Domain name detection method and device, communication equipment, readable storage medium and program product

Abstract

The invention relates to a domain name detection method and device, communication equipment, a readable storage medium and a program product, relates to the technical field of network information security, and can improve the accuracy of a domain name detection result. The method comprises the following steps: acquiring a domain name main body character string corresponding to a domain name to be detected, and segmenting the domain name main body character string according to a pronunciation unit to obtain a plurality of syllable units; merging the plurality of syllable units according to a preset syllable unit combination configuration, obtaining a plurality of syllable blocks according to a merging result, and determining a plurality of syllable features according to the plurality of syllable blocks; determining the pronunciation naturalness of the domain name main body character string according to the plurality of syllable features; and determining an anomaly detection result of the domain name to be detected according to the pronunciation naturalness.

Description

Technical Field

[0001] This application relates to the field of network information security technology, and in particular to a domain name detection method, apparatus, communication equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] With the development of computer technology, it is possible to dynamically generate tens of thousands of pseudo-random domain names through programs, and then establish abnormal communication connections with remote servers based on these pseudo-random domain names. To improve communication security, domain name detection is necessary.

[0003] In related technologies, domain name anomalies can be detected through methods such as comparison with pre-set lists, feature engineering and machine learning, and deep learning models. However, domain name detection methods based on pre-set lists often fail to identify newly generated unknown domain names; the accuracy of methods based on feature engineering and machine learning is highly dependent on data coverage; and detection methods based on deep learning models suffer from high training costs.

[0004] It is evident that the domain name detection methods in related technologies are difficult to obtain domain name detection results efficiently and accurately. Summary of the Invention

[0005] Therefore, it is necessary to provide a domain name detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product to address the aforementioned technical problems.

[0006] Firstly, this application provides a domain name detection method, including:

[0007] Obtain the domain body string corresponding to the domain name to be detected, and segment the domain body string according to the pronunciation unit to obtain multiple syllable units;

[0008] The multiple syllable units are merged according to a preset syllable unit combination configuration, and multiple syllable blocks are obtained according to the merging result. Multiple syllable features are then determined based on the multiple syllable blocks.

[0009] The pronunciation naturalness of the domain name's main string is determined based on the multiple syllable features;

[0010] The anomaly detection result of the domain name to be detected is determined based on the naturalness of the pronunciation.

[0011] In one embodiment, the pronunciation unit includes a combination of consonant characters and a combination of vowel characters whose frequencies meet preset conditions; the step of segmenting the domain name body string according to the pronunciation unit to obtain multiple syllable units includes: segmenting the domain name body string into multiple syllable units according to the matching results of the consonant character combination and the vowel character combination with the domain name body string.

[0012] In one embodiment, the step of segmenting the domain name body string into multiple syllable units based on the matching results of the consonant character combinations and the vowel character combinations with the domain name body string includes: starting from the beginning position of the domain name body string, performing matching sequentially according to the matching priority of the consonant character combinations and the vowel character combinations; the matching priority increases with the length of the character combination; and determining multiple syllable units of the domain name body string based on each successfully matched character combination.

[0013] In one embodiment, merging the plurality of syllable units according to a preset syllable unit combination configuration includes: determining the unit type of each of the plurality of syllable units; the unit type includes consonant syllable units or vowel syllable units; obtaining a preset syllable unit combination configuration; each syllable unit combination configuration indicating the combination method of the consonant syllable units and the vowel syllable units; and merging at least some of the syllable units among the plurality of syllable units according to the unit type of each of the plurality of syllable units and the syllable unit combination configuration.

[0014] In one embodiment, determining multiple syllable features based on the multiple syllable blocks includes: determining the syllable density of the domain name body string based on the relative size of the number of first syllable blocks of the multiple syllable blocks and the string length of the domain name body string; and determining the multiple syllable features based on the syllable density.

[0015] In one embodiment, determining multiple syllable features based on the multiple syllable blocks includes: determining isolated consonant syllable blocks from the multiple syllable blocks; determining isolated consonant density based on the number of second syllable blocks in the isolated consonant syllable blocks; and determining the multiple syllable features based on the isolated consonant density.

[0016] In one embodiment, determining multiple syllable features based on the multiple syllable blocks includes: determining the syllable entropy density of the domain name body string based on the syllable entropy of the multiple syllable blocks; and determining the multiple syllable features based on the syllable entropy density.

[0017] In one embodiment, determining multiple syllable features based on the multiple syllable blocks includes: determining each non-isolated consonant syllable block in the multiple syllable blocks; obtaining a main syllable block based on the merging result of the non-isolated consonant syllable block and other non-isolated consonant syllable blocks adjacent to the non-isolated consonant syllable block; and determining multiple syllable features based on the relative size of the string length of the main syllable block and the string length of the domain name body string.

[0018] In one embodiment, determining the pronunciation naturalness of the domain name body string based on the plurality of syllable features includes: determining the syllable feature weight of each of the plurality of syllable features; and determining the pronunciation naturalness of the domain name body string based on the plurality of syllable features and the weight of each syllable feature.

[0019] Secondly, this application also provides a domain name detection device, comprising:

[0020] The syllable unit acquisition module is used to acquire the domain body string corresponding to the domain name to be detected, and to segment the domain body string according to the pronunciation unit to obtain multiple syllable units;

[0021] The syllable feature acquisition module is used to merge the multiple syllable units according to a preset syllable unit combination configuration, obtain multiple syllable blocks according to the merging result, and determine multiple syllable features according to the multiple syllable blocks;

[0022] The naturalness calculation module is used to determine the pronunciation naturalness of the domain name main string based on the multiple syllable features;

[0023] The detection result acquisition module is used to determine the abnormal detection result of the domain name to be detected based on the naturalness of the pronunciation.

[0024] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the domain name detection method as described in any of the preceding claims.

[0025] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the domain name detection method as described in any of the preceding claims.

[0026] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the domain name detection method as described in any of the preceding claims.

