APT domain attribution based on multi-level feature fusion

Ma Lizhao; Huang Cheng; Li Ming; Mou Haotian; Peng Jiaren; Xie Qiliang

doi:10.11959/j.issn.2096-109x.AQ25254

您当前的位置：

首页 >

文章列表页 >

APT domain attribution based on multi-level feature fusion

Papers | 更新时间：2026-05-11

- APT domain attribution based on multi-level feature fusion
- Chinese Journal of Network and Information Security Vol. 12, Issue 2, Pages: 132-142(2026)
- 作者机构：
  
  1.四川大学网络空间安全学院，四川成都 610207
  2.中国电子科技集团航空电子有限公司，四川成都 611731
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China General Program(62472296);Sichuan Provincial Department of Science and Technology Project(2024ZHCG0197)
- DOI：10.11959/j.issn.2096-109x.AQ25254
  CLC： TP393
- Received：14 October 2025，
  
  Revised：2026-03-25，
  
  Accepted：25 March 2026，
  
  Published：25 April 2026
- 稿件说明：
移动端阅览
马利昭, 黄诚, 黎明, 等. 基于多层次特征融合的APT域名归因方法[J]. 网络与信息安全学报, 2026, 12(2): 132-142.

Ma Lizhao, Huang Cheng, Li Ming, et al. APT domain attribution based on multi-level feature fusion[J]. Chinese Journal of Network and Information Security, 2026, 12(2): 132-142.
马利昭, 黄诚, 黎明, 等. 基于多层次特征融合的APT域名归因方法[J]. 网络与信息安全学报, 2026, 12(2): 132-142. DOI： 10.11959/j.issn.2096-109x.AQ25254.

Ma Lizhao, Huang Cheng, Li Ming, et al. APT domain attribution based on multi-level feature fusion[J]. Chinese Journal of Network and Information Security, 2026, 12(2): 132-142. DOI： 10.11959/j.issn.2096-109x.AQ25254.

摘要

高级持续性威胁（advanced persistent threat

APT）因其高度定向性、技术复杂性和长期潜伏性，对国家关键基础设施和重点行业构成严峻的安全挑战。在现实场景中，APT检测既需实现早期预警，又面临APT域名数据稀缺的困境，导致传统基于通信流量特征或依赖大规模训练数据的神经网络方法难以奏效。为此，提出了一种基于多层次特征融合的APT域名归因方法。该方法融合了文本、统计、语义和关联属性4个层次的特征，将归因任务分解为APT域名检测与归因两个阶段。在检测阶段，通过提取域名的文本特征、统计特征和语义特征，结合支持向量机（support vector machine

SVM）分类器，实现从海量域名中高效筛选潜在APT域名。在归因阶段，补充由RoBERTa模型提取的深层语义特征，结合基于外部数据库查询的域名系统（domain name system

DNS）解析信息等关联属性特征，构建多层次特征表示。接下来采用K-means聚类算法对检测出的APT域名进行关联分析，实现向特定攻击组织的归因。实验结果表明，该方法在检测任务中F1分数达97.47%，在归因任务中调整兰德指数（ARI）达86.85%、标准化互信息（NMI）达90.74%。在真实场景中，该方法相较公开报告平均提前112天标记出18个APT域名，实现了从被动响应到主动防御的转变。

Abstract

APT activities posed severe challenges to national critical infrastructure and key industries due to their highly targeted

technically complex

and persistent nature. However

early-warning capabilities were required in real-world APT detection

while APT domain data were scarce

which rendered conventional methods based on communication-traffic features or data-intensive neural networks ineffective. To address this issue

an APT domain attribution method based on multilevel feature fusion was proposed

in which textual

statistical

semantic

and associative attribute features were integrated and the overall problem was decomposed into two stages: detection and attribution. In the detection stage

potential APT domains were efficiently screened from massive data by extracting textual

statistical

and semantic features

and classification was performed using a SVM classifier. In the attribution stage

deep semantic features were extracted by the RoBERTa model

and associative attribute features such as DNS resolution were supplemented via external database queries to construct a multilevel representation; correlation analysis and attribution to specific threat actors were then conducted using K-means clustering. The experimental results show that this method achieves an F1-score of 97.47% in the detection task

and in the attribution task

it reaches an ARI of 86.85% and an NMI of 90.74%. In real-world testing

18 APT domains were identified on average 112 days earlier than public reports

and proactive defense is enabled by shifting from passive response to early warning and defense.

关键词

Keywords

references

王晨阳 , 彭国军 , 杨秀璋 , 等 . 恶意代码动态分析对抗与反对抗技术综述 [J ] . 网络与信息安全学报 , 2025 , 11 ( 6 ): 1 - 16 .

Wang C Y , Peng G J , Yang X Z , et al . Survey on malicious code dynamic analysis evasion and anti-evasion techniques [J ] . Chinese Journal of Network and Information Security , 2025 , 11 ( 6 ): 1 - 16 .

张维维 , 龚俭 , 刘茜 , 等 . 基于词素特征的轻量级域名检测算法 [J ] . 软件学报 , 2016 , 27 ( 9 ): 2348 - 2364 .

Zhang W W , Gong J , Liu Q , et al . A lightweight domain name detection algorithm based on morpheme features [J ] . Journal of Software , 2016 , 27 ( 9 ): 2348 - 2364 .

Bilge L , Kirda E , Kruegel C , et al . Exposure: finding malicious domains using passive DNS analysis [C ] // Proceedings of the 18th Annual Network and Distributed System Security Symposium . 2011 : 195 - 211 .

