Domain name detection method and device and electronic equipment

Abstract

The invention discloses a domain name detection method and device and electronic equipment. The method comprises the following steps: acquiring historical domain name data of a plurality of historical domain names in a historical domain name set; performing feature extraction on the historical domain name data to obtain statistical features, time sequence features and spatial features of a plurality of historical domain names; performing feature fusion and feature selection on the statistical features, the time sequence features and the spatial features of the plurality of historical domain names to obtain historical domain name features of the historical domain name data; inputting the historical domain name features and the classification labels corresponding to the plurality of historical domain names into a pre-constructed artificial intelligence model for training to obtain a domain name classification model; and obtaining target domain name data of the target domain name, performing feature extraction on the domain name data, inputting the domain name data into the domain name classification model, and outputting a domain name family to which the target domain name belongs. Through the method, the feature discrimination capability and prediction precision of the domain name classification model can be improved. In addition, fine-grained classification can be carried out on the target domain names.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a domain name detection method, device, and electronic device. Background Technology

[0002] The Domain Name System (DNS) is a system that provides services to map domain names to IP address spaces. Its open architecture makes it a key target for cyberattacks. Therefore, the detection of malicious domain names is an important part of network security.

[0003] Currently, domain name detection is generally based on extracting relevant domain features from domain name text, traffic data, and WHOIS information. However, existing domain name detection methods rely excessively on static text features (such as domain name text and WHOIS information), lacking the ability to capture dynamic behavioral features (such as DNS query patterns and network traffic characteristics). Their modeling capabilities for topological relationships between domains (such as the IP hopping relationship between C&C servers and malicious nodes) and temporal behavioral patterns (such as the millisecond-level query cycle of DGA variants) are weak, leading to blind spots in the detection of new evasion techniques, particularly the inability to identify carefully disguised dynamic malicious domains. Furthermore, the prevalent use of feature fusion methods dependent on a single graph structure limits detection performance to predefined relationships, resulting in weak detection capabilities for isolated nodes and new attack families, failing to adapt to the rapidly evolving landscape of malicious domains. Moreover, existing detection methods are only used at the binary classification level of malicious / benign, lacking fine-grained family identification capabilities, making it difficult to meet the advanced needs of attack tracing and threat intelligence analysis in actual security operations, thus limiting the precise formulation of protection strategies.

[0004] There is currently no effective solution to the problems of insufficient domain name feature representation capabilities and classification granularity, resulting in low domain name detection accuracy. Summary of the Invention

[0005] The purpose of this application is to provide a domain name detection method, apparatus, and electronic device to solve the problems of insufficient domain name feature representation ability and classification granularity, resulting in low domain name detection accuracy.

[0006] To solve the above-mentioned technical problems, the first aspect of this specification provides a domain name detection method, including:

[0007] Obtain historical domain data from multiple historical domains in a historical domain set. The historical domain data includes domain information data, traffic data, and domain text data.

[0008] Feature extraction is performed on the historical domain name data to obtain statistical features, temporal features and spatial features of multiple historical domain names. The temporal features are used to characterize the dynamic features of the historical domain name data within a preset time period, and the spatial features are used to characterize the spatial association structure information of multiple historical domain names.

[0009] By performing feature fusion and feature selection on the statistical characteristics, temporal characteristics, and spatial characteristics of multiple historical domain names, the historical domain name characteristics of the historical domain name data are obtained.

[0010] The historical domain name features and the classification labels corresponding to multiple historical domain names are input into a pre-built artificial intelligence model for training to obtain a domain name classification model;

[0011] Obtain the target domain name data, process the target domain name data, input it into the domain name classification model, and output the domain name family to which the target domain name belongs.

[0012] In some embodiments of this specification, feature extraction is performed on the historical domain name data to obtain statistical features, temporal features, and spatial features of multiple historical domain names, including:

[0013] The historical domain name data is subjected to a first feature extraction to obtain the character features, traffic features, and domain name information features of the historical domain name data as the statistical features;

[0014] Extract time-series data from the historical domain name data, and perform time-series embedding on the time-series data to obtain the time-series features;

[0015] Based on the historical domain name data, a communication association structure diagram of the multiple historical domain names is constructed, and graph embedding is performed on the communication association structure diagram to obtain the spatial features. The communication association structure diagram is used to characterize the resource overlap association information among the multiple historical domain names.

[0016] In some embodiments of this specification, the character features include at least one of the following: domain name length, number of subdomains, number of special characters, number of numeric characters, number of conversions between numbers and letters, and number of dictionary words;

[0017] The traffic characteristics include at least one of the following: number of IP address changes, number of resource record changes, range of record resolution times, number of different domain names hosted by the IP address used for domain name resolution, number of different countries to which the IP address used for domain name resolution belongs, number of different regions to which the IP address used for domain name resolution belongs, number of clients requesting domain name resolution, number of times the domain name was requested to be resolved, and number of different domain names requested to be resolved by the client requesting domain name resolution.

[0018] The domain name information features include at least one of the following: whether date information is missing, valid registration duration, and edit distance similarity of domain name servers.

[0019] In some embodiments of this specification, the timing features are extracted in the following manner:

[0020] Time-series data is extracted from the traffic data in the historical domain name data to obtain time-series data of multiple historical domain names within a preset time period. The time-series data includes change data related to client requests and domain name resolution within the preset time period.

[0021] The time series data is input into a pre-trained time series embedding model, which outputs the time series features.

[0022] In some embodiments of this specification, the variable data related to client requests includes at least one of the following: the total number of request packets initiated by the client, the number of clients that initiated the request, the number of hours in which the domain name was requested, the total number of requests in the most active hour, the range of the total number of requests in each hour, the number of unique values ​​of the total number of requests in each hour, the percentage of the total number of requests in the most active hour as a percentage of the total number of requests in the whole day, and the total number of requests in each of the multiple time periods.

[0023] Changes in domain name resolution data include at least one of the following: the total number of domain name resolution packets issued by the domain name resolution system, the number of unique IPs resolved by the domain name, the number of resource record types resolved by the domain name, the range of the total number of responses for each resolution record, and the number of unique values ​​in the total number of responses for each resolution record.

[0024] In some embodiments of this specification, the temporal embedding model includes an input layer, a temporal network processing layer, and an output layer. The temporal network processing layer includes a temporal mapping function, which is used to map the input data to corresponding low-dimensional feature labels.

[0025] The temporal embedding model is trained in the following manner:

[0026] Acquire training sample data, which includes multiple training sample pairs. The training sample pairs are constructed from time-series data and corresponding labels. The labels are used to characterize the low-dimensional embedding features of the time-series data.

[0027] The parameters of the temporal network processing layer are optimized based on the training sample pairs in the training sample data and the first preset loss function.

[0028] In some embodiments of this specification, the spatial features are extracted in the following manner:

[0029] Based on the traffic data and domain information data in the historical domain data, several key resource dimensions associated with the communication structure of the multiple historical domains are determined;

[0030] Based on key resource data corresponding to multiple key resource dimensions, a multi-layer isomorphic weighted graph is constructed for multiple key resource dimensions. Each layer of the multi-layer isomorphic weighted graph includes multiple historical domains and the weighted associations between multiple historical domains, as well as the weighted associations between historical domains in each layer of the isomorphic weighted graph.

[0031] The multi-layer isomorphic weighted graph is input into a pre-trained graph embedding model, which outputs the spatial features.

[0032] In some embodiments of this specification, the multiple key resource dimensions include at least one of the following: IP, CNAME, MX, NS, client, resource record, country, region, NS server, registrant, registrar, administrator email, technical support email, Whois server, and registration address.

[0033] In some embodiments of this specification, a multi-layered isomorphic weighted graph is constructed based on key resource data corresponding to multiple key resource dimensions, including:

[0034] Based on the traffic data, calculate the intra-layer resource similarity and inter-layer resource similarity of each historical domain name;

[0035] The multi-layer isomorphic weighted graph is constructed by using each historical domain name as a node in the isomorphic weighted graph of each layer, using the similarity of resources between layers as the weighted association edges connecting the nodes within each layer, and using the similarity of resources between layers as the weighted association edges connecting the nodes between layers.

[0036] In some embodiments of this specification, the intra-layer resource similarity is determined by the following formula:

[0037] ;

[0038] Among them, intraLayer_weight_reRe(d i ,d j ) represents the domain name d in a multi-layer isomorphic weighted graph constructed from reRe type resources. i With domain d j Intra-layer resource similarity between layers, reRe(d i ) indicates the domain name d i Extract the collection of resources of type reRe that it maps to.

[0039] In some embodiments of this specification, the inter-layer resource similarity is determined by the following formula:

[0040] ;

[0041] Among them, intraLayer_weight_ll'(d i ,d j ) represents the domain name d in a multi-layer isomorphic weighted graph constructed from reRe type resources. i With domain d j Interlayer resource similarity.

