Risk domain name identification method, device, equipment, storage medium and product

Abstract

The application relates to the technical field of network security, and discloses a risk domain name identification method, device, equipment, storage medium and product, the method comprising the following steps: taking a known risk domain name set as a personalized diffusion source, performing a first-stage PageRank on a full-weighted domain name graph to obtain a coarse recall score, the first-stage PageRank is used for expanding the propagation range, constructing a candidate induced subgraph based on the coarse recall score and the known risk domain name set, performing a second-stage PageRank on the candidate induced subgraph to obtain a risk domain name identification result, and the second-stage PageRank is used for stabilizing the ordering in the subgraph; the application can realize wide recall through the first-stage full-graph coarse PageRank, realize stable ordering through the second-stage subgraph fine PageRank, so that the iteration to convergence on the full graph can be avoided, and the calculation cost can be reduced while the recall range and the ordering accuracy are ensured.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device, storage medium and product for identifying risky domain names. Background Technology

[0002] Currently, internet domain name governance involves a massive number of websites. A single domain name may be associated with other domain names through various relationship networks such as the registration entity, site icon, root domain or trunk, page title, and IP address. Related risky domain name identification methods typically use a single-stage graph diffusion approach to identify risky groups, which cannot balance identification accuracy and computational cost. For example, if the single-stage graph diffusion method iterates directly on the entire graph until convergence, the computational cost is high; if only a few iterations are performed, the accuracy is insufficient. Summary of the Invention

[0003] The main purpose of this application is to provide a method, apparatus, device, storage medium and product for identifying risky domain names, which aims to solve the technical problem that the current risky domain name identification method uses a single-stage graph diffusion approach to identify risky groups, and cannot balance identification accuracy and computational cost.

[0004] To achieve the above objectives, this application provides a method for identifying risky domain names, the method comprising: Using a set of known risky domain names as a personalized diffusion source, the first-stage PageRank is executed on the full weighted domain name graph to obtain a coarse recall score. The first-stage PageRank is used to expand the spread. A candidate inducement subgraph is constructed based on the coarse recall score and the set of known risky domain names; A second-stage PageRank is performed on the candidate induced subgraph to obtain the risk domain identification results. The second-stage PageRank is used to stably rank the domains in the subgraph.

[0005] Optionally, the step of performing a second-stage PageRank on the candidate inducement subgraph to obtain the risk domain identification result includes: A second-stage PageRank is performed on the candidate induced subgraph to obtain the domain risk score; Based on the domain risk score, a high-risk inducement subgraph is constructed, and community discovery is performed based on the high-risk inducement subgraph to obtain domain risk results with community identifiers; Based on the domain name risk score and the community identifier, a joint domain name-level and community-level judgment is performed to obtain the risk domain name identification result.

[0006] Optionally, the step of performing a second-stage PageRank on the candidate inducement subgraph to obtain a domain risk score includes: Construct a second transition probability matrix based on the candidate induced subgraph; Using the known risky domain name set as a personalized vector, iterative propagation is performed on the second transition probability matrix with a second restart probability, where the second restart probability is greater than the first restart probability of PageRank in the first stage; When the difference between scores of two adjacent iterations is less than the preset convergence threshold, or when the number of iterations reaches the preset maximum number of iterations, the iteration stops, and the obtained scores are normalized to obtain the domain name risk score.

[0007] Optionally, constructing the second transition probability matrix based on the candidate induced subgraph includes: The inflow gain coefficient of the target node is determined based on the attributes of each domain name in the candidate inducer subgraph; A second transition probability matrix is ​​constructed based on the edge weights of the candidate induced subgraph and the inflow gain coefficient.

[0008] Optionally, the step of constructing a high-risk inducement subgraph based on the domain name risk score, and performing community discovery based on the high-risk inducement subgraph to obtain domain name risk results with community identifiers, includes: Domains whose risk scores are higher than a preset risk threshold are identified as high-risk nodes, and high-risk edges with both ends of the candidate inducement subgraph are extracted. A high-risk induced subgraph is constructed based on the high-risk nodes and the high-risk edges; With weighted modularity as the optimization objective, the community division of the high-risk induced subgraph is updated iteratively through local node movement and community refinement until the division result is stable; The stabilized community identifiers are backfilled to each domain name, and unassigned identifiers are assigned to nodes that have not entered the community, thus obtaining the risk results of domain names with community identifiers.

[0009] Optionally, the step of performing a joint domain-level and community-level determination based on the domain risk score and the community identifier to obtain the risk domain identification result includes: Based on the domain name risk score and the community identifier, a joint feature is formed, and a domain name-level risk determination is performed according to the joint feature to obtain a domain name-level risk determination result; The probability of domain name risk within the same community is aggregated and statistically analyzed. Based on the aggregation results and the community size, a community-level risk assessment is performed to obtain the community-level risk assessment result. Risk domain identification results are generated based on the domain-level risk assessment results and the community-level risk assessment results.

[0010] Optionally, the step of using a known set of risky domain names as a personalized diffusion source and performing a first-stage PageRank on the full weighted domain name graph to obtain a coarse recall score includes: The edge weights of the full-weighted domain name graph are normalized, and a first transition probability matrix is ​​constructed based on the outgoing edge weights of the source nodes in the processed domain name graph. Using the known risky domain name set as a personalized vector, the first restart probability is used to perform a preset number of iterative propagation on the first transition probability matrix, and the scores obtained from the iterations are normalized to obtain a coarse recall score.

[0011] Optionally, constructing a candidate inducement subgraph based on the coarse recall score and the set of known risky domain names includes: The domain names are sorted in descending order based on the coarse recall score, and a first candidate set is selected from the domain names based on the sorting result; Domains whose coarse recall scores are higher than a preset score threshold are identified as the second candidate set; Domains that share strong relationship fingerprints with domains in the known risk domains set are identified as the third candidate set, where the strong relationship fingerprint is a relationship fingerprint whose document frequency does not exceed a preset upper limit. Based on the ranking results, target domains are selected from the domains, and domains that share strong relationship fingerprints with the target domains are determined as the fourth candidate set; The candidate domain name set is obtained by taking the union of the first candidate set, the second candidate set, the third candidate set, the fourth candidate set, and the known risk domain name set; Extract edges from the full weighted domain name graph that both ends belong to the candidate domain name set, and construct a candidate induced subgraph.

[0012] Optionally, before performing the first-stage PageRank on the full weighted domain name graph using a known set of risky domain names as the personalized diffusion source to obtain a coarse recall score, the process further includes: Receive multi-source domain event records and extract relationship fingerprints from the multi-source domain event records; The relationship fingerprint is filtered by document frequency, and a full weighted domain name graph is constructed based on the filtered relationship fingerprint.

[0013] Optionally, the step of filtering the relationship fingerprint by document frequency and constructing a full weighted domain name graph based on the filtered relationship fingerprint includes: The document frequency of the relation fingerprint is counted, and the relation fingerprint is filtered by relation type based on the document frequency. Calculate the inverse document frequency of the filtered relation fingerprint, and project the domains that share the same relation fingerprint into domain pairs; The edge weights of each domain pair are calculated based on the basic weights corresponding to the relation types and the inverse document frequency, and a full weighted domain graph is constructed based on the edge weights.

[0014] Optionally, receiving multi-source domain name event records and extracting relationship fingerprints from the multi-source domain name event records includes: Receive multi-source domain event records organized by domain name, event type, and payload field; The multi-source domain name event records are standardized. Relational fingerprints with relational semantics are extracted from the normalized multi-source domain event records based on the event type.

[0015] Furthermore, to achieve the above objectives, this application also proposes a risky domain name identification device, which includes: The coarse-grained processing module is used to perform the first-stage PageRank on the full weighted domain name graph, using a set of known risky domain names as a personalized diffusion source, to obtain a coarse recall score. The first-stage PageRank is used to expand the propagation scope. The subgraph construction module is used to construct a candidate inducement subgraph based on the coarse recall score and the set of known risky domain names; A fine-grained processing module is used to perform a second-stage PageRank on the candidate induced subgraph to obtain risk domain name identification results. The second-stage PageRank is used to stably rank the domain in the subgraph.

[0016] Optionally, the fine-grained processing module is further configured to perform a second-stage PageRank on the candidate inducement subgraph to obtain a domain risk score; construct a high-risk inducement subgraph based on the domain risk score, and perform community discovery based on the high-risk inducement subgraph to obtain a domain risk result with a community identifier; and perform joint domain-level and community-level determination based on the domain risk score and the community identifier to obtain a risk domain identification result.

[0017] Optionally, the fine-grained processing module is further configured to construct a second transition probability matrix based on the candidate inducer subgraph; use the known risk domain name set as a personalized vector, and perform iterative propagation on the second transition probability matrix using a second restart probability, wherein the second restart probability is greater than the first restart probability of PageRank in the first stage; when the score difference between two adjacent iterations is less than a preset convergence threshold, or the number of iterations reaches a preset maximum number of iterations, the iteration is stopped, and the obtained score is normalized to obtain the domain name risk score.