[0027] The aforementioned domain name detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product can obtain the domain name body string corresponding to the domain name to be detected, segment the domain name body string according to the pronunciation unit to obtain multiple syllable units, then merge the multiple syllable units according to the preset syllable unit combination configuration, obtain multiple syllable blocks according to the merging result, determine multiple syllable features according to the multiple syllable blocks, and then determine the pronunciation naturalness of the domain name body string according to the multiple syllable features, and determine the anomaly detection result of the domain name to be detected according to the pronunciation naturalness. In this embodiment, by determining the naturalness of the pronunciation of the domain name's main string and identifying whether the domain name is abnormal based on the naturalness of pronunciation, the problem of related technologies struggling to achieve both high efficiency and high accuracy in domain name detection is effectively solved. On one hand, this embodiment decomposes the domain name's main string into multiple syllable blocks and determines multiple syllable features, which can characterize the domain name's pseudo-linguistic nature, making domain name detection closer to human speech perception and improving the accuracy of identifying abnormal domain names obtained through random character combinations. This eliminates the need for frequent maintenance of domain name lists and training models. On the other hand, determining the naturalness of the pronunciation of the domain name's main string based on syllable features, while conforming to common domain name configuration patterns, can objectively detect the domain name's fluency, avoiding subjective bias and enhancing the reliability and accuracy of detection. Therefore, this embodiment can effectively improve the accuracy and efficiency of domain name detection while reducing computational resource consumption. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart illustrating a domain name detection method in one embodiment;

[0030] Figure 2 This is a flowchart illustrating the syllable unit merging step in one embodiment;

[0031] Figure 3 This is a schematic diagram of the framework of a domain name detection method in one embodiment;

[0032] Figure 4 This is a flowchart illustrating the domain name detection method in another embodiment;

[0033] Figure 5 This is a structural block diagram of a domain name detection device in one embodiment;

[0034] Figure 6This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0036] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various objects, but these objects are not limited by these terms. These terms are only used to distinguish the first object from the second object. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the solutions, or any combination of multiple solutions.

[0037] With the development of computer technology, thousands of pseudo-random domain names can be dynamically generated by programs. These pseudo-random domain names can then be used to circumvent list matching detection and establish abnormal communication connections with remote servers (such as command and control servers, C&C servers). To improve communication security, domain name detection is necessary.

[0038] In related technologies, domain name anomalies can be detected through methods such as pre-set list comparison, feature engineering and machine learning, and deep learning models. However, domain name detection based on pre-set list comparison requires maintaining a static domain name list, and although the recognition speed is fast, it often fails to identify newly generated unknown domain names. Methods based on feature engineering and machine learning mainly extract statistical features such as domain name length and character entropy, and train classification models based on these features. The accuracy of the model's recognition results is highly dependent on data coverage. Deep learning models require the use of recurrent neural networks and other networks to automatically learn character sequence features, but the training cost is high, interpretability is weak, and it is difficult to achieve good detection results in scenarios such as edge deployment.

[0039] It is evident that the domain name detection methods in related technologies are difficult to obtain domain name detection results efficiently and accurately.

[0040] This application provides a lightweight, efficient, and highly interpretable domain name detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can effectively identify abnormal domain names based on language structure.

[0041] In one embodiment, such as Figure 1As shown, a domain name detection method is provided. This embodiment illustrates the method applied to a server. It is understood that this method can also be applied to a terminal, or to a system including both a terminal and a server, and is implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0042] Step S101: Obtain the domain name body string corresponding to the domain name to be detected, and divide the domain name body string according to the pronunciation unit to obtain multiple syllable units.

[0043] Here, the domain name to be detected refers to the domain name whose anomalies are to be checked. In some examples, the domain name to be detected can be the domain name to be identified as whether it was generated by the DGA algorithm. The domain name to be detected can be recorded as a domain name string.

[0044] The domain body string can be understood as the core part of the domain to be tested after removing prefixes and / or suffixes. For example, information such as the suffixes ".com" and ".net" and the prefix "www." that lack specific identifiers can be removed from the domain to be tested, resulting in domain body strings such as "microsoft", "czijbh", "lenovo", and "cvqthu"; another example is the domain body string "example.com".

[0045] A pronunciation unit, also known as a pronunciation combination, can consist of one or more characters. For example, for English and Chinese domain names, pronunciation units may include one or more of the following: cr, sh, th, ai, ang, ing, etc. A syllable unit can be a pronunciation unit actually contained in the main string of the domain name, obtained by segmenting the domain name according to preset pronunciation units.

[0046] In some embodiments, in this step, the domain name to be detected is first obtained through a domain name resolution tool or database, and the domain name body string of the domain name to be detected is extracted. Then, a preset pronunciation unit dictionary can be called, which may include multiple pre-set pronunciation units, such as multiple pronunciation units obtained according to Chinese or English pronunciation rules. Subsequently, the characters and / or character combinations in the domain name body string can be matched with the pronunciation units in the pronunciation unit dictionary, and the domain name body string is segmented according to the matching results to obtain multiple syllable units.

[0047] Step S102: Merge multiple syllable units according to a preset syllable unit combination configuration, obtain multiple syllable blocks based on the merging result, and determine multiple syllable features based on the multiple syllable blocks.

[0048] Among them, the syllable unit combination configuration can be a syllable unit combination rule based on the pronunciation habits of natural language, such as the syllable unit combination configuration of "consonant + vowel" and "vowel + consonant + vowel" in English, or the syllable unit combination configuration of "initial consonant + final vowel" in Chinese Pinyin. In some optional embodiments, it can be determined based on linguistic information or by statistically analyzing the syllable combination rules of normal domain names.

[0049] After obtaining multiple syllable units, since a single syllable unit may not be able to form complete content with corresponding semantics, in this step, after obtaining multiple syllable units, at least some of them can be merged according to the pre-obtained syllable unit combination configuration to obtain a merging result. From this merging result, multiple syllable blocks can be obtained. A syllable block can be understood as the smallest structure for pronunciation. In some examples, it can be formed by combining consonants (C) and vowels (V) according to certain rules (i.e., syllable unit combination configurations), such as CV, CVC, VC, etc.

[0050] After obtaining multiple syllable blocks, syllable features can be extracted from these blocks to obtain multiple syllable features. These syllable features can be understood as quantitative indicators used to describe the pronunciation attributes of the syllable blocks.

[0051] For example, this may include, but is not limited to, one or more of the following: syllable density, isolated consonant density, syllable entropy density, main syllable block ratio, syllable block length, syllable block pronunciation fluency, and syllable block stress position. Among these, syllable block pronunciation fluency can characterize the degree of matching between the syllable block and the preset configuration, and syllable block stress position can indicate the syllable unit where the stress occurs during pronunciation.

[0052] Step S103: Determine the naturalness of the pronunciation of the domain name main string based on multiple syllable features.

[0053] After obtaining multiple syllable features, the pronunciation naturalness of the domain name's main string can be determined by combining these features. In some examples, the naturalness score of the domain name's main string can be determined based on multiple syllable features. The naturalness score is an indicator that measures whether the string closely resembles the pronunciation and spelling habits of natural language. For example, it can be calculated based on one or more features such as syllable structure, vowel and consonant distribution, and information entropy.

[0054] Step S104: Determine the anomaly detection result of the domain name to be detected based on the naturalness of pronunciation.

[0055] Among them, the anomaly detection result refers to the judgment conclusion of the domain name to be detected, which can include binary detection results, such as "normal" and "abnormal". Of course, in some other examples, the anomaly detection result can be a probability value indicating the degree of abnormality of the domain name to be detected.

