CN110830490B - Malicious domain name detection method and system based on area confrontation training deep network - Google Patents

Abstract

The invention discloses a malicious domain name detection method and a system based on a band confrontation training deep network, wherein the method comprises the following steps: (1) acquiring a malicious domain name sample; (2) preprocessing a malicious domain name sample; (3) training a network model, namely selecting C-RNN-GAN to generate an antagonistic network model; (4) obtaining a suspicious domain name sample; (5) judging and outputting; (6) and judging the suspicious domain name. The invention discloses a malicious domain name detection method and system based on a deep network with countermeasure training, which utilize the characteristic of generating the countermeasure network to obtain a discriminator for calculating the truth of a domain name through the countermeasure training. The discriminator judges the robustness according to the multidimensional characteristics behind the domain name sample and can be used as a classifier for malicious domain name detection. The invention adopts the method of generating the countermeasure network, learns the data characteristics behind the malicious domain name sample, is fully suitable for the actual situation of attack and defense countermeasures of network security, and can realize self-learning and self-improvement. The accuracy of domain name classification is effectively improved.

Description

Malicious domain name detection method and system based on deep network with adversarial training

technical field

The invention relates to the technical field of artificial intelligence and control, in particular to a malicious domain name detection method and system based on a deep network with confrontation training.

Background technique

Domain Name System (DNS) is a part of the entire Internet, which completes the mutual mapping between IP addresses and domain names, and is used to resolve domain names into IP addresses during network communication, which is convenient for memory and use. If the DNS configuration is unreasonable, it may lead to slow network speed, the website cannot be opened, and malicious DNS may even cause malicious behaviors such as advertisement pop-ups, fraud, monitoring and hijacking modification.

In recent years, DNS security problems have occurred frequently. DNS, as the largest and most complex distributed database in the world, due to its openness, complexity, hugeness and other characteristics, as well as ill-conceived security at the beginning of its design, coupled with man-made sabotage, makes it difficult for DNS to cope with the increasingly complex modern communication network , DNS faces a very serious security threat. Among them, the more common security threats are DNS spoofing and distributed denial of service attacks. DNS spoofing means that a server makes a wrong domain name resolution for a wrong domain name request. DNS spoofing can cause many security issues, such as directing users to phishing sites, fraudulent sites, and more. Distributed Denial of Service (DDoS) is also one of the security threats faced by DNS. It exploits the vulnerabilities of network protocols and operating systems, and uses deception and camouflage strategies to carry out network attacks, causing servers to exhaust computing resources. As a result, network requests from legitimate users cannot be processed. such as botnets, etc. Therefore, how to solve the security problem of DNS and seek an effective solution is one of the problems that needs to be solved urgently in the current DNS.

In order to solve the problem of DNS security, people have proposed a variety of solutions, among which the most common is domain name detection, which comprehensively calculates the credibility of the current suspicious domain name and detects whether the current domain name is legitimate. Domain name detection can be further divided into two categories: knowledge-based and machine learning-based. Knowledge-based methods detect suspicious domain names by calculating the probability of domain names appearing together. Although this method has high detection accuracy, it requires a lot of expert knowledge. Due to insufficient expert knowledge, the detection recall rate cannot meet the requirements, and malicious domain names are missed; traditional machine learning-based methods require a large number of Sample labeled data is calculated and classified using algorithms such as clustering, support vector machines, and decision trees. This method requires a large amount of manual labeled data and the cooperation of algorithms, and is often difficult to use in large-scale application instances. Therefore, it is necessary to propose a new method that combines the advantages of the above two methods to make up for the shortcomings of the two methods, so as to obtain a better domain name detection effect.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a malicious domain name detection method and system based on a deep network with adversarial training, which can effectively improve the accuracy of malicious domain name detection.

