Training method and device of generative adversarial network and storage medium

Abstract

The embodiment of the invention provides a training method and device of a generative adversarial network and a storage medium, the generative adversarial network comprises a generator and a discriminator, and the method comprises the following steps: executing the following training operations on the generative adversarial network to be trained for multiple rounds until a set training termination condition is met: inputting random noise data into the generator, obtaining a first simulation domain name set output by the generator; based on a first loss function corresponding to the discriminator, performing parameter adjustment on the discriminator by using a first simulation domain name in the first simulation domain name set and a real domain name in the real domain name set to obtain a parameter-adjusted discriminator; based on a second loss function corresponding to the generator, performing parameter adjustment on the generator by using the random noise data to obtain a parameter-adjusted generator; wherein the second loss function comprises a discrimination loss item and a diversity loss item.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of Internet technology, and more specifically, to a training method, device, and storage medium for generating adversarial networks. Background Art

[0002] With the rapid development of the internet, network security issues are becoming increasingly severe. Domain Generation Algorithms (DGAs) are widely used to create large numbers of domain names. As DGAs continue to evolve, the generated malicious domains exhibit greater randomness and deceptiveness in character selection and arrangement, rendering traditional detection methods increasingly ineffective. Consequently, it is necessary to train detection systems capable of identifying these malicious domains. However, since these malicious domains appear infrequently and change rapidly in real-world environments, it is difficult to collect sufficient samples for detection model training, impacting the accuracy and efficiency of malicious domain detection systems. Currently, generative adversarial networks are commonly used to generate malicious domain samples for training malicious domain detection systems. However, the generated domain samples often lack sufficient diversity, resulting in low sample quality.

[0003] It can be seen from this that the generative adversarial network in related technologies has the problem of low sample quality due to the lack of diversity in the generated samples. Summary of the Invention

[0004] The embodiments of the present application provide a training method, apparatus, and storage medium for a generative adversarial network to at least address the problem of low sample quality caused by a lack of diversity in generated samples in the generative adversarial network in the related art.

[0005] According to one aspect of an embodiment of the present application, a training method for a generative adversarial network is provided, wherein the generative adversarial network includes a generator and a discriminator; the method includes: performing multiple rounds of the following training operations on the generative adversarial network to be trained until a set training termination condition is met: inputting random noise data into the generator to obtain a first set of simulated domain names output by the generator; based on a first loss function corresponding to the discriminator, using the first simulated domain name in the first set of simulated domain names and the real domain name in the real domain name set to adjust the discriminator parameters to obtain the tuned discriminator; based on a second loss function corresponding to the generator, using the random noise data to adjust the generator parameters to obtain the tuned generator; wherein the second loss function includes a discrimination loss term and a diversity loss term, the discrimination loss term corresponds to a discrimination result of the tuned discriminator on the simulated domain names generated by the generator based on the random noise data, and the diversity loss term is used to evaluate the domain name diversity of the simulated domain names generated by the generator based on the random noise data.

[0006] According to another aspect of an embodiment of the present application, a training device for a generative adversarial network is also provided, wherein the generative adversarial network includes a generator and a discriminator; the device includes: an execution unit, configured to perform multiple rounds of the following training operations on the generative adversarial network to be trained until a set training termination condition is met: random noise data is input into the generator to obtain a first set of simulated domain names output by the generator; based on a first loss function corresponding to the discriminator, the first simulated domain name in the first simulated domain name set and the real domain name in the real domain name set are used to adjust the parameters of the discriminator to obtain the adjusted discriminator; based on a second loss function corresponding to the generator, the random noise data is used to adjust the parameters of the generator to obtain the adjusted generator; wherein the second loss function includes a discrimination loss term and a diversity loss term, the discrimination loss term corresponds to a discrimination result of the discriminator after the parameter adjustment on the simulated domain name generated by the generator based on the random noise data, and the diversity loss term is used to evaluate the domain name diversity of the simulated domain names generated by the generator based on the random noise data.

[0007] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when run.

[0008] According to another aspect of the embodiments of the present application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of any of the above-described method embodiments.

[0009] According to another aspect of the embodiments of the present application, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the steps of any of the above method embodiments through the computer program.

[0010] Through the present application, a training method for a generative adversarial network includes: performing multiple rounds of the following training operations on the generative adversarial network to be trained until the set training termination condition is met: inputting random noise data into the generator to obtain a first simulated domain name set output by the generator; based on the first loss function corresponding to the discriminator, using the first simulated domain name in the first simulated domain name set and the real domain name in the real domain name set to adjust the discriminator parameters, thereby obtaining the discriminator after parameter adjustment, thereby improving the accuracy and reliability of the discriminator; based on the second loss function corresponding to the generator, using random noise data to adjust the generator parameters, thereby obtaining the generator after parameter adjustment; wherein, the first The second loss function includes a discriminant loss term and a diversity loss term. The discriminant loss term corresponds to the discrimination result of the discriminator after parameter adjustment on the simulated domain names generated by the generator based on random noise data. The diversity loss term is used to evaluate the domain name diversity of the simulated domain names generated by the generator based on random noise data. Among them, the discriminant loss term can encourage the generator to generate simulated domain names that can deceive the discriminator, and the diversity loss term can encourage the generator to improve the diversity of the simulated domain names it generates. Therefore, it can solve the problem of low sample quality caused by the lack of diversity of generated samples in the generative adversarial network in related technologies, and achieve the effect of optimizing the data quality generated by the generative adversarial network. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 This is a schematic diagram of an application scenario of a training method for a generative adversarial network according to an embodiment of the present application.

[0012] Figure 2 This is a flowchart of an optional training method for a generative adversarial network according to an embodiment of the present application.

[0013] Figure 3 This is a schematic diagram of an optional training method for a generative adversarial network according to an embodiment of the present application.

[0014] Figure 4 This is a schematic diagram of another optional training method for a generative adversarial network according to an embodiment of the present application.

[0015] Figure 5 This is a schematic diagram of another optional training method for a generative adversarial network according to an embodiment of the present application.

[0016] Figure 6 This is a structural block diagram of an optional training device for a generative adversarial network according to an embodiment of the present application.

[0017] Figure 7 This is a block diagram of a computer system structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0018] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0019] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0020] According to one aspect of the embodiment of the present application, a training method for generating an adversarial network is provided. Optionally, in this embodiment, the training method for generating an adversarial network can be applied to, but is not limited to, Figure 1 The hardware environment shown includes a terminal device 102 and a server 104. The server 104 can be connected to the terminal device 102 via a network and can be used to provide services (e.g., application services, etc.) for the terminal device 102 or a client installed on the terminal device 102. A database can be set on the server 104 or independently of the server 104 to provide data storage services for the server 104.

[0021] The aforementioned network may include, but is not limited to, at least one of the following: a wired network and a wireless network. The aforementioned wired network may include, but is not limited to, at least one of the following: a wide area network, a metropolitan area network, or a local area network. The aforementioned wireless network may include, but is not limited to, at least one of the following: Wi-Fi (Wireless Fidelity) and Bluetooth. The terminal device 102 may be, but is not limited to, a personal computer (PC), a mobile phone, a tablet computer, etc. The server 104 may be, but is not limited to, a cloud server, a server cluster, or other server types.

[0022] The training method for a generative adversarial network according to the embodiment of the present application may be executed by the server 104, or by the terminal device 102, or jointly by the server 104 and the terminal device 102. The training method for a generative adversarial network according to the embodiment of the present application may be executed by the terminal device 102 or by a client installed thereon.

