CN116318813A - A method and system for detecting domain name abuse based on cluster analysis - Google Patents

Abstract

The application discloses a domain name abuse detection method and system based on cluster analysis, wherein the method comprises the following steps: selecting multidimensional features of domain name applications; establishing a corresponding one-dimensional feature coordinate system for each feature in the multi-dimensional features; the one-dimensional feature coordinate system is used for identifying the position of the numerical value converted by the feature according to a preset numerical value standard in the coordinate system; establishing a multi-dimensional feature coordinate system according to all the one-dimensional feature coordinate systems; acquiring a preset number of domain name applications according to a domain name list or a URL list; collecting multidimensional features of the domain name application; converting each of the domain name multidimensional features into a numerical value used for being identified in the multidimensional feature coordinate system according to a preset numerical value standard; and calculating the aggregation condition of the domain name application according to the numerical value marked in the multidimensional feature coordinate system, and obtaining the detection result of domain name abuse according to the aggregation condition, thereby achieving the purposes of independence of single feature, high detection efficiency and high accuracy.

Description

A method and system for detecting domain name abuse based on cluster analysis

technical field

The invention relates to the technical field of domain name maintenance, in particular to a domain name abuse detection method and system based on cluster analysis.

Background technique

Due to its easy-to-remember feature, the domain name has become the entrance for various Internet applications (websites, emails, etc.) to access. With the development of the Internet, the data on the number of domain names has also increased rapidly. According to third-party data, at the beginning of 2022, the number of global top-level domain registrations has reached 350 million. The definition of domain name abuse is relatively broad. Generally speaking, any abuse, misuse, or malicious behavior used to attack the existing domain name system can be called domain name abuse.

Common domain name abuses include illegal websites built through registered domain names, phishing websites, sending spam, botnets, spreading malware, and other gray and black domain name industries, etc. With the development of the Internet, the abuse of domain names has also emerged in an endless stream. These abuses have caused certain threats to the Internet, affecting the normal network of computer users, seriously affecting the experience of using the Internet, and even causing major economic or social losses. .

The current detection technology for domain name abuse is mainly to match or filter each domain name application through specific features, which include: domain name features, URL features, domain name resolution features, text features, website image features and website structure features (for website form domain name abuse). Specifically, there are two methods: feature library matching detection and machine learning detection can have a better detection effect on discovered abuses, but there are also some disadvantages, such as large labor investment, low efficiency, poor scalability, and continuous detection efficiency. Poor sex.

Contents of the invention

This application provides a domain name abuse detection method and system based on cluster analysis, which solves the current problems of large manual investment, low efficiency, poor scalability, and poor detection efficiency continuity.

In the first aspect, the present application provides a domain name abuse detection method based on cluster analysis, the method comprising:

Select the multi-dimensional features of the domain name application;

Establishing a corresponding one-dimensional feature coordinate system for each feature in the multi-dimensional features; the one-dimensional feature coordinate system is used to identify the position of the value converted by the feature according to the preset numerical standard in the coordinate system;

establishing a multi-dimensional feature coordinate system according to all the one-dimensional feature coordinate systems;

Obtaining a preset number of domain name applications according to the domain name list or URL list; collecting domain name multi-dimensional features of the domain name application;

converting each feature in the multidimensional feature of the domain name into a numerical value for identification in the multidimensional feature coordinate system according to a preset numerical standard;

Calculate the aggregation situation of the domain name application according to the value identified in the multi-dimensional feature coordinate system, and obtain the detection result of domain name abuse according to the aggregation situation.

In an implementation manner, the multi-dimensional features include: domain name features, URL features, IPv4 address, country of IP address, domain name resolution features, text features, website image features and website structure features.

In an implementation manner, the preset numerical standard is configured as:

If there is a feature that is difficult to convert in the multi-dimensional features, the feature is split into multiple dimensions according to preset rules, and each dimension is numbered sequentially, so that different features correspond to different numbers.