[0056] In some optional embodiments, a pronunciation naturalness threshold can be preset based on the pronunciation naturalness of normal domain names. For example, the threshold can be set to 0.5. After obtaining the pronunciation naturalness score of the domain name to be detected, the pronunciation naturalness can be compared with the preset threshold. If the pronunciation naturalness is greater than the threshold, it can be determined as a suspicious DGA domain name. Of course, other classification logic can also be set according to actual business needs. For example, domain names with low scores such as "chilema" and "microsoft" are determined as normal domain names, while domain names with high scores such as "czijbh" and "cvqthu" are determined as suspicious domain names.

[0057] In this embodiment, the main string of the domain name corresponding to the domain name to be detected can be obtained. The main string is then segmented according to pronunciation units to obtain multiple syllable units. These syllable units are then merged according to a preset syllable unit combination configuration, resulting in multiple syllable blocks. Multiple syllable features are determined based on these blocks, and the pronunciation naturalness of the main string can be determined based on these features. Finally, the anomaly detection result of the domain name to be detected is determined based on the pronunciation naturalness. In this embodiment, by determining the pronunciation naturalness of the main string and identifying whether the domain name is abnormal based on the pronunciation naturalness, the problem of related technologies struggling to achieve both high efficiency and high accuracy in domain name detection is effectively solved. On one hand, by decomposing the main string into multiple syllable blocks and determining multiple syllable features, this embodiment can characterize the pseudo-linguistic nature of the domain name, making domain name detection closer to human speech perception and improving the accuracy of identifying abnormal domain names obtained through random character combinations. This eliminates the need for frequent maintenance of domain name lists and training models. On the other hand, determining the pronunciation naturalness of the main string based on syllable features, while conforming to common domain name setting patterns, can objectively detect domain name fluency, avoiding subjective bias and enhancing the reliability and accuracy of detection. Therefore, this embodiment can effectively improve the accuracy and efficiency of domain name detection while reducing the consumption of computing resources.

[0058] In some optional application scenarios, the domain name detection method provided in one or more embodiments of this application can be integrated into a DGA detection application framework, and the framework can be deployed within a network security system to achieve high-efficiency, low-resource-consumption DGA domain name identification. Specifically, the DGA detection application framework can be applied to various network security scenarios. For example, in DNS security analysis scenarios, it can perform real-time detection of domain names in DNS requests to quickly identify abnormal domain names generated by DGA; in threat intelligence systems, it can perform batch detection of collected domain name information to provide a basis for threat intelligence analysis; in URL reputation scoring scenarios, it can use the naturalness of pronunciation as a key indicator for URL reputation scoring to assist in determining the security of URLs; in CDN edge detection scenarios, it can also detect domain names in access requests at CDN edge nodes to intercept access requests containing abnormal domain names in advance and reduce the impact of malicious traffic on backend servers.

[0059] In practical applications, the domain name anomaly detection method and application framework provided in this application can bring many beneficial effects: (1) High detection accuracy. By analyzing the pronunciation features of the main string of the domain name, it can effectively identify cleverly spelled, short and complex DGA domain names that are difficult to distinguish by traditional statistical models, and avoid the problem of missed detection caused by the lack of obvious surface features of the domain name. (2) Strong interpretability. Each domain name anomaly detection result can be explained by tracing back the syllable structure. For example, by tracing the segmentation process of syllable units, the merging logic of syllable blocks and the judgment basis of syllable features, the generation process of the detection result is clearly presented, which has good auditability and facilitates subsequent result verification and problem investigation. (3) Wide language adaptability. Since the domain name detection method provided in this application determines the naturalness of pronunciation based on the setting of syllable units, the formulation of syllable unit combination configurations, and the extraction of syllable features, and one or more of the above settings (such as pronunciation units, syllable unit combination configurations, syllable features, etc.) can be adjusted according to the phonetic rules of the target language, this method is applicable to language environments with obvious syllable rules, such as English, Pinyinized Chinese, and Southeast Asian languages, without the need to rebuild the detection model for different languages. (4) It can be implemented in a lightweight manner. In the implementation process, this method does not rely on large corpora or complex deep learning models. It can complete the detection by analyzing the syllable structure alone. It requires less computing resources and can be deployed on edge computing devices (such as edge gateways, IoT devices, etc.) or real-time detection systems with high requirements for detection response speed. (5) It has wide applicability. As mentioned above, this method and application framework can be flexibly applied to various scenarios such as DNS security analysis, threat intelligence systems, URL reputation scoring, and CDN edge detection, providing effective domain name anomaly detection solutions for different network security needs.

[0060] In one embodiment, the pronunciation unit may include a combination of consonant characters and a combination of vowel characters whose frequencies meet preset conditions.

[0061] Among them, the frequency of use meeting the preset conditions can refer to character combinations whose frequency of use is greater than the preset frequency of use threshold, such as high-frequency character combinations.

[0062] A consonant character combination can be a sequence of characters consisting of at least one consonant character that is often used as the beginning or connecting part of a syllable in the pronunciation rules of a language, such as "br", "st", and "chr" in English, and "zh", "ch", and "sh" in Chinese Pinyin. This combination can be stored in a pre-established character combination library, which can contain common consonant combinations in different language systems and can be supplemented or adjusted according to actual application scenarios.

[0063] Vowel character combinations can be character sequences consisting of at least one vowel character that are often used as the middle part of syllables in language pronunciation rules, such as "ea", "ou", and "ie" in English, and "ao", "ei", and "iu" in Chinese Pinyin. Similar to consonant character combinations, vowel character combinations can also be stored in a pre-established character combination library and can be classified and marked with consonant character combinations for easy matching and retrieval later.

[0064] In some exemplary embodiments, common consonant character combinations and common vowel character combinations in English and Pinyin languages ​​can be defined first, based on common pronunciation combination rules, to construct corresponding combination sets. For common consonant character combinations, the construction process is based on consonant combinations that actually occur frequently in English and Pinyin languages ​​and conform to common pronunciation habits. The types of consonant combinations included in this set are not limited to a specific range and can be reasonably expanded or adjusted according to the specific needs of the target language scenario in practical applications. For example, the common consonant character combinations may include combinations such as cr, sh, th, ph, ft, sch, str, bb, and cc. These consonant character combinations have a high frequency of occurrence in the daily use scenarios of English and Pinyin and can be used as preferred basic elements for constructing the combination.

