Network security threat detection method and system based on artificial intelligence

Abstract

The present invention provides a network security threat detection method based on artificial intelligence. The method comprises: dividing an input domain name string into three blocks: a top-level domain, a second-level domain, and a sub-domain according to the hierarchy; using a pre-trained BERT model to independently encode the three blocks of the top-level domain, the second-level domain, and the sub-domain, and generate corresponding semantic feature vectors; calculating the Shannon entropy value of the domain name string as a statistical feature; inputting the semantic feature vector and the Shannon entropy value into a gated cross network to generate a dynamically weighted combined feature vector; inputting the combined feature vector into a classifier, and outputting a malicious probability determination result of the domain name. The method provided by the present invention can improve the detection accuracy, robustness, and efficiency of malicious domain names.

Description

Technical Field

[0001] The present invention relates to the field of security threat detection technology, and in particular to an artificial intelligence-based network security threat detection method and system. Background Art

[0002] In recent years, the rapid development of technologies such as the mobile internet, industrial internet, and the Internet of Things has led to a dramatic increase in the number of connected devices, profoundly impacting people's lives and work while also raising a series of cybersecurity issues. Cyber ​​attackers exploit malware to target these connected devices, forming botnets and launching a series of cyberattacks. Cyber ​​attackers rely on control and command servers to indirectly control these malware-infected connected devices (hosts). If the C&C servers are discovered and taken down by cybersecurity defenders, the attackers lose control of the compromised hosts.

[0003] To enhance the stealthiness of their C&C servers, cyber attackers have begun using Fast-Flux and domain generation algorithms (DGAs). Of the large number of domain names generated by botnet controllers using DGAs, only a small fraction are used for actual C&C communications. Bots sequentially query these domains and connect to C&C servers until an available domain is found. Botnets using DGA technology are known as DGA-based botnets, and the domain names generated by DGA are known as algorithmically generated domains (AGDs) or malicious domains. While DGA reduces the risk of C&C server discovery, it also poses a significant challenge to network defense.

[0004] Existing malicious domain name detection suffers from blind spots in single-feature detection. It cannot identify malicious domains disguised as low-randomness and has difficulty detecting purely random DGA domains. Existing methods also treat domains as a whole, failing to locate malicious subdomains. Attackers can trick single detection models by adjusting character distribution (e.g., reducing entropy) or mimicking normal words (e.g., faceb00k-login.com). Therefore, a method that can quickly and accurately identify malicious domains is urgently needed. Summary of the Invention

[0005] The present invention describes an artificial intelligence-based network security threat detection method and system, which can solve the above technical problems.

[0006] In a first aspect, a network security threat detection method based on artificial intelligence is provided. The method comprises: dividing an input domain name string into three blocks: a top-level domain, a second-level domain, and a subdomain according to the hierarchy; using a pre-trained BERT model to independently encode the top-level domain, the second-level domain, and the subdomain blocks, and generating corresponding semantic feature vectors; calculating the Shannon entropy value of the domain name string as a statistical feature; inputting the semantic feature vector and the Shannon entropy value into a gated cross network to generate a dynamically weighted combined feature vector; wherein the gated cross network dynamically adjusts the activation strength of the semantic feature vector according to the Shannon entropy value; inputting the combined feature vector into a classifier, and outputting a malicious probability determination result of the domain name.

[0007] In some embodiments, the process of using a pre-trained BERT model to independently encode the three blocks of the top-level domain, second-level domain and sub-domain includes: using the BERT model to perform character-level encoding on each block, extracting the classification identification vector corresponding to each block as a semantic feature vector, and the top-level domain, second-level domain and sub-domain share the weight parameters of the same BERT model.

[0008] In some embodiments, the method of inputting the semantic feature vector and the Shannon entropy value into a gated cross network to generate a dynamically weighted combined feature vector includes: mapping the Shannon entropy value into a gated weight vector of the same dimension as the semantic feature vector through a fully connected layer; performing a linear transformation on the semantic feature vector to obtain an enhanced feature vector; combining the gated weight vector and the enhanced feature vector by element-wise multiplication to generate a dynamically weighted semantic feature vector; and splicing the dynamically weighted semantic feature vector and the Shannon entropy value into a final combined feature vector.

