Abnormal domain name identification method and device and electronic equipment

Abstract

The embodiment of the invention provides an abnormal domain name identification method. Domain name to be identified can be acquired, text features of the domain name to be identified are extracted; the text features of the domain name to be identified are input into a machine learning model; an identification result of the to-be-identified domain name output by the machine learning model is obtained; wherein the machine learning model is a classification model trained based on a black and white sample set; wherein the black-white sample set comprises black samples and white samples; wherein the black sample is a known abnormal domain name; wherein the white sample is a known normal domain name; Compared with the prior art in which the domain name is identified by means of a known abnormaldomain name or a known abnormal domain name forming rule, the method has the advantages that the accuracy is higher, and the domain name is identified by means of a pre-constructed machine learning model, so that the domain name identification is more flexible.

Description

technical field [0001] The present invention relates to the technical field of domain name identification, in particular to a method, device and electronic equipment for identifying abnormal domain names. Background technique [0002] With the continuous development of network technology, threats appearing in the network continue to increase, such as malware, botnets, and Trojan horses. Attackers often use domain names to connect hosts controlled by malicious programs to C&C (Command&Control) servers. Thus making network attacks more concealed. [0003] In the prior art, in order to identify abnormal domain names carrying malicious programs, the methods of intelligence systems or expert rules are usually used, that is, comparing the domain names to be identified with known abnormal domain names or the composition rules of known abnormal domain names, and judging the domain names to be identified. Identify whether the domain name is an abnormal domain name. [0004] The inv...

AI Technical Summary

Problems solved by technology

[0005] With the development of technology, attackers often use coding methods to randomly generate abnormal domain names, so that these abnormal domain names do not have specific composition rules and have strong flexibility, making it difficult to intercept through intelligence systems or expert rules

Images