[0042] In some embodiments of this specification, the graph embedding model includes an input layer, a graph embedding processing layer, and an output layer. The graph embedding processing layer includes a graph embedding mapping function, which is used to map the input graph data to a low-dimensional vector space.

[0043] The graph embedding model is trained in the following way:

[0044] Acquire training sample data, wherein the training samples include multi-layer isomorphic weighted graph data;

[0045] The graph embedding mapping function of the graph embedding processing layer is used to determine the reconstruction weights between nodes in the training sample data.

[0046] The parameters of the graph embedding processing layer are optimized based on the reconstructed weights, the true weights in the training sample data, and the second preset loss function.

[0047] In some embodiments of this specification, the target domain name data is feature extracted and then input into the domain name classification model, including:

[0048] Feature extraction is performed on the target domain name data to obtain the target statistical features, target temporal features, and target spatial features corresponding to the target domain name data;

[0049] The target statistical features, the target temporal features, and the target spatial features are concatenated and selected to obtain the target domain name features;

[0050] The target domain name features are input into the domain name classification model to obtain the probability of the target domain name being classified into each of the multiple preset domain name families;

[0051] The domain family to which the target domain belongs is determined based on multiple probabilities.

[0052] The second aspect of this specification provides a domain name detection device, comprising:

[0053] The acquisition module is used to acquire historical domain data from multiple historical domains in the historical domain set. The historical domain data includes domain information data, traffic data, and domain text data.

[0054] The extraction module is used to extract features from the historical domain name data to obtain statistical features, temporal features and spatial features of multiple historical domain names. The temporal features are used to characterize the dynamic features of the historical domain name data within a preset time period, and the spatial features are used to characterize the spatial association structure information of multiple historical domain names.

[0055] The processing module is used to perform feature fusion and feature selection on the statistical features, temporal features and spatial features of multiple historical domain names to obtain the historical domain name features of the historical domain name data;

[0056] The training module is used to input the historical domain name features and the classification labels corresponding to multiple historical domain names into a pre-built artificial intelligence model for training, so as to obtain a domain name classification model.

[0057] The classification module is used to obtain the target domain name data of the target domain name, process the target domain name data and input it into the domain name classification model, and output the domain name family to which the target domain name belongs.

[0058] A third aspect of this specification provides an electronic device, comprising: a memory and a processor, the processor and the memory being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the steps of the method described in the first aspect above.

[0059] A fourth aspect of this specification provides a computer storage medium storing computer program instructions that, when executed, implement the steps of the method described in the first aspect.

[0060] The fifth aspect of this specification provides a computer program product comprising a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0061] The domain name detection method, apparatus, and electronic device in the embodiments of this specification acquire historical domain name data of multiple historical domain names in a historical domain name set, wherein the historical domain name data includes domain name information data, traffic data, and domain name text data; extract features from the historical domain name data to obtain statistical features, temporal features, and spatial features of multiple historical domain names, wherein the temporal features are used to characterize the dynamic features of the historical domain name data within a preset time period, and the spatial features are used to characterize the spatial association structure information of multiple historical domain names; perform feature fusion and feature selection on the statistical features, temporal features, and spatial features of multiple historical domain names to obtain historical domain name features of the historical domain name data; input the historical domain name features and the classification labels corresponding to multiple historical domain names into a pre-built artificial intelligence model for training to obtain a domain name classification model; acquire the target domain name data of the target domain name, extract features from the domain name data, input it into the domain name classification model, and output the domain name family to which the target domain name belongs. The above methods extract features from historical domain name data from multiple dimensions. Based on the results of feature extraction, feature fusion and feature selection are performed. The fused and selected historical domain name features can fully characterize the dynamic behavior and relationships within the historical domain name data, enhancing the ability to depict domain family features and thus improving the feature discrimination ability and prediction accuracy of subsequent domain name classification models. Furthermore, the fine-grained historical domain name features after fusion enable the domain name classification model to perform fine-grained classification of target domain names, providing a foundation for subsequent domain name protection. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0063] Figure 1 The diagram shown is a schematic representation of a domain name detection method provided in an embodiment of this specification.

[0064] Figure 2 The diagram shown is a schematic representation of a feature extraction method provided in an embodiment of this specification.

[0065] Figure 3 The diagram shown is a schematic representation of a method for determining time features provided in an embodiment of this specification.

[0066] Figure 4 The diagram shown is a schematic representation of a method for determining time features provided in an embodiment of this specification.

[0067] Figure 5The diagram shown is a schematic representation of a method for determining spatial features provided in an embodiment of this specification.

[0068] Figure 6 The diagram shown is a schematic representation of a method for determining spatial features provided in an embodiment of this specification.

[0069] Figure 7 The diagram shown is a schematic of a malicious domain name family detection method based on multi-source fusion features provided in the embodiments of this specification;

[0070] Figure 8 The diagram shown is a schematic representation of a confusion matrix provided in an embodiment of this specification.

[0071] Figure 9 The diagram shown is a schematic of a domain name detection device provided in an embodiment of this specification;

[0072] Figure 10 The diagram shown is a schematic of an electronic device provided in an embodiment of this specification. Detailed Implementation

[0073] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0074] It should be noted that the information and data related to users involved in the embodiments of this specification are all information and data authorized by the user or fully authorized by the relevant parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with relevant laws, regulations, and standards, do not violate public order and good morals, and provide corresponding operation entry points for users or relevant parties to choose to authorize or refuse.

[0075] It should also be noted that in the embodiments of this specification, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that this application has used or necessarily used such a solution.

[0076] Due to its open architecture, the Domain Name System (DNS) has become a key carrier for cyberattacks such as malware distribution, data breaches, C&C communication, botnet control, phishing, and spam. With the development of network technology, current malicious domain detection technology is evolving from binary classification to a multi-classification paradigm. This requires not only determining the malicious attributes of a domain but also accurately identifying its attack type (such as a specific malware family or attack activity). This helps analyze malicious infections in the network and provides information on the domain cluster to which the domain belongs, which is of great significance for subsequent work such as reverse engineering and security reporting. Malicious domain activity classification needs to achieve fine-grained identification of attack types. The accuracy of the classification model highly depends on the feature characterization ability; highly discriminative feature combinations can significantly improve classification accuracy.

[0077] Current methods for detecting malicious domain names mainly include the following:

[0078] (1) Text vectorization analysis is performed by extracting static features based on domain name text, browser access content, WHOIS information and ICP filing. However, this method relies entirely on static text features and cannot effectively identify the real-time network behavior features of malicious domains, such as key behavioral indicators such as abnormal access patterns. Attackers can construct malicious domains that conform to normal text features (such as reasonable domain name length and compliant WHOIS information) or use browser content dynamic rendering technology to disguise them as legitimate pages and bypass the static detection mechanism. Furthermore, since only the static attributes of isolated domains are analyzed, the entity association of malicious domain families is not modeled, and the topological features and resource reuse patterns of malicious families cannot be effectively identified. It is difficult to capture the sudden change features of malicious domains in request behavior, such as the sudden change in DNS query frequency and the dynamic change of TTL value. It is also difficult to effectively distinguish the temporal behavior patterns of different families, which restricts the accurate identification capability of malicious domain families.

[0079] (2) Based on the association between domain names (such as shared IP, similar WHOIS information, DNS record similarity, etc.), a spatiotemporal relationship graph is constructed to extract the spatiotemporal dynamic features of domain names to achieve malicious domain name identification. However, this method is limited by the graph structure dependency, specifically: the malicious domain name detection capability is highly limited by the preset domain name association relationship, resulting in poor detection capability of the graph base model for newly added isolated malicious nodes. Isolated nodes lack connection edges with existing malicious domain names and cannot obtain contextual association features through graph algorithms, resulting in detection blind spots; the domain name classification granularity is insufficient, only performing binary classification for malicious domain names and benign domain names, failing to further distinguish the malicious family to which the malicious domain name belongs.

[0080] (3) Extract multi-dimensional behaviors such as character information, whois information, host access information, domain name resolution information, and webpage display information of the domain name to be detected to construct a domain name association graph for feature extraction, and use the features to detect malicious domain names. However, this method only considers the spatial dimension association of domain names and lacks modeling of the temporal pattern of domain name resolution. It is difficult to capture the sudden change characteristics of malicious domain names in request behavior, such as the sudden change of DNS query frequency and the dynamic change of TTL value. It cannot effectively distinguish the temporal behavior patterns of different families, which restricts the accurate identification capability of malicious domain name families; and it still has the shortcomings of the second detection method mentioned above.

[0081] It is evident that the core adjustment currently facing multi-classification detection of malicious domains can be summarized as insufficient feature representation capabilities. In-depth analysis reveals two key factors affecting classification effectiveness:

[0082] Missing Feature Dimensions: Existing statistical-based feature extraction methods have significant limitations. Current coarse-grained statistical features (such as query frequency and response latency) are insufficient to effectively characterize the fine-grained behavioral features of malicious domains. Specifically, this manifests in two ways: First, different family domains using similar technologies or naming rules are difficult to distinguish in the feature space, leading to a surge in false positives. Second, various domains working together in the same attack chain (such as C&C domains, resource download domains, and content provider domains in spam attacks) exhibit a loose distribution in the feature space due to differences in behavioral patterns, increasing the risk of missed detections.

