A Knowledge Distillation-Based Triple-Branch Framework for Malicious Domain Detection via Cross-Source Feature Fusion

Abstract

With the continuous expansion of internet applications, malicious domains have become a significant entry point for cyberattacks, posing severe threats to user privacy and corporate security. In practical scenarios, the limited number and complex distribution of malicious domain samples render traditional detection methods—relying on large-scale labelled datasets—ineffective under smallsample conditions, struggling to adapt to rapidly evolving attack techniques. To address this, this paper proposes a malicious domain detection model integrating knowledge distillation with tri-branch cross-source features. Designed for small-sample learning scenarios, this model comprehensively utilises domain semantic features (BERT vectors), manually derived statistical features, and SSL certificate features. It achieves deep semantic representation through branch encoders and employs attention mechanisms for adaptive weighted fusion of multi-source information. Notably, certificate features exhibit significant discriminative power between malicious and benign domains, providing structured security clues that enhance the model’s recognition of novel attack patterns. To further improve generalisation performance and deployment efficiency, this paper introduces a knowledge distillation mechanism. A pre-trained large model (RoBERTa) serves as the teacher model, guiding the student model to learn high-level semantic relationships with limited data through semantic representations and soft labels. Concurrently, Triplet Loss constraints are applied to optimise intra-class cohesion and inter-class separation within the feature space. Experimental results demonstrate that the proposed model achieves outstanding performance on balanced few-shot datasets, attaining Precision, Recall, F1, AUC, and Accuracy scores of 0.9857, 0.9988, 0.9922, 0.9968, and 0.9921 respectively, significantly outperforming conventional methods. This research validates the effectiveness and practical feasibility of a lightweight architecture integrating knowledge distillation and cross-source features for malicious domain detection with small samples, offering novel insights for rapid deployment and continuous protection in cybersecurity systems.