A method and system for multi-period feature fusion analysis based on expired domain names

Abstract

The application provides a kind of multi-period feature fusion analysis method and system based on expired domain name, it is related to network security technical field, the method includes: the registration time and expiration time of domain name are obtained in real time by domain name registration information, expired domain name is filtered based on current time, while integrating the expired domain name list published by third party platform, after de-duplication and standardization processing, initial expired domain name set is generated;Based on initial expired domain name set, historical information, information in the stage of to be continued to charge, information in the stage of re-usable are collected in stages, and multi-dimensional time series data set covering the whole life cycle of domain name is generated.The application mines the historical behavior characteristics of expired domain name, multi-period time series data correlation and dynamic risk modeling, combines machine learning algorithm, mines the behavior mode characteristics of specific operation subject using expired domain name to deploy abnormal network service, realizes early identification of specific operation subject service, and carries out prospective interception.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for multi-period feature fusion analysis based on expired domain names. Background Technology

[0002] In order to reduce resource investment, expand the radius of influence, and evade security monitoring, some network operators tend to register expired domain names to deploy high-risk network services.

[0003] The value of such expired domain names lies mainly in two aspects: Expired domain names may have previously hosted legitimate services or high-risk activities, accumulating historical traffic or search engine ranking; re-registration can leverage their residual traffic to accelerate service dissemination.

[0004] Compared to the high cost of continuous renewal, the economic investment in re-registering expired domain names is significantly reduced; moreover, because the original registration information is invalid, the traceability path of the operator's identity can be weakened.

[0005] However, some current domain name detection solutions have the following technical flaws: For example, relying on behavioral data after domain name re-registration may not be able to predict risks in the early stages of registration (before service deployment), which may lead to insufficient protection timeliness; over-focusing on the current status of domain names (such as real-time WHOIS / traffic) may ignore the identification value of historical behavioral characteristics before expiration for "high-risk re-registration domain names"; lack of correlation analysis of cross-cycle behavioral patterns of "expiration-registration-abandonment" may make it difficult to identify the behavioral characteristics of the same entity registering different expired domain names in rotation. Summary of the Invention

[0006] The technical problem to be solved by this invention is to provide a multi-period feature fusion analysis method and system based on expired domain names. By mining the historical behavioral features of expired domain names, the correlation of multi-period time series data and dynamic risk modeling, and combining machine learning algorithms, the method can mine the behavioral pattern features of specific operators using expired domain names to deploy abnormal network services, thereby achieving early identification of the services of specific operators and proactive interception.

[0007] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows: Firstly, a multi-period feature fusion analysis method based on expired domain names, the method comprising: Step S1: Obtain the registration time and expiration time of the domain name in real time through the domain name registration information, filter expired domain names based on the current time, and integrate the expired domain name list published by third-party platforms. After deduplication and standardization, generate an initial set of expired domain names. Step S2: Based on the initial set of expired domain names, collect historical information, information on the pending renewal stage, and information on the re-availability stage in stages to generate a multi-dimensional time-series dataset covering the entire lifecycle of the domain name; Step S3: Based on the multi-dimensional time series dataset, extract character features, content features, change pattern features and time correlation features. Combined with the domain name's behavior during the stable availability period, identify and label it into three categories: high risk, potential risk or normal through manual and automated identification, and output a set of labeled high-dimensional feature vectors. Step S4: Based on the high-dimensional feature vector set, gradient boosting tree is used to process static features, time series model is used to analyze dynamic features, and graph neural network is used to mine associated features. The class imbalance is optimized through soft labeling mechanism and weighted loss function, and a probability-calibrated three-class risk scoring model is output. Step S5: Based on the three-class risk scoring model, infer and filter the set of high-risk domains from unmarked expired domains. By continuously monitoring the evolution of web page content, DNS resolution, and third-party tags during the re-availability phase, a dynamic warning is triggered when illegal keywords, high-risk IP pointing, or records updated by third-party risk tags are detected.

[0008] Further, step S1: Obtain the registration time and expiration time of the domain name in real time through the domain name registration information, filter expired domain names based on the current time, and integrate the expired domain name list published by third-party platforms. After deduplication and standardization, an initial set of expired domain names is generated, including: The system obtains the registration time and expiration time of domain names in real time. By comparing the current time with the expiration time, it filters out domain names that have expired but have not yet entered the release period, and generates the first subset of expired domain names. Obtain a list of domains to be released from a third-party platform. Based on the first subset of expired domains, deduplicate the third-party list, remove domains that are duplicated with the first subset, and generate a second subset of expired domains after deduplication. Based on the first and second subsets of expired domain names, timestamps are unified to UTC format, registrar names are mapped to ICANN standard encoding, and domain name format is standardized by lowercase conversion and Punycode encoding to generate an initial set of expired domain names. Based on the initial set of expired domain names, the system continuously monitors changes in domain name status, removes domain names that are renewed within the grace period, marks domain names that have entered the release period as objects to be re-registered, and outputs a dynamically updated set of initial expired domain names.

[0009] Further, step S2: Based on the initial set of expired domain names, historical information, information on the pending renewal stage, and information on the re-availability stage are collected in stages to generate a multi-dimensional time-series dataset covering the entire lifecycle of the domain names, including: Based on the initial set of expired domain names, historical website content is extracted from the Internet Archive, and historical DNS records, digital certificates, and risk labels are obtained by combining the passive DNS database and the threat analysis platform. Historical registration information is also collected based on the WHOIS historical database to generate a historical information dataset. Based on historical information datasets, WHOIS information, DNS records, and web page content are collected for grace period domains at a first preset frequency, and relevant WHOIS information, DNS records, and web page content are collected for redemption period domains at a second preset frequency, generating a time-series dataset for the pending renewal stage. Based on the time series dataset of the pending renewal stage, the domain name renewal or re-registration is monitored in stages. In the early stage of re-registration, registration information, DNS resolution records, web page content, digital certificate and third-party risk labels are collected daily. In the stable operation period, the above information is collected weekly and the evolution path is recorded to generate the time series dataset of the re-availability stage. Based on historical information datasets, time-series datasets for the pending renewal phase and the re-availability phase, the three-phase time series are aligned by domain name subject, and domain registration information, DNS resolution records, web page content, digital certificate information, and third-party risk labels are unified. The timestamp intervals are standardized to generate a multi-dimensional time-series dataset covering the entire lifecycle of a domain name.

