A method and system for dynamically generating DNS risk domain names in an IPv6 dual stack environment

Abstract

This invention provides a method and system for dynamically generating DNS risk domain names in an IPv6 dual-stack environment. It belongs to the field of network information security technology. The method includes: acquiring the target application scenario, risk type, and IPv6 feature requirements input by the user; mapping the target application scenario, risk type, and IPv6 feature requirements to corresponding feature dimensions and assigning values ​​based on a predefined feature template dimension structure to obtain a feature template; generating a candidate set of dual-stack risk domain names by using the feature template as conditional input based on a risk domain name generation model; performing verification processing on each dual-stack risk domain name in the candidate set; and outputting a set of verified dual-stack risk domain names based on the verification results. This method can improve the timeliness, scenario matching degree, and realism of risk domain name sample updates, supporting security drills, detection model training, and protection strategy evaluation.

Description

Technical Field

[0001] This invention belongs to the field of network information security technology, and in particular relates to a method and system for dynamically generating DNS risk domain names in an IPv6 dual-stack environment. Background Technology

[0002] With the large-scale deployment of IPv6, IPv6 dual-stack networks have become the mainstream form in enterprise and operational networks. In this network environment, the Domain Name System (DNS) undertakes the basic resolution function of mapping domain names to network addresses, and is a key link for communication between various business systems. With the development of cloud computing, the Industrial Internet, and large-scale enterprise networks, the deployment scope of IPv6 dual-stack DNS continues to expand, and its operational stability and security directly affect the continuity and reliability of network services.

[0003] In practical applications, DNS resolution has gradually become a key target for network attacks. Attackers often construct risky domain names to carry out spoofing, malicious communication control, or data theft. These risky domain names are often characterized by rapid generation and frequent changes, and exhibit differentiated characteristics in different application scenarios. In an IPv6 dual-stack environment, domain name resolution involves both IPv4 and IPv6 address mappings, making the manifestation of risky domain names more complex and placing higher demands on existing security protections.

[0004] In existing technologies, the identification and protection of DNS risky domains mainly rely on a risky domain database built based on historical samples. This database is periodically updated manually or semi-automatically, and interception is performed using rule matching or feature comparison. However, in an IPv6 dual-stack network environment, these existing technologies still have certain limitations. These limitations include: a lag in risky domain updates and handling; unstable protection coverage over time; and difficulty in promptly including newly emerging risky domains in the interception scope. Furthermore, the identification effectiveness is prone to fluctuations under different network and business scenarios, resulting in false positives and false negatives. Additionally, the domain samples relied upon for security testing and drills are insufficient in terms of quantity, diversity, and consistency with actual attack environments, affecting the credibility and comparability of the assessment results. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for dynamically generating risky DNS domain names in an IPv6 dual-stack environment, which can improve the timeliness, scenario matching and realism of risky domain name sample updates, and support security drills, detection model training and protection strategy evaluation.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a method for dynamically generating DNS risk domain names in an IPv6 dual-stack environment, comprising: Obtain user input regarding the target application scenario, risk type, and IPv6 feature requirements; Based on a predefined feature template dimension structure, the target application scenario, risk type and IPv6 feature requirements are mapped to the corresponding feature dimensions and assigned values ​​to obtain the feature template. Based on the pre-trained risk domain name generation model, the feature template is used as a conditional input to generate a candidate dual-stack risk domain name set. The risk domain name generation model is trained to perform dual-stack risk domain name generation based on a multi-dimensional feature space consistent with the dimensional structure of the feature template. For each dual-stack risk domain in the candidate dual-stack risk domain set, a verification process is performed. The verification process includes at least IPv6 feature validity verification, fidelity verification, and dual-stack resolution behavior verification. Based on the verification results, output the set of dual-stack risk domain names that have passed verification.

[0007] Furthermore, the risky domain name generation model is a character-level sequence generation model based on deep learning. The steps for training the risky domain name generation model include: Obtain a historical risk domain name sample set. Each training sample in the historical risk domain name sample set includes at least one known risk domain name character sequence and multi-dimensional feature information corresponding to the risk domain name. The multi-dimensional feature information is used to characterize a multi-dimensional feature space that is consistent with the dimensional structure of the predefined feature template. Based on multi-dimensional feature information, feature fusion and vectorization processing are performed on each training sample to generate a multi-dimensional feature vector corresponding to the character sequence of the risk domain name. Based on multidimensional feature vectors and corresponding risk domain name character sequences, a character-level sequence generation model is used to train the risk domain name generation model, so that the risk domain name generation model can learn to generate a dual-stack risk domain name character sequence that is semantically consistent with the multidimensional feature vectors under the constraint of multidimensional feature vectors.

[0008] Furthermore, the process of generating the historical risk domain name sample set includes: Obtain a basic sample set of historical risk domain names. The basic sample set of historical risk domain names shall include at least the character sequence of the risk domain name, as well as the resolution log data, application scenario information or risk type identification information associated with each character sequence of the risk domain name. For each risk domain name character sequence in the historical risk domain name base sample set, it is processed through multiple preset feature processing channels to characterize the risk domain name character sequence and related data from different feature dimensions and form a corresponding set of multiple features. The feature processing channels include at least: IPv6 feature processing channel used to generate IPv6 protocol feature sets; Dual-stack parsing feature processing channel used to generate dual-stack parsing feature sets; Domain structure feature processing channel used to generate domain structure feature sets; Semantic feature processing channel used to generate semantic feature sets; A scenario and risk feature processing channel used to generate a feature set of application scenarios and risk types; The feature sets obtained from each feature processing channel are combined to form multi-dimensional feature information that corresponds one-to-one with the character sequence of the risk domain name, thus forming a historical risk domain name sample set.

[0009] Furthermore, the IPv6 protocol feature set includes: the embedding format of IPv6 addresses in domain names, the embedding location, the address compression representation method, and the feature information of the legality of IPv6 address structure; The dual-stack resolution feature set includes: the resolution association, resolution mode, and consistency of resolution behavior of the same domain name in both IPv4 and IPv6 dual-stack environments; The domain name structure feature set includes: domain name character composition, character distribution characteristics, length characteristics, and subdomain hierarchical structure features; The semantic feature set includes: domain name semantic representation, semantic similarity, and feature information of brand words or industry words; The set of application scenario and risk type features includes: target application scenario attributes, equipment or industry-related identifiers, and feature information of risk semantic categories.

