A DGA domain name active detection method and system based on key feature extraction

Abstract

The present application relates to the technical field of network security protocols, and specifically to a method and system for active detection of DGA domain names using key feature extraction. The method comprises: screening out a number of subdomains from domain name data and converting them into domain name digital sequences; constructing a dual-branch active detection model, dynamically adjusting the dilation rate of the dilated convolution in branch 1; optimizing the SE attention module in branch 2 to reduce information loss caused by the reduction of channel dimensions in the SE attention module and extract key features of the sample data; fusing the output results of the dual branches to obtain a feature map, and sending it to the maximum pooling layer to extract key features to train the active detection model; and using the trained active detection model to obtain the detection results of the domain name to be detected. The present application aims to improve the ability of the active detection model to extract character length features of different subdomains by extracting results from two branches in the active detection model, and reduce the possibility of channel information loss caused by channel compression reduction.

Description

Technical Field

[0001] The present application relates to the technical field of network security protocols, and in particular to a method and system for actively detecting DGA domain names by extracting key features. Background Art

[0002] DGA domains are generated using a Domain Generation Algorithm (DGA) algorithm based on random characters, time, and dictionary information. These domains are designed to resemble benign domains as closely as possible, thereby evading detection and blocking. DGA domains are often used by centralized botnets to connect to C2 servers, facilitating communication between attackers and infected hosts.

[0003] Because DGA domains typically have a short lifespan, they place higher demands on defenders' detection capabilities. Defenders must detect DGA domains as quickly as possible and take appropriate action to effectively mitigate risk. DGA domain detection methods include supervised learning-based detection, registration status-based detection, threat intelligence-based detection, and deep learning-based detection.

[0004] Among the aforementioned detection methods, active detection based on deep learning to extract key features from DGA domain names is currently one of the mainstream approaches. However, the deep features extracted from DGA domain data using the SE (Squeeze and Excitation) attention module do not take into account the data extraction capabilities of character length features from different subdomains during convolution. Furthermore, when the SE attention module compresses and restores channels through two fully connected layers, the reduced channel compression leads to a loss of channel information. As a result, the extracted features after recovery cannot accurately represent the data characteristics of the sample data, affecting the accuracy of feature extraction. Summary of the Invention

[0005] To solve the above technical problems, this application provides a method and system for actively detecting DGA domain names by extracting key features. The technical solutions adopted are as follows:

[0006] In a first aspect, an embodiment of the present application provides a method for actively detecting DGA domain names by extracting key features, the method comprising the following steps:

[0007] Filter out several subdomains from the domain name data and convert them into domain name numeric sequences;

[0008] Build a dual-branch active detection model;

[0009] In branch 1, the lengths of the subdomain characters in different domain name numeric sequences are converted into domain name word vectors, and the dilation rate of the dilated convolution at each position in the domain name word vector is dynamically adjusted to obtain the corresponding feature map through dilated convolution.

[0010] In branch 2, the feature map after the dilated convolution is dimensionally transformed to obtain a multi-channel feature map for the input of the SE attention module; when the first fully connected layer in the SE attention module performs channel reduction, an undirected graph is constructed for the feature map of each channel, and the dense vector of each node in the undirected graph is used to divide the discriminant node of each node, and the pooling influence weight of each node is determined by combining the number of paths with average path length between nodes in the undirected graph; according to the weight of each feature map output by the second fully connected layer in the SE attention module, the pooling influence weight of the node corresponding to each element in the corresponding feature map is weighted to obtain the final output of the SE attention module;

[0011] The feature maps of the same channel extracted by the dilated convolution of the feature map of each channel in the final output of the SE attention module are added and fused to obtain the fused feature map, which is then sent to the maximum pooling layer to extract key features to train the active detection model; the trained active detection model is used to obtain the detection results of the domain name to be detected.

[0012] Preferably, the step of selecting a plurality of subdomains from the domain name data and converting them into a domain name digital sequence comprises:

[0013] Split each full domain name into multiple subdomains according to the hierarchy;

[0014] A dynamic threshold screening mechanism based on Shannon entropy of positional encoding is used to screen out the subdomain part of each full domain name that is most likely to be a DGA domain name;

[0015] Build a character-to-digit mapping, convert the filtered subdomains into corresponding array lists, and obtain a computer-readable domain name numeric sequence;

[0016] Use the encoding 0-filling method to fill the missing elements in each digital sequence with 0 until the length reaches the preset sequence rated length.

