IDENTIFICATION OF DOMAIN NAMES

Description

Background

[0001] Currently, in the process of accessing a network, a terminal can acquire an Internet protocol (i.e. IP for short) address of a target terminal through a domain name system (i.e. DNS for short) server. The terminal then establishes a communication link with the target terminal through the IP address of the target terminal, and then interacts data with the target terminal. In actual networking, a terminal is at a risk of being infected by a virus program. The infected terminal will transmit data with a malicious terminal set by a lawbreaker, which brings a large security risk to the network.

[0002] In order to prevent data transmission between the infected terminal and the malicious terminal, after receiving a domain name resolution request sent by the terminal, the DNS server performs character extraction on a domain name included in the domain name resolution request. Whether the domain name is legitimate is determined by comparing the character with a stored character feature library.

[0003] Chinese Patent Application CN107807987 discloses a URL string classification method, in order to identify malicious URL strings, comprising: acquiring a string to be classified; inputting the string to be classified into a feature extractor to obtain a feature vector corresponding to the string to be classified; inputting the feature vector into a classifier to obtain the classification result of the string to be classified. It can be seen that the string classification method disclosed by the invention only uses the characteristics of the string itself in the process of string classification, that is, the string to be classified is directly input into the feature extractor to obtain the feature vector, and the classifier classifies the string to be classified according to the feature vector to avoid using other information associated with the string to be classified. The invention also discloses a string classification system, a string classification device and a computer-readable storage medium, which can also realize the above technical effects.

[0004] Chinese Patent Application No. 201610131461. 1 discloses a suspicious detection method based on domain name readability and domain name resolution behavior. The method detects the domain name used in attacks based on DNS query log. The method of the invention first extracts a domain name field from the DNS query log, then extracts readability characteristics of the domain name field based on a 13-dimensional feature vector, and performs detection on the feature vector by using a C4.5 generation algorithm to obtain a suspicious domain name, and finally detects resolution behavior of the suspicious domain name and obtains the malicious domain name. In the invention, the detection of Pinyin domain name is introduced in the readability detection of domain name, so as to reduce the false alarm of Chinese Pinyin domain name detection; however, a large number of domain names with Pinyin or combinations of word initials will be falsely reported as suspicious domain names. In order to reduce the false alarm rate of such domain name types, the resolution behavior of the suspicious domain name is detected again, and finally the domain name involved in attacks in the DNS query log is obtained.

[0005] Yong Shi, Gong Chen, Juntao Li, et al. Malicious Domain Name Detection Based on Extreme Machine Learning [J], published online: 3 July 2017 © Springer Science+Business Media, LLC 2017, discloses a malicious domain detection that is one of the most effective approaches applied in detecting Advanced Persistent Threat (APT), the most sophisticated and stealthy threat to modern network. Domain name analysis provides security experts with insights to identify the Command and Control (C&C) communications in API attacks. In this paper, we propose a machine learning based methodology to detect malware domain names by using Extreme Learning Machine (ELM). ELM is a modem neural network with high accuracy and fast learning speed. We apply ELM to classify domain names based on features extracted from multiple resources. Our experiment reveals the introduced detection method is able to perform high detection rate and accuracy (of more than 95%). The fast learning speed of our ELM based approach is also demonstrated by a comparative experiment. Hence, we believe our method using ELM is both effective and efficient to identify malicious domains and therefore enhance the current detection mechanism of APT attacks.Brief Description of the Drawings

[0006] FIG. 1 is a flowchart of a method for identifying a domain name according to an example of the present disclosure; FIG. 2 is a flowchart of a method for determining a sequence matrix according to an example of the present disclosure; FIG. 3 is a flowchart of a method for calculating a feature vector according to an example of the present disclosure; FIG. 4 is a diagram shows the logic structure of an input and output gate according to an example of the present disclosure; FIG. 5 is a diagram shows the logic structure of a feedback gate according to an example of the present disclosure; FIG. 6 is a flowchart of a method for training a domain name feature analysis model and a domain name classification model according to an example of the present disclosure; FIG. 7 is a schematic structural diagram of an apparatus for identifying a domain name according to an example of the present disclosure; FIG. 8 is a schematic structural diagram of a network device according to an example of the present disclosure. Detailed Description

[0007] The above objects, features and advantages of the present disclosure will become more apparent from the following detailed description in combination with drawings and specific implementations. An example of the present disclosure provides a method for identifying a domain name, and the method is applicable to a network device having a domain name resolution function, for example, a DNS server.

[0008] In the event that a terminal (which can be called a source device) needs to send a packet to a server (which can be called a destination device), the source device first acquires a domain name of the destination device. For example, when a user wants to visit a website, the user may input a domain name of the website. The source device sends a domain name resolution request to the network device. The domain name resolution request includes a domain name of the destination device. The network device determines an IP address corresponding to the domain name according to a pre-stored correspondence between domain names and IP addresses. The network device then sends the IP address to the source device, so that the source device can send a packet to the destination device by this IP address.

[0009] In the example of the present disclosure, the network device is provided with a domain name feature analysis model and a domain name classification model. The domain name feature analysis model includes an input and output gate. When the network device receives a domain name resolution request sent by the terminal, the network device identifies whether the domain name included in the domain name resolution request is a legal domain name by using the domain name feature analysis model and the domain name classification model.

[0010] If the domain name is an illegal domain name, the network device does not send a response message to the terminal, so as to prevent the source device from sending a data packet to the malicious terminal. If the domain name is a legal domain name, the network device sends a response message carrying an IP address corresponding to the domain name to the terminal, so that the terminal accesses a terminal corresponding to this IP address.

[0011] The method for identifying a domain name according to the example of the present disclosure can improve the accuracy of identifying a domain name, thereby improving the security of user data. As shown in FIG. 1, the method includes the following blocks 101-105.

[0012] At block 101, a network device receives a domain name resolution request sent by a terminal.

[0013] The domain name resolution request includes a domain name to be identified, and the domain name includes at least one character.

[0014] In the example of the present disclosure, in order to send a packet to the destination device, the source device (i.e. the terminal) first sends a domain name resolution request to the network device. The domain name resolution request carries a domain name of the destination device (i.e. a domain name to be identified). After receiving the domain name resolution request, the network device acquires the domain name to be identified by resolving the domain name resolution request .

[0015] The destination device is a network device with a domain name, which may be a host, a server, a virtual machine or the like.

[0016] At block 102, the network device determines a sequence matrix corresponding to the domain name.

