the target vector, the dimension of the first historical random noise vector is designed to be the same as that of the target vector, that is , where l represents the batch size, m is the maximum length of the domain name, and n is the dimension of the letter vector. This design ensures that the generator can take into account both randomness and semantic guidance when processing the input.

[0100] The first historical fusion vector is the key input for generating malicious domain names. It is composed of the first historical random noise vector and the target vector, and is fused through linear combination or other mathematical operations. In this embodiment, the first historical fusion vector is created by simply adding the first historical random noise vector and the target vector bit by bit. However, in practice, more complex mathematical operations or weight adjustment strategies can also be adopted to better balance the importance of randomness and semantic features. The use of the first historical fusion vector ensures that the generated malicious domain names have both the novelty brought by randomness and a certain degree of semantic correctness.

[0101] The first historical forged malicious domain name vector is a vector generated by the generator according to the first historical fusion vector, and is used to simulate real malicious activities.

[0102] The first binary classification judgment result is the output of the initial discriminator, which is a vector representing whether the training sample input to the initial generator is a real malicious domain name. Generally, 1 represents that the training sample is a vector of a real malicious domain name, and 0 represents that the training sample is a vector of a forged malicious domain name.

[0103] Optionally, the server initializes a first historical random noise vector with a dimension of , where l is the batch_size (for example, 128), m is the preset domain name length (for example, 20), and n is the dimension of the letter vector (for example, 4). A target vector is randomly selected from a plurality of pre-determined typical semantic vectors, and the first historical random noise vector and the target vector are fused by element-wise addition to form the first historical fusion vector. The server inputs the first historical fusion vector into the generator, and the generator generates the first historical forged malicious domain name vector according to the first historical fusion vector. The real malicious domain name vector and the first historical forged malicious domain name vector are used as training samples respectively, and the training samples are input into the initial discriminator to obtain the first binary classification judgment result, which is a vector representing whether the training sample is a real malicious domain name.

[0104] 2. Calculate the first loss of the initial discriminator based on the first and second classification judgment results and the first loss function, update the parameters of the initial discriminator based on the first loss, and continue training until the first stopping condition is met to obtain a trained discriminator; the first stopping condition refers to the condition that the recognition accuracy of the initial discriminator for real malicious domain names reaches a preset accuracy.

[0105] Among them, the initial discriminator refers to a pre-established and untrained discriminator, and its model parameters are dynamically adjusted according to the first loss of the initial discriminator.

[0106] The first loss function refers to a function used to quantify the classification error degree of the initial discriminator for the first historical forged malicious domain name vectors generated by the initial generator during the discriminator training process. The first loss function is used to measure the recognition ability of the initial discriminator for the vectors of real malicious domain names and the discrimination ability for the first historical forged malicious domain name vectors generated by the generator. The purpose is to optimize the parameters of the initial discriminator so that it can classify domain name samples more accurately and reduce false positives and false negatives. The first loss function can be expressed by the following formula (6). The second loss is calculated based on the first loss function and reflects the classification error rate of the initial discriminator in the current training state. By minimizing the first loss, the learning of the discriminator model can be promoted, the recognition accuracy of its vectors for malicious domain names can be improved, and it can be ensured to play an effective role in the network defense system.

[0107] (6)

[0108] Among them, is the discrimination probability of the discriminator for the vector of the real malicious domain name, is the discrimination probability of the discriminator for the first historical forged malicious domain name vector.

[0109] The first stopping condition refers to the termination criterion during the discriminator training process. The first stopping condition means that the recognition accuracy of the discriminator for real malicious domain names reaches a preset threshold level, indicating that the model has reached sufficient maturity and accuracy and can effectively screen out malicious domain names from the output of the generator and the real data stream.

[0110] 3. Generate a second historical random noise vector, fuse the second historical random noise vector with the target vector to obtain a second historical fusion vector, input the second historical fusion vector into the initial generator to obtain a second historical forged malicious domain name vector; input the second historical forged malicious domain name vector into the trained discriminator to obtain a second binary classification judgment result; the second binary classification judgment result represents whether the second historical forged malicious domain name vector is a vector of a real malicious domain name.

