Malicious domain name detection system fusing multi-modal embedding and dynamic weight mamba
By integrating the Mamba system with multimodal embedding and dynamic weights, a four-dimensional feature vector space is constructed and nonlinear transformations are performed, which solves the problems of computational overhead and processing latency in malicious domain name detection, and achieves efficient and real-time malicious domain name detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- 湖南省通信网络保障中心
- Filing Date
- 2026-04-22
- Publication Date
- 2026-06-16
AI Technical Summary
In the detection of malicious domain names in large-scale network environments, existing technologies struggle to balance processing efficiency and feature representation capabilities. Computational overhead increases quadratically with the input length, leading to processing delays and limited computing resources, making it difficult to achieve real-time monitoring and high accuracy.
The Mamba system, which integrates multimodal embedding and dynamic weights, is adopted. A four-dimensional feature vector space is constructed through a multi-channel parallel Mamba computing module and a load-adaptive feature filtering unit. Nonlinear transformation is performed using state space equations to dynamically sparsify the feature matrix, eliminate adversarial interference, and achieve linear computational overhead and real-time detection by combining protocol scenario awareness and load monitoring.
It achieves real-time auditing capabilities under high concurrency loads, improves the robustness and accuracy of detection, reduces processing latency, ensures efficient utilization of computing resources, and can effectively identify variant malicious domain names.
Smart Images
Figure CN122226480A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of network security technology, and in particular relates to a malicious domain name detection system that integrates multimodal embedding and dynamic weighted Mamba. Background Technology
[0002] Current domain name generation algorithms, used by malware to evade communication monitoring, continue to evolve in the face of network security protocol challenges, requiring monitoring systems to identify large-scale pseudo-random DNS requests. This field commonly employs deep learning paths based on time-series-aware architectures, converting domain name text into high-dimensional vector space features, extracting correlations between character sequences, and establishing automated identification models for abnormal requests. With the growth of network communication bandwidth and the increase in DNS traffic density, monitoring nodes face real-time auditing pressure from massive amounts of domain name data. Traditional architectures based on self-attention mechanisms or recurrent neural networks experience a quadratic increase in computational overhead with input length when processing long-sequence domain names, leading to significant processing delays in large-scale concurrent scenarios. To maintain real-time response to communication protocols, existing solutions typically compromise between model depth and throughput performance, resulting in insufficient extraction of micro-feature perturbations and long-range dependencies in domain names.
[0003] Besides the contradiction between hardware load and computing efficiency, software control methods also have shortcomings. For example, Chinese invention patent application CN120128411A discloses an abnormal domain name detection system based on machine learning. It uses a hybrid encoder of LSTM and Transformer to capture the temporal dependence and long-range association of domain names. However, due to the inherent quadratic computational complexity of the Transformer architecture and the efficiency bottleneck of LSTM serial computation, it still faces latency fluctuations when dealing with more than 100,000 concurrent traffic per second on the backbone network. The dynamic weight adjustment mechanism anchors the focus of the algorithm's internal features and fails to achieve deep decoupling between computational overhead and the physical resource status of the underlying hardware. Under conditions of limited or overloaded computing resources, it is difficult to real-time allocate the computational depth by sensing the processor and memory usage status. It is an environment-independent algorithm stacking, which makes it difficult to ensure audit accuracy while taking into account the reliability of security node engineering.
[0004] Therefore, the technical problem to be solved by this invention is how to achieve deep extraction of multimodal features of domain names with linearly proportional computational overhead, and how to build a detection mechanism that can dynamically adjust the filtering intensity according to the hardware status. Summary of the Invention
[0005] This invention aims to solve the technical problem of balancing processing efficiency and feature representation capabilities in malicious domain name detection in large-scale network environments.
