Malicious Domain Detection with Heterogeneous Graph Propagation Network

As one of the most important basic services of the Internet, the domain name system is abused by attackers for various malicious activities. Malicious domain detection is a key technology against attackers. Previous works mainly employ manually selected features to detect malicious domains which are easily evaded by attackers. In this paper, we propose a novel malicious domain detection system with heterogeneous graph propagation network, named HGPNDom, which can jointly consider the global relationship and higher-order features of domains. In HGPNDom, we first model the DNS scene as a heterogeneous information network (HIN) to capture rich information. Then, we propose a heterogeneous graph propagation network (HGPN) to classify domain nodes in the HIN, including semantic propagation mechanism and semantic fusion mechanism. The semantic propagation mechanism can spread information through more layers and learn higher-order domain features, while the semantic fusion mechanism can learn the importance of different meta-paths and fuse them for classification. Experimental results on the real DNS dataset show that HGPNDom outperforms other state-of-the-art methods.