Domain name system security detection method and device based on multi-dimensional active security detection

Abstract

The embodiment of the application provides a domain name system security detection method and device based on multi-dimensional active security detection, constructs a distributed detection mechanism innovatively, realizes efficient identification of a domain name server through asynchronous coroutine scheduling and layered time delay analysis, designs a domain name expansion mechanism based on a probability model, combines multi-source information acquisition and a three-level expansion strategy, establishes a comprehensive domain name discovery method, introduces a scope relationship graph analysis mechanism, realizes accurate description of a domain name system topology through recursive path tracking and graph structure modeling, and effectively solves the deficiencies of traditional technologies in server detection, domain name expansion and system analysis, and significantly improves the effect of domain name system security detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data processing, in particular to a domain name system security detection method and device based on multi-dimensional active security detection. BACKGROUND

[0002] The existing domain name system security detection method has obvious defects. The traditional system lacks systematicness in domain name server detection, and it is difficult to effectively cover large-scale network space, affecting the integrity of the detection.

[0003] In addition, the existing technology has a bottleneck in domain name expansion. Most systems fail to fully utilize multi-source information and probability models, lack domain name generation mechanisms based on brand words and numerical variants, resulting in insufficient coverage of domain names.

[0004] The existing system has technical shortcomings in domain name system analysis. It lacks in-depth analysis capabilities for recursive resolution paths, and it is difficult to accurately depict the scope relationship through graph structure modeling, affecting the accuracy of the analysis results. Solving these problems is of great significance to improve the level of security detection. SUMMARY

[0005] To solve the problems in the prior art, the present application provides a domain name system security detection method and device based on multi-dimensional active security detection, which can effectively solve the shortcomings of traditional technology in server detection, domain name expansion and system analysis, and significantly improve the effect of domain name system security detection.

[0006] In order to solve at least one of the above problems, the present application provides the following technical solutions:

[0007] In a first aspect, the present application provides a domain name system security detection method based on multi-dimensional active security detection, comprising:

[0008] Based on the network address space of the target area, a distributed detection cluster is constructed, the network address space of the target area is divided into a plurality of subnets, an asynchronous coroutine pool scheduling model is created, a standard domain name query request is sent to the domain name service port of each network address in the subnet, the domain name server and the network server are distinguished by hierarchical time delay threshold, the authoritative domain name is obtained by performing reverse address resolution query on the domain name server, the security certificate of the domain name server is captured to obtain a bound domain name set, the content distribution network address is filtered based on the node database, and an initial domain name server address list is constructed;

[0009] The seed domain name set is acquired by collecting multi-source network information, new domain names are extracted by real-time acquisition of certificate transparency logs, registration information is acquired by querying a domain name registration database, hidden domain names are extracted by parsing dynamic web scripts, a character transition probability model is trained based on the seed domain name set, brand word deformation domain names and digital variant domain names are generated as first-level extended domain names by using the character transition probability model, second-level extended domain names are generated by combining and sampling the first-level extended domain names, third-level extended domain names are generated by verifying the accessibility of the first-level and second-level extended domain names, and the third-level extended domain names are used as new seed domain names to cyclically perform domain name expansion.

[0010] Recursive domain name resolution is performed on the domain name servers in the initial domain name server address list, domain name service records are acquired by tracking the path of the recursive domain name resolution, domain names and subdomain names in the domain name server addresses and the domain name service records are used as nodes, and the path of the recursive domain name resolution is used as an edge to construct a scope relationship graph, the management range of the domain name server is analyzed based on the scope relationship graph, and domain name system distribution information of a target region is output.

[0011] Further, the method further comprises: dividing the network address space of the target region into a plurality of twenty-four-bit prefix subnets according to the network address prefix length of the target region, constructing a distributed probe cluster node pool, assigning the subnets to the nodes in the probe cluster node pool according to network address continuity, implementing task synchronization of the nodes in the probe cluster node pool based on an inter-process communication mechanism, and creating a coroutine-based asynchronous task scheduling model.

[0012] A probe node is selected from the probe cluster node pool, a plurality of coroutine tasks are created based on the asynchronous task scheduling model, the coroutine tasks are assigned to the probe node, the probe node sends a standard domain name query request to a domain name service port of each network address in the assigned subnet through the coroutine task, and the sending frequency of the standard domain name query request is dynamically adjusted and the source address distribution is forged.