[0083] Feature fusion limitations: Existing fusion schemes struggle to effectively integrate static attributes and dynamic behavioral features. Spatiotemporal feature fusion schemes based on deep learning graph models are overly dependent on network topology and perform poorly in detecting isolated nodes and new attack families. Traditional machine learning methods, on the other hand, lack the ability to model high-dimensional features (such as query interval patterns) and spatial features (such as IP geographic location distribution), and their cross-modal feature extraction is limited, significantly restricting detection capabilities.

[0084] To address the aforementioned issues, this specification provides a domain name detection method that compensates for the lack of feature dimensions in traditional methods through multi-source heterogeneous feature extraction. In terms of feature fusion mechanism, it employs a multi-feature concatenation and fusion architecture, and by selecting features, it accurately characterizes domain name features while reducing data volume, thereby improving the accuracy of the trained domain name classification model. Furthermore, it further achieves domain name family identification through a fine-grained classification system. The domain name detection method in this specification achieves breakthroughs in three dimensions: feature completeness, fusion robustness, and classification precision.

[0085] Figure 1The diagram illustrates a domain name detection method provided in an embodiment of this specification. It is understood that the domain name detection in this embodiment can be malicious domain name detection, including detecting whether a domain name is malicious and its corresponding malicious family, or it can be detection of all domain names, including the domain name family corresponding to the domain name and whether the corresponding domain name family is a malicious domain name family, etc. This specification does not limit this. A malicious family can be, for example, malicious activity. Although this specification provides method operation steps or device structures as shown in the following embodiments or figures, based on conventional or non-inventive effort, the method or device may include more or fewer operation steps or module units after partial merging. In steps or structures where there is no logically necessary causal relationship, the execution order of these steps or the module structure of the device is not limited to the execution order or module structure shown in the embodiments or figures of this specification. When the method or module structure is applied in actual devices, servers, or terminal products, it can be executed sequentially or in parallel according to the method or module structure shown in the embodiments or figures (e.g., in a parallel processor or multi-threaded processing environment, or even in a distributed processing or server cluster implementation environment). Figure 1 As shown, the method may include:

[0086] S101: Obtain historical domain data from multiple historical domains in the historical domain set, including domain information data, traffic data, and domain text data.

[0087] Domain information data can be understood to include information related to domain registration, which can be queried using WHOIS (Domain Name System). This data may include information such as domain status, owner, registrar, registration and expiration dates, and can be queried from different WHOIS databases based on different domain suffixes. Traffic data can include Domain Name System (DNS) traffic data, obtained through statistical analysis of DNS request and resolution traffic. This includes statistics on DNS resolution request volume, request source data, resolution network data, and response data. Domain text data can include the domain name characters themselves, i.e., the string corresponding to the domain name.

[0088] S102: Extract features from the historical domain name data to obtain statistical features, temporal features, and spatial features of multiple historical domain names. The temporal features are used to characterize the dynamic features of the historical domain name data within a preset time period, and the spatial features are used to characterize the spatial association structure information of multiple historical domain names.

[0089] It is understood that statistical features can be obtained by extracting statistical features from domain information data, traffic data, and domain text data in historical domain data. Furthermore, different statistical features can be extracted from different data, such as domain information features corresponding to domain information data, traffic features corresponding to traffic data, and character features corresponding to domain text data. In other embodiments, historical domain data may also include other types of data, and the extracted statistical features may also include features corresponding to those types of data.

[0090] It is understandable that historical domain name data may include some time-series related data (hereinafter referred to as time-series data). Time-series data can correspond to different data dimensions, and thus, this time-series data can constitute a multivariate time-series dataset, serving as the basis for extracting time-series features. Time-series features can be obtained by performing feature extraction on this time-series data; these time-series features can also be multivariate time-series features. Feature extraction of time-series data can take the form of time-series embedding, and the preset time period can be set based on requirements.

[0091] It is understandable that historical domain name data may include data related to spatial association structures. By extracting this spatial association structure data from historical domain name data, key resource data can be obtained. This key resource data can correspond to multiple key resource dimensions and can constitute a key resource dataset, serving as the basis for extracting spatial features. Spatial features can then be obtained by performing feature extraction on this key resource data. Specifically, feature extraction of key resource data can be achieved by constructing a corresponding association structure graph and employing feature extraction methods such as graph embedding.

[0092] In some embodiments of this specification, feature extraction of historical domain name data may also include dimensions other than the traditional feature dimensions, temporal feature dimensions, and spatial feature dimensions mentioned above. Furthermore, feature extraction for each dimension can be achieved through mathematical models or artificial intelligence models. This specification does not impose any limitations on this.

[0093] S103: Perform feature fusion and feature selection on the statistical characteristics, temporal characteristics and spatial characteristics of multiple historical domain names to obtain the historical domain name characteristics of the historical domain name data.

[0094] In some embodiments of this specification, feature fusion of extracted statistical features, temporal features, and spatial features can involve concatenating the extracted statistical features, temporal features, and spatial features, and then performing feature selection on the concatenated feature results. This can reduce the computation and storage costs of features, reduce algorithm complexity, and reduce the impact of noisy features on algorithm performance, thus providing a data foundation for the subsequent training of high-precision models.

[0095] S104: Input the historical domain name features and the classification labels corresponding to multiple historical domain names into a pre-built artificial intelligence model for training to obtain a domain name classification model.

[0096] The artificial intelligence model can be a neural network model or a machine algorithm model, etc., and this specification does not impose any restrictions on it.

[0097] S105: Obtain the target domain name data of the target domain name, process the target domain name data and input it into the domain name classification model, and output the domain name family to which the target domain name belongs.

[0098] It is understandable that the data processing for the target domain name data can employ the same methods used for processing the training data during the model training process described above. These methods may include feature extraction, feature fusion, and feature selection. Furthermore, the methods used for feature extraction, feature fusion, and feature selection for the target domain name data can be the same as those used for the historical domain name data. For instance, the same model for feature extraction can be used to extract features from both the historical and target domain name data, and the same feature selection algorithm can be used to select features from both the historical domain name features corresponding to the historical domain name data and the target domain name features corresponding to the target domain name data.

[0099] In the embodiments described in this specification, features are extracted from historical domain name data from multiple dimensions. Based on the results of feature extraction, feature fusion and feature selection are performed. The fused and selected historical domain name features can fully characterize the dynamic behavior and relationships within the historical domain name data, enhancing the ability to depict domain family features and thus improving the feature discrimination ability and prediction accuracy of subsequent domain name classification models. Furthermore, the fine-grained historical domain name features after fusion enable the domain name classification model to perform fine-grained classification of target domain names, thereby providing a foundation for subsequent domain name protection.

[0100] refer to Figure 2 As shown, in some embodiments of this specification, feature extraction is performed on the historical domain name data to obtain statistical features, temporal features, and spatial features of multiple historical domain names, which may include:

[0101] S201: Perform a first feature extraction on the historical domain name data to obtain the character features, traffic features, and domain name information features of the historical domain name data as the statistical features.

[0102] In some embodiments of this specification, the character features may include at least one of the following: domain name length, number of subdomains, number of special characters, number of numeric characters, number of conversions between numbers and letters, and number of dictionary words;

[0103] The traffic characteristics may include at least one of the following: number of IP address changes, number of resource record changes, range of record resolution times, number of different domain names hosted by the IP address of the domain name resolution, number of different countries to which the IP address of the domain name resolution belongs, number of different regions to which the IP address of the domain name resolution belongs, number of clients requesting domain name resolution, number of times the domain name resolution is requested, and number of different domain names requested by the client requesting domain name resolution.

[0104] The domain name information features may include at least one of the following: whether date information is missing, valid registration duration, and edit distance similarity of domain name servers.

[0105] Furthermore, statistical characteristics can be expressed by the following formula:

[0106] .

[0107] Here, ∪ can represent the feature matrix concatenation operation. E char N×CC It can represent character features, E traffic N×TC It can represent flow characteristics, E Whois N×WC It can represent domain name information characteristics, E classic N×C It can represent statistical characteristics.

[0108] S202: Extract time-series data from the historical domain name data, and perform time-series embedding on the time-series data to obtain the time-series features.

[0109] It is understandable that time-series features can reflect the dynamic behavioral characteristics of different domain name families from a high-dimensional perspective. By extracting time-series features, the behavioral characteristics of different domain name families can be analyzed, allowing for a better differentiation of the domain family to which different domain names belong from a temporal dimension. When extracting time-series data, traffic data can be extracted from historical domain name data to obtain time-series data, which can then be embedded to obtain time-series features. However, time-series features differ somewhat from the aforementioned traffic features. While traffic features also belong to dynamic behavioral features, they are obtained through statistical analysis such as frequency based on statistical patterns. Time-series features, on the other hand, involve reasoning using high-dimensional models, allowing for a more comprehensive representation of the characteristics of traffic data.