[0010] Further, step S3: Based on the multi-dimensional time-series dataset, extract character features, content features, change pattern features, and time-related features. Combined with the domain name's behavior during a stable availability period, classify it into three categories—high-risk, potential-risk, or normal—through both manual and automated identification. Output a set of labeled high-dimensional feature vectors, including: Based on a multi-dimensional time-series dataset, four types of feature extraction are performed: character features of parsing domain name length, top-level domain type, proportion of random characters and inducement words; content features of historical risk label type and frequency, certificate update frequency and proportion of risky domains with the same IP address; DNS record change frequency and the change pattern of web page content from blank page to illegal page; and time correlation features of registration to DNS effective time, risk label appearance time and behavior outbreak cycle are measured to generate an original feature vector set. Based on the original feature vector set, the behavior of the domain name during the stable availability period is verified, the web page content is automatically scanned, the threat intelligence interface is called to obtain risk label updates, the blacklist hit records of DNS resolution IPs are recorded, and a behavior verification report is generated. Based on the aforementioned behavior verification report, domain risk classification labels are generated through automated identification combined with manual review: domains containing legally prohibited content or exhibiting verifiable technical abuse are labeled as high-risk domains; domains with historically suspicious characteristics but no current clear technical evidence are labeled as potentially risky domains; and domains without risk characteristics and whose service content is compliant are labeled as normal domains. Based on the original feature vector set and domain risk classification labels, character features, content features, change pattern features, and time correlation features are merged into a unified vector according to the domain name subject. Principal component analysis is used to retain the main feature components with a set variance contribution rate. After associating with classification labels, a set of labeled feature vectors is generated.

[0011] Further, step S4: Based on the high-dimensional feature vector set, gradient boosting trees are used to process static features, time-series models are used to analyze dynamic features, and graph neural networks are used to mine associated features. Class imbalance is optimized through a soft-label mechanism and a weighted loss function, outputting a probability-calibrated three-class risk scoring model, including: Based on a high-dimensional feature vector set, a gradient boosting tree model is used to process sparse input features of registration behavior fields and certificate attributes. A hyperparameter dynamic optimization algorithm is used to adjust the model parameters, an adaptive missing value handling strategy is implemented, and static feature classification results are output. Based on the static feature classification results, a time series model is used to analyze the dynamic features of DNS change sequences and traffic pattern time series data. An attention mechanism is introduced to focus on abnormal time windows and output a dynamic behavior risk score. Based on dynamic behavioral risk scoring, a graph neural network is used to construct an associated feature graph. The input domain name-IP-web page body triplet is used to extract the features of neighboring nodes through graph sampling algorithm. An attention weighting mechanism is used to aggregate edge relationships and output an infrastructure associated risk graph. Based on static feature classification results, dynamic behavioral risk scores, and infrastructure-related risk maps, the three outputs are weighted and fused. Confidence is generated through a soft labeling mechanism, and the class imbalance is optimized by a weighted cross-entropy loss function to output the original risk scoring model. Based on the original risk scoring model, a probability mapping transformation is implemented, and the classification boundary is optimized through an adaptive threshold adjustment mechanism to output a three-class risk scoring model.

[0012] Further, step S5: Based on the three-category risk scoring model, a set of high-risk domains is selected from unmarked expired domains through reasoning. By continuously monitoring the evolution of webpage content, DNS resolution, and third-party tags during the re-availability phase, dynamic alerts are triggered when illegal keywords, high-risk IP addresses, or records updated by third-party risk tags are detected, including: Based on the three-class risk scoring model, batch reasoning is performed on unmarked expired domains. The domain feature vector is input into the model to obtain risk scores and classification labels. Domains with a probability value significantly higher than the random probability are selected to form a set of high-risk domains, and the set of high-risk domains is output. Based on a set of high-risk domain names, monitoring is performed in stages during the domain name availability phase. In the early stage of availability, web page content, DNS resolution records, and third-party risk labels are collected in real time. During the stable availability period, the above data is collected incrementally every day and the evolution path is recorded, and a domain behavior evolution log is output. Based on domain behavior evolution logs, multi-dimensional risk verification is performed. Prohibited text features are detected through webpage content scanning, high-risk IP addresses are identified through DNS resolution analysis, and threat marking records from authoritative platforms are queried through third-party tag verification. Threat behavior verification reports are then output. Based on threat behavior verification reports, tiered early warnings are implemented. Policy configuration generates alarm events according to predefined rules, threshold adjustment dynamically optimizes risk score thresholds through reinforcement learning, and pushes them to the security platform through preset notification channels, outputting early warning event records and handling feedback.

[0013] Secondly, a multi-period feature fusion analysis system based on expired domain names includes: The acquisition module is used to obtain the registration time and expiration time of a domain name in real time through the domain name registration information, filter expired domain names based on the current time, and integrate the expired domain name list published by third-party platforms. After deduplication and standardization, an initial set of expired domain names is generated. The multi-dimensional module is used to collect historical information, information on the pending renewal stage, and information on the re-availability stage based on the initial set of expired domain names, and generate a multi-dimensional time-series dataset covering the entire life cycle of the domain name. The annotation module is used to extract character features, content features, change pattern features and time correlation features based on multi-dimensional time series datasets. Combined with the domain name's behavior during the stable availability period, it identifies and labels the domain name into three categories: high risk, potential risk or normal through manual and automated identification, and outputs a set of labeled high-dimensional feature vectors. The classification module is used to process static features based on a high-dimensional feature vector set, use gradient boosting trees to process static features, time series models to analyze dynamic features, and graph neural networks to mine associated features. It optimizes class imbalance through soft labeling mechanism and weighted loss function, and outputs a probability-calibrated three-class risk scoring model. The early warning module is used to infer and filter a set of high-risk domains from unmarked expired domains based on a three-category risk scoring model. By continuously monitoring the evolution of web page content, DNS resolution, and third-party tags during the re-availability phase, dynamic early warnings are triggered when illegal keywords, high-risk IP addresses, or records updated by third-party risk tags are detected.

[0014] Thirdly, a computing device includes: One or more processors; A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to implement the method.

[0015] Fourthly, a computer-readable storage medium storing a program that, when executed by a processor, implements the method.

[0016] The above-described solution of the present invention has at least the following beneficial effects: Through multi-source data collection, deduplication and standardization, and dynamic updates, the integrity, accuracy, and timeliness of the initial expired domain name set are ensured. Simultaneously, multi-stage information collection covering the entire domain name lifecycle is employed to further extract four types of features: characters, content, change patterns, and time correlations. These features are then combined with manual and automated annotation to form high-dimensional feature vectors, enabling in-depth analysis of domain name behavior and overcoming the limitations of single-feature analysis. By integrating gradient boosting trees, time-series models, and graph neural networks, the class imbalance problem is specifically optimized. The output three-class risk scoring model, after probability calibration, can effectively identify high-risk domain names in the initial stages of availability, improving the accuracy of risk prediction. Through high-risk domain name screening, continuous dynamic monitoring, and multi-dimensional risk verification, combined with a tiered early warning mechanism, risks can be detected and warnings triggered before domain names are used for abnormal technical activities. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating a multi-period feature fusion analysis method based on expired domain names provided in an embodiment of the present invention.

