Malicious Domain Name Detection based on Knowledge Graph

Abstract

In recent years, there have been many examples of attackers exploiting vulnerabilities in the domain name system to infiltrate and steal information and assets. There have been breakthroughs in the research on malicious domain name detection using artificial intelligence. However, there is no specific plan for the research on knowledge graph and malicious domain name detection. Therefore, we innovatively combine the two and propose a malicious domain name detection model based on knowledge graph. We first combined the DNS flow graph with the DNS domain name hierarchy graph by means of rule alignment, and established a new DNS information knowledge graph. Second, we simultaneously complete the vectorization of entities and attributes in a joint learning manner as the input of the detection module. Finally, we combine DNS information, knowledge graph and neural network, and convert the DNS information into entities and attributes in the knowledge graph based on the knowledge graph. Experiments show that the malicious domain name detection model proposed in this paper has excellent performance and good generalization ability.