Domain name abuse detection method and device, electronic equipment and storage medium

Abstract

The invention provides a domain name abuse detection method and device, electronic equipment and a storage medium, and the method comprises the steps: carrying out the feature extraction of a to-be-detected domain name from a semantic layer, a structural layer, a registration layer and a configuration layer, and obtaining a multi-source heterogeneous feature; mapping the multi-source heterogeneous features to a unified representation space and then performing enhanced representation to obtain enhanced features; performing cross network interaction on the enhanced features to obtain explicit cross features; performing deep network interaction on the enhanced features to obtain implicit interaction features; and determining the abuse probability of the domain name to be detected based on the explicit cross feature and the implicit interaction feature. According to the method, multi-dimensional static information is fused, and high-order interaction between features is effectively mined, so that efficient detection can be carried out in the initial stage of domain name registration under the condition that behavior data does not exist, and the problems that a traditional method is insufficient in unknown attack recognition capability, single in feature dimension, poor in model generalization and the like are solved.

Description

Technical Field

[0001] This invention relates to the field of network security detection technology, and in particular to a method, apparatus, electronic device, and storage medium for detecting domain name abuse. Background Technology

[0002] In the existing technology, there are a variety of methods for detecting malicious domain names using machine learning and deep learning. These methods usually extract some static features of the domain name to be detected, and then input these features into traditional machine learning models or deep neural networks for classification.

[0003] However, these methods are not very accurate in detecting malicious domains with strong camouflage and complex attack patterns. For example, a phishing domain may deliberately use common word combinations and top-level domains to make it indistinguishable from a normal domain in terms of lexical and structural features, but its registration information and DNS configuration information may contain risk signals such as abnormally short registration duration and incomplete DNS record configuration. If the above methods are used to analyze only the domain name string, it may be impossible to find abnormal patterns in this associated information, leading to missed detections. Summary of the Invention

[0004] This invention provides a method, apparatus, electronic device, and storage medium for detecting domain name abuse, in order to address the deficiencies in the prior art.

[0005] This invention provides a method for detecting domain name abuse, comprising the following steps: Feature extraction was performed on the domain name to be detected from the semantic layer, structural layer, registration layer and configuration layer respectively to obtain multi-source heterogeneous features; The multi-source heterogeneous features are mapped to a unified representation space and then enhanced to obtain enhanced features. The enhanced features are subjected to cross-network interactions to obtain explicit cross features; The enhanced features are subjected to deep network interaction to obtain implicit interaction features; Based on the explicit cross features and the implicit interaction features, the probability of abuse of the domain name to be detected is determined.

[0006] According to the domain name abuse detection method provided by the present invention, the feature extraction of the domain name to be detected is performed from the semantic layer, structural layer, registration layer, and configuration layer respectively to obtain multi-source heterogeneous features, including: Semantic features reflecting character fragment combination semantics, contextual dependencies, and construction patterns are extracted from the string ontology of the domain name to be detected. Extract constructive statistical features of the character composition and distribution pattern of the domain name to be detected; From the domain registration information of the domain to be detected, extract registration features that reflect the stability and risk of registration behavior; From the domain name resolution information of the domain name to be detected, extract configuration features that reflect the initial deployment form and infrastructure usage characteristics of the domain name.

[0007] According to a domain name abuse detection method provided by the present invention, the step of mapping the multi-source heterogeneous features to a unified representation space includes: The features extracted from the semantic layer are mapped to a high-dimensional embedding space through a pre-trained semantic model; The features with continuous numerical meaning extracted from the structural layer, registration layer and configuration layer are normalized or linearly transformed and mapped to a continuous dense space. The discrete symbol type features extracted from the structure layer, registration layer and configuration layer are mapped to a sparse discrete space through category encoding.

[0008] According to the domain name abuse detection method provided by the present invention, the step of mapping the multi-source heterogeneous features to a unified representation space and then performing enhanced representation to obtain enhanced features includes: The sparse categorical features originating from the sparse discrete space in the multi-source heterogeneous features are encoded into low-dimensional dense vectors through an embedding matrix. For the continuous numerical features originating from a continuous dense space in the multi-source heterogeneous features, a linear transformation is used to project them onto a dense vector of a unified dimension. For the high-dimensional embedding representations originating from the high-dimensional embedding space in the multi-source heterogeneous features, deep semantic features are extracted by performing outer product calculation and nonlinear transformation through the tensor interaction module. The enhanced feature is obtained by concatenating the low-dimensional dense vector, the uniform-dimensional dense vector, and the deep semantic features.

[0009] According to a domain name abuse detection method provided by the present invention, the step of performing cross-network interaction on the enhanced features to obtain explicit cross features includes: The enhanced features are used as the initial input vector and are stacked through multiple cross layers for computation. The current cross layer interacts with the output vector of the previous cross layer and combines it with learnable parameters to generate the output vector of the current cross layer. The output vector of the last cross layer is the explicit cross feature.

[0010] According to a domain name abuse detection method provided by the present invention, the step of performing deep network interaction on the enhanced features to obtain implicit interaction features includes: The enhanced features are input into a deep network composed of multilayer perceptrons. Through multilayer nonlinear transformation and regularization, deep combination relationships between features are extracted to obtain the implicit interaction features.

[0011] According to a domain name abuse detection method provided by the present invention, determining the detection result of the domain name to be detected based on the explicit cross features and the implicit interaction features includes: The explicit cross features are concatenated with the implicit interaction features to obtain a combined feature vector; The combined feature vector is input into the output layer, and the probability of abuse of the domain name to be detected is calculated by the prediction function.

[0012] The present invention also provides a domain name abuse detection device, comprising the following modules: The feature extraction unit is used to extract features from the semantic layer, structural layer, registration layer and configuration layer of the domain name to be detected, respectively, to obtain multi-source heterogeneous features; A feature enhancement unit is used to enhance the representation of the multi-source heterogeneous features to obtain enhanced features; The first interaction unit is used to perform cross-network interaction on the enhanced features to obtain explicit cross features; The second interaction unit is used to perform deep network interaction on the enhanced features to obtain implicit interaction features; The abuse detection unit is used to determine the abuse probability of the domain name to be detected based on the explicit cross features and the implicit interaction features.

[0013] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the domain name abuse detection method as described above.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the domain name abuse detection method as described above.

