Domain name detection method and device

Abstract

The domain name detection method comprises the following steps: performing domain name feature classification based on multi-source domain name information fusion, and screening out candidate suspicious domain names; reasoning and warning the candidate suspicious domain names based on a large language model, and outputting Top-K high-risk malicious domain name warning information; wherein the output of the Top-K high-risk malicious domain name alarm information adopts an iterative questioning mechanism, and the iterative questioning mechanism is used for ensuring that the number of output alarms reaches a preset K value. According to the method, efficient and accurate identification of the Top-K high-risk malicious domain name in the target detection time window and interpretable classification alarm can be realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of domain name detection, and in particular to a domain name detection method and device. BACKGROUND

[0002] The domain name system (DNS) is a key component for realizing the mutual mapping between domain names and IP addresses. Nowadays, most application programs and Internet services are inseparable from the domain name system, and the DNS has become an important infrastructure of the Internet. At the same time, malicious domain names have become a key component of various network attacks. By abusing malicious domain names, the server location can be effectively confused, and it can also be used as a covert channel for command and control. Therefore, malicious domain names are widely used in network attacks such as phishing, botnets, spam, etc. For example, in a botnet, an infected host (Bot) randomly generates multiple malicious domain names through a domain name generation algorithm (DGA), and queries these domain names to a DNS server. If the domain name can be successfully resolved, the IP address obtained by the resolution can be used to communicate with the C&C server, so as to receive commands and execute them. Since the domain names generated by the DGA have the characteristics of randomness and rapid change, it is not easy to be blocked by simple methods such as blacklists, which greatly improves the survival ability of the botnet. For network attacks that use malicious domain names, if a domain name can be identified as a malicious domain name in time, the DNS server or network administrator can block malicious communication in time by refusing DNS resolution services or other effective means, and curb network attack behavior, thereby reducing the security threat of the network. Not only can it reduce the potential loss of users, but also has important significance for maintaining national security and safeguarding the sovereignty of cyberspace. Therefore, how to detect malicious domain names has become a technical problem to be solved. SUMMARY

[0003] In order to solve the problems existing in the prior art, the embodiments of the present application provide a domain name detection method, device, computing device, computer storage medium and product containing computer program, which can realize efficient and accurate identification of Top-K high-risk malicious domain names in a target detection time window and classification alarm with explainability.

[0004] In a first aspect, the embodiments of the present application provide a domain name detection method, comprising: performing domain name feature classification based on multi-source domain name information fusion to screen out candidate suspicious domain names; performing reasoning alarm on the candidate suspicious domain names based on a large language model to output Top-K high-risk malicious domain name alarm information; wherein the output Top-K high-risk malicious domain name alarm information adopts an iterative questioning mechanism, and the iterative questioning mechanism is used to ensure that the number of output alarms reaches a preset K value.

[0005] In some possible implementation manners, the domain name feature classification based on the multi-source domain name information fusion and the screening of the candidate suspicious domain names include: extracting a construction feature, a registration feature and a resolution feature of a domain name according to resolution logs and registration information of the domain name, to construct a domain name feature vector; inputting the domain name feature vector into a pre-trained lightweight neural network classification model, outputting a malicious domain name recognition result by the classification model, and determining a candidate suspicious domain name list based on the recognition result.

[0006] In some possible implementation manners, the domain name feature vector includes at least one of the following features: a domain name character length, a number of vowel characters in the domain name, a number of consonant characters in the domain name, a number of numerical characters in the domain name, a number of non-numerical letter characters in the domain name, an entropy value of a domain name string, whether a top-level domain belongs to a suspicious domain, a domain name survival time, a number of NS servers, a similarity of NS servers, and a number of countries to which IP addresses resolved by the domain name belong.

[0007] In some possible implementation manners, the lightweight neural network classification model is a binary classification model based on a multi-layer perception mechanism.

