A malicious domain name detection method based on domain name joint suspiciousness

Abstract

The application belongs to the technical field of network security, and particularly relates to a malicious domain name detection method based on domain name joint suspiciousness, which comprises the following steps: for real network application, DNS log records in a specific time window are selected for labeling and IP quantity statistics, and the suspiciousness of each domain name is calculated; based on domain name access full sequence similarity measurement, the behavior consistency quality between two domain names with common problem IPs is determined based on the mean and standard deviation of the sequence similarity, the number of common problem IPs is used to determine the co-occurrence enhancement factor, and the behavior consistency quality and the co-occurrence enhancement factor are multiplied as the behavior correlation degree of the two domain names; based on the suspiciousness of each domain name and the behavior correlation degree of the two domain names, whether the unknown domain name in any two labeled malicious domain names and unknown domain names with common problem IPs is malicious or not is judged. The application can simultaneously meet the effectiveness, ease of use and sustainability requirements of malicious domain name detection in real network environment.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and more specifically, relates to a method for detecting malicious domain names based on the suspiciousness of domain name association. Background Technology

[0002] The Domain Name System (DNS) is a critical infrastructure of the Internet, providing a mapping service between domain names and IP addresses. However, the openness and convenience of DNS make it a key tool for cyber attackers to carry out various malicious activities.

[0003] Existing methods for detecting malicious domain names mainly fall into two categories: (a) Detection methods based on statistical features. By analyzing the compositional features of domain name strings (such as length, entropy value, vowel ratio, digit ratio, etc.) or DNS traffic statistical features (such as request count, TTL value, NXDOMAIN response ratio, etc.), machine learning or deep learning algorithms are used for classification.

[0004] (ii) Detection method based on association graphs. By constructing graph structures such as domain-IP association graphs and client-domain association graphs, hidden malicious domains are discovered by utilizing associations such as shared IPs and shared clients.

[0005] However, existing methods have the following shortcomings: (1) Character feature-based detection methods rely on labeled data and are not capable of detecting new malicious domain names; (2) Static statistical feature value methods compress time series into statistics, lose key time sequence information, and sudden abnormal behavior in a short period of time is easily masked by long-term average smoothing; (3) Research work based on high-dimensional features has complex feature engineering and is difficult to implement in real network environments; high-value features (such as WHOIS information and passive DNS data) rely on third-party services and are difficult to continuously obtain, which limits the deployability of the method; (4) Methods based on dynamic graph sequence modeling have complex graph structures, large computational overhead, and difficult time cost control, and there are few literature reports on time overhead.

[0006] In summary, existing methods cannot simultaneously meet the requirements of effectiveness, ease of use, and sustainability for malicious domain name detection in a real-world network environment. Summary of the Invention

[0007] In view of the above-mentioned defects or improvement needs of the existing technology, the present invention provides a malicious domain name detection method based on domain name association suspiciousness, which aims to simultaneously meet the requirements of effectiveness, ease of use and sustainability of malicious domain name detection in the real network environment.

[0008] To achieve the above objectives, according to one aspect of the present invention, a method for detecting malicious domain names based on domain name association suspiciousness is provided, comprising: Obtain the DNS log records of the target network within a specific time window, and label the domain names involved in the DNS log records. The labels are divided into three categories: malicious, benign, and unknown. For each domain name that has been labeled, count the total number n of IPs that accessed the domain name within the specified time window, and the number p of problematic IPs associated with the labeled malicious domain name; the suspiciousness of the domain name is represented by the ratio of p to n; The specific time window is divided into T consecutive sub-windows of equal length. For each labeled domain name d, the number of times each problematic IP accesses d within each sub-window is counted, forming the problematic IP within the specific time window. i The sequence of access behaviors S to d di The sequence has a length of T; For any two labeled domains u and v, obtain the set of common problem IPs for both, calculate the similarity between the access behavior sequences of each common problem IP for u and v, and obtain a similarity sequence of length k corresponding to the two domains u and v. Calculate the mean and standard deviation of the similarity of this sequence, where k represents the number of common problem IPs in the set of common problem IPs. If the standard deviation is 0, the mean is used as the behavioral consistency quality of domains u and v; otherwise, the mean is discounted according to the size of the standard deviation, and the discount result is used as the behavioral consistency quality. The larger the standard deviation, the smaller the discount result. Construct a co-occurrence enhancement factor with a value less than or equal to 1 based on the value of k. The larger the k, the larger the value of the co-occurrence enhancement factor. Multiply the co-occurrence enhancement factor by the behavioral consistency quality to obtain the behavioral correlation between domains u and v. For any two marked malicious domains and unknown domains with a common problematic IP, the minimum of the two domains' suspiciousness is multiplied by the corresponding behavioral correlation, and this is taken as the joint suspiciousness of the two domains. If the joint suspiciousness is greater than a preset threshold, the unknown domain is determined to be a malicious domain.