[0017] Preferably, the step of dynamically adjusting the expansion rate of the dilated convolution at each position in the domain name word vector includes:

[0018] Perform one-hot encoding on the domain name numeric sequence to generate a binary vector, and then use the word embedding matrix to convert the binary vector into a distributed vector as the domain name word vector;

[0019] Input the embedding vector matrix composed of multiple domain name word vectors into the recurrent layer to generate a hidden state matrix;

[0020] Taking the hidden state matrix as input, we use the additive attention module to obtain the attention weights for each position in the domain word vector.

[0021] The expansion rate of each position is dynamically adjusted according to the attention weight of the position.

[0022] Preferably, the expansion rate is dynamically adjusted as follows:

[0023]

[0024] Where, is the expansion rate at the p-th position, 、 They are the minimum and maximum values ​​of the expansion rate preset, is the attention weight of the p-th position.

[0025] Preferably, the method of constructing an undirected graph for each channel includes:

[0026] Each element in the feature map of each channel is regarded as a node in the undirected graph. Whether the two nodes in the undirected graph are connected is determined based on whether the two elements in the feature map are adjacent elements, and the ratio of the frequency of the two elements appearing as adjacent nodes to the sum of the frequency of the two elements appearing is used as the weight of the connecting edge.

[0027] Preferably, the step of using the dense vector of each node in the undirected graph to divide each node into a discriminant node includes:

[0028] The Euclidean distance between any node and the dense vectors of the remaining nodes is divided into two categories by using a binary classification method, and the node corresponding to the dense vector in the category with the largest mean Euclidean distance is used as the discrimination node of the any node.

[0029] Preferably, the pooled influence weight of each node is calculated as follows:

[0030] Construct the adjacency matrix of each undirected graph and calculate the mean length of all paths from each node to the remaining reachable nodes, denoted as K;

[0031] In the matrix after calculating the K-th power of the adjacency matrix, each element is the number of paths of length K between the corresponding nodes in its row and column;

[0032] Calculate the pooling influence weight of node i, expressed as : ; Where m is the number of discriminant nodes of node i, is the number of discriminant nodes of node p, 、 are the number of paths from node i to discriminant node a with a length of K, and from node p to discriminant node b with a length of K, is the length and width of the feature map of each channel.

[0033] Preferably, the weighting method is: Where, 、 are the weighted value and original value of the bth element on the feature map of the first channel, is the pooling influence weight of the node corresponding to the bth element The normalized result of is the weight of the first channel feature map output by the second fully connected layer in the SE attention module.

[0034] Preferably, before using the trained active detection model to obtain the detection results of the domain name to be detected, the key features output by the active detection model need to be used to train a classifier to detect the probability that the output key features are benign domain names and the probability that they are DGA domain names.

[0035] In a second aspect, another embodiment of the present application further provides a DGA domain name active detection system based on key feature extraction, comprising a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements any one of the above-described methods for actively detecting DGA domain names based on key feature extraction.

[0036] This application has at least the following beneficial effects:

[0037] This application extracts key features of domain name samples in a parallel manner. In the dilated convolution module of branch 1, a higher-grained dilation rate adjustment method is generated through the saliency attention weight to achieve dilation rate adjustment of a single element, so that the extracted convolution features are more adaptable to data features of different subdomain lengths. In the SE attention module of branch 2, the impact of the information lost during channel compression on the data information at each element is quantified through graph theory, and the channel weights generated by SE are adjusted to solve the problem of inaccurate weighting results of the channel feature map caused by information loss when compressing the channel feature map in the SE attention module. Finally, the key features are obtained by additive fusion of the extraction results of the two branches in the active detection model, which improves the ability of the active detection model to extract features of character lengths of different subdomains and reduces the possibility of loss of channel information due to channel compression reduction. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present application or the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0039] Figure 1 A flowchart of a method for actively detecting DGA domain names by extracting key features provided in one embodiment of the present application;

[0040] Figure 2 A schematic diagram of the structure of an active detection model for DGA domain names provided in one embodiment of the present application;

[0041] Figure 3 A schematic diagram of the SE attention module provided for one embodiment of the present application. DETAILED DESCRIPTION

[0042] Example 1

[0043] An embodiment of the present application provides a method for actively detecting DGA domain names by extracting key features. Figure 1 , the method comprises the following steps:

[0044] Step 1: Filter out several subdomains from the domain name data and convert them into domain name numeric sequences.

