Patent Description:
The DNS is a service of the Internet that acts as a distributed database for mapping the domain name and the Internet Protocol (IP) address with each other, making it more convenient for people to access the Internet. However, due to the rapid growth of the domain names, tens of thousands of domain names are generated every day. In addition to a large number of normally used domain names (also known as benign domain names), there are also domain names used to perform harmful activities (also known as malicious domain names). The malicious domain names are commonly used in phishing attacks and the spread of malware. The phishing websites usually refer to unofficial websites disguised as bank websites, online shopping websites, or websites that store important personal information, so as to trick the user into inputting the actual account number and password of the user into the phishing website to obtain the access rights of the user on the website. When an attack is successful, the personal privacy and property of the user is threatened, impacted, and damaged to a certain extent. In addition, if a malware is installed on the computer of the user, an attacker may control the computer of the victimized user or obtain important information of the victimized user using the malware.

Generally, computer forensics personnel use reverse engineering to find malicious domain names. However, manual analysis and identification cost a lot of time. Even if the list of malicious domain names is continuously obtained, updated, and mastered, the speed is still far behind the speed of generating new domain names. Therefore, there is an actual need to provide a more effective detection mechanism for malicious domain names.

<CIT> discloses a computer-implemented method for domain name scoring, comprising the steps of receiving a request to provide a reputation score of a domain name, receiving input data associated with the domain name, extracting a plurality of features from the input data and the domain name, generating a feature vector based on the plurality of features, and calculating the reputation score of the domain name by a machine-learning classifier based on a graph database, which includes feature vectors associated with at least a plurality of reference domain names, a plurality of servers, a plurality of domain name owners, and so forth. The method can also calculate the reputation score by finding a similarity between the feature vector and one of domain name clusters in the graph database. The reputation score represents a probability that the domain name is associated with malicious activity. The features analyzed do not include a mapping between the at least one domain name and at least one Internet Protocol address and/or a change of an Internet Protocol address of the at least one domain name.

It is an object of the present disclosure to provide a detection method for a malicious domain name in a domain name system (DNS) and a detection device, which can effectively improve the detection efficiency of automated malicious domain name detection. It is a further object of the present disclosure to provide a detection device configured for carrying out such a detection method.

These problems are solved by a detection method as claimed by claim <NUM>, and by a detection device as claimed by claim <NUM>. Further advantageous embodiments are the subject-matter of the dependent claims. Further aspects of the present disclosure relate to a computer program product, a computer-readable storage medium and a data carrier signal for carrying out a detection method of the present disclosure.

According to the disclosure there is provided a detection method for a malicious domain name in a DNS, which includes the following steps. Network connection data of an electronic device is obtained. Log data related to at least one domain name is captured from the network connection data. In the log data, data reflecting a mapping between the at least one domain name and at least one Internet Protocol address and/or data reflecting a change of an Internet Protocol address of the at least one domain name are analyzed to generate at least one numerical feature related to the at least one domain name. The at least one numerical feature is inputted into a multi-type prediction model, which includes a first data model and a second data model, wherein the first data model is built based on a first malicious feature related to a malware, and the second data model is built based on a second malicious feature related to a phishing website. Whether a malicious domain name related to the malware or the phishing website exists in the at least one domain name is predicted by the multi-type prediction model according to the at least one numerical feature.

An embodiment of the disclosure further provides a detection device for detecting a malicious domain name in the DNS. The detection device includes a web interface and a processor. The web interface is configured to obtain network connection data of an electronic device. The processor is coupled to the web interface. The processor is configured to capture log data related to at least one domain name from the network connection data. The processor is further configured to analyze data reflecting a mapping between the at least one domain name and at least one Internet Protocol address and/or data reflecting a change of an Internet Protocol address of the at least one domain name in the log data to generate at least one numerical feature related to the at least one domain name. The processor is further configured to input the at least one numerical feature into a multi-type prediction model, which includes a first data model and a second data model. The first data model is built based on a first malicious feature related to a malware. The second data model is built based on a second malicious feature related to a phishing website. The processor is further configured to operate the multi-type prediction model to predict whether a malicious domain name related to the malware or the phishing website exists in the at least one domain name according to the at least one numerical feature.