[0111] Among them, the definition of the second historical random noise vector is the same as that of the first historical random noise vector, except that the generation timing of the second historical random noise vector is different from that of the first historical random noise vector. The first historical random noise vector is generated during the process of training the discriminator, while the second historical random noise vector is generated during the process of training the generator after the discriminator is trained. The difference between the second historical fusion vector and the first historical fusion vector is that: the first historical fusion vector is formed by fusing the first historical random noise vector and the target vector through linear combination or other mathematical operations, while the second historical fusion vector is formed by fusing the second historical random noise vector and the target vector through linear combination or other mathematical operations. The difference between the first historical forged malicious domain name vector and the second historical forged malicious domain name vector is that: the first historical forged malicious domain name vector is the domain name generated by the generator according to the first historical fusion vector, while the second historical forged malicious domain name vector is the domain name generated by the generator according to the second historical fusion vector.

[0112] 4. According to the second binary classification judgment result and the second loss function, calculate the second loss of the initial generator, update the model parameters of the initial generator based on the second loss, and continue training until the second stop condition is satisfied to obtain the trained generator; the second stop condition refers to the condition that the misidentification probability of the initial generator is greater than the preset probability threshold.

[0113] Among them, the second loss function is the loss function used during the training process of the generator, which measures the degree to which the generated first historical forged malicious domain name vector is misjudged by the discriminator. The second loss function is designed to maximize the discriminator's "authenticity" judgment of the generated first historical forged malicious domain name vector, that is, to reduce the probability that the discriminator correctly identifies the first historical forged malicious domain name vector as forged, so as to prompt the generator to generate higher-quality first historical forged malicious domain name vectors. The first loss is the loss value calculated according to the second loss function, which reflects the gap between the samples generated by the generator and the real malicious domain names, and a quantitative representation of the misjudgment degree of the discriminator for the generated samples. The first loss of the generator is shown in the following formula (7), where, is the first historical fusion vector.

[0114] (7)

[0115] Using the cross-entropy loss as the second loss function of the generator, the second loss function of the generator is shown in the following formula (8):

[0116] (8)

[0117] Among them, It represents the output probability of the discriminator for the first historical forged malicious domain name vector generated by the generator, with a dimension of (l, 1); y is the target label of the generator, which is fixed at 1 here, indicating that the generator hopes the discriminator to consider the generated sample as real, with a shape of (l, 1).

[0118] The second stopping condition refers to the criterion used to determine when to terminate the training of the generator during the training process. Specifically, the second stopping condition means that the misrecognition probability of the discriminator for the first historical forged malicious domain name vector generated by the generator exceeds a preset probability threshold. That is, when the first historical forged malicious domain name vector generated by the generator is "confusing" enough for the discriminator, making the latter misclassify it as a real malicious domain name with a probability reaching or exceeding a certain threshold, the training of the generator is stopped to avoid overfitting and ensure that the first historical forged malicious domain name vector has sufficient diversity and simulation degree.

[0119] Through this embodiment, the historical forged malicious domain names generated by the generator and the real malicious domain name vectors are sent into the discriminator together, and the obtained binary classification judgment results are directly fed back into the training processes of the generator and the discriminator. This mechanism ensures that the generator can adjust its generation strategy according to the real-time feedback of the discriminator, making the generated forged malicious domain names closer to the real samples. At the same time, the discriminator also becomes more "intelligent" in this process and can more accurately distinguish real and forged malicious domain names, solving the problem that the generated samples are very different from the real samples and it is difficult to improve the training effect of the detection model.

[0120] It should be noted that for the foregoing method embodiments, for the sake of simple description, they are all expressed as a series of action combinations. However, those skilled in the art should know that this application is not limited by the described action sequence, because according to this application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0121] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software plus a necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation. Based on such an understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM (Read-Only Memory), RAM (Random Access Memory), magnetic disk, optical disk), and includes several instructions to enable a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in various embodiments of the present application.

[0122] According to another aspect of the embodiments of the present application, there is also provided a malicious domain name sample generation device. This malicious domain name sample generation device can be used to implement the malicious domain name sample generation method provided in the above embodiments, and those that have been described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that can achieve a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware is also possible and contemplated.

[0123] Figure 5 is a structural block diagram of an optional malicious domain name sample generation device according to the embodiments of the present application. As Figure 5 shown in, this malicious domain name sample generation device includes:

[0124] A malicious domain name generation module 502, which is used to generate a random noise vector, fuse the random noise vector with a target vector through a pre-trained generative adversarial network to obtain a fused vector, and generate a forged malicious domain name according to the fused vector; the target vector refers to a typical semantic vector among a plurality of predetermined typical semantic vectors; each typical semantic vector among the plurality of typical semantic vectors characterizes the typical semantic features of a malicious domain name.

