DNS anomaly detection and domain name hijacking early warning method based on multi-source NLP

Abstract

The application discloses a DNS abnormality detection and domain name hijacking early warning method based on multi-source NLP, and belongs to the technical field of network security. The method of the application firstly performs multi-source intelligence collection and NLP semantic analysis, identifies malicious entities from the collected external intelligence, and reasons attack modes; then, the identified malicious entities are associated and scored with abnormal modes detected within a preset time window, if the score exceeds a threshold value, it is determined that domain name hijacking or DNS poisoning behavior exists, a domain name hijacking early warning process is executed, and an abnormal event log is stored; according to feedback of system alarm results, logs, and sample data output by intelligence association analysis and hijacking determination, the multi-source intelligence collection and NLP semantic analysis module and the DNS abnormality detection model are updated. The application can realize rapid discovery, accurate positioning and timely early warning of domain name hijacking and DNS abnormality, and reduce false positives and false negatives.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and relates to DNS security detection, in particular to a DNS anomaly detection and domain name hijacking early warning method based on multi-source NLP. BACKGROUND

[0002] The domain name system (DNS) is used for mapping domain names and IP addresses, and is an important basic service of the Internet. Intelligence mining of network data refers to obtaining threat clues or attack information related to network security from public or private data sources, which is commonly seen in security forums, hidden networks (such as the dark web), social media and the like. Domain hijacking refers to an attack behavior of making the domain name accessed by a user point to an illegal or malicious IP address by tampering with DNS resolution records or other means. Anomaly detection refers to statistical analysis or machine learning analysis of collected DNS resolution logs or records to identify suspicious events that are significantly different from the conventional behavior pattern.

[0003] For DNS security, the common practice in the industry is to manage domain name security through traditional DNS monitoring tools, such as passive DNS log analysis and simple black and white lists. The process of traditional DNS monitoring includes: (1) collecting passive DNS data, and counting the query volume, query source IP and the like; (2) comparing with a simple malicious domain name blacklist or domain name reputation database; (3) if matching the blacklist or finding DNS resolution volume anomaly, it is prompted that there may be domain name hijacking or malicious domain name activity. This DNS security monitoring technology has the following shortcomings: (1) lack of external intelligence support: relying only on internal DNS logs and simple blacklists, it is difficult to timely perceive new or hidden domain name hijacking methods; (2) high false negative rate and false positive rate: the black and white list is not updated in time and the rules are rough, which easily leads to a large number of false positives or false negatives; (3) difficult to dynamically correlate and analyze: traditional tools are mainly based on static matching, and it is difficult to deal with complex domain name hijacking attacks, such as multi-level CNAME jump or dark web instruction distribution.

[0004] Some security vendors are trying to associate simple intelligence data with DNS logs for DNS monitoring, including the following processes: (1) periodically (e.g., daily or weekly) crawling public security intelligence information (e.g., some forums, CVE announcements, etc.) to obtain threat clues that may be related to domain name attacks; (2) matching the obtained intelligence such as suspicious IP, domain name or attacker ID with internal DNS query data; (3) if a match occurs, the system gives an alarm to prompt that there may be domain name abuse or hijacking. However, the technical solution has the following shortcomings: (1) single source of intelligence, update delay: mostly only a small amount of public data is quoted, and the update cycle is long; (2) unable to perform deep semantic analysis: lacking NLP (Natural Language Processing) processing capability, unable to mine the key attack methods or potential risk prompts from massive texts; (3) lack of real-time early warning capability: intelligence and DNS logs are usually stored separately and manually compared regularly, unable to discover rapidly emerging domain name hijacking attacks in time. SUMMARY

[0005] In today's Internet, DNS domain name hijacking has become a common and highly dangerous attack method, and the existing technology either relies only on internal DNS monitoring or only simply interfaces with a small amount of external intelligence, both of which are difficult to identify complex and variable hijacking attack scenarios in time. Therefore, the present application provides a DNS anomaly detection and domain name hijacking early warning method based on multi-source NLP, which realizes the rapid discovery, accurate positioning and timely warning of domain name hijacking and DNS anomalies, and reduces false positives and false negatives.