[0009] In some embodiments, the classifier has a dual-branch structure, including a semantic branch, a statistical branch and a fusion layer, wherein the semantic branch is used to receive the dynamically weighted semantic feature vector and generate a first feature representation through a fully connected layer; the statistical branch is used to receive the Shannon entropy value and generate a second feature representation through a fully connected layer; the fusion layer is used to add the first feature representation and the second feature representation and then output the classification result through a Softmax function.

[0010] In some embodiments, before the input domain name string is segmented, the domain name string is normalized; wherein the normalization includes converting the domain name string into lowercase letters, removing protocol identifiers and non-domain name characters.

[0011] In some embodiments, the method further includes a model training phase, wherein the training phase includes: using a contrastive loss function to jointly optimize semantic feature extraction and classification tasks, wherein the positive sample pairs are normal domain name feature vectors, and the negative sample pairs are malicious domain name feature vectors.

[0012] In a second aspect, a network security threat detection system based on artificial intelligence is provided, which includes: a domain name segmentation module, which is used to segment the input domain name string into three blocks: top-level domain, second-level domain and sub-domain according to the hierarchy; a semantic encoding module, which is used to use a pre-trained BERT model to independently encode the three blocks of top-level domain, second-level domain and sub-domain, and generate corresponding semantic feature vectors; a Shannon entropy value calculation module, which is used to calculate the Shannon entropy value of the domain name string as a statistical feature; a feature vector combination module, which is used to input the semantic feature vector and the Shannon entropy value into a gated cross network to generate a dynamically weighted combined feature vector; wherein the gated cross network dynamically adjusts the activation strength of the semantic feature vector according to the Shannon entropy value; and a judgment result output module, which is used to input the combined feature vector into a classifier and output the malicious probability judgment result of the domain name.

[0013] By fusing semantic features (BERT block encoding) with statistical features (Shannon entropy), this approach simultaneously captures both contextual semantic anomalies and character distribution anomalies within domain names, addressing the blind spots inherent in single-feature detection. Block encoding technology accurately pinpoints the level of anomalies in malicious domains (e.g., garbled subdomains while the primary domain is normal), reducing false positives. A gated cross-network dynamically adjusts the weights of semantic features based on entropy, forcing attackers to spoof both statistical and semantic features, significantly increasing the cost of attacks. This fusion of block semantic encoding and dynamic features improves the accuracy, robustness, and efficiency of malicious domain detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0015] Figure 1 A schematic diagram of the architecture of a network security threat detection model based on artificial intelligence provided by an embodiment of this specification is shown;

[0016] Figure 2 A schematic diagram of a process flow of a network security threat detection method based on artificial intelligence provided by an embodiment of this specification is shown;

[0017] Figure 3 A schematic flow chart of a method for generating a combined feature vector provided in an embodiment of this specification is shown;

[0018] Figure 4 A schematic diagram of the structure of a network security threat detection system based on artificial intelligence provided in an embodiment of this specification is shown. DETAILED DESCRIPTION

[0019] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0020] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below with reference to the accompanying drawings.

[0021] In the description of the embodiments of the present application, words such as "exemplary," "for example," or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary," "for example," or "for example" in the embodiments of the present application should not be construed as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary," "for example," or "for example" is intended to present the relevant concepts in a concrete manner.

[0022] In the description of the embodiments of this application, the term "and / or" is merely a description of an association relationship between associated objects, indicating that three relationships may exist. For example, A and / or B can represent the following three situations: A exists alone, B exists alone, and A and B exist at the same time. In addition, unless otherwise specified, the term "plurality" means two or more.

[0023] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly identifying the technical features being referred to. Thus, features specified as "first" or "second" may explicitly or implicitly include one or more of such features. The terms "include," "comprising," "having," and their variations all mean "including but not limited to," unless otherwise specifically emphasized.

[0024] Figure 1 A schematic diagram of the network security threat detection model architecture based on artificial intelligence provided by the embodiments of this specification is shown as follows: Figure 1 As shown, the model can include an input layer, a domain name segmentation module, a BERT encoding module, a Shannon entropy calculation module, a gated cross network, a classifier, and an output layer. The input layer is connected to the domain name segmentation module and the Shannon entropy calculation module, respectively. The output of the domain name segmentation module is connected to the BERT segmentation encoding module. The output of the BERT segmentation encoding module and the output of the Shannon entropy calculation module are both input to the gated cross network. The output of the gated cross network is connected to a two-branch classifier, the output of which converges to a feature aggregation layer, which is then connected to the output layer.

