A DGA Domain Name Detection Method and System Based on Obfuscation Awareness

Abstract

This invention relates to the field of network detection, providing a method and system for DGA domain name detection based on confusion awareness. The method includes: extracting multi-dimensional features from original DGA domain name samples to obtain multi-channel feature vectors; identifying easily confused categories of DGA domain names based on an confusion-aware branch network to obtain a category-aware matrix; performing targeted reinforcement learning on easily confused categories based on the category-aware matrix through a difference representation learning branch to obtain difference representation vectors; weightedly fusing the multi-channel feature vectors and difference representation vectors through a feature fusion network to obtain enhanced feature representations; training a cost-sensitive classifier based on the enhanced feature representations using a joint loss function to obtain a DGA domain name classification model; and performing classification prediction on the domain name to be detected using the DGA domain name classification model to obtain the DGA domain name family classification result. This invention improves the effectiveness of imbalanced data processing and enhances the security of network protection.

Description

Technical Field

[0001] This invention relates to the field of network detection technology, and in particular to a DGA domain name detection method and system based on obfuscation awareness. Background Technology

[0002] Domain Name Generation Algorithm (DGA) is a dynamic communication mechanism widely used in modern botnets. It generates a large number of pseudo-random domain names as candidate addresses for command and control (C&C) servers, thereby circumventing traditional blacklist-based detection methods.

[0003] As cybersecurity threats continue to evolve, DGA detection technology has also undergone a development process from traditional statistical analysis to deep learning. Early DGA detection methods were mainly based on DNS traffic analysis, identifying threats through contextual features such as statistical query frequency and NXDomain ratio. However, these methods were computationally complex and only applicable to binary classification scenarios. Subsequently, context-free detection methods based on domain name character features emerged, achieving detection by analyzing character distribution, entropy, n-grams, and other features, demonstrating advantages in privacy protection and computational efficiency. In recent years, the introduction of deep learning technology has brought revolutionary breakthroughs to DGA detection. Sequence modeling methods such as LSTM, GRU, and Transformer have significantly improved detection performance, while innovative methods such as cost-sensitive learning and multimodal fusion have emerged, effectively solving some data imbalance problems.

[0004] However, existing technologies still face serious class imbalance challenges, especially in multi-class DGA family recognition tasks.

[0005] Traditional imbalanced learning methods, such as Random Oversampling (ROS) and SMOTE, primarily address the imbalance problem at the level of sample quantity. However, in the field of DGA detection, the real challenge is not simply the uneven distribution of sample numbers, but rather the significant confounding effect between different DGA families in the traditional feature space. Specifically, although different families differ fundamentally at the generation algorithm level, they exhibit high similarity in character-level statistical features, making it difficult for classification models to establish clear discriminative boundaries and leading to easily confused categories. Existing methods lack specific mechanisms to handle this confounding effect and cannot effectively mine the deep differences between different DGA families, resulting in poor detection performance for families with few samples and similar families, severely impacting detection performance in practical applications. Summary of the Invention

[0006] This invention aims to at least improve one of the technical problems existing in the prior art. To this end, this invention proposes a DGA domain name detection method and system based on obfuscation awareness.

[0007] The technical solution of the present invention is as follows:

[0008] A method for detecting DGA domain names based on obfuscation awareness, comprising:

[0009] S1: Obtain the original DGA domain name sample and perform multi-dimensional feature extraction to obtain a multi-channel feature vector;

[0010] S2: Based on the confusion-aware branch network and the multi-channel feature vector, identify the easily confused categories of DGA domain names to obtain the category-aware matrix;

[0011] S3: Based on the category-aware matrix, perform targeted reinforcement learning on easily confused categories through the differential representation learning branch to obtain differential representation vectors;

[0012] S4: Based on the feature fusion network, the multi-channel feature vector and the differential representation vector are weighted and fused to obtain an enhanced feature representation;

[0013] S5: Based on the enhanced feature representation, a cost-sensitive classifier is trained using a joint loss function to obtain the DGA domain name classification model;

[0014] S6: Based on the DGA domain name classification model, classify and predict the domain name to be detected to obtain the DGA domain name family classification result.

[0015] In one possible technical solution, further, in S1, the multi-channel feature vector includes: character sequence feature vector, statistical feature vector, n-gram feature vector, and top-level domain (TLD) feature vector.

[0016] In one possible technical solution, S1 further includes:

[0017] S11: Use a character sequence encoder to perform LSTM encoding on the domain name string in the original DGA domain name sample to obtain the character sequence feature vector;

[0018] S12: Calculate the statistical indicators of the domain name to obtain the statistical feature vector; wherein the statistical indicators include entropy value, character ratio and length;

[0019] S13: Extract the 2-gram sequence of the domain name and encode it to obtain the n-gram feature vector;

[0020] S14: Based on the top-level domain name resolver, extract the top-level domain name of the domain name and perform feature encoding to obtain the top-level domain name feature vector.

[0021] In one possible technical solution, S2 further includes:

[0022] S21: Combine the feature vectors in the multi-channel feature vectors into a joint representation through a feature splicing layer to obtain a joint category representation vector;

[0023] S22: Perform initial classification prediction on the joint category representation vector based on a fully connected classifier to obtain the category prediction probability distribution;

[0024] S23: Identify easily confused category pairs based on the predicted probability distribution of the categories to obtain a set of confused pairs;

[0025] S24: Based on the matrix construction algorithm, the predicted probability distribution of the categories and the set of confusion pairs are converted into inter-category confusion relationships to obtain the category-aware matrix.

[0026] In one possible technical solution, S3 further includes:

[0027] S31: Based on the category awareness matrix, weights are assigned to easily confused category samples through an attention mechanism to obtain category attention weights;

[0028] S32: Based on the category attention weights, the difference features between easily confused categories are mined through a dual-channel encoder to obtain category difference features;

[0029] S33: Adaptively fuse all features in the category difference features to obtain an enhanced difference representation;

[0030] S34: Optimize the confusion sensitivity of the enhanced differential representation by modifying the loss function to obtain the differential representation vector.

[0031] In one possible technical solution, the dual-channel encoder in S32 further includes:

[0032] The first path encoder is used to perform deep representation learning on the original features of easily confused categories to obtain the first path representation vector.

[0033] The second path encoder is used to supplement the statistical features of easily confused categories with representation learning to obtain the second path representation vector.