In order to achieve the above purpose of the invention, the present invention provides the following technical solutions: a malicious domain name detection method based on a deep network with adversarial training, comprising the following steps:

(1) Obtaining malicious domain name samples, obtaining threat intelligence from the threat intelligence platform, extracting malicious domain names and querying relevant dimension information of malicious domain names, and screening malicious domain names with high network attack scope and confidence according to malicious behavior to form malicious domain name samples , establish a malicious domain name sample set;

(2) network model training, select C-RNN-GAN to generate an adversarial network model, the network model includes a generator and a discriminator, and use the malicious domain name sample set as the input of the network model for training;

(3) Obtaining suspicious domain name samples, querying the relevant dimension information of suspicious domain names, and forming suspicious domain name samples;

(4) discriminating output, inputting suspicious domain name samples to the discriminator of the network model after training to obtain the currently calculated similarity value;

(5) Determine the suspicious domain name, and determine whether the similarity value is less than the current threshold. If so, the suspicious domain name is a malicious domain name, and it is regarded as a malicious domain name sample and added to the malicious domain name sample set. If not, the suspicious domain name is a legitimate domain name.

Further, the relevant dimension information of the malicious domain name includes one or more of the following information:

Website ranking information, which is Alexa website ranking information;

Page index information, including the number of pages indexed by Baidu, the number of pages indexed by Sogou, and the number of pages indexed by Bing;

Page integrity information, where 0 means no information, 1 means there is information;

Registration place information, where 0 means foreign registration, 1 means domestic registration;

A record information, where 0 means no record, 1 means there is a record;

CNAME record information, where 0 means no record, 1 means there is a record;

CDN usage record information, where 0 means no usage record, 1 means there is a usage record;

Update degree information, which is the number of updates of malicious domain names;

Among them, the A record information is used to specify the IP address record corresponding to the host name or domain name; the CNAME record information refers to the alias record, and the record maps multiple names to the same computer; the CDN usage record is the content delivery network ContentDelivery Network usage record, is Refers to the intelligent virtual network built on the basis of the existing network, so that users can obtain the desired content nearby, reduce network congestion, and improve user access response speed and hit rate.

Further, the loss functions of the generator and discriminator are as follows:

Among them, S _G is the loss function of the generator, used to train the generator; S _D is the loss function of the discriminator, used to train the discriminator; G is the generator, used to generate samples; D is the discriminator, used to distinguish Real samples and generated samples; R is the representation layer, which comes from the previous layer of the discriminator's logical classification layer; x ⁱ is the malicious domain name sample; z ⁱ is the random sequence vector used for the generator input, representing the real sample data; n represents the current number of malicious domain name samples.

Further, both the generator and the discriminator adopt the LSTM long short-term memory network with a depth of 2.

Further, wherein, the threshold is updated by means of threshold self-learning, and the formula is as follows:

at = min( _d , at _-1 ), where at represents the current threshold, at _-1 is the previous threshold, and _d is the similarity value.

The present invention also provides a malicious domain name detection system for the malicious domain name detection method described above, including:

A data acquisition module, which is used to acquire malicious domain name samples and suspicious domain name samples;

A data preprocessing module, which is used to filter malicious domain name samples to form a malicious domain name sample set;

The network model, which uses C-RNN-GAN to generate an adversarial network model, is used for training with malicious domain name samples as input, and then takes suspicious domain name samples as input and outputs calculated values;

The judgment module is used to judge whether the suspicious domain name is a malicious domain name or a legitimate domain name according to the calculated value and the threshold value.

Due to the application of the above technical solutions, the present invention has the following advantages compared with the prior art: the method and system for detecting malicious domain names based on a deep network with adversarial training disclosed in the present invention utilizes the characteristics of a generative adversarial network, and the adversarial training obtains the true and false computed domain names. the discriminator. The method and system of the present invention are fully suitable for the actual situation of network security attack and defense confrontation, and can realize self-learning and self-improvement. The discriminator makes robust judgments based on the multi-dimensional features behind the domain name samples, and can be used as a classifier for malicious domain name detection. Due to the method of generating a confrontation network, the invention learns the data features behind the malicious domain name samples, and effectively improves the accuracy of domain name classification.

Description of drawings

1 is a flowchart of a malicious domain name detection method in the present invention;

Fig. 2 is the structure diagram of the network model in the present invention;

FIG. 3 is a structural diagram of a malicious domain name detection system in the present invention.