[0008] In some possible implementation manners, the reasoning and warning of the candidate suspicious domain names based on the large language model and the output of Top-K high-risk malicious domain name warning information include: constructing a malicious domain name recognition prompt word containing a task instruction, an output format requirement and a rule constraint; concatenating the prompt word and a list of domain names to be detected in the current round, inputting into a large language model, and obtaining a reasoning answer output by the large language model; parsing the reasoning answer, formatting and updating the generated warning list, and determining whether the number of warned domain names reaches K; if the K value is not reached, filtering out the warned domain names from the list of domain names to be detected, generating a new list of domain names to be detected, and repeating the reasoning answer step and the parsing and determination step; if the K value is reached or exceeded, outputting the first K domain names with the highest risk level from the generated warning list as the final Top-K high-risk malicious domain name warning information.

[0009] In some possible implementation manners, the malicious domain name recognition prompt word at least includes the following constraints: requiring the large language model to only select the output from the provided domain name list, and prohibiting the addition or construction of unprovided domain names; requiring the output to be in a structured format, and at least including three fields of domain name, threat type and risk level; and requiring the output domain names to be arranged in descending order of risk severity.

[0010] In some possible implementation manners, the large language model is a parameter scale model suitable for a local hardware environment and suitable for local deployment.

[0011] In some possible implementation manners, the method is applied to DNS log data collected in a fixed time length time window, and the K value is a positive integer preset according to operation and maintenance judgment workload.

[0012] In a second aspect, an embodiment of the present application provides a domain name detection device, comprising: a screening module configured to perform domain name feature classification based on multi-source domain name information fusion to screen out candidate suspicious domain names; and an output module configured to perform reasoning and warning on the candidate suspicious domain names based on a large language model and output Top-K high-risk malicious domain name warning information; wherein the output Top-K high-risk malicious domain name warning information adopts an iterative questioning mechanism, and the iterative questioning mechanism is configured to ensure that the number of output warning reaches a preset K value.

[0013] In a third aspect, an embodiment of the present application provides a computer readable storage medium comprising computer readable instructions, which, when read and executed by a computer, cause the computer to perform the method of any one of the first aspect.

[0014] In a fourth aspect, an embodiment of the present application provides a computing device comprising a processor and a memory, wherein the memory stores computer program instructions, and the computer program instructions are executed by the processor to perform the method of any one of the first aspect.

[0015] In a fifth aspect, an embodiment of the present application provides a product comprising a computer program, which, when executed on a processor, causes the processor to perform the method of any one of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0017] Figure 1 is a malicious domain name detection and disposal process schematic diagram provided by an embodiment of the present application;

[0018] Figure 2 is a malicious domain name detection technical solution process schematic diagram based on manually designed character features provided by an embodiment of the present application;

[0019] Figure 3 is a malicious domain name detection technical process schematic diagram based on deep learning text pattern extraction provided by an embodiment of the present application;

[0020] Figure 4A flowchart of a malicious domain name detection technology process based on fine-tuning of a large language model is provided in the embodiments of the present application.

[0021] Figure 5 A flowchart of a domain name detection process is provided in the embodiments of the present application.

[0022] Figure 6 A flowchart of a domain name detection method is provided in the embodiments of the present application.

[0023] Figure 7 A structural diagram of a domain name detection device is provided in the embodiments of the present application.

[0024] Figure 8 A structural diagram of a computing device is provided in the embodiments of the present application. DETAILED DESCRIPTION

[0025] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0026] The term "and / or" in the present document is used to describe the association relationship of associated objects, which means that there can be three relationships, for example, A and / or B can mean that there are three cases of A alone, A and B together, and B alone. The symbol " / " in the present document represents an or relationship of associated objects, for example, A / B represents A or B.

[0027] The terms "first" and "second" and the like in the specification and claims of the present document are used to distinguish different objects, and are not used to describe a specific order of the objects. For example, the first response message and the second response message are used to distinguish different response messages, and are not used to describe a specific order of the response messages.

[0028] In the embodiments of the present application, the words "exemplary" or "for example" are used to mean serving as an example, instance, or illustration. Any embodiment or design solution described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or having more advantages than other embodiments or design solutions. Rather, the use of "exemplary" or "for example" is intended to present the relevant concept in a specific manner.

[0029] In the description of the embodiments of the present application, unless otherwise specified, "a plurality of" means two or more, for example, a plurality of processing units means two or more processing units, and the like; a plurality of elements means two or more elements, and the like.