[0045] A domain name is a string of characters bound to a server's IP address, consisting of letters, numbers, and special characters. The domain name data used in this application comes from public datasets, including but not limited to the Tranco dataset and the Netlab360 dataset. The Tranco dataset is a dataset of benign domain names, while the Netlab360 dataset contains DGA domain names collected during real-world network attacks.

[0046] Here, each full domain name is split hierarchically into multiple subdomains. For example, abele.com is split into a, b, ele, and com. Next, a dynamic threshold screening mechanism based on positional encoding and Shannon entropy is used to identify the subdomains of each full domain name that are most likely to be DGA domains. Next, a character-to-number mapping is constructed. The mapping relationship is shown in Table 1. The characters include the 26 lowercase English letters, 10 numbers, and two special symbols: "." and "-." The selected subdomains are converted into corresponding array lists to obtain a computer-readable domain name numeric sequence.

[0047] Since the length of the filtered subdomains is unstable, the length of the corresponding domain name numeric sequences is not exactly the same. Here, the encoding method of filling in 0 is used to fill in the missing elements in each numeric sequence with 0 until the length reaches the rated length of the sequence. In this embodiment, the preset rated length of the sequence is 35.

[0048] As an example, the domain names with lengths of 10 and 9 are baicai.com and sdaq.info respectively, and the corresponding domain name numeric sequences with length of 15 are {2,1,9,3,1,9,28,3,15,13,0,0,0,0,0} and {19,4,1,17,28,9,14,6,15,0,0,0,0,0,0} respectively.

[0049] Table 1 Mapping relationship table

[0050]

[0051] Step 2: Build a two-branch active detection model. In branch 1, the expansion rate of the dilated convolution is dynamically adjusted. In branch 2, the SE attention module is optimized to reduce the information loss caused by the reduction of the channel dimension in the SE attention module and extract the key features of the sample data.

[0052] In this application, the active detection model structure of DGA domain name is a double-branch structure, the structure is as follows: Figure 2 As shown in the figure, the dilated convolution in branch 1 consists of a dilated convolution layer 24 and a batch normalization layer 22; branch 2 contains three processing units. Unit 1 and unit 2 have the same structure, both consisting of a convolution layer 21, a batch normalization layer 22, and an activation function 23, where the activation function uses the ReLU function. Unit 3 consists of a convolution layer 21, a batch normalization layer 22, and an SE attention module 27. represents the additive fusion operation, 25 represents the probability distribution of the maximum pooling layer output, and 26 represents the generated distributed vector.

[0053] Among them, branch 1 performs convolution operations with different receptive fields on the domain name digital sequence based on dilated convolution to adapt to the feature differences at different positions of the domain name digital sequence of the same length caused by zero-padding of subfields of different lengths; branch 2 quantifies the impact of the lost information in the channel compression process on the data information at each element through graph theory, and adjusts the channel weight generated by SE.

[0054] 201. In branch 1, the lengths of the subdomain characters in different domain name numeric sequences are converted into domain name word vectors and the dilation rate of the dilated convolution at each position in the domain name word vector is dynamically adjusted to obtain the corresponding feature map through the dilated convolution.

[0055] First, the domain name sequence is one-hot encoded to generate a binary vector, and the word embedding matrix is ​​used to convert the binary vector into a distributed vector26. The dimension of the distributed vector is , which is the corresponding domain name word vector. Among them, is the number of characters in the character set that make up the domain name, is the dimension of the preset word vector, including but not limited to 128 and 256. In this embodiment, The value is 128. This is because if characters are directly encoded, the resulting binary vector only has one significant bit, resulting in data sparsity that makes it difficult to effectively express data features. Therefore, it is necessary to convert the word embedding matrix into a word vector to obtain data information in the subdomain. Obtaining a word embedding matrix is ​​a common technique in natural language processing, so the specific process will not be detailed here.

[0056] Secondly, when using convolution kernels of different scales to perform multi-scale convolution on the domain name word vector, under the premise that the sliding step size remains unchanged, for each element on the domain name word vector, the smaller the size of the convolution kernel, the less contextual spatial information is involved in the convolution calculation, but the more accurate the expression of the local features of each element in the convolution result.