[0006] The DNS anomaly detection and domain name hijacking early warning method based on multi-source NLP provided by the present application comprises the following steps:

[0007] Step 1, the multi-source information collection and NLP semantic analysis module first carries out intelligent collection of multi-source heterogeneous information, and then carries out NLP semantic analysis and information structuring processing. The intelligent collection of multi-source heterogeneous information includes: setting a dynamic crawler strategy driven by reinforcement learning, regularly crawling multi-modal data related to network security from a preset website, cross-modal fusion of multi-modal data, and text cleaning of multi-modal data using TextGrad adversarial training. The NLP semantic analysis and information structuring processing includes: taking the fusion features and the multi-modal data after text cleaning as input, on the one hand, performing small sample threat entity recognition to identify malicious entities therein, and on the other hand, performing topic clustering based on causal driving to identify topics therein, constructing evolution paths among the topics, and adding the topics into a threat intelligence knowledge graph to infer attack patterns of malicious entities. The topic refers to entities involved in the threat attack pattern, including APT organization name, CVE number, malicious domain name, IP address and attack tool; the nodes in the threat intelligence knowledge graph are different entities, and the edges are the relationships between the entities, including use, attack and belong. The detected malicious entities, entity relationships and threat confidence scores are sent to the information data analysis and hijacking judgment module.

[0008] Step 2, the DNS record collection and anomaly detection module regularly acquires DNS query and response records and performs anomaly detection.

[0009] Step 3, the information correlation analysis and hijacking judgment module collects the detected malicious entities from the multi-source information collection and NLP semantic analysis module, collects the abnormal patterns detected within a set time window from the DNS record collection and anomaly detection module, calculates the correlation score of the malicious entities and the abnormal patterns, and if the score exceeds a preset threshold, it is determined that there is a domain name hijacking or DNS poisoning behavior, and the judgment result and the recommended disposal instruction and defense action are output to the domain name hijacking early warning and disposal module; wherein the disposal instruction includes a list of domain names or / and IP addresses to be intercepted and a risk level, and the defense action includes DNS redirection, certificate revocation and traffic cleaning.

[0010] Step 4, after receiving the output of the information correlation analysis and hijacking judgment module, the domain name hijacking early warning and disposal module executes: when receiving a judgment that the domain name or / and IP has a high risk, an automatic alarm mechanism is triggered; defense actions are performed according to the set strategy; and abnormal event related log information is stored.

[0011] Step 5, the continuous learning and dynamic updating module collects feedback of system alarm results, collects labeled samples output by the information correlation analysis and hijacking judgment module, synchronizes cooperative defense and abnormal event related logs, and updates the multi-source information collection and NLP semantic analysis module and the DNS anomaly detection model.

[0012] The advantages and positive effects of the present application are:

[0013] (1) The method of the present application uses the NLP fusion analysis technology of multi-source heterogeneous information to realize the three-modal joint analysis of the text, code fragments and images of the target crawled website, and uses the adversarial text cleaning algorithm to clean the collected fusion text, solves the spelling errors and Unicode camouflage problems intentionally planted by attackers, realizes the unified coding of cross-language entities in hyperbolic space (Poincare sphere model), performs entity semantic alignment, and constructs a threat intelligence knowledge graph; the real-time data of NLP intelligence and DNS anomaly detection are fused to realize the automatic mapping and comparison of multi-source information and DNS records in time and space dimensions, which can improve the detection efficiency of real-time DNS anomaly detection.

[0014] (2) The method of the present application can realize early identification of new domain name hijacking attacks, and through multi-source NLP information mining, the system can timely discover the latest hijacking methods or target domain names appearing on the dark web, and early protection control.

[0015] (3) The method of the present application can significantly reduce the false positive rate and the false negative rate, and through the correlation analysis of external information and internal DNS data, a large amount of irrelevant information can be filtered, the accuracy of the alarm can be improved, and the interference to normal business can be reduced.

[0016] (4) The method of the present application establishes a self-learning closed loop, combines the DNS anomaly detection results collected in real time with the intelligence update, continuously iterates and optimizes the model, and improves the adaptability to various complex domain name hijacking scenarios.

[0017] (5) The method of the present application supports multiple application scenarios, and is suitable for enterprise internal DNS protection, root DNS security monitoring of Internet service providers, and domain name risk perception of large-scale content distribution networks (CDN) or cloud platforms and other business scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 is the implementation flowchart of the DNS record anomaly detection and domain name hijacking early warning method of the present application;

[0019] Figure 2 is the schematic diagram of the multi-source heterogeneous data collection of the multi-source information collection and NLP semantic analysis module of the present application;

[0020] Figure 3 is the iteration schematic diagram of the self-learning closed loop of the continuous learning and dynamic updating module of the present application. DETAILED DESCRIPTION

[0021] The present application will be further described in detail below in combination with the drawings and embodiments.

[0022] As Figure 1As shown, the DNS anomaly detection and domain name hijacking early warning method based on multi-source NLP is implemented as a plurality of functional modules and deployed on an application device, mainly including the following functional modules: multi-source intelligence collection and NLP semantic analysis module, intelligence data analysis and hijacking determination module, domain name hijacking early warning and disposal module, continuous learning and dynamic updating module, DNS record collection and anomaly detection module, and security management platform. The DNS anomaly detection and domain name hijacking early warning method based on multi-source NLP of the embodiment of the application comprises the following steps.