Detailed ways

The present invention will be further described below with reference to the principles, drawings and embodiments of the present invention.

In order to overcome the deficiencies of the existing malicious domain name detection methods and effectively improve the accuracy of malicious domain name detection, the present invention proposes a discriminator for obtaining true and false computing data by adversarial training using the characteristics of a generative adversarial network. The discriminator makes robust judgments based on the multi-dimensional features behind the data samples, and can be used as a classifier for malicious domain name detection. Because the method of generating confrontation network is adopted in the present invention, the data features behind malicious samples are learned, and the accuracy of data classification is effectively improved.

Referring to Figures 1 to 3, as shown in the legends, a method for detecting malicious domain names based on a deep network with adversarial training includes the following steps:

(1) Obtaining malicious domain name samples, obtaining threat intelligence from the threat intelligence platform, extracting malicious domain names and querying relevant dimension information of malicious domain names, and screening malicious domain names with high network attack scope and confidence according to malicious behavior to form malicious domain name samples , establish a malicious domain name sample set;

(2) network model training, select C-RNN-GAN to generate an adversarial network model, the network model includes a generator and a discriminator, and use the malicious domain name sample set as the input of the network model for training;

(3) Obtaining suspicious domain name samples, querying the relevant dimension information of suspicious domain names, and forming suspicious domain name samples;

(4) discriminating output, inputting suspicious domain name samples to the discriminator of the network model after training to obtain the currently calculated similarity value;

(5) Determine the suspicious domain name, and determine whether the similarity value is less than the current threshold. If so, the suspicious domain name is a malicious domain name, and it is regarded as a malicious domain name sample and added to the malicious domain name sample set. If not, the suspicious domain name is a legitimate domain name.

In a preferred implementation in this embodiment, the relevant dimension information of the malicious domain name includes one or more of the following information:

Website ranking information, which is Alexa website ranking information;

Page index information, including the number of pages indexed by Baidu, the number of pages indexed by Sogou, and the number of pages indexed by Bing;

Page integrity information, where 0 means no information, 1 means there is information;

Registration place information, where 0 means foreign registration, 1 means domestic registration;

A record information, where 0 means no record, 1 means there is a record;

CNAME record information, where 0 means no record, 1 means there is a record;

CDN usage record information, where 0 means no usage record, 1 means there is a usage record;

Update degree information, which is the number of updates of malicious domain names;

Among them, the A record information is used to specify the IP address record corresponding to the host name or domain name; the CNAME record information refers to the alias record, and the record maps multiple names to the same computer; the CDN usage record is the content delivery network ContentDelivery Network usage record, is Refers to the intelligent virtual network built on the basis of the existing network, so that users can obtain the desired content nearby, reduce network congestion, and improve user access response speed and hit rate.

For the preferred implementation in this embodiment, the loss functions of the generator and the discriminator are as follows:

Among them, S _G is the loss function of the generator, used to train the generator; S _D is the loss function of the discriminator, used to train the discriminator; G is the generator, used to generate samples; D is the discriminator, used to distinguish Real samples and generated samples; R is the representation layer, which comes from the previous layer of the discriminator's logical classification layer; x ⁱ is the malicious domain name sample; z ⁱ is the random sequence vector used for the generator input, representing the real sample data; n represents the current number of malicious domain name samples.

In a preferred implementation in this embodiment, both the generator and the discriminator use an LSTM long short-term memory network with a depth of 2.

The preferred implementation in this embodiment, wherein the threshold is updated by means of threshold self-learning, and the formula is as follows:

at = min( _d , at _-1 ), where at represents the current threshold, at _-1 is the previous threshold, and _d is the similarity value.

The present invention also provides a malicious domain name detection system for the malicious domain name detection method described above, including:

A data acquisition module 10, which is used for acquiring and screening malicious domain name samples and suspicious domain name samples;

The network model 20, which adopts a C-RNN-GAN to generate an adversarial network model, is used for training with malicious domain name samples as input, and then takes suspicious domain name samples as input and outputs calculated values;

The judgment module 30 is used for judging whether the suspicious domain name is a malicious domain name or a legitimate domain name according to the calculated value and the threshold value.