[0009] Furthermore, the method for characterizing the suspiciousness of a domain name based on the ratio of p to n is as follows: calculate the domain name suspiciousness score. This indicates the suspiciousness of the domain name.

[0010] Furthermore, the similarity between the access behavior sequences of each common problem IP for u and v is calculated as follows: Similarity is measured using dynamic time warping, where the bandwidth of the Sakoe-Chiba band in dynamic time warping is set to... ; The similarity obtained using dynamic time warping and the effective active window length penalty factor will be applied. Multiply them, and the result of the multiplication is used as the final similarity value. m=min(nu , n v ), n u and n v The number of sub-windows where the number of non-zero accesses to domain names u and v by the problematic IP within the specific time window is denoted as the effective active window length. This indicates the preset effective active window length threshold.

[0011] further, .

[0012] Furthermore, the behavioral consistency quality of domains u and v is as follows:

[0013] Where Q represents the quality of behavioral consistency, μ is the mean, and σ is the standard deviation.

[0014] Furthermore, the co-occurrence enhancement factor C is determined as follows: .

[0015] Furthermore, the preset threshold corresponding to the joint suspiciousness is determined in the following way: For any two domains that have been marked, if both are malicious domains, they are marked as having a malicious association; if one contains a benign domain, it is marked as not having a malicious association. Set a lower threshold q, and uniformly select Q candidate thresholds t in the interval [q,1]. For the joint suspiciousness of any two non-unknown domains that have been labeled, if the joint suspiciousness is greater than or equal to t, then the two non-unknown domains are recorded as having a malicious association; otherwise, the two non-unknown domains are recorded as not having a malicious association. Calculate the precision and recall of the classification results at each candidate threshold t, and adopt a strategy of prioritizing maximizing precision and maximizing recall when precision is tied, and select the final threshold obtained as the preset threshold.

[0016] According to another aspect of the present invention, an electronic device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the method described above.

[0017] According to another aspect of the invention, a computer-readable storage medium is provided, the computer-readable storage medium including a stored computer program, wherein, when the computer program is run by a processor, it controls the device where the storage medium is located to perform the steps of the method described above.

[0018] According to another aspect of the invention, a computer program product is provided, comprising a computer program or instructions that, when executed by a processor, implement the steps of the method described above.

[0019] In summary, compared with the prior art, the technical solutions conceived by this invention have the following main advantages: This invention proposes a malicious domain name detection method based on domain name association suspiciousness, geared towards real-world applications. It selects DNS log records within a specific time window for annotation and performs IP count statistics. The suspiciousness calculation for each domain name is simple, time-consuming, and easy to deploy and run continuously on a real-world network. Subsequently, it measures similarity based on the entire sequence of domain name accesses, ensuring no traffic temporal characteristics are overlooked and providing sufficient temporal feature measurement. It determines the behavioral consistency quality between two domains with common problematic IPs based on the mean and standard deviation of sequence similarity, and uses the number of common problematic IPs to determine a co-occurrence enhancement factor with a value less than or equal to 1. The behavioral consistency quality and the co-occurrence enhancement factor are multiplied to obtain the behavioral correlation between the two domains. Finally, based on the suspiciousness of each domain and the behavioral correlation between two domains, it judges the malice of any two annotated malicious domains and unknown domains with common problematic IPs. This method simultaneously expresses characteristics that attack activities cannot circumvent, such as domain suspiciousness and temporal consistency, thus effectively detecting malicious domains. Therefore, the method of the present invention discovers domain names that are consistent with known malicious domain name access behavior through DNS traffic analysis, thereby realizing domain name detection and discovering advanced covert threats. It can simultaneously meet the requirements of effectiveness, ease of use and sustainability of malicious domain name detection in real network environment. Attached Figure Description

[0020] Figure 1 This is a flowchart of a malicious domain name detection method based on domain name association suspiciousness provided in an embodiment of the present invention.

[0021] Figure 2 This is a schematic diagram illustrating the construction of the access time sequence and the calculation of edge weights provided in an embodiment of the present invention.

[0022] Figure 3 This is a schematic diagram of weighted isomorphic graph construction provided in an embodiment of the present invention.

[0023] Figure 4 This is a schematic diagram illustrating malicious domain name determination based on joint suspiciousness, provided as an embodiment of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention. Furthermore, the technical features involved in the various embodiments of this invention described below can be combined with each other as long as they do not conflict with each other.

