A threat perception system based on active domain name generation and real-time detection of malicious domain names

By generating similar domain names using an autoregressive model based on Transformer and combining it with real-time monitoring and evaluation, the rule dependence and diversity issues of domain name spoofing attacks in existing technologies are solved, enabling efficient identification and evaluation of potential domain name abuse and improving the accuracy and adaptability of detection.

CN120498763BActive Publication Date: 2025-12-26BEIJING UNIV OF POSTS & TELECOMM
2 Cites 0 Cited by

Patent Information

Application Number
CN202510626191.0
Authority / Receiving Office
CN · China
Patent Type
Patents(China)
Current Assignee / Owner
Filing Date
2025-05-15
Publication Date
2025-12-26
Estimated Expiration
2045-05-15

AI Technical Summary

Technical Problem

Existing technologies suffer from poor detection results when identifying domain name spoofing attacks due to their strong rule dependence, ineffectiveness against unknown attack patterns, low character set and language diversity, lack of context and semantic understanding, and neglect of brand context.

Method used

A Transformer-based autoregressive model is used to generate similar domain names. Combined with historical threat awareness and real-time threat awareness modules, a list of similar domain names is generated through the autoregressive model. WHOIS queries and DNS resolution are used for risk assessment. Combined with real-time monitoring and malicious detection modules, phishing websites are identified.

Benefits of technology

It enables rapid identification and assessment of potential domain name abuse, and can perform efficient real-time detection in large-scale network environments, reducing the risk of phishing and brand abuse. It adapts to different character sets and semantic changes, improving the accuracy and adaptability of detection.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The application discloses a threat perception system based on active domain name generation and real-time detection of malicious domain names, and belongs to the technical field of network security detection. The system comprises a historical threat perception module, a real-time threat perception module and a malicious detection module. In the historical threat perception module, a domain name generation module uses a self-recurrence model based on a Transformer to construct a similar domain name generation model, generates a similar domain name list of a target enterprise, and a risk assessment module detects whether the similar domain names have been registered; if yes, the similar domain names can be accessed and added to a detection list. The real-time threat perception module monitors newly registered domain names in real time, and adds domain names with high similarity to the target enterprise domain names to a suspicious domain name list. The malicious detection module detects the detection list and the suspicious domain name list, and identifies phishing websites. The domain names generated by the system can be highly similar to the real domain names of an enterprise in terms of vision and semantics, and can rapidly identify and evaluate potential domain name abuse risks.
Need to check novelty before this filing date? Find Prior Art