[0110] S203: Based on the historical domain name data, construct a communication association structure diagram of the multiple historical domain names, and perform graph embedding on the communication association structure diagram to obtain the spatial features. The communication association structure diagram is used to characterize the resource overlap association information among the multiple historical domain names.

[0111] It is understandable that a communication association structure diagram can reflect the topological characteristics and resource reuse patterns of different domain name families. Constructing a communication association structure diagram and extracting the corresponding spatial features can characterize the location distribution and other features of different domain name families from a spatial dimension, so as to better distinguish the domain name families to which different domain names belong from a spatial dimension.

[0112] refer to Figure 3 As shown, in some embodiments of this specification, the timing features can be extracted in the following ways:

[0113] S301: Extract time-series data from the traffic data in the historical domain name data to obtain time-series data of multiple historical domain names within a preset time period. The time-series data includes change data related to client requests and domain name resolution within the preset time period.

[0114] In some embodiments of this specification, the changing data related to client requests may include at least one of the following: the total number of request packets initiated by the client, the number of clients initiating the request, the number of hours in which the domain name was requested, the total number of requests in the most active hour, the range of the total number of requests in each hour, the number of unique values ​​of the total number of requests in each hour, the percentage of the total number of requests in the most active hour as a percentage of the total number of requests in the whole day, and the total number of requests in each of multiple time periods. These multiple time periods can be divided by hours or by at least two hours. For example, if a time period is three hours long, it can be divided into time periods 0-3, 4-7, 8-11, 12-15, 16-19, and 20-23.

[0115] Changes related to domain name resolution may include at least one of the following: the total number of domain name resolution packets issued by the domain name resolution system, the number of unique IPs resolved by the domain name, the number of resource record types resolved by the domain name, the range of the total number of responses for each resolution record, and the number of unique values ​​in the total number of responses for each resolution record.

[0116] It is understandable that when extracting time-series data, we can extract change data related to client requests, i.e., client request time-series data, as well as change data related to domain name resolution, i.e., domain name resolution time-series data.

[0117] Specifically, the extraction of client request time-series data can be approached from the perspective of the domain name requested by the client, analyzing the changes in the status of the same domain requested by clients within a given time period. This specification's embodiments primarily focus on the recurring patterns of client requests, extracting two time-series data points: the total number of request packets initiated by the client and the number of clients initiating requests, to describe the daily request situation of the clients. Simultaneously, considering that malicious domains may exhibit concentrated or sudden requests from clients during daily requests, 11 types of time-series data are extracted using hours and time periods as time windows to examine fine-grained time patterns of client requests. Specifically, using each hour as a time window, five types of time-series data are extracted: the number of hours in which the domain was requested, the total number of requests in the most active hour, the range of total requests in each hour, the number of unique values ​​in the total number of requests in each hour, and the percentage of total requests in the most active hour as a percentage of the total number of requests throughout the day. In addition, time periods are used as time windows to analyze the time tendency of client requests. Specifically, the whole day is divided into 6 time periods: 0-3, 4-7, 8-11, 12-15, 16-19, and 20-23. The number of client requests in each time period is counted, that is, the total number of requests in the 0-3 period, the 4-7 period, the 8-11 period, the 12-15 period, the 16-19 period, and the 20-23 period.

[0118] Specifically, the extraction of domain name resolution time-series data starts from the perspective of the domain name response client, analyzing the status changes of the same domain name response requests within a given time period. The embodiments in this specification primarily focus on short-term patterns of domain name resolution, extracting the total number of domain name resolution packets issued by DNS daily as time-series data characterizing daily domain name activity. Furthermore, considering that malicious domains typically employ dynamically changing resource records to provide robust command and control capabilities (e.g., fast-flux strategies) in order to circumvent blacklist mechanisms, four types of time-series data are extracted: the number of unique IP addresses resolved by the domain name, the number of resource record types resolved by the domain name, the range of the total number of responses for each resolution record, and the number of unique values ​​in the total number of responses for each resolution record, to characterize the changes in domain name resolution records.

[0119] The following example uses the total number of request packets initiated by the client to illustrate the time-series data extraction process: For the DNS traffic data to be analyzed, a time interval Δt is set, and the entire time span is divided into Q time periods according to Δt. For the domain set D={d1,d2,...,d...} N}, Statistical analysis of any domain name d within the q-th Δt time interval. i Total number of requests from clients (req) i,q , obtain domain d i Request time series Ti={req i,1 ,...,req i,q ,...,reqi,Q}, the total number of request packets initiated by the clients in the domain name set D is obtained as the time series set T N×Q .

[0120] Extract the above time series data to obtain the multi - variable time series data set T of this article N×M×Q (N can represent the number of historical domain name samples, M can represent the number of types of time series data, and Q can represent the number of time steps). Further, the data T in the set N×M×Q can be standardized to obtain T’ N×M×Q , eliminating the dimensionality effect between different data types to obtain a standardized data set

[0121] S302: Input the time series data into a pre - trained time series embedding model, and output the time series features

[0122] It can be understood that the time series embedding model can achieve dimensionality reduction of time series data, that is, map the time series data into a low - dimensional space with strong representation ability, and obtain low - dimensional embedded features as time series features. The time series embedding model therein can be trained by a supervised training method

[0123] Specifically, as shown in Figure 4 , the above time series features can be multi - variable time series features, and the extraction process can include: processing the original DNS traffic data through two steps of time series data extraction and request pattern mining (corresponding to the process of using the time series embedding model for feature extraction), to obtain the multi - variable standardized time series data set T’ on the domain name set D = {d1,..., d N}, and the multi - variable time series features E N×M×Q of N×TE time_embedding (N can represent the number of historical domain name samples, and TE can represent the number of embedded vector obtained after processing by the time series network processing layer). Since TE << M×Q, it effectively realizes the low - dimensional embedded representation of time series

[0124] In some embodiments of this specification, the time series embedding model may include an input layer, a time series network processing layer, and an output layer. The time series network processing layer includes a time series mapping function, and the time series mapping function is used to map the input data into corresponding low - dimensional feature labels

[0125] It can be understood that the input layer can receive the input data input into the time series embedding model, the time series network processing layer can implement the mapping of time series data to low - dimensional time series features based on the time series mapping function, and output the mapped time series features through the output layer

[0126] Furthermore, the temporal embedding model can be trained in the following way: acquiring training sample data, which includes multiple training sample pairs, wherein the training sample pairs are constructed from temporal data and corresponding labels, and the labels are used to characterize the low-dimensional embedding features of the temporal data; and optimizing the parameters of the temporal network processing layer based on the training sample pairs in the training sample data and a first preset loss function.

[0127] For example, a temporal embedding model can be obtained using a supervised training method. Specifically, multiple training sample pairs {x(d), y(d)} can be constructed using label guidance information to obtain the training sample set D. train Based on this training sample set, the model parameters are learned, and then features are extracted from time-series data using fixed model parameters, extracting low-dimensional embedding features with strong representational capabilities. Here, d can represent the domain name set D={d1,...,d...} N Domain name samples in}, x(d)∈T' N×M×Q Let y(d) represent all standardized time-series data of class d, and y(d)∈{1,…,k}, representing the label information of sample domain names of class k. The process of using a supervised time-series embedding model includes:

[0128] (1) Input layer: Standardized time series data x(d) of input domain name sample d: matrix M×Q ;

[0129] (2) Temporal network processing layer: Select any temporal embedding network and define the mapping function f:x(d):matrix M×Q →y(d): matrix 1×k , indicating that x(d):matrix M×Q Mapping to a k-dimensional vector space yields the label y(d).

[0130] The training process of the temporal embedding model includes: setting up a multi-class optimization problem, the objective of which is to minimize the overall loss function. (x,y) can represent the training sample set D train The labeled samples in It can represent the error function of a multi-class classification task. It can represent the regularization term of the overall loss function, and optimize the temporal embedding effect of the temporal network processing layer by minimizing the multi-classification error and continuously adjusting the model parameters;

[0131] (3) Output layer: In the entire sample set D={d1,...,d N The standardized time series dataset T' N×M×Q ={x(d1),...x(d N)}, perform temporal network processing on it, and take the embedding vector E output by the temporal network processing layer in the model N ×TE time_embedding = {e(d1),...e(d N )} is output as multi-temporal features, where N can represent the number of historical domain name samples, and TE can represent the number of embedding vectors obtained after processing by the temporal network processing layer.

[0132] Reference Figure 5 As shown, in some embodiments of the present specification, the spatial features can be extracted by the following method:

[0133] S501: Based on the traffic data and domain name information data in the historical domain name data, determine multiple key resource dimensions associated with the communication structure of the multiple historical domain names.