[0065] For common vowel character combinations, the set is guided by the common pronunciation combination rules in English and Pinyin languages, and its coverage is not strictly limited. In some optional embodiments, the vowel combinations in the set can be supplemented or optimized in combination with specific language application scenarios (such as the pronunciation of professional terms in specific fields, regional language variants, etc.). For example, the set of common vowel combinations can include vowel combinations such as "ai", "ou", "ee", "ao", "ang", and "ing". These vowel combinations are typical and frequently used combinations in English word pronunciation and Pinyin syllable formation, and can be included as part of the set of common vowel combinations.

[0066] Accordingly, in step S101, the domain name main string is segmented according to the pronunciation units to obtain multiple syllable units, which may include the following steps:

[0067] Based on the matching results of consonant and vowel character combinations with the domain name body string, multiple syllable units of the domain name body string are obtained.

[0068] In practice, based on the language system that the domain name's main string may involve (such as English, Chinese Pinyin, etc.), consonant and vowel character combinations that conform to pronunciation rules under that language system can be collected. For example, for the English scenario, the consonant character combination library stores combinations such as "br", "cr", "dr", "fr", "gr", "pr", "tr", "st", "sp", and "sc"; the vowel character combination library stores common combinations such as "aa", "ae", "ai", "ao", "au", "ea", "ee", "ei", "eo", "eu", "ia", "ie", "io", "iu", "oa", "oe", "oi", "oo", and "ou".

[0069] After obtaining the main string of the domain name, the character sequence can be extracted from the starting position (i.e. the first character) of the main string of the domain name according to the preset rules and compared with the consonant character combination library and the vowel character combination library to obtain a list of content and position matching results containing all matching combinations. Then, the main string of the domain name can be segmented according to the matching result list to obtain multiple syllable units.

[0070] In this embodiment, on the one hand, by using pre-constructed consonant and vowel character combinations that conform to language pronunciation rules and whose usage frequency meets preset conditions to match the domain name body string, the key pronunciation combinations in the domain name body string can be accurately identified, avoiding segmentation errors caused by matching a single character or ignoring the pronunciation rules of combinations, so that the pronunciation logic of the segmented syllable units can match the actual pronunciation logic. On the other hand, by using consonant and vowel character combinations whose usage frequency meets preset conditions for matching, it is possible to more effectively identify whether the domain name body string contains character combinations that conform to the user's daily usage habits, thereby improving the accuracy of the recognition results.

[0071] In one embodiment, segmenting the domain name body string into multiple syllable units based on the matching results of consonant character combinations and vowel character combinations with the domain name body string may include the following steps:

[0072] Starting from the beginning of the domain name body string, matching is performed sequentially according to the matching priority of consonant character combinations and vowel character combinations; the matching priority increases as the length of the character combination increases; based on each successfully matched character combination, multiple syllable units of the domain name body string are determined.

[0073] In this context, matching priority can be understood as the order in which character combinations of different lengths are matched when matching character combinations in the main string of a domain name. The priority of the matching order of character combinations increases as the length of the character combination increases.

[0074] In practical applications, starting from the beginning of the domain name string, the longest possible matching principle is applied, prioritizing longer consonant or vowel combinations to segment the string into syllables. Specifically, after obtaining the consonant and vowel combinations, matching can begin from the very first character of the domain name string. For example, for the domain name string "apple", matching can start from the first character "a". Each time a consonant or vowel combination is used to match from the corresponding position, the longer combination is first attempted. If that fails, shorter combinations are then tried sequentially, while simultaneously checking the matching of both consonant and vowel combinations.

[0075] Furthermore, the character combinations that successfully match the content in the domain name body string from the consonant character combinations and vowel character combinations can be identified as multiple syllable units of the domain name body string.

[0076] In this embodiment, by matching consonant character combinations and vowel character combinations sequentially according to their respective matching priorities, and by increasing the priority as the length of the character combination increases, longer character combinations that are more in line with language habits can be matched first. This avoids segmentation deviations caused by prioritizing the matching of short combinations, helps to determine syllable units by combining pronunciation logic, and further ensures the accuracy of the segmentation results, which are in line with the actual pronunciation rules of the language.

[0077] In one embodiment, such as Figure 2 As shown, in step S102, merging multiple syllable units according to a preset syllable unit combination configuration may include the following steps:

[0078] Step S201: Determine the unit type of each of the multiple syllable units; the unit type includes consonant syllable units or vowel syllable units.

[0079] The unit type can be used to distinguish the pronunciation attributes of syllable units. In this embodiment, the unit type may include consonant syllable units and vowel syllable units.

[0080] In practice, the pronunciation attribute of a syllable unit can be determined by the type of the character combination that is successfully matched in the domain name body string. For example, if a syllable unit in the domain name body string is a syllable unit obtained by matching consonant character combinations, then the unit type of that syllable unit is a consonant syllable unit; if a syllable unit in the domain name body string is a syllable unit obtained by matching vowel character combinations, then the unit type of that syllable unit is a vowel syllable unit.

[0081] Step S202: Obtain the preset syllable unit combination configuration; each syllable unit combination configuration indicates the combination method of consonant syllable units and vowel syllable units.

[0082] In practical applications, syllable unit combination configurations determined according to language habits can be pre-set. These configurations indicate the compliant combination of consonant and vowel syllable units, ensuring that the merged syllables conform to pronunciation rules. In some optional embodiments, speech processing professionals can pre-configure various combination configurations based on the pronunciation habits of different languages ​​(such as Chinese and English) for use during domain name detection. For example, syllable unit combination configurations may include combinations such as "consonant syllable unit - vowel syllable unit" and "consonant syllable unit - vowel syllable unit - consonant syllable unit."

[0083] Furthermore, when identifying anomalies in the domain name to be detected, pre-set and stored syllable unit combination configurations can be invoked.

[0084] Step S203: Based on the unit type and syllable unit combination configuration of the multiple syllable units, at least some of the syllable units in the multiple syllable units are merged.

[0085] After obtaining the unit type and syllable unit combination configuration of each of the multiple syllable units, the syllable unit combination configuration can be matched according to the order of the multiple syllable units in the domain name body string. Then, according to the matching results, multiple syllable units in the domain name body string whose combination method conforms to the preset syllable unit combination configuration can be determined. Finally, multiple syllable units that conform to the preset syllable unit combination configuration can be merged.

[0086] To better understand the above process, the following examples will be provided as illustrations.

[0087] Specifically, for the obtained domain name body string, starting from the beginning of the domain name body string, the maximum matching principle is used to prioritize matching longer consonant or vowel character combinations, segmenting the string into syllable units one by one. For each segmented syllable unit, it can be marked as "C" (i.e., consonant syllable unit, also known as a consonant block) or "V" (i.e., vowel syllable unit, also known as a vowel block) based on the matching consonant or vowel character combinations. Then, they are merged according to configurations such as CV, CVC, etc. For example, when consonant syllable units and vowel syllable units appear consecutively, they can be merged into "CV", and when CV is followed by C, they are merged into "CVC".