[0015] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the domain name abuse detection methods described above.

[0016] The domain name abuse detection method, device, electronic device, and storage medium provided by this invention comprehensively extract multi-source heterogeneous features from four levels: semantics, structure, registration, and configuration. It utilizes parallel cross-networks and deep networks to learn explicit cross-relationships and implicit interaction relationships between features, respectively. Finally, it combines the outputs of both aspects to determine the probability of domain name abuse, achieving accurate prediction of domain name abuse risk. Because this invention integrates multi-dimensional static information and effectively mines high-order interactions between features, it can perform efficient detection in the early stages of domain name registration when behavioral data is unavailable. This avoids the problems of traditional methods, such as insufficient ability to identify unknown attacks, single feature dimensions, and poor model generalization. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating the domain name abuse detection method provided by the present invention.

[0019] Figure 2 This is a schematic diagram of multi-source heterogeneous feature extraction provided by the present invention.

[0020] Figure 3 This is a schematic diagram of the domain name registration and resolution process provided by the present invention.

[0021] Figure 4 This is a schematic diagram of feature interaction based on deep cross-networks provided by the present invention.

[0022] Figure 5 This is a schematic diagram of the characteristic ablation experiment provided by the present invention.

[0023] Figure 6 This is a schematic diagram of the resource overhead experiment provided by the present invention.

[0024] Figure 7 This is a schematic diagram of the domain name abuse detection device provided by the present invention.

[0025] Figure 8 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0027] In the internet ecosystem, domain names are not only an important entry point for users to access network resources, but also a core hub for key links such as data exchange, information transmission, and identity authentication. However, the inherent openness, registrability, and weak censorship of the Domain Name System (DNS) make it a high-frequency carrier of cyberattacks.

[0028] Especially in the early stages of internet domain name creation (such as the period after registration but before resolution or deployment), attackers often preemptively deploy malicious domain names through methods such as mass generation, obfuscation construction, and anonymous registration. Because the characteristics of this stage do not yet show obvious behavioral patterns, traditional detection methods based on content or access behavior cannot respond in time. Therefore, "early identification" has become a key challenge in combating domain name abuse.

[0029] Currently, commonly used methods for detecting domain name abuse can be categorized as follows: The first type is the blacklist-based detection mechanism. This method assesses risk by comparing the domain to be detected with a known database of malicious domains. While this method is fast, it is ineffective against unknown and novel attack domains, exhibiting an inherent lag. Furthermore, blacklist updates rely heavily on manual or community reports, resulting in long update cycles and a high rate of false negatives.

[0030] The second category is detection methods based on manually constructed features and traditional machine learning. These methods typically extract shallow statistical features such as domain name length, character type ratio, top-level domain (TLD) category, and registration duration, and then use models like Support Vector Machines (SVM), Random Forests (RF), and XGBoost for classification. While this approach enhances the ability to identify unknown attacks to some extent, its limited feature dimensions and weak representational power make it difficult to accurately characterize complex abuse patterns. Furthermore, this method heavily relies on the experience of domain experts for feature engineering, resulting in poor generalization and adaptability.

[0031] The third category comprises deep learning-based recognition methods, such as URLNet, CharCNN, and Char-RNN. These models utilize neural networks to automatically extract high-dimensional semantic embeddings from domain name character sequences, capturing local combinational relationships and contextual dependencies between characters. While these methods improve the automation of feature extraction, they often limit themselves to analyzing the domain name string itself, neglecting more indicative external information such as registration information (e.g., registrar, registration time) and DNS configuration behavior (e.g., number of A records, NS server similarity). Furthermore, the structural design of these models is mostly static, failing to support dynamic feature expansion. Once new feature dimensions need to be integrated, the entire model often needs to be reconstructed, lacking flexibility and composability.

[0032] In summary, traditional technical solutions face the following problems when dealing with increasingly complex domain name abuse attacks, especially in the "early stage of domain name creation": First, it is difficult to effectively model and detect the "early stage of domain name creation" when there are no access behaviors or content characteristics; second, most models only use a single information source (such as only the domain name string), and cannot effectively integrate heterogeneous information from multiple dimensions such as structure, semantics, registration, and configuration; third, the model structure has poor scalability, and when the feature space expands, the entire model architecture needs to be reconstructed, resulting in high deployment and maintenance costs; fourth, there is a lack of unified modeling capabilities for the "implicit common features" among different abuse types, leading to insufficient generalization and adaptability of the model.

[0033] In response, this invention provides a domain name abuse detection method. It aims to integrate multi-source heterogeneous features extracted from the semantic layer, structural layer, registration layer, and configuration layer, and combine parallel processing of cross-network interaction and deep network interaction to comprehensively extract explicit cross features and implicit interaction features between features. This solves the problems of traditional methods that rely on only a single information source, are difficult to effectively detect domain name abuse in the early stages, and have insufficient model generalization ability. It achieves efficient, accurate, and forward-looking identification of unknown and new domain name abuse patterns.

[0034] in, Figure 1 This is a flowchart illustrating the domain name abuse detection method provided by the present invention, as follows: Figure 1 As shown, the method includes steps 110, 120, 130, 140 and 150.

[0035] Step 110: Extract features from the semantic layer, structural layer, registration layer and configuration layer of the domain name to be detected to obtain multi-source heterogeneous features.

[0036] In this embodiment, the domain name to be detected can be understood as any domain name string that needs to be assessed for abuse risk, such as "example.com". This domain name may be a domain name that has recently been registered through a registrar.

[0037] The semantic layer, structural layer, registration layer, and configuration layer mentioned here refer to four independent information dimensions that are divided to comprehensively characterize the domain name to be tested. These four dimensions have different information sources, data forms, and underlying intentions.

[0038] Features extracted from the semantic layer can be understood as features extracted from the domain name string itself that reflect its lexical and contextual meanings. These features can include lexical semantic features and contextual semantic features. Lexical semantic features involve segmenting the domain name string into multiple overlapping character-level n-grams (i.e., character fragments) and mapping these fragments to vector representations. Subsequently, a neural network (such as CNN or BiLSTM) is used to encode the vector sequence to capture local combinatorial patterns and semantic dependencies. Contextual semantic features, on the other hand, use a character-level pre-trained language model (such as CharBERT) to directly encode the complete domain name string to capture structural patterns and long-range contextual dependencies within the entire sequence, generating semantic representation vectors.