Based on the above, after obtaining the network connection data of the electronic device, the log data related to the at least one domain name may be captured from the network connection data. Then, data reflecting a mapping between the at least one domain name and at least one Internet Protocol address and/or data reflecting a change of an Internet Protocol address of the at least one domain name in the log data are analyzed to generate the at least one numerical feature related to the at least one domain name, and the numerical feature is inputted into the multi-type prediction model. In particular, the multi-type prediction model includes the first data model and the second data model. The first data model is built based on the first malicious feature related to the malware. The second data model is built based on the second malicious feature related to the phishing website. Then, the multi-type prediction model may predict whether the malicious domain name related to the malware or the phishing website exists in the at least one domain name according to the at least one numerical feature. As such, the detection efficiency of automated malicious domain name detection can be effectively improved.

<FIG> is a schematic diagram of a domain name analysis system according to an embodiment of the disclosure. Referring to <FIG>, a domain name analysis system includes an detection device <NUM> and an electronic device <NUM>. The electronic device <NUM> may be connected to at least one of servers <NUM>(<NUM>) to <NUM>(n) via an Internet <NUM>. In particular, the electronic device <NUM> may be connected to at least one of the servers <NUM>(<NUM>) to <NUM>(n) via one or more domain names. A domain name may be composed of a character string separated by one or more dots (for example, www.

When the electronic device <NUM> intends to connect to a particular domain name, through the analysis of the domain name system (DNS), the domain name may be directed to an Internet Protocol (IP)address of a particular server <NUM>(i) in the servers <NUM>(<NUM>) to <NUM>(n). At this point of time, the electronic device <NUM> may connect to the server <NUM>(i) according to the IP address. Compared with memorizing the IP address of the server <NUM>(i), the domain name used by the server <NUM>(i) is more convenient for the user to remember.

In an embodiment, the detection device <NUM> may automatically analyze the network connection data of the electronic device <NUM>. Then, the detection device <NUM> may automatically predict whether the domain name used by any one of the servers <NUM>(<NUM>) to <NUM>(n) is a malicious domain name according to an analysis result. Do note that, in the embodiment of <FIG>, the detection device <NUM> and the electronic device <NUM> are independent electronic devices (or computer devices). However, in another embodiment, the detection device <NUM> may also be disposed in the electronic device <NUM> in the form of a software or hardware.

In an embodiment, the detection device <NUM> includes a web interface <NUM>, a storage device <NUM>, a processor <NUM>, and a prediction model <NUM>. The web interface <NUM> may be configured to connect to the electronic device <NUM>, so as to obtain the network connection data of the electronic device <NUM>. For example, the web interface <NUM> may include a web interface card. The storage device <NUM> is configured to store the obtained network connection data and the prediction model <NUM>. For example, the storage device <NUM> may include a volatile storage circuit and a non-volatile storage circuit. The volatile storage circuit may include a random access memory. The non-volatile storage circuit may include a flash memory or a traditional hard disk drive (HDD).

The prediction model <NUM> may include one or more artificial intelligence models, one or more machine learning models, and/or one or more deep learning models. For example, the prediction model <NUM> may include multi-decision tree model such as XGBoost model or other types of algorithm models. The prediction model <NUM> may be configured to automatically detect whether a particular domain name is a malicious domain name according to data captured from the network connection data of the electronic device <NUM>. In an embodiment, the prediction model <NUM> may further identify whether the type of the detected malicious domain name belongs to a malware or a phishing website. If a particular malicious domain name belongs to a malware, the electronic device <NUM> may download one or more malwares from the server to become an infected device after connecting to the server using the particular malicious domain name. Thereafter, the electronic device <NUM> may become a zombie computer to be controlled by the hacker at any time. In addition, if a particular malicious domain name belongs to a phishing website, after the electronic device <NUM> connects to a server using the malicious domain name, all sensitive information sent by the user to the server may be collected and used to steal personal information, money, etc. of the user.

In an embodiment, the prediction model <NUM> is also known as a multi-type prediction model. The prediction model <NUM> may include multiple types of data models. Each data model in the prediction model <NUM> may be built according to a specific type of malicious feature and may be configured to detect a malicious domain name belong to the specific type. In an embodiment, each data model in the prediction model <NUM> may operate independently. In an embodiment, multiple data models in the prediction model <NUM> may also cooperate with each other.