[0088] Taking the domain name string "microsoft" as an example, the syllable units obtained after segmentation based on consonant and vowel character combinations are: {m(C), i(V), cr(C), o(V), s(C), o(V), ft(C)}. Correspondingly, after merging according to the syllable unit combination configuration, the merged result is: {mi(CV), cro(CV), soft(CVC)}. As another example, the domain name string "czijbh" is segmented into syllable units: {c(C), z(C), i(V), j(C), b(C), h(V)}. Correspondingly, after merging according to the syllable unit combination configuration, the merged result is: {c(C), zij(CVC), b(C), h(C)}.

[0089] In this embodiment, by merging at least some of the syllable units among multiple syllable units according to their respective unit types and syllable unit combination configurations, it is possible to formulate based on the rules of speech pronunciation, so that the multiple syllable blocks obtained after merging can better conform to the pronunciation habits of natural language, improve the accuracy of subsequent detection of pronunciation naturalness, and avoid unnatural pronunciation caused by abnormal merging.

[0090] In one embodiment, determining multiple syllable features based on multiple syllable blocks in step S102 may include the following steps:

[0091] The syllable density of the domain name body string is determined based on the relative size of the number of the first syllable blocks of multiple syllable blocks and the string length of the domain name body string; based on the syllable density, multiple syllable features are determined.

[0092] In practice, after processing the domain name body string to obtain multiple syllable blocks corresponding to the domain name body string, the number of these multiple syllable blocks can be counted and summarized to obtain the number of the first syllable block reflecting the total number of multiple syllable blocks. For example, for the domain name body string "microsoft", its first syllable block count is 3, namely mi, cro, and soft; for the domain name body string "czijbh", its first syllable block count is 4, namely c, zij, b, and h.

[0093] On the other hand, it is also possible to obtain the length of the domain name body string, which can reflect the number of strings contained in the domain name body string.

[0094] Then, the relative size of the number of first syllable blocks to the string length can be obtained, and the syllable density of the domain name body string can be determined based on this relative size. The syllable density is then used as a syllable feature, where the syllable density reflects the pronunciation complexity of the domain name. In some examples, it can be determined based on the ratio of the number of first syllable blocks in the domain name body string to the string length. Furthermore, multiple syllable features containing the syllable density can be obtained based on the syllable density.

[0095] In this embodiment, by using the relative size of the number of first syllable blocks and the string length of the domain name body string to determine the syllable density, the syllable distribution of the domain name can be transformed from an abstract concept into a calculable value, avoiding the bias of subjective judgment and improving the objectivity and accuracy of domain name syllable attribute analysis. For example, when detecting domain names, the memorability of different domain names can be more accurately judged based on the quantified syllable density, thereby identifying whether the domain name is abnormal.

[0096] In one embodiment, step S102, determining multiple syllable features based on multiple syllable blocks, may also include the following steps: determining isolated consonant syllable blocks from multiple syllable blocks; determining isolated consonant density based on the number of second syllable blocks in the isolated consonant syllable blocks; and determining multiple syllable features based on the isolated consonant density.

[0097] Isolated consonant syllable blocks, also known as isolated consonants, refer to individual consonants that fail to combine into a valid syllable. They can characterize the unnaturalness of language. In some examples, isolated consonant syllables can also be called isolated consonants, which are single consonants that fail to belong to any legal syllable combination during syllable segmentation. They usually appear in DGA domains, reflecting the unnaturalness of spelling.

[0098] In this embodiment, after obtaining multiple syllable blocks, isolated consonant syllable blocks can be identified from these blocks, and the number of second syllable blocks for each isolated consonant syllable block is estimated. If no isolated consonant syllable blocks are identified from the multiple syllable blocks, the number of second syllable blocks is 0. The number of second syllable blocks represents the total number of isolated consonant syllable blocks. For example, for the domain name string "microsoft", its multiple syllable blocks are mi, cro, and soft, and there are no isolated consonant syllable blocks; therefore, the number of second syllable blocks for isolated consonant syllable blocks is 0. For "czijbh", its multiple syllable blocks are c, zij, b, and h; therefore, the number of second syllable blocks for isolated consonant syllable blocks is 3, namely c, b, and h.

[0099] Then, the isolated consonant density can be determined based on the number of second syllable blocks in the isolated consonant syllable block, and this density can be used as a syllable feature. For example, the isolated consonant density can be determined based on the ratio of the number of second syllable blocks in the isolated consonant syllable block to the string length of the domain name body string. Furthermore, multiple syllable features containing the isolated consonant density can be obtained based on this density.

[0100] In this embodiment, by determining the isolated consonant density based on the number of second syllable blocks in the isolated consonant syllable block, the distribution of isolated consonants in the domain name body string can be transformed into a quantitative parameter of isolated consonant density. This allows the unnaturalness of the language in the domain name body string to be directly quantified and detected through density values, which helps improve the accuracy of subsequent pronunciation naturalness recognition.

[0101] In one embodiment, determining multiple syllable features based on multiple syllable blocks in step S102 may also include the following steps:

[0102] Based on the syllable entropy of multiple syllable blocks, determine the syllable entropy density of the domain name main string; based on the syllable entropy density, determine multiple syllable features.

[0103] Among them, syllable entropy can be used as an information entropy index to measure the uniformity of syllable distribution, and can reflect the complexity and regularity of the string in syllable structure; syllable entropy density is obtained by constructing a distribution of the frequency of occurrence of each syllable.

[0104] In a practical implementation, the syllable entropy of multiple syllable blocks can be obtained. In some optional embodiments, the string disorder can be calculated according to the Shannon entropy formula, thereby obtaining the syllable entropy H, where the Shannon entropy formula can be as follows:

[0105]

[0106] Where, p i It can be the probability of a syllable block appearing in the entire set of syllable blocks.

[0107] After obtaining the syllable entropy corresponding to multiple syllable blocks, the syllable entropy density of the domain name body string is determined. For example, the syllable entropy density can be determined based on the ratio of syllable entropy to the string length of the domain name body string. Then, the syllable entropy density is determined as a syllable feature, thereby obtaining multiple syllable features including the syllable entropy density.

[0108] In this embodiment, by calculating the syllable entropy density, the syllable attributes of the domain name's main string can be converted into quantifiable values. Simultaneously, the syllable entropy density integrates the entropy values ​​of multiple syllable blocks, reflecting the overall syllable characteristics of the domain name's main string and effectively demonstrating the global attributes of the domain name at the syllable level. Based on the syllable entropy density, this method can quantify the random distribution of domain names, thereby more accurately detecting abnormal domain names and determining syllable characteristics. It can accurately and effectively quantify the random distribution of domain name pronunciation, thus more accurately detecting abnormal domain names.