[0039] Features extracted from the structural layer can be understood as features that quantify the composition and statistical patterns of a domain name string. They are used to characterize common construction patterns of malicious domain names, such as automated generation or obfuscated splicing. For example, the structural layer features of the domain name "g4k8h2jd9s.info" may exhibit characteristics such as high character entropy and abnormal vowel-consonant ratios.

[0040] Features extracted from the registration layer can be understood as features extracted from the domain name registration information (such as WHOIS records) that reflect the lifecycle management and behavior of the registrant. They are used to characterize the intentions of the registrant behind the domain name, such as short-term abuse, anonymity, or the use of high-risk registrars.

[0041] Features extracted from the configuration layer can be understood as features extracted from the DNS (Domain Name System) resolution configuration records of the domain name that reflect the deployment mode of its network infrastructure. They are used to characterize the "minimal usability" or abnormal configuration patterns commonly seen in the initial deployment of malicious domain names, such as having only A records without MX records, using extremely short TTL values, and low NS server reputation.

[0042] The raw information extracted from the above four levels constitutes multi-source heterogeneous features. Here, "multi-source" means that the features come from multiple different information sources such as domain name strings, WHOIS database, and DNS system; "heterogeneous" means that the data types and structures of these features are different. For example, semantic layer features may be high-dimensional text embedding vectors, structural layer features may be numerical (such as domain name length), registration layer features may contain numerical (such as registration days) and categories (such as registrar name), and configuration layer features are also a mixture of numerical and category.

[0043] As an optional implementation, raw data can first be collected from the four levels mentioned above by calling WHOIS query tools and DNS resolution tools through automated scripts or API interfaces, respectively, and combining them with built-in string analysis algorithms. Then, these raw data undergo preliminary parsing and structuring processing to form a feature set containing multiple fields, which is the multi-source heterogeneous feature set.

[0044] Step 120: After mapping the multi-source heterogeneous features to a unified representation space, perform enhanced representation to obtain enhanced features.

[0045] Specifically, augmented representation can be understood as a feature standardization process used to transform all heterogeneous features into one or more unified mathematical spaces suitable for machine learning models.

[0046] Furthermore, the process of enhancing representations may involve adopting different processing strategies for different types of features. For example, for continuous numerical features (such as domain name length or registration days), normalization or standardization can be performed to make their numerical range fall within a fixed interval (such as 0 to 1); for discrete categorical features (such as registrar names), they can be converted into numerical vectors through some encoding method (such as one-hot encoding or embedding encoding); for high-dimensional textual features, enhanced semantic representations can be obtained by fusing high-dimensional features, such as fusing high-dimensional vector representations of contextual semantic features and high-dimensional vector representations of lexical semantic features.

[0047] After the above processing, the original multi-source heterogeneous features are transformed into a set of numerical vectors with uniform structure and aligned dimensions. This transformed result is the enhanced feature.

[0048] Step 130: Perform cross-network interaction on the enhanced features to obtain explicit cross features.

[0049] Specifically, cross-network interaction can be understood as automatically and explicitly learning combinations of features from low to high order through a cross network.

[0050] Specifically, cross-network interaction calculates layer by layer, performing a vector outer product operation between the original input features and the output vector of the previous layer, and combining this with learnable weight parameters to generate the output vector of the current layer. In other words, each layer in cross-network interaction is based on the previous layer and retains some information from the original input, thus enabling the efficient generation of feature interaction terms of various orders with low computational complexity.

[0051] The output vector of the last layer in the cross-network interaction is called the explicit cross feature. "Explicit" here means that there is a clear and interpretable combination relationship between these cross features and the original input features (e.g., a second-order interaction between feature A and feature B, a third-order interaction between features A, B, and C, etc.).

[0052] This embodiment, through cross-networks, can efficiently capture feature combinations that have proven effective in domain knowledge. For example, the combination of the features "specific high-risk registrars" and "extremely short registration time" may be a very strong signal of abuse.

[0053] Step 140: Perform deep network interaction on the enhanced features to obtain implicit interaction features.

[0054] Specifically, step 140 can be executed in parallel with step 130, aiming to uncover the relationships between features from another perspective. Deep network interaction can be understood as learning highly complex and abstract nonlinear combinatorial relationships between features through deep networks.

[0055] Specifically, deep networks can consist of multiple stacked layers of neurons containing non-linear activation functions (such as ReLU). As augmenting features pass through this deep network, each layer performs a non-linear transformation on the input, thereby extracting more abstract and higher-order feature representations layer by layer. The final output of this process is the implicit interaction feature. Here, "implicit" means that these feature combinations are automatically learned by the model in a data-driven manner; they often lack an intuitive physical explanation but may capture very subtle and crucial latent patterns in the data.

[0056] This embodiment uses deep networks to uncover complex relationships hidden deep within the data that are difficult to discover through human experience, greatly improving the model's generalization ability and its ability to discover unknown abuse patterns.

[0057] Step 150: Determine the probability of abuse of the domain name to be detected based on explicit cross features and implicit interaction features.

[0058] As an optional implementation, the explicit cross features output by the cross-network can first be combined with the implicit interaction feature vector output by the deep network, for example, through concatenation, to form a longer and more comprehensive combined feature. Then, this combined feature is input into a final output layer, such as a logistic regression layer with a sigmoid activation function. The output layer calculates a value between 0 and 1 based on the input combined feature; this value represents the probability of abuse of the domain name to be detected. For example, a probability value of 0.98 indicates that the domain name has a 98% chance of being maliciously abused. A threshold (such as 0.8) can be set; when the abuse probability exceeds this threshold, the domain name is determined to be malicious and appropriate action is taken.

[0059] This embodiment combines explicit cross features and implicit interaction features, which can not only make rapid judgments by utilizing the important feature combinations remembered by the cross network, but also use deep networks to generalize reasoning on complex and unknown patterns, thereby making the final prediction results more accurate and robust.

[0060] The domain name abuse detection method provided in this embodiment comprehensively extracts multi-source heterogeneous features from four levels: semantics, structure, registration, and configuration. It utilizes parallel cross-networks and deep networks to learn explicit cross-relationships and implicit semantic relationships between features, respectively. Finally, it combines the outputs from both aspects to determine the probability of domain name abuse, achieving accurate prediction of domain name abuse risk. Because this embodiment integrates multi-dimensional static information and effectively mines high-order interactions between features, it can perform efficient detection in the early stages of domain name registration when behavioral data is unavailable. This avoids the problems of traditional methods, such as insufficient ability to identify unknown attacks, single feature dimensions, and poor model generalization.