[0023] Taking the server 104 as an example to execute the training method of the generative adversarial network in this embodiment, Figure 2 is a flow chart of an optional training method for a generative adversarial network according to an embodiment of the present application, such as Figure 2 As shown, the process of the method may include the following steps:

[0024] Step S202: Perform multiple rounds of the following training operations on the generative adversarial network to be trained until the set training termination condition is met:

[0025] Step S2021: inputting random noise data into a generator to obtain a first simulated domain name set output by the generator;

[0026] Step S2022: Based on the first loss function corresponding to the discriminator, the first simulated domain name in the first simulated domain name set and the real domain name in the real domain name set are used to adjust the parameters of the discriminator to obtain a discriminator after parameter adjustment;

[0027] Step S2023: Based on the second loss function corresponding to the generator, the generator is adjusted using random noise data to obtain the adjusted generator; wherein the second loss function includes a discrimination loss term and a diversity loss term, the discrimination loss term corresponds to the discrimination result of the discriminator after the parameter adjustment on the simulated domain name generated by the generator based on the random noise data, and the diversity loss term is used to evaluate the domain name diversity of the simulated domain name generated by the generator based on the random noise data.

[0028] The training method for a generative adversarial network in this embodiment can be applied to the field of Internet technology, and to scenarios where a generative adversarial network is used to generate malicious domain name samples. A generative adversarial network (GAN) is a deep learning model that generally includes two neural networks, a generator and a discriminator. The quality of generated data is improved by having these two neural networks compete with each other. The generator is used to generate data that is as realistic as possible. It can receive random noise as input data and attempt to generate new data similar to the real data by learning the distribution of real data. The discriminator is used to distinguish between real data and new data generated by the generator. It can receive real data and data generated by the generator as input and output a judgment result, that is, the probability of the input data being real data, which can be a probability value.

[0029] During the training process of the generative adversarial network, the generator and the discriminator can compete with each other and continuously optimize. The generator strives to generate more realistic data to deceive the discriminator, while the discriminator strives to improve its recognition ability and correctly distinguish between real data and fake data. Through this competition, the generator can gradually learn to generate samples that are closer to the real data distribution, thereby improving the quality of samples generated by the generative adversarial network.

[0030] Generative adversarial networks (GANs) have been widely used for data generation and have achieved some success in the security field. Specifically, research has attempted to apply GANs to generate malicious domain names (DGAs). Here, malicious domains are domains used to threaten network security, circumventing traditional domain name detection mechanisms and being used to conduct activities that threaten network security. With the continuous evolution of DGA algorithms, the generated malicious domains have shown increased randomness and deceptiveness in character selection and arrangement, rendering traditional detection methods increasingly ineffective. Furthermore, since these malicious domains occur less frequently and change rapidly in real-world environments, it is difficult to collect sufficient samples for detection model training, which affects the accuracy and efficiency of malicious domain name detection systems. Therefore, a large number of reliable domain name samples are required to train domain name detection models.

[0031] However, when using generative adversarial networks to generate malicious domain name samples, the traditional GAN model does not fully consider the diversity of domain names when generating domain names, resulting in the generated domain names being prone to mode collapse in specific modes.

[0032] It should be noted that mode collapse refers to the situation where the generator only generates a limited number of examples during training and is unable to capture all patterns or distributions in the dataset. When generating highly diverse samples, the generator may converge to a local optimal state, that is, the generator may capture some significant features or patterns from the training data, and then over-rely on these features during the generation process, failing to explore and cover a wider range of domain name styles, ultimately resulting in a lack of generated sample types and reduced diversity. A specific pattern refers to the tendency of the generator to repeatedly generate a certain type or several similar domain name formats or structures in the process of learning and imitating real malicious domain names. For example, a simple specific pattern may be that the generator tends to generate a large number of domain names containing specific letter combinations (such as "zzz", "rrr") or a specific length.

[0033] It can be seen that the generative adversarial network in related technologies has the problem of low sample quality due to the lack of diversity in the generated samples.

[0034] In order to at least partially solve the above technical problems, a training method for a generative adversarial network is proposed in this embodiment, including: performing multiple rounds of the following training operations on the generative adversarial network to be trained until the set training termination condition is met: inputting random noise data into the generator to obtain a first simulated domain name set output by the generator; based on the first loss function corresponding to the discriminator, using the first simulated domain name in the first simulated domain name set and the real domain name in the real domain name set to adjust the discriminator parameters to obtain the discriminator after parameter adjustment, thereby improving the accuracy and reliability of the discriminator; based on the second loss function corresponding to the generator, using random noise data to adjust the generator parameters to obtain the adjusted discriminator parameters. Generator; wherein, the second loss function includes a discriminant loss term and a diversity loss term, the discriminant loss term corresponds to the discrimination result of the discriminator after parameter adjustment on the simulated domain name generated by the generator based on random noise data, and the diversity loss term is used to evaluate the domain name diversity of the simulated domain name generated by the generator based on random noise data, wherein the discriminant loss term can encourage the generator to generate simulated domain names that can deceive the discriminator, and the diversity loss term can encourage the generator to improve the diversity of the simulated domain names it generates, thereby solving the problem of low sample quality caused by the lack of diversity of generated samples in the generative adversarial network in the related technology, and achieving the effect of optimizing the data quality generated by the generative adversarial network.

[0035] Optionally, the training termination condition can be pre-set, which can be to set an upper limit for the number of training rounds of the generative adversarial network to be trained, and automatically stop training when this upper limit is reached, or it can be to pre-set a second loss function threshold. When the second loss function corresponding to the generator is lower than the second loss function threshold, it can be considered that the model has converged and training is stopped. This is not limited in this embodiment.

[0036] Optionally, random noise data may be input into the generator to obtain a first simulated domain name set output by the generator.

[0037] Optionally, the random noise data may be a set of random vectors from a Gaussian distribution or a uniform distribution. The method for obtaining the random noise data and the dimension of the random noise data may be pre-set or adjusted as needed, which is not limited in this embodiment.

[0038] In this embodiment, the generator can be used to generate samples (i.e., simulated domain names) that imitate real malicious domain names through a series of transformations after receiving random noise data. Correspondingly, by adjusting the training process and parameters of the generator, the characteristics of the first simulated domain name set can be optimized to make it closer to the real malicious domain name set.

[0039] Optionally, the first simulated domain name in the first simulated domain name set and the real domain name in the real domain name set can be used to adjust the parameters of the discriminator. That is, the above-mentioned first simulated domain name and the above-mentioned first domain name can be discriminated based on the discriminator, and the discriminator parameters can be adjusted based on the discrimination results to make the discrimination results of the discriminator more accurate. Here, in order to convert the collected real domain names into a format that the discriminator can understand and process, they can be converted into vector form. For example, one-hot encoding (i.e., unique hot encoding) and decoding are used to achieve the mutual conversion of domain name samples to domain name vectors. Here, one-hot encoding is a data preprocessing technology mainly used to convert categorical variables into digital form for model processing. In this solution, for a specific malicious domain name, the encoder can convert each character in turn into the corresponding one-hot encoding vector, and then splice these vectors in character order to form a complete digital vector. In this way, the original domain name is converted into a long vector, which is convenient for input into the model for calculation and learning.

[0040] Similarly, after the model generates a vector corresponding to a malicious domain name, the decoder can perform the inverse process, reinterpreting the vector into a series of characters to form a new domain name.