[0025] Example 1 A method for detecting malicious domains based on domain association suspiciousness includes: Obtain the DNS log records of the target network within a specific time window, and label the domain names involved in the DNS log records. The labels are divided into three categories: malicious, benign, and unknown. For each domain name that has been labeled, count the total number n of IPs that accessed the domain name within the specified time window, and the number p of problematic IPs associated with the labeled malicious domain name; the suspiciousness of the domain name is represented by the ratio of p to n; The specific time window is divided into T consecutive sub-windows of equal length. For each labeled domain name d, the number of times each problematic IP accesses d within each sub-window is counted, forming the problematic IP within the specific time window. i The sequence of access behaviors S to d di The sequence has a length of T; For any two labeled domains u and v, obtain the set of common problem IPs for both, calculate the similarity between the access behavior sequences of each common problem IP for u and v, and obtain a similarity sequence of length k corresponding to the two domains u and v. Calculate the mean and standard deviation of the similarity of this sequence, where k represents the number of common problem IPs in the set of common problem IPs. If the standard deviation is 0, the mean is used as the behavioral consistency quality of domains u and v; otherwise, the mean is discounted according to the size of the standard deviation, and the discount result is used as the behavioral consistency quality. The larger the standard deviation, the smaller the discount result. Construct a co-occurrence enhancement factor with a value less than or equal to 1 based on the value of k. The larger the k, the larger the value of the co-occurrence enhancement factor. Multiply the co-occurrence enhancement factor by the behavioral consistency quality to obtain the behavioral correlation between domains u and v. For any two marked malicious domains and unknown domains with a common problematic IP, the minimum of the two domains' suspiciousness is multiplied by the corresponding behavioral correlation, and this is taken as the joint suspiciousness of the two domains. If the joint suspiciousness is greater than a preset threshold, the unknown domain is determined to be a malicious domain.

[0026] Specifically, DNS log data and threat intelligence databases can be used as inputs for labeling. DNS log records must contain at least three fields: timestamp, source IP address, and the queried domain name. Based on malicious domain intelligence and a normal domain database (such as Alexa Top 10000 data), domain names are initially labeled: malicious (label=1), benign (label=0), and unknown (label=2). A more specific labeling method is as follows: label malicious domains involved in the DNS; for each malicious domain, count the set of IPs that accessed the malicious domain within a specific time window; determine the domains accessed by each IP in the set of IPs corresponding to each malicious domain, and label them as benign or unknown domains.

[0027] The design of joint suspiciousness includes the following three layers of meaning: First layer (behavioral association constraints between domains u and v): W uv This reflects whether the access timing behavior of the two domains is consistent. If the two domains are not similar in timing behavior (W uv If the degree of suspicion is relatively small, then even if the degree of suspicion of each is relatively high, they should not form a strong threatening association, that is, they are not considered to have strong homogeneity.

[0028] The second layer (single domain suspicion constraint): min(score(u), score(v)) takes the smaller value of the suspicion scores of the two domains, i.e., the weakest link constraint. This design emphasizes that the domain with the lower suspicion score determines the reliability of threat propagation along the entire edge. Only when both domains have sufficient suspicion scores can there be strong propagation capabilities between them.

[0029] The third layer (multiplicative fusion): The two factors mentioned above are multiplied together. When either factor is lower, the joint suspicion is reduced. This reflects the design idea of ​​"double verification"—the joint suspicion is only high when both conditions of "behavioral similarity" and "both ends are suspicious" are met simultaneously.

[0030] The combined_score ∈ [0,1] indicates that the higher the value, the more reliable the relationship between the two domains is as a malicious propagation relationship.

[0031] This embodiment proposes a malicious domain name detection method based on domain name joint suspiciousness, geared towards real-world applications. It selects DNS log records within a specific time window for annotation and performs IP count statistics. The suspiciousness calculation for each domain name is simple, with controllable time overhead, and is easy to deploy and run continuously on a real-world network. Subsequently, it measures similarity based on the entire sequence of domain name accesses, ensuring no traffic temporal characteristics are overlooked and providing sufficient temporal feature measurement. It determines the behavioral consistency quality between two domains with common problematic IPs based on the mean and standard deviation of sequence similarity, and uses the number of common problematic IPs to determine a co-occurrence enhancement factor with a value less than or equal to 1. The behavioral consistency quality and the co-occurrence enhancement factor are multiplied to obtain the behavioral correlation between the two domains. Finally, based on the suspiciousness of each domain and the behavioral correlation between two domains, it judges the malice of any two annotated malicious domains and unknown domains with common problematic IPs. This method simultaneously expresses characteristics that attack activities cannot circumvent, such as domain suspiciousness and temporal consistency, thus effectively detecting malicious domains. Therefore, the method in this embodiment can simultaneously meet the requirements of effectiveness, ease of use, and sustainability for malicious domain name detection in a real-world network environment.