[0006] In this technical solution, a malicious domain name detection system integrating multimodal embedding and dynamic weighted Mamba is provided. The system includes: The domain name preprocessing module is used to perform message denoising and length normalization on the acquired domain name protocol messages in order to output a standard domain name string sequence. The multimodal semantic vector mapping module is used to perform multi-dimensional feature extraction on standard domain name string sequences to construct a 1792-dimensional basic feature vector; The multi-channel parallel Mamba computing module is used to construct a four-dimensional feature vector space based on the basic feature vectors, and to perform nonlinear transformations on the feature flow in the four-dimensional feature vector space using the state space equation. The multi-channel parallel Mamba computing module integrates a load-adaptive feature filtering unit. The load-adaptive feature filtering unit is used to monitor the resource load index data of the network processing nodes in real time and determine the feature filtering threshold based on the resource load index data. The load-adaptive feature filtering unit is also used to perform dynamic sparsification processing on the state transition matrix in the state space equation according to the feature filtering threshold, so as to remove the feature components representing adversarial interference. The classification and detection module is used to perform logistic regression on the feature vector after feature component removal to output a malicious probability classification label.
[0007] Preferably, the multimodal semantic vector mapping module includes: a character-level mapping unit for extracting character distribution features of a standard domain name string sequence; and a combination-level mapping unit for extracting the character distribution features of a standard domain name string sequence. and Contextual features; temporal flipping unit, used to mirror and flip the standard domain name string sequence and extract the flipped character features and contextual features; dimension overlay unit, used to concatenate the character distribution features, contextual features and flipped features to generate a 1792-dimensional basic feature vector.
[0008] Preferably, when constructing a four-dimensional feature vector space, the multi-channel parallel Mamba computing module is used to map the basic feature vectors to a tensor structure containing spatial dimension, channel dimension, state dimension and temporal dimension, so as to achieve multi-perspective decoupling of domain name semantic features.
[0009] Preferably, the multi-channel parallel Mamba computation module further includes a cross-channel weight adjustment unit; the cross-channel weight adjustment unit is used to calculate the contribution of the output features of each parallel channel, and to adjust the feature mapping matrix of each channel based on differentiated weight coefficients according to the contribution, so as to strengthen the features and suppress redundant features.
[0010] Preferably, when the load-adaptive feature filtering unit performs dynamic sparsification on the state space equation, it compares the magnitude relationship between each component in the state transition matrix and the feature filtering threshold; if a component is lower than the feature filtering threshold, the feature response corresponding to that position is set to zero.
[0011] Preferably, the system also includes a protocol scenario awareness module; the protocol scenario awareness module is used to identify the application protocol type in network traffic, and match the corresponding initial calculation parameters for the load adaptive feature filtering unit according to the application protocol type.
[0012] Preferably, when the multi-channel parallel Mamba computing module processes the feature flow using state-space equations, its computational overhead increases linearly with the length of the standard domain name string sequence.
[0013] Preferably, the system further includes a load monitoring module; the load monitoring module is signal-connected to the load adaptive feature filtering unit and is used to acquire resource load data of the detection node at a preset sampling frequency and feed it back to the load adaptive feature filtering unit.
[0014] Preferably, the classification detection module includes: a classifier unit for performing multilayer perceptron mapping operations; and an early warning output unit for outputting a threat alarm signal when the malicious probability classification label exceeds a safety threshold.
[0015] Compared to existing technologies, the malicious domain name detection system of this invention, which integrates multimodal embedding and dynamic weighted Mamba, has the following beneficial effects: Firstly, in the detection of malicious domain names in dynamic weighted Mamba, a multi-channel parallel structure combined with state-space equations is used to transform the processing logic of domain name sequences from the traditional quadratic computational overhead to a linear growth path. This solves the bottleneck problem of the dramatic increase in latency in long-sequence domain name processing under large-scale network traffic monitoring environment, ensures the real-time auditing capability of security protocols under high concurrent load, and enables the system to have high processing timeliness when facing massive data communication.