[0041] Optionally, the first loss function may include the discriminator's score for the above-mentioned real samples and the score for the above-mentioned simulated samples, so that the discriminator can be adjusted according to the feedback of the first loss function (for example, adjusting the discriminator's weights, parameters, learning rate, etc.), so that the discriminator can effectively distinguish between real domain names and simulated domain names generated by the generator, and enhance its understanding of the characteristics of malicious domain names.

[0042] In this embodiment, as the performance of the discriminator is optimized, the generator can also adjust its generation strategy accordingly so that the generated simulated domain names can deceive the discriminator, that is, the generated simulated domain names are increasingly close to the characteristics of real malicious domain names, thereby improving the quality and diversity of the generated data.

[0043] Optionally, based on the second loss function corresponding to the generator, the generator can be tuned using random noise data to obtain a tuned generator, that is, the generator can adjust its parameters based on the discrimination results of the discriminator on the samples it generates, in order to generate more realistic samples in the future; wherein, the second loss function includes a discrimination loss term and a diversity loss term, the discrimination loss term corresponds to the discrimination result of the tuned discriminator on the simulated domain name generated by the generator based on the random noise data, and the diversity loss term is used to evaluate the domain name diversity of the simulated domain name generated by the generator based on the random noise data.

[0044] In this embodiment, in addition to adjusting the parameters of the generator based on the discrimination results of the simulated domain names generated by the generator by the adjusted discriminator, so that the generator adjusts its generation strategy, in order to prevent the above-mentioned generated domain names from experiencing mode collapse under specific modes, the generator can also be adjusted in combination with the diversity loss term to ensure the diversity of the samples it generates.

[0045] Optionally, the diversity loss term can be used to calculate the similarity between malicious domain name samples (i.e., simulated domain names) generated by the generator, penalizing the generator for producing overly similar outputs, thereby improving the coverage of the generated samples and making the generated malicious domain names closer to the diversity in the actual environment.

[0046] Optionally, the specific process of each round of training performed on the generative adversarial network to be trained can be pre-set. For example, in each round, the discriminator can be used to perform discrimination based on the simulated samples generated by the generator in combination with the real samples, and the discriminator can be adjusted according to the discrimination results. This process can be performed once or multiple times to obtain the discriminator after parameter adjustment. The simulated samples generated by the generator are discriminated based on the discriminator after parameter adjustment, and the generator can be adjusted once or multiple times based on the discrimination results of this discrimination combined with the diversity loss term to obtain the generator after parameter adjustment. The number of times the discriminator and generator are adjusted in each round can be pre-set or adjusted. In addition, the conditions for stopping the parameter adjustment can also be set, such as setting the loss function threshold of the generator or discriminator after parameter adjustment. This is not limited in this embodiment.

[0047] Through the embodiments provided by the present application, the following training operations are performed on the generative adversarial network to be trained for multiple rounds until the set training termination condition is met: random noise data is input into the generator to obtain a first set of simulated domain names output by the generator; based on the first loss function corresponding to the discriminator, the first simulated domain name in the first simulated domain name set and the real domain name in the real domain name set are used to adjust the parameters of the discriminator to obtain the discriminator after parameter adjustment; based on the second loss function corresponding to the generator, the random noise data is used to adjust the parameters of the generator to obtain the generator after parameter adjustment; wherein, the second loss function includes a discriminant loss term and a diversity loss term, the discriminant loss term corresponds to the discrimination result of the discriminator after parameter adjustment on the simulated domain name generated by the generator based on the random noise data, and the diversity loss term is used to evaluate the domain name diversity of the simulated domain name generated by the generator based on the random noise data, thereby solving the problem of low sample quality caused by lack of diversity of generated samples in the generative adversarial network in the related art, and improving the quality of samples generated by the generative adversarial network.

[0048] In an exemplary embodiment, based on the second loss function corresponding to the generator, random noise data is used to adjust the parameters of the generator to obtain the adjusted generator, including:

[0049] Inputting random noise data into the generator to obtain a second simulated domain name set output by the generator;

[0050] Inputting each second simulated domain name in the second simulated domain name set into the discriminator after parameter adjustment, and obtaining a discrimination result of each second simulated domain name output by the discriminator after parameter adjustment;

[0051] Determining a first function value of a second loss function according to an expected value of a discrimination result of each second simulated domain name and a loss value of a diversity loss item corresponding to the second simulated domain name set;

[0052] According to the first function value, the generator is adjusted to obtain a generator after parameter adjustment, wherein the function value of the second loss function determined based on the generator after parameter adjustment is less than the first function value.

[0053] Optionally, the random noise data input into the generator to obtain the second simulated domain name set may be used random noise data or newly acquired random noise data, which is not limited in this embodiment.

[0054] Optionally, each domain name in the second set of simulated domain names generated by the generator can be input one by one into a discriminator (i.e., the discriminator after parameter adjustment) that has been previously trained using real domain names and simulated domain names in the first set of simulated domain names to obtain the discriminator's discrimination results on the batch of generated domain names. Thus, the quality and characteristics of each simulated domain name in the second set of simulated domain names can be independently analyzed, and the generator can be adjusted accordingly. Here, the parameter adjustment of the generator can depend on the output of the discriminator, that is, the discriminator's discrimination results on the generated samples. The discrimination results reflect the discriminator's judgment on the samples generated by the generator. The goal of the generator can be to make the value of the discrimination result as high as possible through parameter adjustment (that is, the samples generated by the generator can more effectively deceive the discriminator) to imitate real data.

[0055] Optionally, the expected value of the discrimination result of each second simulated domain name can be calculated, which can be used to evaluate the average probability that the domain name generated by the generator is judged to be a real domain name. Correspondingly, a higher expected value means that the generator has a stronger ability to output results that can confuse the discriminator.

[0056] Optionally, a diversity loss term of the second simulated domain name set can be calculated to evaluate the diversity of the generated second simulated domain name set in terms of character combination, arrangement, and structure. The smaller the diversity loss term, the more diverse the generated domain names are. Adjusting the parameters of the generator based on the diversity loss term can prevent the generator from falling into mode collapse, that is, excessive repetition of certain domain name styles.

[0057] In this embodiment, the first function value of the second loss function can be determined based on the expected value of the discrimination result of each second simulated domain name and the loss value of the diversity loss item corresponding to the second simulated domain name set, which comprehensively reflects the current performance of the generator.

[0058] Optionally, the back-propagation algorithm can be used to optimize and adjust the parameters of the generator based on the first function value (i.e., the second loss function value of the generator in the current state), thereby reducing the overall loss of the generator. Correspondingly, the function value of the second loss function determined by the generator after parameter adjustment can be lower than the value before parameter adjustment.

[0059] Through this embodiment, the generator generates a new simulated domain name, which is evaluated by the discriminator after optimization and parameter adjustment. The generator parameters are adjusted according to the evaluation results and the diversity loss value, which can optimize the performance of the generator and improve the diversity and quality of the domain name samples generated by the generator.

[0060] In an exemplary embodiment, the second simulated domain name set is represented by a domain name set matrix of K×M×N dimensions, where K is the number of second simulated domain names in the second simulated domain name set, M is the number of characters contained in each second simulated domain name, and N is the length of a character vector of a character in each second simulated domain name, and K, M, and N are all positive integers greater than or equal to 2.