[0061] Furthermore, multi-source heterogeneous features can be understood as a set of features extracted from four different information dimensions. As an optional implementation, the process of obtaining multi-source heterogeneous features can be specified as follows: Features extracted from the semantic layer can include lexical semantic features and contextual semantic features. Lexical semantic features involve segmenting the domain name string into multiple overlapping character-level n-grams (i.e., character fragments) and mapping these fragments to vector representations. Subsequently, a neural network (such as CNN or BiLSTM) is used to encode the vector sequence to capture local combinatorial patterns and semantic dependencies. Contextual semantic features use a character-level pre-trained language model (such as CharBERT) to directly encode the complete domain name string to capture structural patterns and long-range contextual dependencies within the entire sequence, generating semantic representation vectors. Features extracted from the structural layer can be a set of statistical values ​​and Boolean values, such as a domain name length of 17, 1 digit, 1 hyphen, a character entropy of 3.85, and whether it contains an IP address ("no"). Features extracted from the registration layer can be a series of field values ​​returned from a WHOIS database query, such as a registrar named "AA", a creation date of "2025-09-20", a registration duration of 365 days, whether privacy protection is enabled ("yes"), and the registrant's country of origin ("XXX"). Features extracted from the configuration layer can be a series of records and statistics returned by DNS queries, such as the number of NS servers being 2, the number of A records being 1, the existence of MX records being "no", and the average TTL being 300 seconds.

[0062] After obtaining the aforementioned multi-source heterogeneous features containing different data types and formats, this embodiment performs a unified mapping on the multi-source heterogeneous features. This unified mapping can be understood as a standardized transformation process, which aims to project multi-source heterogeneous features with different sources, formats, and structures onto a unified numerical feature space suitable for downstream machine learning models.

[0063] As an optional implementation, the unified mapping process maps multi-source heterogeneous features to different modeling subspaces based on their type. For example, semantic layer features (such as domain name strings) can be mapped to a high-dimensional vector space. Features with continuous numerical meaning in the structure, registration, and configuration layers (such as domain name length, registration duration, and TTL value) can be mapped to a continuous dense vector space. Discrete symbolic features in the structure, registration, and configuration layers (such as TLD, registrar, and the presence of an MX record) can be mapped to a sparse discrete vector space.

[0064] Through this unified mapping process, multi-source heterogeneous features are transformed into a set of structured numerical features that can be directly fed into subsequent enhancement representation modules.

[0065] in, Figure 2 This is a schematic diagram of multi-source heterogeneous feature extraction provided by the present invention, such as... Figure 2As shown, firstly, for a domain name information to be detected, information is collected in parallel from four dimensions to obtain raw multi-channel features. Specifically, from the semantic and structural layers, the string ontology of the domain name to be detected is directly analyzed to extract its lexical and character distribution information, thus obtaining semantic features and structural features; from the registration layer, its registration information is obtained by executing a WHOIS query, thus obtaining registration features; and from the configuration layer, its domain name resolution configuration information is obtained by executing a DNS query, thus obtaining configuration features.

[0066] Next, based on the inherent properties of the features, they are projected into different modeling subspaces: features extracted from the semantic layer, such as lexical semantic features and contextual semantic features, are processed by a pretrained model and mapped to a high-dimensional embedding space to obtain high-dimensional vectors corresponding to lexical semantic features and contextual semantic features; features with continuous numerical meaning extracted from the structure layer, registration layer, and configuration layer (such as character entropy, domain lifecycle, etc.) are mapped to a continuous dense space; and discrete symbol type features extracted from the structure layer, registration layer, and configuration layer (such as TLD, whether privacy protection is enabled, etc.) are mapped to a sparse discrete space.

[0067] Based on any of the above embodiments, features are extracted from the domain name to be detected at the semantic layer, structural layer, registration layer, and configuration layer to obtain multi-source heterogeneous features, including: From the string ontology of the domain name to be detected, extract semantic features that reflect the semantics of character fragment combination, contextual dependencies, and construction patterns; Extract constructive statistical features of the character composition and distribution patterns of the domain name to be detected; Extract registration features that reflect the stability and risk of registration behavior from the domain registration information of the domain to be tested; Extract configuration features that reflect the initial deployment form and infrastructure usage characteristics of the domain name to be tested from the domain name resolution information.

[0068] In this embodiment, the string ontology refers to the complete character sequence of the domain name to be detected, such as "aabbccdd.com". Semantic features can be understood as a set of numerical representations that characterize the potential meaning and construction intent of the string after in-depth analysis. Semantic features can include lexical semantic features and contextual semantic features.

[0069] As an alternative implementation, lexical semantic features involve segmenting the domain name string into multiple overlapping character-level n-grams (i.e., character fragments) and mapping these fragments to vector representations. Subsequently, a neural network (such as CNN or BiLSTM) is used to encode the vector sequence to capture local combinatorial patterns and semantic dependencies. Contextual semantic features employ a character-level pre-trained language model (such as CharBERT) to directly encode the complete domain name string, capturing structural patterns and long-range contextual dependencies within the entire sequence to generate semantic representation vectors. For example, for the domain name "microsoft-security-update.com", even without containing any similar-looking or misspelled characters, the model can decompose it into semantically meaningful units such as "microsoft", "security", and "update," indicating that this combination is highly relevant to phishing or malware distribution activities in context, thus identifying its potential intent from a purely semantic level.

[0070] By extracting the above semantic features, it is possible to determine whether a domain name is being imitated or forged from the perspective of vocabulary and context, thereby effectively identifying malicious domain names constructed using methods such as word spoofing, brand imitation, and phishing keyword stuffing.

[0071] Furthermore, constructive statistical features can be understood as indicators used to quantitatively describe the inherent structure of domain name strings from a mathematical and statistical perspective. They do not focus on the lexical meaning of the strings, but rather on their form and structural patterns. These constructive statistical features may include character entropy, length, whether they contain consecutive consonants, and whether they contain IP addresses, among others.