[0018] Figure 2 This is a schematic diagram of a multi-period feature fusion analysis system based on expired domain names provided by an embodiment of the present invention. Detailed Implementation

[0019] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0020] like Figure 1 As shown, an embodiment of the present invention proposes a multi-period feature fusion analysis method based on expired domain names, the method comprising the following steps: Step S1: Obtain the registration time and expiration time of the domain name in real time through the domain name registration information, filter expired domain names based on the current time, and integrate the expired domain name list published by third-party platforms. After deduplication and standardization, generate an initial set of expired domain names. Step S2: Based on the initial set of expired domain names, collect historical information, information on the pending renewal stage, and information on the re-availability stage in stages to generate a multi-dimensional time-series dataset covering the entire lifecycle of the domain name; Step S3: Based on the multi-dimensional time series dataset, extract character features, content features, change pattern features and time correlation features. Combined with the domain name's behavior during the stable availability period, identify and label it into three categories: high risk, potential risk or normal through manual and automated identification, and output a set of labeled high-dimensional feature vectors. Step S4: Based on the high-dimensional feature vector set, gradient boosting tree is used to process static features, time series model is used to analyze dynamic features, and graph neural network is used to mine associated features. The class imbalance is optimized through soft labeling mechanism and weighted loss function, and a probability-calibrated three-class risk scoring model is output. Step S5: Based on the three-class risk scoring model, infer and filter the set of high-risk domains from unmarked expired domains. By continuously monitoring the evolution of web page content, DNS resolution, and third-party tags during the re-availability phase, a dynamic warning is triggered when illegal keywords, high-risk IP pointing, or records updated by third-party risk tags are detected.

[0021] In this embodiment of the invention, by comprehensively collecting and standardizing expired domain name information and integrating multi-dimensional time-series data throughout the entire lifecycle, the integrity and accuracy of the data source for analysis are ensured. By extracting multi-dimensional features such as characters, content, and change patterns and combining manual and automated annotation, in-depth analysis of domain name behavior is achieved, avoiding the one-sidedness of analysis caused by single features. By integrating technologies such as gradient boosting trees, time-series models, and graph neural networks, the problem of category imbalance is specifically optimized, and the output three-classification model can accurately identify high-risk domain names in the early stages of availability, improving the accuracy of risk prediction. Through continuous monitoring and dynamic early warning mechanisms in the re-availability stage, risks can be detected and proactively warned before the domain name is used for threatening activities, improving the ability to prevent and control risks related to expired domain names.

[0022] In a preferred embodiment of the present invention, step S1 above: obtaining the registration time and expiration time of domain names in real time through domain name registration information, filtering expired domain names based on the current time, and integrating the expired domain name list published by third-party platforms, generating an initial set of expired domain names after deduplication and standardization processing, may include: Step S11: Obtain the registration time and expiration time of the domain name in real time. By comparing the current time with the expiration time, filter out the domain names that have expired but have not entered the release period, and generate the first subset of expired domain names. Step S12: Obtain the list of domains to be released from the third-party platform. Based on the first subset of expired domains, perform deduplication on the third-party list, remove domains that are duplicated with the first subset, and generate a deduplicated second subset of expired domains. Step S13: Based on the first subset of expired domain names and the second subset of expired domain names, the timestamps are unified to UTC format, the registrar names are mapped to ICANN standard encoding, and the domain name format is standardized, i.e., lowercase conversion and Punycode encoding processing, to generate the initial set of expired domain names. Step S14: Based on the initial set of expired domain names, continuously monitor changes in domain name status, remove domain names that are renewed within the grace period, mark domain names that have entered the release period as objects to be re-registered, and output a dynamically updated set of initial expired domain names.

[0023] In this embodiment of the invention, data accuracy is improved by using time threshold filtering and deduplication to ensure the reliability of domain name status in the set and avoid low-quality data interfering with subsequent analysis; data integrity is ensured by integrating proprietary monitoring data with third-party platform data, covering expired domain names from different sources to reduce sample omissions; the standardization foundation is strengthened by unifying time format, registrar code, and domain name format, providing consistent data specifications for subsequent multi-dimensional feature extraction and model training; and dynamic timeliness is maintained by continuously monitoring changes in domain name status and updating the set, ensuring that the data is synchronized with the actual lifecycle of the domain names to provide real-time effective samples required for forward-looking analysis.

[0024] In this embodiment of the invention, when applied in a specific way, it can be implemented through the following technical solutions, for example: In step S11 above, the registration time (e.g., "2023-01-15") and expiration time (e.g., "2024-01-15") are obtained in real time through the domain registration information interface. The current system time (e.g., "2024-02-20") is compared with the expiration time, and domains that meet the condition of expiration time < current time and are within the preset protection window are selected and determined to be in "expired and unreleased state", forming the first subset of expired domains.

[0025] In step S12 above, a list of domain names to be released (including domain names and release times) is obtained from the domain name data platform. The list is then compared with the first subset using string exact matching. After removing duplicate domain names, a second subset of expired domain names is generated.

[0026] In step S13 above, the domain name data of the first and second expired domain name subsets are standardized: Time formatting: Convert all timestamps to UTC standard (e.g., "2024-01-15T00:00:00Z"); Registrar Code Conversion: Map registrar names to the ICANN code table (e.g., "Registrar A" → "REGISTRAR_A"). Domain name normalization: convert full domain names to lowercase (e.g., "DOMAIN.COM" → "domain.com"), perform Punycode encoding on internationalized domain names (e.g., "example.com" → "xn--fsq.com"), and generate an initial set of expired domain names.

[0027] In step S14 above, the status of the domains in the initial set is periodically checked every 24 hours. The WHOIS information is used to determine whether there is a renewal record. If a renewal operation is detected within the grace period or redemption period, the domain is removed from the set. For domains that have exceeded the redemption period and have not been renewed, they are marked as "registerable" and their status labels are updated, thereby realizing the dynamic update of the initial expired domain set.

[0028] In a preferred embodiment of the present invention, step S2 above: based on the initial set of expired domain names, collecting historical information, information on the pending renewal stage, and information on the re-availability stage in stages to generate a multi-dimensional time-series dataset covering the entire lifecycle of the domain name, may include: Step S21: Based on the initial set of expired domain names, extract historical website content through the Internet Archive, obtain historical DNS records, digital certificates and risk labels by combining the passive DNS database and the threat analysis platform, and collect historical registration information based on the WHOIS historical database to generate a historical information dataset. Step S22: Based on the historical information dataset, WHOIS information, DNS records and web page content are collected for the grace period domain name at a first preset frequency, and relevant WHOIS information, DNS records and web page content are collected for the redemption period domain name at a second preset frequency, generating a time series dataset for the pending renewal stage. Step S23: Based on the time series dataset of the pending renewal stage, the domain name to be renewed or re-registered is monitored in stages. In the early stage of re-registration, registration information, DNS resolution records, web page content, digital certificate and third-party risk labels are collected daily. In the stable operation period, the above information is collected weekly and the evolution path is recorded to generate the time series dataset of the re-availability stage. Step S24: Based on the historical information dataset, the time series dataset of the pending renewal stage, and the time series dataset of the re-availability stage, align the three-stage time series by domain name subject, unify domain name registration information, DNS resolution records, web page content, digital certificate information, and third-party risk labels, standardize the timestamp interval, and generate a multi-dimensional time series dataset covering the entire life cycle of the domain name.