[0061] Based on the second loss function corresponding to the generator, the generator is tuned using random noise data to obtain a tuned generator, which also includes:

[0062] Flatten the M×N dimensional domain name matrix corresponding to each second simulated domain name in the domain name set matrix to obtain a K×(M*N) dimensional flattened matrix;

[0063] Perform inner product calculation on the flattened matrix and the transpose of the flattened matrix to obtain the first inner product matrix of K×K dimensions;

[0064] Calculate the L2 norm of each row in the first inner product matrix respectively, and perform inner product calculation on the obtained K×1-dimensional first column vector and the transpose of the first column vector to obtain a K×K-dimensional second inner product matrix;

[0065] The second inner product matrix is normalized, and the average value of all elements in the normalized second inner product matrix is determined as the loss value of the diversity loss item corresponding to the second simulated domain name set.

[0066] When the generator finds a specific way to deceive the discriminator, pattern repetition may occur, that is, the generated single domain names are extremely similar (for example, 777eeeerrrrr.com). To this end, a diversity loss term can be added to the generator's second loss function L to avoid pattern repetition. The diversity loss term is used to measure the similarity between samples.

[0067] In this embodiment, the second simulated domain name set can be represented by a K×M×N-dimensional domain name set matrix, where K (length dimension) can be used to represent the total number of simulated domain names in the second simulated domain name set, which can reflect the number of domain name samples generated by the generator at one time. K is a positive integer greater than or equal to 2, that is, the generator generates multiple simulated domain names at a time; M (width dimension) can be used to represent the number of characters in each second simulated domain name, that is, the length of the domain name. For example, a domain name such as "example.com" can include 10 characters, and each domain name includes multiple characters; N (depth dimension) can be used to represent the vector representation length of each character, that is, each character is encoded as an N-dimensional real number vector.

[0068] Optionally, the character vector can be obtained by using a pre-set encoder, for example, one-hot encoding can be used.

[0069] Optionally, the domain name matrix of M×N dimensions corresponding to each second simulated domain name in the domain name set matrix can be denoted as G, and it can be flattened to obtain a flattened matrix of K×(M*N) dimensions, which is denoted as matrix Here, flattening means converting each sample (originally an M*N two-dimensional matrix) into a one-dimensional vector of length M*N, so that the feature representation of each sample can be converted into a form that is convenient for similarity calculation, which is convenient for subsequent calculations.

[0070] Optionally, the inner product calculation can be performed on the flattened matrix and the transpose of the flattened matrix to obtain a first inner product matrix of K×K dimensions, for example, Figure 3 As shown, here, the result of the inner product calculation can be used to reflect the similarity of each pair of domain names in the character vector space. Each value in the first inner product matrix can represent the inner product value between the corresponding two domain names. The larger the value, the higher the similarity between the two domain names. For example, Denoted as matrix The transpose of , as shown in formula (1), and The matrix B obtained by the inner product calculation has a dimension of (l, l), so the value of B[i][j] can represent the similarity between the i-th sample and the j-th sample.

[0071] (1)

[0072] Furthermore, if Figure 3 As shown, the L2 norm of each row in the first inner product matrix can be calculated separately, and the inner product of the obtained K×1-dimensional first column vector and the transpose of the first column vector can be calculated to obtain a K×K-dimensional second inner product matrix. Here, the L2 norm (Euclidean norm) is a measure of the length of the row vector, which can reflect the overall similarity between the domain name and all other domain names. By performing the inner product on the L2 norm vector again, the sum of the squared distances between each domain name and the other domain name vectors can be calculated, and then the average similarity of all samples can be calculated to reflect the similarity distribution within the entire domain name set.

[0073] For example, as shown in formula (2), the matrix can be calculated norm, where D is the column dimension of matrix B, i represents the row, j represents the column, and the calculated dimension is (l, 1):

[0074] (2)

[0075] Optionally, n and Perform inner product calculation to obtain the second inner product matrix, the dimension after calculation is (l, l), and perform normalized Gram processing on the second inner product matrix, which is recorded as matrix , so that the value of the second inner product matrix can be adjusted to a fixed range, avoiding the influence of its numerical size on the loss function, making it more focused on evaluating the relative similarity of samples rather than the absolute numerical size, for example, as shown in formula (3):

[0076] (3)

[0077] Optionally, you can The sum of all elements in is averaged, and the calculated mean is used as the loss value of the diversity loss item corresponding to the second simulated domain name set. , as shown in formula (4):

[0078] (4)

[0079] Optionally, the loss value of the diversity loss item can reflect the similarity level of the entire domain name set. If the value is high, it means that the differences between domain names are small. The middle element will be larger, resulting in An increase in the value corresponds to insufficient diversity, whereas a decrease in the value indicates better diversity.

[0080] Optionally, the generator parameters can be tuned to reduce the loss value of the diversity loss term.

[0081] Through this embodiment, by calculating the loss value of the diversity loss item of the second simulated domain name set, a parameter adjustment direction can be provided for the parameter adjustment of the generator, thereby improving the diversity of the domain names generated by the generator.

[0082] In an exemplary embodiment, the domain name string of each second simulated domain name is normalized to a domain name string of a specified length using a filler, and the second loss function further includes a character loss term for evaluating the frequency of occurrence of characters in the simulated domain name generated by the generator based on the random noise data;

[0083] Based on the second loss function corresponding to the generator, the generator is tuned using random noise data to obtain a tuned generator, which also includes:

[0084] The following processing operations are performed on each second simulated domain name as the current second simulated domain name to obtain a loss value of a character loss item corresponding to each second simulated domain name, where the domain name string of the current second simulated domain name is the current domain name string: when the character that appears most frequently in the current domain name string is a filler character, the loss value of the character loss item corresponding to the current second simulated domain name is determined to be 0; when the character that appears most frequently in the current domain name string is not a filler character, the loss value of the character loss item corresponding to the current second simulated domain name is determined to be the quotient of the number of occurrences of the character that appears most frequently in the current domain name string and the total number of characters in the current domain name string;

[0085] An average of the loss values of the character loss items corresponding to each second simulated domain name is determined as the loss value of the character loss items corresponding to the second simulated domain name set.

[0086] In this embodiment, if the generated domain name relies too much on certain characters, the domain name features will be single, and the detection model will easily ignore these features. In addition to the discrimination loss term and the diversity loss term, the second loss function can also include a character loss term for evaluating the frequency of occurrence of characters in the simulated domain name generated by the generator based on random noise data. Therefore, by adjusting the generator parameters based on the character loss term and penalizing high-frequency non-filler characters, the generator can be encouraged to use all characters more evenly during generation, avoiding mode collapse.

[0087] The simulated domain names generated by the generator may have different lengths. To facilitate processing and comparison, a filler character (such as '_') can be used to normalize all domain name strings to the same length. The length of the normalized domain name string can be a preset fixed value.

[0088] Optionally, for each second simulated domain name, the frequency of occurrence of each character therein may be calculated, which may be determined by counting the number of times each character appears in the domain name string and dividing the number by the total length of the string.

[0089] It should be noted that for the generator, the random noise data it inputs can be in the form of a vector, and the simulated domain name it outputs can also be in the form of a vector. When calculating the character loss term, the simulated domain name generated by the generator can be decoded to obtain a string. For example, the domain name generated by the generator can be decoded by one-hot decoding to obtain a domain name string, which is expressed as ,in Represents the i-th character, the number of characters is n.