[0023] Step one, the multi-source intelligence collection and NLP semantic analysis module first intelligently collects multi-source heterogeneous intelligence, and then performs NLP semantic analysis and intelligence structuring. The intelligent collection of multi-source heterogeneous intelligence refers to periodically crawling multi-modal data related to network security from a preset website, such as Figure 2 As shown, a preset crawling source set is included in the set, including dark web markets and forums, social media platforms, vulnerability database websites, and hacker tool warehouse websites, etc. Multi-modal data is crawled from these websites, cross-modal fusion and adversarial text cleaning are performed on the data, dynamic crawler strategies are set for multi-modal data crawling, threat clues or attack information related to network security are obtained, including steps 1.1-1.3. NLP semantic analysis and intelligence structuring include small sample threat entity recognition and causally driven topic clustering, including steps 1.4-1.5.

[0024] Step 1.1: Cross-modal fusion is performed on multi-modal data as follows:

[0025] F(x) = Transformer(DeBERTa(x_image image || CodeBERT(x_code code ));

[0026] Wherein, F(x) is the feature representation of the fused multi-modal data x, x includes text and code data; Transformer is an attention mechanism model for cross-modal feature fusion; x_image is the text content in the image screenshot of the crawled page, the text content extracted by OCR from the screenshot of the dark web commodity page in the embodiment of the application; x_code is the code content of the crawled page, the code snippet in the dark web page in the embodiment of the application, such as the source code of the DNS hijacking tool; DeBERTa(x_image) is an image modal encoder that extracts features by processing picture OCR text through the DeBERTa model; CodeBERT(x_code) is a code modal encoder that extracts features by parsing code snippets through the CodeBERT model; || represents a vector concatenation operator.

[0027] The embodiment of the application analyzes the dark web market commodity page through three-mode joint coding, and identifies mixed content (text + screenshot + code fragment) containing domain name hijacking tools / services.

[0028] Step 1.2: Perform adversarial text cleaning. The embodiment of the application introduces TextGrad adversarial training to enhance detection robustness. The objective function of the adversarial training is as follows:

[0029] min θ max ||δ||≤ε L(f θ (x+δ),y);

[0030] Wherein, θ represents the text cleaning model parameter; δ is an adversarial perturbation vector, that is, noise added to the input text, ε is the perturbation intensity threshold, and ||δ||≤ε is the L2 norm constraint of the perturbation vector; L is the loss function of the model on the input after adding the perturbation, and the embodiment of the application calculates the cross-entropy loss; f θ is the text cleaning model with parameters; x represents the original input text, and y represents the label of the clean text after cleaning x. Through adversarial text cleaning, the problem of spelling errors and Unicode disguises deliberately planted by attackers is solved to effectively defend against the use of homonyms by attackers, such as the "аррlе.com" disguised Apple domain name.

[0031] Step 1.3: Set the current website to be crawled as the target website, and set a dynamic crawler strategy driven by reinforcement learning. The crawler scheduling strategy is as follows:

[0032]

[0033] Wherein, the strategy function π s (a|s) is the probability distribution of selecting action a in state s; Q(s,a) is a state-action value function for evaluating the return of action a in state s, τ is a temperature coefficient for controlling the balance between exploration and utilization; s is a state vector, and the s of the embodiment of the application contains 15-dimensional features such as target website anti-crawling intensity and page update frequency; the action a of the embodiment of the application is to select a page parsing path under a certain crawling frequency, and the action space is a set of different page parsing paths under different crawling frequencies; the denominator in the formula represents the sum of the exponential functions exp(Q(s,a') / τ) of all possible actions a'. The embodiment of the application selects the optimal parsing path and crawling frequency through the dynamic crawler strategy driven by reinforcement learning.

[0034] Step 1.4: Perform small sample threat entity recognition on the fused features and the cleaned input text.

[0035] a. Constructing a dynamic prompt learning framework for identifying malicious domains. This embodiment of the invention constructs a dynamic prompt learning framework with a two-stage architecture comprising a template generator and a FLAN-T5 inference engine. The dynamic template generator automatically adjusts the prompt template based on the input text features, and the FLAN-T5 model performs a malicious domain classification task based on the generated prompts, achieving high accuracy in identifying malicious domains in zero-sample scenarios.

