Malicious domain name detection method and device based on multiple views, electronic equipment and medium

Abstract

The embodiment of the invention relates to the technical field of computer security, and provides a malicious domain name detection method and device based on multiple views, electronic equipment and a medium, and the method comprises the steps: collecting the multi-dimensional information of a monitored domain name in real time; respectively constructing a plurality of corresponding domain name views based on the multi-dimensional information; taking the monitored domain name as a center node, and generating a domain name embedding vector corresponding to the monitored domain name in each domain name view based on domain name features of the center node in the multiple domain name views and weights of adjacent domain name nodes; based on the domain name embedding vector corresponding to the monitored domain name in each domain name view, a view attention algorithm is applied to calculate and obtain a multi-view unified embedding vector corresponding to the monitored domain name; and judging whether the monitored domain name is a malicious domain name based on the multi-view unified embedding vector. Therefore, the method can effectively cope with the bypassing behavior of an attacker, improves the detection precision, and is higher in detection accuracy.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer security, and in particular to a malicious domain name detection method and device based on multi-view, electronic equipment and medium. BACKGROUND

[0002] Domain Name System is an important part of modern Internet, and its main function is to map IP addresses that are difficult to remember into domain names that are easy to remember, so that users can access any host on the Internet more conveniently through domain names. Because domain names are important portals and basic resources of the Internet, they also have high commercial value. Domain Name System services have been abused in various ways, including spreading malicious software, communicating with command and control servers, sending spam, hosting scams and phishing, etc. Attackers will try to disrupt the data provided by legitimate domain name servers, thereby controlling the flow of resources, or by preemptively registering some popular websites that are about to expire, they will illegally obtain advertising revenue from users' trust in the website, intercept emails or push malicious content to users. Some attacks use domain name hijacking techniques to register domain names that are the same as existing company names or personal names, or register domain names that are very similar to their names, and sell them to the victimized companies or individuals at a high price to achieve the purpose of illegal profit.

[0003] According to the abuse behavior of domain names, malicious domain names can be divided into phishing domain names, fraud domain names, botnet communication domain names, hijacking domain names and content abuse domain names. Among them, phishing fraud domain names simulate a well-known website by copying all or part of the content of the target website, and have a high degree of content similarity with benign domain names, while hijacking domain names refer to domain names registered by attackers that are similar in character composition to some well-known benign websites or homophonic domain names, which are very similar to benign domain names in string composition. The detection methods of these two types of domain names have similarities; botnet communication domain names refer to the domain names used by user hosts when communicating with control command hosts after being infected by botnets. Attackers often use domain name generation algorithms to generate random domain names to evade detection. Because malicious domain names pose many dangers, and the number of domain name system malicious behaviors related to malicious domain names is growing, it is necessary to effectively detect malicious domain names and organize related malicious attack behaviors.

[0004] Malicious domain name detection techniques can be divided into malicious domain name detection methods based on single domain name features and malicious domain name detection methods based on associated information. By extracting the string features and access record features of a single domain name or extracting the associated information between multiple domain names, the detection of malicious domain names is achieved, thereby improving the security of domain name system services.

[0005] Although there are currently some detection methods for malicious domain names, these detection methods have several problems due to various reasons. First, an attacker of a domain name service can easily change domain name object features such as domain name character composition, access timing, and domain name associated features such as resource utilization relationship, to bypass detection of a single domain name and detection using domain name association relationship. Second, these detection methods mostly belong to supervised learning or unsupervised learning. A supervised learning model has a high requirement for a training set. Due to the variability of malicious domain names and the privacy of data, it is difficult to obtain a large amount of labeled data. Unsupervised learning does not require a labeled training set, but has poor detection performance, needs manual classification of domain name clusters divided, and wastes part of the labeled information. Third, the information of the domain name system has diversity. There are problems of low accuracy and high false positive rate in detection using only part of the information of the domain name. SUMMARY

[0006] The application provides a malicious domain name detection method and device based on multiple views, an electronic device and a medium, to solve the defects of inaccurate, missed and false detection of malicious domain names in the prior art, effectively respond to the bypass behavior of attackers, and improve the detection accuracy and high detection accuracy.

[0007] The application provides a malicious domain name detection method based on multiple views, comprising: real-time collection of multi-dimensional information of a monitored domain name; construction of a corresponding multiple domain name views based on the multi-dimensional information; taking the monitored domain name as a center node, generating a domain name embedding vector of the monitored domain name in each domain name view based on domain name features of the center node in the multiple domain name views and weights of adjacent domain name nodes; application of a view attention algorithm to calculate a multiple view unified embedding vector corresponding to the monitored domain name based on the domain name embedding vector of the monitored domain name in each domain name view; judgment of whether the monitored domain name is a malicious domain name based on the multiple view unified embedding vector.