[0017] In the example of the present disclosure, after acquiring the domain name to be identified, the network device calculates the sequence matrix corresponding to the domain name. The sequence matrix includes at least one character vector. Each of the at least one character vector corresponds to each of the at least one character one to one. The calculation method of the sequence matrix will be described in detail later.

[0018] At block 103, the network device sequentially inputs each of the at least one character vector to the input and output gate.

[0019] In the example of the present disclosure, the domain name feature analysis model includes an input and output gate. The input and output gate includes a logical operation rule between a plurality of activation functions. The activation function may be a tanh activation function. After determining the sequence matrix, the network device sequentially inputs each character vector included in the sequence matrix to the input and output gate. The formula of the tanh activation function is: F x = e x − e − x / e x + e − x where e is the base of the natural logarithm.

[0020] The network device sequentially inputs each character vector in the sequence matrix to the input and output gate to calculate a feature vector corresponding to the sequence matrix.

[0021] At block 104, the network device obtains a feature vector corresponding to the sequence matrix by performing logical operation processing on each of the at least one character vector respectively based on the logical operation rule between the plurality of activation functions.

[0022] In the example of the present disclosure, for each character vector input to the input and output gate, the network device obtains the feature vector corresponding to the sequence matrix by performing logical operation processing on the character vector input to the input and output gate through the logical operation rule between the plurality of activation functions. The logical operation processing includes arithmetic and logical operations. The specific process of performing logical operation processing on the character vector through the input and output gate will be descried in detail later.

[0023] At block 105, the network device determines whether the domain name is a legal domain name by inputting the feature vector corresponding to the sequence matrix into the domain name classification model.

[0024] In the example of the present disclosure, the domain name classification model may be a full connection layer in which the number of neurons is 1. The network device inputs the feature vector corresponding to the sequence matrix into the domain name classification model, and the domain name classification model outputs a classification result corresponding to the feature vector. The classification result is used to indicate a probability that the domain name is an illegal domain name. The network device determines whether the domain name is a legal domain name according to the classification result.

[0025] For example, a classification result corresponding to a legal domain name is 0, a classification result corresponding to an illegal domain name is 1, and a preset threshold is 0.6. If the classification result corresponding to the domain name is 0.8>0.6, the network device determines that the domain name is an illegal domain name. If the classification result corresponding to the domain name is 0.2<0.6, the network device determines that the domain name is a legal domain name.

[0026] In the example of the present disclosure, the network device receives a domain name resolution request sent by the terminal. The domain name resolution request includes a domain name to be identified, and the domain name includes at least one character. The network device determines a sequence matrix corresponding to the domain name. The sequence matrix includes at least one character vector, and each of the at least one character vector corresponds to each of the at least one character one to one.

[0027] The network device sequentially inputs each of the at least one character vector to the input and output gate. The input and output gate includes a logical operation rule between a plurality of activation functions. The network device obtains a feature vector corresponding to the sequence matrix by performing logical operation processing on each of the at least one character vector respectively based on the logical operation rule between the plurality of activation functions. The network device determines whether the domain name is a legal domain name by inputting the feature vector corresponding to the sequence matrix into the domain name classification model.

[0028] Based on the example of the present disclosure, it is not necessary to set a character feature library by the technician, and the accuracy of identifying a domain name is improved.

[0029] In an example, if the network device determines that the domain name is a legal domain name, the network device sends a response message to the terminal, wherein the response message carries an IP address corresponding to the domain name.

[0030] In the example of the present disclosure, if the domain name is a legal domain name, the network device determines the IP address corresponding to the domain name according to the pre-stored correspondence between domain names and IP addresses. The network device then sends the determined IP address to the terminal, so that the terminal sends a packet to the destination device by this IP address. If the domain name is an illegal domain name, the network device does not send a response message to the terminal, or the network device sends a prompt message to the terminal, wherein the prompt message is used to indicate that the domain name requested by the terminal is an illegal domain name.

[0031] In the method for identifying a domain name according to the example of the present disclosure, the network device receives a domain name resolution request sent by the terminal. The domain name resolution request includes a domain name to be identified, and the domain name includes at least one character. The network device determines a sequence matrix corresponding to the domain name. The sequence matrix includes at least one character vector, and each of the at least one character vector corresponds to each of the at least one character one to one.

[0032] The network device then sequentially inputs each of the at least one character vector to the input and output gate. The input and output gate includes a logical operation rule between a plurality of activation functions. The network device obtains a feature vector corresponding to the sequence matrix by performing logical operation processing on each of the at least one character vector respectively based on the logical operation rule between the plurality of activation functions.

[0033] The network device determines whether the domain name is a legal domain name by inputting the feature vector corresponding to the sequence matrix into the domain name classification model.

[0034] Based on the example of the present disclosure, it is not necessary to set a character feature library by the technician, and the accuracy of identifying a domain name is improved.

[0035] An example of the present disclosure further provides a method for determining a sequence matrix corresponding to a domain name. As shown in FIG. 2, the method includes the following blocks 201-205.

[0036] At block 201, the network device acquires valid characters from the domain name, wherein the valid characters are composed of characters other than stored prefix characters and stored suffix characters in the domain name.

[0037] In the example of the present disclosure, the network device stores prefix characters and suffix characters that are commonly used in domain names. The prefix characters are a network name, such as "www.", "ftp.", and "smtp.", etc.; the suffix characters are a top-level domain name, such as ".com", ".net", ".edu", and ".gov", etc.. The network device identifies the prefix characters and the suffix characters included in the domain name, and then extracts characters other than the prefix characters and the suffix characters. The extracted characters are valid characters. For example, a domain name is "www.google.com". A character string other than "www." and ".com" is extracted to obtain "google".

[0038] At block 202, the network device obtains a first index sequence for the valid characters by determining an index value corresponding to each of the valid characters according to a stored mapping rule between characters and index values.

[0039] In the example of the present disclosure, the network device stores characters that may appear in a domain name, and assigns an index value to each character, thereby generating a mapping rule between characters and index values.

[0040] In a possible implementation, the network device stores characters that may appear in a domain name, and then sequentially numbers each character from 1. The number corresponding to each character is the index value corresponding to each character. For example, characters that appear are a, b, c, and d. The network device determines that the number corresponding to a is 1, the number corresponding to b is 2, the number corresponding to c is 3, and the number corresponding to d is 4. At this time, the index value of a is 1, the index value of b is 2, the index value of c is 3, and the index value of d is 4. Referring to Table 1, the mapping rule between characters and index values provided by the example of the present disclosure is shown. Table 1characterindex valuecharacterindex valueg1a4o2l5f3e6

[0041] After acquiring the valid characters, the network device obtains a first index sequence for the valid characters by determining an index value corresponding to each of the valid characters according to the stored mapping rule between characters and index values. For example, the domain name is "www.google.com". The valid characters are "google". Based on the mapping rule between characters and index values shown in Table 1, the first index sequence is 1, 2, 2, 1, 5, 6.