[0036] b. Perform comparative learning on the dynamic prompting learning framework to enhance its recognition results. The NT-Xent loss function L is used during the comparative learning. NTXent as follows:

[0037]

[0038] Among them, z i ,z j is the feature vector of a positive sample pair, such as the embedding vector of "DNS hijacking" and "DNS hijacking"; 2N is the total number of samples in the batch, which is the augmented data containing N pairs of positive samples; sim(z i ,z j () is the cosine similarity function, used to calculate the similarity of sample z. i ,z j The similarity between samples is denoted by r, which is a temperature coefficient used to scale the range of similarity values; 1_{k≠i} is an indicator function, which is 1 when k≠i and 0 otherwise. The NT-Xent loss function encourages the model to learn discriminative feature representations by maximizing the similarity between positive sample pairs and minimizing the similarity between negative sample pairs.

[0039] During training of the dynamic cue learning framework, this invention constructs positive sample pairs of different linguistic representations of the same threat entity, such as the positive sample pair "DNS hijacking". DNS hijacking is used for comparative learning to improve cross-language entity alignment capabilities.

[0040] Step 1.5: Using a causal discovery algorithm, identify entities in the threat attack patterns involved in the fused features and cleaned text, and automatically construct evolutionary paths between topics, such as generating an evolutionary path of "vulnerability → attack tool development → attack activity" for malicious domain attacks.

[0041] The neural causal topic model is constructed as follows:

[0042]

[0043] Wherein, p(w|d) represents the probability of generating a network security related word w such as DNS, vulnerability, etc. from the crawled data document d such as threat intelligence text; z is a hidden variable representing a topic such as "attack activity", "tool development", etc.; T is a preset total number of topics; p(w|z=t) represents the generation probability of word w under topic t; p(z=t|d) represents the probability that document d belongs to topic t (constrained by the causal graph). The topic in the embodiment of the present application refers to an entity involved in a threat attack mode, including APT (Advanced Persistent Threat Organization) organization name, CVE (Common Vulnerabilities and Exposures) number, malicious domain name, IP address, attack tool, etc.

[0044] The time sequence topic drift detection model is constructed as follows:

[0045] Delta t =||theta t -theta t-1 ||2>alpha*mada t-k );

[0046] Wherein, theta t , theta t-1 are topic distribution vectors at time t and time t-1 respectively; Delta t represents the topic drift at time t; ||.||2 is the calculation of L2 norm, used to measure the distribution change amplitude; mad({Delta t-k}) represents the median absolute deviation of the change value in the historical window; alpha is a pre-warning sensitivity adjustment coefficient, for example, alpha=3 is a significant anomaly. The time sequence topic drift detection model judges whether to trigger a pre-warning by calculating the change of the topic distribution.

[0047] The present application first extracts the involved topics by using the neural causal topic model for the input, then detects the change of the topics by using the time sequence topic drift detection model, and finally determines the causal relationship between the topics by using the causal discovery algorithm. When the topic distribution change exceeds alpha times of the historical median absolute deviation, a pre-warning is triggered. For example, when it is detected that the intensity of a topic such as tool development increases by more than a certain threshold such as 200% in the time window [t-1, t], the associated CVE number is automatically retrieved, and a relationship edge of "potential attack tool -> exploit -> vulnerability" is created in the threat intelligence knowledge graph.

[0048] Step 1.6: Constructing a threat intelligence knowledge graph. In the threat intelligence knowledge graph of the present application, the nodes are entities involved in a threat attack mode, including APT organization name, CVE number, malicious domain name, IP address, attack tool name, etc.; the edges are actual relationships between these entities, such as use, attack, belong, etc.; the relationship formed by two nodes and an edge, for example, an APT organization uses a certain vulnerability, a vulnerability is exploited to attack a domain name, a domain name resolves to a certain IP address, etc.

[0049] In constructing the threat intelligence knowledge graph, the present application performs hyperbolic space entity alignment on different syntaxes and different encoding representations of node entities, as follows:

[0050]

[0051] Wherein, u and v are two different embedding vector representations of entities in the Poincare ball model, such as embedding vector representations of threat entities described in different languages of Chinese, Russian and English; ||u|| is the Euclidean norm of vector u; arcosh is the inverse hyperbolic cosine function, and the hyperbolic space distance d is calculated H (u,v).

[0052] In the Poincare ball model, unified representation of multi-language threat entities in Chinese, Russian and English is realized.

[0053] Attack pattern reasoning is performed using the constructed threat intelligence knowledge graph: the RotatE relationship reasoning model is adopted: h°r≈t, and the attack chain of "APT organization -> uses -> vulnerability -> attack -> domain name" is automatically completed; wherein h is the head entity embedding, such as "APT organization", r is the relationship embedding, such as "uses", and t is the tail entity embedding, such as "vulnerability"; ° represents a complex space rotation operator, which rotates the head entity h through the relationship r to the vicinity of the tail entity t.