[0057] Furthermore, since the convolution matrices obtained by convolution kernels of different sizes represent domain name word vectors at different scales, and normal domain names are usually highly semantic, usually created to represent specific companies, actual products, or specific organizations, and contain words, abbreviations, or phrases with specific practical meanings; DGA domain names are usually lacking in semantics and are automatically generated by algorithms. To make them difficult to predict and track, characters and letters are usually irregular combinations with a high degree of randomness. This results in the position that can reflect key feature content in the domain name digital sequence of the selected subdomain mappings of different lengths being not fixed. When using dilated convolution for convolution operations, the convolution rate needs to be dynamically adjusted. The specific process is as follows:

[0058] First, normal domain names are typically highly semantic, often created to represent specific companies, actual products, or specific organizations, and contain words, abbreviations, or phrases with concrete, practical meanings. DGA domain names, on the other hand, lack semantics and are automatically generated by algorithms. To make them difficult to predict and track, characters and letters are often irregularly combined, exhibiting a high degree of randomness. Therefore, within the domain word vector corresponding to the domain name data, the receptive field size required to extract data features at different locations also varies. That is, salient regions in the input data typically correspond to key structures or high-frequency details in the domain name data, while low-saliency regions are more likely to correspond to common features in the domain name data, such as data features at zero-padded positions. Therefore, during dilated convolution, low-saliency regions require a larger receptive field to capture context.

[0059] Secondly, the embedding vector matrix (a matrix formed by stacking multiple domain name word vectors in sequence) composed of the domain name word vectors is input into the recurrent layer to generate a hidden state matrix. The recurrent layer includes but is not limited to Bi-LSTM, Bi-GRU, etc. The hidden state matrix is ​​used as input, and the additive attention module is used to obtain the attention weight of each position in the domain name word vector. The larger the attention weight, the more significant the position is in the entire input data and the more important the data feature is; the smaller the attention weight, the weaker the significance of the position in the entire input data and the relatively lower the importance of the data feature.

[0060] Here, the dynamic adjustment method of the expansion rate of the p-th position is:

[0061]

[0062] Where, is the expansion rate at the p-th position, 、 They are the minimum and maximum values ​​of the expansion rate preset, 、 In this embodiment, the values ​​of are 1 and 8 respectively. is the attention weight of the p-th position.

[0063] Among them, the larger the attention weight of the p-th position, the more prominent the data feature of the p-th position. In order to extract the key structure or high-frequency details of the data at the p-th position, a smaller receptive field should be used for convolution operation.

[0064] Furthermore, for each position in the domain name word vector, when the convolution kernel performs a convolution operation with the element at each position, the receptive field during convolution is adjusted according to the expansion rate of each position, and the feature map corresponding to the domain name word vector is obtained, with a dimension of The calculation of the dimension depends on the dimension of the domain name word vector, the scale of the convolution kernel, and the sliding step size. The calculation of the convolution dimension is a well-known technology in the field of deep learning, and the specific process will not be repeated here.

[0065] At this point, the above-mentioned method of generating a higher-grained expansion rate adjustment method through saliency attention weights realizes the expansion rate adjustment of a single element, making the extracted convolutional features more adaptable to data characteristics with different sub-domain lengths.

[0066] 202, perform dimension conversion on the feature map after the dilated convolution to obtain a multi-channel feature map for input of the SE attention module.

[0067] The SE attention module usually needs to transform the dimension of the convolution feature map to obtain the required multi-channel feature map U of a specific dimension, with a size of , 、 is the length and width of each channel feature map, is the number of channels after conversion. The conversion of the feature map dimension is completed by convolving the feature map after convolution with a set of filter kernels of preset size. The conversion of the feature map dimension is based on the existing technology, and the specific process is not repeated here.

[0068] 203. When the first fully connected layer in the SE attention module performs channel reduction, an undirected graph is constructed for the feature map of each channel. The dense vector of each node in the undirected graph is used to divide the discriminant node of each node, and the pooling influence weight of each node is determined by combining the number of paths with average path length between nodes in the undirected graph.

[0069] In the SE attention module, the first fully connected layer uses r (channel scaling parameter) to reduce the input feature channels and compress the feature map directly into a feature vector. Each element in the feature vector is a value into which the channel feature of the feature map is compressed. The specific compression method is: the mean of all elements in each feature map is used as the compressed value through average pooling.