[0042] At block 203, when the length of the first index sequence is smaller than a standard length, the network device supplements the first index sequence to obtain a second index sequence.

[0043] The second index sequence has the standard length.

[0044] In the example of the present disclosure, after obtaining the first index sequence for the valid characters, the network device determines whether the length of the first index sequence equals to the standard length. The standard length can be set by the technician according to experiences, and the standard length is greater than an upper limit of the length of the first index sequence. For example, the standard length can be set to 60 characters.

[0045] If the length of the first index sequence is smaller than the standard length, the network device supplements the first index sequence to obtain the second index sequence, wherein the second index sequence has the standard length. It can be understood that it is easier to program if valid characters are represented by an index sequence with standard length.

[0046] In a possible implementation, the network device may supplement the first index sequence by a preset character. The preset character, for example, is 0. The network device may add the preset character before the first character of the first index sequence, or may add the preset character after the last character of the first index sequence.

[0047] For example, the first index sequence is 1, 2, 2, 1, 5, 6, and the standard length is 60 characters, and thus the second index sequence is 1, 2, 2, 1, 5, 6, 0, 0, ..., 0, that is, 54 zeros are added after the character 6.

[0048] At block 204, the network device calculates a character vector corresponding to each index value in the second index sequence.

[0049] In the example of the present disclosure, the network device stores a embedding layer neural network, and the embedding layer neural network can be used to convert any character into a character vector. The network device can input the second index sequence to the embedding layer neural network to calculate a character vector corresponding to each index value in the second index sequence. The calculated character vector can be a 128-dimensional vector.

[0050] The process of calculating a character vector corresponding to each character through the embedding layer neural network is known in the prior art, which is not described in this example. By calculating the character vector through the embedding layer neural network, the similarity between characters and the correlation between characters in the context can be effectively learned.

[0051] At block 205, the network device determines the sequence matrix based on the character vector corresponding to each index value in the second index sequence.

[0052] In the example of the present disclosure, the network device calculates a character vector corresponding to each index value in the second index sequence, and then, the network device determines the sequence matrix based on the character vector corresponding to each index value in the second index sequence.

[0053] For example, the second index sequence is 1, 2, 2, 1, 5, 6, 0, 0, ..., 0. The second index sequence has a length of 60 characters, that is, 54 zeros are added after the character 6. The network device inputs the second index sequence to the embedding layer neural network, and outputs character vectors a 1 , a 2 , a 3 , ..., a 60 , wherein a i is a 128-dimensional vector. That is, sixty 128-dimensional character vectors are obtained. The network device determine a sequence matrix of 60*128 by using sixty 128-dimensional character vectors.

[0054] In the example of the present disclosure, the network device converts the domain name identification problem into a natural language processing problem. The network device sets an index value corresponding to each character, and then performs character vectorization on the index value, which is easier to program.

[0055] Another implementation for determining the sequence matrix is also provided in the example of the present disclosure, in which the network device may not extract valid characters.

[0056] Specifically, after acquiring the domain name to be identified, the network device obtains an index sequence corresponding to the domain name (which can be referred to as a third index sequence for ease of description) by determining an index value corresponding to each character included in the domain name. The network device determines whether the length of the third index sequence equals to the standard length. If the length of the third index sequence is smaller than the standard length, the network device supplements the third index sequence to obtain the fourth index sequence, wherein the fourth index sequence has the standard length. The network device then calculates a character vector corresponding to each index value in the fourth index sequence. The network device thus determines the sequence matrix by using the character vector corresponding to each index value in the fourth index sequence.

[0057] In the method for determining a sequence matrix corresponding to a domain name according to the example of the present disclosure, the network device first extracts characters with identification function (which may be referred to as valid characters) from the domain name, and then determines the sequence matrix corresponding to the domain name according to the valid characters. In this case, it is not necessary to calculate all the characters included in the domain name, improving the efficiency of determining the sequence matrix.

[0058] An example of the present disclosure further provides a method for calculating a character vector. As shown in FIG. 3, the method includes the following blocks 301-303.

[0059] At block 301, the network device acquires a first character vector currently input to the input and output gate, an output value of a second character vector input to the input and output gate last time, and a feedback value of the second character vector input to the input and output gate last time.

[0060] In the example of the present disclosure, the network device sequentially inputs each character vector included in the sequence matrix to the input and output gate. For convenience of description, the character vector currently input to the input and output gate is referred to as a first character vector, and the character vector that was input to the input and output gate last time is referred to as a second character vector.

[0061] The network device acquires the first character vector, the output value of the second character vector, and the feedback value of the second character vector. For a character vector that is first input to the input and output gate, an output value and a feedback value of a character vector input to the input and output gate last time are all 0. The calculation method of the feedback value will be described in detail later.

[0062] For example, the network device first inputs the character vector a 1 to the input and output gate and outputs an output value of a 1 , and inputs the character vector a 1 to a feedback gate and outputs a feedback value of a 1 . The network device then inputs the character vector a 2 to the input and output gate and outputs an output value of a 2 . The network device acquires the output values of a 2 and a 1 and the feedback value of a 1 for subsequent operations.

[0063] At block 302, the network device obtains an output value of the first character vector by performing a first logic operation on the first character vector, the output value of the second character vector, and the feedback value of the second character vector.

[0064] FIG. 4 shows a logical structure of an input and output gate according to the example of the present disclosure. Based on the input and output gate as shown in FIG. 4, the network device obtains an output value of the first character vector by performing the first logic operation on the first character vector, the output value of the second character vector, and the feedback value of the second character vector. The specific operation process includes the following steps 1-5.

[0065] At step 1, the network device obtains a first weighted result by performing a first weighted calculation on the first character vector and the feedback value of the second character vector according to a first weight matrix.

[0066] At step 2, the network device obtains a second weighted result by performing a second weighted calculation on the first character vector and the feedback value of the second character vector according to a second weight matrix.

[0067] The first weight matrix and the second weight matrix may be the same or not.

[0068] At step 3, the network device obtains a first operation result by inputting the first weighted result and a first offset parameter to a first activation function. The corresponding calculation formula may be as follows: i t = tanh w i ⋅ h t − 1 , x t + b i where, the first activation function is a tanh activation function, h t-1 is the feedback value of the character vector last input to the input and output gate, x t is the character vector currently input to the input and output gate, and w i is the first weight matrix, and b i is the first offset parameter, and it is the first operation result.