[0008] In one possible implementation, the method further comprises: the multi-dimensional information includes domain name string information, domain name registration information, host access domain name flow information and domain name page information; the multiple domain name views include a domain name character view, a domain name registration information view, a host access view, a domain name resolution view and a page information view; application of a domain name maximum matching segmentation algorithm to segment the monitored domain name into multiple domain name segments, and construction of a domain name character view according to the association degree between the multiple domain name segments for the domain name string information; The domain name registration information view construction algorithm is applied to the domain name registration information to mine the registration relationship between the monitoring domain names according to the registrant, the registration location and the registration mailbox and other registration information in the registration information, and construct a domain name registration information view; The host access domain name traffic information of the same host accessing different domain names within a preset time window is used to construct a host access view; The domain name resolution view is constructed based on the coincidence degree of the set of internet protocol addresses obtained through domain name resolution; The page information view is constructed based on the various page information of the domain name page.

[0009] In one possible implementation, the method further includes: The monitoring domain name is taken as a center node, and a node attention algorithm is used to calculate the domain name features of the monitoring domain name and the association weight between adjacent domain name nodes in each domain name view; Based on the domain name features and the association weight, a domain name embedding vector corresponding to each domain name view is generated.

[0010] In one possible implementation, the method further includes: A view attention algorithm is used to weight and fuse the domain name embedding vectors corresponding to each domain name view according to a view fusion weight, to generate a multi-view unified embedding vector corresponding to the monitoring domain name.

[0011] In one possible implementation, the method further includes: Based on the multi-view unified embedding vector, the malicious probability of the monitoring domain name is calculated and outputted; Based on the malicious probability, it is judged whether the monitoring domain name is a malicious domain name.

[0012] In one possible implementation, the method further includes: Based on the multi-view unified embedding vector, a parameter of an attention graph neural network is optimized, wherein the attention graph neural network is used to judge whether the monitoring domain name is a malicious domain name, and the attention graph neural network includes a node layer attention neural network and a view layer attention graph neural network, the node layer attention neural network applies a node attention algorithm, and the view layer attention graph neural network applies a view attention algorithm.

[0013] The application also provides a malicious domain name detection device based on multi-view, which includes the following modules: An acquisition module is configured to acquire multi-dimensional information of a monitoring domain name in real time; A construction module is configured to construct a plurality of domain name views corresponding to the multi-dimensional information respectively; generate, as a center node, the monitored domain name, based on domain name features of the center node in the multiple domain name views and weights of adjacent domain name nodes, domain name embedding vectors corresponding to the monitored domain name in each domain name view; The generating module is further configured to calculate, based on the domain name embedding vectors corresponding to the monitored domain name in each domain name view, a multi-view unified embedding vector corresponding to the monitored domain name by using a view attention algorithm. The detecting module is configured to determine whether the monitored domain name is a malicious domain name based on the multi-view unified embedding vector.

[0014] The application further provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the multi-view based malicious domain name detection method according to any one of the above when executing the computer program.

[0015] The application further provides a non-transitory computer readable storage medium having a computer program stored thereon, and the computer program is executable on a processor to implement the multi-view based malicious domain name detection method according to any one of the above.

[0016] The application further provides a computer program product including a computer program, and the computer program is executable on a processor to implement the multi-view based malicious domain name detection method according to any one of the above.

[0017] The multi-view based malicious domain name detection method, device, electronic device, and medium provided by the application can effectively cope with the bypass behavior of attackers and improve the detection accuracy and the detection accuracy by constructing a domain name multi-view association graph structure based on multi-dimensional domain name related information and simultaneously using the association relationship of different dimensions of domain names. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings described below are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0019] Figure 1 is one of the flowcharts of the malicious domain name detection method based on multiple views provided by the present application.

[0020] Figure 2 is the second flowchart of the malicious domain name detection method based on multiple views provided by the present application.

[0021] Figure 3 is the flowchart of the domain name multiple view construction provided by the present application.

[0022] Figure 4 is the flowchart of the attention graph neural network detection provided by the present application.

[0023] Figure 5 is the relationship diagram among multiple modules provided by the present application.

[0024] Figure 6 is the result diagram of the detection within one month provided by the present application.

[0025] Figure 7 is the structural diagram of the malicious domain name detection device based on multiple views provided by the present application.