[0134] In some embodiments of the present specification, the multiple key resource dimensions may include DNS communication resource types and whois information resource types. Further, the multiple key resource dimensions may include at least one of the following: IP, CNAME, MX, NS, client, resource record, country, region, NS server, registrar, registrar, administrator email, technical support email, Whois server, registration address. Among them, the first 8 items belong to DNS communication resource types, and the last 7 items belong to whois information resource types.

[0135] S502: Based on the key resource data corresponding to the multiple key resource dimensions, construct a multi-layer isomorphic weighted graph of the multiple key resource dimensions. Each layer of the isomorphic weighted graph in the multi-layer isomorphic weighted graph includes the weighted associations between multiple historical domain names and the weighted association relationships of historical domain names between each layer of the isomorphic weighted graph.

[0136] Specifically, referring to Figure 6 As shown, the extraction of spatial features may include: processing the original DNS traffic data and whois information data through two steps of constructing a communication association graph and mining the association structure (corresponding to the extraction process of spatial features), and obtaining the multi-layer isomorphic weighted graph G on the domain name set D = {d1,...,d N} N m (N can represent the number of domain name samples, m can represent the type of resource overlap association between domain names) of spatial features (such as association structure features) E graph_embedding N×GE (N can represent the number of historical domain name samples, GE can represent the number of embedding vectors obtained after graph embedding processing). Since GE << m×N (m×N can represent the multi-layer isomorphic weighted graph G N m(The representation dimension of each node) effectively realizes a low-dimensional embedded representation of the spatial communication association structure graph.

[0137] In some embodiments of this specification, constructing a multi-layer isomorphic weighted graph based on key resource data corresponding to multiple key resource dimensions may include: calculating the intra-layer resource similarity and inter-layer resource similarity of each historical domain name based on the traffic data; constructing the multi-layer isomorphic weighted graph by using each historical domain name as a node of each layer of the isomorphic weighted graph, using inter-layer resource similarity as a weighted association edge connecting the intra-layer nodes, and using inter-layer resource similarity as a weighted association edge connecting the inter-layer nodes.

[0138] For example, a multi-layer isomorphic weighted graph G can be used. N m ={G1,…,G m Model m types of resource overlap relationships between domain names. Graph model G l The isomorphic weighted graph of the l-th layer can be represented as G. l = <V l W l >,V l It can represent a vertex set, W l = W ll +∑ l'≠l W ll’ W can represent a weighted association edge between vertices. ll Resource similarity within the corresponding layer, W ll’ This corresponds to inter-layer resource similarity. Specifically, the weighted edge W within a layer represents the association. ll ={w ll (u,v):u,v∈V l The term describes the strength of the association between vertex u and vertex v in the l-th layer, and the weighted edge W represents the association between layers. ll’ ={w ll’ (u,v):u∈V l ,v∈V l’ The graph model G describes the strength of the association between vertex u in the l-th layer and vertex v in the l'-th layer. l =G ll +∑ l'≠l G ll’ G ll G represents an isomorphic weighted graph with only intra-layer associations. ll’ This represents an isomorphic weighted graph with only inter-layer relationships. The vertex set V... l That is, the domain name set D = {d1,...,d} N All N historical domain name samples on}

[0139] In some embodiments of this specification, the intra-layer resource similarity can be determined by the following formula:

[0140] ;

[0141] Among them, intraLayer_weight_reRe(d i ,d j ) represents the domain name d in a multi-layer isomorphic weighted graph constructed from reRe type resources. i With domain d j Intra-layer resource similarity between layers, reRe(d i ) indicates the domain name d i Extract the collection of resources of type reRe that it maps to.

[0142] Specifically, the weighted edge W within the layer. ll The weighting calculation method involves various association schemes between domain names. For example, the Jaccard coefficient association scheme can be used to measure the association between domain name sets D={d1,...,d...}. N Any domain name d on} i and d j Resource similarity. Here, reRe(·) can represent a function to extract the resource set. Resource types mainly consider various resource overlap and association types between domains, such as the key resource dimension in the previous example. In the domain set D={d1,...,d...} N After calculating m types of intra-layer weighted edges, we obtain {W}. 11 W 22 ,...,W mm} can be viewed as m elements of size N 2 The adjacency matrix is ​​used to obtain the multi-layer isomorphic weighted graph G. N m m isomorphic weighted graphs {G} with intra-layer associations 11 ,…,G mm}

[0143] In some embodiments of this specification, the inter-layer resource similarity can be determined by the following formula:

[0144] ;

[0145] Among them, intraLayer_weight_ll'(d i ,d j ) represents the domain name d in a multi-layer isomorphic weighted graph constructed from reRe type resources. i With domain d j Interlayer resource similarity.

[0146] Specifically, the weighted edge W between layers ll’The weight calculation scheme is as follows: the cross-layer association weight of the same node is 1, and the cross-layer association weight of different nodes is 0. Using intraLayer_weight_ll'(d i ,d j ) represents the domain name d on the l-th layer communication association graph. i Domain name d on the communication association graph of layer l' j The weights of the connecting edges. Similarly, in the domain set D = {d1,...,d...} N After calculating the weighted edges of inter-layer associations on}, we can obtain {∑W 11’ ,∑W 22’ ,...,∑W mm’} can be viewed as m sets of adjacency matrices, each set containing (m-1) elements of size N. 2 The adjacency matrix is ​​used to obtain the multi-layer isomorphic weighted graph G. N m m isomorphic weighted graphs {∑G} with interlayer correlations 11’ ,∑G 22’ ,...,∑G mm’}

[0147] Furthermore, by merging the weights of the two types of weighted associated edges, a multi-layered isomorphic weighted graph is obtained as shown below:

[0148] G N m ={G 11 ,…,G mm}+{∑G 11’ ,∑G 22’ ,...,∑G mm’}={G1,…,G m}

[0149] S503: Input the multi-layer isomorphic weighted graph into a pre-trained graph embedding model and output the spatial features.

[0150] It is understandable that graph embedding models can achieve dimensionality reduction of multi-layer isomorphic weighted graphs, that is, map multi-layer isomorphic weighted graphs into low-dimensional graphs with stronger representational capabilities, and obtain low-dimensional embedding features as spatial features, which can effectively capture the structural and relational attribute features of domain name nodes in multi-layer isomorphic weighted graphs. The graph embedding model can be trained using unsupervised training methods.

[0151] In some embodiments of this specification, the graph embedding model may include an input layer, a graph embedding processing layer, and an output layer. The graph embedding processing layer includes a graph embedding mapping function, which is used to map the input graph data to a low-dimensional vector space.

[0152] It is understandable that the input layer can receive input data into the graph embedding model, the graph embedding processing layer can map multi-layer isomorphic weighted graphs to low-dimensional spatial features based on the graph mapping function, and output the mapped spatial features through the output layer.

[0153] Furthermore, the graph embedding model can be trained in the following way: acquiring training sample data, the training samples including multi-layer isomorphic weighted graph data; using the graph embedding mapping function of the graph embedding processing layer to determine the reconstruction weights between nodes in the training sample data; and optimizing the parameters of the graph embedding processing layer based on the reconstruction weights, the true weights in the training sample data, and the second preset loss function.

[0154] For example, the use of unsupervised graph embedding models may include:

[0155] (1) Input layer: Input domain name set D={d1,...,d N A multi-layer isomorphic weighted graph G constructed on} N m ={G1,…,G m};

[0156] (2) Graph embedding processing layer: Select any graph embedding network and define the mapping function f:V→e(d):matrix 1×GE , indicating that G N m The set of domain name vertices V is mapped to a GE-dimensional vector space, resulting in e(d):matrix 1×GE .

[0157] The training process of the graph embedding processing layer may include: using a multi-layer isomorphic weighted graph G N m The self-structure information (neighbors, context, global structure) sets up an optimization problem, the goal of which is to minimize the overall loss function. , It can represent a similarity reconstruction function. It can represent the error function. This can represent the regularization term of the overall loss function, continuously adjusting model parameters by comparing the true weights and reconstructed weights to optimize graph embedding performance. Structural information can include the node's neighbors, context, and global structure. Neighbors can be node pairs—directly adjacent nodes and their connecting edges. Context can be multi-hop adjacent nodes, such as the number of hops during a random walk, thus obtaining a series of paths on the graph. For intermediate nodes on a path, the preceding nodes are considered the preceding context, and the following nodes are considered the following context. The global structure can be the connected subgraph of a given node, i.e., any node that the given node can reach.

[0158] (3) Output layer: The trained graph embedding processing layer is used as a feature extractor in the entire sample set D={d1,...,d N The multi-layer isomorphic weighted graph G N m ={G1,…,G m} Perform graph embedding processing on the model and retrieve the embedding vector E from the graph embedding processing layer inside the model. N×GE graph_embedding ={e(d1),...e(d N )} is used as the associated structural feature (i.e., spatial feature), where N can represent the number of historical domain name samples, and GE can represent the number of embedding vectors for each domain name obtained after graph embedding processing.