[0069] At step 4, the network device obtains a second operation result by inputting the second weighted result and a second offset parameter to a second activation function. The corresponding calculation formula may be as follows: C t ˜ = tanh w c ⋅ h t − 1 x t + b c where, the second activation function is a tanh activation function, w c is the second weight matrix, b c is the second offset parameter, C t ˜ is the second operation result, and h t-1 and x t are the same as the h t-1 and x t in formula (2).

[0070] The above it and C t ˜ are determined by the feedback value of the second character vector and the first character vector, and it represents a final input data in the current calculation, determined by the feedback value of the second character vector and the first character vector; C t ˜ represents data that needs to be retained in a feedback value used in the current calculation and determined by the feedback value of the second character vector and the first character vector.

[0071] In an example, the first offset parameter and the second offset parameter may be the same or not.

[0072] At step 5, the network device obtains the output value corresponding to the first character vector by multiplying the first operation result by the second operation result, and adding the multiplied result with the output value of the second character vector. The corresponding calculation formula may be as follows: C t = i t * C t ˜ + C t − 1 where, C t is the output value of the first character vector, C t-1 is the output value of the second character vector, it is the first operation result, and C t ˜ is the second operation result.

[0073] In an example, the network device stores the output value of the first character vector for subsequent logical operation processing.

[0074] At block 303, the network device determines a feature vector corresponding to the sequence matrix by the output value of the at least one character vector.

[0075] In the example of the present disclosure, based on the above processing, for any character vector, after inputting this character vector to the input and output gate, the network device obtains the output value of this character vector. In this way, the network device can obtain the output value of each character vector included in the sequence matrix. The network device determines the feature vector corresponding to the sequence matrix based on the output value of each character vector.

[0076] For example, the sequence matrix includes a 1 , a 2 , a 3 . The output value of a 1 is x, the output value of a 2 is y, and the output value of a 3 is z. Thus the feature vector corresponding to the sequence matrix is (x, y, z).

[0077] In the example of the present disclosure, the logic operation of the input and output gate in the existing recurrent neural network is simplified, the processing amount of the network device is reduced, and the accuracy of identifying a domain name is improved.

[0078] Further, in the example of the present disclosure, the domain name feature analysis model further includes a feedback gate. After obtaining the output value of the character vector currently input to the input and output gate, the network device further calculates a feedback value of the character vector currently input to the input and output gate.

[0079] The specific process may include: obtaining, by the network device, the feedback value of the first character vector by performing a second logic operation on the output value of the first character vector, the first character vector, and the feedback value of the second character vector.

[0080] The feedback value is used by the network device to calculate an output value of a character vector input to the input and output gate next time.

[0081] In the example of the present disclosure, for any character vector, the network device inputs the character vector to the input and output gate of the domain name feature analysis model. At the same time, the network device also inputs the character vector to the feedback gate of the domain name feature analysis model. That is, the character vector currently input to the input and output gate and the character vector currently input to the feedback gate are the same character vector. Similarly, the character vector input to the input and output gate last time and the character vector input to the feedback gate last time are the same one.

[0082] It can be understood that for a character vector that is first input to the feedback gate, a feedback value of a character vector input to the feedback gate last time is 0.

[0083] FIG. 5 shows a logical structure of the feedback gate according to the example of the present disclosure. Based on the feedback gate as shown in FIG. 5, the network device obtains a feedback value of the character vector currently input to the feedback value by performing the second logic operation on the output value of the first character vector, the first character vector, and the feedback value of the second character vector. The specific operation process includes the following steps 1-4.

[0084] At step 1, the network device obtains a third weighted result by performing a third weighted calculation on the first character vector and the feedback value of the second character vector according to a third weight matrix.

[0085] At step 2, the network device obtains a third operation result by inputting the third weighted result and a third offset parameter to a third activation function. The corresponding calculation formula may be as follows: O t = tanh w o ⋅ h t − 1 , x t + b o where the third activation function is a tanh activation function, h t-1 is the feedback value of the second character vector, x t is the first character vector, w o is the third weight matrix, b o is the third offset parameter, and O t is the third operation result. O t represents data selected from the feedback value of the second character vector and the first character vector that needs to be fed back to the next calculation, and data that needs to be stored in the current output (i.e., C t ).

[0086] At step 3, the network device obtains a fourth operation result by inputting the output value of the first character vector to a fourth activation function.

[0087] At step 4, the network device obtains the feedback value of the first character vector by multiplying the third operation result by the fourth operation result. The corresponding calculation formula may be as follows: h t = O t * tanh C t where the fourth activation function is a tanh activation function, C t is the output value of the first character vector, O t is the third operation result, and h t is the feedback value of the first character vector.

[0088] In an example, the network device stores the feedback value of the first character vector for subsequent logical operation processing.

[0089] In the above formula (2), w i •[h t-1 ,x t ]=w 1 *h t-1 +w 2 *x t . In the example of the present disclosure, the network device converts each character into a 128-dimensional character vector through the embedding layer. Correspondingly, h t-1 and x t are both 128-dimensional vectors, b i is a 128-dimensional vector, and w i is a matrix of 128* 128. w 1 *h t-1 is a vector of 128*1, w 2 *x t is also a vector of 128*1, and w i •[ h t-1 , x t ]+ b i is a 128-dimensional vector.

[0090] Similarly, in the above formula (3), w c is a matrix of 128*128, and b c is a 128-dimensional vector. In the above formula (5), w o is a matrix of 128*128, and b o is a 128-dimensional vector. In the above formula (4), C t is a matrix of 128*128.

[0091] In the example of the present disclosure, the logic operation of the feedback gate in the existing recurrent neural network is simplified, the processing amount of the network device is reduced, and the accuracy of identifying a domain name is improved.

[0092] An example of the present disclosure further provides a method for training a domain name feature analysis model and a domain name classification model, which may be performed by a network device, wherein the network device may be a network device having a data processing function. As shown in FIG. 6, the method includes the following blocks 601-606.

[0093] At block 601, the network device acquires a stored training sample set.

[0094] The training sample set includes a plurality of positive samples and a plurality of negative samples. Each of the positive samples is a sequence matrix corresponding to a legal domain name, and each of the negative samples is a sequence matrix corresponding to an illegal domain name.