[0025] Specifically, refer to Figure 1, domain name data can be input into the domain name segmentation module to segment the domain name. The segmented domain name is input into the BERT encoding module, which encodes each segment, learns the contextual semantics of the domain name characters, and the naming patterns of different domain name segmentation levels, and obtains a semantic feature vector. The domain name data can be input into the Shannon entropy calculation module to calculate the character Shannon entropy value of the complete domain name. The semantic feature vector and Shannon entropy value are respectively input into the gated cross network. The semantic feature vector is fused with the entropy value through dynamic weighting to generate a combined feature vector. The semantic part of the combined feature vector is input into the semantic branch of the classifier, and the entropy part is input into the statistical branch. The output of the two-branch classifier is converged into the feature aggregation layer. The results of the two branches are added and classified through Softmax, and the malicious probability is output. Finally, the final result (normal / malicious) can be determined based on the probability threshold.

[0026] Figure 2 A schematic diagram of a network security threat detection method based on artificial intelligence provided by an embodiment of this specification is shown as follows: Figure 1 As shown, the method includes:

[0027] Step S101: Segment the input domain name character string into three blocks: top-level domain, second-level domain, and sub-domain according to the hierarchy.

[0028] Specifically, the hierarchy of a fully qualified domain name progresses from right to left, with a general format of: subdomain, second-level domain, and top-level domain. The top-level domain generally identifies the domain type or country / region. The second-level domain is the core identifier of the domain name, usually representing a company, brand, or personal name. Subdomains further divide services or departments under the second-level domain and can be freely created by users. For example, a fully qualified domain name is api.service.example.org, with the top-level domain being org, the second-level domain being example, and the subdomain being api.service.

[0029] You can use specific libraries in programming languages ​​to segment domain name strings into hierarchical chunks, such as Python's tldextract library or Python Libraries.

[0030] In one embodiment, before the input domain name character string is divided into blocks, the domain name character string may be standardized.

[0031] Specifically, domain names can be converted to lowercase. For example, "HTTP: / / Example.Com" can be converted to "http: / / example.com". Protocol identifiers and non-domain characters can be removed. For example, "https: / / example.com" can be converted to "example.com". Paths (such as / path / to / page), query parameters (such as ?id=123), anchor fragments (such as #section), and special symbols (such as @, &, %, $, etc.) can be removed.

[0032] In step S102 , a pre-trained BERT model is used to independently encode the top-level domain, the second-level domain, and the subdomain to generate corresponding semantic feature vectors.

[0033] Specifically, the pre-trained BERT model independently encodes a domain name's top-level domain, second-level domain, and subdomain layers, extracting semantic feature vectors for each component. This block-by-block processing allows the model to accurately capture anomalous patterns at different levels (such as random subdomains or disguised primary domains) while retaining character-level contextual understanding, providing fine-grained semantic features for subsequent detection. This hierarchical encoding approach significantly improves the model's ability to identify complex malicious domains.

[0034] In one embodiment, the process of using a pre-trained BERT model to independently encode the three blocks of the top-level domain, second-level domain and sub-domain includes: using the BERT model to perform character-level encoding on each block, extracting the classification identification vector corresponding to each block as a semantic feature vector, and the top-level domain, second-level domain and sub-domain share the weight parameters of the same BERT model.

[0035] Specifically, after hierarchically segmenting the domain name, each chunk can be converted into a format suitable for BERT input. Special markers, such as [CLS] and [SEP], can be added before and after the chunk to form independent input sequences. For example, the top-level domain chunk might be structured as [CLS] .com [SEP], the second-level domain chunk as [CLS] google [SEP], and the subdomain chunk as [CLS] mail.archive [SEP].

[0036] These sequences are encoded using a shared-weight BERT model. Based on its language understanding capabilities pre-trained on a large corpus, the model analyzes the character-level context within each block. For example, it identifies the regularity of top-level domains (such as the legitimacy of .com), the readability of second-level domains (such as the difference between google and the random string xzjkl), and the rationality of subdomains (such as the comparison between mail as a common service identifier and abc123).

[0037] Finally, the output vector corresponding to the [CLS] tag of each block is extracted as a semantic feature vector. These vectors not only encode the local semantics of each block (such as character replacement and randomness), but also imply the hierarchical relationship between blocks (such as the consistency between the subdomain and the main domain).