[0090] Optionally, for each domain name string of the current second simulated domain name, the character with the highest frequency of occurrence can be found. For example, as shown in formulas (5) and (6), the character frequency can be calculated for each s∈S, c(s) is the frequency of occurrence of a certain character, and the maximum frequency among all character frequencies is calculated. char_count is the number of times the most frequently occurring character appears in the string S, which is recorded as :

[0091] (5)

[0092] (6)

[0093] Optionally, the loss value of the character loss term can be calculated, for example, Figure 4 As shown, when the character that appears most frequently in the current domain name string is a filler, it can be determined that the loss value of the character loss item corresponding to the current second simulated domain name is 0; when the character that appears most frequently in the current domain name string is not a filler, it can be determined that the loss value of the character loss item corresponding to the current second simulated domain name is the quotient of the number of occurrences of the character that appears most frequently in the current domain name string and the total number of characters in the current domain name string, that is, it can be the frequency of the most frequently appearing character in the current domain name string.

[0094] For example, as shown in formula (7), the character-based loss part can be calculated :

[0095] (7)

[0096] Optionally, an average value of the loss values of the character loss items corresponding to each second simulated domain name may be determined as the loss value of the character loss items corresponding to the second simulated domain name set.

[0097] In this embodiment, the second loss function L gen Finally, it can be shown as formula (8), where, The setting can be random noise that follows a normal distribution, D represents the discriminator, G represents the generator, and -Mean(D(G(x))) can represent the discriminator's judgment result on the simulated domain name generated by the generator:

[0098] (8)

[0099] Among them, α and β can be pre-set weights, and can also be dynamically adjusted as needed.

[0100] In this embodiment, the second loss function of the generator may include multiple objectives, each of which is expressed in the form of a loss function. By minimizing the total second loss function, multiple objectives can be optimized simultaneously when adjusting the parameters of the generator, such as generating real samples, improving sample diversity, controlling the frequency of character use, etc.

[0101] Through this embodiment, by calculating the character loss item and adjusting the parameters of the generator based on the character loss item, the frequency of occurrence of characters in the simulated domain name generated by the generator can be controlled, thereby improving the diversity of simulated samples.

[0102] In an exemplary embodiment, the network structures of the generator and the discriminator each include an input layer, two hidden layers, and an output layer;

[0103] Based on the second loss function corresponding to the generator, the generator is tuned using random noise data to obtain the tuned generator, including:

[0104] Through the random deactivation mechanism, the outputs of some neurons in each hidden layer of the generator are set to zero, and the outputs of at least some neurons in each hidden layer of the generator are nonlinearly transformed through a nonlinear transformation function.

[0105] Optionally, for the generator, its input layer can be used to receive random noise data, its hidden layer can be used to learn and extract high-level features of the input data, and its output layer can be used to map the random noise data into a malicious domain name vector (i.e., a simulated domain name). Correspondingly, its output layer can include multiple neurons, each of which can correspond to a character in the simulated domain name.

[0106] Optionally, for the discriminator, its input layer can be used to receive the real domain name or the simulated domain name generated by the generator, its hidden layer can be used to learn and extract high-level features of the input data, and its output layer can be used to output the discrimination result of the simulated domain name generated by the generator. The discrimination result can be a scalar used to represent the probability that the input data is real data. Correspondingly, its output layer can include only one neuron.

[0107] Optionally, the network structures of the generator and the discriminator can be adjusted as needed, for example, by adding a hidden layer, which is not limited in this embodiment.

[0108] Optionally, the outputs of some neurons in each hidden layer of the generator can be set to zero through a random dropout mechanism. Here, the random dropout mechanism is a regularization technique. By randomly inactivating some neurons in the network during training, the model's dependence on specific training samples can be reduced, thereby improving the model's generalization ability. In each hidden layer, the outputs of some neurons are set to zero with a certain probability during each forward propagation, thereby reducing the influence of a single neuron. For example, the Dropout technique (a random dropout technique) can be used to randomly set the outputs of some neurons in the hidden layer of the neural network to zero, so that they do not participate in the forward and back propagation processes, thereby preventing overfitting of the training process.

[0109] Optionally, the outputs of at least some neurons in each hidden layer of the generator can be nonlinearly transformed by a nonlinear transformation function. For example, a rectified linear unit (ReLU) activation function can be used to convert all negative inputs to zero, while positive inputs remain unchanged. The ReLU activation function is shown in formula (9):

[0110] (9)

[0111] By introducing nonlinear variation functions in the training process of the generator, the generator can learn and simulate nonlinear relationships, enhance the generalization ability of the generator, and improve the accuracy and efficiency of generation and discrimination.

[0112] Through this embodiment, by introducing a random deactivation mechanism and a nonlinear change function in the training process of the generator, the performance of the generator can be optimized and the generalization ability and reliability of the generator can be improved.

[0113] In an exemplary embodiment, the first loss function includes a first loss term corresponding to a simulated domain name generated by the generator based on random noise data, a second loss term corresponding to a real domain name in the real domain name set, and a gradient penalty term corresponding to a synthetic domain name obtained by randomly interpolating the simulated domain name generated by the generator based on the random noise data and the real domain name in the real domain name set;

[0114] Based on the first loss function corresponding to the discriminator, the discriminator is tuned using the first simulated domain name in the first simulated domain name set and the real domain name in the real domain name set to obtain the tuned discriminator, including:

[0115] Inputting each first simulated domain name in the first simulated domain name set into the discriminator, obtaining a discrimination result for each first simulated domain name output by the discriminator, and inputting each real domain name in the real domain name set into the discriminator, obtaining a discrimination result for each real domain name output by the discriminator;

[0116] Randomly interpolating each first simulated domain name and one real domain name in the real domain name set to obtain a synthetic domain name set, inputting each synthetic domain name in the synthetic domain name set into a discriminator, and obtaining a discrimination result for each synthetic domain name output by the discriminator;

[0117] Based on the discrimination result of each synthetic domain name, determine the value of the gradient penalty item corresponding to the synthetic domain name set;

[0118] Determining a second function value of the first loss function according to the expected value of the discrimination result of each first simulated domain name, the expected value of the discrimination result of each synthetic domain name, and the value of the gradient penalty term corresponding to the synthetic domain name set;

[0119] According to the second function value, the discriminator is adjusted to obtain a discriminator after adjustment, wherein the function value of the first loss function determined based on the discriminator after adjustment is less than the second function value.

[0120] The discriminator can be used to score domain names and evaluate their authenticity. In this embodiment, the discriminator can be used to score input domain names (including simulated domain names, real domain names, and synthetic domain names obtained by random difference). Correspondingly, Figure 5 As shown, the first loss function may include a first loss term corresponding to a simulated domain name generated by the generator based on random noise data, a second loss term corresponding to a real domain name in a real domain name set, and a gradient penalty term corresponding to a synthetic domain name obtained by random difference between the simulated domain name generated by the generator based on random noise data and the real domain name in the real domain name set.

[0121] Similar to the aforementioned embodiment, the discriminator can obtain a batch of simulated domain names and real domain names from the generator and the real data set respectively to form a first simulated domain name set and a real domain name set, in which each domain name has been converted into an appropriate numerical form.

[0122] Optionally, the discriminator can generate a scoring result for the simulated domain names generated by the generator based on random noise data and a scoring result for the real domain names in the real domain name set, and its output can be a scalar value used to represent its evaluation of the authenticity of the corresponding sample.

[0123] During the training process of the discriminator, the problem of gradient disappearance or gradient explosion may occur. Here, gradient disappearance means that during the back propagation process, as the network depth increases, the gradient value becomes very small, resulting in almost no update of the model weights or extremely slow update speed; gradient explosion means that during the back propagation process, the gradient value becomes abnormally large, resulting in excessive update of the model parameters. To avoid this situation, a gradient penalty term can be introduced to force the gradient norm of the discriminator to be close to 1. By constraining the gradient size, the gradient norm of the discriminator can be maintained within a reasonable range, making the training process more stable.