[0095] In the example of the present disclosure, the technician inputs a plurality of legal domain names in advance in the network device. The network device obtains the positive sample by determining a sequence matrix corresponding to each legal domain name. The network device may also acquire illegal domain names, and the illegal domain names may be obtained by the network device through crawling from the network; or may be generated by the network device through a domain name generation algorithm (i.e., DGA for short). The network device obtains the negative sample by determining a sequence matrix corresponding to each illegal domain name.

[0096] In this way, the network device can obtain a training sample set. The specific process of determining a sequence matrix refers to the related description of block 102, which is not described herein again.

[0097] At block 602, the network device obtains an output value corresponding to each character vector included in each sequence matrix by sequentially inputting each character vector included in each sequence matrix to a first initial training model.

[0098] The first initial training model may be a recurrent neural network, and the recurrent neural network includes an input and output gate and a feedback gate.

[0099] At block 603, the network device determines a feature vector corresponding to each sequence matrix based on the output value of each character vector in this sequence matrix.

[0100] In the example of the present disclosure, the specific process of blocks 602 and 603 may refer to the related description of blocks 301 to 303, which is not described herein again.

[0101] At block 604, the network device obtains a domain name identification result corresponding to each sequence matrix by inputting the feature vector corresponding to this sequence matrix to a second initial training model.

[0102] The second initial training model is a full connection layer.

[0103] The process of this block may refer to the related description of block 105, which is not described herein again.

[0104] At block 605, the network device obtains the domain name feature analysis model by adjusting the first weighted matrix, the second weighted matrix, the third weighted matrix, the first offset parameter, the second offset parameter and the third offset parameter included in the first initial training model by using the domain name identification result corresponding to each sequence matrix through a back propagation algorithm.

[0105] The back propagation algorithm may be a back propagation trough time (i.e. BPTT for short) algorithm.

[0106] In the example of the present disclosure, the network device obtains the domain name feature analysis model by adjusting the first weighted matrix, the second weighted matrix, the first offset parameter and the second offset parameter included in the input and output gate and the third weighted matrix and the third offset parameter included in the feedback gate, according to the domain name identification result corresponding to each sequence matrix (i.e., each sample) and an actual classification result of a domain name corresponding to the sequence matrix (such as a legal domain name or an illegal domain name), through the BPTT algorithm.

[0107] The process of adjusting the recurrent neural network by the BPTT algorithm is known in the prior art, which is not described in the example of the present disclosure.

[0108] At block 606, the network device obtains the domain name classification model by adjusting the second initial training model by using the domain name identification result corresponding to each sequence matrix through the back propagation algorithm.

[0109] In the example of the present disclosure, the full connection layer includes a weight vector, which is a 128-dimensional vector. The network device obtains the domain name classification model by adjusting the value of the weight vector included in the full connection layer according to the domain name identification result corresponding to each sequence matrix (i.e., each sample) and the actual classification result of the domain name corresponding to the sequence matrix (such as a legal domain name or an illegal domain name), through the back propagation algorithm.

[0110] The process of adjusting the full connection layer by the back propagation algorithm is known in the prior art, which is not described in the example of the present disclosure.

[0111] In the examples of the present disclosure, the method examples are described as combinations of a series of actions for the sake of brief description, but those skilled in the art should understand that the examples of the present disclosure are not limited by the order of the actions described. Because some blocks may be performed in other order or simultaneously in accordance with examples of the present disclosure. In addition, those skilled in the art should understand that the examples described in the specification are all preferred examples, and the actions involved are not necessary for the examples of the present disclosure. Referring to FIG. 7, FIG.7 shows an apparatus for identifying a domain name according to an example of the present disclosure. The apparatus is applicable to a network device. The network device is provided with a domain name feature analysis model and a domain name classification model. The domain name feature analysis model includes an input and output gate. The apparatus includes a receiving module 710, a first determination module 720, a first input module 730, a processing module 740, and a second determination module 750. The description of each module is as follows.

[0112] The receiving module 710 is to receive a domain name resolution request sent by a terminal, wherein the domain name resolution request includes a domain name to be identified, and the domain name includes at least one character.

[0113] The first determination module 720 is to determine a sequence matrix corresponding to the domain name, wherein the sequence matrix includes at least one character vector, and each of the at least one character vector corresponds to each of the at least one character one to one.

[0114] The first input module 730 is to sequentially input each of the at least one character vector to the input and output gate, wherein the input and output gate includes a logic operation rule between a plurality of activation functions.

[0115] The processing module 740 is to obtain a feature vector corresponding to the sequence matrix by performing logical operation processing on each of the at least one character vector respectively based on the logical operation rule between the plurality of activation functions.

[0116] The second determination module 750 is determine whether the domain name is a legal domain name by inputting the feature vector corresponding to the sequence matrix into the domain name classification model.

[0117] In an example of the present disclosure, the first determination module 720 may include a first acquiring submodule, a first determination submodule, a supplementing submodule, a first calculation submodule, and a second determination submodule.

[0118] The first acquiring submodule is to acquire valid characters from the domain name, wherein the valid characters are composed of characters other than stored prefix characters and stored suffix characters in the domain name.

[0119] The first determination submodule is to obtain a first index sequence for the valid characters by determining an index value corresponding to each of the valid characters according to a stored mapping rule between characters and index values.

[0120] The supplementing submodule is to supplement the first index sequence to obtain a second index sequence if the length of the first index sequence is smaller than a standard length, wherein the second index sequence has the standard length.

[0121] The first calculation submodule is to calculate a character vector corresponding to each index value in the second index sequence.

[0122] The second determination submodule is to determine the sequence matrix based on the character vector corresponding to each index value in the second index sequence.

[0123] In an example of the present disclosure, the processing module 740 may include a second acquiring submodule, an operation submodule, and a third determination submodule.

[0124] The second acquiring submodule is to acquire a first character vector currently input to the input and output gate, an output value of a second character vector input to the input and output gate last time, and a feedback value of the second character vector input to the input and output gate last time.

[0125] The operation submodule is to obtain an output value of the first character vector by performing a first logic operation on the first character vector, the output value of the second character vector, and the feedback value of the second character vector.

[0126] The third determination submodule is to determine the feature vector corresponding to the sequence matrix based on the obtained output value of the at least one character vector.

[0127] In an example of the present disclosure, the operation submodule 742 may include a first calculation unit, a second calculation unit, a first input unit, a second input unit, and a third calculation unit.

[0128] The first calculation unit is to obtain a first weighted result by performing a first weighted calculation on the first character vector and the feedback value of the second character vector according to a first weight matrix.

