The application discloses a malicious
domain name detection method and device, belongs to the technical field of
network security, and is used for improving the accuracy and reliability of malicious
domain name detection. The method comprises the following steps: acquiring a given malicious
domain name and a to-be-detected domain name, and preset domain name features of the given malicious domain name and the to-be-detected domain name according to domain name association data; acquiring a malicious
score of the to-be-detected domain name according to the preset domain name features and the given malicious domain name; inputting the malicious
score and the preset domain name features into a pre-trained long short-
term memory network to obtain
hidden layer features output by the long short-
term memory network after
feature coding is performed on the current input; and inputting the malicious
score, the preset domain name features and the
hidden layer features into a pre-trained malicious domain name detection model to acquire
a domain name detection result of the to-be-detected domain name. The method combines the
data processing advantages of two different types of models, processes global features and
time sequence features of the domain name, and is helpful to improving the accuracy and reliability of domain name detection.