[0125] A malicious domain name sample generation module 504, which is used to generate a malicious domain name sample according to the forged malicious domain name and label data; the label data is used to label the authenticity attribute of the forged malicious domain name; the malicious domain name sample is used to train a malicious domain name detection model.

[0126] It should be noted that the malicious domain name generation module 502 in this embodiment can be used to execute the above step S202, and the malicious domain name sample generation module 504 in this embodiment can be used to execute the above step S204.

[0127] Through the embodiments provided in this application, multiple typical semantic vectors are extracted from a large number of malicious domain names in advance, and a typical semantic vector is randomly determined from the multiple typical semantic vectors as the target vector. During the process of generating forged malicious domain names, a random noise vector is fused with the target vector to obtain a fused vector, and a forged malicious domain name is generated according to the fused vector. The fusion of the random noise vector and the target vector not only retains the randomness in the generation process but also injects semantic guidance, making the generated forged malicious domain names not only structurally close to real malicious domain names but also, more importantly, similar at the semantic level. This greatly simplifies the traditional preprocessing steps, can generate a large number of samples with specific semantic features in a short time, which greatly alleviates the problem of data collection, solves the problems of low efficiency and poor quality in the malicious domain name generation method in the related art, improves the generation efficiency and generation quality of malicious domain name samples, and enhances the training effect of the malicious domain name detection model.

[0128] In an exemplary embodiment, the malicious domain name generation module 502 is further configured to generate a first malicious domain name vector according to the fused vector through a generative adversarial network; perform character conversion on the first malicious domain name vector to obtain a forged malicious domain name.

[0129] In an exemplary embodiment, the malicious domain name generation module 502 is further configured to use each row element in the first malicious domain name vector as the current row element and perform the following character conversion operations to obtain the character corresponding to each row element: obtain a preset vocabulary; the preset vocabulary includes multiple first characters required to form a domain name and the first semantic vector corresponding to each first character in the multiple first characters; each first character represents a basic unit sequence of the domain name; the basic unit sequence refers to the smallest element sequence that makes up the domain name; the first semantic vector corresponding to each first character includes the context of each first character; calculate the correlation between the current row element and the first semantic vector corresponding to each first character, and determine the first character with the maximum correlation in the preset vocabulary as the character of the current row element; connect the characters corresponding to each row element to obtain a forged malicious domain name.

[0130] In an exemplary embodiment, the malicious domain name generation module 502 is further configured to obtain multiple real malicious domain names and convert the multiple real malicious domain names into multiple second malicious domain name vectors; the multiple real malicious domain names and the multiple second malicious domain name vectors are in one-to-one correspondence; cluster the multiple second malicious domain name vectors to obtain multiple typical semantic vectors.

[0131] In an exemplary embodiment, each of the multiple true malicious domain names includes multiple second characters; the malicious domain name generation module 502 is further configured to use each true malicious domain name as the current malicious domain name and perform the following conversion operations to obtain multiple second malicious domain name vectors: match each of the multiple second characters in the current malicious domain name with each first character in a preset vocabulary; the preset vocabulary includes multiple first characters required to form a domain name and a first semantic vector corresponding to each of the multiple first characters; each first character represents a basic unit sequence of a domain name; the basic unit sequence refers to the smallest element sequence that makes up a domain name; the first semantic vector corresponding to each first character includes the context of each first character; determine the second semantic vector corresponding to each second character as the first semantic vector corresponding to the first character that matches each second character; based on the second semantic vector corresponding to each second character, determine the second malicious domain name vector corresponding to the current malicious domain name.

[0132] In an exemplary embodiment, the malicious domain name generation module 502 is further configured to determine multiple cluster centers, and calculate the distances between each of the multiple second malicious domain name vectors and the multiple cluster centers; the number of the multiple cluster centers is the same as the number of the multiple typical semantic vectors; allocate each second malicious domain name vector to the cluster of the cluster center closest to each second malicious domain name vector to obtain multiple clusters; calculate the mean of each of the multiple clusters, use the mean of each cluster as a new cluster center, and based on the new cluster center, return to the step of calculating the distances between each of the multiple second malicious domain name vectors and the multiple cluster centers and continue to execute until a preset stability condition is met, and determine the mean of each cluster after the preset stability condition is met as the typical semantic vector corresponding to each cluster to obtain multiple typical semantic vectors.

