引文格式：王闪闪,马昊,李群,等.融合异构图网络与大语言模型推理的恶意域名检测方法[J].西安邮电大学学报,2026,31 (5):115-125.
WANG Shanshan, MA Hao, LI Qun, et al. Malicious domain detection method combining heterogeneous graph network and large language model reasoning[J]. Journal of Xi'an University of Posts and Telecommunications,2026,31(5):115-125.(in Chinese)
融合异构图网络与大语言模型推理的恶意域名检测方法
王闪闪¹,²，马 昊¹,²，李 群³，潘 岳¹,²，陈贞翔¹,²
（1.济南大学 信息科学与工程学院，山东 济南 250022；2.济南大学 山东省泛在智能计算重点实验室（筹），山东 济南 250022；3.济宁职业技术学院 电子信息工程系，山东 济宁 272007）
摘要：针对域名系统中基于黑名单与静态特征的方法难以有效应对复杂攻击手段的问题，提出一种融合异构图网络与大语言模型推理的恶意域名检测方法。该方法先构建包含域名、互联网协议、规范名称及注册者等实体的异构信息网络，再在此基础上构建基于元路径的多头图注意力网络，动态量化不同语义空间的邻居权重，并通过多层聚合挖掘节点的结构化关联。最后，引入大语言模型作为推理引擎，计算结构与语义特征的匹配度，输出决策置信度评分，实现对潜在恶意域名的推理与分类，并最终根据证据生成判决报告。实验结果表明，与主流图模型及纯文本方法对比，所提方法对恶意域名检测的准确率达到92.58%，冷启动检测准确率为79.22%，证实了该方法的有效性。
关键词：域名检测；异构信息网络；图注意力网络；大语言模型；协同推理
中图分类号：TN393.08；TP183 文献标志码：A
文章编号：2095-6533(2026)05-0115-11
Malicious domain detection method combining heterogeneous graph networks and large language model reasoning
WANG Shanshan¹,², MA Hao¹,², LI Qun3, PAN Yue¹,², CHEN Zhenxiang¹,²
(1. School of Information Science and Engineering, University of Jinan, Jinan 250022, China; 2. Shandong Key Laboratory of Ubiquitous Intelligent Computing, University of Jinan, Jinan 250022, China; 3. Department of Electronic Information Engineering, Jining Polytechnic, Jining 272007, China)
Abstract: Traditional methods for malicious domain detection based on blacklists and static features in the domain name system struggle to effectively address complex attack techniques. To address this issue, a malicious domain detection method integrating a heterogeneous graph network with large language model reasoning is proposed. Firstly, a heterogeneous information network including domain names, internet protocol, canonical names, and registrants is constructed. On this basis, a meta-path-based multi-head graph attention network is constructed to dynamically quantify the weights of neighboring nodes across different semantic spaces, and to mine the structured associations among nodes through multi-layer aggregation. Finally, a large language model is introduced as the inference engine to measure the matching degree between structural and semantic features, output a decision confidence score, perform reasoning and classification of potentially malicious domain names, with a final evidence-based judgment report generated. The proposed method was evaluated against mainstream graph-based and text-based methods. Experimental results indicate that the proposed method achieves an accuracy of 92.58% in malicious domain detection and an accuracy of 79.22% in cold-start detection, which demonstrate the effectiveness of the proposed method.
Keywords: domain name detection; heterogeneous information network; graph attention network; large language model; collaborative reasoning
基金项目：国家自然科学基金项目(62502182)；山东省自然科学基金项目(ZR2023QF096)；泰山学者工程项目(tstp20240828，tsqnz20221146)
作者简介：王闪闪 (1988—)，女，山东菏泽人，博士，济南大学讲师，主要研究方向为人工智能、网络空间安全等。E-mail：ise_wangss@ujn.edu.cn
马昊 (2002—)，男，山东济南人，济南大学硕士研究生，主要研究方向为网络黑灰产行为分析、自然语言处理等。E-mail：ma_hao@stu.ujn.edu.cn
李群 (1993—)，男，山东济宁人，硕士，济宁职业技术学院讲师，主要研究方向为智能数据处理等。E-mail：ujn_liqun@qq.com
潘岳 (1992—)，男，山东菏泽人，博士，济南大学讲师，主要研究方向为图像处理等。E-mail：ise_pany@ujn.edu.cn
陈贞翔（1979—），男，湖南郴州人，博士，济南大学教授、博士生导师，主要研究方向为网络行为测量、智能数据安全等。E-mail：zxchen@ujn.edu.cn