[0034] In one possible technical solution, S4 further includes:

[0035] S41: Output feature fusion weights through the attention weight calculation module, and perform weighted fusion of the multi-channel feature vector and the differential representation vector according to the feature fusion weights to obtain the fused feature vector;

[0036] S42: Input the fused feature vector into the nonlinear transformation layer to perform feature enhancement and obtain the enhanced feature representation.

[0037] In one possible technical solution, S5 further includes:

[0038] S51: Determine the class weights based on the distribution of multiple DGA family samples in the preset training dataset to obtain the cost-sensitive weight matrix;

[0039] S52: Based on the cost-sensitive weight matrix, construct a loss function based on weighted cross-entropy to obtain the cost-sensitive loss function;

[0040] S53: The confusion perception loss is obtained based on the classification loss of the confusion perception branch network, and the differential representation loss is obtained based on the correction loss of the differential representation learning branch. The confusion perception loss, differential representation loss and the cost-sensitive loss function are combined by weighted summation to obtain the joint loss function.

[0041] S54: Based on the extreme gradient boosting classifier, combined with the joint loss function, the enhanced feature representation is trained end-to-end to obtain the DGA domain name classification model.

[0042] In one possible technical solution, S6 further includes:

[0043] S61: Based on a multi-channel feature extractor and feature fusion network, the domain name to be detected is transformed to obtain the enhanced feature representation to be detected;

[0044] S62: Input the enhanced feature representation to be detected into the DGA domain name classification model to obtain the DGA domain name family classification result.

[0045] An obfuscation-aware DGA domain name detection system is provided to implement the above-mentioned detection method, wherein the system includes the following components.

[0046] Extraction module: used to obtain original DGA domain name samples for multi-dimensional feature extraction, and obtain multi-channel feature vectors;

[0047] Identification module: Based on the confusion-aware branch network and the multi-channel feature vector, identify the easily confused categories of DGA domain names and obtain the category-aware matrix;

[0048] Learning module: Based on the category-aware matrix, it performs targeted reinforcement learning on easily confused categories through a differential representation learning branch to obtain differential representation vectors;

[0049] Fusion module: used to perform weighted fusion of the multi-channel feature vector and the differential representation vector based on the feature fusion network to obtain an enhanced feature representation;

[0050] Training module: used to train a cost-sensitive classifier based on the enhanced feature representation using a joint loss function to obtain a DGA domain name classification model;

[0051] The prediction module is configured as the DGA domain name classification model and is used to perform classification prediction on the domain name to be detected according to the DGA domain name classification model to obtain the DGA domain name family classification result.

[0052] The DGA domain name detection method and system based on confusion perception according to the present invention captures the difference features between DGA domain names by extracting multi-dimensional information, and then finds those category patterns that are easy to misclassify. Then, the model is strengthened to learn these patterns in a targeted manner, so that the model can have a better detection effect on categories with few samples and difficult to distinguish even under imbalanced data conditions.

[0053] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0054] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0055] Figure 1 This is a flowchart of a DGA domain name detection method based on obfuscation awareness according to an embodiment of the present invention;

[0056] Figure 2 This is a schematic diagram of a DGA domain name detection system based on obfuscation awareness according to an embodiment of the present invention. Detailed Implementation

[0057] The embodiments of the present invention are described in detail below. The embodiments described with reference to the accompanying drawings are exemplary. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0058] It should be noted that when a component is said to be "fixed to" another component, it can be directly attached to the other component or there may be an intervening component. When a component is said to be "connected to" another component, it can be directly connected to the other component or there may be an intervening component.

[0059] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0060] The terms "first," "second," "third," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish different objects and not to describe a particular order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, it may include a series of steps or units, or optionally, steps or units not listed, or other steps or units inherent to these processes, methods, products, or devices.

[0061] The accompanying drawings show only the portions relevant to this application, not all of them. Before discussing exemplary embodiments in more detail, it should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe operations (or steps) as sequential processes, many of these operations may be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the operations may be rearranged. The process may be terminated when its operation is completed, but may also have additional steps not included in the drawings. The process may correspond to a method, function, procedure, subroutine, subprogram, etc.

[0062] The terms “component,” “module,” “system,” “unit,” etc., used in this specification are used to refer to computer-related entities, hardware, firmware, combinations of hardware and software, software, or software in execution. For example, a unit can be, but is not limited to, a process running on a processor, a processor, an object, an executable file, a thread of execution, a program, and / or distributed between two or more computers. Furthermore, these units can be executed from various computer-readable media on which various data structures are stored. Units can communicate, for example, via local and / or remote processes based on signals having one or more data packets (e.g., data from a second unit interacting with another unit between a local system, a distributed system, and / or a network; for example, the Internet interacting with other systems via signals).

[0063] To better understand this invention, the research background of this invention will be explained in detail below.

[0064] This invention addresses the challenge of CC class perception in DGA detection by proposing a multi-layered optimization strategy for confusion perception. The overall approach is to first help the model develop a more comprehensive discrimination capability, then make targeted adjustments for highly confusing categories, and finally balance the overall picture with key categories in the prediction stage to obtain more robust decisions.

[0065] In the initial stage, the model learns the basic discriminative features of all DGA categories through multi-source input information, ensuring overall recognition performance. More importantly, for the identified easily confused categories (CCs), the model explicitly enhances its ability to perceive and distinguish subtle differences between these categories during training. This is achieved by dynamically adjusting the optimization target or loss weights, forcing the decision boundary to be clearer and more sensitive in the CC region. This mechanism not only strengthens the model's foundation in all-category classification but also significantly improves its ability to discriminate difficult samples. Finally, by combining global capabilities with targeted reinforcement, the model maintains good judgment performance in both common scenarios and complex category relationships.

[0066] In this process, the present invention introduces a weighted strategy based on prior information: for class pairs that are prone to misclassification, relatively higher attention is given during training, thereby reducing the impact of high confusion. This strategy does not require changes to the main structure and plays more of a supporting role to enhance the stability of the model under complex class relationships.

[0067] Within the experimental scope, the method of the present invention showed a positive trend of improvement in overall accuracy and recall of some categories, demonstrating the potential application value of "confusion perception + targeted reinforcement" in DGA detection.

[0068] The embodiments of the present invention are described below with reference to the figures.

[0069] like Figure 1 As shown, this embodiment provides a DGA domain name detection method based on obfuscation awareness, which includes:

[0070] S1: Obtain the original DGA domain name sample through a confusion-aware multi-channel feature extractor and perform multi-dimensional feature extraction to obtain a multi-channel feature vector.