[0018] Optionally, the fine-grained processing module is further configured to determine the inflow gain coefficient of the target node based on the attributes of each domain name in the candidate induced subgraph; and to construct a second transition probability matrix based on the edge weights of the candidate induced subgraph and the inflow gain coefficient.

[0019] Optionally, the fine-grained processing module is further configured to identify domains with risk scores higher than a preset risk threshold as high-risk nodes, and extract high-risk edges in the candidate inducement subgraph where both ends are high-risk nodes; construct a high-risk inducement subgraph based on the high-risk nodes and the high-risk edges; update the community division of the high-risk inducement subgraph iteratively through local node movement and community refinement with weighted modularity as the optimization objective, until the division result is stable; backfill the stable community identifiers to each domain name, and assign unassigned identifiers to nodes that have not entered the community, thereby obtaining domain risk results with community identifiers.

[0020] Optionally, the fine-grained processing module is further configured to: construct a joint feature based on the domain name risk score and the community identifier; perform domain name-level risk determination based on the joint feature to obtain a domain name-level risk determination result; aggregate and statistically analyze the domain name risk probabilities within the same community; perform community-level risk determination based on the aggregation result and the community size to obtain a community-level risk determination result; and generate a risk domain name identification result based on the domain name-level risk determination result and the community-level risk determination result.

[0021] In addition, to achieve the above objectives, this application also proposes a risk domain name identification device, which includes a memory, a processor, and a risk domain name identification program stored in the memory and executable on the processor. The risk domain name identification program is configured to implement the risk domain name identification method described above.

[0022] In addition, to achieve the above objectives, this application also proposes a storage medium storing a risky domain name identification program, which, when executed by a processor, implements the risky domain name identification method as described above.

[0023] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a risky domain name identification program, and when the risky domain name identification program is executed by a processor, it implements the risky domain name identification method as described above.

[0024] One or more technical solutions proposed in this application have at least the following technical effects: This application discloses a method that uses a set of known risky domain names as a personalized diffusion source, performs a first-stage PageRank on the full weighted domain name graph to obtain a coarse recall score, and uses the first-stage PageRank to expand the propagation range. Based on the coarse recall score and the set of known risky domain names, a candidate inducement subgraph is constructed, and a second-stage PageRank is performed on the candidate inducement subgraph to obtain the risky domain name identification result. The second-stage PageRank is used to achieve stable ranking in the subgraph. This application achieves broad recall through the first-stage full-graph coarse PageRank and achieves stable ranking through the second-stage subgraph fine PageRank, thereby avoiding iteration to convergence on the full graph and reducing computational costs while ensuring recall range and ranking accuracy. Attached Figure Description

[0025] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0026] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This is a flowchart illustrating the first embodiment of the risky domain name identification method of this application; Figure 2 This is a flowchart illustrating the second embodiment of the risky domain name identification method of this application; Figure 3 This is a flowchart illustrating the third embodiment of the risky domain name identification method of this application; Figure 4 This is a flowchart illustrating the fourth embodiment of the risky domain name identification method of this application; Figure 5 This is an overall flowchart of an embodiment of the risky domain name identification method of this application; Figure 6 This is a schematic diagram of the module structure of the risk domain name identification device according to an embodiment of this application; Figure 7 This is a schematic diagram of the device structure of the hardware operating environment involved in the risk domain name identification method in this application embodiment.

[0028] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0029] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0030] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0031] It should be noted that the application scenarios of this embodiment can be the discovery of malicious website groups, black and gray market domains, abnormal domain groups that build websites in batches or share infrastructure, or it can be extended to the risk identification of network objects with multi-source relationship fingerprints such as accounts, devices, merchants, and content publishers. This embodiment does not limit this.

[0032] The execution entity in this embodiment can be a risk domain identification device with data processing, network communication and program running functions, such as a server, computer, or other electronic devices that can achieve the same or similar functions. This embodiment does not limit this.

[0033] Based on this, the embodiments of this application provide a method for identifying risky domain names, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the risky domain name identification method of this application.

[0034] In the first embodiment, the risky domain name identification method includes: Step S10: Using the known risky domain name set as a personalized diffusion source, perform the first stage PageRank on the full weighted domain name graph to obtain a coarse recall score. The first stage PageRank is used to expand the spread.

[0035] It should be understood that the set of known risky domains can refer to a finite set of domains, denoted as S, that have been pre-labeled by humans, identified by threat intelligence sources, or confirmed by historical actions to have risk attributes. Each domain in the set of known risky domains is assigned an initial risk quality, serving as a monitoring signal and starting point for the entire diffusion process.

[0036] In the personalized PageRank algorithm, the personalized diffusion source refers to the set of nodes used to define the initial probability distribution (i.e., the personalized vector q). In this embodiment, the personalized diffusion source ensures that the restart of each random walk only occurs on nodes in the set of known risky domains S, thereby guaranteeing that the propagation of risk scores has a clear direction, i.e., it spreads from known risky domains to their associated nodes.

[0037] A full-weighted domain name graph can refer to a pre-constructed undirected weighted graph that covers all domain names to be identified, denoted as G=(V,E,W). Here, node V is a domain name, edge E is a shared relation fingerprint between domain names (such as filing entity, icon MD5, title template, IP time window overlap, domain trunk, etc.), and edge weight W is jointly determined by the basic weight of the relation type and the inverse document frequency (IDF) of the relation fingerprint.

[0038] In the specific implementation, a set of known risky domain names is used as the personalized diffusion source. Coarse-grained personalized PageRank calculation is performed on the full weighted domain name graph. This stage uses a relatively small restart probability α. A (e.g., 0.1) and a fixed number of iterations K A (e.g., 6 times) does not require strict convergence. Its purpose is to spread the risk quality along the graph edges to distant nodes with lower computational cost, thereby expanding the recall scope.

[0039] Step S20: Construct a candidate inducement subgraph based on the coarse recall score and the set of known risky domain names.

[0040] In the specific implementation, a candidate domain name set C is constructed based on the coarse recall score and the known risk domain name set. All edges whose two endpoints both belong to the candidate set C are extracted from the full weighted domain name graph to form a candidate inducement subgraph G. C .

[0041] Step S30: Perform a second-stage PageRank on the candidate induced subgraph to obtain the risk domain identification result. The second-stage PageRank is used to stably rank the domain in the subgraph.

[0042] It is understandable that the risk domain identification result can refer to the domain risk score, which can be the domain risk score (denoted as ppr_score) of each candidate domain output by PageRank in the second stage, obtained after normalization of the maximum value. The domain risk score reflects the strength of the association between the domain and the known set of risk domains in the candidate subgraph structure, and can be used as a basis for risk judgment. The higher the score, the greater the probability that the domain belongs to the risk domain.

[0043] Stable ranking in the subgraph can refer to the second stage of PageRank, which, within the relatively closed and controllable graph structure of the candidate induced subgraph, achieves convergence through sufficient iterations, so that the risk scores of each node no longer change significantly with the increase of the number of iterations, thus obtaining a stable and reproducible domain name risk ranking result.

[0044] In the specific implementation, the fine-grained personalized PageRank calculation performed on the candidate induced subgraph uses a relatively large restart probability α.B More maximum iterations K B The algorithm iterates until the score change is less than the convergence threshold ε or until the maximum number of iterations is reached, thus obtaining a stable and accurate node risk ranking within a subgraph of finite size.

[0045] This embodiment achieves broad recall through a first-stage coarse PageRank on the entire graph and a second-stage fine PageRank on the subgraph to achieve stable ranking. This avoids iterating to convergence on the entire graph, thereby reducing computational costs while ensuring recall and ranking accuracy.

[0046] Reference Figure 2 , Figure 2 This is a flowchart illustrating the second embodiment of the risky domain name identification method of this application, based on the above. Figure 1 The first embodiment shown presents a second embodiment of the risk domain name identification method of this application.

[0047] In the second embodiment, step S30 includes: Step S301: Perform the second-stage PageRank on the candidate induced subgraph to obtain the domain risk score.

[0048] In the specific implementation, the fine-grained personalized PageRank calculation performed on the candidate induced subgraph uses a relatively large restart probability α. B More maximum iterations K B The process involves iterating until the score change is less than the convergence threshold ε or until the maximum number of iterations is reached, at which point the iteration stops and the obtained score is normalized to obtain the domain name risk score.

[0049] Step S302: Construct a high-risk inducement subgraph based on the domain name risk score, and perform community discovery based on the high-risk inducement subgraph to obtain domain name risk results with community identifiers.

[0050] It should be understood that a high-risk induced subgraph can refer to a subgraph formed by selecting domain names whose risk scores are greater than a preset risk threshold τ (e.g., 0.0005) from the candidate induced subgraphs as nodes, and retaining all edges whose two endpoints both satisfy the threshold, denoted as G. H .

[0051] The community identifier can refer to the community number assigned to each domain by the community discovery algorithm, denoted as community_id. Domains under the same community identifier are judged to belong to the same risky group. For nodes that are not edged in the high-risk subgraph, have not entered the community, or have not met the risk threshold, a value of -1 can be assigned as an unassigned identifier.