[0026] Figure 8 is the structural diagram of the electronic device provided by the present application. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solutions and advantages of the present application more clear, the technical solutions of the present application will be described clearly and completely below in combination with the drawings in the present application. Obviously, the described embodiments are some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor belong to the protection scope of the present application.

[0028] In order to facilitate the understanding of the embodiments of the present application, the following will be further explained and described in specific embodiments in combination with the drawings. The embodiments do not constitute a limitation on the embodiments of the present application.

[0029] Figure 1 is one of the flowcharts of the malicious domain name detection method based on multiple views provided by the present application, as Figure 1 shown, the method comprises the following: S11, real-time collection of multi-dimensional information of the monitored domain name.

[0030] In the embodiment of the application, first, multi-dimensional information related to the monitored domain name in the monitoring list is acquired, and the multi-dimensional information includes domain name string information, domain name registration information, host access domain name traffic information and domain name page information.

[0031] S12, based on the multi-dimensional information, a corresponding plurality of domain name views are constructed.

[0032] The plurality of domain name views include a domain name character view, a domain name registration information view, a host access view, a domain name resolution view and a page information view.

[0033] For the domain name string information, a domain name maximum matching segmentation algorithm is applied to segment the monitored domain name into a plurality of domain name segments, and a domain name character view is constructed according to the association degree between the plurality of domain name segments.

[0034] For the domain name registration information, a domain name registration information view construction algorithm is applied to mine the registration relationship between the monitored domain names according to the registrant, the registration location and the registration mailbox in the registration information, and to construct a domain name registration information view.

[0035] Based on the host access domain name traffic information of the same host accessing different domain names within a preset time window, a host access view is constructed.

[0036] Based on the coincidence degree of the internet protocol address set obtained by domain name resolution, a domain name resolution view is constructed.

[0037] Based on a plurality of page information of a domain name page, a page information view is constructed.

[0038] S13, taking the monitored domain name as a center node, based on the domain name features of the center node in the plurality of domain name views and the weight of adjacent domain name nodes, a domain name embedding vector corresponding to the monitored domain name in each domain name view is generated.

[0039] Taking the monitored domain name as a center node, a node attention algorithm is used to calculate the domain name features of the monitored domain name and the association weight between adjacent domain name nodes in each domain name view; based on the domain name features and the association weight, a domain name embedding vector corresponding to each domain name view is generated.

[0040] S14, based on the domain name embedding vector corresponding to the monitored domain name in each domain name view, a view attention algorithm is applied to calculate a multi-view unified embedding vector corresponding to the monitored domain name.

[0041] The view attention algorithm is used to weight and fuse the domain name embedding vectors corresponding to each domain name view according to the view fusion weight, and a multi-view unified embedding vector corresponding to the monitored domain name is generated.

[0042] S15, whether the monitored domain name is a malicious domain name is judged based on the multi-view unified embedding vector.

[0043] Based on the multi-view unified embedding vector, the malicious probability of the monitored domain name is calculated and output; and whether the monitored domain name is a malicious domain name is judged based on the malicious probability.

[0044] The malicious domain name detection method of the embodiment of the application first acquires multi-dimensional information of the domain names in the detection list, then constructs domain name multi-views based on the acquired multi-dimensional domain name information, generates embedding vector representations of each domain name, finally fuses the embedding vector representations of different views through the attention neural network, and realizes the detection of malicious domain names according to the fused vector.

[0045] The malicious domain name detection method based on multi-views provided by the application acquires multi-dimensional information of the monitored domain name in real time; constructs a plurality of corresponding domain name views based on the multi-dimensional information; takes the monitored domain name as a center node, generates the domain name embedding vector corresponding to the monitored domain name in each domain name view based on the domain name features of the center node in the plurality of domain name views and the weight of the adjacent domain name nodes; applies a view attention algorithm to calculate a multi-view unified embedding vector corresponding to the monitored domain name based on the domain name embedding vector corresponding to the monitored domain name in each domain name view; and judges whether the monitored domain name is a malicious domain name based on the multi-view unified embedding vector. Compared with the defects of inaccurate, missed and false detection of malicious domain names in the prior art, the method can effectively cope with the bypass behavior of attackers, improve the detection precision and the high detection accuracy based on the multi-dimensional domain name related information, construct the domain name multi-view association graph structure and utilize the association relationship of different dimensions of the domain name.

[0046] Figure 2 is a flowchart of the malicious domain name detection method based on multi-views provided by the application, as shown in Figure 2 The method comprises the following steps: S21, multi-dimensional information of the monitored domain name is acquired in real time, and a plurality of corresponding domain name views are constructed based on the multi-dimensional information.