In one implementation, the aggregation of the domain name application is calculated according to the value identified in the multi-dimensional feature coordinate system, and the step of obtaining the detection result of domain name abuse according to the aggregation includes:

Splitting the domain name multidimensional feature into multiple dimensions;

Set all said dimensions to unit distance;

generating a unit space based on unit distances in all said dimensions;

Calculating the proportion of the number of domain names used by the domain name in the unit space in the entire multidimensional space;

judging whether the proportion is greater than or equal to a preset threshold;

If yes, there is an aggregated domain name application.

In an implementation manner, the steps after judging whether the proportion is greater than or equal to a preset threshold include:

If not, there is no aggregate domain name application.

In an implementation manner, the step of calculating the proportion of the domain name application in the unit space includes:

Proportion = the number of domain name applications in the unit space/the number of all domain name applications.

In the second aspect, the present application provides a domain name abuse detection system based on cluster analysis, including: a configuration module, a data processing module, a first conversion module, a collection module, a second conversion module, and a calculation module;

The configuration module is used to select the multi-dimensional characteristics of the domain name application;

A data processing module, configured to establish a corresponding one-dimensional feature coordinate system for each feature in the multi-dimensional features; the one-dimensional feature coordinate system is used to identify the position of the value converted by the feature according to the preset numerical standard in the coordinate system;

The first conversion module is used to establish a multi-dimensional feature coordinate system according to all the one-dimensional feature coordinate systems;

A collection module, configured to obtain a preset number of domain name applications according to a domain name list or a URL list; collect domain name multidimensional features of the domain name application;

The second conversion module is used to convert each feature in the domain name multi-dimensional feature into a numerical value for identification in the multi-dimensional feature coordinate system according to a preset numerical standard;

A calculation module, configured to calculate the aggregation of the domain name application according to the value identified in the multi-dimensional feature coordinate system, and obtain the detection result of domain name abuse according to the aggregation.

In a third aspect, the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and operable on the processor. When the processor executes the program, the computer program described in the first aspect is implemented. The steps of a domain name abuse detection method based on cluster analysis.

In a fourth aspect, the present application provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, a domain name abuse based on cluster analysis is implemented as described in the first aspect The steps of the detection method.

It can be seen from the above-mentioned technical scheme that by utilizing the aggregated features on domain name abuse multi-dimensional features for abuse detection, it does not depend on a single instance of domain name abuse, does not depend on a single feature (such as: does not depend on the text features of domain name abuse applications), in It can also be used based on other multidimensional features in cases where data is not available for one or more features. Suitable for all types of domain name abuse. Moreover, there is no need to separately model and train various multi-dimensional features, and the workload in the early stage is small. The multi-dimensional characteristics of domain name abuse are used, so the suspected domain name abuse detected in a single detection is in batches, and the output of a single detection is very high. According to our abuse detection of 20 million domain names, the number of abused domain names in a single output is between 200,000 and 400,000. The follow-up manual processing workload for the batch of suspected results produced is also very small. As a domain name abuse detection technology that produces the most output under a certain amount of computing power, it has a high accuracy rate of suspected domain name abuse.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can also obtain other drawings according to the provided ones without creative efforts.

FIG. 1 is a flowchart of a domain name abuse detection method and system based on cluster analysis provided by the present application;

Fig. 2 is a flow chart of a domain name abuse detection method and system based on cluster analysis provided by the application to calculate the aggregation of domain name applications;

FIG. 3 is a schematic diagram of a domain name abuse detection system based on cluster analysis provided by the present application.

Detailed ways

It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

The process of dividing a collection of physical or abstract objects into classes of similar objects is called clustering. A cluster generated by clustering is a collection of data objects that are similar to objects in the same cluster and different from objects in other clusters. "Birds of a feather flock together, people are divided into groups", in natural science and social science, there are a lot of classification problems. Cluster analysis, also known as group analysis, is a statistical analysis method for studying (samples or indicators) classification problems.

The current detection technology for domain name abuse is mainly to match or filter each domain name application through specific features, which include: domain name features, URL features, domain name resolution features, text features, website image features and website structure features (for website form domain name abuse). Specifically, there are two ways:

1. Feature library matching detection: system comparison based on the pre-prepared feature library (text library, image library, other feature library) to match domain name applications with specific features;

2. Machine learning detection: Based on the above single or multiple features, use positive samples for machine learning training and modeling, and then use the model for system detection.