[0133] In an exemplary embodiment, the malicious domain name generation module 502 is further configured to collect multiple domain names, and construct an initial vocabulary based on the multiple domain names; the multiple domain names include multiple legitimate domain names and multiple malicious domain names; the initial vocabulary includes all the first characters that make up the multiple domain names; extract multiple character sequences from each of the multiple domain names according to a preset sliding window, and use the multiple character sequences to train a semantic model. After the semantic model is trained, obtain a preset vocabulary; during the training process of the semantic model, the semantic model predicts the context information of the first character in each character sequence based on each character sequence among the multiple character sequences, and adjusts the first semantic vector of each first character in the initial vocabulary based on the context information of each first character in the initial vocabulary; after training, the semantic model outputs the finally adjusted first semantic vector of each first character to obtain a preset vocabulary.

[0134] In an exemplary embodiment, the malicious domain name generation module 502 is further configured to generate a first historical random noise vector, fuse the first historical random noise vector with a target vector to obtain a first historical fusion vector, input the first historical fusion vector into an initial generator to obtain a first historical forged malicious domain name vector; use the real malicious domain name vector and the first historical forged malicious domain name vector as training samples respectively, and input the training samples into an initial discriminator to obtain a first binary classification judgment result; the first binary classification judgment result represents whether the training sample is a vector of a real malicious domain name; calculate a first loss of the initial discriminator according to the first binary classification judgment result and a first loss function, update the model parameters of the initial discriminator based on the first loss, and continue training until a first stop condition is satisfied to obtain a trained discriminator; the first stop condition refers to the condition that the recognition accuracy of the initial discriminator for the training samples reaches a preset accuracy; generate a second historical random noise vector, fuse the second historical random noise vector with the target vector to obtain a second historical fusion vector, input the second historical fusion vector into the initial generator to obtain a second historical forged malicious domain name vector; input the second historical forged malicious domain name vector into the trained discriminator to obtain a second binary classification judgment result; the second binary classification judgment result represents whether the second historical forged malicious domain name vector is a vector of a real malicious domain name; calculate a second loss of the initial generator according to the second binary classification judgment result and a second loss function, update the model parameters of the initial generator based on the second loss, and continue training until a second stop condition is satisfied to obtain a trained generator; the second stop condition refers to the condition that the probability of misrecognition of the initial generator is greater than a preset probability threshold.

[0135] It should be noted that the above-mentioned various modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to this: the above-mentioned modules are all located in the same processor; or, the above-mentioned various modules are respectively located in different processors in any combination form.

[0136] According to another aspect of the embodiments of the present application, there is provided a computer-readable storage medium. The computer-readable storage medium includes a stored program, wherein the program executes the steps in any one of the above method embodiments when running.

[0137] In an exemplary embodiment, the above computer-readable storage medium may include, but is not limited to: various media such as USB flash drives, ROMs, RAMs, mobile hard disks, magnetic disks, or optical discs that can store computer programs.

[0138] According to another aspect of the embodiments of the present application, an electronic device is provided, including a memory, a processor, and a computer program stored on the memory and executable on the processor. The processor is configured to execute the steps in any of the above method embodiments through the computer program. In an exemplary embodiment, the above electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the above processor, and the input / output device is connected to the above processor.

[0139] Specific examples in this embodiment may refer to the examples described in the above embodiments and exemplary embodiments, and will not be repeated here.

[0140] According to another aspect of the embodiments of the present application, a computer program product is further provided. The computer program product includes computer programs / instructions, and the computer programs / instructions include program codes for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609 and / or installed from the removable medium 611. When the computer program is executed by the central processing unit 601, various functions provided by the embodiments of the present application are executed. The serial numbers of the above embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments.

[0141] Figure 6 Schematically shows a block diagram of a computer system of an electronic device for implementing the embodiments of the present application. As Figure 6 shown, the computer system 600 includes a central processing unit (CPU) 601, which can execute various appropriate actions and processes according to the program stored in the ROM 602 or the program loaded from the storage part 608 into the RAM 603. In the random access memory 603, various programs and data required for system operation are also stored. The central processing unit 601, the read-only memory 602, and the random access memory 603 are connected to each other through the bus 604. The I / O (Input / Output) interface 605 is also connected to the bus 604.