[0016] Secondly, by leveraging the deep coupling of six-modal coding and four-dimensional feature space, a composite representation system is constructed that covers character-level micro-features, combinatorial-level contextual associations, and flipped-modal temporal features. This system enables the generation patterns and semantic offset features in domain names to generate synergistic gains. Through the complementary effects between features, it resists the adversarial avoidance measures implemented by attackers through character padding or prefix offsets, effectively broadening the identification dimensions of security protocols for variant malicious domain names and improving the robustness of the detection mechanism in complex adversarial environments. Attached Figure Description
[0017] Figure 1 This invention relates to a flowchart of a malicious domain name detection process that integrates multimodal features and Mamba computation. Figure 2 This invention relates to a system module topology diagram with load and protocol awareness capabilities. Detailed Implementation
[0018] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.
[0019] It should be noted that all directional and positional terms used in this invention, such as: up, down, left, right, front, back, vertical, horizontal, inner, outer, top, bottom, transverse, longitudinal, center, etc., are only used to explain the relative positional relationship and connection between components in a specific state (as shown in the accompanying drawings). They are only for the convenience of describing this invention and do not require that this invention be constructed and operated in a specific orientation. Therefore, they should not be construed as limiting this invention. In addition, the descriptions of "first," "second," etc., in this invention are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated.
[0020] In the description of this invention, unless otherwise explicitly specified and limited, the terms installation, connection, and linking should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections; they can refer to direct connections or indirect connections through an intermediate medium; they can refer to the internal connection of two components. For those skilled in the art, the specific meaning of the above terms in this invention can be understood according to the specific circumstances.
[0021] In the description of this specification, references to the terms "an embodiment," "some embodiments," "illustrative embodiments," "examples," "specific examples," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example, and the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.
[0022] A malicious domain name detection system integrating multimodal embedding and dynamic weighted Mamba, the system comprising: The domain name preprocessing module is used to perform message denoising and length normalization on the acquired domain name protocol messages in order to output a standard domain name string sequence. The multimodal semantic vector mapping module is used to perform multi-dimensional feature extraction on standard domain name string sequences to construct a 1792-dimensional basic feature vector; The multi-channel parallel Mamba computing module is used to construct a four-dimensional feature vector space based on the basic feature vectors, and to perform nonlinear transformations on the feature flow in the four-dimensional feature vector space using the state space equation. The multi-channel parallel Mamba computing module integrates a load-adaptive feature filtering unit. The load-adaptive feature filtering unit is used to monitor the resource load index data of the network processing nodes in real time and determine the feature filtering threshold based on the resource load index data. The load-adaptive feature filtering unit is also used to perform dynamic sparsification processing on the state transition matrix in the state space equation according to the feature filtering threshold, so as to remove the feature components representing adversarial interference. The classification and detection module is used to perform logistic regression on the feature vector after feature component removal to output a malicious probability classification label.
[0023] Preferably, the multimodal semantic vector mapping module includes: a character-level mapping unit for extracting character distribution features of a standard domain name string sequence; and a combination-level mapping unit for extracting the character distribution features of a standard domain name string sequence. -gram and 3-gram contextual features; temporal flipping unit, used to mirror and flip the standard domain name string sequence and extract the flipped character features and contextual features; dimension overlay unit, used to concatenate the character distribution features, contextual features and flipped features to generate a 1792-dimensional basic feature vector.
[0024] Preferably, when constructing a four-dimensional feature vector space, the multi-channel parallel Mamba computing module is used to map the basic feature vectors to a tensor structure containing spatial dimension, channel dimension, state dimension and temporal dimension, so as to achieve multi-perspective decoupling of domain name semantic features.
[0025] Preferably, the multi-channel parallel Mamba computation module further includes a cross-channel weight adjustment unit; the cross-channel weight adjustment unit is used to calculate the contribution of the output features of each parallel channel, and to adjust the feature mapping matrix of each channel based on differentiated weight coefficients according to the contribution, so as to strengthen the features and suppress redundant features.
[0026] Preferably, when the load-adaptive feature filtering unit performs dynamic sparsification on the state space equation, it compares the magnitude relationship between each component in the state transition matrix and the feature filtering threshold; if a component is lower than the feature filtering threshold, the feature response corresponding to that position is set to zero.