[0038] Through the above-mentioned block-by-block independent encoding method, the model can more finely capture abnormal patterns of malicious domain names at specific levels (such as DGA injecting random characters into subdomains), while retaining BERT's powerful modeling capabilities for natural language semantics, providing highly discriminative input for subsequent feature fusion and classification.

[0039] Step S103: Calculate the Shannon entropy value of the domain name string as a statistical feature.

[0040] Specifically, the number of times each character appears in the domain name is counted. Based on the number of times a character appears, the probability of each character appearing is calculated. It is easy to understand that the probability of each character appearing can be calculated by dividing the number of times a character appears by the total number of characters. The traditional entropy value of each domain name is calculated using the Shannon entropy formula, which is as follows:

[0041] ;

[0042] in, Refers to characters Probability of occurrence.

[0043] Calculating the Shannon entropy of a domain name string quantifies its degree of randomness by analyzing the probability distribution of characters within the domain. A higher Shannon entropy indicates a more random character combination (e.g., DGA-generated qwerty.com), while a lower Shannon entropy indicates a more regular character combination (e.g., google.com). This statistical feature effectively captures the common randomness characteristics of malicious domain names, complementing semantic features to improve detection accuracy.

[0044] Step S104: Input the semantic feature vector and the Shannon entropy value into a gated cross network to generate a dynamically weighted combined feature vector. The gated cross network can dynamically adjust the activation strength of the semantic feature vector according to the Shannon entropy value.

[0045] Specifically, the Gated Cross Network (Gated Cross Network) is a structure used to enhance feature interactions in deep learning models. Its core idea is to introduce a gating unit on top of the cross network to control the contribution of cross terms in each layer. This allows the model to automatically determine whether feature cross-pollination is necessary, improving expressiveness and generalization performance.

[0046] The semantic feature vector and Shannon entropy are fed into a gated cross network. This network uses Shannon entropy as a gating signal to dynamically adjust the activation strength of the semantic feature vector, effectively suppressing noise while preserving key semantic information. The network ultimately outputs a dynamically weighted combined feature vector, improving the model's generalization and decision-making accuracy in complex scenarios.

[0047] In one embodiment, Figure 3 FIG. 5 is a flow chart of a method for generating a combined feature vector provided by this embodiment. Figure 3 As shown, the method includes:

[0048] Step S1041 : Map the Shannon entropy value into a gating weight vector of the same dimension as the semantic feature vector through a fully connected layer.

[0049] Specifically, the entropy value is mapped to a gating weight vector with the same dimension as the semantic vector through the fully connected layer:

[0050] ;

[0051] Where h is the entropy vector input to the fully connected layer, is the weight matrix, is the bias term, is the Sigmoid function, which compresses the weight to the (0,1) interval.

[0052] For example, a domain with a high Shannon entropy of 3.5 and g close to 1 can fully preserve the domain's semantic features (because it is highly random and requires BERT detection). A domain with a low Shannon entropy of 1.0 and g close to 0 can suppress the domain's semantic features (because regular domains do not require in-depth analysis).

[0053] Step S1042: Perform linear transformation on the semantic feature vector to obtain an enhanced feature vector.

[0054] Specifically, the semantic feature vector can be input into a linear layer to enhance the feature expression capability through the learnable linear layer. In other words, by rotating or scaling the original semantic feature space, the direction that is more effective for malicious domain name detection can be highlighted.

[0055] Step S1043 : Combining the gated weight vector and the enhanced feature vector by element-wise multiplication to generate a dynamically weighted semantic feature vector.

[0056] Specifically, the gating weight vector and the enhanced feature vector can be combined by multiplying the gating weight and the enhanced feature element by element to generate a dynamically weighted semantic feature vector, which can retain most of the enhanced features.

[0057] Step S1044 : concatenate the dynamically weighted semantic feature vector and the Shannon entropy value into a final combined feature vector.

[0058] Specifically, the weighted semantic feature vector can be concatenated with the original Shannon entropy value to obtain the final combined feature vector to avoid the loss of global statistical information in the gating process.

[0059] As can be seen from this example, the gating weight vector dynamically adjusts the activation strength of semantic features based on the Shannon entropy value. High entropy values ​​(such as random DGA domains) automatically enhance the weight of semantic features, while low entropy values ​​(such as normal domains) suppress them, enabling the model to flexibly respond to different attack patterns. The semantic feature vector undergoes a linear transformation using a learnable weight matrix, highlighting semantic patterns critical for malware detection and suppressing irrelevant features, thereby improving the intra-class compactness and inter-class diversity of the feature space. By analyzing the distribution of gating weights, we can also intuitively understand the basis for the model's decision-making regarding various domain names.

