Pseudo-random domain name detection method, device and program product

Abstract

The application discloses a pseudo-random domain name detection method, device and program product, and belongs to the technical field of network security. The method comprises the following steps: acquiring domain name attribute data of a to-be-detected domain name; performing multi-level feature extraction processing on the domain name attribute data to obtain character-level features, semantic-level features, network-level features and time sequence-level features of the to-be-detected domain name; performing feature fusion processing on the character-level features, the semantic-level features, the network-level features and the time sequence-level features to obtain domain name fusion features of the to-be-detected domain name; and performing detection processing on the to-be-detected domain name according to the domain name fusion features to obtain a detection result of the to-be-detected domain name; wherein the detection result comprises any one of a normal domain name type or a pseudo-random domain name type. According to the key feature information of the domain name at the four levels of the character level, the semantic level, the network level and the time sequence level, the pseudo-random domain name is accurately detected, and therefore the detection precision of the pseudo-random domain name is effectively improved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus and program product for detecting pseudo-random domain names. Background Technology

[0002] Domain name generation algorithms are a common escape method in botnets. They aim to generate tens of thousands or even hundreds of thousands of pseudo-random domain names in a short period of time using pseudo-random algorithms. Attackers only register a small number of these domain names as actual communication addresses for command and control servers. Because the number of pseudo-random domain names is extremely large and constantly changing, it is difficult for defenders to enumerate all pseudo-random domain names in advance and add them to the blacklist. This leads to serious coverage and detection lag problems in traditional blacklist-based and rule-matching detection methods when faced with massive numbers of pseudo-random domain names.

[0003] To improve the accuracy and efficiency of pseudo-random domain name detection, related technologies generally input the character sequence of the domain name to be tested directly into a pre-trained domain name detection model, which then automatically determines whether the domain name is pseudo-random. However, these technologies rely solely on domain name character information, resulting in a relatively singular feature dimension and neglecting other potential and crucial feature dimensions, thus leading to low detection accuracy of pseudo-random domain names. Summary of the Invention

[0004] The main purpose of this application is to propose a method, apparatus and program for detecting pseudo-random domain names, which aims to effectively improve the detection accuracy of pseudo-random domain names.

[0005] To achieve the above objectives, one aspect of this application proposes a pseudo-random domain name detection method, the method comprising: Obtain the domain attribute data of the domain to be tested; Multi-level feature extraction processing is performed on the domain name attribute data to obtain the character-level features, semantic-level features, network-level features, and time-series features of the domain name to be tested. The character-level features, semantic-level features, network-level features, and temporal-level features are fused to obtain the domain name fusion features of the domain name to be tested. Based on the domain name fusion characteristics, the domain name to be tested is detected and processed to obtain the detection result of the domain name to be tested; wherein, the detection result includes either a normal domain name type or a pseudo-random domain name type.

[0006] Furthermore, the character-level features include character embedding features, character depth features, and character statistical features; the multi-level feature extraction processing of the domain name attribute data to obtain the character-level features, semantic-level features, network-level features, and temporal-level features of the domain name to be tested includes: The domain name attribute data is serialized and embedded to obtain the character embedding feature; The domain name attribute data is subjected to character depth feature extraction processing to obtain the character depth features; The domain name attribute data is processed by character statistical operations to obtain the character statistical features.

[0007] Furthermore, the semantic-level features include lifetime semantic features, query behavior semantic features, and response behavior semantic features; the multi-level feature extraction processing of the domain name attribute data to obtain the character-level features, semantic-level features, network-level features, and time-series features of the domain name to be tested includes: The domain name attribute data is subjected to lifetime semantic modeling to obtain the lifetime semantic features; The domain name attribute data is subjected to query behavior semantic modeling to obtain the query behavior semantic features; The domain attribute data is processed by response behavior semantic modeling to obtain the response behavior semantic features.

[0008] Furthermore, the network-level features include source network features and Domain Name System (DNS) network features; the multi-level feature extraction processing of the domain name attribute data to obtain the character-level features, semantic-level features, network-level features, and temporal-level features of the domain name to be tested includes: The source network topology modeling process is performed on the domain name attribute data to obtain the source network characteristics; The domain name attribute data is processed by domain name system network topology modeling to obtain the domain name system network characteristics.

[0009] Furthermore, the multi-level feature extraction processing of the domain name attribute data to obtain the character-level features, semantic-level features, network-level features, and time-series features of the domain name to be tested includes: The domain name attribute data is subjected to time-series feature extraction processing to obtain the time-series features.

[0010] Further, the step of performing detection processing on the domain name to be tested based on the domain name fusion characteristics to obtain the detection result of the domain name to be tested includes: Based on the domain name fusion features and combined with a pre-trained domain name recognition model, the domain name to be tested is detected to obtain the detection probability of the domain name to be tested. If the detection probability is greater than the probability threshold, the detection result is determined to be the pseudo-random domain name type; otherwise, the detection result is determined to be the normal domain name type.

[0011] Furthermore, the method also includes: The probability threshold is determined based on the domain name attribute data and the preset benchmark threshold.

[0012] Furthermore, the method further includes at least one of the following: Based on the detection results, interpretability analysis is performed on the domain name to be tested to obtain the interpretability analysis results of the domain name to be tested. If the detection result is the pseudo-random domain name type, the domain name to be tested shall be processed.

[0013] To achieve the above objectives, another aspect of this application proposes a pseudo-random domain name detection device, the device comprising: The data acquisition module is used to acquire the domain attribute data of the domain name to be tested. The feature extraction module is used to perform multi-level feature extraction processing on the domain name attribute data to obtain the character-level features, semantic-level features, network-level features and time-series features of the domain name to be tested. The feature fusion module is used to perform feature fusion processing on the character-level features, the semantic-level features, the network-level features, and the temporal-level features to obtain the domain name fusion features of the domain name to be tested. The domain name detection module is used to detect the domain name to be tested based on the domain name fusion characteristics, and obtain the detection result of the domain name to be tested; wherein, the detection result includes either a normal domain name type or a pseudo-random domain name type.

[0014] To achieve the above objectives, another aspect of this application proposes a computer program product, including a computer program that, when executed by a processor, implements the aforementioned pseudo-random domain name detection method.

[0015] According to the pseudo-random domain name detection method, apparatus, and program product provided in this application, firstly, shallow domain name features at four levels—character-level, semantic-level, network-level, and time-series-level—are extracted from the domain name attribute data of the domain name to be tested. This yields character-level features, semantic-level features, network-level features, and time-series-level features of the domain name to be tested. Specifically, character-level features capture the word formation rules and pseudo-randomness of the domain name itself; semantic-level features capture the behavioral semantics of the domain name at the DNS level; network-level features capture the network topology characteristics of the domain name associated with queries and responses at the network access level; and time-series features capture the evolutionary patterns of the domain name over time. Then, the features at these four levels are fused to achieve cross-level feature interaction and fusion, thereby further mining the domain name to be tested. Domain names possess deep domain characteristics hidden at four levels: character level, semantic level, network level, and time-series level. This allows for the acquisition of domain name fusion characteristics for the domain name under test. Finally, based on these fusion characteristics, the domain name under test is processed for detection, yielding detection results. These results include either normal domain name type or pseudo-random domain name type. Thus, by relying on key feature information at four levels—character level, semantic level, network level, and time-series level—pseudo-random domain names can be accurately detected. This process not only retains the ability to perceive the static characteristics of domain name characters but also further enhances the ability to perceive dynamic characteristics such as domain name behavioral semantic intent, domain name network topology characteristics, and domain name time evolution patterns, thereby effectively improving the detection accuracy of pseudo-random domain names.

[0016] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the description and the accompanying drawings. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating a pseudo-random domain name detection method provided in this application; Figure 2 This is a schematic diagram illustrating the principle of character-level feature extraction provided in this application; Figure 3 This is a schematic diagram illustrating the principle of semantic-level feature extraction provided in this application; Figure 4 This is a schematic diagram illustrating the principle of network-level feature extraction provided in this application; Figure 5 This is a schematic diagram illustrating the principle of temporal-level feature extraction provided in this application; Figure 6 This is a flowchart illustrating the pseudo-random domain name detection process provided in this application; Figure 7This is a flowchart illustrating the probability threshold decision-making process provided in this application; Figure 8 This is another flowchart illustrating a pseudo-random domain name detection method provided in this application; Figure 9 This is a schematic diagram illustrating the implementation process of a pseudo-random domain name detection method provided in this application; Figure 10 This is a schematic diagram of the structure of a pseudo-random domain name detection device provided in this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application.