[0030] For the convenience of understanding the embodiments of the present application, further explanation and description will be made in specific embodiments in conjunction with the accompanying drawings, and the embodiments do not constitute a limitation on the embodiments of the present application.

[0031] The current main research work on malicious domain name detection at home and abroad aims at threat intelligence expansion, and focuses on using intelligent means to mine potential unknown malicious domain names to cope with the counter-upgrade of malicious domain name generation technology. However, in the actual production network security protection scene, domain name supervision and network operation management need to pay more attention to the accuracy of Top-K alarm in a certain time window, so as to timely and accurately distinguish and dispose the malicious domain name. Exemplarily, Figure 1 A malicious domain name detection and disposal process schematic diagram is shown. As Figure 1 shown, malicious domain name detection needs to extract domain names and related DNS resolution information based on DNS log data collected by network DPI equipment in a certain length of time window (such as 1 hour) online, identify Top-K high-risk malicious domain names in the time window through a malicious domain name detection algorithm, and output domain name alarm. The domain name alarm information will be finally analyzed and judged by the supervision and operation personnel, and corresponding malicious domain name disposal measures will be taken. However, in this scenario, the malicious domain name detection method still faces challenges in reducing false positives in real scenarios, real-time response to alarms, and providing operation explainability, etc.: (1) Many false positives in real scenarios: there are a large number of normal domain names composed of pinyin and generated by random algorithms in real scenarios, and traditional detection methods are prone to mistakenly identify them as malicious domain names by relying on domain name text features; (2) Real-time response defects: with the counter-upgrade of malicious domain name generation technology, the survival period of malicious domain names is shortened to hours, and existing detection methods based on deep learning rely on batch training and are difficult to achieve timely response; (3) Lack of operation explainability: the output result of the traditional detection method is a single malicious domain name classification prediction result, the alarm information is single and lacks explainability, and the operation personnel need to make complex manual judgment after receiving the alarm, which increases the operation burden and is difficult to be applied in practice.

[0032] Malicious domain names generated by DGA often have similar character distribution or other text patterns. The malicious domain name detection technology based on manually designed character features distinguishes DGA-generated malicious domain names and normal domain names by extracting character features of domain names. Exemplarily, Figure 2 A malicious domain name detection technology solution flow schematic diagram based on manually designed character features is shown. As Figure 2As shown, the structural features, statistical features, and linguistic features of the domain name are extracted, and the corresponding features are directly connected to form a domain name feature vector. The domain name is classified by two supervised learning methods, random forest and support vector machine. The structural features include domain name length, whether it contains a valid TLD, whether it has a single character subdomain, the proportion of subdomains composed of only numbers, and the number of subdomains. Linguistic features include the number of different characters, the proportion of repeated syllables, and the proportion of consecutive numbers. Statistical features include N-gram normalization score and entropy value. However, as attackers continuously evolve their techniques for constructing malicious domain names, such as combining DGA-generated domain names with legitimate words or creating domain names highly similar to well-known and popular domain names, relying on traditional manually designed character features is difficult to adapt to the counter-upgrade of DGA technology, and there are considerable challenges in recognition accuracy.

[0033] In addition, domain name detection can also be based on deep learning. To extract deeper and more abstract features of domain names, the deep learning-based text pattern extraction malicious domain name detection technology performs implicit feature extraction through a neural network model. For example, Figure 3 The deep learning-based text pattern extraction malicious domain name detection technology process is shown in the schematic diagram. As Figure 3 As shown, the multi-head attention mechanism is used to deeply mine complex and hidden character patterns and dependencies of domain names. The method flow is as follows: first, check whether the domain name string meets the RFC specification, if not, directly determine it as a malicious domain name, otherwise use the attention neural network model for deep recognition. In the attention neural network model, first encode the domain name string to get the word embedding vector, and use the multi-head Shift-Attention attention layer to calculate the attention of each head of the encoded word embedding vector. Then connect each head's Shift Attention attention value through linear projection. Finally, perform neural network regularization and output the recognition result. However, existing deep learning-based text pattern extraction malicious domain name detection technology still relies on the text structure features of the domain name itself. In recent years, attackers have continuously evolved their attack methods using Domain-flux and other evasion techniques to hide network attack behavior, and traditional detection methods based only on domain name features are difficult to adapt to the rapid changes of malicious domain names.