[0047] In the embodiment of the present application, first, the multi-dimensional information related to the monitored domain name in the monitoring list is acquired, and the multi-dimensional information includes domain name string information, domain name registration information, host access domain name traffic information and domain name page information. Among them, the domain name string information can be directly acquired through the monitoring domain name list; the domain name registration information is mainly queried through the WHOIS interface, and the related domain name registration information includes domain name registration contact, contact telephone number, contact email, domain name creation time and domain name update time; the host access domain name traffic information is mainly extracted from passive DNS traffic, and the domain name query message related to the monitored domain name is filtered through keyword matching in the passive DNS traffic database; the domain name page information is sent to the monitored domain name through HTTP request or HTTPS request by using the requests library through the python script, and the corresponding HTML page source code is retained, and the corresponding page information is acquired through regular expression matching.

[0048] Further, based on the multi-dimensional information, a plurality of domain name views corresponding to the multi-dimensional information are constructed, such as Figure 3 As shown in the figure, the domain name multi-view includes a domain name character view, a domain name registration information view, a host access view, a domain name resolution view and a page information view.

[0049] The domain name segmentation matching algorithm is applied to the monitored domain name to generate a domain name segmentation list, and the segmentation correlation score of the domain name segmentation is calculated, and the segmentation result and the correlation score are input into the domain name string correlation graph construction algorithm to generate a domain name character view G str .

[0050] Specifically, first, the domain name maximum matching segmentation algorithm is applied to the domain name string, and the domain name is divided into a plurality of domain name segments. Among them, the domain name maximum matching segmentation algorithm includes three steps of forward maximum matching algorithm, backward maximum matching algorithm and bidirectional maximum matching algorithm. Then, the domain name character view is constructed according to the correlation degree between the domain name segments. The domain name character view can be represented as G str =<D,E>, wherein D is a set of monitored domain names, E is an edge set, the nth domain name node can be represented as Dn={dn,Sn}, wherein dn is the string composition of the domain name, and Sn is the segmentation result set of the domain name. E={E1,E2,…,En}, wherein Ei={Dp,Dq}, wherein Dp={dp,Sp}, Dq={dq,Sq}, the intersection of Sp and Sq is not empty. In addition, since the frequency of different domain name segments generated by each domain name appearing in the entire data set is different, the importance of different frequency segments for domain name classification should also be different. The edge weight of the domain name character correlation graph is calculated as follows: Among them wTF (Term Frequency)-IDF (inverse document frequency) value weight between the domain names represented. TF and IDF can be represented as: wherein represents the number of occurrences of the word segmentation in the domain name j, k represents the total number of word segmentation, represents the total number of domain names in the domain name data set. denotes the kth word segmentation of the domain name i, is defined as follows: The present application defines three adjustable parameters , through which the influence degree of the length of the domain name and the frequency of the word segmentation on the importance of the domain name in the training process can be dynamically adjusted. represents the frequency of the domain name word segmentation in the entire domain name word segmentation set, and represents the frequency of the domain name word segmentation in the domain name word segmentation set. represents the text length of the domain name .

[0051] The crawler system is used to retrieve the registration information related to the monitoring domain name, and the registration relationship between the monitoring domain names is mined according to the registration information such as the registrant, the registration location and the registration mailbox in the registration information, and a domain name registration information view G whois is constructed.

[0052] Specifically, the domain name registration information view construction algorithm mainly uses a crawler to crawl the registration information related to the domain name, and the related registration information obtained includes the domain name registration contact person, the domain name registration contact telephone, the domain name registration contact email, the domain name creation time and the domain name update time. The registration email and other information in the domain name registration information may belong to public resources, so the association weight between the domain names determined by different types of registration information is different, and therefore the domain name registration information view construction algorithm determines different association weights according to different registration information distribution. The whois information six-tuple of the domain name i is , wherein respectively represent the contact person, the contact telephone, the contact email, the creation time, and the update time. The domain name association score calculation method is as shown below, wherein L is a 01 loss function, is a trainable weight parameter.

[0053] ​ Collecting the traffic related to the domain name, using the request message of the source host to the target domain name and the response message of the target domain name to construct a host access view G access And a domain name resolution view G ip .

[0054] Specifically, the host access view is generated by analyzing the DNS traffic information, and the host access view G access =<D,E>, wherein D is a domain name node set, and E is a host access view edge set. A time window threshold α access The host set that accesses the domain name di within the time window threshold α i ={host1,host2,…}, when the intersection of HOST i and HOST j is not empty, d i and d j are connected, and the edge weight weight ij =|HOST i,j |, |HOST i,j | is the ratio of the number of hosts contained in the intersection of HOST i and HOST j to the number of hosts contained in the union.