[0019] It is understood that the terms “first,” “second,” etc., used in this application may be used herein to describe various concepts, but unless otherwise stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to a determination” as used herein may be interpreted as “when…” or “when…” or “in response to a determination.”

[0020] As used in this application, the terms "at least one", "multiple", "each", "any", etc., "at least one" includes one, two or more, "multiple" includes two or more, "each" refers to each of the corresponding multiples, and "any" refers to any one of the multiples.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0022] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as domain name attribute data, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirects to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the normal operation of embodiments of this application obtained.

[0023] Botnets are a major threat in the field of cybersecurity. Attackers implant malware into infected hosts, turning them into bots, and then use a command and control (C&C) server to control all bots, thus forming a one-to-many control network. This network can be used to launch malicious activities such as distributed denial-of-service (DDoS) attacks, information theft, network fraud, and spam.

[0024] Domain Generation Algorithm (DGA) is a common escape method in botnets. It aims to generate tens of thousands or even hundreds of thousands of pseudo-random domain names in a short period of time using pseudo-random algorithms. Attackers only register a small number of these domain names as the actual communication addresses of C&C servers. Due to the extremely large number of pseudo-random domain names and their continuous changes, it is difficult for defenders to enumerate all pseudo-random domain names in advance and add them to the blacklist. This leads to serious coverage and detection lag problems in traditional blacklist-based and rule-matching detection methods when faced with massive numbers of pseudo-random domain names.

[0025] To improve the detection accuracy and efficiency of pseudo-random domain names, related technologies generally adopt an end-to-end detection framework based on deep learning (DL). The core idea is to directly input the character sequence of the domain name to be tested into a pre-trained domain name detection model, which then automatically determines whether the domain name is pseudo-random. However, these technologies rely solely on domain name character information, resulting in a relatively singular feature dimension and neglecting other potential and crucial feature dimensions, thus leading to low detection accuracy for pseudo-random domain names.

[0026] In view of this, embodiments of this application provide a pseudo-random domain name detection method, apparatus, and program product. This solution accurately detects pseudo-random domain names based on key feature information of domain names at four levels: character level, semantic level, network level, and time level. This enables the detection process of pseudo-random domain names to not only retain the ability to perceive the static characteristics of domain name characters, but also to further possess the ability to perceive the dynamic characteristics such as the semantic intent of domain name behavior, the network topology characteristics of domain names, and the time evolution rules of domain names, thereby effectively improving the detection accuracy of pseudo-random domain names.

[0027] First, the implementation steps of a pseudo-random domain name detection method provided in this application will be described in detail below with reference to the accompanying drawings.

[0028] The pseudo-random domain name detection method provided in this application relates to the field of network security technology. The pseudo-random domain name detection method provided in this application can be applied to a terminal, a server, or software running on a terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or in-vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the pseudo-random domain name detection method, but is not limited to the above forms.

[0029] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0030] Reference Figure 1 This application provides a pseudo-random domain name detection method, which may include the following steps S101-S104.

[0031] S101, Obtain the domain attribute data of the domain to be tested.

[0032] It should be noted that the domain name to be tested refers to the domain name to be determined as a pseudo-random domain name.

[0033] In this step, during the identification of pseudo-random domain names, it is necessary to first determine the domain name to be tested, and then use the domain name to be tested as an index to search and aggregate the corresponding Domain Name System (DNS) data, such as DNS query logs, DNS response logs, passive DNS records, etc., and further obtain the domain name attribute data of the domain name to be tested, so as to provide reliable data input for subsequent processing.

[0034] It is worth noting that domain attribute data can include, but is not limited to, strings, short-term attribute data, and long-term attribute data. Among them, short-term attribute data indicates the short-term performance of the domain under test in terms of query, response, and lifespan, while long-term attribute data indicates the long-term performance of the domain under test, such as activity level, response stability, and passive DNS data.

[0035] Optionally, short-term attribute data can be set according to actual conditions, and this application embodiment does not specifically limit this.

[0036] For example, short-term attribute data may include, but is not limited to, the received response data of at least one DNS event involving the domain name under test within the first time window, and the number of DNS events involving the domain name under test within the first time window. The received response data may include, but is not limited to, DNS query type, DNS query timestamp, DNS response code, Time To Live (TTL), source Internet Protocol (IP) address, source port number, and response return IP address.

[0037] It's important to note that DNS query types can be categorized into A, AAAA, MX, TXT, CNAME, NS, etc. A DNS query timestamp specifically refers to the time the DNS query request was received. DNS response codes can be NOERROR, NXDOMAIN, SERVFAIL, REFUSED, etc. Time to Live (TTL) specifically refers to the maximum valid lifetime of the DNS resource record for the tested domain name in the local recursive DNS server or client cache; it can be measured in seconds, but is not limited to this. The source refers to the client or server that initiated the DNS query request. The response returns an IP address representing the resolution result of the DNS query request.

[0038] Alternatively, long-term attribute data can be set according to actual conditions, and this application embodiment does not impose specific limitations on this.

[0039] For example, long-term attribute data may include, but is not limited to, registration time, expiration time, duration of continuous activity within the second time window, historical resolution stability, and historical passive DNS data.

[0040] It should be noted that the registration time refers to the moment when the domain name under test is officially created and becomes effective. This moment can be in Coordinated Universal Time (UTC) format, but is not limited to it. The expiration time refers to the moment when the current registration validity period of the domain name under test ends. This moment can be in UTC format, but is not limited to it. The continuous active duration specifically refers to the maximum effective lifespan of the domain name under test after excluding the silent period with no queries or responses. It can be measured in days, but is not limited to it. Historical resolution stability reflects the degree of drastic change in the response and other operations of the domain name under test over time. This can include, but is not limited to, the number of times the source IP address has changed and the number of times the IP address returned by the response has changed. Historical passive DNS data can include, but is not limited to, passive IP mapping record data, passive Mail Exchange (MX) record data, and passive Name Server (NS) record data. Among them, passive IP mapping record data is used to record relevant data of the IP address (such as IPv4, IPv6) returned by the response resolved by the domain name under test, passive MX record data is used to record relevant data of the mail server configured for the domain name under test, and passive NS record data is used to record relevant data of the local recursive DNS server configured for the domain name under test.

[0041] It is worth noting that the second time window and the first time window are independent of each other, and the second time window is earlier than the first time window. The time scales of both the first and second time windows can be set according to actual circumstances, and this embodiment does not impose specific limitations on them. For example, the time scale of the first time window can be 5 minutes, or other scales such as 30 minutes, 1 hour, 24 hours, etc., but is not limited to these. Similarly, the time scale of the second time window can be 30 days, or other scales such as 90 days, 180 days, etc., but is not limited to these.

[0042] S102, perform multi-level feature extraction processing on the domain name attribute data to obtain character-level features, semantic-level features, network-level features and time-series features of the domain name to be tested.

[0043] In this step, shallow feature information highly correlated with the domain name to be tested is extracted from the domain name attribute data of the domain name to be tested based on four levels: character level, semantic level, network level, and time-series level. The character level features capture the word formation rules and pseudo-randomness of the domain name itself; the semantic level features capture the behavioral semantics of the domain name at the DNS level; the network level features capture the network topology characteristics of the domain name associated with queries and responses at the network access level; and the time-series features capture the evolution rules of the domain name over time, thereby realizing the shallow domain name feature extraction and processing.

[0044] S103, character-level features, semantic-level features, network-level features and time-series features are fused to obtain the domain name fusion features of the domain name to be tested.

[0045] In this step, shallow feature information at four levels—character level, semantic level, network level, and time-series level—is fused to achieve cross-level feature interaction and fusion. This aims to further uncover deep feature information hidden in the four levels—character level, semantic level, network level, and time-series level—that is highly correlated with the domain name under test, thereby obtaining the domain name fusion feature of the domain name under test and realizing deep domain name feature extraction processing.

[0046] Optionally, before feature fusion, the above method may further include preprocessing the character-level features, semantic-level features, network-level features, and temporal-level features to ensure feature quality. The preprocessing method is not specifically limited; for example, it may include, but is not limited to, logarithmic compression of count features, normalization of proportional features, standardization of continuous statistics, imputation of missing values, and encoding of categorical features. In one example, the preprocessing method is log(1+x) compression of count features, normalization of proportional features to [0,1], min-max normalization or Z-score standardization of continuous statistics, imputation of missing values, and one-hot encoding of categorical features.

[0047] Alternatively, the feature fusion method can be set according to the actual situation, and the embodiments of this application do not specifically limit it.