The following is a detailed explanation of each step of the malicious domain name detection method:

Get data and its dimension information

Obtain threat intelligence from the threat intelligence platform. Threat intelligence contains a variety of information, among which domain name information is one of the core data. According to the existing threat intelligence, the relevant information of the malicious domain name is extracted, and the malicious domain name sample database is obtained. According to the information related to the domain name collected by the malicious domain name sample database, query the Alexa website ranking information. The Alexa website ranking is a relatively authoritative website traffic evaluation index. If the ranking information of the domain name cannot be queried, enter a fixed value; Baidu The indexed information with Sogou indicates the indexing of website pages by search engines. If the information cannot be found, set the current dimension to 0; the indexed information of Bing; the integrity of the website and other data. See the table below for detailed dimension information.

dimension name Approach 1 Alexa Rank Get Alexa website ranking information 2 Baidu included Get the number of pages included in the website 3 Sogou included Get the number of pages included in the website 4 Bing included Get the number of pages included in the website 5 web content integrity Check the integrity of the web page content, 0 means no information, 1 means there is information 6 registered location detection 0 means foreign registration, 1 means domestic registration 7 A record 0 means no record, 1 means there is record 8 CNAME 0 means no record, 1 means there is record 9 CDN 0 means no usage record, 1 means there is usage record 10 Domain name renewal Check the number of current domain name updates

Data cleaning

There are many types of malicious behavior, including spreading malware, sending spam, scams, and phishing. The definition of malicious behavior is different in different security levels. For example, sending spam can be defined as malicious behavior under normal circumstances, but in the case of low security level, spam may not belong to the above malicious behavior. Therefore, it is necessary to screen malicious behaviors and malicious domain names in threat intelligence, focus on selecting malicious domain name samples with high network attack scope and confidence, and establish a malicious domain name sample database. The domain name list and domain-related dimension information are used as the sample set X for adversarial training neural generative adversarial network.

Building a Generative Adversarial Network

The generative adversarial network adopts the generative adversarial network structure of Continuous recurrent neural networks with adversarial training (C-RNN-GAN for short). C-RNN-GAN Generative Adversarial Network is a deep recurrent generative adversarial network with adversarial training. According to the idea of confrontation, the distribution builds the generator G and the discriminator D. The generator G generates the same sample data as the real sample data x as much as possible, and the discriminator D distinguishes between the generated sample data and the real sample data as much as possible. Among them, for the malicious domain name information sample set, the generator and the discriminator respectively use a long short-term memory (Long Short-Term Memory, LSTM) network with a depth of 2, which is used to process the discrete real data in the sample set and learn the real sample data. feature.

Train Generative Adversarial Networks

Define the loss function according to the set model structure. Due to the idea of generative adversarial adopted, a deep recurrent network is used as the generative adversarial network structure of generator G and discriminator D. Therefore, the loss function is defined as follows:

；

;

；

;

Among them, S _G is the loss function of the generator, used to train the generator; S _D is the loss function of the discriminator, used to train the discriminator; G is the generator, used to generate samples; D is the discriminator, used to distinguish Real samples and generated samples; R is the representation layer, the previous layer from the discriminator's logical classification layer; z ⁱ is the random sequence vector used for the generator input; represents the real sample data; n represents the number of current samples.

According to the defined loss function, set the hyperparameters to train the entire model. The input data comes from the sample set X, and the format of the input data is (x ¹ , x ² , ..., x ⁿ ).

Detect suspicious domains

Train the generative adversarial network and extract the discriminator. Enter the relevant information of the suspicious domain name, and the relevant information must have information of all dimensions of the data. Input it to the discriminator to get the currently calculated similarity value d.

Threshold adaptive intelligent learning

Since the size of the threshold α for classifying malicious domain names cannot be determined manually, the threshold self-learning method is adopted. The formula is as follows:

at =min( _d , at _-1 ), where at represents the current threshold, at _-1 is the previous threshold, and _d is the similarity value.