[0010] Furthermore, the generation of the historical risk domain name base sample set includes: Domain name data is obtained from at least one preset data source, which includes at least a manually labeled IPv6 attack scenario sample library, a risk domain name library, a threat intelligence library, security event records, a network security monitoring system, or DNS resolution logs; From the acquired domain name data, select domain names that have been marked as risky domains in the preset data source, or domain names that are associated with malicious communication, abnormal resolution behavior, or known attack activities, and use them as risky domain name character sequences; Obtain the DNS log data, application scenario information, and risk type identification information associated with the character sequence of the risk domain name; The character sequences of risky domain names and their associated information are cleaned and normalized. The character sequences of risky domain names are then combined with their associated DNS log data, application scenario information, and risk type identification information to form a basic sample set of historical risky domain names.

[0011] Furthermore, the verification process performed on dual-stack candidate risk domains includes at least the following steps: Perform IPv6 feature validity verification on candidate risk domains to determine whether the IPv6 address embedding format, embedding location and address structure in the candidate risk domains conform to the preset IPv6 protocol rules; Perform dual-stack resolution behavior verification on candidate risky domains to determine whether the resolution association and resolution behavior of candidate risky domains in the IPv4 and IPv6 dual-stack environment meet the preset consistency conditions. Perform fidelity verification on candidate risk domains to assess the degree of consistency between candidate risk domains and the distribution characteristics of historical risk domains in terms of character structure, semantic representation, and resolution behavior; Based on the results of validity verification, dual-stack resolution behavior verification, and fidelity verification, it is determined whether the candidate risky domain name passes the verification.

[0012] Furthermore, the training process of the risky domain name generation model also includes: a policy optimization step based on reinforcement learning, which includes at least the following: After initial training based on a historical risk domain name sample set, candidate dual-stack risk domain names are generated using a risk domain name generation model. Verification processing is performed on candidate dual-stack risk domains, and reward feedback information is constructed based on the verification results of IPv6 feature validity, fidelity, and consistency of dual-stack resolution behavior. Based on reward feedback information, a near-end policy optimization algorithm is used to update the policy of the conditional probability distribution corresponding to the risk domain name generation model during the character-level decoding process, so as to adjust the selection probability of each candidate character by the risk domain name generation model in the subsequent generation process.

[0013] In a second aspect, the present invention provides a system for dynamically generating DNS risk domain names in an IPv6 dual-stack environment, comprising: The user input acquisition module is used to acquire the target application scenario, risk type, and IPv6 feature requirements of the user input. The feature template construction module is used to map the target application scenario, risk type and IPv6 feature requirements to the corresponding feature dimensions and assign values ​​based on the predefined feature template dimension structure to obtain the feature template; The risk domain name generation module is used to generate a candidate dual-stack risk domain name set based on the pre-trained risk domain name generation model, taking the feature template as conditional input. The risk domain name generation model is trained to perform dual-stack risk domain name generation based on a multi-dimensional feature space consistent with the dimensional structure of the feature template. The risk domain verification module is used to perform verification processing on each dual-stack risk domain in the candidate dual-stack risk domain set. The verification processing includes at least IPv6 feature validity verification, fidelity verification, and dual-stack resolution behavior verification. The results output module is used to output a set of dual-stack risk domain names that have passed verification based on the results of the verification process.

[0014] In a third aspect, the present invention provides an electronic device including a processor and a memory, wherein the processor is used to execute a computer program stored in the memory to implement a method for dynamically generating DNS risk domain names in an IPv6 dual-stack environment.

[0015] In a fourth aspect, the present invention provides a computer-readable storage medium storing at least one instruction, wherein the at least one instruction, when executed by a processor, implements a method for dynamically generating DNS risk domain names in an IPv6 dual-stack environment.

[0016] 1. The method for dynamically generating risky DNS domain names in IPv6 dual-stack environments provided by this invention transforms the risky domain name generation process from static rule-driven to scenario-based and feature-constrained driven by introducing a conditional generation mechanism oriented towards target application scenarios, risk types, and IPv6 feature requirements. Compared with existing methods that rely on fixed rules or manually constructed samples, this invention uses a predefined feature template dimensional structure to uniformly map application scenario features, risk semantic features, and IPv6 protocol-related features to a multi-dimensional feature space, and uses this as conditional input to drive the risky domain name generation model. This ensures that the generated risky domain names are consistent with the target attack scenario in terms of character structure, semantic representation, and dual-stack resolution behavior. Simultaneously, by performing IPv6 feature validity verification, dual-stack resolution behavior verification, and realism verification on candidate risky domain names, low-quality samples that do not conform to IPv6 protocol rules or significantly deviate from the distribution of real risky domain names can be effectively eliminated, thereby outputting a set of dual-stack risky domain names with high real attack characteristics. This method can dynamically generate risky domain names that meet specific attack characteristics in an IPv6 dual-stack environment, providing more realistic, controllable and continuously updated sample support for DNS security detection, protection drills and model training, avoiding the problem that traditional static samples are difficult to cover new IPv6 attack forms.

[0017] 2. This invention constructs a historical risk domain name sample set containing multi-dimensional feature information and employs a character-level sequence generation model for conditional training. This enables the risk domain name generation model to learn the character distribution patterns and semantic features of risk domain names under the constraints of multi-dimensional feature vectors, thereby improving the realism of the generated domain names at the structural and semantic levels. By setting up IPv6 protocol feature processing channels, dual-stack parsing feature processing channels, domain name structure feature processing channels, semantic feature processing channels, and application scenario and risk type feature processing channels, this invention can comprehensively represent historical risk domain names from the protocol layer, parsing behavior layer, character structure layer, and semantic layer, avoiding the problem of insufficient generalization caused by relying solely on single character statistical features. Furthermore, by performing feature modeling on IPv6 address embedding forms, compression representation methods, and dual-stack parsing correlations, the model can learn the risk domain name construction methods unique to the IPv6 dual-stack environment, effectively improving the adaptability of the generated results to IPv6 attack scenarios. Compared with traditional generation methods based on rule concatenation or simple statistical models, this invention has significant advantages in terms of sample coverage breadth, feature expression completeness, and generation result diversity.