[0013] Further, the method further comprises: hierarchically counting the response time of the standard domain name query request, marking network addresses with a response time lower than a first time threshold as suspected domain name servers, marking network addresses with a response time between the first time threshold and a second time threshold as suspected network servers, sending a reverse address resolution request to the suspected domain name servers to acquire authoritative domain names, establishing a mapping relationship between the suspected domain name servers and the authoritative domain names, establishing a connection with the suspected domain name servers based on a transport layer security protocol, acquiring a security certificate of the suspected domain name servers, and extracting a binding domain name from a subject alternative name field of the security certificate.

[0014] The network address of the suspected domain name server is compared with a content distribution network node database, network addresses of matching hits are eliminated, the remaining network addresses are taken as domain name server addresses, a corresponding relationship table of the domain name server addresses and the authoritative domain name and the bound domain name is constructed, and an initial domain name server address list is generated.

[0015] Further, it also includes: collecting domain name information from search engines, domain name registration authorities, and network space mapping platforms, subscribing to certificate transparency log services to obtain real-time certificate records, extracting new domain names from the certificate records, sending batch query requests to domain name registration databases to obtain domain name registration information, creating a headless browser environment to load web pages, parsing dynamic scripts in the web pages to extract hidden domain names, merging and deduplicating the new domain names, the domain name registration information, and the hidden domain names to construct a seed domain name set;

[0016] The domain names in the seed domain name set are cut according to characters, the co-occurrence frequency of adjacent characters is counted, the transition probability between characters is calculated, a character transition probability matrix is constructed, a Markov chain model is trained based on the character transition probability matrix, and the Markov chain model is used as a character transition probability model for subsequent domain name expansion.

[0017] Further, it also includes: based on the character transition probability model, performing character replacement and deformation on brand words in the seed domain name set to generate brand word deformation domain names, performing incremental and decremental transformation on numbers contained in the seed domain name set to generate number variant domain names, merging the brand word deformation domain names and the number variant domain names to construct a first-level expanded domain name set, randomly selecting domain name pairs from the first-level expanded domain name set for combination sampling, and constructing new domain names generated by the sampling into a second-level expanded domain name set;

[0018] Sending domain name resolution requests to domain names in the first-level expanded domain name set and the second-level expanded domain name set, recording domain name resolution results, marking domain names that successfully resolve as valid domain names to construct a third-level expanded domain name set, updating the third-level expanded domain name set to the seed domain name set, and repeating the domain name expansion operation based on the updated seed domain name set.

[0019] Further, it also includes: reading domain name server addresses from the initial domain name server address list, sending recursive domain name resolution requests to the domain name server addresses, setting a recursive query flag bit of the recursive domain name resolution request, taking the domain name server address as a starting node to construct a resolution path, recording domain name service records returned by the domain name server, and extracting subordinate authoritative domain name server addresses from the domain name service records;

[0020] Based on the lower level authoritative domain name server address, a recursive domain name resolution request is continuously sent, each level of domain name server address is added to the resolution path, until the final domain name resolution result is obtained, and each level of domain name server address recorded in the resolution path and the corresponding domain name service record are saved as recursive resolution link data.

[0021] Further, the domain name server address, the domain name and the subdomain name in the domain name service record are constructed as a node set, an edge set is constructed based on the recursive resolution link data, the node set and the edge set are combined to generate a scope relationship graph, a weight attribute is assigned to a node in the scope relationship graph, the in-degree, the out-degree and the centrality of the node are calculated, and the metric indicators of the node are used as the node weight.

[0022] A community discovery algorithm is executed on the scope relationship graph to divide node clusters, the management range of the domain name server is analyzed based on the connectivity of the node clusters, the size and the distribution characteristics of each node cluster are counted, the hierarchical relationship between the node clusters is extracted, and domain name system distribution information of the target region is generated.