[0071] In S1, this invention employs a modular design to construct a multi-channel feature extractor. It processes the original DGA domain name string in parallel through four independent feature extraction channels. Each channel performs feature mining at different semantic levels of the domain name, ultimately forming a unified-dimensional feature representation. The multi-channel feature vectors in S1 include: character sequence feature vectors, statistical feature vectors, n-gram feature vectors, and top-level domain (TLD) feature vectors.

[0072] Wherein, S1 further includes:

[0073] S11: Use a character sequence encoder to perform LSTM encoding on the domain name string in the original DGA domain name sample to obtain the character sequence feature vector.

[0074] Furthermore, the character sequence encoder receives the original DGA domain name string as input. First, it maps each character in the domain name to its corresponding ASCII code value, forming a numerical sequence. Then, the ASCII code values ​​are converted into 64-dimensional character embedding vectors through an embedding layer, with each character corresponding to a fixed-length vector representation. Subsequently, the character embedding vector sequence is processed step by step by an LSTM encoder. The hidden state dimension of the LSTM is set to 64 dimensions. During the processing, the hidden state of the previous time step and the current character embedding vector are fused through a gating mechanism, including a forget gate to control the degree of retention of historical information, an input gate to determine the importance of current information, and an output gate to adjust the output of the hidden state. After iterations of the sequence length, the final hidden state of the LSTM contains the semantic information of the entire domain name character sequence, and outputs a 64-dimensional character sequence feature vector.

[0075] S12: Calculate the statistical indicators of the domain name to obtain the statistical feature vector; wherein the statistical indicators include entropy value, character ratio and length.

[0076] Furthermore, after receiving the domain name string, the statistical feature calculator calculates three types of statistical indicators: entropy value, which is the frequency of occurrence of each character in the domain name; character ratio calculation, including four dimensions: vowel ratio, consonant ratio, numeric character ratio, and special character ratio, obtained by dividing the number of each type of character by the total length of the domain name; and length statistics, including three dimensions: total domain name length, non-top-level domain name length, and top-level domain name length. After the calculation is completed, the 15 calculated statistical indicators are combined into a statistical feature vector, and then a multilayer perceptron is used for dimensional transformation. The multilayer perceptron contains two fully connected layers, and a ReLU activation function is added after each layer. Finally, the statistical feature vector is output.

[0077] S13: Extract the 2-gram sequence of the domain name and encode it to obtain the n-gram feature vector.

[0078] Furthermore, step S13 is implemented using an n-gram analyzer. The n-gram analyzer performs a sliding window operation on the input domain name, gradually moving the window from the first character of the domain name to extract all consecutive 2-character combinations. For example, the domain name "example" will generate 2-gram subsequences such as "ex", "xa", "am", "mp", "pl", and "le". This invention establishes a 2-gram dictionary, mapping each 2-gram subsequence to a unique integer index; then, the 2-gram sequence of the domain name is converted into an index sequence, and each index is mapped to a vector through an embedding layer; then, the LSTM encoder processes the 2-gram embedding vector sequence step by step, fusing the hidden state of the previous time step with the current 2-gram vector information through a gating mechanism. After processing the entire 2-gram sequence, the LSTM outputs an n-gram feature vector containing domain name combination pattern information.

[0079] S14: Based on the top-level domain name resolver (TLD resolver), extract the top-level domain name of the domain name and perform feature encoding to obtain the top-level domain name feature vector.

[0080] Furthermore, the TLD parser first locates the last dot in the domain name through string splitting, and extracts the string after the dot as the top-level domain part. Specifically, this invention pre-constructs a TLD dictionary containing common top-level domains such as ".com", ".org", and ".net". Each TLD is assigned a unique integer identifier. The parser then matches the extracted TLD string with the dictionary to obtain the corresponding integer code. For TLDs that do not exist in the dictionary, this invention assigns a special unknown identifier. The integer code is mapped to a vector representation through an embedding layer. The embedding layer parameters are learned through training, making semantically related TLDs closer together in the vector space. Finally, the TLD feature vector contains the semantic information of the domain name's top-level domain.

[0081] S2: Based on the confusion-aware branch network and the multi-channel feature vector, identify the easily confused categories of DGA domain names to obtain the category-aware matrix.

[0082] In S2, this embodiment establishes a confusion-aware branch network, receives feature vectors from four channels, identifies confusion relationships between DGA families through feature fusion and classification prediction, and finally constructs a matrix structure describing the degree of confusion between categories.

[0083] S2 further includes:

[0084] S21: Combine the feature vectors in the multi-channel feature vectors into a joint representation through a feature splicing layer to obtain a joint category representation vector.

[0085] Furthermore, in S21, this embodiment first receives the four feature vectors output from S1 as input through the feature concatenation layer, including character sequence feature vector, statistical feature vector, n-gram feature vector, and TLD feature vector. Then, a concatenation operation is performed to combine the four vectors along the feature dimension to form a joint feature vector. Next, a fusion network is used to perform a nonlinear transformation on the joint feature vector. The fusion network contains two fully connected layers, with ReLU activation function and Dropout regularization added after each layer. The fusion network learns the interaction relationship between features of different modalities, integrates multi-source information into a unified semantic representation, and finally outputs a joint category representation vector, which contains the comprehensive semantic information of the domain name in multiple feature spaces.

[0086] S22: Perform initial classification prediction on the joint category representation vector based on a fully connected classifier to obtain the category prediction probability distribution.

[0087] Furthermore, in S22, the fully connected classifier contains a fully connected layer with a weight matrix dimension of 64×N, where N is the total number of DGA families and the bias vector dimension is N. In this embodiment, the joint category representation vector is linearly transformed based on the fully connected classifier, and then the linear transformation result is converted into a probability distribution through the Softmax function to ensure that the sum of the probabilities of all categories is 1. The output category prediction probability distribution is an N-dimensional vector, where each element represents the probability value of the domain name belonging to the corresponding DGA family, and the probability value ranges from 0 to 1.

[0088] S23: Identify easily confused category pairs based on the predicted probability distribution of the categories to obtain a set of confused pairs.