[0027] Preferably, the system also includes a protocol scenario awareness module; the protocol scenario awareness module is used to identify the application protocol type in network traffic, and match the corresponding initial calculation parameters for the load adaptive feature filtering unit according to the application protocol type.
[0028] Preferably, when the multi-channel parallel Mamba computing module processes the feature flow using state-space equations, its computational overhead increases linearly with the length of the standard domain name string sequence.
[0029] Preferably, the system further includes a load monitoring module; the load monitoring module is signal-connected to the load adaptive feature filtering unit and is used to acquire resource load data of the detection node at a preset sampling frequency and feed it back to the load adaptive feature filtering unit.
[0030] Preferably, the classification detection module includes: a classifier unit for performing multilayer perceptron mapping operations; and an early warning output unit for outputting a threat alarm signal when the malicious probability classification label exceeds a safety threshold.
[0031] Example 1: In a network security audit scenario deployed at a backbone network egress node, this node handles over 100,000 Domain Name System (DNS) packets per second. Because the attacker uses an evolved domain name generation algorithm to generate malicious domain names with long temporal dependencies, the domain name string sequence length reaches 64 characters. The domain name preprocessing module performs packet denoising and length normalization on the acquired DNS packets, outputting a standard domain name string sequence with a uniform length of 64 bytes. The multimodal semantic vector mapping module, through its integrated character-level mapping unit, combination-level mapping unit, temporal reversal unit, and dimension overlay unit, extracts 2-gram and 3-gram contextual features and mirrored temporal features, converting the standard domain name string sequence into a 1792-dimensional basic feature vector. The multi-channel parallel Mamba computation module constructs a four-dimensional feature vector space containing spatial, channel, state, and temporal dimensions based on the basic feature vector, and performs a nonlinear transformation on the feature flow in the four-dimensional feature vector space using the state space equation.
[0032] The load adaptive feature filtering unit monitors the resource load metrics of the detection nodes in real time. When the processor utilization reaches 80% and the memory usage reaches 80%, the load adaptive feature filtering unit applies a preset feature filtering threshold. Dynamic sparsification is applied to the state transition matrix in the state-space equation, where the feature filtering threshold is... Setting it to 0.5, this process works by filtering out features in the state transition matrix that are below the feature filtering threshold. The feature responses at the corresponding positions of the matrix components are set to zero, thus eliminating the feature components that represent adversarial interference.
[0033] The classification and detection module performs logistic regression on the feature vectors after feature component removal and outputs a malicious probability classification label. The system's computational overhead increases linearly with the length of the domain name string sequence. When processing a domain name sequence containing 128 characters, the detection time for a single record is 0.17ms, and the throughput remains above 5882 records per second. The early warning output unit generates a threat alarm signal when the malicious probability classification label exceeds the safety threshold, achieving real-time blocking of the communication behavior of the malicious domain name generation algorithm with an overall detection accuracy of 99.4%.
[0034] Example 2: In a security audit server equipped with 64 physical cores, a single core clock speed of 2.5GHz, and 128GB of random access memory, the test platform acquired a Domain Name System Protocol (DNS) standard dataset containing 10 million samples. This dataset includes malicious domain name samples from multiple domain name generation algorithm families, covering dictionary-based attacks, random character attacks, and high-entropy covert attacks. Normal domain name samples were extracted from the top 1 million access records globally. Under a non-ideal engineering test environment, Gaussian white noise with a signal-to-noise ratio of 15dB was superimposed on the original traffic, and the packet arrival interval contained 5% random jitter offset. The load-adaptive feature filtering unit obtained the processor utilization of the detection node and determined the feature filtering threshold based on the processor utilization. Feature filtering threshold The value range is from 0 to 1.0, corresponding to an increase in the feature filtering threshold for every 10% increase in processor utilization. Increase the feature filtering threshold by 0.05 units when processor utilization is below 30%. With a value of 0, the multi-channel parallel Mamba computing module retains 1792-dimensional feature responses, achieving a detection accuracy of 99.68%, a single message processing latency of 0.22ms, and a feature filtering threshold at 80% processor utilization. By adjusting the value to 0.55, the system eliminates feature components through sparsification of the state transition matrix, reducing the processing latency of a single message to 0.15ms, achieving a throughput 1.47 times that under low load conditions, and a detection accuracy of 99.40%.