[0055] The domain name resolution view G ip can be represented as G ip =<D,E>, wherein D is a domain name node set, and E is a domain name resolution view edge set, wherein the higher the coincidence degree of the IP sets of two domain name resolutions, the stronger the association, and the application defines four IP coincidence relations, including ip equality, ip proximity, ip same network segment, and ip different network segment, in order coi(ip1,ip2) 1-4 , and the IP coincidence score COI(ip d1 ,ip d2 ) is the sum of the four types of coincidence scores, which is used to represent the association weight between d1 and d2. When and are completely equal, , otherwise 0; when and meet the proximity relationship, , otherwise 0; and so on to and . When defining the weight, for the domain names and , the IP sets and corresponding thereto, the application defines the IP set coincidence score : Edge weights in the IP resolution graph As shown below, this invention defines the correlation between two domain name IP sets based on their different degrees of overlap by defining an IP set overlap score.

[0056] The web crawler system is used to retrieve visible pages corresponding to the monitored domains, and the longest common source code sequence algorithm is used to calculate the page similarity between different monitored domains, generating a page information view G. html .

[0057] Specifically, the page information view construction algorithm mainly consists of two steps: measuring the length of the longest common source code sequence of pages and extracting page information. For page information corresponding to two domains... , The longest common source code sequence refers to a sequence that exists in strict order. X Subscript sequence For all ,satisfy The steps for measuring the length of the longest common source code sequence of pages can be summarized as follows: First, obtain the page information lengths corresponding to the two domains. Then, a public source code sequence list c is created to store it. X and Y The public source code information is retrieved and C is initialized; then the page information is traversed. X and Y If the text at corresponding positions is the same, the length of the common source code sequence at this time is the length of the sequence at the previous position plus 1, and this length of the common source code sequence is stored in the source code sequence table c; if the text at corresponding positions is different, then the value at the corresponding position in c is set to be the same as the previous position. Page information extraction targets include the domain page's electronic certificate, hard-coded email information on the page, statistical links, redirect links, form information, and TKD (title, keywords, and description) information. Page information view G html =<D,E> Where D is the set of domain nodes and E is the set of page information view edges. If the domain , If they appear in the Alternative Name of the same CA certificate, then it applies to the domain name. , Connect edges; if the domain name , If HTML elements contain the same email information or statistical links, then the domain name will be affected. , Connect edges; if the domain name , If the redirect links are the same, meaning the URLs after redirection from the two domains are identical, then the domains are considered to have the same redirection URLs. , Connect edges; if the domain name , If the form submission URL and form field names are the same in the form information contained therein, then the domain name... , Connect edges; if the domain name , If the text similarity of the TKD information is high, then the domain name... , Link edges. Additionally, for domain pairs with high HTML source code similarity or long common subsequences in their HTML source code, it's unnecessary to extract the above information; simply link them directly.

[0058] S22. Using the monitored domain name as the central node, the node attention algorithm is used to calculate the domain name characteristics of the monitored domain name and the association weight between adjacent domain name nodes in each domain name view.

[0059] S23. Based on the domain name features and the association weights, generate a domain name embedding vector corresponding to each domain name view.

[0060] By applying a node attention algorithm, the features of the domain names in each specific view and the association weights between each domain name are calculated to generate the embedding vector of the domain name nodes corresponding to each view. ; The node attention algorithm performs uniform sampling on each input view, randomly selects node v as the starting point for subsequent random walks, and then randomly samples the neighboring nodes of node v and traverses this process. The influence weights of different neighboring nodes on the domain node are autonomously learned and calculated through the attention mechanism.

[0061] Specifically, such as Figure 4 As shown, the attention graph neural network consists of a node-layer attention graph neural network and a view-layer attention graph neural network. The node-layer attention graph network learns the features of domain names in a specific view and the weights of neighboring nodes of the domain names, and generates domain name embedding vectors for that specific view using a graph embedding scheme. Specifically, starting from a node in the multiple domain name views constructed above, neighboring nodes are randomly selected and moved each time, and then the domain name sequences obtained from the random walks are combined. The graph structure input to the node-layer attention graph network is defined as follows: Where V is the set of domain name nodes and E is the set of edges. Where S is the size of the feature space for each attribute vector. Let Y be the set of labels. Different neighboring nodes have different influences on node d, and it is necessary to distinguish different neighbors through weights. This invention also introduces an attention mechanism to autonomously learn the weights of different neighboring nodes. The weights between nodes d and i in view v can be expressed as: in, Let H represent the set of neighboring nodes of node d in view v, and H be a trainable parameter matrix. The embedding of node u in view v can be represented as: S24. Using the view attention algorithm, the domain name embedding vectors corresponding to each domain name view are weighted and fused according to the view fusion weight to generate the unified embedding vector of multiple views corresponding to the monitored domain name.