[0072] By extracting these structural statistical features, malicious domain names generated in batches by algorithms, randomly concatenated, or obfuscated by adding meaningless characters can be effectively identified, providing semantically independent structural evidence for detection.

[0073] Domain registration information typically originates from publicly available WHOIS database queries. Registration characteristics are a set of indicators derived by quantifying and structuring this raw registration information. These indicators are used to assess whether the domain owner's registration behavior aligns with normal commercial or personal purposes, thereby determining potential risks. Registration characteristics may include registration time, update interval, field completeness, whether privacy protections are used, and whether the registrar is high-risk.

[0074] By extracting these registration characteristics, we can gain insight into the underlying intentions from the perspective of domain lifecycle management, and effectively identify anonymously registered domains that are being abused in the short term or intended to conceal their identities.

[0075] Domain name resolution information typically originates from the results of DNS record queries for that domain. Configuration characteristics, on the other hand, are a set of metrics derived from the analysis and statistics of these DNS records. These metrics characterize the domain's deployment strategy on the network infrastructure, thereby identifying common minimally achievable or anomalous configuration patterns common to malicious domains. Configuration characteristics may include the number of NS records, TTL range, presence of MX / TXT records, and configuration completeness.

[0076] By extracting these configuration features, it is possible to discover abnormal behavior patterns of malicious domains in the early stages of their deployment, from the perspective of network deployment and infrastructure usage.

[0077] This embodiment refines the feature extraction process, clarifying the extraction of specific types of features from four levels: semantics, structure, registration, and configuration, thereby constructing a comprehensive, three-dimensional, and complementary feature system. Because this system simultaneously covers the lexical intent, construction patterns, lifecycle behavior, and network deployment strategies of domain names, it fundamentally improves the comprehensive identification capability of various complex and novel domain name abuse patterns, significantly enhancing the depth and breadth of detection.

[0078] in, Figure 3 This is a schematic diagram of the domain name registration and resolution process provided by the present invention, as follows: Figure 3 As shown, users first submit a registration application to the registrar and complete the payment. During this process, they fill out a WHOIS form containing registrant information, contact information, etc. This information is submitted to the Registry for management and stored in the WHOIS database.

[0079] Then, the domain name to be tested (e.g.) Figure 3The string "xxx.com" in the domain name is then formally established. Next, before the domain name can be accessed normally by internet users, the domain owner needs to perform initial deployment on their designated authoritative name server, i.e., add resource records, such as setting IP addresses (A records), mail servers (MX records), etc.

[0080] Finally, when a user initiates a domain name resolution request on the client, the system queries the local server, root server, and top-level domain name server level by level, eventually obtaining the IP address from the authoritative server and returning it to the user, thus completing the domain name access.

[0081] Based on any of the above embodiments, mapping multi-source heterogeneous features to a unified representation space includes: The features extracted from the semantic layer are mapped to a high-dimensional embedding space through a pre-trained semantic model; Features with continuous numerical meaning extracted from the structure layer, registration layer, and configuration layer are normalized or linearly transformed and mapped to a continuous dense space. The discrete symbol type features extracted from the structure layer, registration layer, and configuration layer are mapped to a sparse discrete space through category encoding.

[0082] In this embodiment, the features extracted by the semantic layer mainly refer to the original string of the domain name to be detected. In order to delve deeper into its inherent semantic information, this embodiment uses a pre-trained semantic model for processing. The pre-trained semantic model here can be understood as a deep learning model that is pre-trained on a large-scale text or code corpus and is capable of understanding complex relationships between characters or words, such as CharBERT or Transformer models.

[0083] Mapping features extracted from the semantic layer to a high-dimensional embedding space can be understood as converting discrete, variable-length domain name strings into a fixed-length, dense real-number vector. In the high-dimensional embedding space, semantically or structurally similar domain names (such as "aabbcc.com" and "aabbdd.net") are mapped to positions close to each other in the space.

[0084] Specifically, the domain name string to be detected can be input into a pre-trained CharBERT model. The model will calculate each character in the string and its context, and output a fixed-dimensional vector that can represent the semantics of the entire domain name. This vector is the semantic feature mapped to a high-dimensional embedding space, which captures the potential brand imitation, word construction patterns and contextual dependencies in the domain name.

[0085] Furthermore, features with continuous numerical meaning extracted from the structure layer, registration layer, and configuration layer are normalized or linearly transformed and mapped to a continuous dense space. Features with continuous numerical meaning refer to those features that are themselves numerical types and whose numerical values ​​have actual physical or statistical significance. Examples include TTL, number of NS, registration time interval, and character entropy.

[0086] Considering the significant differences in the original numerical ranges of these features with continuous numerical meanings—for example, domain name length might range from 5 to 63, while registration duration might range from 365 to 3650—this embodiment normalizes or performs linear transformations to eliminate the dimensional differences between features and prevent features with large numerical ranges from dominating model training. This maps these continuous numerical features to a continuous dense space, forming one or more dense vectors. In this space, all features have similar numerical scales.

[0087] The discrete symbol type features extracted from the structure layer, registration layer, and configuration layer are mapped to a sparse discrete space using categorical encoding. Here, discrete symbol type features refer to those features that take values ​​from a finite number of categories or symbols, and their numerical values ​​themselves are not inherently significant. Examples include symbol type features such as registrar, TLD, whether privacy protection is enabled, and the country of the Name Server.

[0088] To enable the model to handle these non-numerical symbols, this embodiment converts them into numerical representations using categorical encoding. Categorical encoding methods can include embedded lookup tables, one-hot encoding, etc.

[0089] Based on any of the above embodiments, after mapping multi-source heterogeneous features to a unified representation space, enhanced representation is performed to obtain enhanced features, including: For sparse categorical features originating from sparse discrete space in multi-source heterogeneous features, they are encoded into low-dimensional dense vectors through embedding matrix; For continuous numerical features originating from a continuous dense space in multi-source heterogeneous features, a linear transformation is used to project them onto a dense vector of a unified dimension. For high-dimensional embedding representations from high-dimensional embedding spaces in multi-source heterogeneous features, deep semantic features are extracted by performing outer product calculation and nonlinear transformation through tensor interaction module. The enhanced feature is obtained by concatenating low-dimensional dense vectors, uniform-dimensional dense vectors, and deep semantic features.