The above-mentioned detection technology has a good detection effect on the discovered abuse, but it also has the following disadvantages:

(1) Large manual investment: The detection based on the feature database needs to be based on a large amount of manual screening or manual reporting in the early stage. However, domain name abuse detection based on machine learning needs to select a large number of positive and negative samples for manual labeling and modeling.

(2) Low efficiency: Existing detection technologies need to model or collect feature databases separately for domain name applications with different text, image, and domain name features, and build various detection models or feature libraries. The model is calculated or compared with different feature libraries, and the detection efficiency is low.

(3) Poor scalability and poor continuity of detection efficiency: the Internet is changing with each passing day, and domain name abuse changes in many ways. The rate will become lower and lower, the feature library must be continuously updated, and the detection model also needs to continuously collect new samples to remodel.

This application aims to solve the problems in the prior art. The current detection technology for domain name abuse is mainly to match or screen each domain name application through specific features. The features include: domain name features, URL features, domain name resolution features, text features, and website features. Image characteristics and website structure characteristics (for domain name abuse in the form of websites). Specifically, there are two methods: feature library matching detection and machine learning detection can have a better detection effect on discovered abuses, but there are problems such as large manual investment, low efficiency, poor scalability, and poor detection efficiency. . Based on the above reasons, the present application provides a domain name abuse detection method and system based on cluster analysis.

Domain name abuse has developed into multiple upstream and downstream industry chains. There are professional personnel to provide services from domain name registration, server leasing and erection, domain name abuse application development and promotion. In order to grab more benefits, domain name abuse often Exist in clusters rather than isolated cases. In our daily data analysis, we also found that a considerable part of domain name abuse has clustering characteristics. By analyzing the aggregation characteristics of domain name abuse, we can quickly discover a large number of domain name abuse in batches.

The method and system of the present invention will be further described below in conjunction with specific embodiments.

In the first aspect, as shown in Figure 1, the present application provides a method for detecting domain name abuse based on cluster analysis, the method comprising:

S100, selecting multi-dimensional features of the domain name application;

In step S100, the multi-dimensional features of common domain name applications include: domain name features, URL features, IPv4 address, country of IP address, domain name resolution features, text features, website image features, and website structure features.

S200, establishing a corresponding one-dimensional feature coordinate system for each feature in the multi-dimensional features; the one-dimensional feature coordinate system is used to identify the position in the coordinate system of the value converted by the feature according to the preset numerical standard;

In step S200, the preset value standard is configured as follows: if there are features in the multi-dimensional features that are difficult to convert into values, split the features into multiple dimensions according to preset rules, and sequentially number each dimension , so that different features correspond to different numbers.

In the actual application scenario, since this application utilizes the aggregated features of domain name abuse on multi-dimensional features, it is necessary to select the multi-dimensional features used by the system first. The selected multi-dimensional features can be domain name features, URL features, IPv4 addresses, IP Address attribution country, domain name analysis characteristics, text characteristics, website image characteristics and website structure characteristics, etc. After determining the required multi-dimensional features, each feature in the multi-dimensional features is converted into a numerical value according to the preset numerical standard. If there is no feature in the multi-dimensional features that is difficult to convert numerical values, then the selected Multi-dimensional features are converted into values, for example: IPv4 address features, if the IPv4 address is 193.168.32.2, then the value of the converted decimal integer is 3249020930; the conversion method can also be to directly sequence the features, for example: the feature is The IP address belongs to the country, so more than 200 countries can be numerically numbered, such as 1 for China and 2 for the United States. Then the value converted from the feature that the country of IP address belongs to China is 1. If there are features that are difficult to convert numerical values in the multi-dimensional features, then it needs to be split into multiple dimensions according to the preset rules, and each dimension is numbered sequentially to ensure that different features correspond to different numbers. For example: the feature is The location of the IP address (that is, the geographic location where the IP is located), since the location of the IP address itself is not a number, it needs to be converted into a numerical value. Normally, the geographic location needs to be represented by latitude and longitude, but because it is difficult to obtain the latitude and longitude, it can be used according to the actual situation. Two additional dimensions are country and province. The country numbered more than 200 countries, such as 1 for China and 2 for the United States. Then the country-specific value of the IP address being China is 1. The province feature is processed in the same way, for example, 1 is Liaoning Province, and 2 is Zhejiang Province, then the province feature value whose IP address is Zhejiang Province is 2. Then, two one-dimensional feature coordinate systems are respectively established according to the converted values.