[0035] The experimental setup included a first control group using the Transformer architecture, a second control group without an integrated load-adaptive feature filtering unit, and a third control group with the character-level mapping unit and the composite-level mapping unit removed. When processing domain name sequences of 128 characters with a concurrency of 50,000 records per second, the first control group had a single record processing time of 1.85 ms, while the system of this invention maintained a single record processing time of 0.17 ms. When a traffic burst caused the processor load to reach 95%, the response time of the second control group increased from 0.19 ms to 0.64 ms, resulting in protocol stack packet loss. The sample group of this invention removed redundant components in the state transition matrix through the load-adaptive feature filtering unit, keeping the response time within 0.20 ms. For malicious domain name samples with high entropy distribution, the detection accuracy of the third control group was 88.42%, while the sample group of this invention extracted semantic association features using the character-level mapping unit, the composite-level mapping unit, and the time-flipping unit, achieving a detection accuracy of 99.41%.
[0036] As the entropy value of the character sequences generated by the malicious domain name generation algorithm increases, the system indicators exhibit a gradient evolution. In the test of the ordinary domain name generation algorithm family, the system false negative rate is 0.045%. In the test of the high-entropy domain name generation algorithm family, the multi-channel parallel Mamba computing module characterizes the time-series dependency features through the nonlinear transformation of the state-space equation, with a false negative rate of 0.078%. Under the extreme load condition of 150,000 packets per second, the feature filtering threshold... Locked at 0.9, the system prioritizes auditing core protocol fields, achieving a detection accuracy of 98.15%. The above quantitative data confirms the feasibility of this system in real-time auditing tasks of network security protocols. It achieves a balance between high-precision detection and extremely low processing latency by reshaping computational complexity through state-space equations.
[0037] Example 3: To address the risk of protocol stack audit interruption caused by memory overflow in detection nodes under large-scale network traffic environments, this system completes the output structure dimension allocation of the multimodal semantic vector mapping module during the initialization phase. After the standard domain name string sequence enters the mapping logic, the character-level mapping unit generates a 256-dimensional character distribution feature vector, the combination-level mapping unit generates a 512-dimensional 2-gram vector and a 512-dimensional 3-gram vector respectively, the time-sequence flipping unit generates a 512-dimensional mirror-flipped combination vector, and the dimension overlay unit completes the vector concatenation in the order of character, combination, and time sequence to generate a floating-point number sequence with a fixed length of 1792.
[0038] When the system is in continuous operation, the load monitoring module collects the processor utilization every 100ms through the underlying hardware registers. With memory usage The load adaptive feature filtering unit determines the load evaluation factors based on the collected indicator data. Calculate the feature filtering threshold Load evaluation factors The calculation formula is as follows: ,in, This is the load evaluation factor, with a value range of 0 to 1.0; For processor utilization, Memory usage rate, feature filtering threshold Based on load evaluation factors With preset slope coefficient The product is determined by the following formula: ,in, The feature filtering threshold; The calibration coefficients are used in the specific deployment of this embodiment. Set to 1.2, when the calculated value is... When the value exceeds the upper limit of 1.0, it automatically aligns to 1.0. The multi-channel parallel Mamba computing module, when processing feature flow transformations, will convert the continuous system matrix in the state-space equations... Convert to discrete system matrix This conversion process is based on the discretization step size. Implementation, Discretization step size Based on the length of the input sequence Determine, i.e., set For a standard domain name string sequence of length 64 bytes, the discretization step size Δ is determined to be 0.0156. Under this parameter configuration, the system calculates the index through matrix exponent mapping. This enables computational convergence of nonlinear transformations in the temporal processing of domain name strings.