[0034] Due to the excellent performance of large language models (LLM) in natural language processing, existing technologies have begun to explore the use of fine-tuning pre-trained large language models for malicious domain name detection. For example, Figure 4 The malicious domain name detection technology process based on fine-tuning of large language models is shown in the schematic diagram. As Figure 4As shown, first, based on large-scale domain name training data, the parameter efficient fine-tuning (PEFT) technology such as low-rank adaptation (LoRA) and quantized LoRA (QLoRA) is used to perform fine-tuning training of pre-trained large language models (such as BERT, LLaMA, etc.) for the classification task of malicious domain names; then the fine-tuned model is used to identify whether the domain name to be detected belongs to a malicious domain name. Although the existing malicious domain name detection technology based on fine-tuned large language models can effectively improve the detection accuracy compared with traditional neural network methods, and performs better in complex network attack environment (such as unknown DGA detection). However, the fine-tuning of the pre-trained large language model relies on large-scale domain name training data, and the training overhead is large, and the identification result is still a single malicious domain name classification prediction result, which lacks explainability.

[0035] Therefore, the embodiments of the present application provide a domain name detection method, aiming to design a malicious domain name recognition and alarm technical solution for actual production network security protection scenarios. On the one hand, multi-source domain name information is fused, domain name construction features, domain name registration features and domain name resolution features are extracted, and a lightweight neural network classification model is used to learn the above domain name feature patterns, solving the problem that the detection method relying only on domain name character features and text patterns is difficult to adapt to the low recognition accuracy caused by the anti-upgrade of DGA technology and the rapid change of malicious domain names. On the other hand, based on the output result of the above domain name feature classification model, the reasoning ability of the large language model is fully utilized to construct a malicious domain name recognition prompt word, and the accurate recognition and classification alarm of Top-K high-risk malicious domain names are realized in cooperation, solving the problem of large training overhead and lack of explainability of the detection method based on fine-tuned large language models.

[0036] Exemplary, Figure 5 A flowchart of a domain name detection method provided by the embodiments of the present application is shown. As shown in FIG. 1, the method comprises the following steps. Figure 5As shown, the process includes two stages. In stage 1, domain name feature classification of multi-source domain name information fusion is performed. In stage 2, malicious domain name reasoning alarm driven by a large language model is performed. In the first stage, domain name feature classification of multi-source domain name information fusion is performed, aiming to perform rapid and accurate preliminary screening of malicious domain names, efficiently reduce the number of candidate suspicious domain names entering the second stage of reasoning alarm, and improve the overall time efficiency and recognition accuracy of malicious domain name detection alarm. First, domain name features are extracted by fusing domain name registration and domain name resolution information. Then, a malicious domain name classification model based on a lightweight neural network is constructed to realize rapid preliminary screening of candidate suspicious domain names. In the second stage, for the candidate suspicious domain names screened in the first stage, a large language model driven malicious domain name reasoning alarm is performed, aiming to accurately identify Top-K high-risk malicious domain names in the candidate suspicious domain names by using the intelligent reasoning capability of the large language model and output alarm information with explainability. First, a malicious domain name identification prompt word is constructed. Then, the prompt word and the candidate suspicious domain name list are spliced and input into the large language model for reasoning and answering. Finally, the answer content is parsed, and the final Top-K high-risk malicious domain name alarm information is output for judgment and disposal by the supervision and operation personnel.

[0037] Next, the process of the domain name detection method will be described in detail. Exemplarily, Figure 6 A flowchart of a domain name detection method provided by an embodiment of the application is shown. The method faces the actual production network security protection scene and proposes a large language model reasoning driven malicious domain name detection and alarm method. Unlike traditional detection methods targeting intelligence expansion, the method aims to ensure the accuracy of Top-K alarms within a certain detection time window (such as 1 hour) to meet the actual supervision and operation alarm needs. For example, Figure 6 As shown, the domain name detection method can include the following steps:

[0038] S61: According to the resolution log and registration information of the domain name, the construction feature, registration feature and resolution feature of the domain name are extracted to construct a domain name feature vector.