[0052] Domain risk results with community identifiers can refer to intermediate results where each domain carries its domain risk score, adjacency statistics, and community ID after the community identifiers from community discovery are backfilled into the refined PageRank domain table.

[0053] In the specific implementation, a risk threshold τ (e.g., 0.0005) is set, and domain names with a risk score greater than τ are selected from the candidate induced subgraph to form a high-risk node set; all edges whose two endpoints both belong to the high-risk node set are extracted from the candidate induced subgraph to form a high-risk induced subgraph G. H ; for high-risk induced subgraph G H Run the weighted Leiden community detection algorithm, using edge weights to participate in weighted modularity optimization, and set a configurable resolution parameter γ (e.g., 1.0). Iterate until the community division is stable. Backfill the community ID (community_id) output by the community detection algorithm into the domain name result table containing domain name risk score and adjacency features. Assign -1 as an unassigned identifier to nodes that have no edges, have not entered a community, or have not met the threshold in the high-risk subgraph, thus obtaining the domain name risk result with community identifier.

[0054] Step S303: Based on the domain name risk score and the community identifier, perform a joint domain name-level and community-level determination to obtain the risk domain name identification result.

[0055] It is understandable that the risk domain identification result can refer to the final result of the joint judgment output, which includes at least two parts: domain-level result and community-level result.

[0056] In its implementation, a single domain name is used as the judgment unit. The risk decision category (such as HIGH_RISK, REVIEW, REVIEW_SUSPICIOUS, SAFE, SAFE_PROTECTED) is output by comprehensively considering the domain name's risk score, individual domain attributes, seed relationship, evidence level (S1 to S4), and protection status. Domain-level judgment focuses on the sufficiency of risk evidence and protection exemption status for a single domain name.

[0057] Using all domains under the same community identifier as the judgment unit, the median, mean, maximum, high-risk proportion, and review proportion of the risk probability of domains within the community are statistically analyzed. Combined with the lower limit of community size, when both the median risk probability and the proportion of high-risk members reach a threshold, the entire community is judged as a high-risk group. Community-level judgment focuses on the overall risk aggregation degree of the group, avoiding the direct amplification of a single anomaly into community-wide action.

[0058] This embodiment combines the directionality of personalized risk diffusion with the cohesion of community-discovered groups, thereby enabling the output of interpretable and batch-processable risk domain identification results that include both individual domain risk quantification scores and group boundary identifiers.

[0059] Furthermore, in order to obtain a domain risk score with higher accuracy than the coarse recall score in the first stage, and to provide a reliable quantitative basis for subsequent high-risk subgraph extraction and community gang identification, step S201 includes: constructing a second transition probability matrix based on the candidate induced subgraph; using the known risk domain set as a personalized vector, performing iterative propagation on the second transition probability matrix with a second restart probability, wherein the second restart probability is greater than the first restart probability of PageRank in the first stage; stopping the iteration when the score difference between two adjacent iterations is less than a preset convergence threshold, or when the number of iterations reaches a preset maximum number of iterations, and normalizing the obtained score to obtain the domain risk score.

[0060] It should be understood that the second transition probability matrix can refer to the matrix based on the candidate induced subgraph G. C The second restart probability is a matrix constructed from the edge weights to describe the probability that a random walker will move from one node to its neighboring nodes. The second restart probability can be denoted as α, which refers to the probability, in the second phase of the PageRank iterations, that the random walker jumps back to the seed node defined by the personalized vector at each step instead of continuing along the edge. B The preset convergence threshold can be a pre-set upper limit of the score difference used to determine whether the iteration has converged, denoted as ε.

[0061] Furthermore, in order to integrate graph structure risk with domain name business importance attributes while maintaining the normalization of source node transition probabilities, and thereby obtain a domain name risk score that reflects both the strength of risk correlation and the priority of business attention, thus improving the priority of identifying high-impact risk domain names, the step of constructing a second transition probability matrix based on the candidate induced subgraph includes: determining the inflow gain coefficient of the target node based on the attributes of each domain name in the candidate induced subgraph; and constructing a second transition probability matrix based on the edge weights of the candidate induced subgraph and the inflow gain coefficient.

[0062] It should be understood that the inflow gain coefficient can be a coefficient, denoted as b(v), calculated based on the domain name attribute of the target node v and used to amplify or adjust the edge weights flowing into that node. The edge weight can be the weight value of the undirected edge connecting two domain name nodes in the candidate induced subgraph, denoted as w(u,v).

[0063] In the specific implementation, attribute information of each domain name is read from the node attribute table of the candidate inducement subgraph, including index count, access volume, inclusion volume, inclusion level, or business importance, etc.; according to the preset attribute-gain mapping rules, the inflow gain coefficient b(v) is calculated for each target node v, for example, according to the index count threshold: when the index count reaches 10 3 When b(v) = 2, it reaches 10. 4 When b(v) = 3, it reaches 10.5 When b(v) = 5; for domains that do not meet any gain conditions or whose inflow gain is not enabled, b(v) = 1 by default, that is, their original edge weights are not changed.

[0064] Obtain candidate induced subgraph G C Given all nodes and weighted undirected edges, and the inflow gain coefficient b(v) of each target node; expand each undirected edge (u,v) into directed edges in two directions: u→v and v→u; for each directed edge u→v, multiply its edge weight w(u,v) by the inflow gain coefficient b(v) of the target node v to obtain the amplified unnormalized transition weight w(u,v). b(v); For each source node u, calculate the sum of the weights of all its outgoing edges after gain Σ[x∈N(u)]w(u,x) b(x); The normalized transition probability is obtained by dividing the weights of the edges from the source node u to each adjacent node v by the sum of the weights of the outgoing edges from the source node. This forms the second transition probability matrix P', ensuring that the sum of the outgoing edge transition probabilities of each source node is 1.

[0065] A personalized vector q is constructed based on a known set of risky domain names S. Seed nodes are uniformly assigned an initial probability q(v) = 1 / |S|, while non-seed nodes are assigned q(v) = 0. A second restart probability α is set. B , and α B The first restart probability α is greater than the first stage PageRank probability α. A This makes the propagation more focused on the seed neighborhood; initialize the node score vector p B (0), a personalized vector q or a uniform distribution can be used as the initial value; according to the iterative formula Perform iterations, where in each iteration the node moves at an α-order. B The probability of obtaining the injection score from the seed is (1-α) B The probability is obtained from the transition probability along the adjacent nodes containing the inflow gain; the iterative calculation is repeated, and after each iteration, the maximum difference between the scores of two adjacent iterations is calculated. v |p B (k+1)(v)-p B (k)(v)|; Determine if the score difference is less than the preset convergence threshold ε. If so, stop the iteration early. If the score difference is not less than the convergence threshold, determine if the current iteration count has reached the preset maximum iteration count K. B If so, the iteration is forcibly stopped; after the iteration stops, take the score vector of the last round and find the maximum score; divide the final score of each node by the maximum score and normalize it to obtain the domain risk score ppr_score of each domain.

[0066] In one embodiment, αB =0.15, K B =25、ε=10 -4 Inflow gain can be tiered according to index size thresholds, for example, when the index size reaches 10. 3 10 4 10 5 The values ​​are 2, 3, and 5 respectively, or the gain can be turned off and b(v) = 1.

[0067] The fine-grained stage also calculates the degree, weighted_degree, number of direct seed neighbors (bad_neighbor_count), seed neighbor ratio (bad_neighbor_frac), and seed neighbor ratio calculated by edge weight for each domain name, which are used for subsequent evidence stratification, rule determination, and model features.

[0068] Furthermore, in order to classify high-risk nodes into well-connected risk groups within a high signal-to-noise ratio subgraph, and thus obtain domain risk results carrying both individual domain risk scores and group community identifiers, providing a basis for group boundaries for subsequent batch analysis and community-level handling, step S202 includes: identifying domains with domain risk scores higher than a preset risk threshold as high-risk nodes, and extracting high-risk edges in the candidate induced subgraph where both ends are high-risk nodes; constructing a high-risk induced subgraph based on the high-risk nodes and the high-risk edges; using weighted modularity as the optimization objective, iteratively updating the community division of the high-risk induced subgraph through local node movement and community refinement until the division result is stable; backfilling the stable community identifiers to each domain name, and assigning unassigned identifiers to nodes that have not entered the community, thereby obtaining domain risk results with community identifiers.

[0069] It should be understood that weighted modularity, denoted as Q, can be a target function for measuring the quality of community partitioning in a weighted graph. This metric assesses the density of connections within a community by comparing the actual sum of edge weights within the community with the expected sum of edge weights in the random network. A higher weighted modularity value indicates denser edge weights within a community, sparser connections between communities, and better community partitioning quality.

[0070] In the specific implementation, domains with ppr_score greater than the risk threshold τ are selected, and edges in the candidate subgraphs that satisfy the threshold at both ends are retained to form a high-risk induced subgraph G. H For G H The weighted Leiden community discovery algorithm optimizes the weighted modularity objective, with a configurable resolution parameter γ, iterating until the community partitioning stabilizes. Leiden refines communities after each round of local movement, reducing disconnected or weakly connected nodes within communities, making it suitable for further dividing high-risk nodes into actionable groups.