[0089] Furthermore, this invention runs a confusion-aware branch network on a validation set to collect the prediction results and true labels of all samples. Subsequently, a confusion matrix is ​​constructed through statistical analysis, where each element represents the number of samples whose true label is the current category i but is predicted as another category j. A confusion rate matrix R is also calculated, where each element R[i,j] represents the probability that the current category i is misclassified as another category j. A confusion threshold θ is set, and all elements in the confusion rate matrix are traversed. When R[i,j]>θ and i≠j, the category pair (i,j) is added to the confusion pair set. This invention also considers bidirectional confusion relationships, that is, if R[i,j]>θ or R[j,i]>θ, then the category pair (i,j) is identified as an easily confused category pair. Finally, the confusion pair set is output, which contains all DGA family pairs whose confusion level exceeds the threshold.

[0090] S24: Based on the matrix construction algorithm, the predicted probability distribution of the categories and the set of confusion pairs are converted into inter-category confusion relationships to obtain the category-aware matrix.

[0091] In S24, this embodiment first initializes an all-zero matrix as a category-aware matrix, where the dimension is the total number of DGA families. It then iterates through each category pair in the confusion pair set and calculates the confusion strength value between categories i and j based on the confusion statistics on the validation set. The confusion strength is expressed as: , representing the average confusion between the probability that current category i is misclassified as category j and the probability that current category j is misclassified as category i, where R[i,j] represents the probability that current category i is misclassified as another category j. This represents the probability that the current category j is misclassified as category i. The calculated confusion intensity value is then filled into the corresponding position in the category-aware matrix to ensure the matrix's symmetry. For category pairs not in the confusion pair set, the corresponding position in the matrix remains zero, and the diagonal elements of the category-aware matrix are set to 1, indicating complete consistency between each category and itself. The final output category-aware matrix describes the confusion relationships between all DGA families. The matrix element values ​​range from 0 to 1; a larger value indicates that the corresponding category pair is more easily confused.

[0092] S3: Based on the category-aware matrix, perform targeted reinforcement learning on easily confused categories through the differential representation learning branch to obtain differential representation vectors.

[0093] In S3, this embodiment uses the differential representation learning branch to take the category-aware matrix as input and uses an attention mechanism and dual-path encoding architecture to specifically learn features for easily confused categories, thereby mining subtle differences between categories.

[0094] S3 includes:

[0095] S31: Based on the category awareness matrix, assign weights to easily confused category samples through an attention mechanism to obtain category attention weights.

[0096] This invention calculates the category attention weight for each sample based on a category-aware matrix. For an input training sample, its true category label is first obtained, and then a vector is extracted from the category-aware matrix. The extracted vector represents the confusion intensity distribution between the current category and all other categories. After extraction, the confusion intensity vector is normalized using a softmax function to generate the attention weight distribution. The obtained attention weights reflect the strength of the confusion relationship between the current sample and each category; the higher the degree of confusion, the greater the weight, highlighting the key distinguishing features between easily confused categories.

[0097] S32: Based on the category attention weights, the differential features between easily confused categories are mined using a dual-channel encoder to obtain category difference features, wherein the dual-channel encoder includes:

[0098] The first path encoder is used to perform deep representation learning on the original features of easily confused categories to obtain the first path representation vector; the second path encoder is used to perform supplementary representation learning on the statistical features of easily confused categories to obtain the second path representation vector.

[0099] A dual-path encoder is used to extract discriminative information from the original feature space and the statistical feature space, respectively. Specifically, the first-path encoder processes the complete multi-channel feature vector, which contains original semantic information such as character sequences, n-grams, and TLDs. The encoder adopts a two-layer fully connected network structure, with BatchNorm and ReLU activation added after each layer. The second-path encoder specifically processes the statistical feature vector, which contains numerical indicators such as entropy, character ratio, and length. This encoder also adopts a two-layer structure. The two encoders process their respective input data in parallel. The first path captures semantic-level discriminative patterns, while the second path captures statistical-level discriminative patterns. After parallel processing, the two outputs are concatenated to form a dual-path joint representation vector, which integrates the original semantic information and statistical pattern information.

[0100] Specifically, the first path encoder is the CC class perception model branch (HCR), which is based on a multi-channel feature system to build an initial classification model for all categories. The role of this branch is to dynamically perceive "easily confused categories" in the DGA family during training. By analyzing the classification results in real time, it identifies category combinations that are difficult to distinguish due to feature overlap and similar algorithm logic (such as specific DGA family pairs). At the same time, it locates categories with few samples and high classification error rates, providing clear "confusion targets" for subsequent branches. Its perception effect can be quantitatively evaluated by localization loss.

[0101] The second path encoder is the Confusing Class Discriminative Representation Learning (DR) branch: closely connected to the output of the Confusing Class Perception Model branch, it focuses only on the easily confused categories identified by the former. This branch does not focus on the classification effect of the overall category, but specifically mines the subtle differences between easily confused categories (such as deep temporal patterns and probability distribution differences). Through targeted learning, it extracts exclusive representations that can effectively distinguish these confused categories, providing key support for breaking the "feature confusion" dilemma.

[0102] After parallel processing through two branches, this embodiment fuses the outputs of the two preceding branches. The fused features incorporate, on the one hand, the overall category classification representation generated by the confusion class perception model branch, ensuring basic discrimination capability for non-confusion classes; on the other hand, they integrate specific differential features extracted by the confusion class discriminative representation learning branch, enhancing the discrimination of difficult-to-classify categories. This invention, through a fusion strategy of basic representation and differential features, ultimately generates an enhanced representation that is both comprehensive and accurate, effectively improving the model's detection performance in imbalanced scenarios.

[0103] S33: Adaptively fuse all features in the category difference features to obtain an enhanced difference representation.

[0104] Specifically, in this embodiment, the attention score vector and the dual-path joint representation vector are first multiplied element-wise to achieve adaptive weighting of feature dimensions. Subsequently, a fusion network is built for fusion. During the fusion process, the attention mechanism automatically learns which feature dimensions are most critical for distinguishing easily confused categories, amplifies the weight of important features, suppresses the influence of irrelevant features, and finally outputs an enhanced differential representation that includes category discrimination information optimized by attention.

[0105] S34: Optimize the confusion sensitivity of the enhanced differential representation by modifying the loss function to obtain the differential representation vector.

[0106] The modified loss function receives enhanced differential representations as input and further strengthens class discrimination capabilities through confusion sensitivity optimization. This embodiment constructs a modified loss function based on the class-aware matrix. This loss function consists of two parts: a standard cross-entropy term and a confusion penalty term. The standard cross-entropy term calculates the difference between the predicted probability distribution and the true label. The confusion penalty term dynamically adjusts the loss weights based on the confusion intensity values ​​in the class-aware matrix, assigning higher penalty coefficients to easily confused class pairs. Specifically, for a sample with a misprediction, if its true class and predicted class correspond to a high confusion value in the class-aware matrix, the loss of that sample will be amplified. The modified loss function updates the network parameters through backpropagation, making the model pay more attention to distinguishing easily confused classes during training. After optimization with the modified loss, the differential representation learning branch outputs a differential representation vector, which specifically encodes the discriminative features between easily confused classes.