[0018] 3. This invention introduces a reinforcement learning-based policy optimization mechanism during the training and generation process of the risk domain name generation model. It combines the verification results of IPv6 feature validity, fidelity, and consistency of dual-stack resolution behavior to construct a reward feedback mechanism, thereby dynamically adjusting the character-level decoding probability distribution during generation. By directly feeding the verification results back to the policy update stage of the generation model, the model can proactively favor domain name samples that meet IPv6 feature constraints, dual-stack resolution consistency requirements, and high fidelity features in subsequent generation, reducing the proportion of invalid or low-quality domain names generated. Simultaneously, by setting up a multi-dimensional verification process at the generation backend, the generated results can be screened a second time at the output stage, further ensuring the comprehensive quality of the final output risk domain name set in terms of protocol legality, resolution behavior rationality, and semantic similarity. This closed-loop training and verification mechanism enables the model to continuously optimize, adapting to new IPv6 attack methods as new samples are introduced, improving the usability and stability of the risk domain name generation results in actual security detection and protection drills. Attached Figure Description

[0019] The accompanying drawings, which form part of this application, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a flowchart illustrating the method for dynamically generating DNS risk domains in an IPv6 dual-stack environment according to an embodiment of the present invention. Figure 2This is a system architecture diagram of the method for dynamically generating DNS risk domains in an IPv6 dual-stack environment according to an embodiment of the present invention; Figure 3 This is a flowchart illustrating the multi-dimensional feature extraction process according to an embodiment of the present invention. Figure 4 This is a schematic diagram illustrating the working principle of the AI ​​generation engine in an embodiment of the present invention. Figure 5 This invention provides scenario adaptation and dynamic generation of timing diagrams for embodiments of the invention. Figure 6 This is a structural block diagram of the IPv6 dual-stack environment DNS risk domain name dynamic generation system according to an embodiment of the present invention; Figure 7 This is a structural block diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0020] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other.

[0021] The following detailed description is exemplary and intended to provide further detailed explanation of the invention. Unless otherwise specified, all technical terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. The terminology used in this invention is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention.

[0022] Example 1 This invention provides a method for dynamically generating DNS risk domain names in an IPv6 dual-stack environment, such as... Figure 1 As shown, the method includes steps S1 to S5. Figure 2As shown, the method for dynamically generating risky DNS domain names in an IPv6 dual-stack environment provided in this embodiment is deployed based on a cloud-edge collaborative architecture to adapt to the IPv6 dual-stack network environment. The edge layer deploys feature acquisition nodes installed next to the IPv6 dual-stack DNS server, collecting DNS resolution logs via the sFlow protocol to extract features related to resolution behavior. The feature acquisition nodes support IPv4 and IPv6 dual-protocol communication, with hardware configurations including an ARM Cortex-A72 CPU (quad-core 1.8GHz), 4GB DDR4 memory, and 32GB BeMMC storage, adaptable to industrial-grade temperature and humidity (-30℃~60℃). The cloud layer deploys a sample library, a multi-dimensional feature extraction module, an AI generation engine, and a scene adaptation module, using a cloud server cluster (2 primary, 1 backup). Each server is configured with an Intel Xeon Gold 6338 CPU (32 cores 2.0GHz), 256GB DDR4 memory, and 20TB HDD + 4TB SSD storage, running a Linux operating system and the TensorFlow framework to achieve parallel processing of distributed model training and generation tasks.

[0023] In step S1, the target application scenario, risk type, and IPv6 feature requirements input by the user are obtained. Target application scenarios include, but are not limited to, enterprise campus networks, cloud data center networks, and industrial control networks; risk types include spoofed domains, malicious C2 domains, and phishing domains; IPv6 feature requirements include, but are not limited to, whether address embedding is required, whether dual-stack resolution association is required, and whether a specific IPv6 address range or address compression embedding format is required. This user input serves as the input condition for scenario adaptation and feature template invocation.

[0024] In step S2, based on a predefined feature template dimensional structure, the target application scenario, risk type, and IPv6 feature requirements are mapped to corresponding feature dimensions and assigned values ​​to obtain the feature template. The feature template dimensional structure is consistent with the multidimensional feature space, which includes at least the basic character feature dimension, IPv6 protocol feature dimension, dual-stack parsing association feature dimension, semantic feature dimension, parsing behavior feature dimension, and scenario feature dimension. Specifically, the target application scenario is mapped to the target application scenario attribute dimension and assigned values, the risk type is mapped to the risk semantic category dimension and assigned values, and the IPv6 feature requirements are mapped to the IPv6 protocol feature dimension and dual-stack parsing feature dimension and assigned values. The scenario adaptation module automatically calls the feature template corresponding to the scenario based on user input and performs feature weight adjustments for different scenarios. For example, in the industrial control network scenario, the semantic feature weight of the device word is increased from 0.2 to 0.5 to ensure that the generated domain name conforms to the attack characteristics of this scenario.

[0025] In this embodiment, the feature template is not generated independently through training, but rather formed based on a predefined feature template dimensional structure through rule-based mapping and combination. Specifically, the system predefines a feature template dimensional structure to describe the set of feature dimensions that can be constrained and controlled during the generation of risky domain names. The feature template dimensional structure includes at least an application scenario dimension, a risk type dimension, an IPv6 protocol feature dimension, a dual-stack resolution feature dimension, a domain name structure feature dimension, and a semantic feature dimension.

[0026] In step S2, based on the target application scenario, risk type, and IPv6 feature requirements obtained in step S1, rule matching and mapping are first performed in each corresponding feature dimension to determine the value range or constraints in each feature dimension. For example, when the target application scenario is an industrial control network, the feature identifier corresponding to the industrial control scenario is enabled in the application scenario dimension; when the risk type is malicious communication or C2 domain name, the corresponding risk semantic category identifier is enabled in the risk type dimension; when the IPv6 feature requirement indicates that address embedding is required, feature constraints related to the IPv6 address embedding form and embedding location are enabled in the IPv6 protocol feature dimension.

[0027] Meanwhile, considering that the multidimensional feature space used by the risk domain name generation model has a fixed-dimensional structure, such as a 64-dimensional feature vector, and that not all feature dimensions are suitable for or require explicit user input of constraints, the system uses pre-defined default feature rules to supplement the assignment of values ​​for feature dimensions not explicitly specified by the user during the feature template construction process. Default feature rules describe feature constraints that are generally applicable or basically enabled in an IPv6 dual-stack environment. For example, if not explicitly specified, the dual-stack resolution feature dimension defaults to enabling IPv4 and IPv6 dual-stack resolution association constraints to ensure that the generated risk domain names have resolvability and consistent resolution behavior in a dual-stack environment; in the IPv6 protocol feature dimension, IPv6 address structure legality verification features are enabled by default; in the domain name structure feature dimension, character length range and character composition rules conforming to DNS protocol constraints are enabled by default; and in the resolution behavior feature dimension, resolution frequency and TTL distribution characteristics obtained from historical risk domain name statistics are used as basic constraints by default.