[0048] For example, feature fusion can be achieved through a multi-head self-attention mechanism. Specifically, firstly, character-level features, semantic-level features, network-level features, and temporal-level features are projected onto a unified semantic space through a feature projection layer, resulting in projected character-level features, projected semantic-level features, projected network-level features, and projected temporal-level features. This ensures that the feature dimensions of the four layers are the same, laying the foundation for dimensional alignment for subsequent cross-modal interactions.

[0049] Secondly, the projected character-level features, projected semantic-level features, projected network-level features, and projected temporal-level features are stacked along the sequence dimension to obtain the original projection matrix, which serves as the input to the multi-head self-attention layer. Each row of the original projection matrix represents an attention token. Furthermore, the multi-head self-attention layer includes multiple self-attention heads. The number of self-attention heads is not specifically limited; for example, it can be eight, but is not limited to this.

[0050] Then, in each attention head of the multi-head self-attention layer, the original projection matrix input to the self-attention head is first multiplied by the query linear transformation matrix, the key linear transformation matrix, and the value linear transformation matrix, respectively, to obtain the corresponding query matrix, value matrix, and key matrix. Next, a scaling dot product operation is performed on the query matrix, value matrix, and key matrix to obtain the output of the self-attention head. In this way, through the self-attention mechanism, each layer can effectively perceive and utilize the contribution of the other three layers to itself, thereby accurately capturing cross-layer global dependencies. Finally, the outputs of each attention head are concatenated along the feature dimension and processed by an output linear layer to obtain the cross-layer attention matrix, thus mining and learning cross-layer global interaction patterns in different high-dimensional subspaces.

[0051] Next, the cross-level attention matrix and the original projection matrix are added together and then layer-normalized to obtain layer-normalized features. This effectively preserves shallow feature information from each level and reduces the risk of feature degradation and gradient vanishing. The layer-normalized features are then sequentially fed into two fully connected layers and non-linearly mapped using activation functions to obtain activated layer-normalized features. Finally, the layer-normalized features and the activated layer-normalized features are added together and layer-normalized again to obtain the processed cross-level attention features. This allows for the further extraction of higher-order interaction features and captures more abstract and deeper dependencies between the four levels. The activation function is not specifically limited; it can be ReLU, Sigmoid, or other activation functions, but is not limited to these.

[0052] Finally, to obtain deep features of fixed length, pooling operations are performed on the processed cross-level attention features along the sequence dimension to aggregate all feature information and obtain the domain name fusion features. The pooling operation is not specifically limited; for example, it can be mean pooling, but it is not limited to this.

[0053] Therefore, the above process, while preserving the integrity of shallow feature information at the character, semantic, network, and temporal levels, captures global dependencies across levels through high-order feature interactions and feature enhancement. This further uncovers deep feature information highly correlated with the domain name under test at the four levels: character, semantic, network, and temporal. This explicitly enhances the expressive power of deep feature information highly correlated with the domain name under test, thereby effectively improving the extraction accuracy of deep domain name features and providing high-quality input with rich information and compact expression for subsequent pseudo-random domain name detection.

[0054] Furthermore, referring to the example above, feature fusion can be achieved through a bilinear fusion mechanism. Specifically, firstly, character-level features, semantic-level features, network-level features, and temporal-level features are projected onto a unified semantic space through a feature projection layer, resulting in projected character-level features, projected semantic-level features, projected network-level features, and projected temporal-level features. This ensures that the feature dimensions of the four levels are identical, laying the foundation for dimensional alignment for subsequent cross-modal interactions.

[0055] Then, any one of the projected character-level features, projected semantic-level features, projected network-level features, and projected temporal-level features is defined as the first feature. All other features among the projected character-level features, projected semantic-level features, projected network-level features, and projected temporal-level features, excluding the first feature, are defined as the second features. For the first and second features, the following steps are taken: First, a preset first low-rank matrix is ​​multiplied by the first feature to obtain the processed first feature. Simultaneously, a preset second low-rank matrix is ​​multiplied by the second feature to obtain the processed second feature, thus reducing the number of parameters and controlling computational complexity. Then, the processed first and processed second features are subjected to the Hadamard product to obtain a bilinear fused feature for both the first and second features. By traversing all pairwise combinations of the projected features across the four levels, six bilinear fused features are obtained. This effectively captures cross-level local second-order multiplicative interactions and nonlinear correlation patterns.

[0056] Finally, the six bilinear fusion features are concatenated along the feature dimension and then processed sequentially through a fully connected layer and a non-linear activation function to obtain the domain name fusion feature. The activation function is not specifically limited; it can be ReLU, Sigmoid, or other similar functions, but is not restricted to these.

[0057] Therefore, the above process, while preserving the integrity of shallow feature information at the character, semantic, network, and temporal levels, captures local second-order multiplicative interaction relationships and nonlinear association patterns across levels through high-order feature interactions and feature enhancement. This further uncovers deep feature information highly correlated with the domain name under test hidden in the four levels of character, semantic, network, and temporal. This explicitly enhances the expressive power of deep feature information highly correlated with the domain name under test, thereby effectively improving the extraction accuracy of deep domain name features and providing high-quality input with rich information and compact expression for subsequent pseudo-random domain name detection.

[0058] To reiterate, continuing with the example above, feature fusion can be achieved by combining a multi-head self-attention mechanism with a bilinear fusion mechanism. Specifically, one type of domain name fusion feature is first obtained through multi-head attention to capture cross-level global dependencies and long-range interaction patterns. Simultaneously, another type of domain name fusion feature is obtained through bilinear fusion to uncover cross-level local quadratic interactions and nonlinear association patterns. The two domain name fusion features are then concatenated along the feature dimension to obtain the final domain name fusion feature. This feature simultaneously carries cross-level global dependencies and local quadratic interactions. While preserving the integrity of shallow feature information at the character, semantic, network, and temporal levels, it achieves synergistic complementarity between global dependency modeling and local pairwise multiplicative interactions at these levels. This further enhances the expressive power of deep feature information highly correlated with the domain name under test, thereby improving the extraction accuracy of deep domain name features and providing a high-quality input with rich information and compact expression for subsequent pseudo-random domain name detection.

[0059] S104. Based on the domain name fusion characteristics, perform detection processing on the domain name to be tested to obtain the detection result of the domain name to be tested; wherein, the detection result includes either the normal domain name type or the pseudo-random domain name type.

[0060] In this step, detection operations are performed on the domain name under test based on domain name fusion characteristics. This yields detection results indicating whether the domain name is of normal or pseudo-random type, thus achieving the detection and processing of pseudo-random domain names. It should be understood that a normal domain name type indicates that the domain name under test is not a pseudo-random domain name, while a pseudo-random domain name type indicates that the domain name under test is a pseudo-random domain name.

[0061] Therefore, this embodiment first extracts shallow domain name features at four levels—character level, semantic level, network level, and time-series level—from the domain name attribute data of the domain name to be tested, obtaining character-level features, semantic-level features, network-level features, and time-series features of the domain name to be tested. Among them, character-level features capture the word formation rules and pseudo-randomness of the domain name itself; semantic-level features capture the behavioral semantics of the domain name at the DNS level; network-level features capture the network topology characteristics of the domain name associated with queries and responses at the network access level; and time-series features capture the evolution rules of the domain name over time. Then, the features at the above four levels are fused to achieve cross-level feature interaction and fusion, thereby further mining the deep domain name features hidden in the four levels of character, semantic, network, and time-series, obtaining the domain name fusion features of the domain name to be tested. Finally, the domain name to be tested is detected based on the domain name fusion features of the domain name to be tested, obtaining the detection results of the domain name to be tested. The detection results include either normal domain name type or pseudo-random domain name type. Thus, by relying on the key feature information of domain names at four levels—character level, semantic level, network level, and temporal level—pseudo-random domain names can be accurately detected. This makes the detection process of pseudo-random domain names not only retain the ability to perceive the static characteristics of domain name characters, but also further possess the ability to perceive the dynamic characteristics such as the semantic intent of domain name behavior, the network topology characteristics of domain names, and the temporal evolution patterns of domain names, thereby effectively improving the detection accuracy of pseudo-random domain names.

[0062] The steps described above will be explained in further detail below.

[0063] In some implementations, refer to Figure 2 The aforementioned character-level features may include character embedding features, character depth features, and character statistical features; in step S102, multi-level feature extraction processing is performed on the domain name attribute data to obtain character-level features, semantic-level features, network-level features, and temporal-level features of the domain name to be tested, which may include: The domain name attribute data is serialized and embedded to obtain character embedding features; Character depth features are extracted from domain attribute data to obtain character depth features; Perform character statistical operations on the domain name attribute data to obtain character statistical features.