[0107] Furthermore, to enhance sensitivity to confusion categories, the present invention introduces a CCP-based modified loss expression as follows:

[0108]

[0109] in, The differential representation loss represents the total loss value of the differential representation learning branch (DR branch), which is used to optimize the ability to distinguish between easily confused categories. This is a category index used to traverse all DGA family categories. The total number of categories represents the number of families included in the DGA dataset. As a true label indicator, when the true category of the sample is hour, ,otherwise , For DR branch pairs of categories The predicted probability represents the probability distribution of the output of the differential representation learning branch. The values ​​of each element are between 0 and 1. To obfuscate the penalty weighting coefficient, The obfuscation cost coefficient is derived from the category-aware matrix, representing the true category. With prediction category The degree of confusion between them.

[0110] S4: Based on the feature fusion network, the multi-channel feature vector and the differential representation vector are weighted and fused to obtain an enhanced feature representation.

[0111] In S4, this invention establishes a feature fusion network that receives multi-channel feature vectors and differential representation vectors. It adaptively fuses the two types of features through an attention weighting mechanism to generate an enhanced feature representation that includes global semantics and local differential information.

[0112] S4 further includes:

[0113] S41: Output feature fusion weights through the attention weight calculation module, and perform weighted fusion of the multi-channel feature vector and the differential representation vector according to the feature fusion weights to obtain the fused feature vector.

[0114] Furthermore, in S41, this embodiment uses an attention weight calculation module to simultaneously receive multi-channel feature vectors and differential representation vectors as input. First, the two vectors are concatenated to form a joint input vector. Then, an attention weight calculation network is established, containing a three-layer fully connected structure. The two-dimensional output of the third layer represents the importance scores of the multi-channel features and differential representations, respectively, and is finally normalized to weight coefficients using a softmax function. After obtaining the weight coefficients, this invention performs weighted fusion of the two types of feature vectors based on the calculated weight coefficients. Specifically, the multi-channel feature vector is multiplied by its corresponding weight, and the differential representation vector is first expanded through a linear transformation and then multiplied by the weight. Then, the two weighted vectors are added element-wise to finally generate a fused feature vector.

[0115] S42: Input the fused feature vector into the nonlinear transformation layer to perform feature enhancement and obtain the enhanced feature representation.

[0116] Furthermore, the nonlinear transformation layer established in this invention adopts a three-layer fully connected network architecture. BatchNorm batch normalization is added between each layer to normalize the features and accelerate training convergence. The activation function is LeakyReLU, with its negative half-axis slope set to 0.01, which can retain more gradient information compared to standard ReLU. Dropout regularization is added after the first and second layers, with a dropout rate set to 0.3 to prevent the model from overfitting.

[0117] During the nonlinear transformation process, the fused feature vector is subjected to multi-layer nonlinear mapping, and then the fused feature vector is transformed into a higher-dimensional representation space to enhance the expressive power and discriminative power of the features. Finally, an enhanced feature representation is output, which comprehensively includes the multi-channel semantic information of the original domain name and the differential features optimized for easily confused categories.

[0118] S5: Based on the enhanced feature representation, a cost-sensitive classifier is trained using a joint loss function to obtain the DGA domain name classification model.

[0119] Furthermore, in S5, this embodiment is based on cost-sensitive classifier training, receiving the enhanced feature representation from the aforementioned steps as input, and performing end-to-end training by constructing a joint loss function and an XGBoost classifier to generate a detection model optimized for imbalanced DGA family classification.

[0120] S5 further includes:

[0121] S51: Determine the class weights based on the distribution of multiple DGA family samples in the preset training dataset to obtain the cost-sensitive weight matrix.

[0122] This embodiment statistically analyzes the sample size distribution of each DGA family in a pre-set training dataset, calculates the sample frequency of each family, and uses an inverse frequency weighting method to assign weight coefficients to each family. The inverse frequency weighting results in families with fewer samples receiving higher weight values ​​and families with more samples receiving relatively lower weight values. After the calculation is completed, the calculated weight coefficients are organized into an N-dimensional weight vector, and then expanded into an N×N diagonal matrix. The diagonal elements are the weight coefficients of the corresponding families, and the off-diagonal elements are 0. The resulting cost-sensitive weight matrix directly reflects the importance distribution of each DGA family during the training process. Families with larger weight values ​​in the matrix occupy a higher proportion in the loss calculation.

[0123] S52: Based on the cost-sensitive weight matrix, construct a loss function based on weighted cross-entropy to obtain the cost-sensitive loss function.

[0124] This embodiment first obtains the predicted probability distribution of the XGBoost classifier for the enhanced feature representation, where each element represents the probability that a sample belongs to the corresponding DGA family. Then, it calculates the difference between the predicted probability and the true label based on the standard cross-entropy loss. After calculation, this embodiment multiplies the standard cross-entropy loss by the corresponding weight coefficients in the cost-sensitive weight matrix to obtain the weighted loss value. The weighting operation results in a larger loss penalty for classification errors of minority class samples, forcing the model to pay more attention to these difficult-to-classify samples during training.

[0125] S53: The confusion perception loss is obtained based on the classification loss of the confusion perception branch network, and the differential representation loss is obtained based on the correction loss of the differential representation learning branch. The confusion perception loss, differential representation loss and the cost-sensitive loss function are combined in a weighted summation form to obtain the joint loss function.

[0126] Furthermore, in S53, this invention establishes a joint loss function, combining three independent loss terms into a unified optimization objective through weighted summation. The confusion-aware loss originates from the classification loss of the confusion-aware branch network in S2, which calculates the standard cross-entropy based on the prediction results of the joint category representation vector. The discriminative representation loss originates from the correction loss of the discriminative representation learning branch in S3, which, combined with the category-aware matrix, applies additional penalties to easily confused categories. The cost-sensitive loss function is the weighted cross-entropy loss constructed in S52. The established joint optimization mechanism enables the model to simultaneously learn global classification ability, easily confused category discrimination ability, and category imbalance compensation ability.

