Abstract: Current malicious domain detection techniques based on graph neural networks rely on domain experts for meta-path selection to convert heterogeneous graphs into homogeneous graphs for direct learning.This approach struggles to leverage the rich topological information within the graph and lacks good scalability and generalization capabilities.For this issue,this paper proposes a malicious domain detection technique based on inductive learning from heterogeneous graphs.Firstly,it constructs a heterogeneous information network with nodes representing domains,hosts,and domain registration information using a meta-path generation algorithm.Secondly,to address the model’s poor applicability in real networks under direct training,it utilizes the inductive graph neural network HeteroGAT to learn the general structure of the heterogeneous graph formed by training samples and enhances detection performance through an autoencoder-based domain feature representation.Finally,it compares the proposed algorithm with machine learning and deep learning methods on public datasets.Experimental results demonstrate that the proposed method achieves superior performance metrics and effectively handles data imbalance even with a limited number of training samples,showing strong robustness.

Key words: Network security, Malicious domain detection, Inductive learning, Heterogeneous graph, Meta-path