[0064] In this embodiment, the domain name feature extraction process at the character level can be divided into three aspects: character serialization and embedding, deep character feature extraction, and character statistical operations. In terms of character serialization and embedding, the string of the domain name to be tested is first extracted from the domain name attribute data of the domain name to be tested, and each character in the string of the domain name to be tested is converted into a corresponding real number vector. Then, the real number vectors of each character are concatenated into a character sequence as a character embedding feature. In this way, the original character form of the domain name to be tested can be converted into a high-dimensional vector expression, thereby realizing the modeling and processing of the string of the domain name to be tested.

[0065] For character depth extraction, the string of the domain name to be tested is first extracted from its domain attribute data. Then, a pre-defined feature extraction network is used to perform character depth feature extraction on the string, yielding the character depth features. The feature extraction network can be flexibly configured according to the actual situation; for example, it can be a Convolutional Neural Network (CNN), MobileNetV2, EfficientNet-B0, etc., but is not limited to these. In this way, the character combination patterns and abstract structural rules of the domain name to be tested can be comprehensively captured, thereby accurately uncovering complex character distribution characteristics that are difficult to cover through manual statistics.

[0066] In terms of character statistical operations, the string of the domain name to be tested is first extracted from the domain name attribute data of the domain name to be tested, and then the string of the domain name to be tested is statistically analyzed to obtain statistical features associated with the domain name characters, which are used as character statistical features. In this way, the randomness and word formation anomaly of the domain name to be tested can be comprehensively characterized in multiple dimensions such as statistical distribution, information uncertainty and structural combination.

[0067] Optionally, character statistical features can be set according to actual conditions, and this implementation method does not impose specific limitations on them.

[0068] For example, character statistical features may include, but are not limited to, string length, the proportion of numbers in the string, the proportion of vowels in the string, information entropy, the length of the longest consecutive consonant, top-level domain structure pattern, character frequency distribution, N-gram character features, etc.

[0069] It should be noted that string length refers to the length of the string. The percentage of numbers in the string represents the proportion of numeric characters in the main body of the string to the total number of characters in the main body. The main body typically refers to the second or third level fields preceding the top-level field, and numeric characters are 0-9. The percentage of vowels in the string represents the proportion of vowel characters in the main body of the string to the total number of characters in the main body. Vowel characters refer to vowels such as a, e, i, o, u, etc. Information entropy indicates the uncertainty or randomness of the character distribution in a string, and it can be calculated based on the frequency of occurrence of each character (including letters and numbers) in the string. The longest consecutive consonant length represents the maximum length of a consonant substring that appears consecutively in the string. The top-level field structure pattern represents the combination rules of the top-level and second-level fields in terms of character composition and hierarchical logic. This can include, but is not limited to, the ratio of the length of the second-level fields to the length of the top-level field, the type of the top-level field, and the type of the second-level fields. Character frequency distribution represents the proportion of all characters (including letters and numbers) in the main body of a string to the total number of characters in the main body. N-gram character features are statistical features based on character sequences, representing the frequency distribution of combinations of N consecutive characters in a string. The N-gram character features can be flexibly set according to the actual situation; for example, N-gram character features can include, but are not limited to, 1-gram character features, 2-gram character features, and 3-gram character features, corresponding to the frequency distribution of combinations of a single character, two characters, and three characters, respectively.

[0070] Finally, the character embedding features, character depth features, and character statistical features are concatenated into character-level features.

[0071] Therefore, this implementation method extracts corresponding character embedding features, character depth features, and character statistical features from three perspectives: character vector modeling, character feature mining, and character statistical analysis. These features serve as shallow feature information of the domain name under test at the character level. Specifically, character embedding features mine the high-dimensional vector expression of the character form of the domain name under test, character depth features capture the complex character distribution characteristics of the domain name under test, and character statistical features provide interpretable quantitative statistical indicators of the domain name under test. This allows for a comprehensive and accurate positioning of the word formation rules and pseudo-randomness of the domain name under test, thereby effectively improving the accuracy of shallow domain name feature extraction at the character level and providing a reliable data foundation for subsequent processing.

[0072] In some implementations, refer to Figure 3The aforementioned semantic-level features may include lifetime semantic features, query behavior semantic features, and response behavior semantic features; in step S102, multi-level feature extraction processing is performed on the domain name attribute data to obtain character-level features, semantic-level features, network-level features, and time-series features of the domain name to be tested, which may include: Lifetime semantic modeling is performed on domain attribute data to obtain lifetime semantic features; Semantic modeling of query behavior is performed on domain attribute data to obtain semantic features of query behavior; Semantic modeling of response behavior is performed on domain attribute data to obtain semantic features of response behavior.

[0073] In this embodiment, the semantic-level domain name feature extraction process can be divided into three aspects: lifetime semantic modeling, DNS query behavior semantic modeling, and DNS response behavior semantic modeling, among which: In terms of DNS lifetime semantic modeling, short-term and long-term attribute data are extracted from domain name attribute data, and statistical analysis is performed on the short-term and long-term attribute data to obtain statistical features associated with DNS lifetime, which are used as lifetime semantic features to accurately model the DNS lifetime characteristics of the domain name under test.

[0074] Optionally, the lifecycle semantic features can be set according to the actual situation, and this implementation does not impose specific limitations on them.

[0075] For example, the semantic features of lifespan may include, but are not limited to, registration time, expiration time, TTL distribution characteristics, and duration of continuous activity within the second time window. It should be noted that the TTL distribution characteristics specifically refer to the information obtained from statistical analysis of the TTL within the first time window, which may include, but are not limited to, the TTL mean, TTL standard deviation, TTL maximum, TTL minimum, and TTL median.

[0076] In terms of semantic modeling of DNS query behavior, short-term attribute data is extracted from domain name attribute data, and statistical analysis is performed on the short-term attribute data to obtain statistical features associated with DNS query behavior, which are used as semantic features of query behavior, thereby accurately modeling the DNS query characteristics of the domain name under test.

[0077] Optionally, the semantic features of the query behavior can be set according to the actual situation, and this implementation does not impose specific limitations on this.

[0078] For example, the semantic features of query behavior may include, but are not limited to, DNS event frequency, DNS query volatility coefficient, and the number of times each DNS query type occurs within the first time window. It should be noted that DNS event frequency specifically refers to the ratio of the number of DNS events involving the domain name under test to the first time window (e.g., in minutes). DNS query volatility coefficient specifically refers to the degree of volatility in the DNS event query behavior of the domain name under test. It indicates the degree of volatility in the domain name's queries; that is, the larger the DNS query volatility coefficient, the greater the query volatility of the domain name under test and the higher the malicious risk; conversely, the smaller the query volatility of the domain name under test and the lower the malicious risk. The DNS query volatility coefficient can be flexibly set according to the actual situation. For example, the sum of the average number of DNS events involving the domain name under test within the first time window and the constant to prevent division by zero (such as 0.001) can be used as the first parameter. Then, the ratio of the standard deviation of the number of DNS events involving the domain name under test within the first time window to the first parameter can be used as the coefficient of variation (CV). This coefficient of variation is the DNS query volatility coefficient, thereby comprehensively exploring the abnormal fluctuations in the DNS query behavior of the domain name under test.

[0079] In terms of semantic modeling of DNS response behavior, short-term and long-term attribute data are extracted from domain name attribute data, and statistical analysis is performed on the short-term and long-term attribute data to obtain statistical features associated with DNS response behavior, which are used as semantic features of response behavior, thereby accurately modeling the DNS response characteristics of the domain name under test.

[0080] Optionally, the semantic features of the response behavior can be set according to the actual situation, and this implementation does not impose specific limitations on them.

[0081] For example, the semantic features of response behavior may include, but are not limited to, the DNS response volatility coefficient, the historical resolution stability within the second time window, and the number of occurrences of each DNS response code within the first time window. It should be noted that the DNS response volatility coefficient specifically refers to the degree of volatility in the DNS event response behavior of the domain name under test. It indicates the degree of volatility in the response of the domain name under test; that is, the larger the DNS response volatility coefficient, the greater the response volatility of the domain name under test and the higher the malicious risk, and vice versa. The DNS response volatility coefficient can be flexibly set according to the actual situation. For example, the moving average variance of the proportions of NXDOMAIN, REFUSED, and SERVFAIL types in the first time window can be calculated first, and then the weighted average or mean of the moving average variances of the three can be determined as the response distribution entropy change rate. This response distribution entropy change rate is the DNS response volatility coefficient, thereby effectively capturing abnormal fluctuations in the resolution response structure of the domain name under test.