[0127] Furthermore, the expression for the overall loss function is:

[0128]

[0129] in, For the joint loss function, The confusion perception loss is derived from the classification loss of the confusion perception branch network (HCR branch) in S2. The differential representation loss is derived from the modified loss of the differential representation learning branch (DR branch) in S3. The final classification loss is derived from the final classification task after feature fusion, and the loss value is calculated based on the prediction results of the enhanced feature representation.

[0130] S54: Based on the extreme gradient boosting classifier, combined with the joint loss function, the enhanced feature representation is trained end-to-end to obtain the DGA domain name classification model.

[0131] In S54, this invention uses the joint loss function as a custom objective function for the XGBoost classifier, replacing the default cross-entropy loss. The XGBoost classifier training process includes multiple iterations. In each iteration, a new decision tree is added to fit the residual of the previous model. In each iteration, the XGBoost classifier calculates the gradient and second gradient of the samples based on the joint loss function to guide the construction of the new decision tree. The selection of split nodes in the decision tree is based on the reduction of the joint loss function, prioritizing features and split points that maximize the loss reduction. The trained XGBoost model contains an ensemble of multiple decision trees, each of which is specifically responsible for fitting a specific pattern guided by the joint loss function. The final DGA domain name classification model can handle 192-dimensional augmented feature inputs and outputs an N-dimensional probability distribution representing the classification confidence of each DGA family.

[0132] In specific embodiments, the present invention selects the XGBoost model as the base model. However, it should be noted that the present invention also uses various machine learning classifiers to construct the base model for DGA detection on the dataset, including: XGBoost classifier, support vector machine (SVM), k-nearest neighbor algorithm (KNN), decision tree (DT), random forest (RF), Naive Bayes (NB), and logistic regression (LR). Then, based on Micro and Macro evaluation metrics (Precision, Recall, F1-Score, etc.), the detection performance of each classifier is compared. Finally, the classifier with the best performance can be selected as the final base model. The selected baseline model is not intended to limit the present invention.

[0133] S6: Based on the DGA domain name classification model, classify and predict the domain name to be detected to obtain the DGA domain name family classification result.

[0134] Step S6 further includes:

[0135] S61: Based on a multi-channel feature extractor and a feature fusion network, the domain name to be detected is transformed to obtain the enhanced feature representation to be detected; S62: The enhanced feature representation to be detected is input into the DGA domain name classification model to obtain the DGA domain name family classification result.

[0136] In the detection phase, the present invention first inputs the domain name to be detected into a multi-channel feature extractor, and extracts character sequence features, statistical features, n-gram features, and TLD features according to the processing method of step S1 to obtain a multi-channel feature vector; then, through the confusion perception branch network and the differential representation learning branch, category perception information and differential representation vectors are generated according to the processing flow of steps S2 and S3; then, the feature fusion network weights and combines the multi-channel features and differential representations according to the fusion mechanism of step S4 to generate the enhanced feature representation to be detected; finally, the enhanced feature representation is input into the trained XGBoost classification model, and the model outputs an N-dimensional probability distribution through decision tree ensemble calculation, with the category with the highest probability being the final DGA family classification result.

[0137] This embodiment provides a DGA domain name detection system based on obfuscation awareness, which includes [the following components].

[0138] Extraction module 100: used to obtain original DGA domain name samples for multi-dimensional feature extraction to obtain multi-channel feature vectors;

[0139] Identification module 200: Based on the confusion-aware branch network and the multi-channel feature vector, identify the easily confused categories of DGA domain names and obtain the category-aware matrix;

[0140] Learning module 300: Based on the category perception matrix, it performs targeted reinforcement learning on easily confused categories through a differential representation learning branch to obtain differential representation vectors;

[0141] Fusion module 400: used to perform weighted fusion of the multi-channel feature vector and the differential representation vector based on the feature fusion network to obtain an enhanced feature representation;

[0142] Training module 500: Used to train a cost-sensitive classifier based on the enhanced feature representation using a joint loss function to obtain a DGA domain name classification model;

[0143] The prediction module 600 is configured as the DGA domain name classification model and is used to perform classification prediction on the domain name to be detected according to the DGA domain name classification model to obtain the DGA domain name family classification result.

[0144] The following describes the implementation effect of a DGA domain name detection method and system based on obfuscation awareness according to the present invention, with reference to specific embodiments.

[0145] To select the optimal DGA (Domain Name Generation Algorithm) detection classifier, this invention conducted comparative experiments on two public datasets (360DGA and OSINTDGA), testing various machine learning algorithms, including Naive Bayes, Logistic Regression, Support Vector Machine (SVM), K-Nearest Neighbors (KNN), Decision Tree, and XGBoost classifier. Experimental results show that the XGBoost classifier performs best on a series of metrics, including Micro-F1 and Micro-Precision. Therefore, this invention ultimately chooses to build the basic model for DGA detection based on the XGBoost classifier.

[0146] This invention compares and analyzes three typical imbalanced learning schemes: Random Oversampling (ROS), SMOTE, and Cost-Sensitive learning. By comparing performance with a baseline model (PMAE + XGBoost classifier), the SMOTE scheme's overall performance is slightly lower than the baseline model, while the ROS scheme performs poorly, significantly lagging behind the baseline model. The CS scheme performs well; on the OSINTDGA dataset, Micro-F1 (97.22%) slightly outperforms the baseline model (97.10%), and Macro-F1 significantly improves to 75.64%. On the 360DGA dataset, the Cost-Sensitive scheme performs stably; Micro-F1 (99.32%) is comparable to the baseline, and Macro-F1 (78.55%) also shows improvement. Therefore, this invention will ultimately build a detection model based on Cost-Sensitive learning.

[0147] To comprehensively evaluate the superiority of the proposed method, a series of comparative experiments were conducted on the OSINT and 360 DGA datasets. The method was compared with the classic imbalanced optimization algorithm (ROS / SMOTE / Cost-Sensitive) and the current state-of-the-art detection methods (LSMT.PQDO / LSTM.MI / DeepDGA). The experimental data show that the method of the present invention significantly improves the model's ability to identify difficult and rare classes, and achieves more balanced classification performance while maintaining high accuracy.