[0060] Step S105: input the combined feature vector into a classifier, and output a malicious probability determination result of the domain name.

[0061] Specifically, the combined feature vector obtained by the dynamic weighted fusion of the gated cross network can be input into the malicious domain name classifier. The classifier models the malicious behavior tendency of the domain name based on the discriminant pattern learned from the training data, and outputs a probability value between 0 and 1 to indicate the possibility that the domain name belongs to the malicious category.

[0062] In one embodiment, a dual-branch structure classifier is provided, which includes at least a semantic branch, a statistical branch, and a fusion layer.

[0063] Specifically, the semantic branch receives dynamically weighted semantic feature vectors and generates a first feature representation through a fully connected layer. This can be used to detect anomalies such as character substitutions (g00gle) and meaningless combinations (xzjkl). The statistical branch receives Shannon entropy values ​​and generates a second feature representation through a fully connected layer. This can be used to quantify randomness and independently identify high-entropy domain names. The fusion layer adds the first and second feature representations and outputs the classification result through a softmax function. This avoids feature fragmentation caused by simple concatenation and promotes interactive learning.

[0064] The combined features pre-screened by the gated cross network already contain the dynamic weighting information of entropy value on semantic features, which enables the classifier to automatically adjust the dependency strategy in different scenarios. For example, as shown in Table 1:

[0065]

[0066] Table 1. Results of a classifier tuning strategy

[0067] This implementation demonstrates that the dual-branch structure (semantic branch + statistical branch) forces the model to consider both local semantic anomalies (such as character substitution g00gle) and global randomness (such as high entropy values ​​asdfgh.com), addressing the blind spots of traditional single-feature models. By combining features pre-screened by a gated cross-network, the classifier can automatically adjust its dependency strategy in different scenarios.

[0068] In one embodiment, the method described in the above embodiment also includes a model training stage.

[0069] Specifically, the contrastive loss function can be used to jointly optimize the semantic feature extraction and classification tasks, where the positive sample pair is the normal domain name feature vector and the negative sample pair is the malicious domain name feature vector.

[0070] During model training, a contrastive loss function is used to jointly optimize semantic feature extraction and classification tasks, forcing the model to learn more discriminative feature representations. Specifically, this loss function reduces the distance between feature vectors of similar domains (e.g., two legitimate domains) while increasing the distance between feature vectors of dissimilar domains (e.g., a legitimate domain and a malicious domain), thereby forming clear class boundaries in the feature space. Positive pairs are derived from the feature vectors of legitimate domains, while negative pairs are a mixture of legitimate and malicious domain feature vectors.

[0071] This contrastive learning mechanism significantly improves the quality of semantic features generated by the BERT encoder, enabling it to better discern subtle malicious patterns (such as character substitutions or random combinations). Simultaneously, the standard cross-entropy loss for classification tasks ensures the discriminative nature of the final output probabilities. The weighted joint training of these two methods optimizes the discriminative power of feature extraction while ensuring classification accuracy, thereby comprehensively improving the model's detection robustness in open environments.

[0072] Corresponding to the above method provided by the present invention, the present invention also provides a system. Figure 4 FIG2 shows a schematic diagram of the structure of a network security threat detection system based on artificial intelligence provided by an embodiment of this specification. Figure 4 As shown, the system includes:

[0073] The domain name segmentation module 201 is used to segment the input domain name character string into three segments: top-level domain, second-level domain and sub-domain according to the hierarchy.

[0074] The semantic encoding module 202 is used to use the pre-trained BERT model to independently encode the top-level domain, the second-level domain and the sub-domain blocks to generate corresponding semantic feature vectors.

[0075] The Shannon entropy value calculation module 203 is used to calculate the Shannon entropy value of the domain name string as a statistical feature.

[0076] The feature vector combination module 204 is configured to input the semantic feature vector and the Shannon entropy value into a gated cross network to generate a dynamically weighted combined feature vector. The gated cross network dynamically adjusts the activation strength of the semantic feature vector according to the Shannon entropy value.

[0077] The determination result output module 205 is configured to input the combined feature vector into a classifier and output a malicious probability determination result of the domain name.