[0032] As a preferred implementation, the method for characterizing the suspiciousness of a domain name based on the ratio of p to n is as follows: calculate the domain name suspiciousness score. , representing the suspiciousness of the domain name, score(v)∈[0,1].

[0033] The aforementioned specific time window is divided into equal-length continuous sub-windows. For each domain name d, the number of times each problematic IP accesses d within each aggregation window is counted, forming the problematic IP. i The sequence of access behaviors S to d di Where T is the total number of aggregation windows, and S di = (x1, x2, …, x T ) i Subsequently, preferably, Dynamic Time Warping (DTW) can be applied to calculate their similarity, with time warping bandwidth limited and sparse sequence penalty applied during the calculation, to obtain a similarity list Sim={Sim1,Sim2,…, Sim k}, where k is the number of IPs with common issues. Specifically, the similarity between the access behavior sequences of each IP with common issues to u and v is calculated as follows: Similarity is measured using dynamic time warping, where the bandwidth of the Sakoe-Chiba band in dynamic time warping is set to... The similarity obtained by dynamic time warping will be combined with the effective active window length penalty factor. Multiply them, and the result of the multiplication is used as the final similarity value. m=min(n u , n v ), n u and n v The number of sub-windows where the number of non-zero accesses to domain names u and v by the problematic IP within the specific time window is denoted as the effective active window length. This indicates the preset effective active window length threshold.

[0034] In this preferred embodiment, two constraints are introduced into the DTW calculation: Time Warping Bandwidth Constraint: To reduce computational complexity, a Sakoe-Chiba band is introduced to constrain the alignment path search range of DTW. The bandwidth of the Sakoe-Chiba band is set to... T is the sequence length. This bandwidth limit prevents matching of points more than r apart. For example, if the access sequences of the same problematic IP address to two domains are similar but the time difference exceeds r, then they do not exhibit behavioral consistency.

[0035] Effective Activity Window Length Penalty: To avoid false high-similarity matches caused by short effective activity window lengths (for example, a problematic IP may visit two domains within one minute at similar times, but this may be accidental; therefore, a short effective activity window length can lead to false high similarity and misleading malicious domain detection, thus requiring an effective activity window length penalty), a sequence length penalty factor is introduced. Let n be the number of effective activity (non-zero access counts of the problematic IP) sub-windows for domains u and v respectively. u and n v Let m be the effective active window length, and let m = min(n u , n v The penalty length threshold is further preferably set as follows: Effective active window length penalty factor Defined as:

[0036] Where T is the sequence length. When the number of effective active windows is less than 5 / 12 of the total number of windows, the penalty factor decreases quadratically as m decreases, effectively suppressing accidental matching of short sequences. The coefficients used for similarity calculated by DTW are used to obtain the final similarity value.

[0037] We introduce time-warping bandwidth constraints and sparse sequence penalties to avoid spurious matches with short effective active window lengths and effective active window lengths with large time differences.

[0038] Subsequently, the mean of the similarity sequence Sim is calculated. = mean(Sim) and standard deviation = std(Sim). As a preferred implementation, the behavioral quality Q is defined as follows:

[0039] when When Q = 0 (the similarity of all common problem IPs is completely identical), Q = ;when When Q > 0, Q < ,and The larger the value, the more significant the discount; the smaller the value, the more discounts are available.

[0040] Alternatively, as a preferred implementation method, a co-occurrence enhancement factor C can be defined:

[0041] When k=1, C≈0.632; when k≥3, C≈0.95, which is close to saturation, and a small amount of co-occurrence is sufficient to establish a reliable association.

[0042] The behavioral correlation between two domains with a common problem IP is as follows, where W∈[0, 1]: .

[0043] As a preferred implementation, the preset threshold corresponding to the joint suspicion level is determined by the following method: For any two domains that have been marked, if both are malicious domains, they are marked as having a malicious association; if one contains a benign domain, it is marked as not having a malicious association. Set a lower threshold q, and uniformly select Q candidate thresholds t in the interval [q,1]. For the joint suspiciousness of any two non-unknown domains that have been labeled, if the joint suspiciousness is greater than or equal to t, then the two non-unknown domains are recorded as having a malicious association; otherwise, the two non-unknown domains are recorded as not having a malicious association. Calculate the precision and recall of the classification results at each candidate threshold t, and adopt a strategy of prioritizing maximizing precision and maximizing recall when precision is tied, and select the final threshold obtained as the preset threshold.

[0044] It should be noted that, optionally, a weighted isomorphic graph can be introduced when actually implementing the method of this embodiment to facilitate understanding of the method logic and implementation. A detailed explanation follows: (1) Using domain names as nodes and the calculated behavioral correlation as the edge weight between two nodes with common problem IPs, construct a weighted isomorphic graph G=(V, E, W), where V is the set of domain name nodes, E is the set of edges, and W is the set of edge weights. The node feature is the calculated domain name suspiciousness score(v).

