Robust Malicious Domain Detection Against Adversarial Attacks on Heterogeneous Graph

Domain Name System (DNS) is a crucial infrastructure of the Internet, yet it is also a primary medium for disseminating illicit information. Researchers have proposed numerous methods to detect malicious domains, among which heterogeneous graph (HG) based models have demonstrated good performance. However, their success may also motivate attackers to defeat HG based models in order to evade detection. In this paper, we propose a novel malicious domain detection model named RoDom, which is robust against adversarial attacks on HG. Firstly, we introduce different perturbations to construct multiple attacked graphs, which are designed to simulate different types of adversarial attacks on the HG. Secondly, we design a discriminator to perform robust representation learning on the HG by discriminating the original graph from attacked graphs. Finally, we introduce a classification selector to further improve the model's robustness by automatically combining domain representations of multiple HGs for domain classification. The experimental results show that RoDom out-performs other state-of-the-art methods and exhibits stronger robustness against adversarial attacks on the HG.