[0029] In this embodiment of the invention, full-cycle data coverage is achieved by collecting historical, pending renewal, and reusability information in stages, completely capturing the behavioral trajectory of a domain name from expiration to reuse to avoid missing data in key stages; the continuity of temporal features is ensured by unifying timestamp intervals and data alignment, ensuring that temporal data from different stages can be directly used for dynamic feature analysis to support the mining of time-related patterns; the richness of feature dimensions is improved by integrating multiple types of data such as registration information, DNS records, and web page content, providing comprehensive materials for subsequent extraction of features such as characters, content, and change patterns; and the data standardization foundation is strengthened by unifying field formats and label rules, reducing the interference of data heterogeneity on model training to improve the efficiency and accuracy of feature extraction.

[0030] In this embodiment of the invention, when applied in a specific way, it can be implemented through the following technical solutions, for example: Step S21 above involves retrieving and extracting historical website content snapshots of each domain from the WaybackMachine database, based on the initial set of expired domains. This snapshots cover the homepage structure, text content, and page layout at different points in time. It also involves obtaining historical DNS records (including resolution types such as A, AAAA, and CNAME, and their corresponding IP addresses), historical digital certificate data (fields such as issuing authority, validity period, and bound domain), and historical risk labels (reputation ratings and risk type markings of security vendors) from a passive DNS database and threat analysis platform (such as VirusTotal and Microstep Online). Simultaneously, it relies on a WHOIS historical database (such as WhoisXML) to collect historical registration information for the domains, including registrant identity, registrar name, registration time, and change records. This multi-dimensional information is then integrated and linked by domain name entity, removing duplicate data and supplementing missing key fields to generate a historical information dataset.

[0031] In step S22 above, based on the historical information dataset, information is collected from domains in the grace period at a first preset frequency (e.g., every 4 hours): WHOIS information (including changes in registrant contact information, registrar adjustments, etc.), DNS records (changes in IP address resolution, domain name server updates, etc.), and web page content (page text updates, structural adjustments, etc.). For domains entering the redemption period, similar information is collected at a second preset frequency (e.g., every 8 hours), including changes in registration status in WHOIS information, adjustments to DNS record resolution relationships, and changes in the accessibility of web page content. During the collection process, a precise timestamp is added to each piece of data to record the specific time of information change. Through time-series alignment processing, the collected data from the grace period and the redemption period are arranged in chronological order to generate a time-series dataset for the pending renewal stage.

[0032] Step S23 above involves monitoring domains that have completed renewal or re-registration in stages, based on the time-series dataset of the pending renewal phase: Initial availability (can be set via a custom time window, such as the first 7 days, 14 days, or 30 days): Daily collection of registration information (new registrant identity information, registrar attributes, registration time, etc.), DNS resolution records (resolution type, pointed IP address, and change frequency), webpage content (homepage structure, keyword distribution, page redirection characteristics, and reachability), digital certificate information (issuing authority, validity period, list of domains bound to the certificate, etc.), and third-party risk labels (real-time reputation scores and risk label updates from security vendors, etc.). Stable availability period (after exceeding the custom initial time window): Collect similar information weekly, focusing on recording the evolution path of the information, including changes in webpage content themes, adjustments to DNS resolution relationships, updates to digital certificates, and changes in third-party risk labels.

[0033] The collected data is organized according to time series, and a stage identifier is added to the information of each time node to generate a reusable stage time series dataset.

[0034] Step S24 above uses the domain name as a unique identifier to associate and align the historical information dataset, the time-series dataset for the pending renewal stage, and the time-series dataset for the re-availability stage, ensuring that the three stages of data for the same domain name can be connected sequentially in time. It unifies and integrates core data dimensions, including domain name registration information, DNS resolution records, web page content, digital certificate information, and third-party risk labels. It standardizes the timestamps of each stage and converts them into fixed time intervals (such as in hours). It fills in the feature values ​​of missing time periods using the average of adjacent time periods or the default value. It removes outliers (such as obviously incorrect IP addresses, registration information with incorrect format, etc.) through data cleaning, and finally generates a multi-dimensional time-series dataset covering the entire lifecycle of a domain name from historical use, pending renewal, to re-availability.

[0035] In a preferred embodiment of the present invention, step S3 above: based on a multi-dimensional time-series dataset, extracting character features, content features, change pattern features, and time-related features, and combining the domain name's behavior during a stable availability period, manually and automatically identifying and labeling it into three categories: high risk, potential risk, or normal, and outputting a set of labeled high-dimensional feature vectors, may include: Step S31: Based on the multi-dimensional time series dataset, perform four types of feature extraction, namely, parsing the character features of domain name length, top-level domain type, random character ratio and inducement words, statistically analyzing the content features of historical risk label type and frequency, certificate update frequency, and the proportion of risky domains with the same IP, calculating the DNS record change frequency, tracking the evolution path of web page content from blank page to illegal page, measuring the time correlation features of registration to DNS effective time, risk label appearance time point and behavior outbreak cycle, and generating the original feature vector set; Step S32: Based on the original feature vector set, verify the behavior of the domain name during the stable availability period, automatically scan the web page content, call the threat intelligence interface to obtain risk label updates, record the blacklist hit records of DNS resolution IPs, and generate a behavior verification report. Step S33: Based on the behavior verification report, generate domain risk classification labels through automated identification combined with manual review: when a webpage contains content prohibited by law or has verifiable technical abuse behavior, it is marked as a high-risk domain; when there are historical suspicious features but no current clear technical evidence, it is marked as a potentially risky domain; when there are no risk features and the service content is compliant, it is marked as a normal domain. Step S34: Based on the original feature vector set and the domain name risk classification label, the character features, content features, change pattern features and time correlation features are merged into a unified vector according to the domain name subject. The main feature components with a set variance contribution rate are retained through principal component analysis, and a labeled feature vector set is generated after associating the classification label.

[0036] In this embodiment of the invention, by extracting character features, content features, change pattern features, and time-related features, the system achieves complete capture of multi-dimensional features throughout the entire lifecycle of a domain name, avoiding the limitations of a single feature dimension. Verification is performed by combining the domain name's behavior during its stable availability period. Through automated scanning and threat intelligence interface calls, the latest risk information and behavioral evidence are obtained in real time, ensuring consistency between features and the actual behavior of the domain name. A labeling method combining automated identification and manual review leverages the efficiency of automated processing while ensuring the accuracy of the labels through manual verification. Clear definitions of "high risk," "potential risk," and "normal" make the labels more closely reflect the actual risk state, providing high-quality supervisory samples for subsequent model training. Principal component analysis is used to retain key feature components, reducing data redundancy and computational complexity while preserving the core discriminative information of the features.