Mahdavifar S , Maleki N , Lashkari A H , et al . Classifying malicious domains using DNS traffic analysis [C ] // Proceedings of the 2021 IEEE International Conference on Dependable, Autonomic and Secure Computing . Piscataway : IEEE Press , 2021 : 60 - 67 .

Kidmose E , Stevanovic M , Pedersen J M . Detection of malicious domains through lexical analysis [C ] // Proceedings of the 2018 International Conference on Cyber Security and Protection of Digital Services (Cyber Security) . Piscataway : IEEE Press , 2018 : 1 - 5 .

Ghalati N F , Ghalaty N F , Barata J . Towards the detection of malicious URL and domain names using machine learning [C ] // Proceedings of the Doctoral Conference on Computing, Electrical and Industrial Systems . Berlin : Springer , 2020 : 109 - 117 .

Vinayakumar R , Soman K P , Poornachandran P . Detecting malicious domain names using deep learning approaches at scale [J ] . Journal of Intelligent & Fuzzy Systems , 2018 , 34 ( 3 ): 1355 - 1367 .

Chen Y , Zhang S , Liu J , et al . Towards a deep learning approach for detecting malicious domains [C ] // Proceedings of the 2018 IEEE International Conference on Smart Cloud (SmartCloud) . Piscataway : IEEE Press , 2018 : 190 - 195 .

Su M Y , Su K L . BERT-based approaches to identifying malicious URLs [J ] . Sensors , 2023 , 23 ( 20 ): 8499 .

Devlin J , Chang M W , Lee K , et al . BERT: pre-training of deep bidirectional transformers for language understanding [C ] // Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers) . Kerrville : Association for Computational Linguistics , 2019 : 4171 - 4186 .

Liu Y H , Ott M , Goyal N , et al . RoBERTa: a robustly optimized BERT pretraining approach [PP ] . arXiv [ 2025-10-14 ] . arXiv: arXiv. 1907 . 11692 .

Sebastián S , Diugan R G , Caballero J , et al . Domain and website attribution beyond WHOIS [C ] // Proceedings of the Annual Computer Security Applications Conference . New York : ACM , 2023 : 124 - 137 .

Xiang X Y , Liu H , Zeng L Y , et al . IPAttributor: cyber attacker attribution with threat intelligence-enriched intrusion data [J ] . Mathematics , 2024 , 12 ( 9 ): 1364 .

Wei J , Zou K . EDA: easy data augmentation techniques for boosting performance on text classification tasks [J ] . arXiv: 1901.11196 , 2019 .

Xie Q , Dai Z , Hovy E , et al . Unsupervised data augmentation for consistency training [J ] . Advances in Neural Information Processing Systems , 2020 , 33 : 6256 - 6268 .

Belinkov Y , Bisk Y . Synthetic and natural noise both break neural machine translation [J ] . arXiv: 1711.02173 , 2017 .

Sahingoz O K , Buber E , Demir O , et al . Machine learning based phishing detection from URLs [J ] . Expert Systems with Applications , 2019 , 117 : 345 - 357 .

宋文纳 , 彭国军 , 傅建明 , 等 . 恶意代码演化与溯源技术研究 [J ] . 软件学报 , 2019 , 30 ( 8 ): 2229 - 2267 .

Song W N , Peng G J , Fu J M , et al . Research on malicious code evolution and traceability technology [J ] . Journal of Software , 2019 , 30 ( 8 ): 2229 - 2267 .

Tharwat A . Parameter investigation of support vector machine classifier with kernel functions [J ] . Knowledge and Information Systems , 2019 , 61 ( 3 ): 1269 - 1302 .

Li H , Lü Z , Yue Z . Support vector machine for structural reliability analysis [J ] . Applied Mathematics and Mechanics , 2006 , 27 ( 10 ): 1295 - 1303 .

Afek Y , Litmanovich A . Decoupling DNS update timing from TTL values [C ] // Proceedings of the NOMS 2025-2025 IEEE Network Operations and Management Symposium . Piscataway : IEEE Press , 2025 .

张慧菲 , 杨秀璋 , 彭国军 . APEA: 一种恶意URL新型识别方法 [J ] . 网络与信息安全学报 , 2025 , 11 ( 6 ): 77 - 91 .

Zhang H F , Yang X Z , Peng G J . APEA: a novel identification method for malicious URLs [J ] . Chinese Journal of Network and Information Security , 2025 , 11 ( 6 ): 77 - 91 .

Hubert L , Arabie P . Comparing partitions [J ] . Journal of Classification , 1985 , 2 ( 1 ): 193 - 218 .

Strehl A , Ghosh J . Cluster ensembles: a knowledge reuse framework for combining multiple partitions [J ] . Journal of Machine Learning Research , 2002 , 3 ( 3 ): 583 - 617 .

Almashhadani A O , Kaiiali M , Carlin D , et al . MaldomDetector: a system for detecting algorithmically generated domain names with machine learning [J ] . Computers & Security , 2020 , 93 : 101787 .

La O R L , Catania C A , Parlanti T . LLMs for domain generation algorithm detection [PP ] . arXiv [ 2025-10-14 ] . arXiv: arXiv. 2411 . 03307 .

张唯一 , 罗启瑞 , 张琳 . 基于动态聚类和信誉评估的抗攻击联邦框架 [J ] . 网络与信息安全学报 , 2025 , 11 ( 6 ): 120 - 130 .

Zhang W Y , Luo Q R , Zhang L . Anti-attack federated framework based on dynamic clustering and reputation evaluation [J ] . Chinese Journal of Network and Information Security , 2025 , 11 ( 6 ): 120 - 130 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

No data

Related Author

No data

Related Institution

No data

⁰