[0023] In a second aspect, the application provides a domain name system security detection device based on multi-dimensional active security detection, comprising:

[0024] A domain name processing module is configured to construct a distributed detection cluster based on the network address space of a target region, divide the network address space of the target region into a plurality of subnetwork segments, create an asynchronous coroutine pool scheduling model, send a standard domain name query request to a domain name service port of each network address in the subnetwork segment, distinguish a domain name server from a network server through a hierarchical time delay threshold, perform a reverse address resolution query on the domain name server to obtain an authoritative domain name, capture a security certificate of the domain name server to obtain a bound domain name set, filter a content distribution network address based on a node database, and construct an initial domain name server address list.

[0025] An expansion processing module is configured to collect multi-source network information to obtain a seed domain name set, obtain a certificate transparency log in real time to extract a new domain name, query a domain name registration database to obtain registration information, parse a dynamic web page script to extract a hidden domain name, train a character transfer probability model based on the seed domain name set, generate a brand word deformation domain name and a digital variant domain name as a first-level expansion domain name using the character transfer probability model, combine and sample the first-level expansion domain name to generate a second-level expansion domain name, verify the accessibility of the first-level expansion domain name and the second-level expansion domain name to generate a third-level expansion domain name, and use the third-level expansion domain name as a new seed domain name to perform domain name expansion cyclically.

[0026] The security detection module is configured to perform recursive domain name resolution on the domain name servers in the initial domain name server address list, track a path of the recursive domain name resolution to obtain domain name service records, construct a scope relationship graph by taking the domain name server addresses and domain names and subdomain names in the domain name service records as nodes and taking the path of the recursive domain name resolution as edges, analyze a management range of the domain name servers based on the scope relationship graph, and output domain name system distribution information of a target region.

[0027] In a third aspect, the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method for detecting security of a domain name system based on multi-dimensional active security detection when executing the program.

[0028] In a fourth aspect, the present application provides a computer readable storage medium, which stores a computer program, wherein the computer program is executable on a processor to implement the steps of the method for detecting security of a domain name system based on multi-dimensional active security detection.

[0029] In a fifth aspect, the present application provides a computer program product, comprising computer programs / instructions, wherein the computer programs / instructions are executable on a processor to implement the steps of the method for detecting security of a domain name system based on multi-dimensional active security detection.

[0030] According to the above technical solution, the present application provides a method and device for detecting security of a domain name system based on multi-dimensional active security detection, which realizes efficient identification of domain name servers by innovatively constructing a distributed detection mechanism, asynchronously scheduling and analyzing hierarchical time delays, designing a domain name expansion mechanism based on a probability model, combining multi-source information acquisition and a three-level expansion strategy to establish a comprehensive domain name discovery method, introducing a scope relationship graph analysis mechanism, and realizing accurate description of a domain name system topology by recursively analyzing a path and modeling a graph structure. The method effectively solves the deficiencies of traditional technologies in server detection, domain name expansion, and system analysis, and significantly improves the effect of detecting security of a domain name system. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0032] Figure 1 FIG. 1 is a flowchart of a method for detecting security of a domain name system based on multi-dimensional active security detection according to an embodiment of the present application;

[0033] Figure 2 FIG. 1 is a structural diagram of a domain name system security detection device based on multi-dimensional active security detection in an embodiment of the present application;

[0034] Figure 3 FIG. 4 is a structural diagram of an electronic device in an embodiment of the present application.

[0035] Reference signs:

[0036] Electronic device 9600, central processor 9100, memory 9140, communication module 9110, input unit 9120, audio processor 9130, display 9160, power supply 9170, buffer memory 9141, application / function storage unit 9142, data storage unit 9143, driver program storage unit 9144, antenna 9111, speaker 9131, microphone 9132. DETAILED DESCRIPTION

[0037] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the following will be combined with the accompanying drawings in the embodiments of the present application to make a clear and complete description of the technical solutions in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0038] The acquisition, storage, use, processing, and the like of data in the technical solutions of the present application all comply with relevant provisions of national laws and regulations.