[0090] In this embodiment, sparse categorical features refer to features located in a sparse discrete space obtained through categorical encoding methods (such as one-hot encoding) in the aforementioned embodiments, such as features like registrars, TLDs, and NS countries. The original representations of these features are usually high-dimensional and very sparse.

[0091] To address this issue and provide richer semantic representations of category features, this embodiment employs an embedding matrix encoding approach. The embedding matrix here can be understood as a learnable lookup table, where each row corresponds to a low-dimensional, dense vector representation of a specific category.

[0092] Specifically, for each sparse categorical feature field, an independent, trainable embedding matrix can be constructed. When a specific registrar name is input, it is directly mapped to the corresponding vector in the matrix by looking up a table; this vector is a low-dimensional dense vector.

[0093] For example, multiple registrar names can be mapped to 32-dimensional dense vectors. By concatenating the low-dimensional dense vectors obtained after encoding all sparse categorical feature fields (such as registrar, TLD, country, etc.) using their respective embedding matrices, a unified sparse feature representation can be obtained. The calculation process can be expressed as follows: in, The number of fields for sparse categorical features. For the embedded dimension.

[0094] For continuous numerical features originating from a continuous dense space in multi-source heterogeneous features, a linear transformation is used to project them onto a dense vector of a uniform dimension. Here, continuous numerical features refer to features located in a continuous dense space after normalization and other processing as described in the previous embodiments, such as domain name length, character entropy, and domain name lifetime. Despite normalization, these features may still be independent, unaligned scalar values.

[0095] To integrate these independent numerical features and match their dimensionality to other types of feature representations, this embodiment projects them onto a dense vector of uniform dimension using a linear transformation. This linear transformation can be understood as a fully connected layer that passes the vector composed of multiple consecutive input numerical features through a learnable weight matrix. and bias vector Perform matrix multiplication and addition operations.

[0096] Specifically, if the original continuous numerical eigenvector is Then, after linear transformation, a dense vector of uniform dimension is obtained. It can be represented as: in, . , .

[0097] For high-dimensional embedding representations derived from high-dimensional embedding spaces in multi-source heterogeneous features, deep semantic features are extracted by performing outer product calculations and nonlinear transformations on them through the tensor interaction module. Here, the high-dimensional embedding representation refers to the feature vectors generated by the pre-trained semantic model in the aforementioned embodiments, which are located in high-dimensional embedding spaces. Although these vectors already contain rich semantic information, the interaction relationships between their different dimensions have not yet been fully explored.

[0098] To further refine and enhance its representational capabilities, this embodiment processes it through the Tensor FusionModule. The core of this module lies in explicitly modeling the second-order or even higher-order interaction relationships within the features through outer product calculation and nonlinear transformation.

[0099] For example, the high-dimensional embedding representation of the input (or its two parts) can be used. and Perform the outer product operation, that is... The outer product operation can generate tensors. tensor Each element in the vector represents a combination of the product of two features of different dimensions in the original vector, thus explicitly capturing all paired feature interactions.

[0100] The tensor obtained by calculating the outer product The data is flattened and then fed into a two-layer multilayer perceptron (MLP) network. Through processing with multiple nonlinear activation functions (such as ReLU), the model can learn more complex and higher-order combinatorial relationships of these pairwise interactions.

[0101] Furthermore, to ensure effective information fusion, this module can also introduce gated residual connections, the calculation formula of which can be expressed as: in, It is the original high-dimensional embedding representation. These are the features after nonlinear transformation. It is a learnable gating factor used to automatically adjust the fusion strength, ultimately resulting in... This refers to deep semantic features that contain richer interactive information.

[0102] Finally, the low-dimensional dense vector, the uniform-dimensional dense vector, and the deep semantic features are concatenated to obtain the enhanced features. That is, the low-dimensional dense vector representing sparse categorical features, the uniform-dimensional dense vector representing continuous numerical features, and the deep semantic features representing semantic layer features are concatenated end to end to form a final vector. This combined vector serves as the unified input for the next stage of "feature interaction learning".

[0103] Based on any of the above embodiments, cross-network interactions are performed on the enhanced features to obtain explicit cross features, including: The enhanced features are used as the initial input vector and are stacked through multiple cross layers for computation. The current cross layer is used to interact with the initial input vector and the output vector of the previous cross layer, and combined with learnable parameters to generate the output vector of the current cross layer. The output vector of the last cross layer is the explicit cross feature.

[0104] In this embodiment, a multi-layer cross layer refers to a network structure composed of multiple cross layers with the same structure stacked sequentially. This network structure can be a cross network. The stacking computation can be understood as the output vector of the nth cross layer serving as the input of the (n+1)th cross layer.

[0105] Specifically, this embodiment always uses the enhanced features as the initial input vector. Output vector of the previous cross layer The outer product operation is performed, and the result reflects the pairwise interaction between all the original features and the combined features learned from the previous layer.

[0106] During the interaction, a set of learnable parameters is also introduced, typically including a weight vector. and a bias vector These parameters are automatically learned and optimized during model training using the backpropagation algorithm. Their role is to control and adjust which feature interactions are important in the current cross layer, and the strength of those interactions.

[0107] As an optional embodiment, the first Output vectors of each cross layer The calculation process can be represented by the following formula: After stacking multiple cross layers, the output vector of the last cross layer (such as the Nth layer) is the explicit cross feature. This feature contains all polynomial feature combinations from first to N+1 orders. These combination relationships are explicitly defined by the network structure and have good interpretability. For example, it can explicitly learn the combined risk brought about by the simultaneous occurrence of the three features "high-risk registrar", "extremely short registration time" and "no MX record".

[0108] Based on any of the above embodiments, deep network interactions are performed on the enhanced features to obtain implicit interaction features, including: The enhanced features are input into a deep network composed of multilayer perceptrons. Through multilayer nonlinear transformation and regularization, the deep combination relationship between features is extracted to obtain implicit interaction features.

[0109] The deep network here can be a standard fully connected feedforward neural network, also known as a multi-layer perceptron (MLP). This network can consist of multiple hidden layers and an output layer stacked together, with each layer containing a number of neurons.