[0124] Optionally, random interpolation can be performed on each first simulated domain name and one real domain name in the real domain name set to obtain a synthetic domain name set. That is, for each first simulated domain name and one real domain name in its corresponding real domain name set, only one random interpolation can be performed to generate a synthetic domain name. For example, for 5 simulated domain names, 5 synthetic domain names can be generated. Correspondingly, the loss value of the gradient penalty corresponding to the synthetic domain name set of the 5 synthetic domain names can be calculated.

[0125] Optionally, if Indicates real domain name data, The simulated domain name data generated by the generator can first be and generate data Randomly interpolate between and get the synthetic domain name set, as shown in formula (10):

[0126] (10)

[0127] Where α is a coefficient matrix randomly sampled from a uniform distribution U(0,1), with a dimension of (K,1,1), where K represents the batch size. Represents the interpolation result. Here, batch refers to dividing the entire training data set into multiple small batches (or batches), each batch contains a certain number of samples.

[0128] Optionally, each synthetic domain name in the synthetic domain name set may be input into the discriminator respectively to obtain a discrimination result of each synthetic domain name output by the discriminator.

[0129] Optionally, the value of the gradient penalty item corresponding to the synthetic domain name set can be determined based on the discrimination result of each synthetic domain name, and then the second function value of the first loss function can be determined according to the expected value of the discrimination result of each first simulated domain name, the expected value of the discrimination result of each synthetic domain name, and the value of the gradient penalty item corresponding to the synthetic domain name set.

[0130] For example, the weight of the gradient penalty (GP) value can be set to 10, and the final discriminator loss L DIS It can be shown as formula (11):

[0131] (11)

[0132] Among them, noise is random noise data that obeys the normal distribution and has dimensions of (K, M, N). represents the expected value of the discriminator's discrimination result for each first simulated domain name, It represents the expected value of the discriminator's discrimination result for each synthetic domain name.

[0133] Optionally, the discriminator can be adjusted according to the second function value to obtain a discriminator after parameter adjustment, wherein the function value of the first loss function determined based on the discriminator after parameter adjustment is less than the second function value, that is, the discriminator can be used to adjust the discrimination results of the generated domain name and the real domain name to reduce the second function value of the discriminator after parameter adjustment, so that the discriminator can more accurately distinguish the real domain name from the simulated domain name generated by the generator, and maintain its gradient stable in all areas.

[0134] Through this embodiment, by determining the second function value of the first loss function and adjusting the parameters of the discriminator based on the expected value of the discrimination result of each first simulated domain name, the expected value of the discrimination result of each synthetic domain name, and the value of the gradient penalty term corresponding to the synthetic domain name set, the performance of the discriminator can be optimized and the stability of the discriminator can be improved.

[0135] In an exemplary embodiment, determining the value of the gradient penalty item corresponding to the set of synthetic domain names based on the discrimination result of each synthetic domain name includes:

[0136] Calculate the gradient of the discrimination result of each synthetic domain name with respect to each synthetic domain name to obtain the gradient corresponding to each synthetic domain name, and calculate the L2 norm of the gradient corresponding to each synthetic domain name to obtain the gradient norm corresponding to each synthetic domain name;

[0137] The expected value of the deviation of the gradient norm corresponding to each synthetic domain name from 1 is determined as the value of the gradient penalty term corresponding to the synthetic domain name set.

[0138] In this embodiment, the gradient of the discrimination result of each synthetic domain name can be calculated for each synthetic domain name to obtain the gradient corresponding to each synthetic domain name, and the L2 norm of the gradient corresponding to each synthetic domain name can be calculated respectively to obtain the gradient norm corresponding to each synthetic domain name. For example, the above-mentioned calculation can be performed for each batch to obtain , then the interpolated data Output discriminator D, and then the output of the discriminator About interpolation points Calculate the gradient (i.e. grad), the calculation process is shown in formula (12):

[0139] (12)

[0140] Alternatively, the gradient of each domain vector can be calculated as shown in formula (13): Norm (i.e. gradient norm), the dimension of the result is (K, 1, 1).

[0141] (13)

[0142] Optionally, the expected value of the deviation of the gradient norm corresponding to each synthetic domain name from 1 can be determined as the value of the gradient penalty term corresponding to the synthetic domain name set, which can be used to quantify the sensitivity of the discriminator to input changes, that is, the degree of change in the discriminator output result when the input data changes slightly. The calculation process can be shown as formula (14):

[0143] (14)

[0144] Through this embodiment, by determining the value of the gradient penalty item corresponding to the synthetic domain name set, it can be constrained to ensure that the discriminator has a stable and smooth gradient, thereby avoiding instability during the training process.

[0145] It should be noted that for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by this application.

[0146] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product is stored in a storage medium (such as read-only memory (ROM) / random access memory (RAM), a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0147] According to another aspect of the embodiments of the present application, a training device for a generative adversarial network is also provided, which can be used to implement the training method for a generative adversarial network provided in the above-mentioned embodiments, which has been described and will not be repeated here. As used below, the term "module" can implement a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0148] Figure 6 This is a structural block diagram of an optional training device for a generative adversarial network according to an embodiment of the present application. As shown in the figure, the training device for a generative adversarial network includes:

[0149] The execution unit 602 is configured to perform multiple rounds of the following training operations on the generative adversarial network to be trained until a set training termination condition is met:

[0150] Inputting random noise data into the generator to obtain a first simulated domain name set output by the generator;

[0151] Based on the first loss function corresponding to the discriminator, the first simulated domain name in the first simulated domain name set and the real domain name in the real domain name set are used to adjust the parameters of the discriminator to obtain a discriminator after parameter adjustment;

[0152] Based on the second loss function corresponding to the generator, the generator is tuned using random noise data to obtain the tuned generator;

[0153] Among them, the second loss function includes a discriminant loss term and a diversity loss term. The discriminant loss term corresponds to the discrimination result of the discriminator after parameter adjustment on the simulated domain name generated by the generator based on random noise data. The diversity loss term is used to evaluate the domain name diversity of the simulated domain name generated by the generator based on random noise data.

[0154] It should be noted that the execution unit 602 in this embodiment can be used to execute the above step S202.

[0155] Through the embodiments provided by the present application, the following training operations are performed on the generative adversarial network to be trained for multiple rounds until the set training termination condition is met: random noise data is input into the generator to obtain a first set of simulated domain names output by the generator; based on the first loss function corresponding to the discriminator, the first simulated domain name in the first simulated domain name set and the real domain name in the real domain name set are used to adjust the parameters of the discriminator to obtain the discriminator after parameter adjustment; based on the second loss function corresponding to the generator, the random noise data is used to adjust the parameters of the generator to obtain the generator after parameter adjustment; wherein, the second loss function includes a discriminant loss term and a diversity loss term, the discriminant loss term corresponds to the discrimination result of the discriminator after parameter adjustment on the simulated domain name generated by the generator based on the random noise data, and the diversity loss term is used to evaluate the domain name diversity of the simulated domain name generated by the generator based on the random noise data, thereby solving the problem of low sample quality caused by lack of diversity of generated samples in the generative adversarial network in the related art, and improving the quality of samples generated by the generative adversarial network.