In an embodiment, the prediction model <NUM> includes at least a first data model and a second data model. The first data model is built mainly based on malicious features related to a malware (also known as a first malicious feature). The second data model is built mainly based on malicious features related to a phishing website (also known as a second malicious feature). For example, after training a particular data model in the prediction model <NUM> using a large amount of malicious features related to a malware, the first data model may be built and may be exclusively used for detecting a malicious domain name belonging to the malware. Similarly, after training a particular data model in the prediction model <NUM> using a large amount of malicious features related to a phishing website, the second data model is built and may be exclusively used for detecting a malicious domain name belonging the phishing website. Do note that in other embodiments, the prediction model <NUM> may also include other types of data models to detect other types of malicious domain names.

In an embodiment, the prediction model <NUM> is stored in the storage device <NUM> as in the form of a software. However, in another embodiment, the prediction model <NUM> may also be implemented as a hardware circuit to be disposed in the detection device <NUM> in the form of a hardware. In addition, the prediction accuracy of the prediction model <NUM> may be improved by training.

The processor <NUM> is coupled to the web interface <NUM> and the storage device <NUM>. The processor <NUM> is responsible for analyzing the network connection data of the electronic device <NUM> and transmitting the analysis result to the prediction model <NUM> for the prediction of the malicious domain name. In an embodiment, the processor <NUM> may also be responsible for the overall or partial operation of the detection device <NUM>. For example, the processor <NUM> may include a central processing unit (CPU), or other programmable general-purpose or special-purpose microprocessors, digital signal processors (DSP), programmable controllers, application specific integrated circuits (ASIC), programmable logic device (PLD), other similar devices, or a combination of the devices.

<FIG> is a schematic diagram of analyzing network connection data according to an embodiment of the disclosure. Referring to <FIG> and <FIG>, in an embodiment, the processor <NUM> may use a packet recording tool (such as Zeek) to monitor network connection data <NUM> of the electronic device <NUM> and convert the network connection data <NUM> into log data. The processor <NUM> may capture the log data (also known as DNS log data) <NUM> related to at least one domain name from the log data. For example, the DNS log data <NUM> may include different types of DNS query records and response records such as A, AA, MX, NS, CNAME, and TXT.

In an embodiment, the processor <NUM> may perform data screening on the DNS log data <NUM>. The data screening may be configured to filter an A record and an AAAA record in the DNS log data <NUM> and generate DNS log data <NUM>. The A record reflects address data of at least one Internet Protocol version <NUM> (IPv4). The AAAA record reflects address data of at least one Internet Protocol version <NUM> (IPv6). By performing the data screening on the DNS log data <NUM>, the A and AAAA type of query and response records in the DNS log data <NUM> may be retained in the DNS log data <NUM>, while other types of query and response records (such as MX, NS, CNAME, and TXT) may be removed.

In an embodiment, the processor <NUM> may perform whitelist filtering on the DNS log data <NUM>. The whitelist filtering is configured to eliminate related log data of known benign domain names in the DNS log data <NUM>, while only retaining related log data of other domain names not recorded on the whitelist in the DNS log data <NUM>. Therefore, the subsequent detection efficiency of malicious domain names can be improved.

A piece of log data in the DNS log data <NUM> may contain at least <NUM> data fields, which respectively record the time, query target (that is, domain name), response result (that is, IP address corresponding to the queried domain name), and time to live (TTL) of the DNS record. The processor <NUM> may analyze the DNS log data <NUM> to generate at least one numerical feature related to at least one domain name. For example, the processor <NUM> may analyze data related to at least one of the query behavior of at least one domain name, the mapping between at least one domain name and at least one IP address, the character composition of at least one domain name, the change of the IP address of at least one domain name, and the TTL of at least one domain name in the DNS log data <NUM> to obtain the numerical feature. Then, the processor <NUM> may run the prediction model <NUM> to predict whether a malicious domain name exists in the domain names involved in the DNS log data <NUM> according to the numerical feature.