[0054] The initial threat intelligence knowledge graph of the present application is constructed from two parts of collected external multi-source heterogeneous intelligence and internal DNS monitoring data (DNS logs and records, abnormal detection results, etc.), and after NLP processing, entities and relationships are extracted, a threat intelligence knowledge graph is constructed, and the graph will be updated continuously as the collection and DNS monitoring data are collected.

[0055] As shown in Figure 1 The multi-source intelligence collection and NLP semantic analysis module obtains the running state of the module, including data collection throughput, NLP model load rate, threat intelligence update frequency and other monitoring indicators, and outputs the current detected threat intelligence to the security management platform, including time dimension statistical threat type distribution, high-risk domain name / IP list, intelligence source credibility evaluation results, etc. The multi-source intelligence collection and NLP semantic analysis module provides structured threat data, such as extracted malicious entities, threat semantic labels and threat confidence scores, to the intelligence correlation analysis and hijacking judgment module. Malicious entities such as domain names, IPs, attack tool names, threat semantic labels such as DNS hijacking, phishing attacks, and threat confidence scores are risk quantification values based on NLP semantic analysis, with a value range of 0-1.

[0056] Step two, the DNS record collection and abnormal detection module performs abnormal detection on DNS records at regular intervals.

[0057] The DNS record collection and anomaly detection module is deployed in the log collection system at the operator DNS, root DNS, authoritative DNS, etc., to obtain DNS query and response records in real time or in batches, such as different types of records such as A, CNAME, NS, MX, AAAA, etc.; then the time series analysis, statistical characteristics or machine learning model is used to detect the anomaly of the DNS record, to detect the abnormal situation such as suspicious traffic explosion, abnormal resolution direction, and unusual TTL change. Above, A represents that this record contains the IPv4 address of the domain; CNAME represents that this record maps the domain or subdomain to another domain; NS represents that this record describes the authoritative name server of the domain; MX represents that this record contains information about the email server responsible for receiving emails of a specific domain; AAAA represents that this record contains the IPv6 address of the domain.

[0058] Step three, the intelligence data analysis and hijacking judgment module cross-domain correlates the malicious entities such as suspicious domain name / IP / keyword extracted by the multi-source intelligence collection and NLP semantic analysis module with the anomaly detection results in the DNS record collection and anomaly detection module, and simultaneously performs entity correlation scoring based on cosine similarity. Here, cross-domain refers to the heterogeneous data correlation between the external threat intelligence domain (text semantic space) and the internal DNS log domain (network traffic space). The correlation objects are: a. malicious entities in external intelligence, and domain name / IP / attacker ID; b. resolution records in DNS anomaly events, such as A / CNAME / NS, etc. If the matching degree or risk score exceeds the preset threshold, it is determined that there may be domain name hijacking or DNS poisoning behavior, and the hijacking early warning process is entered.

[0059] The intelligence data analysis and hijacking judgment module realizes the correlation analysis of external intelligence and internal DNS data by using spatiotemporal alignment, multi-modal feature fusion, causal effect calculation and comprehensive reproduction scoring. The specific implementation is as follows:

[0060] (1) Spatiotemporal alignment: establish a sliding window matching rule for the timestamp t_i of external intelligence and the timestamp t_d of DNS anomaly;

[0061] |t_i-t_d|≤Δt;

[0062] Where t_i represents the timestamp of external intelligence, t_d represents the time of DNS anomaly, and Δt is the time window threshold. In this embodiment, Δt is set to 24 hours, that is, the DNS data detected by the present application within 24 hours is used to detect abnormal patterns.

[0063] (2) Multi-modal feature fusion: concatenate the external intelligence threat vector v_i and the DNS anomaly pattern vector v_d to form a fusion vector.

[0064] v_{fused} = Concat(v_i, v_d);

[0065] where Concat(·,·) denotes the vector concatenation operation; the generated fused vector v_{fused} contains the information of the two vectors. The threat vector v_i of external intelligence is the word vector of the detected malicious entity, and the DNS anomaly pattern vector v_d is the word vector of the detected DNS anomaly pattern.

[0066] (3) Causal effect calculation: quantify the causal influence of external threats on DNS anomalies through counterfactual reasoning. Calculate the causal effect CausalEffect of external threats on DNS anomalies as follows:

[0067] CausalEffect = P(Anomaly | do(Threat = 1)) - P(Anomaly | do(Threat = 0));

[0068] where Threat represents external threats, Anomaly represents DNS anomalies, P(Anomaly | do(Threat = 1)) represents the probability of DNS anomaly occurrence under the condition of actively setting Threat to 1, and P(Anomaly | do(Threat = 0)) represents the probability of DNS anomaly occurrence under the condition of actively setting Threat to 0. The calculated CausalEffect reflects the strength of the causal relationship between external threats and DNS anomalies.