Select the test set to test the trained model. The similarity value obtained by each test sample through the discriminator D is compared with the previous threshold, and the smaller value of the two is selected as the new threshold, and continuous self-learning is obtained. The most reasonable threshold for malicious domain name detection in the current sample set.

The above description of the disclosed embodiments enables any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims (5)

1. a malicious domain name detection method based on a deep network with adversarial training, is characterized in that, comprises the steps: (1) Obtaining malicious domain name samples, obtaining threat intelligence from the threat intelligence platform, extracting malicious domain names and querying relevant dimension information of malicious domain names, and screening malicious domain names with high network attack scope and confidence according to malicious behavior to form malicious domain name samples , establish a malicious domain name sample set; The relevant dimension information of malicious domain names includes one or more of website ranking information, page index information, page integrity information, registration location information, A record information, CNAME record information, CDN usage record information, and update degree information; (2) network model training, select C-RNN-GAN to generate an adversarial network model, the network model includes a generator and a discriminator, and use the malicious domain name sample set as the input of the network model for training; (3) Obtaining suspicious domain name samples, querying the relevant dimension information of suspicious domain names, and forming suspicious domain name samples; (4) discriminating output, inputting suspicious domain name samples to the discriminator of the network model after training to obtain the currently calculated similarity value; (5) Judging suspicious domain names, and judging whether the similarity value is less than the current threshold, if so, the suspicious domain name is a malicious domain name, and it is used as a malicious domain name sample and added to the malicious domain name sample set, if not, the suspicious domain name is a legitimate domain name; The threshold is updated by threshold self-learning, and the formula is as follows: at = min( _d , at _-1 ), where at represents the current threshold, at _-1 is the previous threshold, and _d is the similarity value. 2. malicious domain name detection method as claimed in claim 1, is characterized in that: Website ranking information, which is Alexa website ranking information; Page index information, including the number of pages indexed by Baidu, the number of pages indexed by Sogou, and the number of pages indexed by Bing; Page integrity information, where 0 means no information, 1 means there is information; Registration place information, where 0 means foreign registration, 1 means domestic registration; A record information, where 0 means no record, 1 means there is a record; CNAME record information, where 0 means no record, 1 means there is a record; CDN usage record information, where 0 means no usage record, 1 means there is a usage record; Update degree information, which is the number of updates of malicious domain names; Among them, the A record information is used to specify the IP address record corresponding to the host name or domain name; the CNAME record information refers to the alias record, which maps multiple names to the same computer; the CDN usage record is the content delivery network ContentDelivery Network usage record, is Refers to the intelligent virtual network built on the basis of the existing network, so that users can obtain the desired content nearby, reduce network congestion, and improve user access response speed and hit rate. 3. malicious domain name detection method as claimed in claim 1, is characterized in that, the loss function of generator and discriminator is as follows:

Among them, S _G is the loss function of the generator, used to train the generator; S _D is the loss function of the discriminator, used to train the discriminator; G is the generator, used to output generated samples; D is the discriminator, used to Distinguish between real samples and generated samples; R is the representation layer, the previous layer from the discriminator's logical classification layer; ^xi represents malicious domain samples; ^zi is the random sequence vector used for generator input, representing data from real samples ; n represents the current number of malicious domain name samples. 4 . The malicious domain name detection method according to claim 1 , wherein the generator and the discriminator both use an LSTM long short-term memory network with a depth of 2. 5 . 5. A malicious domain name detection system for the malicious domain name detection method as described in any one of claims 1-4, characterized in that, comprising: The data acquisition module is used to obtain and screen malicious domain name samples and obtain suspicious domain name samples; The network model adopts the C-RNN-GAN generative adversarial network model, which is used for training with malicious domain name samples as input, and then takes suspicious domain name samples as input and outputs the calculated value; The judgment module is used to judge whether the suspicious domain name is a malicious domain name or a legitimate domain name according to the calculated value and the threshold value.

Images