<FIG> is a schematic diagram of generating a prediction result according to numerical features according to an embodiment of the disclosure. Referring to <FIG> and <FIG>, in an embodiment, the processor <NUM> may analyze the DNS log data <NUM> to obtain evaluation values <NUM>(<NUM>) to <NUM>(a) belonging to a type <NUM>, evaluation values <NUM>(<NUM>) to <NUM>(b) belonging to a type <NUM>, evaluation values <NUM>(<NUM>) to <NUM>(c) belonging to a type <NUM>, evaluation values <NUM>(<NUM>) to <NUM>(d) belonging to a type <NUM>, and evaluation values <NUM>(<NUM>) to <NUM>(e) belonging to a type <NUM>. The evaluation values <NUM>(<NUM>) to <NUM>(a), <NUM>(<NUM>) to <NUM>(b), <NUM>(<NUM>) to <NUM>(c), <NUM>(<NUM>) to <NUM>(d) and <NUM>(<NUM>) to <NUM>(e) may all reflect the malicious features of malicious domain names that may exist in the numerical form. In addition, the total number of the evaluation values <NUM>(<NUM>) to <NUM>(a), the total number of the evaluation values <NUM>(<NUM>) to <NUM>(b), the total number of the evaluation values <NUM>(<NUM>) to <NUM>(c), the total number of the evaluation values <NUM>(<NUM>) to <NUM>(d), and the total number of the evaluation values <NUM>(<NUM>) to <NUM>(e) may all be adjusted according to practical requirements, and the disclosure is not limited thereto.

In an embodiment of the disclosure, the processor <NUM> may analyze data (also referred to as first data) related to the query behavior of at least one domain name in the DNS log data <NUM> to obtain the evaluation values <NUM>(<NUM>) to <NUM>(a) belonging to the type <NUM> (also known as query behavior evaluation values). The evaluation values <NUM>(<NUM>) to <NUM>(a) may respectively reflect the statistical characteristic of the query behavior of the electronic device <NUM> on at least one domain name.

In an embodiment, assuming that the first data reflects that the number of queries made by the electronic device <NUM> on a particular domain name (also known as first domain name) in each hour of a particular day (Day <NUM>) is recorded as [x1, x2,. , x24 ] (for example, x1 is the number of queries made by the electronic device <NUM> on the first domain name from <NUM>:<NUM> to <NUM>:<NUM> of Day <NUM>, x2 is the number of queries made by the electronic device <NUM> on the first domain name from <NUM>:<NUM> to <NUM>:<NUM> of Day1, and so on), and the number of queries made by the electronic device <NUM> on the first domain name in each hour of another day (Day <NUM>) is recorded as [y1, y2,. , y24] (for example, y1 is the number of queries made by the electronic device <NUM> on the first domain name from <NUM>:<NUM> to <NUM>:<NUM> of Day <NUM>, y2 is the number of queries made by the electronic device <NUM> on the first domain name from <NUM>:<NUM> to <NUM>:<NUM> of Day <NUM>, and so on), the evaluation value <NUM>(<NUM>) may be generated according to the following equation (<NUM>):
<MAT>.

The smaller the value of the evaluation value <NUM>(<NUM>), the more consistent the query behavior of the electronic device <NUM> on the same first domain name within multiple time ranges in days, and the higher the probability that the electronic device <NUM> is infected by a malware and is repeatedly connecting to a relay station. In addition, in other embodiments, the above calculation may also be performed in the units of multiple days (for example, three days), weeks, months, or years, and the disclosure is not limited thereto.

In an embodiment, the processor <NUM> may obtain a difference value (that is, time difference) between a time T1 of the first occurrence and a time T2 of the last occurrence of a particular domain name (for example, the first domain name) according to the first data. The processor <NUM> may generate the evaluation value <NUM>(<NUM>) according to the time difference. For example, the evaluation value <NUM>(<NUM>) may be equal to T1-T2.

In an embodiment, the processor <NUM> may obtain a total number of times of the electronic device <NUM> connecting to a particular domain name (for example, the first domain name) within a time frame according to the first data, and determine the evaluation value <NUM>(<NUM>) according to the total number of times. For example, if the DNS log data <NUM> reflects that the electronic device <NUM> has connected to the first domain name <NUM> times within a month, the evaluation value <NUM>(<NUM>) may be set as <NUM>.