[0109] In one embodiment, determining multiple syllable features based on multiple syllable blocks in step S102 may also include the following steps:

[0110] Identify each non-isolated consonant syllable block in multiple syllable blocks; obtain the main syllable block based on the merging result of the non-isolated consonant syllable block and other adjacent non-isolated consonant syllable blocks; determine multiple syllable features based on the relative size of the string length of the main syllable block and the string length of the domain name body string.

[0111] Among them, non-isolated consonant syllable blocks can be any syllable block other than isolated consonants (i.e., isolated consonant syllable blocks). The main syllable block refers to the longest continuous, structurally complete substring in the main string of the domain name that is closest to the combination of syllables in natural language, and usually has a high degree of language fit.

[0112] In practice, isolated consonants in multiple syllable blocks can be identified first, and the syllable blocks other than those with isolated consonants can be designated as non-isolated consonant syllable blocks. For example, the domain name string "microsoft" has 0 isolated consonants, so the three syllable blocks mi, cro, and soft can all be designated as non-isolated consonant syllable blocks; the domain name string "czijbh" has 3 isolated consonants, namely c, b, and h, so the resulting non-isolated consonant syllable block is zij.

[0113] After identifying each non-isolated consonant syllable block, it can be determined whether there are other non-isolated consonant syllable blocks adjacent to it. If so, the non-isolated consonant syllable block can be merged with the other adjacent non-isolated consonant syllable blocks, and the main syllable block is obtained based on the merging result. For example, "microsoft" merges three syllable blocks mi, cro, and soft to obtain the main syllable block microsoft; "czijbh" has only one non-isolated consonant syllable block zij, so the main syllable block is zij.

[0114] After identifying the main syllable block, multiple syllable features can be determined based on the relative length of the main syllable block's string to the length of the domain body string. In one example, the ratio of the main syllable block's string length to the domain body string's string length can be obtained; this ratio is also called the main syllable block ratio, and the main syllable block ratio can then be used to determine the syllable features.

[0115] In this embodiment, by identifying non-isolated consonant syllable blocks, irrelevant noise in the main string of the domain name can be filtered out, focusing on key syllable units; by merging adjacent non-isolated consonant syllable blocks to obtain the main syllable block, a more representative syllable structure is formed, improving the accuracy of domain name readability analysis; by comparing the relative size of the main syllable block and the main string of the domain name, it is helpful to evaluate the speech fluency and memorability of the domain name, achieving efficient and accurate abnormal domain name detection.

[0116] In one embodiment, in step S103, determining the pronunciation naturalness of the domain name body string based on multiple syllable features may include the following steps: determining the syllable feature weights of each of the multiple syllable features; and determining the pronunciation naturalness of the domain name body string based on the multiple syllable features and their respective weights.

[0117] In the specific implementation, after extracting multiple syllable features corresponding to multiple syllable blocks, the syllable feature weights of each of the multiple syllable features can be determined. Then, feature fusion is performed based on the multiple syllable features and the weights of each syllable feature, and the pronunciation naturalness of the domain name main string can be obtained based on the fusion result.

[0118] In one example, multiple syllable features may include syllable density, isolated consonant density, syllable entropy density, and main syllable block ratio. The pronunciation naturalness score can then be determined using the following scoring function:

[0119] score = α × syllable density + β × isolated consonant density + γ × syllable entropy density - δ × main syllable block ratio.

[0120] Here, α, β, γ, and δ are feature weights, which can be empirical weight parameters or obtained through training optimization. In some examples, a higher pronunciation naturalness score indicates that the domain name is closer to a natural language structure; a lower score indicates that it is more likely to have been generated by DGA.

[0121] In this embodiment, by determining the naturalness of the pronunciation of the main string of the domain name based on multiple syllable features and the weight of each syllable feature, multiple dimensions of the domain name pronunciation can be captured, avoiding misjudgment due to insufficient single features, and effectively improving the accuracy of abnormal domain name detection.

[0122] To enable those skilled in the art to better understand the above steps, the following example illustrates the embodiments of this application, but it should be understood that the embodiments of this application are not limited thereto.

[0123] To address the problems of poor accuracy, low interpretability, and high deployment costs in existing DGA domain name detection methods, this embodiment proposes a domain name detection method based on syllable structure analysis and naturalness scoring. This method can effectively improve the ability of existing network protection systems to detect DGA attacks and provide more interpretable, scalable, and practical defense measures for network security.

[0124] The domain name detection method based on syllable structure analysis and naturalness scoring provided in this embodiment is particularly suitable for detecting non-natural domain names generated by domain name generation algorithms (DGA). This method draws on the structural rules of syllable composition in linguistics, and constructs an interpretable and discriminative naturalness scoring system by restoring domain names to syllable combinations that are close to human language. It can effectively identify potential abnormal domain names. This technical concept has strong scalability, panlinguistic adaptability and model independence.

[0125] In practical applications, the domain name detection method and system provided in this embodiment can have the following technical framework: Figure 3 As shown, it can include multiple parts such as a syllable block segmentation module, a syllable feature statistics module, a naturalness scoring module, and a domain name judgment module. The following further combines... Figure 4 This embodiment will be described.

[0126] Step S401: Obtain the domain body string corresponding to the domain to be detected.

[0127] Step S402: Starting from the beginning of the domain name main string, match sequentially according to the matching priority of consonant character combinations and vowel character combinations; determine multiple syllable units of the domain name main string based on each successfully matched character combination.

[0128] Step S403: Determine the unit type of each of the multiple syllable units.

[0129] In practical implementation, a language structure-driven malicious domain name identification system can be constructed. By simulating the pronunciation and spelling rules of human language, a deep understanding and effective classification of domain name composition can be achieved. Then, a syllable segmentation module performs syllable matching and segmentation. The syllable segmentation module takes the input domain name string as the analysis object and performs maximum matching segmentation based on the consonant-vowel (CV) combination pattern of English and common phonetic languages. Specifically, a dictionary of common consonant combinations and vowel combinations can be constructed first, and then the domain name string can be traversed to segment syllable components according to the maximum matching rule from left to right, such as consonant components (C) and vowel components (V).

[0130] Step S404: Based on the unit type and syllable unit combination configuration of the multiple syllable units, at least some of the syllable units in the multiple syllable units are merged, and multiple syllable blocks are obtained based on the merging result.

[0131] Then, based on common syllable structures, such as CV, CVC, VC, etc., syllable components can be merged and combined into syllable blocks.

[0132] Step S405: Determine multiple syllable features based on multiple syllable blocks.