[0156] In an exemplary embodiment, the execution unit includes: a first input module for inputting random noise data into the generator to obtain a second simulated domain name set output by the generator; a second input module for inputting each second simulated domain name in the second simulated domain name set into the discriminator after parameter adjustment to obtain a discrimination result of each second simulated domain name output by the discriminator after parameter adjustment; a first determination module for determining a first function value of the second loss function based on the expected value of the discrimination result of each second simulated domain name and the loss value of the diversity loss term corresponding to the second simulated domain name set; a first parameter adjustment module for adjusting the generator according to the first function value to obtain the generator after parameter adjustment, wherein the function value of the second loss function determined based on the generator after parameter adjustment is less than the first function value.

[0157] In an exemplary embodiment, the second simulated domain name set is represented by a K×M×N dimensional domain name set matrix, where K is the number of second simulated domain names in the second simulated domain name set, M is the number of characters contained in each second simulated domain name, and N is the length of a character vector of a character in each second simulated domain name, and K, M, and N are all positive integers greater than or equal to 2; the execution unit further includes: a flattening module, configured to flatten the M×N dimensional domain name matrix corresponding to each second simulated domain name in the domain name set matrix to obtain a K×(M*N) dimensional flattened matrix; a first calculation module, configured to perform inner product calculation on the flattened matrix and the transpose of the flattened matrix to obtain a K×K dimensional first inner product matrix; a second calculation module, configured to calculate the L2 norm of each row in the first inner product matrix respectively, and perform inner product calculation on the obtained K×1 dimensional first column vector and the transpose of the first column vector to obtain a K×K dimensional second inner product matrix; a first execution module, configured to normalize the second inner product matrix, and determine the average value of all elements in the normalized second inner product matrix as the loss value of the diversity loss item corresponding to the second simulated domain name set.

[0158] In an exemplary embodiment, the domain name string of each second simulated domain name is standardized into a domain name string of a specified length using a filler, and the second loss function also includes a character loss term for evaluating the frequency of occurrence of characters in the simulated domain name generated by the generator based on random noise data; the execution unit also includes: a second execution module, used to perform the following processing operations on each second simulated domain name as the current second simulated domain name to obtain a loss value of the character loss term corresponding to each second simulated domain name, wherein the domain name string of the current second simulated domain name is the current domain name string: when the character that appears most frequently in the current domain name string is a filler, the loss value of the character loss term corresponding to the current second simulated domain name is determined to be 0; when the character that appears most frequently in the current domain name string is not a filler, the loss value of the character loss term corresponding to the current second simulated domain name is determined to be the quotient of the number of occurrences of the character that appears most frequently in the current domain name string and the total number of characters in the current domain name string; the average of the loss values of the character loss terms corresponding to each second simulated domain name is determined as the loss value of the character loss term corresponding to the second simulated domain name set.

[0159] In an exemplary embodiment, the network structures of the generator and the discriminator each include an input layer, two hidden layers and an output layer; the execution unit includes: a third execution module, which is used to set the outputs of some neurons in each hidden layer of the generator to zero through a random inactivation mechanism, and to perform nonlinear transformation on the outputs of at least some neurons in each hidden layer of the generator through a nonlinear transformation function.

[0160] In an exemplary embodiment, the first loss function includes a first loss term corresponding to a simulated domain name generated by a generator based on random noise data, a second loss term corresponding to a real domain name in a real domain name set, and a gradient penalty term corresponding to a synthetic domain name obtained by random difference between the simulated domain name generated by the generator based on the random noise data and the real domain name in the real domain name set; the execution unit includes: a third input module for inputting each first simulated domain name in the first simulated domain name set into the discriminator to obtain a discrimination result of each first simulated domain name output by the discriminator, and inputting each real domain name in the real domain name set into the discriminator to obtain a discrimination result of each real domain name output by the discriminator; a fourth execution module for performing a random operation on each first simulated domain name and the real domain name. A second determination module is configured to randomly interpolate a real domain name in a domain name set to obtain a synthetic domain name set, and input each synthetic domain name in the synthetic domain name set into a discriminator to obtain a discrimination result of each synthetic domain name output by the discriminator; a second determination module is configured to determine a value of a gradient penalty item corresponding to the synthetic domain name set based on the discrimination result of each synthetic domain name; a third determination module is configured to determine a second function value of the first loss function based on an expected value of the discrimination result of each first simulated domain name, an expected value of the discrimination result of each synthetic domain name, and a value of the gradient penalty item corresponding to the synthetic domain name set; a second parameter adjustment module is configured to adjust the parameters of the discriminator according to the second function value to obtain a discriminator after parameter adjustment, wherein the function value of the first loss function determined based on the discriminator after parameter adjustment is less than the second function value.

[0161] In an exemplary embodiment, the execution unit includes: a fifth execution module, configured to calculate a gradient of a discrimination result of each synthetic domain name with respect to each synthetic domain name to obtain a gradient corresponding to each synthetic domain name, and to calculate the L2 norm of the gradient corresponding to each synthetic domain name to obtain a gradient norm corresponding to each synthetic domain name; and a fourth determination module, configured to determine an expected value of a deviation of the gradient norm corresponding to each synthetic domain name from 1 as a value of a gradient penalty term corresponding to the synthetic domain name set.

[0162] It should be noted that the above modules can be implemented through software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0163] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored program, wherein the program executes the steps of any of the above method embodiments when it is run.

[0164] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, a ROM, a RAM, a mobile hard disk, a magnetic disk, or an optical disk.

[0165] According to another aspect of the embodiments of the present application, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor is configured to execute the steps of any of the above-described method embodiments through the computer program. In an exemplary embodiment, the electronic device may further comprise a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0166] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail here.

[0167] According to another aspect of an embodiment of the present application, a computer program product is also provided, which includes a computer program / instruction, which contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network via the communication portion 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit 701, the various functions provided by the embodiments of the present application are performed. The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0168] Figure 7 The following schematically shows a block diagram of a computer system structure of an electronic device for implementing an embodiment of the present application. Figure 7 As shown, computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to programs stored in ROM 702 or programs loaded from storage 708 into RAM 703. Random access memory 703 also stores various programs and data required for system operation. CPU 701, read-only memory 702, and random access memory 703 are interconnected via bus 704. An input / output (I / O) interface 705 is also connected to bus 704.

[0169] The following components are connected to the I / O interface 705: an input section 706 including a keyboard, mouse, and the like; an output section 707 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and speakers; a storage section 708 including a hard disk; and a communication section 709 including a network interface card such as a local area network card or a modem. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. Removable media 711, such as a magnetic disk, optical disk, magneto-optical disk, or semiconductor memory, is installed in the drive 710 as needed, so that computer programs read from the media can be installed in the storage section 708 as needed.

[0170] In particular, according to an embodiment of the present application, the processes described in the various method flow charts can be implemented as computer software programs. For example, an embodiment of the present application includes a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for executing the methods shown in the flow charts. In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 709 and / or installed from a removable medium 711. When the computer program is executed by the central processing unit 701, the various functions defined in the system of the present application are performed.