[0028] By combining the feature values ​​obtained from user input mapping with the system's preset default feature values, a feature template covering the complete feature template dimensional structure is formed. The feature template is consistent with the multidimensional feature space used in the training phase of the risk domain name generation model, and is used to impose multidimensional constraints on the subsequent risk domain name generation process. This ensures the compatibility between the template and the feature representation inside the model during the generation phase, and enables flexible construction for different application scenarios, risk types, and IPv6 feature requirements without introducing additional models or learning processes.

[0029] It should also be noted that the feature dimensional structure, dimensional meaning, and value format used in the feature template are consistent with the multidimensional feature space used in the training phase of the risk domain name generation model. Specifically, during model training, each training sample in the historical risk domain name sample set is used to extract and construct a corresponding multidimensional feature vector based on the same feature template dimensional structure, which serves as the conditional input for the character-level sequence generation model. During generation, the constructed feature template is converted into a conditional feature vector according to the same dimensional order, dimensional semantics, and data format as in the training phase, and then input into the risk domain name generation model. This ensures that the feature constraints applied in the generation phase are consistent with the feature representation in the model training phase in terms of structure and semantics. This approach avoids the problem of distorted or uncontrollable model inference results due to inconsistencies in feature definitions between the generation and training phases, ensuring that the risk domain name generation model can perform dual-stack risk domain name generation under the same feature space constraints as the training phase.

[0030] In this embodiment, the feature template is used not only to indicate the values ​​or constraints of each feature dimension, but also to describe the relative importance of each feature dimension in the risk domain name generation process. Therefore, the feature template further includes weight parameters that correspond one-to-one with each feature dimension, representing the degree of contribution of different feature dimensions in the multidimensional feature space.

[0031] Specifically, during the feature template construction process, the system assigns a corresponding weight coefficient to each feature dimension in the feature template's dimensional structure. This weight coefficient, as part of the feature template, is encoded along with the values ​​of each feature dimension, and together they constitute the conditional feature vector input to the risk domain name generation model. The weight coefficients are used to impose different degrees of constraints or guidance on different feature dimensions during the model generation process.

[0032] In this embodiment, the feature dimension weights can be dynamically adjusted according to the target application scenario, risk type, or security strategy. For example, in an industrial control network scenario, the weights of semantic feature dimensions related to device identification, protocol features, or industry terms are increased to enhance the semantic realism of the generated domain name in the industrial control scenario; in a general Internet attack scenario, the weights of character structure features or parsing behavior features are increased to enhance the simulation effect of the generated domain name at the level of character distribution and parsing behavior.

[0033] The adjustment of the feature dimension weights does not change the feature template dimensional structure itself, but is achieved by modifying the weight parameters of each feature dimension in the conditional feature vector. This ensures that the feature template structure remains consistent with the multidimensional feature space used in the training phase of the risk domain name generation model. Through this method, the feature template can achieve flexible weight configuration for different scenarios without changing the model structure, enabling the risk domain name generation process to possess both structural stability and scenario adaptability.

[0034] In step S3, based on the pre-trained risk domain name generation model, the feature template is used as a conditional input to generate a candidate dual-stack risk domain name set, wherein the risk domain name generation model is trained to perform dual-stack risk domain name generation based on a multi-dimensional feature space consistent with the dimensional structure of the feature template. The risk domain name generation model is a character-level sequence generation model based on deep learning. Its training and data preparation process is as follows: First, a historical risk domain name sample set is obtained. The historical risk domain name sample set is constructed from risk domain name data of multi-source IPv6 dual-stack environment. The sample collection includes at least samples from public threat intelligence databases, enterprise private log samples, and manually labeled samples. Among them, the public threat intelligence database samples include IPv6 risk domain name samples from MITRE ATT&CK and CIRCL (including spoofing, C2, and phishing types, totaling 150,000+ records). The enterprise private log samples include abnormal domain names (such as multiple resolutions in a short period of time, associated with malicious IPv6 addresses, totaling 80,000+ records) in the IPv6 dual-stack DNS logs of a certain operator from 2023 to 2024. The manually labeled samples include 50,000+ customized risk domain names manually labeled for IPv6-specific attack scenarios (such as address embedding, dual-stack resolution conflicts). Domains marked as risky domains in the above domain data, or those associated with malicious communication, abnormal resolution behavior, or known attack activities, are identified as risky domain character sequences. Resolution log data, application scenario information, and risk type identification information associated with the risky domain character sequences are obtained to form a basic sample set of historical risky domains.

[0035] Subsequently, the historical risk domain name base sample set underwent cleaning and normalization. Cleaning included removing invalid samples (such as domain names shorter than 3 or longer than 63 characters, or containing illegal characters), and using K-means clustering to remove duplicate samples, ultimately retaining over 220,000 valid samples. Normalization included format standardization and labeling, with IPv6 addresses uniformly converted to compressed format, for example, converting 2001:0db8:0000:0000:0000:0000:1428:57ab to 2001:db8: :1428:57ab, to ensure the consistency of address embedding generation logic, and to support the generation example of IPv6 address compression embedding, such as compressing 2001:db8::1 into the domain name character sequence 2001db80001 and embedding it into the generated domain name; and to label the samples with multi-dimensional tags, including at least risk type (counterfeiting, malicious C2, phishing), IPv6 features (address embedding, dual-stack resolution association), scenario attributes (enterprise network, cloud data center, industrial control network), and semantic features (including brand words, industry words).

[0036] like Figure 3 As shown, for each risk domain name character sequence in the historical risk domain name basic sample set, it is processed through multiple preset feature processing channels to characterize the risk domain name character sequence and related data from different feature dimensions and form corresponding multi-class feature sets. Figure 3 Each feature processing channel outputs a feature set corresponding to its respective dimension. The feature fusion and vectorization module combines the outputs of each channel to form multi-dimensional feature information that corresponds one-to-one with the character sequence of the risky domain name, thus constituting a historical risky domain name sample set. The feature processing channels include at least: an IPv6 feature processing channel for generating an IPv6 protocol feature set; a dual-stack parsing feature processing channel for generating a dual-stack parsing feature set; a domain name structure feature processing channel for generating a domain name structure feature set; a semantic feature processing channel for generating a semantic feature set; and a scenario and risk feature processing channel for generating an application scenario and risk type feature set. The feature sets obtained from each feature processing channel are combined to form multi-dimensional feature information that corresponds one-to-one with the character sequence of the risky domain name.