S300. Establish a multi-dimensional feature coordinate system according to all the one-dimensional feature coordinate systems;

In the actual application scenario, since the one-dimensional feature coordinate system has been established according to the converted value, the point on the one-dimensional feature coordinate system at this time represents the position of the multi-dimensional feature. Establish a multi-dimensional feature coordinate system based on all acquired one-dimensional feature coordinate systems.

S400. Obtain a preset number of domain name applications according to the domain name list or URL list; collect domain name multi-dimensional features of the domain name applications;

In practical application scenarios, the domain name list is a collection of website domain names. The domain name list is used as the entrance of detection, and can usually be obtained from online collection or third-party channels. URL is the abbreviation of Uniform Resource Locator (URL), which is the Internet A representation used on a World Wide Web server to specify the location of information. A URL is composed of a string of characters, which can be letters, numbers, and special symbols. where the URL contains the following information: the protocol used to access the resource, the location of the server (whether by IPv4 address or domain name), the port number on the server, the location of the resource in the server's directory structure, and a fragment identifier, a list of URLs as detected The entrance of , usually can be collected from the Internet or obtained from third-party channels. Acquire a preset number of domain name applications according to the domain name list or URL list, wherein, in order to better judge the aggregation of domain name applications, the number of domain name applications must be at least in the unit of 10,000. By using the crawler to crawl the webpage, and using the detection program to perform data detection to obtain the domain name multi-dimensional characteristics of the domain name application.

S500. Convert each feature in the multi-dimensional features of the domain name into a numerical value for identification in the multi-dimensional feature coordinate system according to a preset numerical standard;

In practical application scenarios, it is necessary to establish a preset value standard first, and convert each feature in the domain name multi-dimensional feature into a value according to the preset value standard, and the value is used to identify the position of the feature in the multi-dimensional feature coordinate system. Among them, when converting each feature in the domain name multi-dimensional feature into a value, if there is no feature in the domain name multi-dimensional feature that is difficult to convert into a value, then the selected domain name multi-dimensional feature can be directly converted into a value according to the above preset rules, or The conversion method can be to directly number the multi-dimensional features of the domain name in sequence. If there are features that are difficult to convert numerical values in the multi-dimensional features of the domain name, then it needs to be split into multiple dimensions according to the above preset rules, and each dimension is sequenced. Numbering, to ensure that different features correspond to different numbers.

S600. Calculate the aggregation situation of the domain name application according to the value identified in the multi-dimensional feature coordinate system, and obtain a domain name abuse detection result according to the aggregation situation.

In step S600, as shown in FIG. 2, the aggregation of the domain name application is calculated according to the value identified in the multi-dimensional feature coordinate system, and the step of obtaining the detection result of domain name abuse according to the aggregation includes:

S610. Split the domain name multi-dimensional feature into multiple dimensions;

In step S610, if there is a feature that is difficult to convert into a numerical value among the multi-dimensional features of the domain name, it needs to be split into multiple dimensions according to preset rules so as to convert it into a numerical value.

S620, setting a unit distance for all the dimensions;

In step S620, a standard distance L is set for each split dimension, from L ₁ to L _W .

S630, generating a unit space according to unit distances of all dimensions;

In step S630, a unit space is formed according to the unit distance set in each dimension (the volume of the unit space is L ₁ *L ₂ *...*L _w ).