[0129] The second calculation unit is to obtain a second weighted result by performing a second weighted calculation on the first character vector and the feedback value of the second character vector according to a second weight matrix.

[0130] The first input unit is to obtain a first operation result by inputting the first weighted result and a first offset parameter to a first activation function.

[0131] The second input unit is to obtain a second operation result by inputting the second weighted result and a second offset parameter to a second activation function.

[0132] The third calculation unit is to obtain an output value corresponding to the first character vector by multiplying the first operation result by the second operation result, and adding the multiplied result and the output value of the second character vector.

[0133] In an example of the present disclosure, the domain name feature analysis model further includes a feedback gate, and the apparatus further includes an operation module.

[0134] The operation module is to obtain a feedback value of the first character vector by performing a second logic operation on the output value of the first character vector, the first character vector, and the feedback value of the second character vector.

[0135] In an example of the present disclosure, the operation module may include a second calculation submodule, a first input submodule, a second input submodule, and a multiplication submodule.

[0136] The second calculation submodule is to obtain a third weighted result by performing a third weighted calculation on the first character vector and the feedback value of the second character vector according to a third weight matrix.

[0137] The first input submodule is to obtain a third operation result by inputting the third weighted result and a third offset parameter to a third activation function.

[0138] The second input submodule is to obtain a fourth operation result by inputting the output value of the first character vector to a fourth activation function.

[0139] The multiplication submodule is to obtain the feedback value of the first character vector by multiplying the third operation result by the fourth operation result.

[0140] In an example of the present disclosure, the apparatus further includes an acquiring module, a second input module, a third determination module, a third input module, a first adjustment module, and a second adjustment module.

[0141] The acquiring module is to acquire a stored training sample set, wherein the training sample set includes a plurality of positive samples and a plurality of negative samples; each of the positive samples is a sequence matrix corresponding to a legal domain name, and each of the negative samples is a sequence matrix corresponding to an illegal domain name.

[0142] The second input module is to obtain an output value corresponding to each character vector included in each sequence matrix by sequentially inputting each character vector included in each sequence matrix to a first initial training model.

[0143] The third determination module is to determine a feature vector corresponding to each sequence matrix based on the output value of each character vector in this sequence matrix.

[0144] The third input module is to obtain a domain name identification result corresponding to each sequence matrix by inputting the feature vector corresponding to this sequence matrix to a second initial training model.

[0145] The first adjustment module is to obtain the domain name feature analysis model by adjusting the first weighted matrix, the second weighted matrix, the third weighted matrix, the first offset parameter, the second offset parameter and the third offset parameter included in the first initial training model by using the domain name identification result corresponding to each sequence matrix, through a back propagation algorithm.

[0146] The second adjustment module is to obtain the domain name classification model by adjusting the second initial training model by using the domain name identification result corresponding to each sequence matrix, through the back propagation algorithm.

[0147] The apparatus for identifying a domain name according to the example of the present disclosure is applicable to a network device, wherein the network device is provided with a domain name feature analysis model and a domain name classification model, and the domain name feature analysis model includes an input and output gate. The network device receives a domain name resolution request sent by the terminal, wherein the domain name resolution request includes a domain name to be identified, and the domain name includes at least one character. The network device determines a sequence matrix corresponding to the domain name. The sequence matrix includes at least one character vector, and each of the at least one character vector corresponds to each of the at least one character one to one.

[0148] The network device then sequentially inputs each of the at least one character vector to the input and output gate. The input and output gate includes a logical operation rule between a plurality of activation functions. The network device obtains a feature vector corresponding to the sequence matrix by performing logical operation processing on each of the at least one character vector respectively based on the logical operation rule between the plurality of activation functions.

[0149] The network device determines whether the domain name is a legal domain name by inputting the feature vector corresponding to the sequence matrix to the domain name classification model.

[0150] Based on the example of the present disclosure, it is not necessary to set a character feature library by the technician, and the accuracy of identifying a domain name is improved.

[0151] Corresponding to the above method example for identifying a domain name, an example of the present disclosure further provides a network device. Referring to FIG. 8, FIG. 8 shows a structural block diagram of a network device according to an example of the present disclosure.

[0152] The network device includes a processor 801, a transceiver 802, and a machine readable storage medium 803 that stores machine executable instructions.

[0153] The network device is provided with a domain name feature analysis model and a domain name classification model, wherein the domain name feature analysis model includes an input and output gate. The domain name feature analysis model and the domain name classification model can be implemented by software function modules. It can be understood that the above software function module may be loaded into a flash, and is called and executed by the processor 801; or the above software function module may be set in the processor, and is accessed and executed by the processor 801.