[0062] By applying the view attention algorithm, the domain embedding vectors of the different domain views generated above are fused to generate a multi-view embedding vector representation of the domain.

[0063] Specifically, the view-layer attention network projects node layer vectors into a high-dimensional space and then combines multiple views to generate a joint embedding vector. Specifically, firstly, multiple layers of embedding vectors are set for each view, where the higher the number of embedding vector layers, the more detailed the semantic representation of the node. The embedding vector at the l-th layer under view v can be represented as: Different views represent the relationships between domains across different dimensions. Different views also have varying degrees of importance in detecting malicious domains; therefore, it is necessary to calculate the weight of each view. as follows: in, It is the weight vector of domain name d with respect to view v. Random initialization and learning during training. Ultimately, the embedding set of domain name d under different views can be obtained: Finally, the embeddings in the collection are concatenated to obtain the multi-view embedding representation of domain d.

[0064] S25. Calculate and output the malicious probability of the monitored domain name based on the multi-view unified embedding vector.

[0065] S26. Determine whether the monitored domain name is a malicious domain name based on the malicious probability.

[0066] Based on the domain name embedding vector representation obtained in the previous step, the loss is calculated using softmax for labeled data: in, It is an indicator function. Indicates the true label, The multi-view embedding representing the domain name is obtained through a single-layer perceptron. For the final predicted number of domain name types, For unlabeled data, this embodiment of the invention uses a random walk algorithm, taking labeled data as the starting point for the random walk, and performing a random walk on the association graph to utilize unlabeled data to calculate the loss function. The loss function on the domain association graph is defined as follows, where, This represents a node on the random walk path d. This diagram illustrates the distribution of malicious domains. This represents the sigmoid function.

[0067] Finally, by combining the two types of loss functions, the final loss function can be generated, where... This represents the balance term of the two types of loss functions. This represents the L2 regularization term for the parameter.

[0068] The gradient descent algorithm was then used to optimize the model and determine malicious domains. The detected domain set was iterated repeatedly to finally generate a malicious domain determination result set. The method of this embodiment was used to detect 477,921 domains, and the detection results are as follows: Figure 6 As shown.

[0069] It should be noted that the embodiments of the present invention can pre-train the attention graph neural network and use the network to detect malicious domain names. Alternatively, the parameters of the attention graph neural network can be optimized based on the unified embedding vector of multiple views, so as to achieve on-the-fly optimization of the network. The attention graph neural network includes a node layer attention neural network and a view layer attention graph neural network. The node layer attention neural network uses the node attention algorithm, and the view layer attention graph neural network uses the view attention algorithm.

[0070] like Figure 5 The module relationship diagram of the malicious domain name detection system based on multiple views shown in this embodiment of the invention includes: The data collection module is responsible for collecting real-time data on network domain names. Based on different dimensions of domain data, this module can be divided into four sub-modules: domain character collection module, domain registration information collection module, domain access record collection module, and domain page information collection module. The domain character collection module collects the complete string name of the domain name and its different subdomains; the domain registration information collection module collects various registration information, including registrant information, registration time, and last update time; the domain access record collection module collects access record data, including traffic packets and logs from domain name resolution to IP addresses, and traffic packets and logs from user access to the domain; and the domain page information collection module obtains the HTML text data corresponding to the domain name through distributed crawlers.

[0071] Data Storage Module. This module enables efficient storage and retrieval of multi-dimensional domain name data. It employs different storage strategies for different dimensions of collected domain name data. For example, relational data is stored using a non-relational database, while redundant data such as page information is compressed to save storage space and improve efficiency. Furthermore, this module utilizes in-memory databases and caching systems to accelerate frequent data storage processes. Due to the complexity of the stored data dimensions, this module also employs a converged distributed storage strategy to alleviate the pressure on single-point storage. This includes using distributed file systems and cloud storage systems, and ensuring high availability and fault tolerance through data sharding and replication mechanisms. Simultaneously, load balancing is implemented at the application layer to optimize data read and write performance.

[0072] Malicious Domain Detection Module. This module constructs multi-view domain associations based on multi-dimensional domain data acquired by the data collection module. By building these associations and integrating multiple data dimensions, it can identify potential malicious activity patterns and relationships. Subsequently, the module uses an attention graph neural network to further analyze the multi-dimensional domain data and generate a set of malicious domains.