[0069] (4) Considering the causal effect and the similarity between vectors, calculate the risk score RiskScore of external threats as follows:

[0070] RiskScore = 0.7 × CausalEffect + 0.3 × cos(v_i, v_d);

[0071] where cos(v_i, v_d) represents the cosine similarity between vectors v_i and v_d, which is used to measure the consistency of their directions, and the coefficients 0.7 and 0.3 respectively represent the weights of causal effect and vector similarity in risk score.

[0072] The intelligence correlation analysis and hijacking determination module outputs risk event reports and analysis performance indicators to the security management platform; outputs labeled sample data (verified threat determination results, difference analysis of model predictions and actual results) and feature distribution deviation (trend of feature distribution changes of external intelligence and DNS abnormal data) detection to the continuous learning and dynamic updating module; outputs disposal instructions, including domain names / IP lists that need to be intercepted and risk levels, recommended defense actions such as DNS redirection, certificate revocation, and traffic cleaning, to the domain name hijacking early warning and disposal module. The risk event report includes a high-risk domain name / IP list, an attack chain visualization graph, and a risk level classification of cross-source correlation results. The analysis performance indicators include correlation analysis accuracy, false positive / false negative rate, processing delay, and other performance data.

[0073] Step four, the domain name hijacking early warning and disposal module performs: a) when the system determines that a certain domain name or IP has a high risk, an automatic alarm mechanism is triggered; b) according to the pre-set strategy, defense actions such as traffic interception, blocking resolution, and manual secondary review are performed; c) at the same time, the abnormal event and related log information are stored and submitted to the security management platform for retention and traceability.

[0074] The functions implemented by the collaborative defense and log storage module are: a) collaborative defense: linkage with other security defense systems (such as firewalls, IDS, etc.), timely blocking of malicious IPs or traffic, and enhancement of defense strength. b) log storage and traceability: all alarm information and abnormal event logs are stored to the security management platform to ensure traceability and support subsequent security analysis and reporting.

[0075] Step five, the continuous learning and dynamic updating module performs: a) collects feedback of system alarm results, such as confirmation of false positives, new changes in attack methods, etc., and updates the multi-source intelligence collection and NLP semantic analysis module and the DNS abnormal detection model through online or offline methods; b) forms a self-learning closed loop to continuously improve the ability to capture new domain name hijacking attacks.

[0076] For example, Figure 1 and Figure 3As shown, the continuous learning and dynamic updating module performs continuous learning and dynamic iteration to obtain data: labeled sample data and feature distribution offset from the intelligence correlation analysis and hijacking determination module, the labeled sample data being verified threat determination results, difference analysis of model prediction and actual results, and the feature distribution offset being the feature distribution trend of external intelligence and DNS abnormal data; all alarm information and abnormal event logs are synchronized from the collaborative defense and log storage module. Then, the models involved in the multi-source intelligence collection and NLP semantic analysis module are updated according to the obtained data, and the DNS anomaly detection model in the DNS record collection and anomaly detection module is updated, so that the system can quickly adapt to new hijacking methods. The alarm results are verified and fed back to the intelligence data analysis and hijacking determination module.

[0077] The functions realized by the security management platform in the method of the application are: a) real-time monitoring and reporting: the platform monitors the real-time state of the system and provides comprehensive security reports for administrators to view and analyze. b) event analysis and backtracking: support for backtracking and in-depth analysis of historical security events to help identify attack patterns and vulnerabilities. At the same time, the security management platform issues policies and receives states. The types of policies issued include: (1) collection strategy: adjust the priority of intelligence sources, such as increasing the frequency of dark web crawling; set data cleaning rules, such as filtering low-trust sources. (2) analysis strategy: dynamically adjust risk determination thresholds, time window thresholds Δt, such as shortening from 24 hours to 12 hours. (3) defense linkage strategy: define linkage rules with other security systems (firewall, WAF), such as setting the rule "high-risk domain name triggers firewall IP block".

[0078] The following is an example of a specific scenario to illustrate the workflow of DNS anomaly detection and domain name hijacking early warning in the method of the application:

[0079] Step 1, multi-source intelligence collection and NLP analysis: the system crawls a post from a hacker forum discussing how to use similar domain names for phishing attacks, and NLP analysis extracts:

[0080] There are malicious domain names similar to log1n, such as "logln.example.com" and potential attack IP "198.51.xxx.xxx".