[0045] (2) A layered filtering strategy can be adopted during construction: only retain all edges related to malicious nodes, that is, at least one of the two nodes is a node corresponding to a malicious domain name, with the label (1,0), (1,1) or (1,2).

[0046] (3) For each edge e = (u, v) in the graph, its two endpoints u and v have node suspicion scores score(u) and score(v) respectively, and edge weight W. uv Calculate the joint suspicion score for this edge, with a value in the range [0,1]: combined_score(u, v) = W uv × min(score(u), score(v)).

[0047] (4) Before actually performing malicious detection, the threshold for joint suspiciousness can be determined first according to the following method: For each edge e = (u, v), if both ends of the node are malicious nodes ((1,1) edge), it is marked as a malicious edge (label=1), and if it contains benign nodes ((1,0) edge), it is marked as a normal edge (label=0). Set the lower limit of the threshold to, for example, 0.0001, and uniformly select, for example, 200 candidate thresholds in the interval [0.0001,1]. For edges with combined_score ≥ t, classify them as malicious edges, otherwise classify them as normal edges. After traversing all thresholds, calculate the precision and recall of the edge classification results under each threshold. Use the strategy of prioritizing maximizing precision and maximizing recall when precision is equal to select the final classification threshold θ, that is, the aforementioned preset threshold.

[0048] (5) Then, the malicious detection step is entered. The determined threshold θ is applied to the classification of unknown label edges ((1,2) edges). If the combined_score of the edge is greater than or equal to θ, it is classified as a malicious edge, and the unknown node (label=2) in its nodes is classified as a malicious domain.

[0049] (6) Further optional, all unknown domains judged to be malicious are aggregated, sorted in descending order according to the maximum value of the joint suspiciousness of the related edges, and a high-risk candidate list is output for security operations personnel to further analyze.

[0050] Based on the above isomorphic graph detection method, the overall flowchart of the malicious domain name detection method in this embodiment can be understood to include the following functional modules: Node feature calculation module: Calculates the total number of accessing IPs and the number of problematic IPs for each domain within a given time window, and calculates the composite suspiciousness score. As a node feature.

[0051] The temporal sequence construction and edge weight calculation module calculates the DTW similarity of the access time sequences of common problem IPs to the domains for any two domains, and integrates the consistency quality of behavior. Co-occurrence enhancing factor Calculate edge weights .

[0052] Graph construction module: Using domain names as nodes, node suspicion score(v) as node features, domain name shared access relationships as edges, and edge weights W, a weighted isomorphic graph G=(V, E, W) is constructed, and a threat enhancement subgraph is constructed using a hierarchical filtering strategy.

[0053] Joint Suspicion Calculation Module: Calculates the joint suspicion score (combined_score(u, v) = W) for each edge in graph G.uv × min(score(u), score(v)) combines edge weights with node suspicion.

[0054] Threshold selection module: On the known label edge, 200 candidate thresholds are uniformly selected from the interval [0.0001,1]. Precision and recall are calculated for each threshold. The edge classification threshold θ is selected by prioritizing maximizing precision and maximizing recall when precision is tied.

[0055] Domain name detection module: It applies a threshold θ to unlabeled edges. If the combined suspiciousness score (combined_score) is greater than or equal to θ, and the edge contains an unknown domain name node, it is determined to be a malicious domain. The unknown domains determined to be malicious are sorted in descending order of the maximum combined suspiciousness score of their related edges, and output as a high-risk candidate list.

[0056] The following sections provide a more detailed breakdown by module: (1) Node feature calculation Data collection must be conducted within a specified time window (e.g., 24 hours) by collecting DNS request logs from the DNS servers or network egress mirror traffic of the campus / industrial park network. Each log record must contain at least the fields shown in Table 1 below: Table 1. DNS log fields to be collected

[0057] Domains are labeled based on domain blacklists and whitelists (such as threat intelligence databases and Alexa Top 10000 data), with labels divided into three categories: malicious (label=1), benign (label=0), and unknown (label=2).

[0058] Based on this, the suspiciousness of the nodes is calculated: For each domain name d, count its access IP information within the time window: the total number of all IPs accessing the domain name n (deduplicated) and the total number of problematic IPs (IPs that have accessed known malicious domain names) p.

[0059] Calculate the suspicion score: This formula focuses on the proportion of problematic IPs, while also adding a saturation factor to the absolute number of problematic IPs. When p=1, the saturation factor is approximately 0.632, moderately reducing the credibility of evidence from a single IP; when p≥5, the saturation factor approaches 1, and the proportion becomes the dominant factor.

[0060] (2) Construction of access time sequence and calculation of edge weights Figure 2 This demonstrates the process of constructing the access time sequence and calculating edge weights.