[0133] After syllable segmentation is completed, the syllable structure fusion and main syllable block identification steps are entered. Based on the aforementioned segmentation results, the structure of adjacent non-isolated consonant syllable blocks is fused, and the longest syllable continuum in the entire string is identified and defined as the main syllable block. The main syllable block will be used in the subsequent feature analysis process.

[0134] Next, the syllable feature statistics module can perform syllable feature statistics. In this embodiment, four types of structured features are mainly extracted: syllable density, isolated consonant density, syllable entropy density, and main syllable block ratio. Among them, syllable density reflects the pronunciation complexity of the domain name, isolated consonant density refers to individual consonants that fail to combine into a valid syllable, and its value can represent the unnaturalness of the language, syllable entropy density is the string disorder calculated based on Shannon entropy after constructing the distribution of the frequency of each syllable, and the main syllable block ratio is the proportion of the longest continuous syllable block to the total length.

[0135] Step S406: Determine the pronunciation naturalness of the domain name main string based on multiple syllable features and the weight of each syllable feature.

[0136] After obtaining the aforementioned syllable features, a naturalness score can be calculated. The naturalness of pronunciation is determined based on the extracted syllable features and the scoring function. The scoring function can be expressed as: score = α × syllable density + β × isolated consonant density + γ × syllable entropy density - δ × main syllable block ratio.

[0137] Step S407: Determine the anomaly detection result of the domain name to be detected based on the naturalness of pronunciation.

[0138] Finally, the domain name identification module can identify and filter DGA domain names based on naturalness scores and pre-set thresholds. Alternatively, in some optional embodiments, simple classification models (such as logistic regression, decision trees, etc.) can be used for DGA domain name identification and filtering.

[0139] To further illustrate the practical application effect of the method of the present invention, the following provides an exemplary example of syllable feature processing, which detects the four domain names "microsoft", "czijbh", "lenovo", and "cvqthu" respectively, and the results are as follows:

[0140] For "microsoft", after segmentation, we get mi, cro, and soft. Its syllable density is 0.33, the independent consonant density is 0.00, the syllable entropy density is 0.17, the main syllable block ratio is 1.00, and the naturalness score is -0.50.

[0141] For “czijbh”, after segmentation, we get c, zij, b, and h. Its syllable density is 0.67, independent consonant density is 0.50, syllable entropy density is 0.30, main syllable block ratio is 0.50, and naturalness score is 0.97.

[0142] For "lenovo", after segmentation, we get le, no, vo, with a syllable density of 0.50, an independent consonant density of 0.00, a syllable entropy density of 0.26, a main syllable block ratio of 1.00, and a naturalness score of -0.24.

[0143] For “cvqthu”, after segmentation, we get c, v, q, thu. Its syllable density is 0.67, independent consonant density is 0.50, syllable entropy density is 0.30, main syllable block ratio is 0.50, and naturalness score is 0.97.

[0144] As can be seen from the above results, DGA domain names such as "czijbh" and "cvqthu" usually have the characteristics of high syllable density, high isolated consonants, high entropy value and no obvious main syllable block, while natural domain names such as "microsoft" and "lenovo" show the opposite characteristics.

[0145] In response to the difficulty of efficiently and accurately detecting abnormal domain names using related technologies, the inventors of this application have made the following improvements after extensive creative work: (1) Providing a syllable segmentation mechanism for domain name text, which identifies CV configurations and their combinations in domain names by constructing a language-independent maximum matching segmentation algorithm; (2) Proposing a method for extracting naturalness features from the main string of the domain name. Specifically, this application proposes a feature set with the number of syllables, the number of isolated consonants, the proportion of main syllable blocks, and syllable entropy as the main syllable features, in order to depict the linguistic nature of the domain name; (3) Providing a naturalness scoring mechanism, which uses a scoring function that integrates multi-dimensional syllable structure features to score the naturalness of the main string of the domain name. (3) Comprehensive detection can be performed to measure the pronunciation and naturalness of the string; (4) The domain name detection method provided in this application can provide a feasible, specific and universally applicable application framework for DGA detection. By integrating the above domain name detection method into the network security system, DGA domain name recognition with high efficiency and low resource consumption can be achieved. Moreover, since this application has the ability to analyze structured features, unlike the deep learning black box model, it is suitable for running in resource-constrained environments such as edge devices and embedded systems. At the same time, it can achieve efficient recognition without massive labeled samples, which is convenient for rapid deployment of response when early threats appear. It is especially suitable for dealing with new DGA algorithms with complex spelling and high variability. It can be seen that this application provides a DGA detection method that is both lightweight and efficient and has good interpretability. It can effectively identify pseudo-random domain names that seem reasonable but are actually abnormal from the perspective of the essential structure of language.

[0146] The domain name detection method of this application can also achieve the following effects and objectives: Firstly, it can improve the accuracy and generalization ability of DGA domain name detection, especially suitable for dealing with novel DGA algorithms that handle complex spellings and high variability; secondly, it enhances the interpretability and lightweight deployment capability of the method. Unlike deep learning black-box models, this application has structured feature analysis capabilities, enabling it to run conveniently in resource-constrained environments such as edge devices and embedded systems; thirdly, this application also reduces the dependence on corpora and the threshold for training data, achieving efficient identification without massive labeled samples, facilitating rapid deployment and response when threats emerge in the early stages. Therefore, the domain name detection method provided by this application can effectively improve the perception capability of existing network protection systems against DGA attacks, providing more interpretable, scalable, and practical defense methods for network security.

[0147] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps. It is understood that the steps in different embodiments can be freely combined as needed, and all non-contradictory solutions formed by such combinations are within the scope of protection of this application.

[0148] Based on the same inventive concept, this application also provides a domain name detection device for implementing the domain name detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more domain name detection device embodiments provided below can be found in the limitations of the domain name detection method described above, and will not be repeated here.

[0149] In one exemplary embodiment, such as Figure 5 As shown, a domain name detection device is provided, comprising:

[0150] The syllable unit acquisition module 501 is used to acquire the domain name body string corresponding to the domain name to be detected, and to segment the domain name body string according to the pronunciation unit to obtain multiple syllable units;

[0151] The syllable feature acquisition module 502 is used to merge the multiple syllable units according to a preset syllable unit combination configuration, obtain multiple syllable blocks according to the merging result, and determine multiple syllable features according to the multiple syllable blocks;

[0152] The naturalness calculation module 503 is used to determine the pronunciation naturalness of the domain name main string based on the multiple syllable features;

[0153] The detection result acquisition module 504 is used to determine the abnormal detection result of the domain name to be detected based on the naturalness of the pronunciation.