[0142] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including such as a CRT (Cathode Ray Tube), an LCD (Liquid Crystal Display), etc. and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. The drive 610 is also connected to the input / output interface 605 as required. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as required so that a computer program read from it can be installed into the storage section 608 as required.

[0143] Specifically, according to an embodiment of the present application, the processes described in each method flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program codes for executing the methods shown in the flowcharts. In such an embodiment, the computer program can be downloaded and installed from the network through the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit 601, various functions defined in the system of the present application are executed.

[0144] It should be noted that Figure 6 The computer system 600 of the electronic device shown is only an example, and should not bring any limitation to the functions and usage scope of the embodiments of the present application.

[0145] Obviously, those skilled in the art should understand that the above-mentioned modules or steps of the present application can be implemented by a general-purpose computing device. They can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices. They can be implemented by program codes executable by the computing device. Thus, they can be stored in the storage device and executed by the computing device. And in some cases, the steps shown or described can be executed in a different order from here, or they can be separately made into individual integrated circuit modules, or multiple modules or steps among them can be made into a single integrated circuit module to implement. In this way, the present application is not limited to any specific combination of hardware and software.

[0146] The above are only the preferred embodiments of the present application, and are not used to limit the present application. For those skilled in the art, the present application can have various changes and modifications. Any modification, equivalent replacement, improvement, etc. made within the principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for generating malicious domain name samples, characterized in that, Including: Generating a random noise vector, fusing the random noise vector with a target vector through a pre-trained generative adversarial network to obtain a fused vector, and generating a forged malicious domain name according to the fused vector; the target vector refers to a typical semantic vector among a plurality of pre-determined typical semantic vectors; each typical semantic vector among the plurality of typical semantic vectors characterizes the typical semantic features of a malicious domain name; Generating a malicious domain name sample according to the forged malicious domain name and label data; the label data is used to label the authenticity attribute of the forged malicious domain name; The malicious domain name sample is used to train a malicious domain name detection model.

2. The method according to claim 1, wherein The generating the forged malicious domain name according to the fused vector includes: Generating a first malicious domain name vector according to the fused vector through the generative adversarial network; performing character conversion on the first malicious domain name vector to obtain the forged malicious domain name.

3. The method according to claim 2, wherein The performing character conversion on the first malicious domain name vector to obtain the forged malicious domain name includes: Taking each row element in the first malicious domain name vector as the current row element, and performing the following character conversion operation to obtain the character corresponding to each row element: obtaining a preset vocabulary; the preset vocabulary includes a plurality of first characters required to form a domain name and a first semantic vector corresponding to each first character among the plurality of first characters; each first character represents a basic unit sequence of the domain name; the basic unit sequence refers to the smallest element sequence that forms the domain name; the first semantic vector corresponding to each first character includes the context of each first character; calculating the correlation between the current row element and the first semantic vector corresponding to each first character, and determining the first character corresponding to the maximum correlation in the preset vocabulary as the character of the current row element; Connecting the characters corresponding to each row element to obtain the forged malicious domain name.

4. The method according to claim 1, wherein The method further includes: Obtaining a plurality of real malicious domain names, and converting the plurality of real malicious domain names into a plurality of second malicious domain name vectors; the plurality of real malicious domain names and the plurality of second malicious domain name vectors are in one-to-one correspondence; Clustering the plurality of second malicious domain name vectors to obtain the plurality of typical semantic vectors.

5. The method according to claim 4, wherein Each real malicious domain name among the plurality of real malicious domain names includes a plurality of second characters; the converting the plurality of real malicious domain names into a plurality of second malicious domain name vectors includes: Taking each real malicious domain name as the current malicious domain name, and performing the following conversion operation to obtain the plurality of second malicious domain name vectors: Matching each second character in the current malicious domain name with each first character in the preset vocabulary; the preset vocabulary includes a plurality of first characters required to form a domain name and a first semantic vector corresponding to each first character among the plurality of first characters; each first character represents a basic unit sequence of the domain name; the basic unit sequence refers to the smallest element sequence that forms the domain name; the first semantic vector corresponding to each first character includes the context of each first character; Determine the first semantic vector corresponding to the first character that matches each of the second characters as the second semantic vector corresponding to each of the second characters; based on the second semantic vector corresponding to each of the second characters, determine the second malicious domain name vector corresponding to the current malicious domain name.