[0071] Community results are backfilled into the refined PPR domain name table in the form of community_id; nodes without edges, not entering a community, or not meeting the threshold in high-risk subgraphs can be assigned a value of -1 as an unassigned identifier. In one embodiment, τ=0.0005 and γ=1.0. The community algorithm can be implemented using a high-performance graph computing library on the driver side, or it can be implemented in a distributed manner; under the condition of maintaining the consistency of input and output schema, algorithms such as Louvain can be used as a compatibility fallback, but Leiden is the preferred implementation.

[0072] Furthermore, in order to combine the detailed risk conclusions of individual domain names with the risk aggregation profile of the entire group, and thus obtain risk domain name identification results that support both precise handling of single domain names and batch analysis of risk groups, thereby improving the granularity and efficiency of risk handling, step S203 includes: forming a joint feature based on the domain name risk score and the community identifier, and performing domain name-level risk judgment based on the joint feature to obtain a domain name-level risk judgment result; aggregating and statistically analyzing the risk probabilities of domain names within the same community, and performing community-level risk judgment based on the aggregation result and the community size to obtain a community-level risk judgment result; and generating a risk domain name identification result based on the domain name-level risk judgment result and the community-level risk judgment result.

[0073] It should be understood that joint features refer to a multi-dimensional feature set organized by domain name after aggregating individual domain information, seed relationships, and community structure information. This feature set includes at least five categories: Category A: Internal community structure features (such as community size, internal density, strong edge ratio, consistency of registration / icons); Category B: Community naming distribution features (such as the proportion of numeric strings, the proportion of short alphanumeric strings, the proportion of low-priced suffixes, and suffix diversity); Category C: External community location features (such as the mean / maximum / median PPR within the community, seed density, and distribution of inclusion levels); Category D: Individual domain features (such as domain attributes, PPR score, degree, strong edge ratio, and lexical features); and Category E: Seed relative features (such as whether it shares a strong fingerprint with a seed, and the proportion of seed neighbors). Joint features enable the decision-making model to identify both known patterns directly connected to seeds and new groups that do not have direct seed anchors but have highly consistent internal structures.

[0074] Domain risk probability can refer to the probability value output by the model classifier in domain-level risk assessment that the domain is a risky domain, denoted as prob_bad, with a value range of [0,1].

[0075] In the specific implementation, based on the domain risk score ppr_score and the community identifier community_id, domain attributes, edge statistics, seed relative relationships and community structure information are aggregated to construct a joint feature table containing five types of features: the internal structure of Class A communities, the naming distribution of Class B communities, the external location of Class C communities, individual Class D domains, and relative relationships of Class E seeds. Each row corresponds to a domain name, as shown in Table 1. Table 1. Classification of Domain Names and Communities by Joint Characteristics

[0076] The joint features are input into a pre-trained classification model (such as an XGBoost binary classification model) to output the risk probability prob_bad for each domain name; or a rule-based branching approach is adopted, matching risk evidence, protection conditions, filing ring features, fingerprint batch features, etc., according to evidence priority, and classifying the domain name into the corresponding decision bucket; evidence levels are generated based on the joint features: S1 is a strong deterministic relationship with the seed-shared filing main number, filing entity, or non-general icon; S2 is the community fingerprint consistency, internal density, seed neighbor ratio, or title template sharing reaching a threshold; S3 is a medium to high PPR but lacks a strong community signature; S4 is dominated by weak edge connections or has a low risk score; combining the risk probability, evidence level, confidence level, and protection status, the decision category (high risk, review, protected but questionable, safe, protected and safe) for each domain name is output to form a domain-level risk judgment result.

[0077] Domains are grouped by community_id, with domains sharing the same community_id grouped into the same community. The domain risk probability (prob_bad) of all domains within each community is aggregated and statistically analyzed to calculate the median, mean, maximum, high-risk member ratio, and review member ratio. The community size is then assessed to determine if it has reached a preset lower limit. If not, the community is prioritized for review or retention, but not directly classified as high-risk. If the community size reaches the lower limit, the community risk probability median is further assessed to determine if it meets both the median threshold and the high-risk member ratio threshold. If both conditions are met, the community is classified as a high-risk group; otherwise, it is either reviewed or retained. For each community, a community_id, community size, aggregated statistics, and community decision category are output, forming a community-level risk assessment result.

[0078] The domain-level risk assessment results are organized into a domain-level result table, which includes the domain name, domain risk score, risk probability, whether it is a seed domain, community identifier, degree, seed neighbor ratio, evidence level, confidence level, decision category, protection status, and main explanatory features. The community-level risk assessment results are organized into a community-level result table, which includes the community identifier, community size, median / mean / maximum risk probability, high-risk ratio, number of seeds, evidence level count, and community decision category. The domain-level results are linked to the community-level results through the community identifier, so that the overall risk decision of the community to which each domain name record belongs can be traced. The domain-level result table and the community-level result table are output to form the risk domain identification results.

[0079] Reference Figure 3 , Figure 3 This is a flowchart illustrating the third embodiment of the risky domain name identification method of this application. Based on the above embodiments, the third embodiment of the risky domain name identification method of this application is proposed.

[0080] In the third embodiment, step S10 includes: Step S101: Normalize the edge weights of the full weighted domain name graph, and construct a first transition probability matrix based on the outgoing edge weights of the source nodes of the processed domain name graph.

[0081] It should be understood that the source node can refer to the node that serves as the starting point for the random walk in a directed transition relation, i.e., the starting node u of the edge. The sum of the outgoing edge weights of the source node can refer to the sum of the normalized weights of all outgoing edges of a source node u, i.e., Σ[x∈N(u)]w'(u,x), where w'(u,x) is the normalized edge weight, and N(u) is the set of adjacent nodes of node u.

[0082] In the specific implementation, all nodes and weighted undirected edges of the full weighted domain name graph G=(V,E,W) are obtained; the edge weights of all edges in the entire graph are traversed, and the maximum edge weight value is found; the edge weight of each edge is divided by the maximum edge weight value to complete the edge weight normalization process, and the normalized edge weight w'(u,v)=w(u,v) / w is obtained. max To ensure that all edge weights fall within the interval [0,1], each undirected edge (u,v) is expanded into directed edges in two directions: u→v and v→u, with each edge weight being a normalized weight w'(u,v). For each source node u, the sum of the normalized weights of all its outgoing edges Σ[x∈N(u)]w'(u,x) is calculated. The normalized edge weight from source node u to each adjacent node v is divided by the sum of the outgoing edge weights of that source node to obtain the transition probability P(u→v)=w'(u,v) / Σ[x∈N(u)]w'(u,x), thus forming the first transition probability matrix P, ensuring that the sum of the outgoing edge transition probabilities of each source node is 1.

[0083] Step S102: Using the known risky domain name set as a personalized vector, perform a preset number of iterative propagation on the first transition probability matrix with the first restart probability, and normalize the scores obtained from the iterations to obtain a coarse recall score.

[0084] A personalized vector q is constructed based on a known set of risky domain names S. Seed nodes are uniformly assigned an initial probability q(v) = 1 / |S|, while non-seed nodes are assigned q(v) = 0. The first restart probability α is set. A (Take the smaller value, such as 0.1) and the preset number of iterations K A (e.g., 6 times); Initialize the node score vector p A (0), a personalized vector q can be used as the initial value; according to the iterative formula p A (k+1)=α A ·q+(1-α A )·P T ·p A (k) Perform iterations, where in each iteration the node moves at an α-order. A The probability of obtaining the injection score from the seed is (1-α) A The probability is obtained by deriving the propagation score from the transition probability of adjacent nodes; the iterative calculation is repeated until the number of iterations reaches the preset number K. A Then stop without judging the convergence condition; find the maximum score in the final round score vector, divide the final score of each node by the maximum score to normalize, and obtain the preliminary recall score of each node.

[0085] This embodiment achieves wide-area diffusion of risk signals on a large-scale full graph with low computational cost by normalizing the edge weights of the full weighted domain name graph and constructing a first transition probability matrix, and by using known risky domain names as personalized vectors and performing a preset number of iterations with a relatively small first restart probability and normalizing them. This results in obtaining a coarse recall score covering long-tail associated nodes, providing a broad-coverage screening basis for the subsequent construction of candidate inducement subgraphs.

[0086] In the third embodiment, step S20 includes: Step S201: Sort the domain names in descending order according to the coarse recall score, and select the first candidate set from the domain names according to the sorting result.

[0087] Step S202: The domains whose coarse recall scores are higher than the preset score threshold are identified as the second candidate set.

[0088] Step S203: Domains that share strong relationship fingerprints with domains in the known risk domain set are identified as the third candidate set, where the strong relationship fingerprint is a relationship fingerprint whose document frequency does not exceed a preset upper limit.

[0089] Step S204: Select target domains from the domains according to the arrangement results, and determine the domains that share strong relationship fingerprints with the target domains as the fourth candidate set.

[0090] Step S205: Take the union of the first candidate set, the second candidate set, the third candidate set, the fourth candidate set, and the known risk domain name set to obtain the candidate domain name set.