[0171] It should be noted that Figure 7 The computer system 700 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0172] Obviously, those skilled in the art should understand that the modules or steps of the present application described above can be implemented using a general-purpose computing device, they can be concentrated on a single computing device, or distributed across a network composed of multiple computing devices, they can be implemented using program code executable by the computing device, and thus, they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be performed in a different order than herein, or they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0173] The above are only preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, various modifications and variations of the present application are possible. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A training method for generating an adversarial network, characterized in that: The generative adversarial network includes a generator and a discriminator; the method includes: The generative adversarial network to be trained is subjected to multiple rounds of the following training operations until the set training termination condition is met: Inputting random noise data into the generator to obtain a first simulated domain name set output by the generator; Based on a first loss function corresponding to the discriminator, adjusting parameters of the discriminator using a first simulated domain name in the first simulated domain name set and a real domain name in the real domain name set to obtain the discriminator after parameter adjustment; Based on the second loss function corresponding to the generator, using the random noise data to adjust the parameters of the generator to obtain the adjusted generator; Among them, the second loss function includes a discriminant loss term and a diversity loss term. The discriminant loss term corresponds to the discrimination result of the discriminator after parameter adjustment on the simulated domain name generated by the generator based on the random noise data, and the diversity loss term is used to evaluate the domain name diversity of the simulated domain name generated by the generator based on the random noise data.

2. The method according to claim 1, characterized in that The method of adjusting parameters of the generator using the random noise data based on the second loss function corresponding to the generator to obtain the adjusted generator includes: Inputting the random noise data into the generator to obtain a second simulated domain name set output by the generator; Inputting each second simulated domain name in the second simulated domain name set into the discriminator after parameter adjustment, and obtaining a discrimination result of each second simulated domain name output by the discriminator after parameter adjustment; determining a first function value of the second loss function according to an expected value of the discrimination result of each second simulated domain name and a loss value of the diversity loss item corresponding to the second simulated domain name set; According to the first function value, the generator is adjusted to obtain the adjusted generator, wherein the function value of the second loss function determined based on the adjusted generator is less than the first function value.

3. The method according to claim 2, characterized in that The second simulated domain name set is represented by a domain name set matrix of K×M×N dimensions, where K is the number of second simulated domain names in the second simulated domain name set, M is the number of characters contained in each second simulated domain name, and N is the length of a character vector of a character in each second simulated domain name, and K, M, and N are all positive integers greater than or equal to 2; The method further comprises: adjusting the parameters of the generator using the random noise data based on the second loss function corresponding to the generator to obtain the adjusted generator; Flattening the M×N dimensional domain name matrix corresponding to each second simulated domain name in the domain name set matrix to obtain a K×(M*N) dimensional flattened matrix; Performing an inner product calculation on the flattened matrix and the transpose of the flattened matrix to obtain a first inner product matrix of K×K dimensions; Calculating the L2 norm of each row in the first inner product matrix respectively, and performing inner product calculation on the obtained K×1-dimensional first column vector and the transpose of the first column vector to obtain a K×K-dimensional second inner product matrix; Normalization is performed on the second inner product matrix, and an average value of all elements in the normalized second inner product matrix is determined as a loss value of the diversity loss item corresponding to the second simulated domain name set.

4. The method according to claim 2, characterized in that The domain name string of each second simulated domain name is normalized to a domain name string of a specified length using a filler, and the second loss function further includes a character loss term for evaluating the frequency of occurrence of characters in the simulated domain name generated by the generator based on the random noise data; The method further comprises: adjusting the parameters of the generator using the random noise data based on the second loss function corresponding to the generator to obtain the adjusted generator; The following processing operations are performed on each of the second simulated domain names as the current second simulated domain name to obtain a loss value of the character loss item corresponding to each of the second simulated domain names, wherein the domain name string of the current second simulated domain name is the current domain name string: when the character that appears most frequently in the current domain name string is the filler character, the loss value of the character loss item corresponding to the current second simulated domain name is determined to be 0; when the character that appears most frequently in the current domain name string is not the filler character, the loss value of the character loss item corresponding to the current second simulated domain name is determined to be the quotient of the number of occurrences of the character that appears most frequently in the current domain name string and the total number of characters in the current domain name string; An average of the loss values of the character loss items corresponding to each of the second simulated domain names is determined as the loss value of the character loss items corresponding to the second simulated domain name set.

5. The method according to claim 1, wherein The network structures of the generator and the discriminator each include an input layer, two hidden layers and an output layer; The method of adjusting parameters of the generator using the random noise data based on the second loss function corresponding to the generator to obtain the adjusted generator includes: The outputs of some neurons in each hidden layer of the generator are set to zero through a random deactivation mechanism, and the outputs of at least some neurons in each hidden layer of the generator are nonlinearly transformed through a nonlinear transformation function.

6. The method according to any one of claims 1 to 5, characterized in that The first loss function includes a first loss term corresponding to a simulated domain name generated by the generator based on the random noise data, a second loss term corresponding to a real domain name in the real domain name set, and a gradient penalty term corresponding to a synthetic domain name obtained by randomly differencing the simulated domain name generated by the generator based on the random noise data and the real domain name in the real domain name set; The method of adjusting parameters of the discriminator based on the first loss function corresponding to the discriminator using the first simulated domain name in the first simulated domain name set and the real domain name in the real domain name set to obtain the adjusted discriminator includes: Inputting each first simulated domain name in the first simulated domain name set into the discriminator, obtaining a discrimination result of each first simulated domain name output by the discriminator; and inputting each real domain name in the real domain name set into the discriminator, obtaining a discrimination result of each real domain name output by the discriminator; performing random interpolation on each of the first simulated domain names and one real domain name in the real domain name set to obtain a synthetic domain name set, inputting each synthetic domain name in the synthetic domain name set into the discriminator, and obtaining a discrimination result of each synthetic domain name output by the discriminator; Determining the value of the gradient penalty item corresponding to the set of synthetic domain names based on the discrimination result of each synthetic domain name; Determining a second function value of the first loss function according to the expected value of the discrimination result of each first simulated domain name, the expected value of the discrimination result of each synthetic domain name, and the value of the gradient penalty term corresponding to the set of synthetic domain names; According to the second function value, the discriminator is adjusted to obtain the discriminator after adjustment, wherein the function value of the first loss function determined based on the discriminator after adjustment is less than the second function value.

7. The method according to claim 6, characterized in that The determining, based on the discrimination result of each synthetic domain name, the value of the gradient penalty item corresponding to the synthetic domain name set includes: Calculating a gradient of the discrimination result of each synthetic domain name with respect to each synthetic domain name to obtain a gradient corresponding to each synthetic domain name, and respectively calculating an L2 norm of the gradient corresponding to each synthetic domain name to obtain a gradient norm corresponding to each synthetic domain name; The expected value of the deviation of the gradient norm corresponding to each synthetic domain name from 1 is determined as the value of the gradient penalty item corresponding to the synthetic domain name set.

8. A training device for generating an adversarial network, characterized in that The generative adversarial network includes a generator and a discriminator; the device includes: An execution unit is configured to perform multiple rounds of the following training operations on the generative adversarial network to be trained until a set training termination condition is met: Inputting random noise data into the generator to obtain a first simulated domain name set output by the generator; Based on a first loss function corresponding to the discriminator, adjusting parameters of the discriminator using a first simulated domain name in the first simulated domain name set and a real domain name in the real domain name set to obtain the discriminator after parameter adjustment; Based on the second loss function corresponding to the generator, using the random noise data to adjust the parameters of the generator to obtain the adjusted generator; Among them, the second loss function includes a discriminant loss term and a diversity loss term. The discriminant loss term corresponds to the discrimination result of the discriminator after parameter adjustment on the simulated domain name generated by the generator based on the random noise data, and the diversity loss term is used to evaluate the domain name diversity of the simulated domain name generated by the generator based on the random noise data.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method according to any one of claims 1 to 7 when executed by a processor.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

Images