[0070] In this channel-reducing feature compression process, the feature information in the domain data expressed by elements at different positions on the feature map is lost. This application considers using graph theory to quantify the impact of the local information of each element in the feature map for the lost information entering the first fully connected layer. The quantization result is combined with the feature vector to act on the feature map of each channel to obtain the final output of the SE attention module. The specific process includes the following:

[0071] First, an undirected graph of each channel in a multi-channel feature map of a specific dimension is constructed on the channel dimension. When channel compression is performed through global average pooling, the size of elements at different positions reflects the different feature information of the domain data. Here, the feature map in each channel is Each element is treated as a node, and the association between different nodes is inferred using undirected graph technology. This is because global average pooling compresses the elements of the entire feature map into a real number, and the loss of channel information has a greater impact on the local information of the element.

[0072] Secondly, each element in the feature graph of each channel is regarded as a node in the undirected graph. Whether the two nodes in the undirected graph are connected is determined according to whether the two elements in the feature graph are adjacent elements. If the two elements are adjacent elements, the nodes corresponding to the two elements are connected, and the ratio of the frequency of the two elements appearing as adjacent nodes to the sum of the frequency of the two elements appearing is used as the weight of the connected edge to obtain the undirected graph corresponding to the feature graph of each channel.

[0073] Subsequently, the constructed undirected graph is used as input, and the Node2Vec algorithm is used to output the dense vector of each node. In this embodiment, the number of steps of each random walk in the algorithm is set to 30, the number of random walks for each node is set to 200, the embedding dimension is set to 64, and the return parameter p and in and out q are set to 0.5 and 2 respectively. The Node2Vec method is a commonly used technology in the field of undirected graphs, and the specific process will not be repeated here.

[0074] The dense vector of each node represents the local information at that node. Because the global average pooling of the first fully connected layer compresses the elements of the entire feature map into a single real number, the loss of channel information is more of a representation of local information. The node's dense vector is used to assess the impact of channel compression on each node, and the lost information is reconstructed through interpolation.

[0075] Specifically, the Euclidean distance between the dense vectors of node i and the remaining nodes is divided into two categories using a binary classification method, and the node corresponding to the dense vector in the category with the largest mean value of the Euclidean distance is used as the discriminant node of node i. If the information propagation between nodes with large differences in local structural features is easier, the data features of the element corresponding to node i are more similar to the data features expressed by the entire feature graph. The binary classification can be achieved by dividing all the Euclidean distances into two categories using a clustering algorithm, and the clustering algorithm includes but is not limited to k-means clustering, DBSCAN clustering, etc. In other embodiments, statistical classification can also be used, for example, the mean value of all the Euclidean distances is used as the binary classification threshold to achieve binary classification.

[0076] Next, construct the adjacency matrix for each undirected graph and calculate the mean path length of all paths from each node to all other reachable nodes, denoted as K. Calculate the Kth power of the adjacency matrix, taking the element in the i-th row and j-th column of the Kth power of the adjacency matrix as an example. This element represents the number of paths of length K from node i to node j.

[0077] The fewer paths between node i and node j, the more difficult it is for data information to propagate between them. Conversely, the more paths there are, the easier it is for information to propagate between them. Furthermore, the more nodes node i can propagate information with via shorter paths, the greater the impact of node i's data on the rest of the nodes, and the greater the impact of global average pooling on the domain information expressed by the element corresponding to node i.

[0078] Here, the pooling influence weight of node i is calculated and expressed as :

[0079]

[0080] Where m is the number of discriminant nodes of node i, is the number of discriminant nodes of node p, 、 are the number of paths from node i to discriminant node a with a length of K, and from node p to discriminant node b with a length of K, is the length and width of the feature map of each channel.

[0081] 204, according to the weight of each feature map output by the second fully connected layer in the SE attention module, the pooling influence weight of the node corresponding to each element in the corresponding feature map is weighted to obtain the final output of the SE attention module.

[0082] First, the multi-channel feature map U converted in step 202 is used as the input of the SE attention module, and first undergoes global average pooling to convert Compressed into Then, using two fully connected layers, the first fully connected layer The channels are compressed into channels to reduce the amount of calculation, and then pass through a RELU nonlinear activation layer, and the second fully connected layer restores the number of channels to channels, and then activate the weight vector through Sigmoid ,in, 、 、 They are the first, second, and third outputs of the second fully connected layer in the SE attention module. The weight of the channel feature map, r is the compression ratio, which is 16 in this embodiment. The SE attention module is a commonly used technology in the field of deep learning, and the specific process will not be repeated here.