[0061] First, the access time series is constructed. The time window is divided into continuous aggregation windows of equal length. For each domain name d, the number of accesses to d by each problematic IP address is counted according to the aggregation window, forming the problematic IP address. i The access sequence S of d di = (x1, x2, …, x T ) i T represents the total number of aggregation windows, i.e., the sequence length. For example, if the time window is 1 day and the aggregation window is 1 minute, then T = 1440. The number of visits per minute from each IP address to d is counted to form S. di It contains 1440 elements, each representing the number of visits within that minute.

[0062] Secondly, DTW similarity calculation. For any two domains u and v, obtain the set of common problematic IPs (i.e., problematic IPs that have visited both u and v).

[0063] For each common problem IP, calculate the Dynamic Time Warping (DTW) similarity (Sim) of the IP's access time series to the two domain names. DTW is a commonly used sequence similarity measurement algorithm in time series data mining. The similarity scores of all common problem IPs are represented by a list Sim = {Sim1, Sim2, ..., Sim...} k}, where k is the number of IPs with common problems.

[0064] Finally, the edge weights W are calculated, as mentioned before, W∈[0, 1]: .

[0065] (3) Graph structure construction Figure 3 The process of constructing a weighted isomorphic graph is demonstrated as follows: Using domain names as nodes, edges are formed between nodes with common problematic IPs, thus constructing a weighted isomorphic graph G=(V, E, W). The edge weights are represented by W, and the node features are represented by the suspicion score (v).

[0066] Layered filtering strategy: Considering that malicious domains account for a very low percentage of real-world network traffic, a layered filtering strategy is adopted to construct a threat enhancement subgraph, retaining only all edges related to malicious nodes to ensure that threat information is not lost.

[0067] (4) Calculation of joint suspicion The combined_score is the core metric, which combines edge weights (reflecting the consistency of temporal behavior between two domains) and the suspiciousness of the two endpoints (reflecting the strength of their association with malicious activities) to assess whether there is a reliable malicious propagation relationship between two domains connected by an edge.

[0068] For each edge e = (u, v) in the graph, where u and v are two domain name nodes, their joint suspiciousness is defined as: combined_score(u,v) = W uv × min(score(u), score(v)) Among them, W uv Let be the edge weight between domains u and v, score(u) and score(v) be the node suspiciousness of domains u and v, and min(score(u), score(v)) be the smaller value of the suspiciousness of the two nodes.

[0069] Furthermore, we use the concepts of edges and nodes to understand the three layers of meaning in the joint suspiciousness design: First layer (edge ​​weight constraint): W uv This reflects whether the access timing behavior of the two domains is consistent. If the two domains are not similar in timing behavior (W uv If the degree of suspicion is relatively small, then even if the degree of suspicion of each is relatively high, they should not form a strong threatening association, that is, they are not considered to have strong homogeneity.

[0070] The second layer (node ​​suspiciousness constraint): min(score(u), score(v)) takes the smaller value of the suspiciousness of the two nodes, i.e., the weakest link constraint. This design emphasizes that the node with lower suspiciousness among the two domains determines the reliability of threat propagation of the entire edge. Only when both ends have sufficient suspiciousness does the edge have strong propagation capability.

[0071] The third layer (multiplicative fusion): The two factors mentioned above are multiplied together. When either factor is lower, the joint suspiciousness is reduced. This reflects the design idea of ​​"double verification"—the combined suspiciousness of an edge is only high when both conditions of "similar behavior" and "both ends are suspicious" are met simultaneously.

[0072] The combined_score ∈ [0,1] indicates that the higher the value, the more reliable the relationship between the two domains connected by the edge is to be a malicious propagation relationship.

[0073] (5) Selection of classification threshold For each edge of the graph, calculate its combined suspiciousness score (combined_score). For each edge e=(u,v), if both ends are malicious nodes (edge ​​(1,1)), it is marked as a malicious edge (label=1); if it contains benign nodes (edge ​​(1,0)), it is marked as a benign edge (label=0). The classification threshold is trained only on edges with known labels.

[0074] (6) Malicious Domain Name Identification and High-Risk List Generation Figure 4The diagram illustrates malicious domain name determination: A threshold θ is applied to the unknown label edges in graph G, i.e., edges with unknown nodes (1,2). If combined_score(u,v) ≥ θ, and u or v is an unknown node, then the unknown node is determined to be a malicious node. If an unknown node is associated with multiple edges, the maximum value of the combined_score of the associated edges is used as the joint suspiciousness score for subsequent ranking of detected malicious nodes. Specifically, all detected malicious nodes are sorted in descending order according to their respective joint suspiciousness scores to obtain a list of high-risk domain names for further analysis by security operations personnel.