[0148] Compared with the three state-of-the-art (SOTA) methods, the method of this invention leads by 0.89 to 1.89 percentage points in the Micro-F1 score and achieves a significant improvement of 7.96 to 9.59 percentage points in the Macro-F1 score. On the 360DGA dataset, the performance advantage is even more pronounced. Compared with classic imbalanced methods, the method of this invention leads by 3.22 and 5.14 percentage points in the Micro-F1 score, respectively, and also improves by 2.22 percentage points compared with the Cost-Sensitive method; the Macro-F1 score improvement reaches 16.68 to 19.09 percentage points. Compared with SOTA methods, while maintaining a 0.12 to 2.31 percentage point advantage in the Micro-F1 score, the method of this invention achieves a significant improvement of 13.54 to 16.56 percentage points in the Macro-F1 score.

[0149] In terms of specific performance, the method of this invention maintains the detection accuracy of mainstream families while significantly improving the recognition ability of minority classes. Taking the DGA family, which has a smaller sample size, as an example, the recall rate of low-frequency families is improved by an average of 45.6% on the OSINT dataset, and the F1 score of novel variant families is improved by an average of 62.3% on the 360 ​​dataset. These data fully verify the effectiveness of the proposed method in solving the class imbalance problem in DGA detection, providing a more reliable detection scheme for practical applications.

[0150] On the 360DGA dataset, compared to the three classic imbalanced methods, the method of this invention outperforms ROS, SMOTE, and Cost-Sensitive methods by 3.22, 5.14, and 2.22 percentage points in MicroF1, respectively, and shows a more significant advantage in MacroF1, exceeding them by 16.68, 19.09, and 8.54 percentage points, respectively. Compared to the three state-of-the-art methods, the method of this invention maintains a MicroF1 advantage of 0.12 to 2.31 percentage points, while achieving MacroF1 scores 13.54, 15.16, and 7.29 percentage points higher than LSTM.PQDO, LSTM.MI, and DeepDGA, respectively, demonstrating a clear performance advantage.

[0151] Of particular note is the exceptional performance of the method of this invention for detecting very few sample families. Taking the Tofsee family (only 20 samples) as an example, the method of this invention achieves perfect detection for the first time (F1=1.0), while all comparative methods (except DeepDGA, which reaches 66.67%) fail completely (F1=0). For the Proslikefan family (100 samples), the method of this invention achieves an F1 score of 0.3, while all comparative methods are below 0.125 or fail completely. Furthermore, in a very small number of categories with fewer than 50 samples, the method of this invention achieves an average F1 score of 85%, an improvement of over 40% compared to the best comparative method.

[0152] Experimental results demonstrate that the method of this invention exhibits superior performance on the 360DGA dataset, particularly showing a significant advantage in handling a very small number of sample classes. This not only verifies the effectiveness of the method in imbalanced data processing but also provides a reliable technical solution for detecting rare DGA families in practical network security protection.

[0153] This invention proposes a novel DGA detection method that departs from traditional approaches and focuses on addressing the problem of different categories appearing too similar and difficult to distinguish. Specifically, it extracts multi-dimensional information to capture the distinguishing features between DGA domains, identifies category patterns that are prone to misclassification, and then specifically strengthens the model's learning of these patterns. Ultimately, this allows the model to achieve better detection results for categories with few samples and difficult differentiation, even under imbalanced data conditions.

[0154] Specifically, this invention comprises three stages. The first stage is multi-channel discriminative feature extraction, aiming to construct a comprehensive feature representation system and improve the model's low efficiency in perceiving CC classes. In this first stage, the invention mines discriminative information of DGA domain names from a multi-dimensional feature space to address the high confusion caused by similar generation strategies among different families. First, domain names are encoded at multiple levels, including character sequences, readable fragments, combination patterns, TLD preferences, and statistical features, to construct multi-channel feature vectors. These features encompass both general structural information and subtle semantic differences, providing an informational foundation for the subsequent construction of the discriminative model. Subsequently, sub-representations of each channel are extracted and fused into a unified joint category representation (HCR). To further strengthen the discriminative boundaries between easily confused categories (CC), this invention uses HCR as a contextual prior to guide the model to focus on the confusion region, from which more discriminative differential representations (HDR) are extracted. The basic representation and the differential representation are further fused to form an enhanced domain name representation, which significantly improves the ability to identify highly confused categories while maintaining overall classification performance, thereby systematically enhancing the robustness and discriminative power of the model.

[0155] The second stage is CC category-aware targeted reinforcement learning. This stage focuses the model on difficult-to-classify samples by perceiving the CC category, achieving targeted reinforcement learning. First, an initial classification model for all categories is built based on multi-channel features, forming the CC category-aware model branch (HCR). During training, this branch dynamically identifies CC categories, including the DGA family with similar algorithmic logic and categories with few samples and high error rates. It generates a category-aware matrix to quantify the perception level of CC categories, providing clear perceptual target information for subsequent branches. Building on this, the confusion class discriminative representation learning branch (DR) closely follows the output of HCR, performing feature learning only for the identified easily confused categories. This branch focuses on uncovering subtle differences between CC categories, extracting specific discriminative representations by targeted optimization of feature boundaries and focusing on misclassified samples, thereby enhancing the model's discriminative ability in the CC category. Finally, the augmented representation learning branch merges the outputs of the first two branches. On the one hand, it retains the overall classification representation generated by HCR to ensure the basic discrimination ability for non-confusing categories. On the other hand, it introduces the differential features extracted by the DR branch to enhance the recognition of difficult-to-classify categories. Through this fusion strategy of "basic representation + differential features", an augmented feature vector with both breadth and accuracy is finally generated, providing a more robust input for downstream classification tasks.

[0156] The third stage focuses on efficient classification in imbalanced scenarios, achieving efficient classification based on enhanced feature representations. First, the original domain samples are converted into an enhanced feature vector dataset through a pre-processing stage. Second, the performance of various classic classifiers (such as XGBoost, RandomForest, and SVM) on this dataset is compared to select the optimal base model. Finally, the base model is combined with the proposed "confusion-aware enhancement strategy" and compared with traditional imbalanced learning methods (such as ROS, SMOTE, and ordinary Cost-Sensitive) to verify the performance improvement of targeted enhancement for detecting categories with few samples and difficult classification, ultimately determining the optimal detection scheme.

[0157] The DGA domain name detection system based on confusion awareness in this application embodiment can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, mobile electronic devices can be mobile phones, tablets, laptops, PDAs, ultra-mobile personal computers (UMPCs), netbooks, or personal digital assistants (PDAs), etc., while non-mobile electronic devices can be servers, network-attached storage (NAS), personal computers (PCs), etc. This application embodiment does not impose specific limitations.

[0158] The DGA domain name detection system based on obfuscation awareness in this application embodiment can be a device with an operating system. This operating system can be Android, iOS, or other possible operating systems; this application embodiment does not specifically limit it.