S640, calculating the proportion of the number of domain names used by the domain name in the unit space in the entire multidimensional space (multidimensional feature coordinate system);

In step S640, in order to determine whether there is an aggregated application, it is necessary to calculate the proportion of the domain name application in the unit space, where proportion=the number of the domain name application in the unit space/the number of all the domain name applications.

S650, judging whether the proportion is greater than or equal to a preset threshold;

In step S650, it is necessary to determine whether the proportion is greater than or equal to a preset threshold value because of judging whether there is an aggregation application, wherein the preset threshold value K is a decimal between 0 and 1. Moreover, the value of K actually depends on a variety of factors: including whether the detected domain name applications are sufficient and representative, the selection of multi-dimensional features, and the establishment standard of the coordinate system of each feature dimension (the calculation method of converting features into values).

S660, if yes, there is an aggregated domain name application;

S670, if not, there is no aggregation domain name application.

In the actual application scenario, the domain name multi-dimensional feature is first split into multiple dimensions, and a unit distance is set for each split dimension. If the domain name multi-dimensional feature is split into three dimensions: L ₁ L ₂ L ₃ , then the unit space generated by the unit distance of all dimensions is expressed as V=L ₁ *L ₂ *L ₃ , and then it is necessary to calculate the proportion R of the domain name application in the unit space, because the proportion = the unit space described in The number of domain name applications/the number of all domain name applications. If the preset threshold K is 0.1, if the number of domain name applications in the standard unit space is 500, the number of all domain name applications is 50,000, so R=500÷50000=0.01, so R<K, does not exist Aggregated domain name applications. If the number of domain name applications in the unit space is 5000, the number of all domain name applications is 50000, so R=5000÷50000=0.1, K=0.1 at this time, so R=K, there is an aggregated domain name It can be directly processed manually or combined with other features for further detection before manual processing. If the number of domain name applications in the unit space is 10,000, the number of all domain name applications is 50,000, so R=10000÷50000=0.2, and K=0.1 at this time, so R is greater than K, and there is an aggregated domain name It can be directly processed manually or combined with other features for further detection before manual processing.

Take the website domain name abuse detection as an example: first obtain the multi-dimensional features of the domain name application, among which the multi-dimensional features include: domain name features, URL features, IPv4 address, country of IP address, domain name resolution features, text features, website image features and website Structure. After determining the required multi-dimensional features, each feature in the multi-dimensional features is converted into a numerical value according to the preset numerical standard. If there is no feature in the multi-dimensional features that is difficult to convert numerical values, then the selected The multi-dimensional features are converted into values, and the conversion method can be directly numbering the multi-dimensional features sequentially. If there are features that are difficult to convert numerical values in the multi-dimensional features, then it is necessary to split them into multiple dimensions according to the preset rules, and number each dimension sequentially to ensure that different features correspond to different numbers, and according to the converted A one-dimensional feature coordinate system is established numerically, and a multi-dimensional feature coordinate system is established based on all one-dimensional feature coordinate systems.

Obtain a preset number of website applications according to the domain name list or URL list, and collect the domain name multidimensional features of the website application. For website domain name abuse detection, the selected domain name multidimensional features are the website IPv4 address, website keywords, and the country where the website server is located. region, first convert the IPv4 address of the website into a numerical value, and then select the abused text feature library for the website keyword, use whether it contains the text in the feature library and the frequency of feature text to convert it into a numerical value through the preset numerical standard, and finally convert the country where the website server is located The region is converted into a numerical value according to the preset numerical standard, and each country and region needs to be numerically numbered, for example, the number of region A is 1, and the number of region B is 5. Each individual website application calculates the specific three-dimensional coordinates according to the above three characteristics, and conducts abuse analysis according to the aggregation degree of all website applications in the three-dimensional space: that is, the proportion of website applications appearing in a certain three-dimensional space to all website applications reaches a certain threshold , that is, it is judged that there is suspected domain name abuse in the domain name applications gathered in this space, and subsequent manual processing or manual processing is carried out after further screening in combination with other specific characteristics.