[0039] In this embodiment, feature vectors for representing domain name behavior are extracted and constructed from multi-source data. This process aims to convert abstract domain name strings and their associated information into a set of quantifiable, machine-readable numerical features, providing information-rich input data for subsequent classification models.

[0040] First, the system obtains domain name resolution log data collected from network packet detection devices and accesses public data services on the Internet as the data basis for feature extraction. Feature extraction is mainly performed in three dimensions, including domain name construction features, domain name registration features, and domain name resolution features.

[0041] The extraction object of the domain name construction feature is the domain name string itself. This dimension is further divided into text features and top-level domain features. The calculation of text features includes but is not limited to: counting the total length of the domain name string, the number of vowel letters, the number of consonant letters, the number of numerical characters, and the number of non-alphanumeric characters such as hyphen. In addition, the entropy value of the domain name string needs to be calculated to quantify the randomness degree. The extraction of top-level domain features is to query the externally disclosed threat intelligence dataset to determine whether the top-level domain to which the domain name belongs is marked as a suspicious top-level domain related to malicious activities.

[0042] The acquisition of domain name registration features needs to be realized by querying Whois service. The system parses the creation time of the domain name from the Whois record and calculates its survival time, i.e. the length of time from the creation time to the current time. At the same time, the number of authoritative name servers specified in the domain name registration information is counted, and the similarity of the names of these name servers and the names of the known benign domain name servers is calculated.

[0043] Domain name resolution features are derived from domain name resolution logs. The system obtains one or more IP addresses resolved by the domain name within a specified time window, and queries the country or region code to which these IP addresses belong using IP geolocation service, and finally counts the number of different countries where these IP addresses are distributed.

[0044] After the extraction and calculation of the above features are completed, the system splices and normalizes all the feature values in the pre-defined order to finally form a fixed-dimensional numerical vector, i.e. the domain name feature vector. This feature vector can represent the properties of the domain name in terms of text construction, registration background and network resolution behavior.

[0045] S62: inputting the domain name feature vector into a pre-trained lightweight neural network classification model, outputting a malicious domain name recognition result by the classification model, and determining the candidate suspicious domain name list based on the recognition result.

[0046] In this embodiment, the domain name feature vector generated in the foregoing steps is processed by using a pre-trained lightweight neural network classification model to realize the rapid preliminary identification of malicious domain names and generate a candidate suspicious domain name list for subsequent in-depth analysis.

[0047] Specifically, the lightweight neural network classification model preferably adopts a multi-layer perceptron architecture. The model structure includes an input layer, at least one hidden layer, and an output layer. The number of neurons in the input layer matches the dimension of the domain name feature vector and is used to receive the feature vector. The hidden layer performs non-linear transformation on the input features through full connection to learn the complex patterns between the features. The output layer usually consists of one neuron and uses a Sigmoid activation function, and its output value is a continuous probability score between 0 and 1, representing the confidence of the input domain name being malicious.

[0048] Before the model is put into actual use, an offline training phase is required. This training process uses historically accumulated and labeled domain name intelligence data as the training set, which clearly indicates the benign or malicious properties of each domain name. During training, binary cross-entropy is used as the loss function, and the model parameters are optimized through the backpropagation algorithm, with the goal of minimizing the difference between the predicted probability of malicious domain names and the true labels. After sufficient training, the model can capture the mapping relationship from domain name features to their malicious properties.

[0049] In the domain name detection phase, the feature vectors corresponding to all domain names to be detected within a specific time window are input one by one into the trained classification model. The model performs forward propagation calculation on each vector and outputs a corresponding malicious probability value. Then, the system sets a probability threshold, and judges the domain names with output probabilities higher than the threshold as preliminary suspicious domain names. All domain names judged as preliminary suspicious domain names are collected to form a candidate suspicious domain name list.

[0050] S63: Based on the large language model, the candidate suspicious domain names are inferred and alarmed, and Top-K high-risk malicious domain name alarm information is output.

[0051] In this embodiment, the inference ability of the large language model is used to deeply analyze and generate alarm for the candidate suspicious domain name list, and finally output a specified number of high-risk malicious domain names and their analysis information. This process aims to achieve the unity of high-precision identification and result interpretability.