[0073] Centralized Scheduling Module. This module acts as the central scheduler, responsible for connecting and coordinating different modules. First, it dynamically acquires multi-level domain name data. When the malicious domain name detection module sends a request, the centralized scheduling module transmits the request content, including the required domain name and information type, to the data collection module, prioritizing these requests to optimize testing and data acquisition efficiency. Second, after data acquisition, this module is responsible for information storage and integration. The acquired data is sent to the malicious domain name detection module for further analysis and testing, and also to the data storage module to ensure effective data preservation and archiving.

[0074] This invention provides a multi-view-based malicious domain name detection method. It collects multi-dimensional information of the monitored domain name in real time; constructs multiple domain name views based on this information; uses the monitored domain name as a central node; and generates a domain name embedding vector for each domain name view based on the domain name features of the central node in each domain name view and the weights of adjacent domain name nodes. Based on this embedding vector, a view attention algorithm is applied to calculate a unified embedding vector for the monitored domain name across multiple views. Finally, the method determines whether the monitored domain name is malicious based on this unified embedding vector. This method, by constructing a multi-view association graph structure based on multi-dimensional domain name information and simultaneously utilizing the association relationships of different dimensions of the domain name, can effectively counter attacker bypass attempts and improve detection accuracy and precision.

[0075] The following describes the malicious domain name detection device based on multiple views provided by the present invention. The malicious domain name detection device based on multiple views described below can be referred to in correspondence with the malicious domain name detection method based on multiple views described above.

[0076] Figure 7 This is a schematic diagram of the structure of the malicious domain name detection device based on multiple views provided by the present invention, specifically including: The data acquisition module 701 is used to collect multi-dimensional information about the monitored domain name in real time. For detailed explanations, please refer to the relevant descriptions in the above method embodiments; they will not be repeated here.

[0077] The construction module 702 is used to construct corresponding multiple domain name views based on the multi-dimensional information. For detailed explanations, please refer to the relevant descriptions in the above method embodiments; they will not be repeated here.

[0078] The generation module 703 is used to take the monitored domain name as a central node and, based on the domain name characteristics of the central node in the various domain name views and the weights of adjacent domain name nodes, generate a domain name embedding vector corresponding to the monitored domain name in each domain name view. For detailed explanations, please refer to the relevant descriptions in the above method embodiments; they will not be repeated here.

[0079] The generation module 703 is further configured to calculate a unified embedding vector for multiple views corresponding to the monitored domain name based on the domain name embedding vector corresponding to the monitored domain name in each domain name view, using a view attention algorithm. For detailed explanations, please refer to the relevant descriptions in the above method embodiments; they will not be repeated here.

[0080] The detection module 704 is used to determine whether the monitored domain name is a malicious domain name based on the multi-view unified embedding vector. For detailed explanation, please refer to the relevant descriptions in the above method embodiments; they will not be repeated here.

[0081] Figure 8 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 8 As shown, the electronic device may include: a processor 810, a communications interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communications interface 820, and the memory 830 communicate with each other through the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute a multi-view-based malicious domain name detection method. This method includes: real-time acquisition of multi-dimensional information of the monitored domain name; constructing corresponding multiple domain name views based on the multi-dimensional information; using the monitored domain name as a central node, generating a domain name embedding vector corresponding to the monitored domain name in each domain name view based on the domain name features of the central node in the multiple domain name views and the weights of adjacent domain name nodes; applying a view attention algorithm to calculate a unified multi-view embedding vector corresponding to the monitored domain name based on the domain name embedding vector corresponding to the monitored domain name in each domain name view; and determining whether the monitored domain name is a malicious domain name based on the unified multi-view embedding vector.

[0082] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0083] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the malicious domain name detection method based on multiple views provided by the above methods. The method includes: real-time collection of multi-dimensional information of the monitored domain name; constructing corresponding multiple domain name views based on the multi-dimensional information; using the monitored domain name as a central node, generating a domain name embedding vector corresponding to the monitored domain name in each domain name view based on the domain name features of the central node in the multiple domain name views and the weights of adjacent domain name nodes; calculating a unified embedding vector for the monitored domain name based on the unified embedding vector for each domain name view using a view attention algorithm; and determining whether the monitored domain name is a malicious domain name based on the unified embedding vector for the multiple views.