[0110] Within deep networks, the enhanced feature vectors undergo multiple layers of nonlinear transformations. These nonlinear transformations mean that in each layer, the input vector first undergoes a linear transformation (multiplying with the layer's weight matrix and adding a bias vector), and then the result is processed by a nonlinear activation function, such as ReLU. By stacking multiple such nonlinear transformations, deep networks can learn arbitrarily complex and highly abstract combinations of features—relationships that simple linear or shallow models cannot capture.

[0111] To prevent the model from overfitting to the training data and to improve its generalization ability to unknown data, this embodiment also introduces regularization. This regularization can be Dropout. During training, Dropout randomly sets the output of some neurons in the network to zero with a certain probability, so that the network does not overly rely on any single feature or combination of features, thereby learning more robust and generalized feature representations.

[0112] After the above multi-layer nonlinear transformation and regularization processing, deep networks can effectively extract deep combination relationships between features. These combination relationships are data-driven and automatically learned, without the need for prior human knowledge.

[0113] This embodiment introduces a deep network branch specifically designed to learn highly complex, non-linear implicit combination relationships between features. This effectively complements the cross-network that learns explicit cross-features. The powerful abstraction and generalization capabilities of deep networks enable the model to discover entirely new and unknown attack patterns, thereby greatly enhancing the ability to identify new and variant domain name abuses.

[0114] Based on any of the above embodiments, the detection result of the domain name to be detected is determined based on explicit cross features and implicit interaction features, including: Explicit cross features are concatenated with implicit interaction features to obtain a combined feature vector; The combined feature vector is input into the output layer, and the probability of abuse of the domain name to be detected is calculated through the prediction function.

[0115] In this embodiment, concatenation can be understood as a vector join operation, used to combine explicit cross features x. cross With implicit interaction feature h deepBy concatenating the first and last features in terms of dimension, a longer and more comprehensive single vector is formed. For example, if the dimension of the explicit cross feature is d_cross and the dimension of the implicit interaction feature is d_deep, then the dimension of the combined feature vector obtained after concatenation will be d_cross + d_deep.

[0116] The combined eigenvector z = [x cross h deep It also contains explicit feature combinations with strong interpretability provided by cross-networks, as well as highly abstract implicit feature patterns provided by deep networks.

[0117] The combined feature vector is input to the output layer, and the probability of abuse of the domain name to be detected is calculated by the prediction function. The output layer here is the last layer of the entire neural network model; it receives the combined feature vector z obtained in the previous step as input and is responsible for converting it into the final prediction result.

[0118] in, Figure 4 This is a schematic diagram of feature interactions based on deep cross-networks provided by the present invention, such as... Figure 4 As shown, the multi-source heterogeneous features obtained in the feature extraction stage are received as input and then enter the feature enhancement and representation stage. In this stage, different types of features are processed in parallel: For sparse categorical features (Sparse Input) originating from a sparse discrete space, they are processed by an embedding layer and encoded into a low-dimensional dense vector; For continuous numerical features (Dense Input) originating from a continuous dense space, they are projected onto a dense vector of uniform dimension through linear transformation and other processing. For the high-dimensional embedding representation (High-dim Input) originating from the high-dimensional embedding space, its deep semantic features are extracted through the tensor interaction module (Fusion Module).

[0119] Subsequently, the vectors obtained after the above processing are concatenated to obtain the enhanced features. Then, the enhanced feature is simultaneously fed into two parallel network branches: the Cross Network branch and the Deep Network branch.

[0120] In this process, the cross-network branch interacts with the enhanced features through cross-network computation. By stacking multiple cross layers, it explicitly learns the combinational relationships between features from low to high order, ultimately generating explicit cross features. ).

[0121] Deep network branches typically consist of multi-layer perceptrons that perform deep network interactions on enhanced features. Through multi-layer nonlinear transformations and regularization, they implicitly learn highly abstract combinatorial relationships between features, ultimately generating implicit interactive features. ).

[0122] Next, the explicit cross features output by the cross network branches ( The implicit interaction features between the outputs of deep network branches and the network itself. The concatenation operation is performed to obtain a combined feature vector that contains both explicit and implicit combined information. ).

[0123] Finally, the combined feature vector ( The input is fed to the output layer (MLP with Dropout), and a value between 0 and 1 is calculated by a prediction function (such as the Sigmoid function). This value is the probability of abuse of the domain name to be detected.

[0124] Experimental tests have shown that, on various types of real and mixed abuse datasets, the domain name abuse detection method provided by this invention significantly outperforms traditional methods in terms of accuracy, precision, recall, and F1 score.

[0125] Specifically, the domain name abuse detection method provided by this invention has been comprehensively evaluated on multiple different types of datasets (including recent phishing domains DS-1, historical phishing domains DS-2, traditional DGA domains DS-3, adversarial DGA domains DS-4, and a hybrid dataset DS-5 that integrates multiple abuse types), verifying its generalization ability and robustness. Experimental data show that the method provided by this invention (hereinafter referred to as "this method") significantly outperforms traditional methods in key indicators such as accuracy, precision, recall, and F1 score.

[0126] Specifically, in the phishing detection task, our method outperformed both the DS-1 and DS-2 datasets, achieving F1 scores of 0.9540 and 0.9303 respectively, demonstrating strong identification capabilities for phishing domains across different time spans and sources. In contrast, traditional methods based on lexical features, such as PMANet, GramBeddings, and FANCI, as well as LSTM-based methods, performed significantly worse on the historical phishing dataset DS-2, primarily due to the wide distribution of phishing domains and the discreteness of their features.

[0127] On the traditional DGA detection (DS-3), this method achieved near-perfect detection results (F1=0.9976), thanks to its effective integration of structural information such as DNS configuration, which enhances the ability to identify DGA domains. In the adversarial DGA dataset DS-4, due to the presence of high-intensity confusion and mutations, the performance of all models decreased, but this method still maintained a high detection accuracy (F1=0.8512), demonstrating its strong robustness and tolerance to adversarial examples.

[0128] It should be noted that on the DS-5 dataset, which covers a variety of malicious domain name abuses, this method demonstrates excellent balance with an F1 score of 0.9564. In particular, it achieves excellent coordination between precision and recall, far exceeding traditional multi-source methods that use static feature concatenation. This shows that this method can effectively capture complex correlations across the feature space and is suitable for both single-task and multi-task scenarios.

[0129] Overall, the experimental results fully validate that this method effectively improves the accuracy and robustness of domain name abuse detection. Especially when facing highly complex adversarial examples and diverse abuse types, this invention maintains excellent detection performance.