[0037] The IPv6 protocol feature set should at least include the embedding format, embedding location, address compression representation, and IPv6 address structure legality of the domain name; the dual-stack resolution feature set should at least include the resolution association, resolution mode, and consistency of resolution behavior of the same domain name in both IPv4 and IPv6 dual-stack environments, and further include dual-stack resolution latency difference features, where a resolution latency difference greater than 100ms is considered abnormal; the domain name structure feature set should at least include the domain name character composition (letters, numbers, special symbols, etc.), character distribution characteristics, length distribution, subdomain hierarchical structure, and the proportion of IPv6-oriented address characters; the semantic feature set should at least include the domain name semantic representation, semantic similarity, and brand or industry term identifier features, where semantic similarity can be obtained by comparing with real... The cosine similarity of domain names is calculated, and a similarity greater than 0.8 is considered a high degree of counterfeiting. Examples of brand terms include "bank" and "clud", and examples of industry terms include "it" and "industrial". The set of DNS resolution behavior features includes at least the resolution frequency, associated IP range, and TTL value distribution extracted from historical DNS logs. A resolution frequency greater than 100 times / minute during peak hours is considered abnormal, and a TTL less than 300s indicates a short-lived domain name. The set of application scenario and risk type features includes at least the target application scenario attributes, equipment or industry-related identifiers, and risk semantic category features. For example, industrial control network scenarios can be marked as containing equipment model words (such as "plc" and "dcs"), and cloud data center scenarios can be marked as containing cloud vendor prefixes (such as "ali" and "tencent").

[0038] After obtaining the aforementioned multi-dimensional feature information, feature fusion and vectorization processing are performed on each training sample based on this information to generate a multi-dimensional feature vector corresponding to the character sequence of the risk domain name. This multi-dimensional feature vector has the same dimensional structure as the feature template and serves as a vectorized representation of the multi-dimensional feature space. Based on the multi-dimensional feature vector and the corresponding risk domain name character sequence, a character-level sequence generation model is trained to enable the risk domain name generation model to learn and generate a dual-stack risk domain name character sequence semantically consistent with the multi-dimensional feature vector under the constraint of the multi-dimensional feature vector.

[0039] At the core module implementation level, data collection scripts are deployed to collect IPv6 risky domain name samples from MITRE ATT&CK and enterprise DNS logs and store them in a MySQL database. A Python data cleaning program is run to remove invalid samples and label features. Pandas is used for data formatting, ultimately generating a library of over 220,000 labeled samples. A sample update mechanism is established, automatically collecting approximately 5,000 new samples monthly and updating the model through incremental training. Basic character feature extraction uses Python's `re` library to count character types and the `numpy` library to calculate length distribution and the proportion of address characters. IPv6 protocol feature extraction develops an IPv6 address embedding detection algorithm, matching IPv6 compressed segments (such as "2001db8") in domain names using regular expressions and labeling their embedding positions. Semantic feature extraction is based on a pre-trained BERT model (bert-base-uncased), using the Hugging Face library to extract semantic vectors and calculate similarity with real domain names. DNS resolution behavior feature extraction is based on DNS logs, using the Spark streaming framework to count resolution frequency and associated IP segments and generate behavioral feature vectors.

[0040] like Figure 4 As shown, the basic generative model is a Transformer domain name generation model. Its input layer uses the aforementioned multi-dimensional feature vectors as 64-dimensional conditional feature vectors, combined with randomly initialized character embedding vectors to form the model input. The encoding layer captures the relationships between features through a 6-layer Transformer encoder. The decoding layer uses an autoregressive decoding method to generate domain name character sequences and introduces a semantic constraint layer to ensure that the generated domain names contain specified semantic features. The model training batch size is set to 64, with 150 iterations. The training dataset is divided into training, validation, and test sets in a 7:2:1 ratio. After training, the domain name generation accuracy reaches 89%. In terms of implementation, the Transformer model is built on the TensorFlow 2.x framework with a 6-layer encoder + 6-layer decoder structure. The input feature dimension is set to 64, and the character embedding dimension is set to 128. After training, the model is exported in ONNX format and deployed to a cloud inference engine to support 1000 domain name generation requests per second.

[0041] After completing the initial training based on the historical risk domain name sample set, this embodiment also includes a policy optimization step based on reinforcement learning to further improve the overall quality of candidate dual-stack risk domain names. For example... Figure 4As shown, the Proximal Policy Optimization (PPO) algorithm is used for reinforcement learning optimization, which includes at least the following steps: generating candidate dual-stack risk domains using a risk domain generation model that has completed initial training; performing verification processing on the candidate dual-stack risk domains and constructing reward feedback information based on the verification results of IPv6 feature validity, fidelity, and consistency of dual-stack resolution behavior; and using PPO to update the policy of the risk domain generation model during character-level decoding to adjust the selection probability of each candidate character in subsequent generation processes. The reward function targets fidelity score, IPv6 feature matching degree, and scene adaptability. The fidelity score is obtained by weighting the semantic similarity (calculated by the BERT model) and character distribution similarity (KL divergence) with the real domain name database (weights are 0.6 and 0.4, respectively). IPv6 feature matching degree is used to detect whether the generated domain name contains preset IPv6 features (such as address embedding), and a score is added if it matches. Scene adaptability is used to determine whether the generated domain name conforms to the target scene features (such as industrial control networks needing to contain equipment words), and a score is added if it matches. The reward function is defined as: R = 0.5 × fidelity score + 0.3 × IPv6 feature matching degree + 0.2 × scene fit degree. Through PPO iterative adjustments to the model parameters, the overall score of the generated domain names is improved to above 0.85 (out of 1.0), and the fidelity is increased from the initial 35% to 82%. At the implementation level, the PPO reinforcement learning optimization module can develop an optimizer based on the PyTorch framework, reducing the model loss value to below 0.08 after 150 iterations.