In an embodiment, the processor <NUM> may obtain an average number (also known as first number of times) of connections (or queries) on a particular domain name (such as the first domain name) within multiple first time ranges and an average number (also known as second number of times) of connections (or queries) on the first domain name within multiple second time ranges according to the first data. For example, the multiple first time ranges may refer to multiple time ranges before a particular time point, and the multiple second time ranges may be multiple time ranges after the time point. The processor <NUM> may determine whether a variation point exists according to whether the difference between the first number of times and the second number of times is greater than a threshold. Assuming that the difference between the average number of connections (that is, the first number of times) before a particular time point and the average number of connections (that is, the second number of times)after the time point is greater than the threshold, a variation point is determined to have occurred at the time point. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the total number of variation points occurred within a predetermined time range.

In an embodiment, the processor <NUM> may obtain a total number of connections (or queries) made by the electronic device <NUM> on a single or multiple domain names within the same time range (for example, <NUM>:<NUM> to <NUM>:<NUM>) of different days (or other time units) according to the first data, and determine the evaluation value <NUM>(<NUM>) according to the total number of connections (or queries). For example, assuming that the electronic device <NUM> respectively connects to the first domain name <NUM>, <NUM>, and <NUM> times from <NUM>:<NUM> to <NUM>:<NUM> each day within three days, the evaluation value <NUM>(<NUM>) may be set as <NUM> (that is, <NUM>=<NUM>+<NUM>+<NUM>).

In an embodiment, the processor <NUM> may analyze data (also referred to as second data) related to the mapping of at least one domain name and at least one IP address in the DNS log data <NUM> to obtain the evaluation values <NUM>(<NUM>) to <NUM>(b) belonging to the type <NUM> (also known as mapping evaluation values). The evaluation values <NUM>(<NUM>) to <NUM>(b) may respectively reflect the statistical characteristic of the mapping between at least one domain name and at least one IP address.

In an embodiment, the processor <NUM> may obtain a total number of countries to which one or more IP addresses mapped to a particular domain name (for example, the first domain name) belong according to the second data. The processor <NUM> determines the evaluation value <NUM>(<NUM>) according to the total number of countries.

In an embodiment, the processor <NUM> may obtain a total number of one or more IP addresses mapped to a particular domain name (for example, the first domain name) according to the second data. The processor <NUM> determines the evaluation value <NUM>(<NUM>) according to the total number of IP addresses.

In an embodiment, the processor <NUM> may obtain multiple IP addresses mapped to a particular domain name (for example, the first domain name) according to the second data. The processor <NUM> may obtain a total number of domain names mapped by the IP addresses. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the total number of domain names.

In an embodiment, the processor <NUM> may query the malware information sharing platform (MISP) according to the second data to obtain whether one or more IP addresses mapped to a particular domain name (for example, the first domain name) have ever been used for malicious purposes. The processor <NUM> may determine a probability according to the query result to reflect the probability of the first domain name belonging to a malicious domain name. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the probability.

In an embodiment, the processor <NUM> may analyze data (also referred to as the third data) related to a character composition of at least one domain name in the DNS log data <NUM> to obtain the evaluation values <NUM>(<NUM>) to <NUM>(c) belonging to the type <NUM> (also known as domain name evaluation values). The evaluation values <NUM>(<NUM>) to <NUM>(c) may respectively reflect the statistical characteristic of the character composition in at least one domain name.

In an embodiment, the processor <NUM> may obtain a ratio of numbers appearing in a particular domain name (for example, the first domain name) according to the third data. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the ratio.

In an embodiment, the processor <NUM> may obtain a ratio of the total length of a domain name occupied by the length of the most meaningful character string in the particular domain name (for example, the first domain name) according to the third data. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the ratio. Taking google. com as an example, wherein google is the most meaningful character string, the evaluation value <NUM>(<NUM>) may be set as <NUM> (that is, <NUM>/<NUM> = <NUM>).

In an embodiment, the processor <NUM> may obtain a ratio of all domain names in the DNS log data <NUM> occupied by a top domain of a particular domain name (for example, the first domain name) according to the third data. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the ratio. Taking google. com as an example, the top domain name thereof is com. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the ratio of all domain names occupied by com as the top domain of the domain name.