[0083] Secondly, for the feature map of each channel, taking the feature map F1 of the first channel as an example, the pooling influence weight of the node corresponding to each element in the feature map F1 is calculated according to step 203, and the weight of the feature map F1 is combined The pooling influence weight of each element is weighted to obtain the weighted result of the feature map F1. The weighted results of the channel feature maps are arranged in channel order to obtain the final output X of the SE attention module.

[0084] In this application, the schematic diagram of the SE attention module is as follows Figure 3 As shown, in Figure 3 In the middle, 31 means Figure 2The output of unit 2 in branch 2, 32 represents the multi-channel feature map U, 33 represents the feature vector compressed by the first fully connected layer, 34 represents the obtained weight vector S, 35 represents the undirected graph constructed by the single-channel feature map, 36 represents the adjacency matrix of the undirected graph, and 37 represents the final output X of the SE attention module. Indicates weighted calculation.

[0085] Here, the weighted result of the bth element on the feature map F1 is calculated:

[0086]

[0087] Where, 、 are the weighted value and original value of the bth element on the feature map of the first channel, is the pooling influence weight of the node corresponding to the bth element The normalized result of is the weight of the first channel feature map output by the second fully connected layer in the SE attention module. The normalization is based on the pooled influence weights of the nodes corresponding to all elements on the feature map F1.

[0088] Among them, the greater the pooling influence weight of the node corresponding to the b-th element on the feature map F1, the more local information of the b-th element is lost in the global average pooling process. In order to reduce the impact of information loss caused by channel compression, the weighted weight should be amplified during weighted reconstruction; the less local information of the b-th element is lost in the global average pooling process, the smaller the weighted weight should be used during weighted reconstruction to ensure the accuracy of the weighted result corresponding to the feature map F1.

[0089] Step 3: The feature map of each channel in the final output of the SE attention module is added and fused with the feature map of the same channel extracted by the dilated convolution to obtain the fused feature map, and sent to the maximum pooling layer to extract key features to train the active detection model; the trained active detection model is used to obtain the detection results of the domain name to be detected.

[0090] First, the feature map of each channel in the final output X of the SE attention module is additively fused with the feature map of the same channel extracted by the dilated convolution to obtain the fused feature map. The fused feature map is then fed into the maximum pooling layer to output the probability distribution. The maximum pooling operation compresses the dimension of the vector after the addition feature fusion and screens and outputs the most discriminative key features by extracting the maximum value response of the feature.

[0091] Furthermore, the active detection model is trained using benign domain names in the benign domain name set and DGA domain names. The ratio of the training set to the test set is divided in the range of 7:3-9:1. Preferably, in this embodiment, the ratio of the training set to the test set is divided into 8:2. The samples of the training set are subjected to the above process to extract key features, and the classifier is trained based on the key features. The optimizer is the Adam (Adaptive Moment Estimation) optimizer, and the loss function is the cross-entropy loss function. The training of the neural network is a well-known technology, and the specific process is not repeated here.

[0092] Afterwards, for the domain name to be detected, it is digitally mapped and encoded to obtain the input of the trained active detection model, and the detection result of the domain name to be detected is output. The detection result includes the probability of benign domain name and the probability of DGA domain name.

[0093] Example 2

[0094] Another embodiment of the present application further provides a system for actively detecting DGA domain names by extracting key features, comprising a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements any of the above-described methods for actively detecting DGA domain names by extracting key features.

[0095] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of the present application and include common knowledge or customary techniques in the art not invented herein.

[0096] It will be understood that the present application is not limited to the exact construction that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof.

Claims

1. A method for actively detecting DGA domain names by extracting key features, characterized in that: The method comprises the following steps: Filter out several subdomains from the domain name data and convert them into domain name numeric sequences; Build a dual-branch active detection model; In branch 1, the lengths of the subdomain characters in different domain name numeric sequences are converted into domain name word vectors, and the dilation rate of the dilated convolution at each position in the domain name word vector is dynamically adjusted to obtain the corresponding feature map through dilated convolution. In branch 2, the feature map after the dilated convolution is dimensionally transformed to obtain a multi-channel feature map for the input of the SE attention module; when the first fully connected layer in the SE attention module performs channel reduction, an undirected graph is constructed for the feature map of each channel, and the dense vector of each node in the undirected graph is used to divide the discriminant node of each node, and the pooling influence weight of each node is determined by combining the number of paths with average path length between nodes in the undirected graph; according to the weight of each feature map output by the second fully connected layer in the SE attention module, the pooling influence weight of the node corresponding to each element in the corresponding feature map is weighted to obtain the final output of the SE attention module; The feature maps of the same channel extracted by the dilated convolution of the feature map of each channel in the final output of the SE attention module are added and fused to obtain the fused feature map, which is then sent to the maximum pooling layer to extract key features to train the active detection model; the trained active detection model is used to obtain the detection results of the domain name to be detected.