[0037] In this embodiment of the invention, when applied in a specific way, it can be implemented through the following technical solutions, for example: In step S31 above, based on the multi-dimensional time-series dataset, four types of feature extraction are performed: Character features: resolve domain name length (number of characters), top-level domain type (distinguishing between general top-level domains, country code top-level domains, etc.), proportion of random characters (proportion of irregular characters in the domain name), number of semantically meaningless character combinations, mis-spelling disguise, presence of misleading words (such as vulgar or misleading words), and batch generation features (such as batch domain name features with increasing / decreasing numbers), forming a subset of character features; Content features: Statistically analyze the types and frequency of historical risk tags (such as phishing and illegal content related tags), calculate the average frequency and validity period of digital certificates, analyze the risk ratio of domains under the same IP (the ratio of the number of risky domains to the total number of domains under the same IP), extract the types of historical web page content (such as commercial, information, and illegal content related) and the frequency of change, and form a subset of content features; Change pattern characteristics: Calculate the change frequency and time interval of DNS records (A, NS, CNAME, etc.), track the evolution path of web page content from the initial state (such as blank page, landing page) to the subsequent state (such as content change, structural adjustment), record the number of registrar migrations, certificate replacement patterns and clustered changes of resolved IPs, and form a subset of change pattern characteristics; Time-related features: Measure the time from registration completion to the first effective date of DNS, the time point when the risk label first appears, and the time window of concentrated behavior outbreaks (such as the density of DNS changes / content updates within a certain period). Statistically analyze the concentration of subdomain creation time and its correlation with the registration time of other domains to form a subset of time-related features. The above four feature subsets are integrated, duplicate features are removed and missing values ​​are added to generate the original feature vector set.

[0038] Step S32 above verifies the domain name's behavior during its stable availability period from multiple dimensions, based on the original feature vector set: Automated scanning of web page content, identification of page text keywords, structural templates and redirection features, and recording of content compliance (such as whether it contains illegal descriptions or false information); Call third-party threat intelligence interfaces (such as security vendor reputation platforms and compliance detection systems) to obtain the latest risk label updates for domain names and blacklist hit records of associated IPs; Continuously monitor DNS resolution records, track historical risk records and current service types pointing to IP addresses, and verify the stability and compliance of resolution. Based on the above monitoring results, a behavioral verification report is generated that includes content compliance, external risk tags, and IP security analysis.

[0039] In step S33 above, based on the behavior verification report, a domain name risk classification label is generated through automated identification combined with manual review. When automated scanning detects that a webpage contains content prohibited by law (such as illegal information or false and fraudulent descriptions), or exhibits verifiable technical abuse (such as continuously pointing to high-risk IPs or being marked as illegal by multiple platforms), it will be labeled as "high-risk" after manual review and confirmation. When there are historically suspicious characteristics (such as previous association with risk labels or abnormal DNS changes) but there is currently no clear technical evidence (such as compliant webpage content or not being marked by the latest risk labels), they are marked as "potential risks" and are designated as key targets for tracking. When there are no risk characteristics, the service content is compliant (such as an official website or legitimate commercial service), the DNS resolution is stable and not listed on any risk list, and it is verified to comply with Internet usage regulations, it is marked as "normal".

[0040] In step S34 above, based on the original feature vector set and the domain name risk classification label, character features, content features, change pattern features, and time correlation features are merged according to the domain name as the unique identifier to form a feature vector of unified dimension; Principal component analysis (PCA) algorithm is used to reduce the dimensionality of the high-dimensional features, retaining the main feature components with a set variance contribution rate (such as 95%) to reduce feature redundancy; the dimensionality-reduced feature vector is associated and bound with the corresponding "high risk", "potential risk", and "normal" classification labels to generate a set of labeled high-dimensional feature vectors.

[0041] In a preferred embodiment of the present invention, step S4 above: based on a high-dimensional feature vector set, using gradient boosting trees to process static features, time-series models to analyze dynamic features, and graph neural networks to mine associated features, optimizing class imbalance through a soft labeling mechanism and a weighted loss function, and outputting a probability-calibrated three-class risk scoring model, may include: Step S41: Based on the high-dimensional feature vector set, the sparse input features of the registration behavior field and certificate attribute are processed by the gradient boosting tree model. The model parameters are adjusted by the hyperparameter dynamic optimization algorithm, the missing value adaptive processing strategy is implemented, and the static feature classification result is output. Step S42: Based on the static feature classification results, use a time series model to analyze the dynamic features of DNS change sequences and traffic pattern time series data, introduce an attention mechanism to focus on abnormal time windows, and output a dynamic behavior risk score; Step S43: Based on dynamic behavioral risk scoring, construct an associated feature map using a graph neural network. Input the domain name-IP-web page body triplet, extract the features of neighboring nodes through a graph sampling algorithm, aggregate edge relationships using an attention weighting mechanism, and output an infrastructure associated risk map. Step S44: Based on the static feature classification results, dynamic behavioral risk scores and infrastructure-related risk maps, the three outputs are weighted and fused. Confidence is generated through a soft labeling mechanism, and the class imbalance is optimized using a weighted cross-entropy loss function to output the original risk scoring model. Step S45: Based on the original risk scoring model, perform probability mapping transformation, optimize the classification boundary through an adaptive threshold adjustment mechanism, and output a three-class risk scoring model.

[0042] In this embodiment of the invention, a gradient boosting tree is used to specifically handle static features such as registration behavior and certificate attributes, while a time-series model focuses on dynamic features such as DNS changes and traffic patterns. A graph neural network mines the association features between domain name, IP address, and webpage body, achieving specialized processing of different types of features. An attention mechanism is introduced into the time-series model, which can accurately focus on abnormal time windows in dynamic data such as DNS changes and traffic fluctuations, enhancing the sensitivity to dynamic risks in the early disguise stage of domain names and solving the problem of insufficient attention to key abnormal periods in traditional time-series analysis. By constructing a domain name-IP address-webpage body triple association graph and combining graph sampling and attention weighting mechanisms, the graph neural network can effectively identify hidden infrastructure association patterns, breaking through the limitations of single domain name feature analysis. A soft label mechanism is used to generate dynamic confidence scores, and a weighted cross-entropy loss function is used to assign differentiated weights to samples of different categories, solving the model bias problem caused by the low proportion of high-risk domain name samples. Through probability mapping transformation and adaptive threshold adjustment, the risk score output by the model is closer to the actual risk probability, and the classification boundary can be dynamically optimized according to the business scenario.

[0043] In this embodiment of the invention, when applied in a specific way, it can be implemented through the following technical solutions, for example: In step S41 above, based on the high-dimensional feature vector set, static features such as registration behavior fields (e.g., registrant information, registrar attributes, registration duration) and certificate attributes (e.g., issuing authority, validity period, number of bound domains) are extracted and input into the gradient boosting tree model for processing. The TPE hyperparameter dynamic optimization algorithm is used to automatically adjust key parameters such as tree depth (limited to 5-8 layers) and the number of leaf nodes, and the optimal value is determined by the evolutionary algorithm CMA-ES. For missing values ​​in the features, the XGBoost missing value splitting direction automatic learning strategy is used to replace fixed value filling, improve the classification accuracy of sparse features, and output static feature classification results (including the preliminary judgment probability of three categories: "high risk", "potential risk" and "normal").