[0042] In step S4, verification processing is performed on each dual-stack risk domain name in the candidate dual-stack risk domain name set. The verification processing includes at least IPv6 feature validity verification, fidelity verification, and dual-stack resolution behavior verification. In this embodiment, the verification processing includes at least the following steps: performing IPv6 feature validity verification on the candidate risk domain names to determine whether the IPv6 address embedding form, embedding position, and address structure in the candidate risk domain names conform to preset IPv6 protocol rules. The verification includes determining the legality of the IPv6 address structure and verifying the address embedding validity. Dual-stack resolution behavior verification is performed on candidate risky domains to determine whether the resolution association and behavior of the candidate risky domains in the IPv4 and IPv6 dual-stack environment meet preset consistency conditions. The consistency conditions are used to constrain the characteristics of dual-stack resolution association attacks and can be combined with abnormal resolution latency differences (greater than 100ms) for judgment. Fidelity verification is performed on candidate risky domains to evaluate the degree of consistency between the candidate risky domains and the distribution characteristics of historical risky domains in terms of character structure, semantic representation, and resolution behavior. Semantic representation can be calculated using the BERT model to calculate semantic similarity, character structure can be evaluated using character distribution similarity, and resolution behavior can be evaluated by combining resolution frequency, associated IP segments, and TTL value distribution. Fidelity verification is used to avoid generated risky domains deviating too much from the semantic and structural distribution of real domains. For example, in a "bank" spoofing scenario, a traditional model might generate "abc123.cm," which is significantly different from the real domain "bankxx.cm." Such domains lack fidelity and cannot be effectively used for protection drills and detection model training; in this embodiment, the fidelity verification step will be judged as failing. The validity of candidate risky domain names is determined based on the results of validity verification, dual-stack resolution behavior verification, and fidelity verification.

[0043] In step S5, based on the verification results, a set of verified dual-stack risk domain names is output. In this embodiment, the output strategy is further implemented as follows: low-quality domain names with scores below 0.7 are removed, and only the set of verified risk domain names is output; the output is dynamically updated, generating a batch of 1000 risk domain names every 5 minutes, supporting push to the security detection system or protection drill platform via API interface to achieve dynamic updates and real-time invocation.

[0044] like Figure 5As shown, the scenario adaptation and dynamic generation process in this embodiment can be executed sequentially: after the user inputs the target scenario, risk type, and IPv6 feature requirements, the scenario adaptation module outputs a customized feature template; the multi-dimensional feature extraction module generates conditional feature vectors based on the feature template and inputs them into the AI ​​generation engine; after the Transformer model generates the initial domain name sequence, the reinforcement learning module calculates the comprehensive score and optimizes it; then the generation result verification is performed, including verifying the address embedding validity through the IPv6 feature detector, comparing it with the real domain name through the semantic similarity detector, and simulating dual-stack resolution through the resolution behavior simulator to verify whether it conforms to the attack behavior; finally, the set of risky domain names that have passed the verification is output and enters the next round of cycle generation. Figure 5 In the temporal sequence shown, user input corresponds to step S1, feature template calling corresponds to step S2, domain name generation and optimization corresponds to step S3, verification processing corresponds to step S4, and risky domain name output after verification corresponds to step S5, thus forming a closed-loop process.

[0045] In a specific test example, a feature template was configured for the scenario of "malicious C2 domains in IPv6 industrial control networks". The template must include features such as containing words related to PLC and DCS devices, embedding the IPv6 address range of industrial control devices (e.g., fe80:: / 10), and a resolution frequency greater than 50 times / minute. After calling the API interface and inputting the above scenario parameters, the engine generated 1,000 risky domains. Through verification by the IPv6 feature detector, 92% of the domains contained valid address embeddings. The generated domains were imported into a security exercise platform for an industrial control network to test the detection rate of the protection system. The initial detection rate was 65%, which increased to 94% after three rounds of model optimization.

[0046] This embodiment provides an example of a generation result verification interface. The verification interface includes at least a generated domain name list display area and a verification result field display area, used to display the generated domain name list, IPv6 feature annotations, fidelity scores, and scenario adaptability assessment results. The generated domain name list display area displays a set of verified risk domain name character sequences, while the verification result field display area displays IPv6 feature annotation information, fidelity scores, scenario adaptability assessment results, and dual-stack resolution behavior verification information for each generated domain name in the list, thus supporting structured presentation and output of the generated results. The output fields include at least the generated domain name character sequence, IPv6 address embedding identifier or embedding form information, dual-stack resolution association status or consistency judgment information, fidelity score field, and scenario matching score field, enabling security detection systems, protection drill platforms, or model training systems to filter, sort, and retrieve the generated results.

[0047] To ensure the quality of the generated results and to continuously adapt to the latest attack methods, this embodiment also includes a result verification and optimization mechanism, which includes two types: offline verification and online feedback. In offline verification, the generated risky domain names are input into existing DNS security detection tools for testing, including Snort and Suricata, and compared with a real IPv6 risky domain name database to calculate the feature matching rate. When the detection rate is greater than 90% and the matching rate is greater than 85%, the model is deemed to meet the standard. In online feedback, usage feedback information from security protection drills is collected, including whether the generated domain names successfully bypassed temporary protection rules and whether they meet the expected attack scenarios. The model parameters are adjusted using the gradient descent method. In iterative optimization, the sample database and feature vectors are updated quarterly based on newly collected IPv6 risky domain name samples, and the model is retrained. The number of newly added samples is 50,000+, to ensure that the generation capability continuously adapts to the latest attack methods.

[0048] In this embodiment, the aforementioned method for dynamically generating DNS risk domains in an IPv6 dual-stack environment runs continuously in a periodic manner, and is divided into two independent but coordinated execution cycles based on different functions: a model training and update cycle and a model call and generation cycle. The model call and generation cycle is used to dynamically generate a set of risk domains based on the currently valid risk domain generation model while keeping the model parameters unchanged; the model training and update cycle is used to retrain or incrementally optimize the risk domain generation model after introducing new historical risk domain samples, so as to update the model parameters and improve the subsequent generation effect.

[0049] The model generation cycle can be set to a short cycle, such as being triggered on a minute or hourly basis, or triggered immediately upon receiving new target application scenarios, risk types, or IPv6 feature requirements. Within this cycle, the system calls the currently deployed risk domain name generation model, generates candidate dual-stack risk domain names based on the latest constructed feature template, and completes IPv6 feature validity verification, dual-stack resolution behavior verification, and fidelity verification. It then outputs a set of verified risk domain names for security detection, protection drills, or model testing. For example, in actual deployment, the generation process can be called every 5 minutes, generating 1000 risk domain names each time to meet the continuous dynamic sample requirements of the protection system.