Claims

1. A method for identifying a domain name, which is applicable to a network device, wherein the network device is provided with a domain name feature analysis model and a domain name classification model, and the domain name feature analysis model comprises an input and output gate and a feedback gate, wherein the network device stores an embedding layer neural network which is used to convert a character into a character vector; the method comprises: receiving a domain name resolution request sent by a terminal (101), wherein the domain name resolution request comprises a domain name to be identified, and the domain name comprises at least one character; determining a sequence matrix corresponding to the domain name (102), wherein the sequence matrix comprises at least one character vector, and each of the at least one character vector corresponds to each of the at least one character one to one; sequentially inputting each of the at least one character vector to the input and output gate (103), wherein the input and output gate comprises a logic operation rule between a plurality of tanh activation functions; obtaining a feature vector corresponding to the sequence matrix by performing logical operation processing on each of the at least one character vector respectively based on the logical operation rule between the plurality of tanh activation functions (104); and inputting the feature vector corresponding to the sequence matrix to the domain name classification model, outputting a classification result corresponding to the feature vector, and determining whether the domain name is a legal domain based on the classification result (105), wherein the classification result is used to indicate a probability that the domain name is an illegal domain name; if the classification result is smaller than a preset threshold, the domain name is determined as a legal domain name; when the domain name is determined as an illegal domain name, not sending a response message to the terminal; when the domain name is determined as a legal domain name, sending a response message carrying an IP address corresponding to the domain name to the terminal, so that the terminal accesses a terminal corresponding to this IP address; wherein determining a sequence matrix corresponding to the domain name (102) comprises: acquiring valid characters from the domain name (201), wherein the valid characters are extracted characters from the domain name other than stored prefix characters and stored suffix characters, wherein the stored prefix characters are a network name, and the stored suffix characters are a top-level domain name; obtaining a first index sequence for the valid characters by determining an index value corresponding to each of the valid characters according to a stored mapping rule between characters and index values (202); adding a preset character before a first character of the first index sequence or after a last character of the first index sequence to obtain a second index sequence if the length of the first index sequence is smaller than a standard length (203), wherein the second index sequence has the standard length, wherein the standard length is set as 60 characters; inputting the second index sequence to the embedding layer neural network to calculate a character vector corresponding to each index value in the second index sequence (204); and determining the sequence matrix based on the character vector corresponding to each index value in the second index sequence (205), wherein the sequence matrix is a matrix composed of character vectors corresponding to all of index values in the second index sequence, wherein obtaining the feature vector corresponding to the sequence matrix by performing logical operation processing on each of the at least one character vector respectively based on the logical operation rule between the plurality of tanh activation functions (104) comprises: acquiring a first character vector currently input to the input and output gate, an output value of a second character vector input to the input and output gate last time, and a feedback value of the second character vector input to the input and output gate last time (301), wherein the feedback value of the second character vector is obtained by inputting the second character vector to the feedback gate comprised in the domain name feature analysis model; obtaining an output value of the first character vector by performing a first logic operation on the first character vector, the output value of the second character vector, and the feedback value of the second character vector (302); and determining the feature vector corresponding to the sequence matrix based on the obtained output value of the at least one character vector (303), wherein the feature vector is a vector composed of the output value; wherein obtaining the output value of the first character vector by performing the first logic operation on the first character vector, the output value of the second character vector, and the feedback value of the second character vector (302) comprises: obtaining a first weighted result by performing a first weighted calculation on the first character vector and the feedback value of the second character vector according to a first weight matrix; obtaining a second weighted result by performing a second weighted calculation on the first character vector and the feedback value of the second character vector according to a second weight matrix; obtaining a first operation result by inputting the first weighted result and a first offset parameter to a first tanh activation function, wherein the first operation result is calculated by: i t = tanh w i · h t − 1 , x t + b i , wherein, the first tanh activation function is a tanh activation function, ht-1 is a feedback value of a character vector last input to the input and output gate, xt is a character vector currently input to the input and output gate, and wi is the first weight matrix, and bi is the first offset parameter, and it is the first operation result; obtaining a second operation result by inputting the second weighted result and a second offset parameter to a second tanh activation function, wherein the second operation result is calculated by: C t ˜ = tanh w c · h t − 1 , x t + b c , wherein, the second tanh activation function is a tanh activation function, wc is the second weight matrix, bc is the second offset parameter, C t ˜ is the second operation result; and obtaining an output value corresponding to the first character vector by multiplying the first operation result by the second operation result, and adding the multiplied result and the output value of the second character vector, wherein the output value corresponding to the first character vector is calculated by: C t = i t * C t ˜ + C t − 1 , wherein, Ct is the output value of the first character vector, Ct-1 is the output value of the second character vector, it is the first operation result, and C t ˜ is the second operation result.

2. The method of claim 1, wherein after obtaining the output value of the first character vector, the method further comprises: obtaining a feedback value of the first character vector by performing a second logic operation on the output value of the first character vector, the first character vector, and the feedback value of the second character vector; wherein the feedback value is used to calculate an output value of a character vector input to the input and output gate next time; obtaining the feedback value of the first character vector by performing the second logic operation on the output value of the first character vector, the first character vector, and the feedback value of the second character vector comprises: obtaining a third weighted result by performing a third weighted calculation on the first character vector and the feedback value of the second character vector according to a third weight matrix; obtaining a third operation result by inputting the third weighted result and a third offset parameter to a third tanh activation function, wherein the third operation result is calculated by: O t = tanh w o ⋅ h t − 1 , x t + b o , wherein, the third tanh activation function is a tanh activation function, ht-1 is the feedback value of the second character vector, xt is the first character vector, wo is the third weight matrix, bo is the third offset parameter, and Ot is the third operation result; obtaining a fourth operation result by inputting the output value of the first character vector to a fourth tanh activation function; and obtaining the feedback value of the first character vector by multiplying the third operation result by the fourth operation result, wherein the feedback value of the first character vector is calculated by: h t = O t * tanh C t , wherein, the fourth tanh activation function is a tanh activation function, Ct is the output value of the first character vector, Ot is the third operation result, and ht is the feedback value of the first character vector.

3. The method of claim 3, further comprising: acquiring a stored training sample set, wherein the training sample set comprises a plurality of positive samples and a plurality of negative samples; each of the positive samples is a sequence matrix corresponding to a legal domain name, and each of the negative samples is a sequence matrix corresponding to an illegal domain name; obtaining an output value corresponding to each character vector comprised in each sequence matrix by sequentially inputting each character vector comprised in each sequence matrix to a first initial training model, wherein, the first initial training model is a recurrent neural network and the recurrent neural network comprises an input and output gate and a feedback gate; determining a feature vector corresponding to each sequence matrix based on the output value of each character vector in this sequence matrix; obtaining a domain name identification result corresponding to each sequence matrix by inputting the feature vector corresponding to this sequence matrix to a second initial training model, wherein, the second initial training model is a full connection layer, wherein the full connection layer comprises a weight vector, which is a 128-dimensional vector; obtaining the domain name feature analysis model by adjusting the first weighted matrix, the second weighted matrix, the first offset parameter, the second offset parameter comprised in the input and output gate comprised in the recurrent neural network, and the third weighted matrix and the third offset parameter comprised in the feedback gate comprised in the recurrent neural network, by using the domain name identification result corresponding to each sequence matrix and an actual classification result of a domain name corresponding to the sequence matrix, through a back propagation algorithm; and obtaining the domain name classification model by adjusting a value of the weight vector included in the full connection layer by using the domain name identification result corresponding to each sequence matrix and an actual classification result of a domain name corresponding to the sequence matrix, through the back propagation algorithm.