[0159] Furthermore, the aforementioned multi-dimensional features can be fused, including statistical features, temporal features, and spatial features, to obtain a feature set under multiple classification dimensions. Specifically, the domain name set D={d1,...,d...} can be concatenated using feature concatenation. N Statistical features E extracted from} classic N×C Time series characteristics E N×TE time_embedding Spatial features E N×GE graph_embedding The three types of features are concatenated sample by sample to obtain the full feature set E. N×FE feature_concat =E classic N×C ∪ E N×TE time_embedding ∪E N×GE graph_embedding ∪ represents the feature matrix concatenation operation. Furthermore, considering E N×FE feature_concat An excessively large feature set will incur additional computational and storage costs, increase algorithm complexity, and the performance degradation caused by noisy features can negatively impact algorithm performance. Therefore, any feature selection scheme can be chosen to filter the FE-dimensional features, ultimately yielding FS-dimensional multivariate fusion features with high informativeness and discriminative power. The feature set is represented as E. N×FS feature_select .

[0160] In some embodiments of this specification, the domain name classification model can be obtained by training a multi-classification model using historical domain name features. The specific training process may include: constructing a multi-classification model. The input is sample d. j eigenvector x(d) j matrix 1×FS The output is the feature vector x(d) j Under the condition of ), predict the probability values ​​P(y|x(d) for each of the k class labels.j ))=(P(y1| x(d j ),...,P(y k |x(d j This is used to classify malicious domains into malicious families. The objective function is minimized on the training sample set as follows:

[0161]

[0162] in, This can be expressed as calculating the multi-class misclassification loss for all domain name samples on the training sample set (e.g., historical domain name features): L(y i ,f θ (x(d j ))) can represent a domain name sample d j The misclassification loss is classified as category i, where y i This can represent the i-th component of the label vector y; ∑ k i=1 L(y i ,f θ (x(d j ))) can represent domain name sample d j The multi-class loss. The second term, λR(θ), can represent a positive loss term constructed with respect to the model parameters to prevent overfitting.

[0163] In some embodiments of this specification, the process of extracting features from the target domain name data and then inputting it into the domain name classification model may include: extracting features from the target domain name data to obtain target statistical features, target temporal features, and target spatial features corresponding to the target domain name data; performing feature concatenation and feature selection on the target statistical features, the target temporal features, and the target spatial features to obtain target domain name features; inputting the target domain name features into the domain name classification model to obtain the probability that the target domain name is classified into each of multiple preset domain name families; and determining the domain name family to which the target domain name belongs based on the multiple probabilities.

[0164] It is understandable that when using a trained domain name classification model to detect and classify target domain names, similar processing methods to those used for historical domain name data can be employed to process the target domain name data, including multi-feature extraction, feature fusion, and feature selection. The processed target domain name features are then input into the domain name classification model for classification, thereby improving the accuracy of domain name detection.

[0165] The domain name detection method based on multi-feature fusion proposed in the embodiments of this specification can mine the communication behavior patterns and resource overlap characteristics of domain name families from a spatiotemporal dimension, effectively making up for the shortcomings of traditional methods in representing the dynamic behavior and association relationships of domain names. It can improve the feature discrimination ability in multi-classification scenarios and provide more comprehensive feature support for domain name detection and classification. By performing feature concatenation and feature selection on traditional statistical features, multi-feature temporal features, and association structure features, it effectively removes noisy features while retaining key discrimination information, significantly improving the discriminativeness and robustness of feature representation, forming a multi-feature fusion scheme with fine-grained features and strong discriminative ability. Furthermore, the multi-layer isomorphic weighted graph in the above method can overcome the inherent limitations of traditional graph-based models in isolated node detection.

[0166] This specification also provides a method for detecting malicious domain name families based on multi-source fusion features. The following uses malicious domain name family classification as an example to introduce the method for detecting malicious domain name families based on multi-source fusion features. (Reference) Figure 7 As shown, the above method may include the following process:

[0167] (1) Statistical Feature Extraction. Typical features are extracted from all domain names involved in DNS traffic (i.e., the preceding traffic data) and WHOIS information (i.e., the preceding domain name information data), including character features, traffic features, and WHOIS features. The differences between benign and malicious domain names in character composition, communication characteristics, WHOIS information, and resource overlap are addressed. The specific steps can be divided into: character feature extraction, traffic feature extraction, WHOIS feature extraction, feature processing, and file generation.

[0168] 1) Character feature extraction. Extracted character features may include: domain name length, number of subdomains, number of special characters, number of numeric characters, number of conversions between numbers and letters, and number of dictionary terms;

[0169] 2) Traffic Feature Extraction. The extracted traffic features may include: number of IP address changes, number of resource record changes, range of record resolution times, number of different domain names hosted by the IP address used for domain name resolution, number of different countries to which the IP address used for domain name resolution belongs, number of different regions to which the IP address used for domain name resolution belongs, number of clients requesting domain name resolution, number of times the client requests domain name resolution, and number of different domain names requested by the client requesting domain name resolution.

[0170] 3) WHOIS feature extraction. The extracted WHOIS features may include: whether date information is missing, effective registration duration, and edit distance similarity of the domain name server.

[0171] (2) Multivariate temporal feature extraction. Multivariate attention long short-term memory fully convolutional network (MALSTM-FCN) algorithm is used to model multidimensional domain name request and response time series and extract multivariate temporal data embedding features.

[0172] (3) Extraction of associated structural features (i.e., spatial features of the preceding text). Based on the multi-node2vec algorithm, low-dimensional embedding is performed on the multi-layer isomorphic weighted graph to extract the structural and relational attribute features of multiple domain nodes in the domain graph.

[0173] (4) Feature fusion. Specifically, it can include feature concatenation and feature selection.

[0174] (5) Model training. Use the features obtained after feature fusion to train the multi-classification model.

[0175] The following section uses the anonymized DNS communication traffic and all WHOIS data of a real large network over 91 days as historical domain data to further illustrate the above-mentioned malicious domain family detection method based on multi-dimensional fusion features. As shown in Table 1 below, this historical domain data involves 952 malicious domains, totaling 9 malicious domain families.

[0176] Table 1

[0177]

[0178] The malicious domain name family detection method based on multi-feature fusion in the embodiments of this specification is compared with three other feature construction schemes. The comparison schemes are involved and experiments are conducted. The experimental design is shown in Table 2.

[0179] Table 2

[0180]

[0181] As can be seen from Table 2 above, the malicious domain family detection method based on multi-dimensional fusion features can provide better accuracy in classifying malicious activities belonging to malicious domains.

[0182] The experimental results of the above comparative schemes are shown in Table 3 below. Figure 8 Show the statistical characteristics (baseline comparison scheme, such as) respectively. Figure 8 (as shown in a) and the multi-element fusion features in the embodiments of this specification (such as...) Figure 8 The confusion matrix shown in b) is as follows.

[0183] Table 3

[0184]

[0185] Table 3 can be interpreted as the average detection results across multiple category labels. Figure 8 The confusion matrix in the diagram focuses on the detection results for a specific category. The darker data corresponding to the diagonal lines in the diagram represents correct classification. The vertical columns represent the true labels, and the horizontal columns represent the labels predicted by the model. The cells other than those on the diagonal represent misclassifications. Figure 8 It can be seen that the malicious domain name family detection method based on multi-factor fusion features in the embodiments of this specification is more effective and has better detection performance in each category. (See Table 3 and...) Figure 8 It can be seen that, whether it is the average detection result or the single-category classification result, the malicious domain name family detection method based on multi-dimensional fusion features in the embodiments of this specification can achieve the best classification accuracy in all evaluation indicators, and has the best ability to characterize and identify various malicious domain names.

[0186] Based on the domain name detection method described above, one or more embodiments of this specification also provide a domain name detection device. The device may include an apparatus (including a distributed system), software (application), module, plug-in, server, client, etc., using the method described in the embodiments of this specification, combined with necessary hardware implementation. Based on the same innovative concept, the devices in one or more embodiments provided in this specification are as described in the following embodiments. Since the implementation schemes and methods for solving the problem are similar, the implementation of specific devices in the embodiments of this specification can refer to the implementation of the foregoing method, and repeated details will not be elaborated further. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated. Figure 9 The diagram shown is a schematic representation of the domain name detection device provided in an embodiment of this specification. Figure 9 As shown, the domain name detection device 900 may include:

[0187] The acquisition module 901 is used to acquire historical domain data of multiple historical domains in the historical domain set, including domain information data, traffic data, and domain text data.

[0188] The extraction module 902 is used to extract features from the historical domain name data to obtain statistical features, temporal features and spatial features of multiple historical domain names. The temporal features are used to characterize the dynamic features of the historical domain name data within a preset time period, and the spatial features are used to characterize the spatial association structure information of multiple historical domain names.