[0154] In one embodiment, the pronunciation unit includes a combination of consonant characters and a combination of vowel characters whose frequencies meet preset conditions; the syllable unit acquisition module 501 is used to: segment the domain name main string into multiple syllable units based on the matching results of the consonant character combination and the vowel character combination with the domain name main string.

[0155] In one embodiment, the syllable unit acquisition module 501 is configured to: start from the beginning of the domain name body string, and sequentially match according to the matching priority of each consonant character combination and vowel character combination; the matching priority increases with the length of the character combination; and determine multiple syllable units of the domain name body string based on each successfully matched character combination.

[0156] In one embodiment, the syllable feature acquisition module 502 is configured to: determine the unit type of each of the plurality of syllable units; the unit type includes consonant syllable units or vowel syllable units; acquire a preset syllable unit combination configuration; each syllable unit combination configuration indicates the combination method of the consonant syllable units and the vowel syllable units; and merge at least some of the syllable units among the plurality of syllable units according to the unit type of each of the plurality of syllable units and the syllable unit combination configuration.

[0157] In one embodiment, the syllable feature acquisition module 502 is configured to: determine the syllable density of the domain name body string based on the relative size of the number of the first syllable blocks of the plurality of syllable blocks and the string length of the domain name body string; and determine the plurality of syllable features based on the syllable density.

[0158] In one embodiment, the syllable feature acquisition module 502 is configured to: determine isolated consonant syllable blocks from the plurality of syllable blocks; determine the isolated consonant density based on the number of second syllable blocks of the isolated consonant syllable blocks; and determine the plurality of syllable features based on the isolated consonant density.

[0159] In one embodiment, the syllable feature acquisition module 502 is configured to: determine the syllable entropy density of the domain name main string based on the syllable entropy of the plurality of syllable blocks; and determine the plurality of syllable features based on the syllable entropy density.

[0160] In one embodiment, the syllable feature acquisition module 502 is configured to: determine each non-isolated consonant syllable block in the plurality of syllable blocks; obtain a main syllable block based on the merging result of the non-isolated consonant syllable block and other non-isolated consonant syllable blocks adjacent to the non-isolated consonant syllable block; and determine a plurality of syllable features based on the relative size of the string length of the main syllable block and the string length of the domain name body string.

[0161] In one embodiment, the naturalness calculation module 503 is configured to: determine the syllable feature weights of the plurality of syllable features; and determine the pronunciation naturalness of the domain name body string based on the plurality of syllable features and the weights of each syllable feature.

[0162] Each module in the aforementioned domain name detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0163] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 6 As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs in the non-volatile storage media to run. The database stores the domain name and syllable information to be detected. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a domain name detection method.

[0164] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0165] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0166] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0167] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0168] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0169] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0170] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0171] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A domain name detection method, characterized in that, The method includes: Obtain the domain body string corresponding to the domain name to be detected, and segment the domain body string according to the pronunciation unit to obtain multiple syllable units; The multiple syllable units are merged according to a preset syllable unit combination configuration, and multiple syllable blocks are obtained according to the merging result. Multiple syllable features are then determined based on the multiple syllable blocks. The pronunciation naturalness of the domain name's main string is determined based on the multiple syllable features; The anomaly detection result of the domain name to be detected is determined based on the naturalness of the pronunciation.

2. The method according to claim 1, characterized in that, The pronunciation unit includes combinations of consonant characters and combinations of vowel characters whose frequencies meet preset conditions; The domain name main string is segmented according to pronunciation units to obtain multiple syllable units, including: Based on the matching results between the consonant character combination and the vowel character combination and the domain name main string, multiple syllable units of the domain name main string are obtained.

3. The method according to claim 2, characterized in that, The step of segmenting the domain name body string into multiple syllable units based on the matching results of the consonant character combinations and the vowel character combinations with the domain name body string includes: Starting from the beginning of the domain name string, matching is performed sequentially according to the matching priority of each consonant character combination and vowel character combination; the matching priority increases as the length of the character combination increases. Based on the successfully matched character combinations, multiple syllable units of the domain name body string are determined.

4. The method according to claim 1, characterized in that, The step of merging the multiple syllable units according to a preset syllable unit combination configuration includes: Determine the unit type of each of the plurality of syllable units; the unit type includes consonant syllable units or vowel syllable units. Obtain a preset syllable unit combination configuration; each syllable unit combination configuration indicates the combination method of the consonant syllable unit and the vowel syllable unit; Based on the unit type of each of the plurality of syllable units and the combination configuration of the syllable units, at least some of the syllable units are merged.

5. The method according to claim 1, characterized in that, The step of determining multiple syllable features based on the multiple syllable blocks includes: The syllable density of the domain name body string is determined based on the relative size of the number of the first syllable blocks of the plurality of syllable blocks and the string length of the domain name body string. The features of the plurality of syllables are determined based on the syllable density.

6. The method according to claim 1, characterized in that, The step of determining multiple syllable features based on the multiple syllable blocks includes: Identify isolated consonant syllable blocks from the plurality of syllable blocks; The density of isolated consonants is determined based on the number of second syllable blocks in the isolated consonant syllable block; The features of the multiple syllables are determined based on the density of isolated consonants.

7. The method according to claim 1, characterized in that, The step of determining multiple syllable features based on the multiple syllable blocks includes: The syllable entropy density of the domain name body string is determined based on the syllable entropy of the multiple syllable blocks; The features of the plurality of syllables are determined based on the syllable entropy density.

8. The method according to claim 1, characterized in that, The step of determining multiple syllable features based on the multiple syllable blocks includes: Identify each non-isolated consonant syllable block in the plurality of syllable blocks; The main syllable block is obtained by merging the non-isolated consonant syllable block with other non-isolated consonant syllable blocks adjacent to the non-isolated consonant syllable block; Multiple syllable features are determined based on the relative length of the main syllable block and the length of the domain name body string.

9. The method according to any one of claims 1 to 8, characterized in that, The step of determining the pronunciation naturalness of the domain name main string based on the multiple syllable features includes: Determine the syllable feature weights of each of the multiple syllable features; The pronunciation naturalness of the domain name body string is determined based on multiple syllable features and the weight of each syllable feature.

10. A domain name detection device, characterized in that, The device includes: The syllable unit acquisition module is used to acquire the domain body string corresponding to the domain name to be detected, and to segment the domain body string according to the pronunciation unit to obtain multiple syllable units; The syllable feature acquisition module is used to merge the multiple syllable units according to a preset syllable unit combination configuration, obtain multiple syllable blocks according to the merging result, and determine multiple syllable features according to the multiple syllable blocks; The naturalness calculation module is used to determine the pronunciation naturalness of the domain name main string based on the multiple syllable features; The detection result acquisition module is used to determine the abnormal detection result of the domain name to be detected based on the naturalness of the pronunciation.

11. A communication device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 9.

Images