[0084] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the malicious domain name detection method based on multiple views provided by the above methods. The method includes: real-time collection of multi-dimensional information of the monitored domain name; constructing corresponding multiple domain name views based on the multi-dimensional information; using the monitored domain name as a central node, generating a domain name embedding vector corresponding to the monitored domain name in each domain name view based on the domain name features of the central node in the multiple domain name views and the weights of adjacent domain name nodes; calculating a unified embedding vector for the monitored domain name in each domain name view using a view attention algorithm based on the unified embedding vector for the monitored domain name in each domain name view; and determining whether the monitored domain name is a malicious domain name based on the unified embedding vector for the multiple views.

[0085] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0086] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0087] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting malicious domain names based on multiple views, characterized in that, include: Real-time collection of multi-dimensional information on the monitored domains; Based on the aforementioned multi-dimensional information, various corresponding domain name views are constructed. Using the monitored domain name as the central node, and based on the domain name characteristics of the central node in the various domain name views and the weights of adjacent domain name nodes, a domain name embedding vector corresponding to the monitored domain name in each domain name view is generated. Based on the domain name embedding vector corresponding to the monitored domain name in each domain name view, the view attention algorithm is applied to calculate the multi-view unified embedding vector corresponding to the monitored domain name. The monitored domain name is determined as a malicious domain name based on the unified embedding vector of the multi-view.

2. The method according to claim 1, characterized in that, The multi-dimensional information includes domain name string information, domain name registration information, host access domain name traffic information, and domain name page information; The various domain name views include a domain name character view, a domain name registration information view, a host access view, a domain name resolution view, and a page information view; The construction of various domain name views based on the multi-dimensional information includes: For the domain name string information, the domain name maximum matching word segmentation algorithm is applied to divide the monitored domain name into multiple domain name words, and a domain name character view is constructed based on the degree of correlation between the multiple domain name words; For the domain registration information, the domain registration information view construction algorithm is applied to mine the registration relationships between the monitored domains based on the registration information such as the registrant, registration location, and registration email address, and construct a domain registration information view; A host access view is constructed based on the host access domain traffic information of the same host accessing different domains within a preset time window. A domain name resolution view is constructed based on the overlap of the Internet Protocol address set obtained from domain name resolution; A page information view is constructed based on various page information from the domain name page.

3. The method according to claim 2, characterized in that, The step of using the monitored domain name as a central node, and generating a domain name embedding vector for the monitored domain name in each domain name view based on the domain name characteristics of the central node in the various domain name views and the weights of adjacent domain name nodes, includes: Using the monitored domain name as the central node, the node attention algorithm is used to calculate the domain name characteristics of the monitored domain name and the association weight between adjacent domain name nodes in each domain name view. Based on the domain name features and the association weights, a domain name embedding vector is generated for each domain name view.

4. The method according to claim 3, characterized in that, The step of calculating the unified multi-view embedding vector corresponding to the monitored domain name based on the domain name embedding vector corresponding to each domain name view by applying the view attention algorithm includes: The view attention algorithm is used to weight and fuse the domain embedding vectors corresponding to each domain view according to the view fusion weight, so as to generate the unified embedding vector of multiple views corresponding to the monitored domain.

5. The method according to claim 4, characterized in that, The step of determining whether the monitored domain name is a malicious domain name based on the multi-view unified embedding vector includes: The malicious probability of the monitored domain name is calculated and output based on the multi-view unified embedding vector. The monitored domain name is determined to be a malicious domain name based on the probability of malice.

6. The method according to claim 1, characterized in that, The method further includes: The attention graph neural network is optimized based on the multi-view unified embedding vector. The attention graph neural network is used to determine whether the monitored domain name is a malicious domain name. The attention graph neural network includes a node layer attention graph neural network and a view layer attention graph neural network. The node layer attention graph neural network applies a node attention algorithm, and the view layer attention graph neural network applies a view attention algorithm.

7. A malicious domain name detection device based on multiple views, characterized in that, include: The data acquisition module is used to collect multi-dimensional information about the monitored domain name in real time. The construction module is used to construct corresponding multiple domain name views based on the multi-dimensional information; The generation module is used to take the monitored domain name as the central node, and generate the domain name embedding vector corresponding to the monitored domain name in each domain name view based on the domain name characteristics of the central node in the multiple domain name views and the weights of adjacent domain name nodes. The generation module is further configured to calculate the unified embedding vector of the monitored domain name in each domain name view by applying a view attention algorithm based on the domain name embedding vector of the monitored domain name in each domain name view. The detection module is used to determine whether the monitored domain name is a malicious domain name based on the multi-view unified embedding vector.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the malicious domain name detection method based on multiple views as described in any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the malicious domain name detection method based on multiple views as described in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the malicious domain name detection method based on multiple views as described in any one of claims 1 to 6.

Images