[0044] In step S42 above, based on the static feature classification results, DNS change sequences (such as the frequency of IP address changes and domain name server adjustment times) and traffic pattern time series data (such as fluctuations in access volume and changes in geographical distribution) are selected as dynamic features and input into the time series model for analysis. An attention-based parameter optimization algorithm is introduced to identify abnormal time windows (such as periods where the number of resolutions exceeds three times the historical average within 24 hours) through EWMA dynamic baseline calculation and assign them higher weights. For the periodic features in the traffic data, a seasonal decomposition method combining STL and Prophet is used to extract abnormal fluctuations in the main trend and residuals, enhance the ability to capture dynamic risks, and output a dynamic behavior risk score (0-100 points, with higher scores indicating higher risks).

[0045] In step S43 above, based on dynamic behavioral risk scoring, a domain-IP-webpage body triplet association feature graph is constructed: the domain name is the core node, the IP and webpage body are the association nodes, and the resolution relationship and service pointing are the edge relationships; the neighbor sampling strategy of GraphSAGE is adopted to extract multi-level neighborhood features of each node (such as the historical risk records of IP associated with the domain name and the content template features of the webpage body); through the attention weighting mechanism of Graph Attention Network (GAT), differentiated weights are assigned to edge relationships (such as the resolution frequency of domain name and IP and the content association degree between webpage body and domain name), and the importance of nodes is dynamically adjusted by combining the PageRank algorithm (such as increasing the weight of domain names that frequently associate with high-risk IPs), and an infrastructure association risk map containing node risk values ​​and association strength is output.

[0046] In step S44 above, based on the static feature classification results, dynamic behavioral risk scores, and infrastructure-related risk maps, the three outputs are fused according to preset weights (e.g., 30% for static features, 30% for dynamic scores, and 40% for the related maps) to generate a comprehensive feature vector. A dynamic confidence level is generated through a soft label mechanism: for domains in "undetermined states," the KNN algorithm is used to calculate their feature similarity to known risk domains, generating soft labels between 0 and 1 (the higher the similarity, the closer the label value is to 1). The labels are then updated using the prediction results of behavior change trends from a Long Short-Term Memory (LSTM) network. A weighted cross-entropy loss function is used to dynamically adjust the weights based on the real-time sample distribution (when the proportion of "high-risk" samples is less than 5%, the weight is increased to 3-5 times that of normal samples). Combined with focus loss, higher weights are assigned to difficult-to-classify samples (soft labels close to 0.5) to optimize the class imbalance problem and output the original risk scoring model.

[0047] In step S45 above, based on the original risk scoring model, Platt scaling is used for probability mapping transformation. The original score is fitted to a confidence value that closely approximates the actual risk probability through logistic regression (e.g., a score of 0.7 corresponds to a 70% probability of "high risk"). A reinforcement learning optimization algorithm (e.g., Q-learning) is introduced to adaptively adjust the classification boundary threshold based on feedback from different business scenarios (e.g., false alarm rate control targets in highly sensitive industries). For domains in the "slow tracking queue," an autoregressive integral moving average model is used to dynamically optimize the threshold based on feature changes during the tracking period. Finally, a probability-calibrated three-class risk scoring model is output, which can directly identify domains with "high risk," "potential risk," and "normal" tendencies in the initial stage of availability.

[0048] In a preferred embodiment of the present invention, step S5 above: Based on a three-class risk scoring model, a set of high-risk domain names is selected by reasoning from unmarked expired domain names. Through continuous monitoring of webpage content, DNS resolution, and the evolution of third-party tags during the re-availability phase, a dynamic warning is triggered when illegal keywords, high-risk IP addresses, or records updated by third-party risk tags are detected. This may include: Step S51: Based on the three-class risk scoring model, perform batch reasoning on unmarked expired domains, input domain feature vectors into the model to obtain risk scores and classification labels, filter domains whose probability values ​​for classifying them as high-risk categories are significantly higher than random probabilities to form a set of high-risk domains, and output the set of high-risk domains. Step S52: Based on the set of high-risk domain names, monitoring is performed in stages during the domain name availability phase. In the early stage of availability, web page content, DNS resolution records, and third-party risk labels are collected in real time. During the stable availability period, the above data is collected incrementally every day and the evolution path is recorded, and the domain behavior evolution log is output. Step S53: Based on the domain behavior evolution log, perform multi-dimensional risk verification, detect prohibited text features by scanning web page content, identify high-risk IP points by DNS resolution analysis, query threat marking records from authoritative platforms by third-party tag verification, and output a threat behavior verification report; Step S54: Based on the threat behavior verification report, execute graded early warning. The policy configuration generates alarm events according to predefined rules, the threshold adjustment dynamically optimizes the risk score threshold through reinforcement learning, and pushes it to the security platform through preset notification channels. The early warning event record and handling feedback are output.

[0049] In this embodiment of the invention, a three-category risk scoring model is used to perform batch reasoning on unmarked expired domains. Based on risk scores and classification labels, a set of high-risk domains is selected, which can accurately identify targets with high-risk evolutionary tendencies and avoid ineffective monitoring of low-risk domains. During the domain reavailability stage, a phased monitoring strategy is implemented. Key data is collected in real time in the early stage of availability to capture early anomalies, and the evolution path is recorded incrementally every day during the stable availability period, realizing full-process behavior tracking of domains from initial use to long-term operation. Through multi-dimensional risk verification, combined with prohibited text recognition, high-risk IP comparison, and authoritative platform marking queries, risks are cross-verified from multiple levels such as content compliance, infrastructure relevance, and external reputation, effectively reducing the bias of single-dimensional judgment. Through graded early warning and multi-channel push, the early warning response is made more efficient, and combined with dynamic threshold adjustment to adapt to different scenario needs, the forward-looking interception capability is improved.

[0050] In this embodiment of the invention, when applied in a specific way, it can be implemented through the following technical solutions, for example: In step S51 above, based on the three-class risk scoring model, batch reasoning is performed on unlabeled expired domains: extracting character features, content features, change pattern features, and time correlation features of the domains to be detected, constructing feature vectors and inputting them into the model, obtaining the risk score (0-100 points) and three classification labels of "high risk", "potential risk" and "normal" for each domain; setting a high-risk screening threshold (e.g., risk score ≥ 70 points and classification label "high risk"), filtering out domains with a probability value significantly higher than that of random distribution, forming a high-risk domain set, ensuring that the domains in the set have a clear high-risk evolution tendency, and outputting the set for subsequent key monitoring.