[0039] When the system detects for and When the operating condition is 75%, the load evaluation factor L is 0.81, and the feature filtering threshold is... The threshold value is set to 0.972. The load-adaptive feature filtering unit sets the feature responses at positions corresponding to components with amplitudes lower than 0.972 in the state transition matrix to zero based on this feature filtering threshold, reducing floating-point operation overhead by 65%. To prevent instability of the dynamic system caused by large-area hard zeroing and divergence of step integrals during discretization, while performing the above feature response zeroing operation, the system retains the principal component feature components on the diagonal of the matrix and does not participate in sparsification filtering. A small unit diagonal constant is added for feature root translation compensation. This orthogonalization constraint compensation mechanism ensures that the highly sparsified state transition matrix still maintains full-rank characteristics and non-singularity in mathematical structure, ensuring that the evolution and derivation process of the state equation will not collapse due to excessive truncation of feature information. This method enables the system to keep the processing time of a single domain name below 0.2ms under traffic peak impact, and the false negative rate increment below 0.1%, achieving a balance between computing resource utilization and network security audit accuracy under extreme conditions.
[0040] Example 4: In traffic monitoring scenarios that carry core business and exhibit time-varying fluctuations, the malicious probability classification labels generated by the classification and detection module and the triggering criteria of the early warning output unit are determined through statistical calibration procedures. The system acquires trusted traffic packet data continuously for 24 hours within a preset trial operation period. The classification and detection module calculates the malicious probability response value for each normal domain name packet to establish a normal probability distribution model. Skewness and kurtosis are calculated on the response value sequence, and a security threshold is set. Set as the 99.7th percentile value of the probability response distribution, where the safety threshold is... Following the three-standard-deviation principle, when the malicious probability classification label of the measured traffic exceeds this security threshold... At that time, the early warning output unit generates a threat alarm signal, and maintains the false alarm rate within the 0.1% boundary when the background traffic changes.
[0041] When the detection system is deployed on different network protocol audit nodes, causing the domain name string feature distribution to deviate from the initial baseline, the multimodal semantic vector mapping module calibrates the internal contribution of the 1792-dimensional basic feature vector through an offline feature correlation calibration procedure. This calibration procedure injects labeled malicious sample sequences into the test platform, monitors the response gain of the state transition matrix in the multi-channel parallel Mamba computing module to different modal inputs, determines the weight correction factor of the multimodal semantic vector based on the feature energy ratio of each channel, and adjusts the feature space from a uniform mapping to an unbalanced weighted mapping determined based on threat features. This eliminates the interference of differences in packet length distribution under different network topologies on detection accuracy. The system locks the cascading order and weight parameters of multimodal features based on the feature gain response under actual operating conditions, maintaining detection consistency under different audit requirements.
[0042] Example 5: In the initialization scenario of deploying a malicious domain name detection system on a network audit node, the load adaptive feature filtering unit determines the load evaluation factor through a pre-load calibration process. The weighting parameters are used in this calibration process, which injects simulated packet flows with progressively increasing traffic intensity into the audit nodes, while simultaneously monitoring processor utilization. With memory usage The fluctuations in message audit latency caused by changes were analyzed using a least squares regression algorithm to assess the contribution of resource consumption to the sensitivity of protocol stack processing latency increases. Furthermore, the load evaluation factor was locked when the weight of processor performance degradation on latency reached 1.5 times the weight of memory consumption. The linear combination coefficients are 0.6 and 0.4, respectively.
[0043] When the multi-channel parallel Mamba computing module constructs a four-dimensional eigenvector space based on 1792-dimensional fundamental eigenvectors, the state transition matrix in the state-space equation is... Initialization is completed through a cold-start calibration procedure, which retrieves prior probability values from the local malicious domain semantic distribution configuration table and maps the embedded components generated at the character level, combination level, and flip mode to a state transition matrix. The initial values of the diagonal elements are used to establish the representation benchmark of the long-term time-series dependency features of the domain name sequence in the state space equation at the initial stage of system startup. When implementing this mapping initialization, the calibration procedure divides the 1792-dimensional basic feature vector into 16 consecutive sub-feature sets at equal intervals according to the arrangement order, and uses conventional arithmetic logic to extract the average value within each set. Then, the system uses the retrieved prior probability values to perform multiplication operations with the 16 corresponding average values, thereby generating 16 weighted and dimensionality-reduced benchmark scalars, which are then sequentially filled into the main diagonal of the 16×16 state transition matrix, ensuring the computational determinism of the transition from high-dimensional multimodal signals to low-level state structures.