Take spam detection as an example: first obtain the multi-dimensional features of the domain name application, among which the multi-dimensional features include: domain name features, URL features, IPv4 address, country of IP address, domain name analysis features, text features, website image features and website structure feature. After determining the required multi-dimensional features, each feature in the multi-dimensional features is converted into a numerical value according to the preset numerical standard. If there is no feature in the multi-dimensional features that is difficult to convert numerical values, then the selected The multi-dimensional features are converted into values, and the conversion method can be directly numbering the multi-dimensional features sequentially. If there are features that are difficult to convert numerical values in the multi-dimensional features, then it is necessary to split them into multiple dimensions according to the preset rules, and number each dimension sequentially to ensure that different features correspond to different numbers, and according to the converted A one-dimensional feature coordinate system is established numerically, and a multi-dimensional feature coordinate system is established based on all one-dimensional feature coordinate systems.

Obtain a preset number of emails according to the domain name list or URL list, and collect the domain name multi-dimensional features of the emails. For spam detection, the selected domain name multi-dimensional features are: mail sending IPv4 address, mail server IPv4 address, mail sending time, mail sender. After confirming the multi-dimensional characteristics of the domain name, it needs to be converted into a value according to the preset value standard. Among them, the mail sending IPv4 address is converted into a value in 256 base, the mail sending server IPv4 address is converted into a value in 256 base, and the mail sending time is converted into a value in 256 base. Timestamp 300 (period of 5 minutes) is converted into a value, and the email sender is converted into a value according to the comparison table (a new record is added every time a new email sender is found during processing). The specific four-dimensional coordinates of each email are calculated according to the multi-dimensional characteristics of the above four domain names, and the abuse analysis is performed according to the aggregation degree of all emails in the four-dimensional space: that is, the proportion of emails appearing in a certain four-dimensional space to all emails reaches a certain threshold, that is, it is judged Spatially aggregated emails are suspected spam and can be blocked directly.

In the second aspect, as shown in Figure 3, the present application provides a domain name abuse detection system based on cluster analysis, including: a configuration module, a data processing module, a first conversion module, a collection module, a second conversion module, and a calculation module ;

The configuration module is used to select the multi-dimensional characteristics of the domain name application;

A data processing module, configured to establish a corresponding one-dimensional feature coordinate system for each feature in the multi-dimensional features; the one-dimensional feature coordinate system is used to identify the position of the value converted by the feature according to the preset numerical standard in the coordinate system;

The first conversion module is used to establish a multi-dimensional feature coordinate system according to all the one-dimensional feature coordinate systems;

A collection module, configured to obtain a preset number of domain name applications according to a domain name list or a URL list; collect domain name multidimensional features of the domain name application;

The second conversion module is used to convert each feature in the domain name multi-dimensional feature into a numerical value for identification in the multi-dimensional feature coordinate system according to a preset numerical standard;

A calculation module, configured to calculate the aggregation of the domain name application according to the value identified in the multi-dimensional feature coordinate system, and obtain the detection result of domain name abuse according to the aggregation.

For the function and effect of the above-mentioned system when the above-mentioned method is applied, please refer to the description in the above-mentioned method embodiment, which will not be repeated here.

In a third aspect, the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and operable on the processor. When the processor executes the program, the computer program described in the first aspect is implemented. The steps of a domain name abuse detection method based on cluster analysis.

In a fourth aspect, the present application provides a non-transitory computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, a domain name abuse based on cluster analysis is implemented as described in the first aspect The steps of the detection method.

Through the above description of the implementations, those skilled in the art can clearly understand that each implementation can be implemented by means of software plus a necessary general-purpose hardware platform, and of course also by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the prior art can be embodied in the form of software products, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic discs, optical discs, etc., including several instructions to make a computer device (which may be a personal computer, server, or network device, etc.) execute the methods described in various embodiments or some parts of the embodiments.

Other embodiments of the invention will be readily apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any modification, use or adaptation of the present invention, these modifications, uses or adaptations follow the general principles of the present invention and include common knowledge or conventional technical means in the technical field not disclosed in the present invention . It is intended that the specification and examples be considered exemplary only, with a true scope and spirit of the invention indicated by the appended claims.