[0052] Specifically, this step starts with the reception of the candidate suspicious domain name list. Then, a prompt word specifically for the malicious domain name identification task is constructed. The prompt word clearly requires the large language model to play the role of a network security analysis expert and rank the provided domain name list based on the pre-set network security evaluation standard. The output rules are strictly limited in the prompt word, including: requiring the model to only select domain names from the given list, prohibiting the addition or construction of any unprovided domain names; the output result must be in a structured format, containing at least three key fields: domain name, determined threat type, and evaluated risk level; all output entries need to be sorted in descending order of risk severity.

[0053] Table 1 is an example of a prompt word provided by an embodiment of the present application.

[0054] Table 1 As a professional domain security analysis expert, I will analyze the provided list of domain names based on network security evaluation standards and rank them according to their malicious risk. The output will be a structured CSV file containing the following three columns: domain name, type of threat, and risk level. The output will be sorted in descending order of risk severity. The output format will follow the standard CSV format, with English commas separating the fields. The same domain names provided in the input list will be used without modification, construction, or guessing of any additional domain names. ​

[0055] Next, the constructed prompt word is spliced with the list of candidate suspicious domain names to form complete input information, and submitted to a locally deployed large language model for reasoning. Based on its built-in extensive knowledge and understanding of natural language instructions, the model performs risk assessment on the domain names in the list and generates a preliminary answer that meets the format requirements. The large language model is a parameter scale model suitable for local deployment and local hardware environment.

[0056] The system then parses the original output of the large language model, extracts the domain name, threat type and risk level information, and formats it into a standard structured alarm item. After that, it can be merged and de-duplicated with existing alarm information.

[0057] In some possible embodiments, to ensure the stability of the number of final output alarms, i.e., to ensure that the top K domain names with the highest risk are always output, the embodiment also provides an iterative questioning mechanism.

[0058] In this embodiment, the system continuously counts the number of generated alarms. If the number is less than the preset K value, the system removes the alarmed domain names from the initial list of domain names to be detected, generates a new, reduced list of domain names, and repeats the process of prompt word splicing, model reasoning and result analysis. This iterative cycle continues until the cumulative number of alarms reaches or exceeds the K value.

[0059] When the iteration process is complete, the system sorts all generated alarm items according to their risk levels, and selects the top K items as the final output results of this phase, i.e., Top-K high-risk malicious domain name alarm information. This result not only contains specific malicious domain names, but also includes their threat types and risk levels, providing high-value explainability for subsequent disposal decisions by regulatory and maintenance personnel.

[0060] In some possible embodiments, the K value can be 20. In the case where the number of existing alarms is less than 20, the system filters out the existing alarm domain names from the list of domain names to be detected, and repeats the process of parsing the output of the large language model. In the case where the number of existing alarms is greater than 20, the system outputs the final alarm information.

[0061] The above is an introduction to the domain name detection method provided in the embodiments of this application. In view of the challenges faced by malicious domain name detection in practical application scenarios, such as many false alarms, difficulty in timely response and poor interpretability, a malicious domain name detection and alarm method driven by large language model inference is proposed. Through the collaborative detection of two stages, namely multi-source domain name information fusion domain name feature classification and large language model driven malicious domain name inference alarm, it can achieve efficient and accurate identification of Top-K high-risk malicious domain names within the target detection time window and classification alarm with interpretability.

[0062] Specifically, in the first stage, this invention integrates extracted domain name construction features, domain name registration features, and domain name resolution features to reduce false positives caused by relying solely on domain name text features. It then constructs a malicious domain name classification model based on a lightweight neural network for efficient identification of malicious domain names, achieving rapid initial screening of candidate suspicious domain names and reducing the number of candidate suspicious domain names entering the second stage of inference and alerting, thereby improving the overall time efficiency and identification accuracy of malicious domain name detection and alerting. In the second stage, this invention designs malicious domain name identification prompts tailored to practical application scenarios, guiding the large language model to understand the task objective and infer and output Top-K high-risk malicious domain name alert information. This achieves accurate malicious domain name alerts while providing interpretable alert information for regulatory operations.