[0159] The DGA domain name detection system based on confusion awareness provided in this application embodiment can achieve... Figure 1 The implementation of the method embodiment of a DGA domain name detection method based on obfuscation awareness will not be repeated here to avoid repetition.

[0160] The DGA domain name detection method and system based on confusion perception according to the present invention captures the difference features between DGA domain names by extracting multi-dimensional information, and then finds those category patterns that are easy to misclassify. Then, the model is strengthened to learn these patterns in a targeted manner, so that the model can have a better detection effect on categories with few samples and difficult to distinguish even under imbalanced data conditions.

[0161] Optionally, embodiments of this application also provide an electronic device, including a processor, a memory, and a program or instructions stored in the memory and executable on the processor. When the program or instructions are executed by the processor, they implement the various processes of the above-described embodiment of the DGA domain name detection method based on confusion awareness and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0162] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described embodiment of the DGA domain name detection method based on obfuscation awareness and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0163] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0164] Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. The reference to "embodiment" herein means that a specific feature, structure, or characteristic described in connection with an embodiment can be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily indicate the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0165] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. A method for detecting DGA domain name based on confusion perception, characterized in that, Comprising: S1: obtaining original DGA domain name samples for multi-dimensional feature extraction, to obtain a multi-channel feature vector, the multi-channel feature vector comprising: a character sequence feature vector, a statistical feature vector, an n-gram feature vector, and a top-level domain name feature vector, the S1 comprising: S11: using a character sequence encoder to perform LSTM encoding on the domain name string in the original DGA domain name sample, to obtain a character sequence feature vector; S12: calculating statistical indicators of the domain name, to obtain a statistical feature vector; wherein the statistical indicators include entropy, character proportion, and length; S13: extracting the 2-gram sequence of the domain name and encoding, to obtain an n-gram feature vector; S14: based on a top-level domain name resolver, extracting the top-level domain name of the domain name and performing feature encoding, to obtain a top-level domain name feature vector; S2: identifying the easily confused categories of DGA domain names based on a confusion perception branch network and the multi-channel feature vector, to obtain a category perception matrix, the S2 comprising: S21: combining the feature vectors in the multi-channel feature vector into a joint representation through a feature concatenation layer, to obtain a joint category representation vector; S22: performing initial classification prediction on the joint category representation vector based on a fully connected classifier, to obtain a category prediction probability distribution; S23: identifying easily confused category pairs according to the category prediction probability distribution, to obtain a confusion pair set; S24: converting the category prediction probability distribution and the confusion pair set into inter-category confusion relationships based on a matrix construction algorithm, to obtain a category perception matrix; S3: based on the category perception matrix, performing directed reinforcement learning on the easily confused categories through a difference representation learning branch, to obtain a difference representation vector; S4: based on a feature fusion network, performing weighted fusion on the multi-channel feature vector and the difference representation vector, to obtain an enhanced feature representation; S5: based on the enhanced feature representation, training a cost-sensitive classifier through a joint loss function, to obtain a DGA domain name classification model; S6: performing classification prediction on the domain name to be detected according to the DGA domain name classification model, to obtain a DGA domain name family classification result.

2. The method of detecting DGA domain names based on obfuscated perception according to claim 1, characterized in that S3 Comprising: S31: based on the category perception matrix, assigning weights to the easily confused category samples through an attention mechanism, to obtain category attention weights; S32: based on the category attention weights, mining the difference features between the easily confused categories through a double-path encoder, to obtain category difference features; S33: adaptively fusing all features in the category difference features, to obtain an enhanced difference representation; S34: optimizing the confusion sensitivity of the enhanced difference representation through a correction loss function, to obtain a difference representation vector.

3. The method of claim 2, wherein the method further comprises: The double-path encoder in S32 comprises: A first path encoder for performing deep representation learning on the original features of the easily confused categories, to obtain a first path representation vector; A second path encoder for performing supplementary representation learning on the statistical features of the easily confused categories, to obtain a second path representation vector.

4. The method of claim 1, wherein S4 Comprising: S41: Output the feature fusion weight through the attention weight calculation module, and perform weighted fusion on the multi-channel feature vector and the difference representation vector according to the feature fusion weight to obtain a fusion feature vector; S42: Input the fusion feature vector into a nonlinear transformation layer to perform feature enhancement to obtain an enhanced feature representation.

5. The method of claim 1, wherein S5 Comprising: S51: Determine a class weight according to the distribution of multiple DGA family samples in a preset training data set to obtain a cost-sensitive weight matrix; S52: Construct a loss function based on weighted cross-entropy according to the cost-sensitive weight matrix to obtain a cost-sensitive loss function; S53: Obtain a confusion perception loss based on the classification loss of the confusion perception branch network, obtain a difference representation loss based on the correction loss of the difference representation learning branch, and combine the confusion perception loss, the difference representation loss and the cost-sensitive loss function through weighted summation to obtain a joint loss function; S54: Based on an extreme gradient boosting classifier, combine the joint loss function to perform end-to-end training on the enhanced feature representation to obtain a DGA domain name classification model.

6. The method of claim 1, wherein S6 Comprising: S61: Based on a multi-channel feature extractor and a feature fusion network, convert a to-be-detected domain name to obtain a to-be-detected enhanced feature representation; S62: Input the to-be-detected enhanced feature representation into the DGA domain name classification model to obtain a DGA domain name family classification result.

7. A system for detecting DGA domain names based on obfuscated perception, the system comprising: For implementing the detection method as claimed in any one of claims 1 to 6, comprising: An extraction module: configured to obtain original DGA domain name samples for multi-dimensional feature extraction to obtain a multi-channel feature vector; An identification module: configured to identify the easily-confused categories of DGA domain names based on the confusion perception branch network and the multi-channel feature vector to obtain a category perception matrix; A learning module: configured to perform directional reinforcement learning on the easily-confused categories through the difference representation learning branch based on the category perception matrix to obtain a difference representation vector; A fusion module: configured to perform weighted fusion on the multi-channel feature vector and the difference representation vector based on the feature fusion network to obtain an enhanced feature representation; A training module: configured to train a cost-sensitive classifier through a joint loss function based on the enhanced feature representation to obtain a DGA domain name classification model; A prediction module, the prediction module is configured as the DGA domain name classification model, and is configured to classify and predict a to-be-detected domain name according to the DGA domain name classification model to obtain a DGA domain name family classification result.

Images