[0082] Finally, the semantic features of lifespan, query behavior, and response behavior are concatenated into semantic-level features.

[0083] Therefore, this implementation method performs semantic modeling from three perspectives: lifetime, DNS query behavior, and DNS response behavior. This yields lifetime semantic features, query behavior semantic features, and response behavior semantic features, which serve as shallow feature information of the domain name under test at the semantic level. Among them, the lifetime semantic features indicate the DNS survival characteristics of the domain name under test, the query behavior semantic features indicate the DNS query behavior of the domain name under test, and the response behavior semantic features indicate the DNS response behavior of the domain name under test. This allows for a comprehensive and accurate capture of the behavioral semantics of the domain name under test at the DNS level, thereby effectively improving the accuracy of shallow domain name feature extraction at the semantic level and providing a reliable data foundation for subsequent processing.

[0084] In some implementations, refer to Figure 4 The aforementioned network-level features may include source network features and Domain Name System (DNS) network features; in step S102, multi-level feature extraction processing is performed on the domain name attribute data to obtain character-level features, semantic-level features, network-level features, and temporal-level features of the domain name to be tested, which may include: Source network topology modeling is performed on domain name attribute data to obtain source network characteristics; Domain name system network topology modeling is performed on domain name attribute data to obtain domain name system network characteristics.

[0085] In this embodiment, the domain name feature extraction process at the network layer can be divided into two aspects: source network topology modeling and DNS network topology modeling, wherein: In terms of source network topology modeling, short-term attribute data is extracted from domain name attribute data, and the source network topology is modeled based on this data to obtain source network characteristics. This allows for the accurate capture of the network topology characteristics of the source that initiates the DNS query request, which indirectly indicates the network topology characteristics of the domain name under test associated with the query at the network access layer.

[0086] Optionally, the source network characteristics can be set according to the actual situation, and this implementation does not impose specific limitations on them.

[0087] For example, source network characteristics may include, but are not limited to, the number of IP addresses, the number of IP changes, the distribution characteristics of IP network segments, IP types, IP geographical information, Autonomous System (AS) distribution information, AS diversity index, etc., which indicate the static attributes and distribution patterns of the source IP addresses themselves, as well as the distribution and diversity of the AS to which the source IP addresses belong.

[0088] In terms of DNS network topology modeling, historical passive DNS data is extracted from domain name attribute data, and the DNS network topology is modeled based on this data to obtain the domain name system network characteristics, thereby deeply mining the network topology characteristics of the domain name under test in relation to the response at the network access level.

[0089] Optionally, the domain name system network characteristics can be set according to the actual situation, and this implementation method does not impose specific limitations on this.

[0090] For example, the network characteristics of the Domain Name System may include, but are not limited to, the number of IPs, the number of IP changes, the distribution characteristics of IP network segments, IP types, IP geographical information, AS distribution information, AS diversity index, etc. of the response return IP address, mail server IP address, and local recursive DNS server IP address. These characteristics indicate the static attributes and distribution patterns of the response return IP address, mail server IP address, and local recursive DNS server IP address, as well as the distribution and diversity of the AS to which they belong.

[0091] It should be noted that the IP count represents the number of IP addresses within a time window. The IP change count represents the number of times an IP address changed within a time window. IP network segment distribution characteristics may include, but are not limited to, the proportion of IP addresses falling within the / 24 network segment to the total number of IP addresses within a time window, the proportion of IP addresses falling within the / 16 network segment to the total number of IP addresses within a time window, etc., to indicate the concentration of IP addresses in the 24 and / or 16 network segments. IP type represents the most frequently occurring address type. Address types can be categorized by protocol types such as IPv4 and IPv6, or by network types such as residential IPs and data center IPs, but are not limited to these. IP geographic information represents the latitude and longitude of the most frequently occurring IP address within a time window. AS distribution information can be the AS number that appears most frequently within a time window, to indicate the concentration of the AS to which the IP address belongs. The AS diversity index can be the number obtained by deduplicating the AS numbers to which the IP address belongs within a time window, to indicate the diversity of the AS to which the IP address belongs. It should be understood that the IP address here can be the source IP address, the response return IP address, the mail server IP address, the local recursive DNS server IP address, etc., and the time window can be the first time window, the second time window, etc.

[0092] Finally, the source network characteristics and the domain name system network characteristics are concatenated into network-level characteristics.

[0093] Therefore, this implementation method models the network topology from both the initiation and response of DNS query requests, obtaining source network features and Domain Name System (DNS) network features as shallow feature information of the domain name under test at the network layer. The source network features capture the network topology characteristics of the source that initiates the DNS query request for the domain name under test, while the DNS network features mine the network topology characteristics of the DNS at the response layer. This allows for a comprehensive and accurate positioning of the network topology characteristics of the domain name under test at the network access layer related to queries and responses, thereby effectively improving the accuracy of shallow domain name feature extraction at the network layer and providing a reliable data foundation for subsequent processing.

[0094] In some implementations, refer to Figure 5 In step S102 above, multi-level feature extraction processing is performed on the domain name attribute data to obtain character-level features, semantic-level features, network-level features, and time-series features of the domain name to be tested, which may include: Temporal feature extraction is performed on domain attribute data to obtain temporal-level features.

[0095] In this embodiment, firstly, short-term attribute data is extracted from the domain name attribute data, and further features such as the adjacent time interval, TTL change, response code switching status, and query source clustering degree of each DNS event involved in the domain name to be tested within the first time window are extracted.

[0096] It should be noted that the adjacent time interval represents the absolute value of the difference between the DNS query timestamp of the DNS event and the DNS query timestamp of the previous DNS event. The TTL change represents the absolute value of the difference between the TTL of the DNS event and the TTL of the previous DNS event. The response code switching status indicates whether the DNS response code of the DNS event has changed compared to the DNS response code of the previous DNS event; a value of 1 indicates a change, and a value of 0 indicates no change. Query source clustering measures the concentration of source IP addresses among other DNS events preceding the DNS event; it can be calculated using Shannon entropy, but is not limited to this. Specifically, the adjacent time interval, TTL change, and response code switching status of the first DNS event can be set to zero. Optionally, after obtaining the characteristics of each DNS event, the characteristics of each DNS event are preprocessed to ensure feature quality. The description of the preprocessing method here can follow the previous description and will not be repeated here.

[0097] Then, the features of each DNS event related to the domain name under test are sorted according to the chronological order of DNS query timestamps to obtain the DNS event input sequence. This sequence is then fed into a pre-defined temporal feature extraction network, which captures the evolutionary patterns of the domain name under test over time, thereby obtaining temporal-level features. The temporal feature extraction network can be configured according to specific circumstances; for example, it can be a Long Short-Term Memory (LSTM) network, a Bidirectional Long Short-Term Memory (BiLSTM) network, or a Transformer, but is not limited to these.

[0098] Therefore, this implementation method utilizes a temporal feature extraction network to perform feature extraction operations, which can accurately capture the evolutionary pattern of the domain name under test in the time dimension, thereby effectively improving the accuracy of shallow domain name feature extraction at the temporal level and providing a reliable data foundation for subsequent processing.

[0099] In some implementations, refer to Figure 6 In step S104 above, the domain name to be tested is detected based on the domain name fusion characteristics to obtain the detection result of the domain name to be tested, which may include: Based on the domain name fusion characteristics and combined with the pre-trained domain name recognition model, the domain name to be tested is detected and processed to obtain the detection probability of the domain name to be tested. If the detection probability is greater than the probability threshold, the detection result is determined to be a pseudo-random domain name type; otherwise, the detection result is determined to be a normal domain name type.

[0100] In this embodiment, firstly, the domain name fusion features are input into a pre-trained domain name recognition model. The domain name recognition model outputs the detection probability of the domain name to be tested, which represents the probability that the domain name to be tested is a pseudo-random domain name, and its value ranges from [0,1]. Then, the detection probability is compared with a preset probability threshold. If the detection probability is greater than the probability threshold, it means that the domain name to be tested is relatively likely to be a pseudo-random domain name, and the detection result is determined to be a pseudo-random domain name to indicate that the domain name to be tested is a pseudo-random domain name. Otherwise, it means that the domain name to be tested is relatively unlikely to be a pseudo-random domain name, and the detection result is determined to be a normal domain name to indicate that the domain name to be tested is not a pseudo-random domain name.

[0101] Optionally, the type of domain name recognition model can be set according to the actual situation, and this implementation method does not impose specific limitations. For example, the domain name recognition model can be a linear head, a multi-layer perceptron (MLP), etc., but is not limited to these.

