Abstract
The Domain Name System (DNS) facilitates access to Internet devices, but is also widely used for various malicious activities. Existing detection methods are mainly classified into statistical feature-based methods and graph structure-based methods. However, highly hidden malicious domains can bypass statistical feature-based methods, and graph structure-based methods have limited performance in the case of extremely sparse labels. In this paper, we propose a malicious domain detection method based on self-supervised HGNNs with contrastive learning, which can make full use of unlabeled domain data. Specifically, we design a hierarchical attention mechanism and a cross-layer message passing mechanism in the encoder for discovering more hidden malicious domains. Then, we construct a node-level contrastive task and graph-level similarity task to pre-train high-quality domain representations. Finally, we classify domains by fine-tuning the model with a small number of domain labels. Extensive experiments are conducted on the real DNS dataset and the results show that our method outperforms the state-of-the-art methods.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
ALEXA: Alexa top 1 million (2022). www.aws.amazon.com/cn/alexa-top-sites/
Antonakakis, M., Perdisci, R., Dagon, D., Lee, W., Feamster, N.: Building a dynamic reputation system for DNS. In: USENIX Security Symposium, pp. 273–290 (2010)
cybercrime: cybercrime-tracker (2022). www.cybercrime-tracker.net/
Devlin, J., Chang, M.W., Lee, K., Toutanova, K.: BERT: pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 (2018)
Dong, Y., Chawla, N.V., Swami, A.: metapath2vec: scalable representation learning for heterogeneous networks. In: Proceedings of the 23rd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 135–144 (2017)
Hassani, K., Khasahmadi, A.H.: Contrastive multi-view representation learning on graphs. In: International Conference on Machine Learning, pp. 4116–4126. PMLR (2020)
Hu, Z., Dong, Y., Wang, K., Sun, Y.: Heterogeneous graph transformer. In: Proceedings of the Web Conference 2020, pp. 2704–2710 (2020)
Ji, H., Wang, X., Shi, C., Wang, B., Yu, P.: Heterogeneous graph propagation network. IEEE Trans. Knowl. Data Eng. (2021)
Kim, D., Baek, J., Hwang, S.J.: Graph self-supervised learning with accurate discrepancy learning. arXiv preprint arXiv:2202.02989 (2022)
Kipf, T.N., Welling, M.: Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907 (2016)
Li, Z., Yuan, F., Liu, Y., Cao, C., Fang, F., Tan, J.: Heterogeneous graph attention network for malicious domain detection. In: Pimenidis, E., Angelov, P., Jayne, C., Papaleonidas, A., Aydin, M. (eds.) ICANN 2022. LNCS, vol. 13530, pp. 506–518. Springer, Cham (2022). https://doi.org/10.1007/978-3-031-15931-2_42
OPENDNS: Phishtank (2022). www.phishtank.com
Park, C., Kim, D., Han, J., Yu, H.: Unsupervised attributed multiplex network embedding. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol. 34, pp. 5371–5378 (2020)
Perozzi, B., Al-Rfou, R., Skiena, S.: Deepwalk: online learning of social representations. In: Proceedings of the 20th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 701–710 (2014)
Riskanalytics: Malware domain block list (2022). www.malwaredomains.com
Sato, K., Ishibashi, K., Toyono, T., Hasegawa, H., Yoshino, H.: Extending black domain name list by using co-occurrence relation between DNS queries. IEICE Trans. Commun. 95(3), 794–802 (2012)
Schüppen, S., Teubert, D., Herrmann, P., Meyer, U.: \(\{\)FANCI\(\}\): feature-based automated nxdomain classification and intelligence. In: 27th \(\{\)USENIX\(\}\) Security Symposium (\(\{\)USENIX\(\}\) Security 18), pp. 1165–1181 (2018)
Sun, X., Tong, M., Yang, J., Xinran, L., Heng, L.: Hindom: a robust malicious domain detection system based on heterogeneous information network with transductive classification. In: 22nd International Symposium on Research in Attacks, Intrusions and Defenses (\(\{\)RAID\(\}\) 2019), pp. 399–412 (2019)
Veličković, P., Cucurull, G., Casanova, A., Romero, A., Lio, P., Bengio, Y.: Graph attention networks. arXiv preprint arXiv:1710.10903 (2017)
Wang, X., et al.: Heterogeneous graph attention network. In: The World Wide Web Conference, pp. 2022–2032 (2019)
Wang, X., Liu, N., Han, H., Shi, C.: Self-supervised heterogeneous graph neural network with co-contrastive learning. In: Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 1726–1736 (2021)
Wu, Z., Pan, S., Chen, F., Long, G., Zhang, C., Philip, S.Y.: A comprehensive survey on graph neural networks. IEEE Trans. Neural Netw. Learn. Syst. 32(1), 4–24 (2020)
Yin, Y., Wang, Q., Huang, S., Xiong, H., Zhang, X.: AutoGCL: automated graph contrastive learning via learnable view generators. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol. 36, pp. 8892–8900 (2022)
Zhang, S., et al.: Attributed heterogeneous graph neural network for malicious domain detection. In: 2021 IEEE 24th International Conference on Computer Supported Cooperative Work in Design (CSCWD), pp. 397–403. IEEE (2021)
Zhao, J., Wang, X., Shi, C., Liu, Z., Ye, Y.: Network schema preserving heterogeneous information network embedding. In: International Joint Conference on Artificial Intelligence (IJCAI) (2020)
Acknowledgements
This work is supported by Key Research and Development Program Projects of Xinjiang (No. 2022B03010-2), Strategic Priority Research Program of the Chinese Academy of Sciences (No.XDC02030400).
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Li, Z., Yuan, F., Cao, C., Su, M., Lu, Y., Liu, Y. (2023). Malicious Domain Detection Based on Self-supervised HGNNs with Contrastive Learning. In: Iliadis, L., Papaleonidas, A., Angelov, P., Jayne, C. (eds) Artificial Neural Networks and Machine Learning – ICANN 2023. ICANN 2023. Lecture Notes in Computer Science, vol 14256. Springer, Cham. https://doi.org/10.1007/978-3-031-44213-1_6
Download citation
DOI: https://doi.org/10.1007/978-3-031-44213-1_6
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-44212-4
Online ISBN: 978-3-031-44213-1
eBook Packages: Computer ScienceComputer Science (R0)