[0050] The model training and update cycle is relatively long, reflecting the changing characteristics of attack samples over time, and can be set to run weekly, monthly, or quarterly. Within this cycle, the system collects newly added IPv6 dual-stack risk domain name samples from the threat intelligence database, DNS resolution logs, or security event records, updates the historical risk domain name sample set, and retrains the risk domain name generation model or optimizes it using reinforcement learning strategies based on the updated sample set, thereby adjusting the probability distribution of the model in the character-level generation process. For example, in one embodiment, newly added IPv6 risk domain name samples can be aggregated monthly, the model can be centrally trained and updated once, and after training, the updated model can be deployed to the generation engine for risk domain name generation in subsequent cycles.

[0051] By separating the model call generation cycle from the model training update cycle, the risk domain name generation system can periodically absorb the latest attack sample features and update the model parameters while maintaining high-frequency dynamic generation capabilities, thereby achieving continuous operation, dynamic adaptation, and long-term effectiveness of the risk domain name generation process.

[0052] Through the above steps, this embodiment achieves dynamic generation and real-time updating of DNS risk domain names for IPv6 dual-stack environments without relying on static blacklists. It constructs multi-dimensional feature space constraints using multi-source sample libraries, five types of feature channels, and 64-dimensional conditional feature vectors. Combined with Transformer character-level sequence generation and PPO strategy optimization, and after verification of IPv6 feature validity, realism, and dual-stack resolution behavior, it outputs a set of verified dual-stack risk domain names. This provides dynamic, scenario-based, and highly realistic risk domain name samples to support security protection drills and detection model training.

[0053] In summary, this invention integrates protocol features, resolution behavior features, domain name structure features, semantic features, and application scenario features in an IPv6 dual-stack environment into a multi-dimensional feature space. Based on a conditional character-level sequence generation model and a reinforcement learning strategy optimization mechanism, it achieves dynamic and scenario-based generation of risky domain names. This method not only generates highly realistic risky domain names at the character structure and semantic levels but also ensures that the generated results possess reasonable resolution behavior features in both IPv4 and IPv6 dual-stack environments, effectively covering various attack patterns emerging in IPv6 networks. By introducing a multi-dimensional verification mechanism and a reward feedback loop, this invention achieves a balance between generation quality and result controllability, avoiding the problems of traditional static sample libraries being difficult to update and having limited coverage. The overall solution can provide continuous, realistic, and high-quality risky domain name sample support for DNS security detection systems, protection drill platforms, and security model training, demonstrating good engineering feasibility and practical application value.

[0054] Example 2 like Figure 6 As shown, based on the same inventive concept as the above embodiments, the present invention also provides a dynamic generation system for DNS risk domain names in an IPv6 dual-stack environment, comprising: The user input acquisition module is used to acquire the target application scenario, risk type, and IPv6 feature requirements of the user input. The feature template construction module is used to map the target application scenario, risk type and IPv6 feature requirements to the corresponding feature dimensions and assign values ​​based on the predefined feature template dimension structure to obtain the feature template; The risk domain name generation module is used to generate a candidate dual-stack risk domain name set based on the pre-trained risk domain name generation model, taking the feature template as conditional input. The risk domain name generation model is trained to perform dual-stack risk domain name generation based on a multi-dimensional feature space consistent with the dimensional structure of the feature template. The risk domain verification module is used to perform verification processing on each dual-stack risk domain in the candidate dual-stack risk domain set. The verification processing includes at least IPv6 feature validity verification, fidelity verification, and dual-stack resolution behavior verification. The results output module is used to output a set of dual-stack risk domain names that have passed verification based on the results of the verification process.

[0055] Example 3 like Figure 7 As shown, the present invention also provides an electronic device 100 for implementing a method for dynamically generating DNS risk domain names in an IPv6 dual-stack environment; The electronic device 100 includes a memory 101, at least one processor 102, a computer program 103 stored in the memory 101 and executable on at least one processor 102, and at least one communication bus 104.

[0056] The memory 101 can be used to store computer program 103. The processor 102 implements the method for dynamically generating DNS risk domain names in IPv6 dual-stack environment according to embodiment 1 by running or executing the computer program stored in the memory 101 and calling the data stored in the memory 101.

[0057] The memory 101 may primarily include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created based on the use of the electronic device 100 (such as audio data), etc. In addition, the memory 101 may include non-volatile memory, such as hard disk, RAM, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other non-volatile solid-state storage device.

[0058] At least one processor 102 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 102 may be a microprocessor or any conventional processor. Processor 102 is the control center of electronic device 100, connecting various parts of electronic device 100 via various interfaces and lines.

[0059] The memory 101 in the electronic device 100 stores multiple instructions to implement a method for dynamically generating DNS risk domain names in an IPv6 dual-stack environment. The processor 102 can execute multiple instructions to achieve: obtaining the target application scenario, risk type and IPv6 feature requirements input by the user. Based on a predefined feature template dimension structure, the target application scenario, risk type and IPv6 feature requirements are mapped to the corresponding feature dimensions and assigned values ​​to obtain the feature template. Based on the pre-trained risk domain name generation model, the feature template is used as a conditional input to generate a candidate dual-stack risk domain name set. The risk domain name generation model is trained to perform dual-stack risk domain name generation based on a multi-dimensional feature space consistent with the dimensional structure of the feature template. For each dual-stack risk domain in the candidate dual-stack risk domain set, a verification process is performed. The verification process includes at least IPv6 feature validity verification, fidelity verification, and dual-stack resolution behavior verification. Based on the verification results, output the set of dual-stack risk domain names that have passed verification.

[0060] Example 4 If the modules / units integrated in the electronic device 100 are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, and read-only memory (ROM).

[0061] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0062] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0063] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0064] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0065] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0066] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A DNS risk domain name dynamic generation method in an IPv6 dual stack environment, characterized in that, include: Obtain user input regarding the target application scenario, risk type, and IPv6 feature requirements; Based on a predefined feature template dimension structure, the target application scenario, risk type and IPv6 feature requirements are mapped to the corresponding feature dimensions and assigned values ​​to obtain the feature template. Based on the pre-trained risk domain name generation model, the feature template is used as a conditional input to generate a candidate dual-stack risk domain name set. The risk domain name generation model is trained to perform dual-stack risk domain name generation based on a multi-dimensional feature space with the same dimensional structure as the feature template. For each dual-stack risk domain name in the candidate dual-stack risk domain name set, a verification process is performed. The verification process includes at least IPv6 feature validity verification, fidelity verification, and dual-stack resolution behavior verification. Based on the results of the verification process, a set of dual-stack risky domain names that have passed verification is output.