4. A network device, which is provided with a domain name feature analysis model and a domain name classification model, the domain name feature analysis model comprising an input and output gate and a feedback gate, wherein the network device stores an embedding layer neural network which is used to convert a character into a character vector, and comprises a processor, a transceiver, and a machine readable storage medium storing machine executable instructions; wherein, the transceiver is to receive a domain name resolution request sent by a terminal (101), and transmit the domain name resolution request to the processor, wherein the domain name resolution request comprises a domain name to be identified, and the domain name comprises at least one character; the machine executable instructions are read and executed by the processor to cause the processor to: determine a sequence matrix corresponding to the domain name, wherein the sequence matrix comprises at least one character vector, and each of the at least one character vector corresponds to each of the at least one character one to one; sequentially input each of the at least one character vector to the input and output gate (103), wherein the input and output gate comprises a logic operation rule between a plurality of tanh activation functions; obtain a feature vector corresponding to the sequence matrix by performing logical operation processing on each of the at least one character vector respectively based on the logical operation rule between the plurality of tanh activation functions (104); and input the feature vector corresponding to the sequence matrix to the domain name classification model, output a classification result corresponding to the feature vector, and determine whether the domain name is a legal domain based on the classification result (105), wherein the classification result is used to indicate a probability that the domain name is an illegal domain name; if the classification result is smaller than a preset threshold, the domain name is determined as a legal domain name, when the domain name is determined as an illegal domain name, not send a response message to the terminal; when the domain name is determined as a legal domain name, send a response message carrying an IP address corresponding to the domain name to the terminal, so that the terminal accesses a terminal corresponding to this IP address; wherein determining a sequence matrix corresponding to the domain name (102) comprises: acquiring valid characters from the domain name (201), wherein the valid characters are extracted characters from the domain name other than stored prefix characters and stored suffix characters, wherein the stored prefix characters are a network name, and the stored suffix characters are a top-level domain name; obtaining a first index sequence for the valid characters by determining an index value corresponding to each of the valid characters according to a stored mapping rule between characters and index values (202); adding a preset character before a first character of the first index sequence or after a last character of the first index sequence to obtain a second index sequence if the length of the first index sequence is smaller than a standard length (203), wherein the second index sequence has the standard length, wherein the standard length is set as 60 characters; inputting the second index sequence to the embedding layer neural network to calculate a character vector corresponding to each index value in the second index sequence (204); and determining the sequence matrix based on the character vector corresponding to each index value in the second index sequence (205), wherein the sequence matrix is a matrix composed of character vectors corresponding to all of index values in the second index sequence, wherein the machine executable instructions cause the processor to: acquire a first character vector currently input to the input and output gate, an output value of a second character vector input to the input and output gate last time, and a feedback value of the second character vector input to the input and output gate last time (301), wherein the feedback value of the second character vector is obtained by inputting the second character vector to the feedback gate comprised in the domain name feature analysis model; obtain an output value of the first character vector by performing a first logic operation on the first character vector, the output value of the second character vector, and the feedback value of the second character vector (302); and determine the feature vector corresponding to the sequence matrix through the obtained output value of the at least one character vector (303), wherein the feature vector is a vector composed of the output value; wherein the machine executable instructions cause the processor to: obtain a first weighted result by performing a first weighted calculation on the first character vector and the feedback value of the second character vector according to a first weight matrix; obtain a second weighted result by performing a second weighted calculation on the first character vector and the feedback value of the second character vector according to a second weight matrix; obtain a first operation result by inputting the first weighted result and a first offset parameter to a first tanh activation function, wherein the first operation result is calculated by: i t = tanh w i · h t − 1 , x t + b i , wherein, the first tanh activation function is a tanh activation function, ht-1 is a feedback value of a character vector last input to the input and output gate, xt is a character vector currently input to the input and output gate, and wi is the first weight matrix, and bi is the first offset parameter, and it is the first operation result; obtain a second operation result by inputting the second weighted result and a second offset parameter to a second tanh activation function, wherein the second operation result is calculated by: C t ˜ = tanh w c · h t − 1 , x t + b c , wherein, the second tanh activation function is a tanh activation function, wc is the second weight matrix, bc is the second offset parameter, C t ˜ is the second operation result; and obtain an output value corresponding to the first character vector by multiplying the first operation result by the second operation result, and adding the multiplied result and the output value of the second character vector, wherein the output value corresponding to the first character vector is calculated by: C t = i t * C t ˜ + C t − 1 , wherein, Ct is the output value of the first character vector, Ct-1 is the output value of the second character vector, it is the first operation result, and C t ˜ is the second operation result.

5. The network device of claim 4, wherein the machine executable instructions further cause the processor to: obtain a feedback value of the first character vector by performing a second logic operation on the output value of the first character vector, the first character vector, and the feedback value of the second character vector; wherein the feedback value is used to calculate an output value of a character vector input to the input and output gate next time; wherein the machine executable instructions cause the processor to: obtain a third weighted result by performing a third weighted calculation on the first character vector and the feedback value of the second character vector according to a third weight matrix; obtain a third operation result by inputting the third weighted result and a third offset parameter to a third tanh activation function, wherein the third operation result is calculated by: O t = tanh w o · h t − 1 , x t + b o , wherein, the third tanh activation function is a tanh activation function, ht-1 is the feedback value of the second character vector, xt is the first character vector, wo is the third weight matrix, bo is the third offset parameter, and Ot is the third operation result; obtain a fourth operation result by inputting the output value of the first character vector to a fourth tanh activation function; and obtain the feedback value of the first character vector by multiplying the third operation result by the fourth operation result, wherein the feedback value of the first character vector is calculated by: h t = O t * tanh C t , wherein, the fourth tanh activation function is a tanh activation function, Ct is the output value of the first character vector, Ot is the third operation result, and ht is the feedback value of the first character vector.

6. The network device of claim 5, wherein the machine executable instructions further cause the processor to: acquire a stored training sample set, wherein the training sample set comprises a plurality of positive samples and a plurality of negative samples; each of the positive samples is a sequence matrix corresponding to a legal domain name, and each of the negative samples is a sequence matrix corresponding an illegal domain name; obtain an output value corresponding to each character vector comprised in each sequence matrix by sequentially inputting each character vector comprised in each sequence matrix to a first initial training model, wherein, the first initial training model is a recurrent neural network and the recurrent neural network comprises an input and output gate and a feedback gate; determine a feature vector corresponding to each sequence matrix based on the output value of each character vector in this sequence matrix; obtain a domain name identification result corresponding to each sequence matrix by inputting the feature vector corresponding to this sequence matrix to a second initial training model, wherein, the second initial training model is a full connection layer, wherein the full connection layer comprises a weight vector, which is a 128-dimensional vector; obtain the domain name feature analysis model by adjusting the first weighted matrix, the second weighted matrix, the first offset parameter, the second offset parameter comprised in the input and output gate comprised in the recurrent neural network and the third weighted matrix and the third offset parameter comprised in the feedback gate comprised in the recurrent neural network by using the domain name identification result corresponding to each sequence matrix and an actual classification result of a domain name corresponding to the sequence matrix, through a back propagation algorithm; and obtain the domain name classification model by adjusting a value of the weight vector included in the full connection layer by using the domain name identification result corresponding to each sequence matrix and an actual classification result of a domain name corresponding to the sequence matrix, through the back propagation algorithm.