6. The method according to claim 4, wherein The clustering of the multiple second malicious domain name vectors to obtain the multiple typical semantic vectors includes: Determine multiple cluster centers, and calculate the distances between each second malicious domain name vector in the multiple second malicious domain name vectors and the multiple cluster centers; the number of the multiple cluster centers is the same as the number of the multiple typical semantic vectors; Assign each second malicious domain name vector to the cluster of the cluster center closest to each second malicious domain name vector to obtain multiple clusters; Calculate the mean of each cluster in the multiple clusters, use the mean of each cluster as a new cluster center, and based on the new cluster center, return to the step of calculating the distances between each second malicious domain name vector in the multiple second malicious domain name vectors and the multiple cluster centers and continue to execute until a preset stability condition is met. Determine the mean of each cluster after meeting the preset stability condition as the typical semantic vector corresponding to each cluster to obtain the multiple typical semantic vectors.

7. The method according to claim 3 or 5, characterized in that, The method further includes: Collect multiple domain names, and construct an initial vocabulary based on the multiple domain names; the multiple domain names include multiple legitimate domain names and multiple malicious domain names; the initial vocabulary includes all the first characters that make up the multiple domain names; Extract multiple character sequences from each of the multiple domain names according to a preset sliding window, use the multiple character sequences to train a semantic model, and after the semantic model is trained, obtain the preset vocabulary; during the training process of the semantic model, the semantic model predicts the context information of the first character in each character sequence based on each character sequence in the multiple character sequences, and adjusts the first semantic vector of each first character in the initial vocabulary based on the context information of each first character in the initial vocabulary; after being trained, the semantic model outputs the finally adjusted first semantic vector of each first character to obtain the preset vocabulary.

8. The method according to any one of claims 1 to 6, characterized in that, The generative adversarial network includes a generator and a discriminator; the method further includes: Generate a first historical random noise vector, fuse the first historical random noise vector with the target vector to obtain a first historical fusion vector, input the first historical fusion vector into an initial generator to obtain a first historical forged malicious domain name vector; use the real malicious domain name vector and the first historical forged malicious domain name vector as training samples respectively, and input the training samples into an initial discriminator to obtain a first binary classification judgment result; the first binary classification judgment result represents whether the training sample is a vector of a real malicious domain name. Calculate the first loss of the initial discriminator according to the first binary classification judgment result and the first loss function, update the model parameters of the initial discriminator based on the first loss, and continue training until the first stopping condition is satisfied to obtain the trained discriminator; the first stopping condition refers to the condition that the recognition accuracy of the initial discriminator for the training samples reaches a preset accuracy. Generate a second historical random noise vector, fuse the second historical random noise vector with the target vector to obtain a second historical fusion vector, input the second historical fusion vector into the initial generator to obtain a second historical forged malicious domain name vector; input the second historical forged malicious domain name vector into the trained discriminator to obtain a second binary classification judgment result; the second binary classification judgment result represents whether the second historical forged malicious domain name vector is a vector of a real malicious domain name. Calculate the second loss of the initial generator according to the second binary classification judgment result and the second loss function, update the model parameters of the initial generator based on the second loss, and continue training until the second stopping condition is satisfied to obtain the trained generator; the second stopping condition refers to the condition that the probability of misidentification of the initial generator is greater than a preset probability threshold.

9. A generating device for malicious domain name samples, characterized in that, Comprising: A malicious domain name generation module, configured to generate a random noise vector, fuse the random noise vector with a target vector through a pre-trained generative adversarial network to obtain a fusion vector, and generate a forged malicious domain name according to the fusion vector; the target vector refers to a typical semantic vector among a plurality of pre-determined typical semantic vectors; each typical semantic vector among the plurality of typical semantic vectors represents the typical semantic features of a malicious domain name. A malicious domain name sample generation module, configured to generate malicious domain name samples according to the forged malicious domain name and label data; the label data is used to label the authenticity attribute of the forged malicious domain name. The malicious domain name samples are used to train a malicious domain name detection model.

10. A computer-readable storage medium, characterized in that, A computer program is stored in the computer-readable storage medium, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images