[0081] Step 2, perform DNS record anomaly detection:

[0082] a) In the DNS log, a large number of requests for resolving "logln.example.com" recently appeared, and the access source IP geographic location distribution was abnormally concentrated in some high-risk areas;

[0083] b) The IP address pointed by the resolution matched part of "198.51.xxx.xxx", causing the system to issue a preliminary warning.

[0084] Step 3, intelligence correlation analysis:

[0085] a) By comparing with the DNS abnormal rules in the intelligence library, it is confirmed that the domain name detected in step 1 has a high risk association with the extracted malicious IP;

[0086] b) The system automatically calculates the risk score to determine that the suspected phishing domain name and domain name hijacking behavior have a high possibility.

[0087] Step 4, early warning and disposal:

[0088] a) The system immediately issues a high-level warning and automatically notifies the security administrator;

[0089] b) Subsequently, the domain name can be automatically added to the enterprise internal blacklist or subjected to DNS resolution interception to block user access;

[0090] c) After the administrator manually reviews and confirms that it is indeed a malicious counterfeit domain name, the system marks the intelligence entry and performs positive feedback to the model.

[0091] In general, various example embodiments of the present disclosure can be implemented in hardware or special-purpose circuitry, software, firmware, logic, or any combination thereof. Certain aspects can be implemented in hardware, while other aspects can be implemented in firmware or software executed by a controller, microprocessor, or other computing device. When aspects of the embodiments of the present disclosure are illustrated or described as a flow diagram, flowchart, or using some other graphical representation, it is to be understood that the blocks, devices, systems, techniques, or methods described herein can be implemented in hardware, software, firmware, special-purpose circuitry, or logic, general-purpose hardware or controller or other computing device, or some combination thereof, as non-limiting examples.

[0092] In addition to the technical features described in the specification, they are known to those skilled in the art. The present application omits the description of known components and known technologies to avoid redundancy and unnecessary limitation of the present application. The embodiments described in the above embodiments do not represent all embodiments consistent with the present application. Various modifications or variations made by those skilled in the art without creative labor on the basis of the technical solutions of the present application are still within the protection scope of the present application.

Claims

1. A method for DNS anomaly detection and domain hijacking early warning based on multi-source NLP, characterized in that, include: Step 1: The multi-source intelligence gathering and NLP semantic analysis module first performs intelligent gathering of multi-source heterogeneous intelligence, followed by NLP semantic analysis and intelligence structuring processing. The intelligent gathering of multi-source heterogeneous intelligence includes: setting up a reinforcement learning-driven dynamic crawling strategy to periodically crawl multimodal data related to cybersecurity from preset websites; performing cross-modal fusion of the multimodal data; and using TextGrad adversarial training to clean the multimodal data. The NLP semantic analysis and intelligence structuring processing includes: using the fused features and the cleaned multimodal data as input to perform small-sample threat entity identification. The system identifies malicious entities within the threat intelligence knowledge graph. It also performs causal-driven topic clustering to identify specific topics, constructs evolutionary paths between topics, and incorporates them into the graph to infer the attack patterns of malicious entities. These topics refer to entities involved in threat attack patterns, including APT organization names, CVE numbers, malicious domains, IP addresses, and attack tools. In the knowledge graph, nodes represent different entities, and edges represent relationships between entities, including usage, attack, and belonging. Here, APT stands for Advanced Persistent Threat Organization, CVE for Common Vulnerability Disclosure, and NLP for Natural Language Processing. The detected malicious entities, entity relationships, and threat confidence scores are sent to the intelligence correlation analysis and hijacking determination module. Step 2: The DNS record collection and anomaly detection module periodically acquires DNS query and response records and performs anomaly detection; Step 3: The intelligence association analysis and hijacking judgment module collects malicious entities detected by the multi-source intelligence collection and NLP semantic analysis module, and collects abnormal patterns detected within the set time window from the DNS record collection and anomaly detection module. It calculates the association score between malicious entities and abnormal patterns. If the score exceeds the preset threshold, it determines that there is domain hijacking or DNS poisoning behavior, and outputs the judgment result, suggested handling instructions and defense actions to the domain hijacking warning and handling module. The handling instructions include a list of domains and / or IPs to be blocked and their risk levels, and the defense actions include DNS redirection, certificate revocation and traffic scrubbing. Step 4: After receiving the output from the intelligence correlation analysis and hijacking judgment module, the domain hijacking early warning and handling module performs the following actions: when a domain name or / and IP is judged to have a high risk, it triggers an automatic alarm mechanism; it executes defensive actions according to the set strategy; and it stores logs of abnormal events. Step 5: The continuous learning and dynamic update module collects feedback from system alarm results, collects judgment results from the intelligence correlation analysis and hijacking judgment module, synchronizes collaborative defense and abnormal event related logs, and updates the multi-source intelligence collection and NLP semantic analysis module and the DNS anomaly detection model.