[0051] Step S52 above implements a phased monitoring mechanism based on the set of high-risk domain names during the domain name availability phase: In the initial usability period (e.g., the first 30 days): Real-time collection of web page content (homepage text, structure template, redirect links), DNS resolution records (resolving IP addresses, domain name servers, record type changes), and third-party risk labels (security vendor reputation ratings, compliance platform markings), generating monitoring snapshots every hour; Stable availability period (e.g., more than 30 days): Collect the above information incrementally every day, focusing on recording the evolution path (e.g., changes in web page content theme, IP address switching, and third-party tag update trajectory), form a continuous behavior sequence through time alignment, and output a domain behavior evolution log containing timestamps, feature values, and change descriptions.

[0052] Step S53 above performs multi-dimensional risk verification based on domain behavior evolution logs: Webpage content scanning: NLP text analysis technology is used to identify prohibited text features (such as illegal information, false descriptions, and misleading content), combined with image recognition to detect non-compliant image elements and mark the content risk level; DNS resolution analysis: Compare the resolved IP with a known high-risk IP database (including historical violation records and abnormal service clusters) to identify frequently changing IP addresses and cross-domain IP sharing patterns, and determine the risk of resolution association. Third-party tag verification: Call the interface of authoritative security platform (such as compliance detection system, reputation database) to query the latest threat tag records of domain name and associated IP (such as illegal service labeling, risk list inclusion) to verify the correlation with external risks; Based on the above results, a threat behavior verification report is output, which includes the risk type, strength of evidence, and correlation characteristics.

[0053] In step S54 above, based on the threat behavior verification report, a tiered early warning mechanism is executed: Policy configuration: Generate alert events according to predefined rules, such as webpages containing prohibited keywords with a matching degree of ≥80%, pointing to high-risk IPs for 24 consecutive hours, or being marked as violating by more than 3 authoritative platforms; Threshold adjustment: Through reinforcement learning algorithms, the risk score threshold is dynamically optimized based on historical handling results (such as early warning accuracy and response time). For example, the threshold for high-sensitivity scenarios is lowered to 60 points, while the threshold for general scenarios is maintained at 70 points. Notification push: Push warning events through preset channels (internal system message center, SMS, email, API connection security operation platform), including domain information, risk evidence, evolution path and handling suggestions; Record the reception status, processing results, and feedback of early warning events to form a closed-loop management system, and output early warning event records and handling feedback reports.

[0054] like Figure 2 As shown, embodiments of the present invention also provide a multi-period feature fusion analysis system based on expired domain names, comprising: The acquisition module is used to obtain the registration time and expiration time of a domain name in real time through the domain name registration information, filter expired domain names based on the current time, and integrate the expired domain name list published by third-party platforms. After deduplication and standardization, an initial set of expired domain names is generated. The multi-dimensional module is used to collect historical information, information on the pending renewal stage, and information on the re-availability stage based on the initial set of expired domain names, and generate a multi-dimensional time-series dataset covering the entire life cycle of the domain name. The annotation module is used to extract character features, content features, change pattern features and time correlation features based on multi-dimensional time series datasets. Combined with the domain name's behavior during the stable availability period, it identifies and labels the domain name into three categories: high risk, potential risk or normal through manual and automated identification, and outputs a set of labeled high-dimensional feature vectors. The classification module is used to process static features based on a high-dimensional feature vector set, use gradient boosting trees to process static features, time series models to analyze dynamic features, and graph neural networks to mine associated features. It optimizes class imbalance through soft labeling mechanism and weighted loss function, and outputs a probability-calibrated three-class risk scoring model. The early warning module is used to infer and filter a set of high-risk domains from unmarked expired domains based on a three-category risk scoring model. By continuously monitoring the evolution of web page content, DNS resolution, and third-party tags during the re-availability phase, dynamic early warnings are triggered when illegal keywords, high-risk IP addresses, or records updated by third-party risk tags are detected.

[0055] It should be noted that this system is a system corresponding to the above method. All implementation methods in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0056] Embodiments of the present invention also provide a computing device, including: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the method described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0057] Embodiments of the present invention also provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the method described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effects.

[0058] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for multi-period feature fusion analysis based on expired domain names, characterized in that, The method includes: Step S1: Obtain the registration time and expiration time of the domain name in real time through the domain name registration information, filter expired domain names based on the current time, and integrate the expired domain name list published by third-party platforms. After deduplication and standardization, generate an initial set of expired domain names. Step S2: Based on the initial set of expired domain names, collect historical information, information on the pending renewal stage, and information on the re-availability stage in stages to generate a multi-dimensional time-series dataset covering the entire lifecycle of the domain names, including: Based on the initial set of expired domain names, historical website content is extracted from the Internet Archive, and historical DNS records, digital certificates, and risk labels are obtained by combining the passive DNS database and the threat analysis platform. Historical registration information is also collected based on the WHOIS historical database to generate a historical information dataset. Based on historical information datasets, WHOIS information, DNS records, and web page content are collected for grace period domains at a first preset frequency, and relevant WHOIS information, DNS records, and web page content are collected for redemption period domains at a second preset frequency, generating a time-series dataset for the pending renewal stage. Based on the time series dataset of the pending renewal stage, the domain name renewal or re-registration is monitored in stages. In the early stage of re-availability, registration information, DNS resolution records, web page content, digital certificate and third-party risk labels are collected daily. In the stable availability period, the above information is collected weekly and the evolution path is recorded to generate the time series dataset of the re-availability stage. Based on historical information datasets, time series datasets of the pending renewal stage, and time series datasets of the re-availability stage, the three-stage time series are aligned by domain name subject, and domain name registration information, DNS resolution records, web page content, digital certificate information, and third-party risk labels are unified. The timestamp interval is standardized to generate a multi-dimensional time series dataset covering the entire life cycle of a domain name. Step S3: Based on the multi-dimensional time series dataset, extract character features, content features, change pattern features and time correlation features. Combined with the domain name's behavior during the stable availability period, identify and label it into three categories: high risk, potential risk or normal through manual and automated identification, and output a set of labeled high-dimensional feature vectors. Step S4: Based on the high-dimensional feature vector set, gradient boosting tree is used to process static features, time series model is used to analyze dynamic features, and graph neural network is used to mine associated features. The class imbalance is optimized through soft labeling mechanism and weighted loss function, and a probability-calibrated three-class risk scoring model is output. Step S5: Based on the three-class risk scoring model, infer and filter the set of high-risk domains from unmarked expired domains. By continuously monitoring the evolution of web page content, DNS resolution, and third-party tags during the re-availability phase, a dynamic warning is triggered when illegal keywords, high-risk IP pointing, or records updated by third-party risk tags are detected.

