Malicious Blockchain Domain Detection Based on Heterogeneous Information Network

With the popularity of Blockchain Domain Name System (BDNS), more and more cybercriminals integrate Blockchain Domain Names (BDNs) into their infrastructure. Due to the anonymity and anti-censorship of BDNs, it is difficult to detect malicious activities based on BDNs, posing a serious threat to network security. In this paper, we propose a novel method to detect malicious BDNs. First, we extract 16 statistical features of domain names. Second, we construct a Heterogeneous Information Network (HIN) of BDNS, which can use malicious traditional domain names as supplementary data. Then we associate domain names by meta-paths in the HIN and build an association graph of domain names. To better characterize domain names, we use the graph convolutional network algorithm to fuse the statistical features of domain names in the association graph. Finally, we detect malicious BDNs by the neural network algorithm. Compared with the existing methods, the experimental results show that our method can accurately detect malicious BDNs with the F1 score of 0.9901 and discover more unknown malicious BDNs from the dataset.