[0189] The processing module 903 is used to perform feature fusion and feature selection on the statistical features, temporal features and spatial features of multiple historical domain names to obtain the historical domain name features of the historical domain name data;

[0190] The training module 904 is used to input the historical domain name features and the classification labels corresponding to multiple historical domain names into a pre-built artificial intelligence model for training, so as to obtain a domain name classification model.

[0191] The classification module 905 is used to obtain the target domain name data of the target domain name, process the target domain name data and input it into the domain name classification model, and output the domain name family to which the target domain name belongs.

[0192] In some embodiments of this specification, the extraction module 902 may specifically be used to: extract a first feature from the historical domain name data to obtain character features, traffic features, and domain name information features of the historical domain name data as the statistical features; extract time-series data from the historical domain name data and perform time-series embedding on the time-series data to obtain the time-series features; construct a communication association structure diagram of the multiple historical domain names based on the historical domain name data, and perform graph embedding on the communication association structure diagram to obtain the spatial features, wherein the communication association structure diagram is used to characterize the resource overlap association information among the multiple historical domain names.

[0193] In some embodiments of this specification, the character features include at least one of the following: domain name length, number of subdomains, number of special characters, number of numeric characters, number of conversions between numbers and letters, and number of dictionary words; the traffic features include at least one of the following: number of IP address changes, number of resource record changes, range of record resolution times, number of different domain names hosted by the IP address used for domain name resolution, number of different countries to which the IP address used for domain name resolution belongs, number of different regions to which the IP address used for domain name resolution belongs, number of clients requesting domain name resolution, number of times the domain name was requested to be resolved, and number of different domain names requested to be resolved by the client requesting domain name resolution; the domain name information features include at least one of the following: whether date information is missing, effective registration duration, and edit distance similarity of domain name servers.

[0194] In some embodiments of this specification, the time-series features are extracted in the following manner: time-series data is extracted from the traffic data in the historical domain name data to obtain time-series data of multiple historical domain names within a preset time period, wherein the time-series data includes change data related to client requests and domain name resolution within the preset time period; the time-series data is input into a pre-trained time-series embedding model to output the time-series features.

[0195] In some embodiments of this specification, the variable data related to client requests includes at least one of the following: the total number of request packets initiated by the client, the number of clients initiating the request, the number of hours in which the domain name was requested, the total number of requests in the most active hour, the range of the total number of requests in each hour, the number of unique values ​​in the total number of requests in each hour, the percentage of the total number of requests in the most active hour as a percentage of the total number of requests in the whole day, and the total number of requests in each of the multiple time periods; the variable data related to domain name resolution includes at least one of the following: the total number of domain name resolution packets issued by the domain name resolution system, the number of unique IPs resolved by the domain name, the number of resource record types resolved by the domain name, the range of the total number of responses for each resolution record, and the number of unique values ​​in the total number of responses for each resolution record.

[0196] In some embodiments of this specification, the temporal embedding model includes an input layer, a temporal network processing layer, and an output layer. The temporal network processing layer includes a temporal mapping function, which maps the input data to corresponding low-dimensional feature labels. The temporal embedding model is trained by: acquiring training sample data, which includes multiple training sample pairs, each training sample pair being constructed from temporal data and corresponding labels, the labels representing the low-dimensional embedding features of the temporal data; and optimizing the parameters of the temporal network processing layer based on the training sample pairs in the training sample data and a first preset loss function.

[0197] In some embodiments of this specification, the spatial features are extracted in the following manner: based on the traffic data and domain name information data in the historical domain name data, multiple key resource dimensions associated with the communication structure of the multiple historical domain names are determined; based on the key resource data corresponding to the multiple key resource dimensions, a multi-layer isomorphic weighted graph of multiple key resource dimensions is constructed, wherein each layer of the multi-layer isomorphic weighted graph includes multiple historical domain names and the weighted associations between multiple historical domain names, as well as the weighted associations between historical domain names in each layer of the isomorphic weighted graph; the multi-layer isomorphic weighted graph is input into a pre-trained graph embedding model to output the spatial features.

[0198] In some embodiments of this specification, the multiple key resource dimensions include at least one of the following: IP, CNAME, MX, NS, client, resource record, country, region, NS server, registrant, registrar, administrator email, technical support email, Whois server, and registration address.

[0199] In some embodiments of this specification, a multi-layer isomorphic weighted graph is constructed based on key resource data corresponding to multiple key resource dimensions, including: calculating the intra-layer resource similarity and inter-layer resource similarity of each historical domain name based on the traffic data; constructing the multi-layer isomorphic weighted graph by using each historical domain name as a node of each layer isomorphic weighted graph, using inter-layer resource similarity as a weighted association edge connecting the intra-layer nodes, and using inter-layer resource similarity as a weighted association edge connecting the inter-layer nodes.

[0200] In some embodiments of this specification, the intra-layer resource similarity is determined by the following formula:

[0201] ;

[0202] Among them, intraLayer_weight_reRe(d i ,d j ) represents the domain name d in a multi-layer isomorphic weighted graph constructed from reRe type resources. i With domain d j Intra-layer resource similarity between layers, reRe(d i ) indicates the domain name d i Extract the collection of resources of type reRe that it maps to.

[0203] In some embodiments of this specification, the inter-layer resource similarity is determined by the following formula:

[0204] ;

[0205] Among them, intraLayer_weight_ll'(d i ,d j ) represents the domain name d in a multi-layer isomorphic weighted graph constructed from reRe type resources. i With domain d j Interlayer resource similarity.

[0206] In some embodiments of this specification, the graph embedding model includes an input layer, a graph embedding processing layer, and an output layer. The graph embedding processing layer includes a graph embedding mapping function, which maps the input graph data to a low-dimensional vector space. The graph embedding model is trained by: acquiring training sample data, which includes multi-layer isomorphic weighted graph data; determining the reconstruction weights between nodes in the training sample data using the graph embedding mapping function of the graph embedding processing layer; and optimizing the parameters of the graph embedding processing layer based on the reconstruction weights, the true weights in the training sample data, and a second preset loss function.

[0207] In some embodiments of this specification, when the classification module 905 extracts features from the target domain name data and inputs it into the domain name classification model, it can specifically be used to: extract features from the target domain name data to obtain target statistical features, target temporal features, and target spatial features corresponding to the target domain name data; perform feature concatenation and feature selection on the target statistical features, the target temporal features, and the target spatial features to obtain target domain name features; input the target domain name features into the domain name classification model to obtain the probability that the target domain name is classified into each of the multiple preset domain name families; and determine the domain name family to which the target domain name belongs based on the multiple probabilities.

[0208] The descriptions and functions of the above modules can be found in the section on domain name detection methods, and will not be repeated here.

[0209] This application also provides an electronic device, such as... Figure 10 As shown, the electronic device may include a processor 1001 and a memory 1002, wherein the processor 1001 and the memory 1002 may be connected via a bus or other means. Figure 10 Taking the example of a connection between China and Israel via a bus.

[0210] Processor 1001 may be a central processing unit (CPU). Processor 1001 may also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations thereof.

[0211] The memory 1002, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the domain name detection method in the embodiments of the present invention. The processor 1001 executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions, and modules stored in the memory 1002, thereby implementing the domain name detection method in the above method embodiments.

[0212] The memory 1002 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor 1001, etc. Furthermore, the memory 1002 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory 1002 may optionally include memory remotely located relative to the processor 1001, and these remote memories may be connected to the processor 1001 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0213] The one or more modules are stored in the memory 1002, and when executed by the processor 1001, the following domain name detection method is performed:

[0214] The process involves: acquiring historical domain data from multiple historical domains in a historical domain set, including domain information data, traffic data, and domain text data; extracting features from the historical domain data to obtain statistical features, temporal features, and spatial features of the historical domains, where temporal features characterize the dynamic characteristics of the historical domain data within a preset time period, and spatial features characterize the spatial association structure information of the multiple historical domains; fusing and selecting features from the statistical features, temporal features, and spatial features of the multiple historical domains to obtain the historical domain features of the historical domain data; inputting the historical domain features and the classification labels corresponding to the multiple historical domains into a pre-built artificial intelligence model for training to obtain a domain classification model; acquiring target domain data for a target domain, processing the target domain data, and inputting it into the domain classification model to output the domain family to which the target domain belongs.

[0215] The specific details of the aforementioned electronic device can be understood by referring to the relevant descriptions and effects in the above method embodiments, and will not be repeated here.

[0216] This specification also provides a computer storage medium storing computer program instructions, which, when executed, implement the steps of the above-described domain name detection method.

[0217] This specification also provides a computer program product, which includes a computer program that, when executed, implements the steps of the method for determining the fracturing construction parameters described above.

[0218] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0219] The various embodiments in this specification are described in a progressive manner. For the same or similar parts between the various embodiments, please refer to each other. The focus of each embodiment is to describe the differences from other embodiments.

[0220] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions.

[0221] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0222] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute certain parts of the methods of various embodiments of this application.

[0223] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc.

[0224] This application can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0225] The above description is merely a preferred embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to the embodiments described herein by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of protection of this specification.