[0075] The method described in this embodiment was deployed at the exit of a university campus network to collect DNS log data for 30 days from April 1 to April 30, 2026, with an average daily DNS request volume of approximately 250 million records.

[0076] Data collection Using Microstep OneDNS threat intelligence as a domain blacklist and Alexa Top 10000 data as a domain whitelist, the domains were labeled. A total of 845 malicious domains, 125887 normal domains, and 585178 unknown domains were found in the DNS log data, with malicious domains accounting for approximately 0.12%.

[0077] Node feature calculation The suspiciousness score for each domain name was calculated. The results showed that the average suspiciousness score for malicious domain names was 0.66814, while the average suspiciousness score for benign domain names was 0.46212. The suspiciousness of malicious domain names was significantly higher than that of benign domain names, reflecting the degree of suspiciousness of the domain names and ensuring the accuracy of subsequent malicious domain name detection.

[0078] (3) Graph construction and edge weight calculation Using a one-day time window and a one-minute aggregation window, each domain generates a 1440-dimensional access time sequence daily, and DTW is used to calculate the temporal similarity between domains. Edge weights are fused with behavioral quality Q and co-occurrence enhancement factor C to calculate W=Q×C. A weighted isomorphic graph G=(V, E, W) is constructed daily, and a hierarchical filtering strategy is used to form a threat enhancement subgraph, retaining only edges related to malicious nodes.

[0079] For each edge, it is marked as a malicious edge if it contains a malicious node, a benign edge if it contains a benign node, and an unknown edge if it contains an unknown node. The results show that the 30-day graph contains 31,798 malicious edges, with an average edge weight of 1.6872e. -04 There are 3,322,385 benign edges, with an average edge weight of 1.9601e. -06There are 5,615,473 unknown edges, with an average edge weight of 1.4079e. -06 Malicious edges have the highest edge weight, indicating stronger behavioral consistency among nodes; benign edges and unknown edges have lower edge weights, requiring further analysis to uncover potential malicious domains.

[0080] (4) Calculation of joint suspicion For each edge in the daily graph snapshot, calculate the joint suspiciousness score: combined_score(u,v) = W. uv × min(score(u), score(v)). The results show that the average combined_score of all malicious edges across the 30 graphs is 1.3512e. -04 The average combined score for benign edges is 3.6309e. -08 The average combined_score for unknown edges is 2.3781e. -07 Malicious edges have a significantly higher combined_score than benign edges, demonstrating a clear distinction between the two.

[0081] (5) Threshold selection (based on known label edges) The classification threshold is trained only on malicious and benign edges, with a lower threshold of 0.0001. 200 candidate thresholds are uniformly selected within the interval [0.0001, 1]. For each threshold t, edges satisfying combined_score(u,v) ≥ t are marked as malicious edges; otherwise, they are marked as benign edges. The thresholds are then compared with the edge's true label to calculate precision and recall. A strategy prioritizing maximizing precision, and maximizing recall when precision is tied, is used to select the edge classification threshold θ. The threshold selection for each day of the 30-day graph is shown in Table 2.

[0082] Table 2 DNS log fields to be collected

[0083] (6) Malicious Domain Name Detection (Based on Unknown Edges) A daily threshold is applied to predict unknown edges. For each unknown edge, if combined_score ≥ θ, the unknown node in that edge is considered malicious. For example, the threshold chosen for April 16, 2026 is θ = 5.1246e. -03 The total number of unknown edges on that day was 201,046, of which 12 had combined_scores exceeding the threshold, and 3 related unknown domains were identified as malicious domains (as shown in Table 3).

[0084] Table 3 Unknown Domains as of April 16, 2026

[0085] (7) Summary of test results Within 30 days, a total of 50 high-risk unknown nodes were detected, averaging 1-2 high-risk unknown nodes detected per day. After manual verification through domain intelligence centers such as Microstep Online Intelligence Center, 38 of these were confirmed as malicious domains. Table 4 below lists the top 30 examples: Table 4 Examples of high-risk domain names detected in April 2026

[0086] (8) Time expenditure The main time-consuming stage lies in graph construction for each specific time window (including node features, edge features, and DTW similarity calculation). Taking a 1-day time window, a 1-minute aggregation window, and constructing one graph per day as an example, the average daily time consumption on a 32-core CPU server is 5-25 minutes (depending on the daily log volume). Data collection is directly extracted from log files, with the specific implementation adjusted according to the DNS log format. The total daily time consumption for joint suspiciousness calculation, classification threshold selection, and malicious domain name determination is less than 1 minute, meeting the detection requirements in a real-world network environment.

[0087] Example 2 This application also relates to an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described above.

[0088] The electronic device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The memory can be used to store computer programs and / or modules. The processor performs various functions of the electronic device by running or executing the computer programs and / or modules stored in the memory, and by accessing data stored in the memory.

