Abstract: The timely and accurate detection of illegal domain names can effectively prevent the information loss caused by server crashes or unauthorized intrusions. A multifamily malicious domain name intrusion detection method based on collaborative attention is proposed. Firstly, the deep autoencoder network is used to encode and compress layer by layer, extracting the domain name encoding features at the intermediate layer. Secondly, the longdistance and shortdistance encoding features of the domain name string are extracted from the temporal and spatial dimensions, and the selfattention mechanism is constructed on the temporal and spatial encoding feature maps to enhance the expressiveness of the encoding features in local space. Thirdly, the crossattention mechanism is used to establish information interaction between the temporal and spatial encoding features, enhancing the expressiveness of different dimension encoding features in the global space. Finally, the softmax function is used to predict the probability of the domain name to be tested, and quickly determine the legitimacy of the domain name according to the probability value. The results of testing on multiple families of malicious domain name datasets show that the proposed method can achieve a detection accuracy of 0.9876 in the binary classification task of normal and malicious domain names, and an average recognition accuracy of 0.9568 on 16 family datasets. Compared with other classic methods of the same kind, the proposed method achieves the best detection results on multiple evaluation metrics.

Key words: malicious domain name intrusion detection, collaborative attention, deep autoencoder network, selfattention, crossattention

摘要： 及时准确地检测出非法域名，可以有效预防网络服务器宕机或非法入侵导致的信息丢失问题.为此，提出一种基于协同注意力的多家族恶意域名入侵检测方法.首先，利用深度自编码网络逐层编码压缩，捕获中间层的域名编码特征；其次，从时序和空间维度提取域名字符串的长短距离编码特征和空间编码特征，并在时序和空间编码特征图上构造自注意力机制，强化编码特征在局部空间中的表达能力；再次，借助交叉注意力机制建立时序和空间编码特征的信息交互，增强不同维度编码特征在全局空间中的表达能力；最后，利用softmax函数预测待测域名的概率，并根据概率值快速判定待测域名的合法性.在多个家族的恶意域名数据集上进行测试，结果表明所设计的方法在合法域名与恶意域名二分类检测任务上可以获得0.9876的检测精准率，并在16个家族数据集上可以实现0.9568的平均识别精准率.与其他同类经典方法相比，所设计方法在多个评价指标上实现了最佳的检测结果.

关键词: 恶意域名入侵检测, 协同注意力, 深度自编码网络, 自注意力, 交叉注意力