[0102] Alternatively, the training process of the domain name recognition model can be set according to the actual situation, and this implementation method does not impose specific limitations.

[0103] For example, the training process of the domain name recognition model can be as follows: First, obtain multiple preset domain name attribute data samples and the first label of each preset domain name attribute data sample, and perform feature extraction and feature fusion on the multiple preset domain name attribute data samples to obtain the domain name fusion features of each preset domain name attribute data sample. Then, integrate the domain name fusion features and the first label of each preset domain name attribute data sample into a first dataset. The first label includes either a pseudo-random domain name type with a value of 1 or a normal domain name type with a value of 0.

[0104] Then, the first dataset is divided into a training set and a test set according to a specific ratio (e.g., 7:3). The pre-built neural network model is trained using the training set to obtain the trained neural network model. The trained neural network model is then tested using the test set to obtain its performance metrics. Finally, if the performance metrics meet the preset performance conditions, the trained neural network model is identified as the pre-trained domain name recognition model and output; otherwise, the relevant parameters for model training are adjusted, and the process returns to the step of training the pre-built neural network model using the training set, thus achieving iterative training. Optionally, Dropout can be added to the domain name fusion features during model training to avoid overfitting.

[0105] The performance indicators and performance conditions are not specifically limited. For example, performance indicators can be accuracy, F1 score, recall, F1 score, false alarm rate, etc., and performance conditions can be accuracy reaching a preset accuracy threshold, F1 score within a preset numerical range, etc., but are not limited to these.

[0106] Furthermore, there are no specific restrictions on the loss function used during training. For example, the loss function can be one or more of the following: contrastive learning loss function, classification loss function, etc., but it is not limited to these.

[0107] In one example, a contrastive learning loss function is used. Specifically, multiple preset domain name attribute data samples are divided into different pseudo-random family samples and normal domain name samples according to their first label. Samples of the same pseudo-random family are used as positive sample pairs, and samples of different pseudo-random families and normal domain name samples are used as negative sample pairs. Each sample undergoes feature extraction to obtain corresponding character-level features, semantic-level features, network-level features, and temporal-level features. Further, feature fusion is performed to obtain corresponding domain name fusion features. The supervised contrastive learning loss function is applied to each level of features and / or domain name fusion features to bring similar features closer together and separate dissimilar features, thereby enhancing the cross-level feature representation ability.

[0108] In another example, a classification loss function is employed. Specifically, classification loss functions such as cross-entropy (CE) and binary cross-entropy (BCE) are applied to each predefined domain name attribute data sample and its first label to enhance the ability to distinguish pseudo-random domain names. It should be understood that when at least two loss functions exist, they are weighted and summed to obtain the final loss function, which is used for backpropagation and parameter updates during model training.

[0109] In some implementations, refer to Figure 7 The above methods may also include: The probability threshold is determined based on the domain name attribute data and the preset baseline threshold.

[0110] In this embodiment, after obtaining character-level features, semantic-level features, network-level features, and temporal-level features, these features are concatenated along the feature dimension and input into a pre-trained classification model. The classification model then outputs the information type of the domain name attribute data. The information type can include either a definite type or a fuzzy type. A definite type indicates that the feature information at each level is highly consistent and strongly points to the same detection result, while a fuzzy type indicates that the feature information at at least two levels contradicts each other, i.e., they do not point to the same detection result.

[0111] The type of classification model is not specifically limited. For example, the classification model can be a neural network model such as a convolutional neural network, or a machine learning model such as a support vector machine, but it is not limited to these.

[0112] It should be understood that the classification model can be trained using a second dataset. This second dataset can be, but is not limited to, multiple pre-defined composite data samples and their respective second labels. The composite data samples can include, but are not limited to, character-level features, semantic-level features, network-level features, and temporal-level features of domain attribute data samples. The second label represents the information type, which can be either a clearly defined type (e.g., labeled as 1) or a fuzzy class (e.g., labeled as 0), and can be labeled by experts or using pre-defined rules. During model training, the classification model can learn the mapping relationship from character-level features, semantic-level features, network-level features, and temporal-level features to information types.

[0113] If the domain name attribute data has a clearly defined information type, it indicates that the feature information at the four levels—character level, semantic level, network level, and time-series level—is highly consistent and strongly points to the same detection result. In this case, a rapid decision can be made: a preset baseline threshold can be directly used as the probability threshold for subsequent determination of whether a domain name is pseudo-random. The baseline threshold is not specifically limited; for example, it can be determined by the optimal point of the F1 score, recall rate, and false positive rate on the balanced validation set, but it is not limited to this. In one example, the baseline threshold could be 0.5. This significantly improves detection efficiency while ensuring detection accuracy.

[0114] If the information type of the domain name attribute data is fuzzy, it means that there is a contradiction between the feature information of at least two levels among the character level, semantic level, network level and time series level, that is, at least two do not point to the same detection result. In this case, dynamic decision-making is required, that is, decision generation processing is performed based on the domain name attribute data to obtain a dynamic probability threshold, which is used to determine whether it is a pseudo-random domain name.

[0115] The decision generation method is not specifically limited. For example, database lookup processing can be performed on various data points, including the missing data rate of domain name attribute data, DNS query fluctuation coefficient, IP network segment distribution characteristics of source IP addresses, confidence level of historical passive DNS data, and the proportion of abnormal DNS response codes such as NXDOMAIN within the first time window in the total number of DNS response codes, to determine the corresponding threshold correction values ​​for each data point. Here, the missing data rate represents the ratio of the number of missing fields in the domain name attribute data to the number of fields that should be present. The confidence level represents the credibility of historical passive DNS data pointing to malicious pseudo-random domain names. The IP network segment distribution characteristics here specifically refer to the proportion of IP addresses falling within either the / 16 or / 24 network segment to the total number of IP addresses.

[0116] It should be understood that a database can be pre-built to store data such as the missing rate of domain name attribute data, DNS query volatility coefficient, IP segment distribution characteristics of source IP addresses, confidence level of historical passive DNS data, and the proportion of abnormal DNS response codes such as NXDOMAIN in the total number of DNS response codes within the first time window, along with their corresponding threshold correction values. The corresponding threshold correction values ​​can be obtained by searching and processing this database.

[0117] It is worth noting that the threshold correction values ​​are pre-defined signed values. Specifically, the higher the data missing rate of the domain name attribute data, the less complete the evidence chain pointing to the pseudo-random domain name. Therefore, its threshold correction value is positive, and the absolute value increases with the increase of the data missing rate to improve the probability threshold and reduce the false positive rate. The higher the DNS query volatility coefficient, the more drastic the fluctuation in the number of DNS events involved in the domain name under test, and the more abnormal the query behavior. The higher the credibility of its pointing to the pseudo-random domain name, the higher its threshold correction value is. Therefore, its threshold correction value is negative, and the absolute value increases with the increase of the DNS query volatility coefficient to reduce the probability threshold and improve the recall. The higher the IP segment distribution characteristics of the source IP address, the more concentrated the source IP address is in a specific / 24 or / 16 network segment, and the more abnormal the network segment distribution. The higher the credibility of its pointing to the pseudo-random domain name, the higher its threshold correction value is. Therefore, its threshold correction value is negative, and the absolute value increases with the increase of the IP segment distribution characteristics to reduce the probability threshold and improve the recall. A higher confidence level in historical passive DNS data indicates a higher credibility of the data pointing to malicious pseudo-random domains. Therefore, its threshold correction value is negative, and the absolute value increases with the increase in the confidence level of historical passive DNS data, in order to lower the probability threshold and enhance the detection capability of pseudo-random domains. A higher proportion of abnormal DNS response codes indicates a larger proportion of abnormal DNS response codes such as NXDOMAIN in the total number of DNS response codes, and a more significant abnormal response. The higher the credibility of these codes pointing to pseudo-random domains, the lower the probability threshold and the better the recall.

[0118] Then, based on the threshold correction values ​​of each data point, the preset baseline threshold is adjusted to obtain the probability threshold, as shown in the following formula (1): θ=clip(θ0+λ1 M+λ2 B+λ3 R+λ4 D+λ5 C,θ min ,θ max (1); In equation (1), θ represents the probability threshold; clip() restricts the value to [θ]. min , θmax ], θ min Let θ represent the minimum probability. max λ1 represents the maximum probability; θ0 represents the preset baseline threshold; M represents the threshold correction value for the data missing rate; B represents the threshold correction value for the DNS query volatility coefficient; R represents the threshold correction value for the IP segment distribution characteristics of the source IP address; D represents the threshold correction value for the confidence level of historical passive DNS data; C represents the threshold correction value for the proportion of abnormal DNS response codes; λ1, λ2, λ3, λ4, and λ5 are all preset weight values. The minimum and maximum probabilities can be flexibly set according to actual conditions. For example, the minimum probability can range from [0.35, 0.45], and the maximum probability can range from [0.65, 0.80], but are not limited to these ranges.