[0091] Step S206: Extract edges from the full weighted domain name graph that both ends belong to the candidate domain name set, and construct a candidate induced subgraph.

[0092] In the specific implementation, a candidate domain name set C is constructed. The candidates do not rely on a single PPR truncation, but rather take the union of the following four types of sources, and are required to include all available seeds: C1: Top-K domains sorted in descending order of preliminary_ppr, used to preserve the main propagation paths.

[0093] C2: Preliminary_ppr domains that are higher than the threshold θA, used to retain the long tail of scores.

[0094] C3: Domains that share a strong relationship token with the seed, used to recall nodes within the same group that have been on the same hop.

[0095] C4: Domains that share strong relationship tokens with the top M high PPR nodes, used to recall second-degree relatives and shell-swapped nodes.

[0096] C = C1∪C2∪C3∪C4∪S Strong relationships can include icon_md5, icp_main, icp_ent, title_tmpl, and trunk. Only when df(t) is not greater than the upper limit D of strong tokens is a strong relationship possible. strong Only tokens with specific requirements are included in C3 and C4 expansions to prevent the majority of tokens from overly inflating the candidate set. If the candidate size exceeds C... max If the condition is met, a deterministic backoff is performed, retaining at least the Top-K, seed strong token neighbors, and all seeds; then, edges whose ends both belong to C are extracted from the full graph to form an induced subgraph G. C In one embodiment, K=50000, θ A =10 -4 D strong =200, M=500, C max =300000.

[0097] This embodiment employs a collaborative approach that combines four candidate fusion methods: Top-K selection based on coarse recall scores, score threshold filtering, one-hop expansion of strong seed fingerprints, and second-degree expansion of strong fingerprints of high-scoring nodes, with mandatory inclusion of seeds. It also extracts edges between candidate nodes from the full graph to construct an induced subgraph. This approach preserves the main path of risk propagation and long-tail nodes while recalling shell-changing domains with insufficient coarse scores but strong fingerprint associations. Furthermore, it constructs a comprehensive candidate induced subgraph while controlling the candidate size, providing a broad-coverage, low-noise computational foundation for the second-stage refined PageRank.

[0098] Reference Figure 4 , Figure 4 This is a flowchart illustrating the fourth embodiment of the risky domain name identification method of this application. Based on the above embodiments, the fourth embodiment of the risky domain name identification method of this application is proposed.

[0099] In the fourth embodiment, before step S10, the method further includes: Step S01: Receive multi-source domain name event records and extract relationship fingerprints from the multi-source domain name event records.

[0100] It should be understood that multi-source domain event records can refer to domain-related event data organized by "domain name, event type, and payload field" from different data sources. Event types include WHOIS, ICP filing, page title history, IP resolution history, icon detection, domain attribute information, etc. Each record contains a domain name, the event type to which the record belongs, and the specific payload field content under that type.

[0101] Relationship fingerprints are tokens with relational semantics extracted from multi-source domain event records, used to characterize shared features between domains. They can be categorized by relationship type: registrar (reg), domain name server (ns), ICP main number (icp_main), ICP entity (icp_ent), normalized title template (title_tmpl), C-class IP (ip24), IP time window overlap (ip_overlap), non-generic icon MD5 (icon_md5), and domain trunk. Among these, ICP, icon, title template, and domain trunk are strong relationship fingerprints, while registrars, domain name servers, and C-class IPs are weak relationship fingerprints. Relationship fingerprints are the basis for constructing edges between domains.

[0102] Step S02: Filter the relationship fingerprint by document frequency and construct a full weighted domain name graph based on the filtered relationship fingerprint.

[0103] Understandably, document frequency filtering refers to the operation of filtering relation fingerprints based on their document frequency according to a threshold. By setting minimum document frequency, maximum document frequency ratio, and maximum number of associated domains for different relation types, high-fan-out public fingerprints with excessively high document frequencies (such as public DNS, popular registrars, CDN C-segments, and generic icons) and noisy fingerprints with excessively low document frequencies, the system avoids excessively large connectivity components and false propagation caused by public infrastructure, while also reducing pairwise combination explosions.

[0104] This embodiment employs a progressive approach: receiving multi-source domain name events and extracting heterogeneous relationship fingerprints; filtering relationship fingerprints by document frequency; and jointly weighting and projecting them with basic weights and inverse document frequencies to construct a full-weighted domain name graph. This approach suppresses the pollution of the graph structure by high-frequency public fingerprints such as popular registrars, public DNS, CDN C-segments, and generic icons, allowing rare and reliable shared fingerprints to obtain higher edge weights. Consequently, a low-noise, highly discriminative full-weighted domain name graph is constructed, providing a reliable graph structure foundation for the risk diffusion of the first-stage coarse-grained PageRank.

[0105] Furthermore, in order to improve the accuracy of relation fingerprints, step S01 includes: receiving multi-source domain name event records organized by domain name, event type, and payload field; performing normalization processing on the multi-source domain name event records; and extracting relation fingerprints with relational semantics from the normalized multi-source domain name event records according to the event type.

[0106] In the specific implementation, it receives domain event records organized by "domain name, event type, and payload field," converts the domain names to lowercase, and validates the event types. For different event types, it extracts tokens with relational semantics, while storing scalars such as inclusion level, index quantity, and risk mask as domain attributes, rather than directly using them for edge connections. See Table 2 for details. Table 2 Multi-source event and relation fingerprint mapping table

[0107] One implementation of the title template is as follows: convert the title to lowercase, replace consecutive numbers with uniform placeholders, replace vertical bars, hyphens, underscores, forward slashes, and punctuation with spaces, and calculate the summary value after compressing consecutive whitespace; template tokens are not generated for titles that are too short. For icon relationships, the `has_icon` flag, MD5 validity, a general icon blacklist, and minimum icon size are checked first. For the domain trunk, the longest common suffix is ​​matched first, the `www` prefix is ​​removed, and the last one or two segments that can represent the brand or site group name are retained.

[0108] Furthermore, to improve the reliability of the full weighted domain name graph, step S02 includes: counting the document frequency of the relation fingerprint, and filtering the relation fingerprint by relation type based on the document frequency; calculating the inverse document frequency of the filtered relation fingerprint, and projecting domains sharing the same relation fingerprint into pairs of domain pairs; calculating the edge weight of each domain pair based on the basic weight corresponding to the relation type and the inverse document frequency, and constructing the full weighted domain name graph based on the edge weight.

[0109] In the implementation, the document frequency (df(t)) of each token is calculated for each deduplicated "domain-token-relationship type" record, where N represents the total number of different domains. Minimum document frequency, maximum document frequency ratio, and maximum number of associated domains are set for ip24, ns, reg, and other relationships. High-fanout public DNS, popular registrars, CDN C-segments, and generic icons are filtered before self-connection projection to avoid pairwise combination explosion.

[0110] idf(t)=ln((N+1) / (df(t)+1))+1 For the filtered tokens, each associated domain is projected pairwise into undirected domain pairs and normalized so that src is less than dst. The relation type r has a base weight β. r The contribution of token t to the domain pair (u,v) is β. r ×idf(t); When multiple tokens are shared by the same domain, the final edge weight is obtained by summing the contributions.

[0111] w(u,v)=Σ[t∈T(u)∩T(v)]β relation (t)·idf(t)+w time (u,v) Among them, w time (u,v) represents the time-series IP overlap weight. An ip_overlap edge is established when two domains have resolved to the same IP, and the time intervals [s1,e1] and [s2,e2] satisfy s1≤e2 and s2≤e1. IPs with more than the maximum number of associated domains are filtered first, and multiple records of the same "domain-IP" are merged into the earliest start time and latest end time to reduce duplicate self-joins. See Table 3 for details. Table 3. Basic Relationship Weights

[0112] For ease of understanding, please refer to Figure 5 This is for illustrative purposes only, and does not limit the scope of this application. As an example, Figure 5This is an overall flowchart of an embodiment of the risk domain name identification method of this application. This application uses a risk seed set as a monitoring signal and multi-source relationship fingerprints between domain names as a propagation medium. The system first performs low-cost coarse-grained probing on the full graph, constructing candidate subgraphs using coarse scores and strong fingerprint relationships; then, it performs convergent fine-grained probing on the candidate subgraphs, and accordingly extracts high-risk induced subgraphs for Leiden community detection; finally, it inputs domain name scores, neighbor characteristics, and community characteristics into the model or rule-based decision branch to generate domain name risk, community risk, evidence level, protection status, and explanation reasons. Specific steps include: Step 1: Multi-source domain event access: It receives multi-source domain event records organized by "domain name, event type, and load field," with event sources covering WHOIS, ICP filing, page title history, IP resolution history, icon detection, and domain attributes. It converts domain names to lowercase and verifies event types, extracting relational fingerprints with semantic meaning for different event types. This includes extracting registrars and domain name servers from WHOIS, filing main numbers and filing entities from ICP filing, standardized title templates from title history, C-segment IPs and time ranges from IP history, non-generic icon MD5s from icon detection, and the domain trunk after removing common suffixes from domain names. Simultaneously, it saves scalars such as inclusion level, index volume, and risk markers as domain attributes, without directly using them for edge connections.