[0044] During the system initialization process for semantic deep parsing of domain name protocol messages, the multi-channel parallel Mamba computing module performs topological mapping on the 1792-dimensional basic feature vector through a four-dimensional feature vector space. This topological mapping follows specific spatial expansion rules, converting the one-dimensional floating-point sequence into a tensor structure containing spatial, channel, state, and temporal dimensions. The spatial dimension corresponds to the sequence length of 64 sampling positions; the channel dimension corresponds to the four sets of feature modes generated by character-level mapping units, combination-level mapping units, and temporal flipping units; the state dimension corresponds to the 16 discrete components of the implicit state vector in the state-space equation; and the temporal dimension is synchronized with the parsing order of the domain name characters. Based on the principle of linear spatial mapping, the multi-dimensional tensor transformation operator projects the low-dimensional asymmetric feature space to a high-dimensional orthogonal space. The system extracts the 1792-dimensional basic feature vector output by the multi-modal semantic vector mapping module, calculates its inner product with a preset 1792×4096-dimensional projection weight matrix, and generates 4096 discrete scalar intermediate sequences. This projection weight matrix is used in the initial... The design integrates positional encoding information based on discrete sine transform. Through feature inner product operations, it re-distributes weights based on relative positions for static mapping vectors that lost absolute order during multimodal feature aggregation. This discrete scalar intermediate sequence, containing positional sequence information, essentially reconstructs the relative order of the original 64 characters across four feature modalities and sixteen state dimensions. This establishes a concrete mathematical foundation for subsequent reshaping of the physical temporal dimension using matrix structures. Based on the underlying memory step size allocation logic, the intermediate sequence is reconstructed into a 64x4x16 four-dimensional tensor. The system uses multidimensional tensor transformation operators to deconstruct the original embedded vectors and fill them into the corresponding tensor coordinates, establishing the computational carrier of the state-space equation in the domain name feature representation task. After receiving the high-order feature stream output from the multi-channel parallel Mamba computing module, the classifier unit performs feature weight normalization processing based on the real-time feature energy distribution of each sub-channel, generating dynamic fusion coefficients corresponding one-to-one with the four modal channels. subscript The system represents the channel index and satisfies the constraint that the sum of the coefficients is always equal to 1.0. For each modal sub-channel, the system calculates the sum of squares of all feature response values of the higher-order feature flow tensor. This result is used as the real-time feature energy quantization value to measure the significance of that channel. The classifier unit extracts the feature energy of a single channel and divides it by the sum of the feature energies of the four modal channels, thereby deriving the specific dynamic fusion coefficients representing the influence of that modality. This establishes a unique weight mapping basis for multi-dimensional composite features during dimensionality reduction. The system linearly accumulates the normalized feature components and inputs them into the logistic regression operator of the classifier unit. This operator performs an inner product operation on the fused features using a preset weight matrix and bias parameters. The Sigmoid function maps the result to the interval between 0 and 1.0 to generate a malicious probability classification label. If the malicious probability classification label is greater than a security threshold... Once the decision boundary is determined, the early warning output unit generates a threat alarm signal, realizing a closed-loop logical deduction from multimodal original embedded features to malicious behavior judgment conclusions.
[0045] The embodiments of this application have been described above with reference to the accompanying drawings. Unless otherwise specified, the embodiments and features in the embodiments of this application can be combined with each other. This application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit of this application and the scope of protection of this invention, and all of these forms are within the protection scope of this application.