[0119] Therefore, this embodiment provides a probability threshold determination method that combines static and dynamic approaches. It can adjust the probability threshold based on the consistency or conflict ambiguity exhibited at the character, semantic, network, and temporal levels. Specifically, when consistency is observed at each level, a preset baseline threshold is directly used as the static probability threshold to improve the detection efficiency of pseudo-random domain names. When conflict ambiguity is observed at each level, the baseline threshold is adjusted based on dimensions such as data loss, DNS query fluctuations, source IP distribution, passive DNS confidence, and abnormal DNS responses to obtain a dynamic probability threshold. Furthermore, when evidence pointing to pseudo-random domain names is insufficient, the threshold is appropriately tightened to suppress false alarms; when evidence pointing to pseudo-random domain names is sufficient, the threshold is appropriately relaxed to enhance the detection capability of pseudo-random domain names. This allows the probability threshold to accurately match the evidence chain of features at each level pointing to pseudo-random or normal domain names, thereby effectively improving the detection accuracy of pseudo-random thresholds.

[0120] In some implementations, refer to Figure 8 The above method may also include at least one of the following: Based on the test results, interpretability analysis is performed on the domain name to be tested to obtain the interpretability analysis results of the domain name to be tested; If the test result is a pseudo-random domain name, the domain name to be tested will be processed.

[0121] In this embodiment, after obtaining the detection results of the domain name to be tested, corresponding interpretability analysis results can be output based on the detection results, and / or corresponding processing can be performed on the domain name to be tested that belongs to the pseudo-random domain name type. The interpretability analysis results are used to indicate the basis for judging the detection results and the source of risk, thereby improving the interpretability of the pseudo-random domain name detection process. The processing can promptly intercept pseudo-random domain names, thereby reducing the network security risks caused by pseudo-random domain names.

[0122] Optionally, the interpretability analysis results can be set according to the actual situation, and this implementation does not impose specific limitations on this.

[0123] For example, the interpretability analysis results may include, but are not limited to, heatmaps of features at each level, gradient values ​​of domain name fusion features with respect to the output of the domain name detection model, the contribution of features at each level to the detection process of the domain name under test, the character segments in the string of the domain name under test that contribute the most to the detection process, key time periods that trigger anomalies in time-series features, IP geographic information of key source IP addresses, AS distribution information and AS diversity index in network-level features, abnormal passive IP mapping record data, abnormal passive MX record data, abnormal passive NS record data, and similarity analysis results of features at each level relative to known pseudo-random families. The method for obtaining the contribution of characters is not specifically limited; for example, it can be generated through Grad-CAM, attention weights, or gradient attribution methods, but is not limited to these. Optionally, after obtaining the heatmap, the heatmap is rendered as a color image and overlaid on the string of the domain name under test, highlighting suspicious characters. The color image overlaid on the string of the domain name under test and the highlighted suspicious characters are both added to the interpretability analysis results.

[0124] Alternatively, the handling method can be set according to the actual situation, and this embodiment does not make specific limitations on it.

[0125] For example, the handling methods may include, but are not limited to, adding the pseudo-random domain name to at least one of the following: the blocking list, the RPZ policy library, and the blacklist library; issuing at least one of the following: blocking, redirection, and sinkhole resolution policies for the pseudo-random domain name to the local recursive DNS server; pushing risk events for the pseudo-random domain name to at least one of the following: the security operations platform, the alarm platform, or the ticket system; writing the pseudo-random domain name and its domain name attribute data, characteristics at each level, domain name fusion characteristics, and other related data into the threat intelligence library; and generating an analysis report based on the interpretability results to assist in manual review.

[0126] Furthermore, referring to the above example, the handling method can also include, but is not limited to, tiered handling based on the detection probability range of the domain name under test. This includes, if the detection probability of the domain name under test is within the first range, performing operations such as intelligence retention and manual review; if the detection probability of the domain name under test is within the second range, performing operations such as alarms and gray-scale blocking; if the detection probability of the domain name under test is within the third range, performing operations such as automatic blocking and synchronous reporting to the intelligence platform. The first, second, and third ranges are independent of each other and can be flexibly set according to the actual situation. For example, the first range could be [θ, 0.7), the second range could be [0.7, 0.9), and the third range could be [0.9, 1], but it is not limited to these.

[0127] To facilitate understanding of the pseudo-random domain name detection method described above in this application, an example of its actual application scenario is provided below.

[0128] Reference Figure 9 In this application scenario, the domain name to be tested is “XXXXX.com”. The process of detecting whether the domain name to be tested is a pseudo-random domain name is shown in steps S201-S205 below.

[0129] S201, Data Acquisition: Obtain the domain attribute data of the domain to be tested. This domain attribute data includes strings, short-term attribute data, and long-term attribute data. Short-term attribute data includes the received response data for at least one DNS event involving the domain within the first time window, as well as the number of DNS events involving the domain within the first time window. Received response data includes DNS query type, DNS query timestamp, DNS response code, TTL, source IP address, source port number, and response return IP address. Long-term attribute data includes registration time, expiration time, duration of continuous activity within the second time window, historical resolution stability, and historical passive DNS data.

[0130] S202, Feature Extraction: (1) Character-level domain name feature extraction: The string of the domain name to be tested is extracted from the domain attribute data of the domain name to be tested. Each character in the string of the domain name to be tested is converted into a corresponding real number vector, and then the real number vectors of each character are concatenated into a character sequence to serve as character embedding features. Statistical analysis is performed on the string of the domain name to be tested to obtain character statistical features, including string length, the proportion of numbers in the string, the proportion of vowels in the string, information entropy, the length of the longest consecutive consonant, top-level domain structure pattern, character frequency distribution, N-gram character features, etc. A CNN is used to extract deep character features from the string of the domain name to be tested to obtain deep character features. The character embedding features, deep character features, and statistical character features are concatenated into character-level features.

[0131] (2) Semantic-level domain name feature extraction: Short-term and long-term attribute data are extracted from domain attribute data, and statistical analysis is performed on these data to obtain semantic features related to time-to-live (TTL), query behavior, and response behavior. TTL features include registration time, expiration time, TTL distribution characteristics, and duration of continuous activity within the second time window. TTL distribution characteristics include TTL mean, TTL standard deviation, TTL maximum, TTL minimum, and TTL median. Query behavior features include DNS event frequency, DNS query volatility coefficient, and the number of occurrences of each DNS query type within the first time window. Response behavior features include DNS response volatility coefficient, historical resolution stability within the second time window, and the number of occurrences of each DNS response code within the first time window. These semantic features are then concatenated to form semantic-level features.

[0132] (3) Domain name feature extraction at the network level: Short-term attribute data is extracted from domain name attribute data, and based on this, the source network topology is modeled to obtain source network characteristics, including the number of IP addresses, IP change frequency, IP network segment distribution characteristics, IP type, IP geographic information, AS distribution information, and AS diversity index. Historical passive DNS data is extracted from domain name attribute data, and based on this, the DNS network topology is modeled to obtain Domain Name System (DNS) network characteristics, including the number of IP addresses returned in response, mail server IP addresses, and local recursive DNS server IP addresses, as well as their respective IP counts, IP change frequency, IP network segment distribution characteristics, IP type, IP geographic information, AS distribution information, and AS diversity index. The source network characteristics and DNS network characteristics are then concatenated to form network-level characteristics.

[0133] (4) Temporal-series domain name feature extraction: First, short-term attribute data is extracted from the domain name attribute data. Then, features such as the adjacent time interval, TTL change, response code switching status, and query source clustering degree of each DNS event involved in the domain name under test within the first time window are further extracted. Then, the features of each DNS event involved in the domain name under test are sorted according to the chronological order of DNS query timestamps to obtain the DNS event input sequence. The DNS event input sequence is then input into a BiLSTM with 2 layers × 128 hidden nodes or a Transformer with 4 layers to obtain time-series features.

[0134] S203, Feature Fusion: First, the features at each level are preprocessed. For example, log(1+x) compression is used for count features, proportional features are normalized to [0,1], min-max normalization or Z-score standardization is used for continuous statistics, missing values ​​are imputed, and categorical features are encoded using one-hot encoding. Then, for each level of features, one domain name fusion feature is obtained through a multi-head attention mechanism with eight self-attention heads, and another domain name fusion feature is obtained through a bilinear fusion mechanism. Finally, the two domain name fusion features are concatenated along the feature dimension to obtain the final domain name fusion feature.