[0130] Table 1 is a list of indicators provided by the present invention on different datasets.

[0131] Table 1 also, Figure 5 This is a schematic diagram of the characteristic ablation experiment provided by the present invention, as shown below. Figure 5 As shown, in the feature ablation experiment, the stepwise introduction of the selected multi-source static features significantly improved the model performance, fully verifying the complementarity between the various information dimensions.

[0132] Figure 6 This is a schematic diagram of the resource overhead experiment provided by the present invention, such as... Figure 6 As shown, even under high QPS or large batch conditions, the CPU and GPU resource overhead of the model remains low, and the latency is always less than 1 second, demonstrating real-time processing capabilities and adaptability to large-scale data processing.

[0133] The domain name abuse detection device provided by the present invention is described below. The domain name abuse detection device described below can be referred to in correspondence with the domain name abuse detection method described above.

[0134] Based on any of the above embodiments Figure 7 This is a schematic diagram of the domain name abuse detection device provided by the present invention, as shown below. Figure 7 As shown, the device includes: The feature extraction unit 710 is used to extract features from the semantic layer, structural layer, registration layer and configuration layer of the domain name to be detected, respectively, to obtain multi-source heterogeneous features; The feature enhancement unit 720 is used to map multi-source heterogeneous features to a unified representation space and then perform enhanced representation to obtain enhanced features; The first interaction unit 730 is used to perform cross-network interaction on the enhanced features to obtain explicit cross features; The second interaction unit 740 is used to perform deep network interaction on the enhanced features to obtain implicit interaction features; The abuse detection unit 750 is used to determine the probability of abuse of a domain name to be detected based on explicit cross features and implicit interaction features.

[0135] Figure 8 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 8 As shown, the electronic device may include a processor 810, a communications interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communications interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute a domain name abuse detection method.

[0136] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0137] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer is able to execute the domain name abuse detection method provided by the above methods.

[0138] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the domain name abuse detection methods provided by the methods described above.

[0139] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0140] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0141] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting domain name abuse, characterized in that, include: Feature extraction was performed on the domain name to be detected from the semantic layer, structural layer, registration layer and configuration layer respectively to obtain multi-source heterogeneous features; The multi-source heterogeneous features are mapped to a unified representation space and then enhanced to obtain enhanced features. The enhanced features are subjected to cross-network interactions to obtain explicit cross features; The enhanced features are subjected to deep network interaction to obtain implicit interaction features; Based on the explicit cross features and the implicit interaction features, the probability of abuse of the domain name to be detected is determined.

2. The domain name abuse detection method according to claim 1, characterized in that, The process involves extracting features from the semantic layer, structural layer, registration layer, and configuration layer of the domain name to be detected, respectively, to obtain multi-source heterogeneous features, including: Semantic features reflecting character fragment combination semantics, contextual dependencies, and construction patterns are extracted from the string ontology of the domain name to be detected. Extract constructive statistical features of the character composition and distribution pattern of the domain name to be detected; From the domain registration information of the domain to be detected, extract registration features that reflect the stability and risk of registration behavior; From the domain name resolution information of the domain name to be detected, extract configuration features that reflect the initial deployment form and infrastructure usage characteristics of the domain name.

3. The domain name abuse detection method according to claim 1, characterized in that, The step of mapping the multi-source heterogeneous features to a unified representation space includes: The features extracted from the semantic layer are mapped to a high-dimensional embedding space through a pre-trained semantic model; The features with continuous numerical meaning extracted from the structural layer, registration layer and configuration layer are normalized or linearly transformed and mapped to a continuous dense space. The discrete symbol type features extracted from the structure layer, registration layer and configuration layer are mapped to a sparse discrete space through category encoding.

4. The domain name abuse detection method according to any one of claims 1 to 3, characterized in that, The process of mapping the multi-source heterogeneous features to a unified representation space and then performing enhanced representation to obtain enhanced features includes: Sparse categorical features originating from sparse discrete space are encoded into low-dimensional dense vectors through an embedding matrix. For continuous numerical features originating from a continuous dense space, a linear transformation is used to project them onto a dense vector of uniform dimension. For high-dimensional embedding representations derived from high-dimensional embedding spaces, deep semantic features are extracted by performing outer product calculations and nonlinear transformations through tensor interaction modules. The enhanced feature is obtained by concatenating the low-dimensional dense vector, the uniform-dimensional dense vector, and the deep semantic features.

5. The domain name abuse detection method according to any one of claims 1 to 3, characterized in that, The process of performing cross-network interactions on the enhanced features to obtain explicit cross features includes: The enhanced features are used as the initial input vector and are stacked through multiple cross layers for computation. The current cross layer interacts with the output vector of the previous cross layer and combines it with learnable parameters to generate the output vector of the current cross layer. The output vector of the last cross layer is the explicit cross feature.

6. The domain name abuse detection method according to any one of claims 1 to 3, characterized in that, The process of performing deep network interactions on the enhanced features to obtain implicit interaction features includes: The enhanced features are input into a deep network composed of multilayer perceptrons. Through multilayer nonlinear transformation and regularization, deep combination relationships between features are extracted to obtain the implicit interaction features.

7. The domain name abuse detection method according to any one of claims 1 to 3, characterized in that, The determination of the detection result of the domain name to be detected based on the explicit cross features and the implicit interaction features includes: The explicit cross features are concatenated with the implicit interaction features to obtain a combined feature vector; The combined feature vector is input into the output layer, and the probability of abuse of the domain name to be detected is calculated by the prediction function.

8. A domain name abuse detection device, characterized in that, include: The feature extraction unit is used to extract features from the semantic layer, structural layer, registration layer and configuration layer of the domain name to be detected, respectively, to obtain multi-source heterogeneous features; The feature enhancement unit is used to map the multi-source heterogeneous features to a unified representation space and then perform enhanced representation to obtain enhanced features; The first interaction unit is used to perform cross-network interaction on the enhanced features to obtain explicit cross features; The second interaction unit is used to perform deep network interaction on the enhanced features to obtain implicit interaction features; The abuse detection unit is used to determine the abuse probability of the domain name to be detected based on the explicit cross features and the implicit interaction features.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the domain name abuse detection method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the domain name abuse detection method as described in any one of claims 1 to 7.

Images