2. The method for actively detecting DGA domain names by extracting key features according to claim 1, wherein: The step of selecting a plurality of subdomains from the domain name data and converting them into a domain name digital sequence comprises: Split each full domain name into multiple subdomains according to the hierarchy; A dynamic threshold screening mechanism based on Shannon entropy of positional encoding is used to screen out the subdomain part of each full domain name that is most likely to be a DGA domain name; Build a character-to-digit mapping, convert the filtered subdomains into corresponding array lists, and obtain a computer-readable domain name numeric sequence; Use the encoding 0-filling method to fill the missing elements in each digital sequence with 0 until the length reaches the preset sequence rated length.

3. The method for actively detecting DGA domain names by extracting key features according to claim 2, wherein: The step of dynamically adjusting the expansion rate of the dilated convolution at each position in the domain name word vector includes: Perform one-hot encoding on the domain name numeric sequence to generate a binary vector, and then use the word embedding matrix to convert the binary vector into a distributed vector as the domain name word vector; Input the embedding vector matrix composed of multiple domain name word vectors into the recurrent layer to generate a hidden state matrix; Taking the hidden state matrix as input, we use the additive attention module to obtain the attention weights for each position in the domain word vector. The expansion rate of each position is dynamically adjusted according to the attention weight of the position.

4. The method for actively detecting DGA domain names by extracting key features according to claim 3, wherein: The dynamic adjustment method of the expansion rate is: Where, is the expansion rate at the p-th position, 、 They are the minimum and maximum values ​​of the expansion rate preset, is the attention weight of the p-th position.

5. The method for actively detecting DGA domain names by extracting key features according to claim 1, wherein: The method of constructing an undirected graph for each channel includes: Each element in the feature map of each channel is regarded as a node in the undirected graph. Whether the two nodes in the undirected graph are connected is determined based on whether the two elements in the feature map are adjacent elements, and the ratio of the frequency of the two elements appearing as adjacent nodes to the sum of the frequency of the two elements appearing is used as the weight of the connecting edge.

6. The method for actively detecting DGA domain names by extracting key features according to claim 1, wherein: The step of using the dense vector of each node in the undirected graph to divide each node into a discriminant node includes: The Euclidean distance between any node and the dense vectors of the remaining nodes is divided into two categories by using a binary classification method, and the node corresponding to the dense vector in the category with the largest mean Euclidean distance is used as the discrimination node of the any node.

7. The method for actively detecting DGA domain names by extracting key features according to claim 6, wherein: The calculation method of the pooling influence weight of each node is: Construct the adjacency matrix of each undirected graph and calculate the mean length of all paths from each node to the remaining reachable nodes, denoted as K; In the matrix after calculating the K-th power of the adjacency matrix, each element is the number of paths of length K between the corresponding nodes in its row and column; Calculate the pooling influence weight of node i, expressed as : ; Where m is the number of discriminant nodes of node i, is the number of discriminant nodes of node p, 、 are the number of paths from node i to discriminant node a with a length of K, and from node p to discriminant node b with a length of K, is the length and width of the feature map of each channel.

8. The method for actively detecting DGA domain names by extracting key features according to claim 7, wherein: The weighting method is: Where, 、 are the weighted value and original value of the bth element on the feature map of the first channel, is the pooling influence weight of the node corresponding to the bth element The normalized result of is the weight of the first channel feature map output by the second fully connected layer in the SE attention module.

9. The method for actively detecting DGA domain names by extracting key features according to claim 1, wherein: Before using the trained active detection model to obtain the detection results of the domain name to be detected, the key features output by the active detection model need to be used to train a classifier to detect the probability that the output key features are benign domain names and the probability of DGA domain names.

10. A DGA domain name active detection system based on key feature extraction, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the method for actively detecting DGA domain names by extracting key features according to any one of claims 1 to 9 is implemented.

Images