2. The method of claim 1, wherein the method further comprises: The risky domain name generation model is a character-level sequence generation model based on deep learning. The steps for training the risky domain name generation model include: Obtain a historical risk domain name sample set. Each training sample in the historical risk domain name sample set includes at least one known risk domain name character sequence and multi-dimensional feature information corresponding to the risk domain name. The multi-dimensional feature information is used to characterize a multi-dimensional feature space that is consistent with the dimensional structure of a predefined feature template. Based on the multi-dimensional feature information, feature fusion and vectorization processing are performed on each training sample to generate a multi-dimensional feature vector corresponding to the character sequence of the risk domain name. Based on the multidimensional feature vector and the corresponding risk domain name character sequence, the risk domain name generation model is trained using a character-level sequence generation model training method, so that the risk domain name generation model learns to generate a dual-stack risk domain name character sequence that is semantically consistent with the multidimensional feature vector under the constraint of the multidimensional feature vector.

3. The method of claim 2, wherein the method further comprises: The process of generating the historical risky domain name sample set includes: Obtain a basic sample set of historical risk domain names. The basic sample set of historical risk domain names includes at least the character sequence of risk domain names, as well as the resolution log data, application scenario information or risk type identification information associated with each character sequence of risk domain names. For each risk domain name character sequence in the historical risk domain name base sample set, it is processed through multiple preset feature processing channels to characterize the risk domain name character sequence and associated data from different feature dimensions, and form a corresponding set of multiple features. The feature processing channel includes at least: IPv6 feature processing channel used to generate IPv6 protocol feature sets; Dual-stack parsing feature processing channel used to generate dual-stack parsing feature sets; Domain structure feature processing channel used to generate domain structure feature sets; Semantic feature processing channel used to generate semantic feature sets; A scenario and risk feature processing channel used to generate a feature set of application scenarios and risk types; The feature sets obtained from each feature processing channel are combined to form multi-dimensional feature information that corresponds one-to-one with the character sequence of the risk domain name, thereby constituting the historical risk domain name sample set.

4. The method of claim 3, wherein the method further comprises: The IPv6 protocol feature set includes: the IPv6 address embedding format in the domain name, the embedding location, the address compression representation method, and the feature information of the legality of the IPv6 address structure; The dual-stack resolution feature set includes: resolution association, resolution mode, and consistency of resolution behavior for the same domain name in both IPv4 and IPv6 dual-stack environments; The domain name structure feature set includes: domain name character composition, character distribution characteristics, length characteristics, and feature information of subdomain hierarchical structure; The semantic feature set includes: domain name semantic representation, semantic similarity, and feature information of brand words or industry words; The set of application scenarios and risk types includes: target application scenario attributes, equipment or industry-related identifiers, and risk semantic category feature information.

5. The method of claim 4, wherein the method further comprises: The generation of the historical risk domain name base sample set includes: Domain name data is obtained from at least one preset data source, wherein the preset data source includes at least a manually labeled IPv6 attack scenario sample library, a risk domain name library, a threat intelligence library, security event records, a network security monitoring system, or DNS resolution logs; From the acquired domain name data, select domain names that have been marked as risky domain names in the preset data source, or domain names that are associated with malicious communication, abnormal resolution behavior, or known attack activities, and use them as risky domain name character sequences; Obtain the parsing log data, application scenario information, and risk type identification information associated with the character sequence of the risk domain name; The risk domain name character sequence and its associated information are cleaned and normalized, and the risk domain name character sequence is combined with its associated resolution log data, application scenario information and risk type identification information to form the historical risk domain name basic sample set.

6. The method of claim 1, wherein the method further comprises: The verification process performed on dual-stack candidate risky domain names includes at least the following steps: Perform IPv6 feature validity verification on the candidate risk domain names to determine whether the IPv6 address embedding form, embedding position and address structure in the candidate risk domain names conform to the preset IPv6 protocol rules; Perform dual-stack resolution behavior verification on candidate risky domains to determine whether the resolution association and resolution behavior of the candidate risky domains in the IPv4 and IPv6 dual-stack environment meet the preset consistency conditions. A fidelity check is performed on the candidate risk domains to assess the degree of consistency between the candidate risk domains and the distribution characteristics of historical risk domains in terms of character structure, semantic representation, and resolution behavior. Based on the results of the validity verification, dual-stack resolution behavior verification, and fidelity verification, it is determined whether the candidate risky domain name passes the verification.

7. The method of claim 2, wherein the method further comprises: The training process of the risky domain name generation model also includes: a policy optimization step based on reinforcement learning, wherein the policy optimization step includes at least: After initial training based on a historical risk domain name sample set, the risk domain name generation model is used to generate candidate dual-stack risk domain names. Verification processing is performed on the candidate dual-stack risk domain names, and reward feedback information is constructed based on the verification results of IPv6 feature validity, fidelity, and consistency of dual-stack resolution behavior. Based on the reward feedback information, a near-end policy optimization algorithm is used to update the policy of the conditional probability distribution corresponding to the risk domain name generation model during the character-level decoding process, so as to adjust the selection probability of each candidate character by the risk domain name generation model in the subsequent generation process.

8. A DNS risk domain name dynamic generation system in an IPv6 dual stack environment, characterized in that, include: The user input acquisition module is used to acquire the target application scenario, risk type, and IPv6 feature requirements of the user input. The feature template construction module is used to map the target application scenario, risk type and IPv6 feature requirements to the corresponding feature dimensions and assign values ​​based on the predefined feature template dimension structure to obtain the feature template; The risk domain name generation module is used to generate a candidate dual-stack risk domain name set by taking the feature template as conditional input based on a pre-trained risk domain name generation model. The risk domain name generation model is trained to perform dual-stack risk domain name generation based on a multi-dimensional feature space with the same dimensional structure as the feature template. The risk domain name verification module is used to perform verification processing on each dual-stack risk domain name in the candidate dual-stack risk domain name set. The verification processing includes at least IPv6 feature validity verification, fidelity verification, and dual-stack resolution behavior verification. The result output module is used to output a set of verified dual-stack risk domain names based on the results of the verification process.

9. An electronic device, comprising: It includes a processor and a memory, the processor being used to execute a computer program stored in the memory to implement the method for dynamically generating DNS risk domain names in an IPv6 dual-stack environment as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one instruction, which, when executed by a processor, implements the method for dynamically generating DNS risk domain names in an IPv6 dual-stack environment as described in any one of claims 1 to 7.

Images