[0113] Step 2: Relationship-specific fingerprint mapping: For the deduplicated "domain-relationship fingerprint-relationship type" records, the document frequency of each relationship fingerprint is statistically analyzed. The minimum document frequency, maximum document frequency ratio, and maximum number of associated domains are set according to the relationship type. Public fingerprints with high fan-out, popular registrars, CDNC segments, and common icons are filtered to avoid pair combination explosion and false propagation. The inverse document frequency of the filtered relationship fingerprints is calculated, and the different domains associated with them are projected into undirected domain pairs. The basic weight of the relationship type is multiplied by the inverse document frequency as the edge weight contribution of the fingerprint pair domain pair. When the same domain pair shares multiple fingerprints, the contributions are summed and the time-series weights of the same IP and overlapping historical time windows are superimposed to form the final edge weight, thereby constructing a full weighted domain map covering all domains to be identified.

[0114] Step 3: First stage: Rough PPR of the entire image: The edge weights of the full-weighted domain name graph are normalized based on the maximum edge weight of the entire graph. Undirected edges are expanded into bidirectional directed edges. A first transition probability matrix is ​​constructed based on the outgoing edge weights of each source node. The known set of risky domain names is used as a personalized vector. The initial probability is evenly distributed among the seed nodes. A small first restart probability (e.g., 0.1) is used to perform a fixed number of iterations (e.g., 6 times) on the first transition probability matrix. Strict convergence is not required. This allows the risk quality to spread along the graph edges to distant nodes to expand the recall range. After completing the preset number of iterations, the scores of each node are normalized based on the maximum score of the entire graph to obtain a coarse recall score.

[0115] Step 4: Four-way candidate fusion and induced subgraph: Based on the coarse recall score and the set of known risky domains, a candidate set is constructed from four sources and their union is taken: the first path consists of the Top-K domains sorted in descending order of coarse recall score, used to retain the main propagation paths; the second path consists of domains with coarse recall scores higher than a preset threshold, used to cover the long tail of scores; the third path consists of domains that share strong relationship fingerprints with known risky domains (and the frequency of these fingerprint documents does not exceed a preset upper limit), used to recall nodes in the same group that have a one-hop connection; the fourth path consists of domains that share strong relationship fingerprints with the top M domains with high coarse recall scores, used to recall nodes with second-degree associations and those that have been swapped out; and all known risky domains are forcibly included. If the candidate size exceeds the upper limit, a deterministic fallback is performed, retaining at least the Top-K, strong fingerprint neighbors of the seeds, and all seeds. Subsequently, edges belonging to the candidate domain set at both ends are extracted from the full weighted domain graph to construct a candidate inducement subgraph.

[0116] Step 5: Second stage subgraph refinement PPR: The transition matrix is ​​recalculated on the candidate induced subgraph. The inflow gain coefficient of the target node can be determined based on the index volume, access volume, inclusion volume, or business importance attributes of each domain name. Gains are applied to the edge weights flowing into the target node, and then normalized according to the source node to construct a second transition probability matrix. Using the known set of risky domain names as a personalized vector, iterative propagation is performed on the second transition probability matrix using a second restart probability greater than the first restart probability (e.g., 0.15). When the score difference between two adjacent iterations is less than a preset convergence threshold (e.g., 10), the transition probability is determined. -4 The algorithm can be stopped early or forcibly stopped when the number of iterations reaches the preset maximum number of iterations (e.g., 25). The final score is normalized to the maximum value within the subgraph to obtain the domain name risk score. At the same time, the adjacency statistics characteristics of each domain name, such as degree, weighted degree, number of direct seed neighbors, and proportion of seed neighbors, are calculated.

[0117] Step 6: High-risk subgraph Leiden community discovery: Domains with risk scores higher than a preset risk threshold are identified as high-risk nodes. High-risk edges with both ends being high-risk nodes are extracted from the candidate induced subgraph. A high-risk induced subgraph is formed by high-risk nodes and high-risk edges. The weighted Leiden community detection algorithm is run on the high-risk induced subgraph, with weighted modularity as the optimization objective. The community division is updated iteratively through local node movement and community refinement until the division result is stable. The stable community identifiers are backfilled to each domain. Unassigned identifiers are assigned to nodes in the high-risk subgraph that have no edges or have not entered a community, thus obtaining the domain risk results with community identifiers.

[0118] Step 7: Domain / Group Collusion Determination: Based on domain risk scores and community identifiers, individual domain attributes, PPR results, edge statistics, seed relative relationships, and community structure information are aggregated to form a joint feature comprising five categories: internal community structure, community naming distribution, external community location, individual domains, and seed relative relationships. Domain-level risk assessment is performed based on these joint features, outputting domain risk probabilities through classification models such as XGBoost, or employing a precision-priority rule-based branching approach. Combining evidence levels (S1 to S4), confidence levels, and protection status, the decision category for each domain is output (high risk, under review, protected but questionable, secure, protected and secure). Simultaneously, the risk probabilities of domains within the same community are aggregated and statistically analyzed, calculating the median, mean, maximum, high-risk proportion, and under review proportion. Community-level risk assessment is then performed based on the lower limit of community size. A high-risk group is identified when the community size meets the threshold and both the median risk probability and the proportion of high-risk members reach the threshold.

[0119] Step 8: Result Output and Verification: Integrating domain-level and community-level risk assessment results, the system outputs risk domain identification results that include at least both domain-level and community-level result tables. Domain-level results include the domain name, domain risk score, risk probability, whether it is a seed domain, community identifier, degree, seed neighbor ratio, evidence level, confidence level, decision category, protection status, and key explanatory features. Community-level results include the community identifier, community size, risk probability statistics, high-risk ratio, number of seeds, evidence level count, and community decision category. Domains protected but still with high risk probabilities undergo separate special review; domains reaching the review threshold or with low confidence levels are subject to manual or secondary model review, thus providing an interpretable, verifiable, and accuracy-prioritized basis for risk management.

[0120] One model implementation uses seeds as positive samples. Domains sharing the same registration number or non-generic icon with the seeds are only expanded into positive samples if they simultaneously meet constraints such as low inclusion level, minimum seed density in the community, and a smaller community corresponding to the icon path. This prevents mislabeling caused by large enterprise registration numbers or public icons. Negative samples can be drawn from domains with high inclusion and clean communities, as well as domains with near-zero PPR.

[0121] For the intermediate PPR range, diluted communities with large scale, low proportion of strong edges, low proportion of bad neighbors, and low consistency of registration can be added as negative samples; pure small and medium-sized communities within the set range with high consistency of registration, icon consistency, proportion of strong edges, proportion of numeric strings, or proportion of short alphanumeric characters can be added as positive samples. In case of conflict between positive and negative samples, positive samples take precedence.

[0122] During training, GroupKFold is preferably performed by grouping by seed to ensure that seeds from the same known group do not appear simultaneously in the training and validation folds. If the proportion of ungrouped samples is too high, it reverts to random K-folds. During training, the relative features of class E seeds are randomly set to zero with probability p, forcing the model to learn the non-seed intrinsic patterns of classes A, B, C, and D. One embodiment uses an XGBoost binary classification model, 5-fold cross-validation, and seed feature deactivation with p=0.3, and trains the final model based on the median number of optimal iterations in the validation fold. In scenarios where model training is not required or stronger interpretability is needed, a rule-based alternative branching approach, where the first hit determines the final bucket, can be used. This branch obtains evidence from DOMAIN_INFO, ICP_PART, title history, and strong fingerprint statistics, and distributes the data in the following order: self-risk ironclad evidence, government education protection, genuine registered organization domain name protection, high inclusion protection, registration number protection cluster, registration ring risk, inclusion level review, fingerprint risk cluster, low inclusion structure risk, and normal fallback.

[0123] The protection chain and the risk chain are isolated from each other. The protection chain only allows the has_icp_real records generated by the official filing database as irrefutable evidence. The has_icp of loosely filed websites detected by pages or images can only be used for the risk side's "no filing" judgment. The protection cluster only allows the filing main number as the cluster key and does not use icons or title templates that are easily stolen. The risk side can still use icons, title templates, and filing entities to discover batch website groups.

[0124] For filing rings within the same community that share a main filing account or filing entity and reach a certain scale, the average PPR of the ring is calculated. If the average PPR is low, the title does not contain black content, and the title template is not batched, it can be marked as a scattered group of business information or bidding websites; otherwise, it is marked as a filing resale ring or a risk cluster of batch templates. This mechanism utilizes the structural difference between "normal business information websites operate independently with dispersed image dissemination" and "reselling / cheating rings rely on interconnection and template copying with centralized image dissemination" to reduce false positives caused by judging solely based on the number of filings. See Table 4 for details: Table 4. Examples of Precision-Priority Rule-Based Traffic Splitting

[0125] In one alternative implementation, unsupervised dense subgraph detection is run in parallel from the domain-token bipartite graph. This branch does not use a seed to determine blocks; it only calculates the overlap ratio with the seed after detection is complete to discover new batch groups without known seed anchors.