In an embodiment, the processor <NUM> may obtain the length of a third domain name of a particular domain name (for example, the first domain name) according to the third data. Taking x111. com as an example, wherein the third domain is x111 and the length thereof is <NUM>. Therefore, the processor <NUM> may set the evaluation value <NUM>(<NUM>) as <NUM>.

In an embodiment, the processor <NUM> may obtain a total length of character string of a particular domain name (for example, the first domain name) according to the third data. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the total length of character string.

In an embodiment, the processor <NUM> may analyze data (also known as fourth data) related to the TTL of at least one domain name in the DNS log data <NUM> to obtain the evaluation values <NUM>(<NUM>) to <NUM>(d) belonging to the type <NUM> (also known as the TTL evaluation values). The evaluation values <NUM>(<NUM>) to <NUM>(c) may respectively reflect the statistical characteristic of the TTL of at least one domain name.

In an embodiment, the processor <NUM> may obtain an average TTL of a particular domain name (for example, the first domain name) according to the fourth data. For example, assuming that multiple TTL values of the first domain name is respectively recorded as <NUM>, <NUM>, and <NUM> in the DNS log data <NUM>, the average TTL of the first domain name may be <NUM>. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the average TTL.

In an embodiment, the processor <NUM> may obtain a standard deviation of multiple TTL of a particular domain name (for example, the first domain name) according to the fourth data. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the standard deviation.

In an embodiment, the processor <NUM> may obtain a number of different TTL in multiple TTL of a particular domain name (for example, the first domain name) according to the fourth data, and determine the evaluation value <NUM>(<NUM>) according to the number. For example, assuming that multiple TTL values of the first domain name is respectively recorded as <NUM>, <NUM>, and <NUM> in the DNS log data <NUM>, which indicates that the first domain name has <NUM> different TTL. Therefore, the processor <NUM> may set the evaluation value <NUM>(<NUM>) as <NUM>.

In an embodiment, the processor <NUM> may obtain a number of changes of TTL of a particular domain name (for example, the first domain name) according to the fourth data. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the number of changes.

In an embodiment, the processor <NUM> may obtain a total number of TTL less than a predetermined time length in the TTL of a particular domain name (for example, the first domain name) according to the fourth data. For example, the predetermined time length may be <NUM> seconds or other time lengths. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the total number.

In an embodiment, the processor <NUM> may analyze data (also known as fifth data) related to the change of IP addresses of at least one domain name in the DNS log data <NUM> to obtain the evaluation values <NUM>(<NUM>) to <NUM>(d) belonging to the type <NUM> (also known as address change evaluation values). The evaluation values <NUM>(<NUM>) to <NUM>(c) may respectively reflect the statistical characteristics of the change of the IP addresses of at least one domain name.

In an embodiment, the processor <NUM> may obtain a total number of a predetermined IP address in the IP addressed used by a particular domain name (for example, the first domain name) according to the fifth data. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the total number. For example, the predetermined IP address may be <NUM>. <NUM>, <NUM>. <NUM> and/or <NUM>. Assuming that the DNS log data <NUM> reflects that the first domain name has used <NUM>. <NUM> once, the evaluation value <NUM>(<NUM>) may be set as <NUM>.

In an embodiment, the processor <NUM> may obtain a ratio of all IP addresses used by a particular domain name (for example, the first domain name) occupied by a predetermined IP address according to the fifth data. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the ratio.

In an embodiment of the disclosure, the processor <NUM> may obtain a number of times a predetermined IP address has been changed in all IP addresses used by a particular domain name (for example, the first domain name) according to the fifth data. The processor <NUM> may determine the evaluation value <NUM>(<NUM>) according to the number of times. For example, assuming that the DNS log data <NUM> reflects that the first domain name has been changed to use <NUM>. <NUM> once, the processor <NUM> may set the evaluation value <NUM>(<NUM>) as <NUM>.

It should be noted that the setting and generation method of the various types of evaluation values mentioned the abovementioned embodiments are only examples and are not intended to limit the disclosure. In some of the unillustrated embodiments, more types of evaluation values may be generated according to the information recorded in the DNS log data <NUM> to reflect the operation methods of different types of malwares or phishing websites, which may be involved with one or more domain names. In addition, the type of the evaluation values in <FIG> may also be increased or decreased according to actual requirements, and the disclosure is not limited thereto.