[0063] Experimental evaluation results based on domain name resolution log data collected from real networks show that, under domain name data in four different 1-hour time windows, the Top-20 malicious domain name identification accuracy of the technical solution of this invention is as high as 98.8% on average, and the average alarm time is at the minute level. It can meet the performance requirements of malicious domain name detection and alarm in actual application scenarios. Its output of malicious domain name alarm information including domain name category and risk level can effectively improve the interpretability of operation and maintenance.

[0064] This application uses a malicious domain name as an example to introduce the method, but the malicious domain name can also be replaced by other technical scenarios that need to be detected, such as malicious URL detection scenarios.

[0065] It is understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. Furthermore, in some possible implementations, each step in the above embodiments may be selectively executed according to actual circumstances; it may be partially or fully executed, without limitation here. All or part of any feature of any embodiment of this application can be freely and arbitrarily combined without contradiction. The combined technical solutions are also within the scope of this application.

[0066] Based on the methods in the above embodiments, this application also provides a domain name detection device. For example,​ A structural schematic diagram of a domain name detection apparatus provided by an embodiment of the present application is shown. As shown in the figure, ​ The domain name detection apparatus 700 comprises a screening module 701 and an output module 702.

[0067] The screening module 701 is configured to perform domain name feature classification based on multi-source domain name information fusion, and screen out candidate suspicious domain names.

[0068] The output module 702 is configured to perform reasoning and warning on the candidate suspicious domain names based on a large language model, and output Top-K high-risk malicious domain name warning information. The output Top-K high-risk malicious domain name warning information adopts an iterative questioning mechanism, which is configured to ensure that the number of output warning reaches a preset K value.

[0069] It should be understood that the above apparatus is used to execute the method in the above embodiments, and the corresponding program modules in the apparatus have similar implementation principles and technical effects to those described in the above method. The working process of the apparatus can refer to the corresponding process in the above method, and will not be described here.

[0070] The present application also provides a computing device 800, which can be an FPGA arranged on the edge device described above. As shown in the figure, ​ The computing device 800 comprises a bus 802, a processor 804, a memory 806 and a communication interface 808. The processor 804, the memory 806 and the communication interface 808 communicate through the bus 802. The computing device 800 can be a server or a terminal device. It should be understood that the present application does not limit the number of processors and memories in the computing device 800.

[0071] The bus 802 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the sake of representation, ​ only one line is used in the figure, but it does not mean that there is only one bus or one type of bus. The bus 804 can include a channel for transmitting information between various components (for example, the memory 806, the processor 804, the communication interface 808) of the computing device 800.

[0072] The processor 804 can include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP), among other processors.

[0073] The memory 806 can include volatile memory, such as random access memory (RAM), among other types of dynamic storage. The processor 804 can also include non-volatile memory, such as read-only memory (ROM), flash memory, a hard disk drive (HDD), or a solid-state drive (SSD), among other types of non-volatile memory.

[0074] The memory 806 stores executable program code that the processor 804 executes to respectively implement the functions of the aforementioned screening module 701 and output module 702, thereby implementing all or part of the steps of the methods of the aforementioned embodiments. That is, the memory 806 stores instructions for executing all or part of the steps of the methods of the aforementioned embodiments.

[0075] Alternatively, the memory 806 stores executable program code that the processor 804 executes to respectively implement the functions of the aforementioned domain name detection apparatus 700, thereby implementing all or part of the steps of the methods of the aforementioned embodiments. That is, the memory 806 stores instructions for executing all or part of the steps of the methods of the aforementioned embodiments.

[0076] The communication interface 808 uses a transceiver module such as, but not limited to, a network interface card, a transceiver, among other transceiver modules, to enable communication between the computing device 800 and other devices or communication networks.

[0077] Based on the methods in the aforementioned embodiments, the embodiments of the present application provide a computer-readable storage medium, which stores a computer program. When the computer program is run on a processor, the processor executes the methods in the embodiments.

[0078] Based on the methods in the aforementioned embodiments, the embodiments of the present application provide a computer program product, which, when run on a processor, causes the processor to execute the methods in the embodiments.

[0079] It is to be understood that the processor in the embodiments of the present application can be a central processing unit (CPU), and can also be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor can be a microprocessor or any conventional processor.