[0126] w f (d,t)=1 / ln(df(t)+5) For edges in a bipartite graph that satisfy the DF range, the aforementioned anti-spoofing weights are applied. In each round, the weighted degree of nodes on the domain side and the token side is calculated, and nodes with a weighted degree no higher than (1+δ)×average weighted degree are deleted. The intermediate subgraph with the highest density is recorded. After a block is discovered, its domain name is removed, and subsequent blocks are extracted repeatedly. Large, normal sites can be pre-excluded based on their high inclusion level to reduce interference from public infrastructure.

[0127] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the risk domain name identification method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0128] This application also provides a risky domain name identification device, please refer to... Figure 6 The risk domain name identification device includes: The coarse-grained processing module 10 is used to perform a first-stage PageRank on the full weighted domain name graph using a set of known risky domain names as a personalized diffusion source to obtain a coarse recall score. The first-stage PageRank is used to expand the propagation range. Subgraph construction module 20 is used to construct a candidate inducement subgraph based on the coarse recall score and the set of known risky domain names; The fine-grained processing module 30 is used to perform a second-stage PageRank on the candidate induced subgraph to obtain risk domain name identification results. The second-stage PageRank is used to stably rank the domain in the subgraph.

[0129] The risk domain identification device provided in this application, employing the risk domain identification method described in the above embodiments, can solve the technical problem that related risk domain identification methods, which use a single-stage graph diffusion approach to identify risky groups, cannot simultaneously achieve both identification accuracy and computational cost. Compared with the prior art, the beneficial effects of the risk domain identification device provided in this application are the same as those of the risk domain identification method provided in the above embodiments, and other technical features in the risk domain identification device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0130] This application provides a risk domain name identification device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the risk domain name identification method in Embodiment 1 above.

[0131] The following is for reference. Figure 7 The diagram illustrates a structural schematic of a risk domain name identification device suitable for implementing embodiments of this application. The risk domain name identification device in embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 7 The risk domain identification device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0132] like Figure 7As shown, the risk domain identification device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in ROM (Read Only Memory) 1002 or a program loaded from storage device 1003 into RAM (Random Access Memory) 1004. RAM 1004 also stores various programs and data required for the operation of the risk domain identification device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via bus 1005. Input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touch screens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, LCDs (Liquid Crystal Displays), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the risk domain identification device to communicate wirelessly or wiredly with other devices to exchange data. While the figures show risk domain identification devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0133] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0134] The risk domain name identification device provided in this application, employing the risk domain name identification method described in the above embodiments, can solve the technical problem that related risk domain name identification methods, which use a single-stage graph diffusion approach to identify risky groups, cannot simultaneously achieve both identification accuracy and computational cost. Compared with the prior art, the beneficial effects of the risk domain name identification device provided in this application are the same as those of the risk domain name identification method provided in the above embodiments, and other technical features in this risk domain name identification device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0135] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0136] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0137] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the risk domain name identification method in the above embodiments.

[0138] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described risky domain name identification method. This solves the technical problem that related risky domain name identification methods, which use a single-stage graph diffusion approach to identify risky groups, cannot simultaneously achieve both high identification accuracy and high computational cost. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the risky domain name identification method provided in the above embodiments, and will not be elaborated upon here.

[0139] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the risky domain name identification method described above.

[0140] The computer program product provided in this application can solve the technical problem that the single-stage graph diffusion method used in relevant risk domain name identification methods cannot balance identification accuracy and computational cost. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the risk domain name identification method provided in the above embodiments, and will not be repeated here.

[0141] The above description is only a part of the embodiments of this application and does not limit the scope of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included within the protection scope of this application.

[0142] It should be noted that the data collection, tag management, rule setting, and push decision-making processes involved in this application are designed to work with other technical features to solve technical problems. They do not involve or support any illegal activities. Any data processing that may violate laws and regulations (such as unauthorized collection of privacy data, generation of discriminatory tags, setting unfair rules, or pushing illegal information) is not within the scope of protection of this application's technical solution. Of course, the user data in this application will be encrypted, anonymized, or de-identified before storage to ensure user data security.

[0143] This application discloses A1, a method for identifying risky domain names, the method comprising: Using a set of known risky domain names as a personalized diffusion source, the first-stage PageRank is executed on the full weighted domain name graph to obtain a coarse recall score. The first-stage PageRank is used to expand the spread. A candidate inducement subgraph is constructed based on the coarse recall score and the set of known risky domain names; A second-stage PageRank is performed on the candidate induced subgraph to obtain the risk domain identification results. The second-stage PageRank is used to stably rank the domains in the subgraph.

[0144] A2. The risk domain identification method as described in A1, wherein performing a second-stage PageRank on the candidate inducement subgraph to obtain the risk domain identification result includes: A second-stage PageRank is performed on the candidate induced subgraph to obtain the domain risk score; Based on the domain risk score, a high-risk inducement subgraph is constructed, and community discovery is performed based on the high-risk inducement subgraph to obtain domain risk results with community identifiers; Based on the domain name risk score and the community identifier, a joint domain name-level and community-level judgment is performed to obtain the risk domain name identification result.

[0145] A3. The risk domain identification method as described in A2, wherein performing a second-stage PageRank on the candidate inducement subgraph to obtain a domain risk score includes: Construct a second transition probability matrix based on the candidate induced subgraph; Using the known risky domain name set as a personalized vector, iterative propagation is performed on the second transition probability matrix with a second restart probability, where the second restart probability is greater than the first restart probability of PageRank in the first stage; When the difference between scores of two adjacent iterations is less than the preset convergence threshold, or when the number of iterations reaches the preset maximum number of iterations, the iteration stops, and the obtained scores are normalized to obtain the domain name risk score.

[0146] A4. The risk domain identification method as described in A3, wherein constructing the second transition probability matrix based on the candidate inducement subgraph includes: The inflow gain coefficient of the target node is determined based on the attributes of each domain name in the candidate inducer subgraph; A second transition probability matrix is ​​constructed based on the edge weights of the candidate induced subgraph and the inflow gain coefficient.

[0147] A5. The risk domain identification method as described in A2, wherein constructing a high-risk inducement subgraph based on the domain risk score and performing community discovery based on the high-risk inducement subgraph to obtain domain risk results with community identifiers, includes: Domains whose risk scores are higher than a preset risk threshold are identified as high-risk nodes, and high-risk edges with both ends of the candidate inducement subgraph are extracted. A high-risk induced subgraph is constructed based on the high-risk nodes and the high-risk edges; With weighted modularity as the optimization objective, the community division of the high-risk induced subgraph is updated iteratively through local node movement and community refinement until the division result is stable; The stabilized community identifiers are backfilled to each domain name, and unassigned identifiers are assigned to nodes that have not entered the community, thus obtaining the risk results of domain names with community identifiers.

[0148] A6. The risk domain identification method as described in A2, wherein the joint determination at the domain level and community level based on the domain risk score and the community identifier to obtain the risk domain identification result includes: Based on the domain name risk score and the community identifier, a joint feature is formed, and a domain name-level risk determination is performed according to the joint feature to obtain a domain name-level risk determination result; The probability of domain name risk within the same community is aggregated and statistically analyzed. Based on the aggregation results and the community size, a community-level risk assessment is performed to obtain the community-level risk assessment result. Risk domain identification results are generated based on the domain-level risk assessment results and the community-level risk assessment results.

[0149] A7. The risk domain identification method as described in any one of A1 to A6, wherein the step of using a known set of risk domains as a personalized diffusion source and performing a first-stage PageRank on a full-weighted domain graph to obtain a coarse recall score includes: The edge weights of the full-weighted domain name graph are normalized, and a first transition probability matrix is ​​constructed based on the outgoing edge weights of the source nodes in the processed domain name graph. Using the known risky domain name set as a personalized vector, the first restart probability is used to perform a preset number of iterative propagation on the first transition probability matrix, and the scores obtained from the iterations are normalized to obtain a coarse recall score.

[0150] A8. The risk domain name identification method as described in any one of A1 to A6, wherein constructing a candidate inducement subgraph based on the coarse recall score and the known risk domain name set includes: The domain names are sorted in descending order based on the coarse recall score, and a first candidate set is selected from the domain names based on the sorting result; Domains whose coarse recall scores are higher than a preset score threshold are identified as the second candidate set; Domains that share strong relationship fingerprints with domains in the known risk domains set are identified as the third candidate set, where the strong relationship fingerprint is a relationship fingerprint whose document frequency does not exceed a preset upper limit. Based on the ranking results, target domains are selected from the domains, and domains that share strong relationship fingerprints with the target domains are determined as the fourth candidate set; The candidate domain name set is obtained by taking the union of the first candidate set, the second candidate set, the third candidate set, the fourth candidate set, and the known risk domain name set; Extract edges from the full weighted domain name graph that both ends belong to the candidate domain name set, and construct a candidate induced subgraph.

[0151] A9. The risk domain identification method as described in any one of A1 to A6, before the step of performing a first-stage PageRank on the full-weighted domain graph using a known set of risk domains as a personalized diffusion source to obtain a coarse recall score, further includes: Receive multi-source domain event records and extract relationship fingerprints from the multi-source domain event records; The relationship fingerprint is filtered by document frequency, and a full weighted domain name graph is constructed based on the filtered relationship fingerprint.