Claims (9)

1. A domain name abuse detection method based on cluster analysis, said method comprising: Select the multi-dimensional features of the domain name application; Establishing a corresponding one-dimensional feature coordinate system for each feature in the multi-dimensional features; the one-dimensional feature coordinate system is used to identify the position of the value converted by the feature according to the preset numerical standard in the coordinate system; establishing a multi-dimensional feature coordinate system according to all the one-dimensional feature coordinate systems; Obtaining a preset number of domain name applications according to the domain name list or URL list; collecting domain name multi-dimensional features of the domain name application; converting each feature in the multidimensional feature of the domain name into a numerical value for identification in the multidimensional feature coordinate system according to a preset numerical standard; Calculate the aggregation situation of the domain name application according to the value identified in the multi-dimensional feature coordinate system, and obtain the detection result of domain name abuse according to the aggregation situation. 2. A method for domain name abuse detection based on cluster analysis according to claim 1, wherein said multi-dimensional feature comprises: domain name feature, URL feature, IPv4 address, country of IP address attribution, domain name resolution features, text features, website image features, and website structure features. 3. A method for domain name abuse detection based on cluster analysis according to claim 1, wherein the preset numerical standard is configured as: If there is a feature that is difficult to convert numerical value among the multi-dimensional features, the feature is split into multiple dimensions according to preset rules, and each dimension is sequentially numbered, so that different features correspond to different numbers. 4. The method for domain name abuse detection based on cluster analysis according to claim 1, characterized in that, according to the numerical values identified in the multi-dimensional feature coordinate system, the aggregation of the domain name application is calculated, and according to the aggregation The steps to obtain detection results of domain name abuse include: Splitting the domain name multidimensional feature into multiple dimensions; Set all said dimensions to unit distance; generating a unit space based on unit distances in all said dimensions; Calculating the proportion of the number of domain names used by the domain name in the unit space in the entire multidimensional space; judging whether the proportion is greater than or equal to a preset threshold; If yes, there is an aggregated domain name application. 5. A method for domain name abuse detection based on cluster analysis according to claim 4, wherein the step after judging whether the proportion is greater than or equal to a preset threshold comprises: If not, there is no aggregate domain name application. 6. A method for domain name abuse detection based on cluster analysis according to claim 4, wherein the step of calculating the proportion of the domain name application in the unit space comprises: Proportion = the number of domain name applications in the unit space/the number of all domain name applications. 7. A domain name abuse detection system based on cluster analysis, applied to the domain name abuse detection method based on cluster analysis according to any one of claims 1 to 6, characterized in that it includes: a configuration module, a data processing module, A first conversion module, an acquisition module, a second conversion module, and a calculation module; The configuration module is used to select the multi-dimensional characteristics of the domain name application; A data processing module, configured to establish a corresponding one-dimensional feature coordinate system for each feature in the multi-dimensional features; the one-dimensional feature coordinate system is used to identify the position of the value converted by the feature according to the preset numerical standard in the coordinate system; The first conversion module is used to establish a multi-dimensional feature coordinate system according to all the one-dimensional feature coordinate systems; A collection module, configured to obtain a preset number of domain name applications according to a domain name list or a URL list; collect domain name multidimensional features of the domain name application; The second conversion module is used to convert each feature in the domain name multi-dimensional feature into a numerical value for identification in the multi-dimensional feature coordinate system according to a preset numerical standard; A calculation module, configured to calculate the aggregation of the domain name application according to the value identified in the multi-dimensional feature coordinate system, and obtain the detection result of domain name abuse according to the aggregation. 8. An electronic device comprising a memory, a processor, and a computer program stored on the memory and operable on the processor, wherein the processor implements any of claims 1 to 6 when executing the program. The steps of a domain name abuse detection method based on cluster analysis described in the item. 9. A non-transitory computer-readable storage medium, on which a computer program is stored, characterized in that, when the computer program is executed by a processor, it implements the cluster analysis based on any one of claims 1 to 6 The steps of the domain name abuse detection method.

Images