[0135] S204, Detection of pseudo-random domain names: First, character-level features, semantic-level features, network-level features, and temporal-level features are concatenated along the feature dimension and input into a pre-trained classification model, which outputs the information type of the domain name attribute data. The information type includes either a definite type or a fuzzy type, and the classification model is a CNN. If the information type of the domain name attribute data is a definite type, the preset baseline threshold is directly used as the probability threshold. The baseline threshold is 0.5. If the information type of the domain name attribute data is a fuzzy type, the missing data rate of the domain name attribute data, the DNS query fluctuation coefficient, the IP segment distribution characteristics of the source IP address, the confidence level of historical passive DNS data, and the proportion of the number of abnormal DNS response codes such as NXDOMAIN in the first time window in the total number of DNS response codes are first processed by database lookup to determine the threshold correction value corresponding to each data. Then, based on the threshold correction value of each data, the preset baseline threshold is adjusted to obtain the probability threshold, as shown in the above formula (1).

[0136] Then, the domain name fusion features are input into a pre-trained domain name recognition model, which outputs the detection probability of the domain name to be tested. This detection probability represents the probability that the domain name to be tested is a pseudo-random domain name, and its value ranges from [0,1]. The domain name recognition model is an MLP (Multi-Level Processing).

[0137] Finally, the detection probability is compared with a preset probability threshold. If the detection probability is greater than the probability threshold, the detection result is determined to be a pseudo-random domain name, indicating that the domain name under test is a pseudo-random domain name; otherwise, the detection result is determined to be a normal domain name, indicating that the domain name under test is not a pseudo-random domain name. Ultimately, the domain name under test is detected as a pseudo-random domain name.

[0138] S205, Interpretability Analysis and Handling: Based on the detection results, corresponding interpretability analysis results are output, including heatmaps of features at each level, gradient values ​​of domain name fusion features with respect to the domain name detection model output, the contribution of each level of features to the detection process of the domain name under test, the character segment in the string of the domain name under test that contributes the most to the detection process, key time periods that trigger anomalies in time-series features, IP geographic information of key source IP addresses in network-level features, AS distribution information and AS diversity index, abnormal passive IP mapping record data, abnormal passive MX record data, abnormal passive NS record data, and similarity analysis results of features at each level relative to known pseudo-random families. Furthermore, after obtaining the heatmap, it is rendered as a color image and overlaid on the string of the domain name under test, highlighting suspicious characters. Both the color image overlaid on the string of the domain name under test and the highlighted suspicious characters are added to the interpretability analysis results.

[0139] Appropriate actions are taken for the domains under test. For example, tiered actions are implemented based on the detection probability range of the domain. This includes: if the detection probability falls within the first range, intelligence retention and manual review are performed; if the detection probability falls within the second range, alerts and gray-scale blocking are implemented; if the detection probability falls within the third range, automatic blocking and simultaneous reporting to the intelligence platform are performed. Other actions include: adding the domain to be tested to at least one of the following: the block list, the RPZ policy library, and the blacklist; issuing at least one of the following blocking, redirection, and sinkhole resolution policies for the domain to the local recursive DNS server; pushing risk events for the domain to be tested to at least one of the following: the security operations platform, the alert platform, or the work order system; writing the domain and its domain attribute data, characteristics at each level, and domain fusion characteristics into the threat intelligence database; and generating an analysis report based on interpretability results to assist manual review.

[0140] In addition, refer to Figure 10 This application also provides a pseudo-random domain name detection device that can implement the above method. The device includes: The data acquisition module 301 is used to acquire the domain attribute data of the domain name to be tested; The feature extraction module 302 is used to perform multi-level feature extraction processing on the domain name attribute data to obtain character-level features, semantic-level features, network-level features and time-series features of the domain name to be tested. The feature fusion module 303 is used to perform feature fusion processing on character-level features, semantic-level features, network-level features and time-series features to obtain the domain name fusion features of the domain name to be tested. The domain name detection module 304 is used to detect and process the domain name to be tested based on the domain name fusion characteristics, and obtain the detection result of the domain name to be tested; wherein, the detection result includes either normal domain name type or pseudo-random domain name type.

[0141] The content of the above method embodiments is applicable to the device embodiments. The specific functions implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0142] Finally, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described pseudo-random domain name detection method.

[0143] The content of the above method embodiments is applicable to the embodiments of this program product. The specific functions implemented by the embodiments of this program product are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0144] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0145] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0146] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0147] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0148] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0149] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0150] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0151] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0152] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0153] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0154] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A method for detecting pseudo-random domain names, characterized in that, The method includes: Obtain the domain attribute data of the domain to be tested; Multi-level feature extraction processing is performed on the domain name attribute data to obtain the character-level features, semantic-level features, network-level features, and time-series features of the domain name to be tested. The character-level features, semantic-level features, network-level features, and temporal-level features are fused to obtain the domain name fusion features of the domain name to be tested. Based on the domain name fusion characteristics, the domain name to be tested is detected and processed to obtain the detection result of the domain name to be tested; wherein, the detection result includes either a normal domain name type or a pseudo-random domain name type.

2. The method according to claim 1, characterized in that, The character-level features include character embedding features, character depth features, and character statistical features; the multi-level feature extraction processing of the domain name attribute data to obtain the character-level features, semantic-level features, network-level features, and temporal-level features of the domain name to be tested includes: The domain name attribute data is serialized and embedded to obtain the character embedding feature; The domain name attribute data is subjected to character depth feature extraction processing to obtain the character depth features; The domain name attribute data is processed by character statistical operations to obtain the character statistical features.

3. The method according to claim 1, characterized in that, The semantic-level features include lifetime semantic features, query behavior semantic features, and response behavior semantic features; the multi-level feature extraction processing of the domain name attribute data to obtain the character-level features, semantic-level features, network-level features, and time-series features of the domain name to be tested includes: The domain name attribute data is subjected to lifetime semantic modeling to obtain the lifetime semantic features; The domain name attribute data is subjected to query behavior semantic modeling to obtain the query behavior semantic features; The domain attribute data is subjected to response behavior semantic modeling to obtain the response behavior semantic features.

4. The method according to claim 1, characterized in that, The network-level features include source network features and Domain Name System (DNS) network features; the multi-level feature extraction processing of the domain name attribute data to obtain the character-level features, semantic-level features, network-level features, and temporal-level features of the domain name to be tested includes: The source network topology modeling process is performed on the domain name attribute data to obtain the source network characteristics; The domain name attribute data is processed by domain name system network topology modeling to obtain the domain name system network characteristics.

5. The method according to claim 1, characterized in that, The multi-level feature extraction process on the domain name attribute data yields character-level features, semantic-level features, network-level features, and time-series features of the domain name to be tested, including: The domain name attribute data is subjected to time-series feature extraction processing to obtain the time-series features.

6. The method according to claim 1, characterized in that, The step of detecting the domain name to be tested based on the domain name fusion characteristics to obtain the detection result of the domain name to be tested includes: Based on the domain name fusion features and combined with a pre-trained domain name recognition model, the domain name to be tested is detected to obtain the detection probability of the domain name to be tested. If the detection probability is greater than the probability threshold, the detection result is determined to be the pseudo-random domain name type; otherwise, the detection result is determined to be the normal domain name type.

7. The method according to claim 6, characterized in that, The method further includes: The probability threshold is determined based on the domain name attribute data and the preset benchmark threshold.

8. The method according to any one of claims 1-7, characterized in that, The method further includes at least one of the following: Based on the detection results, interpretability analysis is performed on the domain name to be tested to obtain the interpretability analysis results of the domain name to be tested. If the detection result is the pseudo-random domain name type, the domain name to be tested shall be processed.

9. A pseudo-random domain name detection device, characterized in that, The device includes: The data acquisition module is used to acquire the domain attribute data of the domain name to be tested. The feature extraction module is used to perform multi-level feature extraction processing on the domain name attribute data to obtain the character-level features, semantic-level features, network-level features and time-series features of the domain name to be tested. The feature fusion module is used to perform feature fusion processing on the character-level features, the semantic-level features, the network-level features, and the temporal-level features to obtain the domain name fusion features of the domain name to be tested. The domain name detection module is used to detect the domain name to be tested based on the domain name fusion characteristics, and obtain the detection result of the domain name to be tested; wherein, the detection result includes either a normal domain name type or a pseudo-random domain name type.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements a pseudo-random domain name detection method according to any one of claims 1 to 8.

Images