Claims

1. A domain name detection method, characterized by, The method comprises: acquiring historical domain name data of a plurality of historical domain names in a historical domain name set, wherein the historical domain name data comprises domain name information data, traffic data, and domain name text data; performing feature extraction on the historical domain name data to obtain statistical features, time sequence features, and spatial features of the plurality of historical domain names, wherein the time sequence features are used to represent dynamic features of the historical domain name data within a preset time period, and the spatial features are used to represent association structure information of the plurality of historical domain names in space; performing feature fusion and feature selection on the statistical features, the time sequence features, and the spatial features of the plurality of historical domain names to obtain historical domain name features of the historical domain name data; inputting the historical domain name features and classification labels corresponding to the plurality of historical domain names into a pre-constructed artificial intelligence model to perform training, and obtaining a domain name classification model; acquiring target domain name data of a target domain name, performing data processing on the target domain name data, and inputting the target domain name data into the domain name classification model to output a domain name family to which the target domain name belongs.

2. The domain name detection method according to claim 1, characterized in that, The feature extraction on the historical domain name data to obtain the statistical features, the time sequence features, and the spatial features of the plurality of historical domain names comprises: performing first feature extraction on the historical domain name data to obtain character features, traffic features, and domain name information features of the historical domain name data as the statistical features; extracting time sequence data in the historical domain name data, performing time sequence embedding on the time sequence data to obtain the time sequence features; based on the historical domain name data, constructing a communication association structure graph of the plurality of historical domain names, and performing graph embedding on the communication association structure graph to obtain the spatial features, wherein the communication association structure graph is used to represent resource overlap association information between the plurality of historical domain names.

3. The domain name detection method according to claim 2, characterized by, The character features comprise at least one of the following: domain name length, subdomain quantity, special character quantity, number character quantity, number of times of conversion between numbers and letters, and number of dictionary words. The traffic features comprise at least one of the following: IP address change frequency, resource record change frequency, range of record resolution frequency, number of different domain names hosted by IP addresses for domain name resolution, number of different countries to which IP addresses for domain name resolution belong, number of different regions to which IP addresses for domain name resolution belong, number of client devices requesting domain name resolution, number of times of requesting domain name resolution, and number of different domain names requested by client devices requesting domain name resolution. The domain name information features comprise at least one of the following: whether date information is missing, valid registration duration, and edit distance similarity of domain name name servers.

4. The domain name detection method according to claim 1 or 2, characterized by, The time sequence features are extracted by the following method: performing time sequence data extraction on the traffic data in the historical domain name data to obtain time sequence data of the plurality of historical domain names within a preset time period, wherein the time sequence data comprises change data related to client requests and domain name resolution within the preset time period; inputting the time sequence data into a pre-trained time sequence embedding model to output the time sequence features.

5. The domain name detection method according to claim 4, characterized by, The change data related to the client request includes at least one of the following: a total number of client-initiated request packets, a number of clients initiating requests, a number of hours in which the domain name is requested, a total number of requests in the most active hour, a range of the total number of requests in each hour, a number of unique values of the total number of requests in each hour, a proportion of the most active hour to the total number of requests in the whole day, and a total number of requests in each period in a plurality of periods; The change data related to the domain name resolution includes at least one of the following: a total number of domain name resolution packets issued by the domain name resolution system, a number of unique IPs for domain name resolution, a number of resource record types for domain name resolution, a range of the total number of response records for each resolution record, and a number of unique values of the total number of response records for each resolution record.

6. The domain name detection method according to claim 4, characterized by, The time sequence embedding model includes an input layer, a time sequence network processing layer, and an output layer, the time sequence network processing layer includes a time sequence mapping function, and the time sequence mapping function is used to map input data to corresponding low-dimensional feature labels; The time sequence embedding model is trained in the following manner: obtaining training sample data, the training sample data including a plurality of training sample pairs, the training sample pairs being constructed from time sequence data and labels corresponding to the time sequence data, the labels being used to represent low-dimensional embedding features of the time sequence data; optimizing parameters of the time sequence network processing layer based on the training sample pairs in the training sample data and a first preset loss function.

7. The domain name detection method according to claim 1 or 2, characterized by, The spatial feature is extracted in the following manner: based on the traffic data and the domain name information data in the historical domain name data, determining a plurality of key resource dimensions associated with a communication structure of the plurality of historical domain names; based on key resource data corresponding to the plurality of key resource dimensions, constructing a multi-layer isomorphic weighted graph of the plurality of key resource dimensions, each layer isomorphic weighted graph in the multi-layer isomorphic weighted graph including a plurality of historical domain names and weighted associations between the plurality of historical domain names, and weighted association relationships of historical domain names between the layers isomorphic weighted graph; inputting the multi-layer isomorphic weighted graph into a pre-trained graph embedding model to output the spatial feature.

8. The domain name detection method according to claim 7, characterized in that, The plurality of key resource dimensions include at least one of the following: IP, CNAME, MX, NS, client, resource record, country, region, NS server, registrant, registrar, manager mailbox, technical support mailbox, Whois server, and registration address.

9. The domain name detection method according to claim 7, characterized in that, Based on the key resource data corresponding to the plurality of key resource dimensions, the multi-layer isomorphic weighted graph of the plurality of key resource dimensions is constructed, including: based on the traffic data, calculating intra-layer resource similarity and inter-layer resource similarity of each historical domain name; each historical domain name is taken as a node of each layer isomorphic weighted graph, the inter-layer resource similarity is taken as a weighted association edge connecting nodes in each layer, and the inter-layer resource similarity is taken as a weighted association edge connecting nodes between layers, to construct the multi-layer isomorphic weighted graph.

10. The domain name detection method according to claim 9, wherein The intra-layer resource similarity is determined by the following formula: ； wherein intraLayer_weight_reRe(d i , d j ) represents the intra-layer resource similarity between domain d i and domain d j in the multi-layer isomorphic weighted graph constructed by reRe type resources, and reRe(d i ) represents the reRe type resource set extracted from domain d i and its mapping.

11. The domain name detection method of claim 9, wherein, The inter-layer resource similarity is determined by the following formula: ； wherein intraLayer_weight_ll'(d i , d j ) represents the inter-layer resource similarity between domain d i and domain d j in a multi-layer isomorphic weighted graph constructed by reRe type resources.

12. The domain name detection method of claim 7, wherein, The graph embedding model includes an input layer, a graph embedding processing layer, and an output layer, the graph embedding processing layer includes a graph embedding mapping function, and the graph embedding mapping function is used to map input graph data to a low-dimensional vector space; The graph embedding model is trained in the following manner: Obtaining training sample data, the training sample including multi-layer isomorphic weighted graph data; Determine the reconstruction weight between each node in the training sample data by using the graph embedding mapping function of the graph embedding processing layer; Optimize the parameters of the graph embedding processing layer based on the reconstruction weight, the real weight in the training sample data and the second preset loss function.

13. The domain name detection method of claim 1, wherein, After feature extraction on the target domain name data, input the domain name classification model, including: After feature extraction on the target domain name data, obtain the target statistical features, target time sequence features and target space features corresponding to the target domain name data; After feature splicing and feature selection on the target statistical features, the target time sequence features and the target space features, obtain the target domain name features; Input the target domain name features into the domain name classification model to obtain the probability of the target domain name classification into each domain name family in the plurality of preset domain name families; Determine the domain name family to which the target domain name belongs based on the plurality of probabilities.

14. A domain name detecting apparatus characterized by comprising: Including: An acquisition module is configured to acquire historical domain name data of a plurality of historical domain names in a historical domain name set, wherein the historical domain name data includes domain name information data, traffic data and domain name text data; An extraction module is configured to perform feature extraction on the historical domain name data to obtain statistical features, time sequence features and space features of the plurality of historical domain names, wherein The time sequence features are used to represent dynamic features of the historical domain name data in a preset time period, and the space features are used to represent correlation structure information of the plurality of historical domain names in space; A processing module is configured to perform feature fusion and feature selection on the statistical features, the time sequence features and the space features of the plurality of historical domain names to obtain historical domain name features of the historical domain name data; A training module is configured to input the historical domain name features and classification labels corresponding to the plurality of historical domain names into a pre-constructed artificial intelligence model to perform training, thereby obtaining a domain name classification model; A classification module is configured to acquire target domain name data of a target domain name, perform data processing on the target domain name data and input the processed data into the domain name classification model, and output a domain name family to which the target domain name belongs.

15. An electronic device, comprising: Including: A memory and a processor, which are in communication connection with each other, the memory stores computer instructions, and the processor implements the steps of the method in any one of claims 1 to 13 by executing the computer instructions.

16. A computer storage medium, comprising, The computer storage medium stores computer program instructions, and the computer program instructions are executed to implement the steps of the method in any one of claims 1 to 13.

17. A computer program product, characterised in that, The computer program is executed by the processor to implement the steps of the method in any one of claims 1 to 13.

Images