Semi-supervised Malicious Domain Detection Based on Meta Pseudo Labeling

The Domain Name System (DNS) is a crucial infrastructure of the Internet, yet it is also a primary medium for disseminating illicit content. Researchers have proposed numerous methods to detect malicious domains, with association-based approaches achieving relatively good performance. However, these methods encounter limitations in detecting malicious domains within isolated nodes and heavily relying on labeled data to improve performance. In this paper, we propose a semi-supervised malicious domain detection model named SemiDom, which is based on meta pseudo labeling. Firstly, we use associations among DNS entities to construct a semantically enriched domain association graph. In particular, we retain isolated nodes within the dataset that lack relationships with other entities. Secondly, a teacher network computes pseudo labels on the unlabeled nodes, which effectively augments the scarce labeled data. A student network utilizes these pseudo labels to transform both the structure and attribute features to domain labels. Finally, the teacher network is constantly optimized based on the student’s performance feedback on the labeled nodes, enabling the generation of more precise pseudo labels. Extensive experiments on the real-world DNS dataset demonstrate that our proposed method outperforms the state-of-the-art methods.