Claims
1. A malicious domain name detection system integrating multimodal embedding and dynamic weighted Mamba, characterized in that, The system includes: The domain name preprocessing module is used to perform message denoising and length normalization on the acquired domain name protocol messages in order to output a standard domain name string sequence. The multimodal semantic vector mapping module is used to perform multi-dimensional feature extraction on standard domain name string sequences to construct a 1792-dimensional basic feature vector; The multi-channel parallel Mamba computing module is used to construct a four-dimensional feature vector space based on the basic feature vectors, and to perform nonlinear transformations on the feature flow in the four-dimensional feature vector space using the state space equation. The multi-channel parallel Mamba computing module integrates a load-adaptive feature filtering unit. The load-adaptive feature filtering unit is used to monitor the resource load index data of the network processing nodes in real time and determine the feature filtering threshold based on the resource load index data. The load-adaptive feature filtering unit is also used to perform dynamic sparsification processing on the state transition matrix in the state space equation according to the feature filtering threshold, so as to remove the feature components representing adversarial interference. The classification and detection module is used to perform logistic regression operations on the feature vectors after feature component removal to output a malicious probability classification label.
2. The malicious domain name detection system integrating multimodal embedding and dynamic weighted Mamba as described in claim 1, characterized in that, The multimodal semantic vector mapping module includes: a character-level mapping unit for extracting character distribution features of standard domain name string sequences; a combination-level mapping unit for extracting 2-gram and 3-gram contextual features of standard domain name string sequences; a temporal flipping unit for mirroring the standard domain name string sequences and extracting the flipped character features and contextual features; and a dimension stacking unit for concatenating the character distribution features, contextual features, and flipped features to generate a 1792-dimensional basic feature vector.
3. The malicious domain name detection system integrating multimodal embedding and dynamic weighted Mamba as described in claim 1, characterized in that, When constructing a four-dimensional feature vector space, the multi-channel parallel Mamba computing module is used to map the basic feature vectors to a tensor structure containing spatial, channel, state, and temporal dimensions, so as to achieve multi-perspective decoupling of domain name semantic features.
4. The malicious domain name detection system integrating multimodal embedding and dynamic weighted Mamba as described in claim 1, characterized in that, The multi-channel parallel Mamba computation module also includes a cross-channel weight adjustment unit; the cross-channel weight adjustment unit is used to calculate the contribution of the output features of each parallel channel, and to adjust the feature mapping matrix of each channel based on the contribution using differentiated weight coefficients to strengthen features and suppress redundant features.
5. The malicious domain name detection system integrating multimodal embedding and dynamic weighted Mamba as described in claim 1, characterized in that, When the load-adaptive feature filtering unit performs dynamic sparsification on the state space equation, it compares the magnitude relationship between each component in the state transition matrix and the feature filtering threshold. If a component is lower than the feature filtering threshold, the feature response corresponding to the position is set to zero.
6. The malicious domain name detection system integrating multimodal embedding and dynamic weighted Mamba as described in claim 1, characterized in that, The system also includes a protocol scenario awareness module; The protocol scenario awareness module is used to identify the application protocol type in network traffic and match the corresponding initial calculation parameters for the load adaptive feature filtering unit according to the application protocol type.
7. The malicious domain name detection system integrating multimodal embedding and dynamic weighted Mamba as described in claim 1, characterized in that, When the multi-channel parallel Mamba computing module processes feature flows using state-space equations, its computational overhead increases linearly with the length of the standard domain name string sequence.
8. The malicious domain name detection system integrating multimodal embedding and dynamic weighted Mamba as described in claim 1, characterized in that, The system also includes a load monitoring module; the load monitoring module is signal-connected to the load adaptive feature filtering unit and is used to acquire resource load data of the detection node at a preset sampling frequency and feed it back to the load adaptive feature filtering unit.
9. A malicious domain name detection system integrating multimodal embedding and dynamic weighted Mamba as described in claim 1, characterized in that, The classification and detection module includes: a classifier unit, used to perform multilayer perceptron mapping operations; and an early warning output unit, used to output a threat alarm signal when the malicious probability classification label exceeds the safety threshold.