[0080] The method steps in the embodiments of the present application can be implemented by means of hardware, or by means of a processor executing software instructions. The software instructions can be composed of corresponding software modules, and the software modules can be stored in a random access memory (RAM), a flash memory, a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically EPROM (EEPROM), a register, a hard disk, a mobile hard disk, a CD-ROM or any other form of storage medium well known in the art. An exemplary storage medium is coupled to the processor, so that the processor can read information from, and write information to, the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an ASIC.

[0081] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in or transmitted by a computer readable storage medium. The computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through a wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer readable storage medium can be any available medium accessible by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)) and the like.

[0082] It can be understood that various numerical numbers involved in the embodiments of the present application are only distinguished for convenience of description, and are not used to limit the scope of the embodiments of the present application.

Claims

1. A domain name detection method, characterized in that, The method includes: Domain name feature classification is performed based on the fusion of multi-source domain name information to filter out candidate suspicious domain names; Based on a large language model, inference alerts are generated for the candidate suspicious domains, and Top-K high-risk malicious domain alert information is output. The output of Top-K high-risk malicious domain alert information adopts an iterative questioning mechanism to ensure that the number of alerts output reaches a preset value of K.

2. The method according to claim 1, characterized in that, The domain name feature classification based on multi-source domain name information fusion, which filters out candidate suspicious domain names, includes: Based on the domain name resolution logs and registration information, extract the domain name's construction features, registration features, and resolution features to construct a domain name feature vector; The domain name feature vector is input into a pre-trained lightweight neural network classification model, which outputs a malicious domain name identification result and determines the candidate suspicious domain name list based on the identification result.

3. The method according to claim 2, characterized in that, The domain name feature vector includes at least one of the following features: Domain name character length, number of vowel characters in the domain name, number of consonant characters in the domain name, number of numeric characters in the domain name, number of non-numeric alphanumeric characters in the domain name, entropy value of the domain name string, whether the top-level domain is suspicious, domain lifespan, number of NS servers, NS server similarity, and number of countries to which the domain name's IP address belongs.

4. The method according to claim 2, characterized in that, The lightweight neural network classification model is a binary classification model based on a multilayer perceptron.

5. The method according to claim 1, characterized in that, The method of reasoning and alerting based on the large language model for the candidate suspicious domains, and outputting Top-K high-risk malicious domain alert information, includes: Construct malicious domain name identification prompts that include task instructions, output format requirements, and rule constraints; The prompt words are concatenated with the list of domain names to be detected in the current round, and then input into the large language model to obtain the reasoning answer output by the large language model; Parse the inference response, format and update the generated alert list, and determine whether the number of alerted domains has reached the K value; if it has not reached the K value, filter out the alerted domains from the list of domains to be detected, generate a new list of domains to be detected, and repeat the inference response step and the parsing and judgment step; if it has reached or exceeded the K value, output the top K domains with the highest risk level from the generated alert list as the final Top-K high-risk malicious domain alert information.

6. The method according to claim 5, characterized in that, The malicious domain identification prompts must include at least the following constraints: The large language model must select outputs only from the provided list of domain names, and adding or constructing domain names not provided is prohibited. The output should be in a structured format and contain at least three fields: domain name, threat type, and risk level. The output domain names should be sorted in descending order of risk severity.

7. The method according to claim 1, characterized in that, The large language model is a parameter-scale model suitable for local deployment and local hardware environment.

8. The method according to claim 1, characterized in that, The method is applied to DNS log data collected over a fixed time window, where the K value is a positive integer preset based on the workload assessment of operations and maintenance.

9. A domain name detection device, characterized in that, The device includes: The filtering module is used to classify domain names based on the fusion of multi-source domain name information and filter out candidate suspicious domain names; The output module is used to perform inference alerts on the candidate suspicious domain names based on the large language model and output Top-K high-risk malicious domain name alert information; wherein, the output of Top-K high-risk malicious domain name alert information adopts an iterative questioning mechanism, which is used to ensure that the number of alerts output reaches a preset value of K.

10. A computer-readable storage medium comprising computer-readable instructions that, when read and executed by a computer, cause the computer to perform the method as described in any one of claims 1-8.

Images