[0078] It is worth mentioning that Figure 4 The system shown is Figure 2 The method embodiments shown correspond to and can be applied to Figure 2 The domain name segmentation, domain name semantic encoding, Shannon entropy calculation, feature vector combination, and malicious result determination in the illustrated method embodiment will not be described in detail here. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0079] According to another embodiment, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the system realizes the combination of Figure 2 The method described.

[0080] According to another embodiment, there is also provided a computer readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 2 The method described.

[0081] Those skilled in the art will appreciate that, in one or more of the above examples, the functions described herein may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0082] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network security threat detection method based on artificial intelligence, characterized in that: The method comprises: Split the input domain name string into three blocks: top-level domain, second-level domain and subdomain; Use the pre-trained BERT model to independently encode the top-level domain, second-level domain, and subdomain blocks to generate corresponding semantic feature vectors; Calculating the Shannon entropy value of the domain name string as a statistical feature; Inputting the semantic feature vector and the Shannon entropy value into a gated cross network to generate a dynamically weighted combined feature vector; wherein the gated cross network dynamically adjusts the activation strength of the semantic feature vector according to the Shannon entropy value; the method for generating the dynamically weighted combined feature vector includes: The Shannon entropy value is mapped into a gating weight vector of the same dimension as the semantic feature vector through a fully connected layer; Perform linear transformation on the semantic feature vector to obtain the enhanced feature vector; Combining the gated weight vector and the enhanced feature vector in an element-wise multiplication manner to generate a dynamically weighted semantic feature vector; The dynamically weighted semantic feature vector and the Shannon entropy value are concatenated into the final combined feature vector; The combined feature vector is input into a classifier, and a malicious probability determination result of the domain name is output.

2. The method according to claim 1, characterized in that The process of using the pre-trained BERT model to independently encode the top-level domain, second-level domain, and subdomain blocks includes: A BERT model is used to perform character-level encoding on each block, and a classification identification vector corresponding to each block is extracted as a semantic feature vector. The top-level domain, second-level domain, and subdomain share the weight parameters of the same BERT model.

3. The method according to claim 1, characterized in that The classifier has a dual-branch structure, including a semantic branch, a statistical branch and a fusion layer, wherein: The semantic branch is used to receive the dynamically weighted semantic feature vector and generate the first feature representation through the fully connected layer; The statistical branch is used to receive the Shannon entropy value and generate the second feature representation through the fully connected layer; The fusion layer is used to add the first feature representation and the second feature representation and output the classification result through the Softmax function.

4. The method according to claim 1, wherein Before the input domain name character string is divided into blocks, the domain name character string is standardized; wherein the standardization includes converting the domain name character string into lowercase letters, removing protocol identifiers and non-domain name characters.

5. The method according to claim 1, wherein The method also includes a model training phase, which includes: using a contrast loss function to jointly optimize semantic feature extraction and classification tasks, where the positive sample pairs are normal domain name feature vectors and the negative sample pairs are malicious domain name feature vectors.

6. An artificial intelligence-based network security threat detection system, characterized in that: The security threat detection system includes: The domain name segmentation module is used to segment the input domain name string into three segments: top-level domain, second-level domain and subdomain. The semantic encoding module is used to independently encode the top-level domain, second-level domain, and subdomain blocks using the pre-trained BERT model to generate corresponding semantic feature vectors; a Shannon entropy value calculation module, configured to calculate the Shannon entropy value of the domain name string as a statistical feature; a feature vector combination module, configured to input the semantic feature vector and the Shannon entropy value into a gated cross network to generate a dynamically weighted combined feature vector; wherein the gated cross network dynamically adjusts the activation strength of the semantic feature vector according to the Shannon entropy value; and wherein the process of generating the dynamically weighted combined feature vector comprises: mapping the Shannon entropy value into a gated weight vector of the same dimension as the semantic feature vector through a fully connected layer; Perform linear transformation on the semantic feature vector to obtain the enhanced feature vector; Combining the gated weight vector and the enhanced feature vector in an element-wise multiplication manner to generate a dynamically weighted semantic feature vector; The dynamically weighted semantic feature vector and the Shannon entropy value are concatenated into the final combined feature vector; Inputting the combined feature vector into a classifier and outputting a malicious probability determination result of the domain name; The determination result output module is used to input the combined feature vector into the classifier and output the malicious probability determination result of the domain name.

Images