[0152] A10. The risk domain identification method as described in A9, wherein the step of filtering the relationship fingerprint by document frequency and constructing a full weighted domain name graph based on the filtered relationship fingerprint includes: The document frequency of the relation fingerprint is counted, and the relation fingerprint is filtered by relation type based on the document frequency. Calculate the inverse document frequency of the filtered relation fingerprint, and project the domains that share the same relation fingerprint into domain pairs; The edge weights of each domain pair are calculated based on the basic weights corresponding to the relation types and the inverse document frequency, and a full weighted domain graph is constructed based on the edge weights.

[0153] A11. The risk domain identification method as described in A9, wherein receiving multi-source domain event records and extracting relationship fingerprints from the multi-source domain event records includes: Receive multi-source domain event records organized by domain name, event type, and payload field; The multi-source domain name event records are standardized. Relational fingerprints with relational semantics are extracted from the normalized multi-source domain event records based on the event type.

[0154] This application also discloses B12, a risky domain name identification device, the risky domain name identification device comprising: The coarse-grained processing module is used to perform the first-stage PageRank on the full weighted domain name graph, using a set of known risky domain names as a personalized diffusion source, to obtain a coarse recall score. The first-stage PageRank is used to expand the propagation scope. The subgraph construction module is used to construct a candidate inducement subgraph based on the coarse recall score and the set of known risky domain names; A fine-grained processing module is used to perform a second-stage PageRank on the candidate induced subgraph to obtain risk domain name identification results. The second-stage PageRank is used to stably rank the domain in the subgraph.

[0155] B13. The risk domain identification device as described in B12, wherein the fine-grained processing module is further configured to perform a second-stage PageRank on the candidate inducement subgraph to obtain a domain risk score; construct a high-risk inducement subgraph based on the domain risk score, and perform community discovery based on the high-risk inducement subgraph to obtain a domain risk result with a community identifier; and perform joint domain-level and community-level determination based on the domain risk score and the community identifier to obtain a risk domain identification result.

[0156] B14. The risk domain identification device as described in B13, wherein the fine-grained processing module is further configured to construct a second transition probability matrix based on the candidate inducer subgraph; using the known risk domain set as a personalized vector, perform iterative propagation on the second transition probability matrix using a second restart probability, wherein the second restart probability is greater than the first restart probability of PageRank in the first stage; when the score difference between two adjacent iterations is less than a preset convergence threshold, or the number of iterations reaches a preset maximum number of iterations, stop the iteration, and normalize the obtained score to obtain the domain risk score.

[0157] B15. The risk domain identification device as described in B14, wherein the fine-grained processing module is further configured to determine the inflow gain coefficient of the target node based on the attributes of each domain in the candidate inducement subgraph; and to construct a second transition probability matrix based on the edge weights of the candidate inducement subgraph and the inflow gain coefficient.

[0158] B16. The risk domain identification device as described in B13, wherein the fine-grained processing module is further configured to identify domains whose risk scores are higher than a preset risk threshold as high-risk nodes, and extract high-risk edges in the candidate inducement subgraph where both ends are high-risk nodes; construct a high-risk inducement subgraph based on the high-risk nodes and the high-risk edges; update the community division of the high-risk inducement subgraph iteratively through local node movement and community refinement with weighted modularity as the optimization objective, until the division result is stable; backfill the stable community identifier to each domain name, and assign unassigned identifiers to nodes that have not entered the community, thereby obtaining the domain risk result with community identifiers.

[0159] B17. The risk domain identification device as described in B13, wherein the fine-grained processing module is further configured to: construct a joint feature based on the domain risk score and the community identifier; perform domain-level risk determination based on the joint feature to obtain a domain-level risk determination result; aggregate and statistically analyze the domain risk probabilities within the same community; and perform community-level risk determination based on the aggregation result and the community size to obtain a community-level risk determination result; and generate a risk domain identification result based on the domain-level risk determination result and the community-level risk determination result.

[0160] This application also discloses C18, a risk domain name identification device, the risk domain name identification device comprising: a memory, a processor, and a risk domain name identification program stored in the memory and executable on the processor, wherein the risk domain name identification program, when executed by the processor, implements the risk domain name identification method as described above.

[0161] This application also discloses D19, a storage medium storing a risk domain name identification program, which, when executed by a processor, implements the risk domain name identification method as described above.

[0162] This application also discloses E20, a computer program product including a risk domain identification program, which, when executed by a processor, implements the risk domain identification method as described above.

Claims

1. A method for identifying risky domain names, characterized in that, The method for identifying risky domain names includes: Using a set of known risky domain names as a personalized diffusion source, the first-stage PageRank is executed on the full weighted domain name graph to obtain a coarse recall score. The first-stage PageRank is used to expand the spread. A candidate inducement subgraph is constructed based on the coarse recall score and the set of known risky domain names; A second-stage PageRank is performed on the candidate induced subgraph to obtain the risk domain identification results. The second-stage PageRank is used to stably rank the domains in the subgraph.

2. The risky domain name identification method as described in claim 1, characterized in that, The second-stage PageRank operation on the candidate inducement subgraph to obtain the risk domain identification result includes: A second-stage PageRank is performed on the candidate induced subgraph to obtain the domain risk score; Based on the domain risk score, a high-risk inducement subgraph is constructed, and community discovery is performed based on the high-risk inducement subgraph to obtain domain risk results with community identifiers; Based on the domain name risk score and the community identifier, a joint domain name-level and community-level judgment is performed to obtain the risk domain name identification result.

3. The risky domain name identification method as described in claim 2, characterized in that, The second-stage PageRank operation on the candidate inducement subgraph to obtain the domain risk score includes: Construct a second transition probability matrix based on the candidate induced subgraph; Using the known risky domain name set as a personalized vector, iterative propagation is performed on the second transition probability matrix with a second restart probability, where the second restart probability is greater than the first restart probability of PageRank in the first stage; When the difference between scores of two adjacent iterations is less than the preset convergence threshold, or when the number of iterations reaches the preset maximum number of iterations, the iteration stops, and the obtained scores are normalized to obtain the domain name risk score.

4. The risky domain name identification method as described in claim 3, characterized in that, The step of constructing the second transition probability matrix based on the candidate induced subgraph includes: The inflow gain coefficient of the target node is determined based on the attributes of each domain name in the candidate inducer subgraph; A second transition probability matrix is ​​constructed based on the edge weights of the candidate induced subgraph and the inflow gain coefficient.

5. The risky domain name identification method as described in claim 2, characterized in that, The process of constructing a high-risk inducement subgraph based on the domain name risk score, and performing community discovery based on the high-risk inducement subgraph to obtain domain name risk results with community identifiers, includes: Domains whose risk scores are higher than a preset risk threshold are identified as high-risk nodes, and high-risk edges with both ends of the candidate inducement subgraph are extracted. A high-risk induced subgraph is constructed based on the high-risk nodes and the high-risk edges; With weighted modularity as the optimization objective, the community division of the high-risk induced subgraph is updated iteratively through local node movement and community refinement until the division result is stable; The stabilized community identifiers are backfilled to each domain name, and unassigned identifiers are assigned to nodes that have not entered the community, thus obtaining the risk results of domain names with community identifiers.

6. The risky domain name identification method as described in claim 2, characterized in that, The method of performing joint domain-level and community-level judgment based on the domain risk score and the community identifier to obtain risk domain identification results includes: Based on the domain name risk score and the community identifier, a joint feature is formed, and a domain name-level risk determination is performed according to the joint feature to obtain a domain name-level risk determination result; The probability of domain name risk within the same community is aggregated and statistically analyzed. Based on the aggregation results and the community size, a community-level risk assessment is performed to obtain the community-level risk assessment result. Risk domain identification results are generated based on the domain-level risk assessment results and the community-level risk assessment results.

7. A risky domain name identification device, characterized in that, The risky domain name identification device includes: The coarse-grained processing module is used to perform the first-stage PageRank on the full weighted domain name graph, using a set of known risky domain names as a personalized diffusion source, to obtain a coarse recall score. The first-stage PageRank is used to expand the propagation scope. The subgraph construction module is used to construct a candidate inducement subgraph based on the coarse recall score and the set of known risky domain names; A fine-grained processing module is used to perform a second-stage PageRank on the candidate induced subgraph to obtain risk domain name identification results. The second-stage PageRank is used to stably rank the domain in the subgraph.

8. A risky domain name identification device, characterized in that, The risk domain name identification device includes: a memory, a processor, and a risk domain name identification program stored in the memory and executable on the processor. When the risk domain name identification program is executed by the processor, it implements the risk domain name identification method as described in any one of claims 1 to 6.

9. A storage medium, characterized in that, The storage medium stores a risk domain name identification program, which, when executed by a processor, implements the risk domain name identification method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The computer program product includes a risk domain identification program, which, when executed by a processor, implements the risk domain identification method as described in any one of claims 1 to 6.

Images