In an embodiment in <FIG>, the prediction model <NUM> may calculate and generate a prediction result <NUM> according to the evaluation values <NUM>(<NUM>) to <NUM>(a), <NUM>(<NUM>) to <NUM>(b), <NUM>(<NUM>) to <NUM>(c), <NUM>(<NUM>) to <NUM>(d), and <NUM>(<NUM>) to <NUM>(e) related to a particular domain name (for example, the first domain name). For example, the prediction model <NUM> may use the XGBoost model to perform the prediction. The prediction result <NUM> may reflect whether the first domain name is predicted as a malicious domain name. For example, after comprehensively considering the evaluation values <NUM>(<NUM>) to <NUM>(a), <NUM>(<NUM>) to <NUM>(b), <NUM>(<NUM>) to <NUM>(c), <NUM>(<NUM>) to <NUM>(d), and <NUM>(<NUM>) to <NUM>(e), the generated prediction result 36may include a probability. If the probability is higher than a decision value (for example, <NUM>), the processor <NUM> may determine that the first domain name is a malicious domain name. On the contrary, if the probability is not higher than the decision value, the processor <NUM> may determine that the first domain name is not a malicious domain name.

In an embodiment of the disclosure, the prediction model <NUM> may further identify whether the type of the first domain name, which may be a malicious domain name, is a malware or a phishing website according to the evaluation values <NUM>(<NUM>) to <NUM>(a), <NUM>(<NUM>) to <NUM>(b), <NUM>(<NUM>) to <NUM>(c), <NUM>(<NUM>) to <NUM>(d), and <NUM>(<NUM>) to <NUM>(e) related to a particular domain name (for example, the first domain name). In other words, in an embodiment, the prediction result <NUM> may also reflect whether the type of the first domain name is a malware or a phishing website.

In an embodiment, the domain name (for example, the first domain name) predicted as a malicious domain name may be recorded in a list for subsequent usage or verification. In an embodiment, the domain name predicted as a malicious domain name may be verified by a security personnel. The processor <NUM> may use the verification result to train the prediction model <NUM>, so as to improve the prediction accuracy of the prediction model <NUM>.

In an embodiment, the processor <NUM> may also extract the domain name with the probability falling within a predetermined range (for example, <NUM> to <NUM>). The extracted domain name may be verified by the security personnel. The processor <NUM> may use the verification result to train the prediction model <NUM>.

<FIG> is a flowchart of a detection method for a malicious domain name in a domain name system (DNS) according to an embodiment of the disclosure. Referring to <FIG>, in Step S401, network connection data of an electronic device is obtained. In Step S402, log data related to at least one domain name is captured from the network connection data. In Step S403, the log data is analyzed to generate at least one numerical feature related to the at least one domain name. In Step S404, the at least one numerical feature is inputted into a multi-type prediction model, which includes a first data model and a second data model, wherein the first data model is built based on a first malicious feature related to a malware, and the second data model is built based on a second malicious feature related to a phishing website. In Step S405, the multi-type prediction model predicts whether a malicious domain name related to the malware or the phishing website exists in the at least one domain name according to the at least one numerical feature.

Each step in <FIG> has been described in detail above, so there will be no reiteration here. It is worth noting that each step in <FIG> may be implemented as multiple program codes or circuits, and the disclosure is not limited thereto. In addition, the method in <FIG> may be used with the above exemplary embodiments or may be used alone, and the disclosure is not limited thereto.

Claim 1:
A detection method for a malicious domain name in a domain name system (DNS), comprising:
obtaining network connection data (<NUM>) of an electronic device (<NUM>);
capturing log data (<NUM>, <NUM>) related to at least one domain name from the network connection data (<NUM>);
analyzing data reflecting a mapping between the at least one domain name and at least one Internet Protocol address and/or data reflecting a change of an Internet Protocol address of the at least one domain name in the log data (<NUM>, <NUM>) to generate at least one numerical feature related to the at least one domain name;
inputting the at least one numerical feature into a multi-type prediction model, which comprises a first data model and a second data model, wherein the first data model is built based on a first malicious feature related to a malware, and the second data model is built based on a second malicious feature related to a phishing website; and
predicting whether a malicious domain name related to the malware or the phishing website exists in the at least one domain name by the multi-type prediction model according to the at least one numerical feature.