[0089] The relevant technical solutions are the same as above, and will not be repeated here.

[0090] Example 3 This application also relates to a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described above.

[0091] Specifically, the memory may include high-speed random access memory, as well as non-volatile memory, such as hard disks, RAM, plug-in hard disks, smart media cards (SMC), secure digital (SD) cards, flash cards, at least one disk storage device, flash memory device, or other volatile solid-state storage devices.

[0092] The relevant technical solutions are the same as above, and will not be repeated here.

[0093] Example 4 This application provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of the method described in the above embodiments of this application.

[0094] The relevant technical solutions are the same as above, and will not be repeated here.

[0095] Those skilled in the art will readily understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting malicious domain names based on the suspiciousness of domain name association, characterized in that, include: Obtain the DNS log records of the target network within a specific time window, and label the domain names involved in the DNS log records. The labels are divided into three categories: malicious, benign, and unknown. For each domain name that has been marked, count the total number n of IPs that accessed the domain name within the specified time window, and the number p of problematic IPs that were associated with the marked malicious domain name. The suspiciousness of a domain name is represented by the ratio of p to n; The specific time window is divided into T consecutive sub-windows of equal length. For each labeled domain name d, the number of times each problematic IP accesses d within each sub-window is counted, forming the problematic IP within the specific time window. i The sequence of access behaviors S to d di The sequence has a length of T; For any two labeled domains u and v, obtain the set of common problem IPs for both, calculate the similarity between the access behavior sequences of each common problem IP for u and v, and obtain a similarity sequence of length k corresponding to the two domains u and v. Calculate the mean and standard deviation of the similarity of this sequence, where k represents the number of common problem IPs in the set of common problem IPs. If the standard deviation is 0, the mean is used as the behavioral consistency quality of domains u and v; otherwise, the mean is discounted according to the size of the standard deviation, and the discount result is used as the behavioral consistency quality. The larger the standard deviation, the smaller the discount result. Construct a co-occurrence enhancement factor with a value less than or equal to 1 based on the value of k. The larger the k, the larger the value of the co-occurrence enhancement factor. Multiply the co-occurrence enhancement factor by the behavioral consistency quality to obtain the behavioral correlation between domains u and v. For any two marked malicious domains and unknown domains with a common problematic IP, the minimum of the two domains' suspiciousness is multiplied by the corresponding behavioral correlation, and this is taken as the joint suspiciousness of the two domains. If the joint suspiciousness is greater than a preset threshold, the unknown domain is determined to be a malicious domain.

2. The malicious domain name detection method as described in claim 1, characterized in that, The method for characterizing the suspiciousness of a domain name based on the ratio of p to n is as follows: calculate the domain name suspiciousness score. This indicates the suspiciousness of the domain name.

3. The malicious domain name detection method as described in claim 1, characterized in that, The similarity between the access behavior sequences of each common problem IP for u and v is calculated as follows: Similarity is measured using dynamic time warping, where the bandwidth of the Sakoe-Chiba band in dynamic time warping is set to... ; The similarity obtained using dynamic time warping and the effective active window length penalty factor will be applied. Multiply them, and the result of the multiplication is used as the final similarity value. m=min(n u , n v ), n u and n v The number of sub-windows where the number of non-zero accesses to domain names u and v by the problematic IP within the specific time window is denoted as the effective active window length. This indicates the preset effective active window length threshold.

4. The malicious domain name detection method as described in claim 3, characterized in that, 。 5. The malicious domain name detection method as described in claim 1, characterized in that, The behavioral consistency quality of domains u and v is: Where Q represents the quality of behavioral consistency, μ is the mean, and σ is the standard deviation.

6. The malicious domain name detection method as described in claim 1, characterized in that, The co-occurrence enhancement factor C is determined as follows: .

7. The malicious domain name detection method as described in claim 1, characterized in that, The preset threshold corresponding to the joint suspicion level is determined in the following way: For any two domains that have been marked, if both are malicious domains, they are marked as having a malicious association; if one contains a benign domain, it is marked as not having a malicious association. Set a lower threshold q, and uniformly select Q candidate thresholds t in the interval [q,1]. For the joint suspiciousness of any two non-unknown domains that have been labeled, if the joint suspiciousness is greater than or equal to t, then the two non-unknown domains are recorded as having a malicious association; otherwise, the two non-unknown domains are recorded as not having a malicious association. Calculate the precision and recall of the classification results at each candidate threshold t, and adopt a strategy of prioritizing maximizing precision and maximizing recall when precision is tied, and select the final threshold obtained as the preset threshold.

8. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored computer program, wherein the computer program, when executed by a processor, controls the device on which the storage medium is located to perform the steps of the method as described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method as described in any one of claims 1 to 7.

Images