2. The multi-period feature fusion analysis method based on expired domain names according to claim 1, characterized in that, Step S1: Obtain the registration and expiration dates of domain names in real time through domain registration information. Filter expired domain names based on the current time, and integrate expired domain name lists published by third-party platforms. After deduplication and standardization, generate an initial set of expired domain names, including: The system obtains the registration time and expiration time of domain names in real time. By comparing the current time with the expiration time, it filters out domain names that have expired but have not yet entered the release period, and generates the first subset of expired domain names. Obtain a list of domains to be released from a third-party platform. Based on the first subset of expired domains, deduplicate the third-party list, remove domains that are duplicated with the first subset, and generate a second subset of expired domains after deduplication. Based on the first and second subsets of expired domain names, timestamps are unified to UTC format, registrar names are mapped to ICANN standard encoding, and domain name format is standardized by lowercase conversion and Punycode encoding to generate an initial set of expired domain names. Based on the initial set of expired domain names, the system continuously monitors changes in domain name status, removes domain names that are renewed within the grace period, marks domain names that have entered the release period as objects to be re-registered, and outputs a dynamically updated set of initial expired domain names.

3. The multi-period feature fusion analysis method based on expired domain names according to claim 2, characterized in that, Step S3: Based on the multi-dimensional time-series dataset, extract character features, content features, change pattern features, and time-related features. Combined with the domain's behavior during a stable availability period, classify it into three categories—high-risk, potential-risk, or normal—through both manual and automated identification. Output a set of labeled high-dimensional feature vectors, including: Based on a multi-dimensional time-series dataset, four types of feature extraction are performed: character features of parsing domain name length, top-level domain type, proportion of random characters and inducement words; content features of historical risk label type and frequency, certificate update frequency and proportion of risky domains with the same IP address; DNS record change frequency and the change pattern of web page content from blank page to illegal page; and time correlation features of registration to DNS effective time, risk label appearance time and behavior outbreak cycle are measured to generate an original feature vector set. Based on the original feature vector set, the behavior of the domain name during the stable availability period is verified, the web page content is automatically scanned, the threat intelligence interface is called to obtain risk label updates, the blacklist hit records of DNS resolution IPs are recorded, and a behavior verification report is generated. Based on the aforementioned behavior verification report, domain risk classification labels are generated through automated identification combined with manual review: domains containing legally prohibited content or exhibiting verifiable technical abuse are labeled as high-risk domains; domains with historically suspicious characteristics but no current clear technical evidence are labeled as potentially risky domains; and domains without risk characteristics and whose service content is compliant are labeled as normal domains. Based on the original feature vector set and domain risk classification labels, character features, content features, change pattern features, and time correlation features are merged into a unified vector according to the domain name subject. Principal component analysis is used to retain the main feature components with a set variance contribution rate. After associating with classification labels, a set of labeled feature vectors is generated.

4. The multi-period feature fusion analysis method based on expired domain names according to claim 3, characterized in that, Step S4: Based on the high-dimensional feature vector set, gradient boosting trees are used to process static features, time-series models are used to analyze dynamic features, and graph neural networks are used to mine associated features. Class imbalance is optimized through a soft-label mechanism and a weighted loss function, outputting a probability-calibrated three-class risk scoring model, including: Based on a high-dimensional feature vector set, a gradient boosting tree model is used to process sparse input features of registration behavior fields and certificate attributes. A hyperparameter dynamic optimization algorithm is used to adjust the model parameters, an adaptive missing value handling strategy is implemented, and static feature classification results are output. Based on the static feature classification results, a time series model is used to analyze the dynamic features of DNS change sequences and traffic pattern time series data. An attention mechanism is introduced to focus on abnormal time windows and output a dynamic behavior risk score. Based on dynamic behavioral risk scoring, a graph neural network is used to construct an associated feature graph. The input domain name-IP-web page body triplet is used to extract the features of neighboring nodes through graph sampling algorithm. An attention weighting mechanism is used to aggregate edge relationships and output an infrastructure associated risk graph. Based on static feature classification results, dynamic behavioral risk scores, and infrastructure-related risk maps, the three outputs are weighted and fused. Confidence is generated through a soft labeling mechanism, and the class imbalance is optimized by a weighted cross-entropy loss function to output the original risk scoring model. Based on the original risk scoring model, a probability mapping transformation is implemented, and the classification boundary is optimized through an adaptive threshold adjustment mechanism to output a three-class risk scoring model.

5. The multi-period feature fusion analysis method based on expired domain names according to claim 4, characterized in that, Step S5: Based on the three-category risk scoring model, a set of high-risk domains is selected from unmarked expired domains through reasoning. During the re-availability phase, the evolution of webpage content, DNS resolution, and third-party tags is continuously monitored. When illegal keywords, high-risk IP addresses, or updated records of third-party risk tags are detected, dynamic alerts are triggered, including: Based on the three-class risk scoring model, batch reasoning is performed on unmarked expired domains. The domain feature vector is input into the model to obtain risk scores and classification labels. Domains with a probability value significantly higher than the random probability are selected to form a set of high-risk domains, and the set of high-risk domains is output. Based on a set of high-risk domain names, monitoring is performed in stages during the domain name re-availability phase. In the early stage of re-availability, web page content, DNS resolution records, and third-party risk labels are collected in real time. During the stable availability period, the above information is collected incrementally every day and the evolution path is recorded, and a domain behavior evolution log is output. Based on domain behavior evolution logs, multi-dimensional risk verification is performed. Prohibited text features are detected through webpage content scanning, high-risk IP addresses are identified through DNS resolution analysis, and threat marking records from authoritative platforms are queried through third-party tag verification. Threat behavior verification reports are then output. Based on threat behavior verification reports, tiered early warnings are implemented. Policy configuration generates alarm events according to predefined rules, threshold adjustment dynamically optimizes risk score thresholds through reinforcement learning, and pushes them to the security platform through preset notification channels, outputting early warning event records and handling feedback.

6. A multi-period feature fusion analysis system based on expired domain names, wherein the system implements the method as described in any one of claims 1 to 5, characterized in that, include: The acquisition module is used to obtain the registration time and expiration time of a domain name in real time through the domain name registration information, filter expired domain names based on the current time, and integrate the expired domain name list published by third-party platforms. After deduplication and standardization, an initial set of expired domain names is generated. The multi-dimensional module is used to collect historical information, information on the pending renewal stage, and information on the re-availability stage based on the initial set of expired domain names, and generate a multi-dimensional time-series dataset covering the entire life cycle of the domain name. The annotation module is used to extract character features, content features, change pattern features and time correlation features based on multi-dimensional time series datasets. Combined with the domain name's behavior during the stable availability period, it identifies and labels the domain name into three categories: high risk, potential risk or normal through manual and automated identification, and outputs a set of labeled high-dimensional feature vectors. The classification module is used to process static features based on a high-dimensional feature vector set, use gradient boosting trees to process static features, time series models to analyze dynamic features, and graph neural networks to mine associated features. It optimizes class imbalance through soft labeling mechanism and weighted loss function, and outputs a probability-calibrated three-class risk scoring model. The early warning module is used to infer and filter a set of high-risk domains from unmarked expired domains based on a three-category risk scoring model. By continuously monitoring the evolution of web page content, DNS resolution, and third-party tags during the re-availability phase, dynamic early warnings are triggered when illegal keywords, high-risk IP addresses, or records updated by third-party risk tags are detected.

7. A computing device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program that, when executed by a processor, implements the method as described in any one of claims 1 to 5.

Images