2. The method according to claim 1, characterized in that, In step 1, the multi-source intelligence gathering and NLP semantic analysis module performs cross-modal fusion of multimodal data, as shown below: )； Where x represents the crawled multimodal data, x_image is the text in the screenshot of the crawled page image, and x_code is the code of the crawled page; F(x) is the fused feature; Transformer is the attention mechanism model for cross-modal feature fusion; DeBERTa(x_image) means extracting features from x_image using the DeBERTa model; CodeBERT(x_code) means extracting features from x_code using the CodeBERT model; || represents the vector concatenation operator.

3. The method according to claim 1, characterized in that, In step 1, the multi-source intelligence gathering and NLP semantic analysis module sets up a reinforcement learning-driven dynamic crawling strategy, taking the current website to be crawled as the target website, the features of the current target website as state s, and the set of different page parsing paths under different crawling frequencies as the action space. The strategy function is as follows: ； in, Let be the probability distribution of choosing action a in state s; Q(s,a) is the state-action value function, used to evaluate the benefit of action a in state s; τ is the temperature coefficient, used to control the balance between exploration and exploitation; the denominator in the formula represents the probability distribution of all possible actions. exponential function Summation; Select the optimal parsing path and crawling frequency for the target website through a dynamic crawling strategy driven by reinforcement learning.

4. The method according to claim 1, characterized in that, In step 1, when the multi-source intelligence gathering and NLP semantic analysis module performs small-sample threat entity identification, it uses a constructed dynamic prompt learning framework to identify malicious domain names from the input. The dynamic prompt learning framework is a two-stage architecture that includes a template generator and a FLAN-T5 inference engine. The template generator automatically adjusts the prompt template based on the input text features, and the FLAN-T5 model performs a malicious domain name classification task based on the generated prompts. When training the dynamic prompt learning framework, positive sample pairs of different linguistic representations of the same threat entity are constructed, and the NT-Xent loss function is used to perform comparative learning on the dynamic prompt learning framework to enhance the identification results of the dynamic prompt learning framework.

5. The method according to claim 1, characterized in that, In step 1, the multi-source intelligence gathering and NLP semantic analysis module extracts the relevant topics from the input using a neural causal topic model, and then uses a temporal topic drift detection model to detect changes in the topics. When a change in the topic distribution is detected to exceed α times the absolute deviation of the historical median, an early warning is triggered, where α is the early warning sensitivity adjustment coefficient. Finally, the causal relationship between topics is determined through a causal discovery algorithm, and the evolutionary path between topics is constructed.

6. The method according to claim 1 or 5, characterized in that, In step 1, the multi-source intelligence gathering and NLP semantic analysis module performs hyperbolic space entity alignment on different encoding representations of the same entity when constructing the threat intelligence knowledge graph, and realizes a unified representation of different encoding representations of the same entity in the Poincaré sphere model; and based on the existing threat intelligence knowledge graph, it uses the RotatE relational reasoning model to perform attack pattern reasoning and complete the attack chain.

7. The method according to claim 1, characterized in that, In step 2, the DNS record collection and anomaly detection module is a log collection system deployed on the carrier DNS, root DNS, and authoritative DNS, which uses time-series analysis, statistical features, or machine learning models to detect anomalies in DNS records.

8. The method according to claim 1, characterized in that, In step 3, the intelligence association analysis and hijacking determination module calculates the association score between malicious entities and abnormal patterns, including: let the timestamp of the malicious entity detected by the multi-source intelligence collection and NLP semantic analysis module be t_i, and the word vector be v_i; let the occurrence time of the DNS abnormal pattern collected by the DNS record collection and anomaly detection module be t_d, and the word vector be v_d. First, based on the matching rules of the set time window threshold Δt, the DNS anomaly pattern is obtained, satisfying... ; Then, counterfactual reasoning was used to quantify the causal effect of malicious entities on DNS anomaly patterns. ; Where Threat represents a malicious entity, Anomaly represents a DNS anomaly pattern, P(Anomaly | do(Threat =1)) represents the probability of a DNS anomaly occurring when Threat is actively set to 1, and P(Anomaly | do(Threat =0)) represents the probability of a DNS anomaly occurring when Threat is actively set to 0. Finally, taking into account both causal effects and vector similarity, the RiskScore for malicious entities is calculated as follows: ； in, This indicates that the cosine similarity between vectors v_i and v_d is calculated, with coefficients of 0.7 and 0.3 representing the weights of causal effect and vector similarity in risk scoring, respectively.

Images