[0039] In view of the problems in the prior art, the present application provides a domain name system security detection method and device based on multi-dimensional active security detection. By innovatively constructing a distributed detection mechanism, through asynchronous coroutine scheduling and hierarchical time delay analysis, efficient identification of domain name servers is achieved. A domain name expansion mechanism based on a probability model is designed, combined with multi-source information acquisition and a three-level expansion strategy, to establish a comprehensive domain name discovery method. A scope relationship graph analysis mechanism is introduced, through recursive path tracking and graph structure modeling, to achieve accurate description of the domain name system topology. This method effectively solves the deficiencies of traditional technology in server detection, domain name expansion, and system analysis, and significantly improves the effect of domain name system security detection.

[0040] In order to effectively solve the deficiencies of traditional technology in server detection, domain name expansion, and system analysis, and significantly improve the effect of domain name system security detection, an embodiment of a domain name system security detection method based on multi-dimensional active security detection is provided in the present application, as shown in Figure 1 , the domain name system security detection method based on multi-dimensional active security detection specifically includes the following contents:

[0041] Step S101: Construct a distributed probe cluster based on the network address space of the target region, divide the network address space of the target region into multiple subnet segments, create an asynchronous coroutine pool scheduling model, send a standard domain name query request to the domain name service port of each network address in the subnet segment, distinguish between domain name servers and web servers through hierarchical latency thresholds, perform a reverse address resolution query on the domain name servers to obtain authoritative domain names, capture the security certificates of the domain name servers to obtain a set of bound domain names, filter content distribution network addresses based on a node database, and construct an initial domain name server address list;

[0042] Optionally, the embodiment innovatively designs a distributed probe scheme based on coroutine pools to address the low efficiency of domain name system infrastructure probing and the poor accuracy of server type identification. In terms of probe efficiency optimization, the embodiment designs a dynamic load balancing formula: Load_Factor = (Active_Coroutines x Avg_Response_Time) / (Max_Coroutines x Target_Response_Time), where Active_Coroutines represents the number of active coroutines, Avg_Response_Time represents the average response time, Max_Coroutines represents the maximum number of coroutines, and Target_Response_Time represents the target response time. The number of coroutines is dynamically adjusted through the formula to improve resource utilization efficiency while ensuring probe quality.

[0043] The embodiment deeply optimizes the network address space division strategy. For the network address space of the target region, the system uses an intelligent fragmentation algorithm based on address continuity. First, the address space is preliminarily divided according to a 24-bit prefix, and then dynamically adjusted according to the activity level and network topology characteristics of the address segment. For example, for high-density deployment regions, the system will use a finer-grained division strategy; for sparsely distributed regions, a larger subnet division is used. This adaptive division method not only improves the coverage efficiency of the address space, but also avoids frequent probing of a single subnet.

[0044] The embodiment innovatively implements an asynchronous coroutine pool scheduling mechanism. In the coroutine pool design, a multi-level task queue structure is used to achieve priority scheduling and load balancing of tasks. Each coroutine is responsible for handling probe tasks for a specific subnet, and high-concurrency queries are achieved through asynchronous I / O mechanisms. The system dynamically adjusts the allocation strategy of coroutines based on network response, increases the retry interval for subnets with slower responses, and increases the query frequency for stable subnets. This flexible scheduling strategy significantly improves probe efficiency while avoiding excessive pressure on the target network.

[0045] The embodiment realizes server type recognition through accurate time delay analysis. Based on a large amount of experimental data, the system establishes a multi-level time delay threshold model. The first time delay threshold is set to 1.5 times the standard DNS query response time, which is used to quickly identify local cache servers; the second time delay threshold is set to the median of the standard Web service response time, which is used to distinguish other network services. This threshold setting method based on actual observation data significantly improves the accuracy of server type judgment.

[0046] The embodiment establishes a complete domain name information collection chain. For the identified domain name server, the system first performs reverse address resolution to obtain the authoritative domain name. Then the server certificate is obtained through the TLS handshake, and the binding domain name is extracted from the SubjectAltName field of the certificate. This multi-dimensional information collection method ensures the integrity and reliability of the domain name server identity information. At the same time, the system will verify the validity of the obtained domain name and eliminate possible invalid records.

[0047] The embodiment improves the accuracy of the detection result by filtering the CDN node. The system maintains a real-time updated CDN node database containing the network address range and characteristic identification of mainstream CDN service providers. Through intelligent matching with this database, the system can accurately identify and filter CDN nodes, avoiding misjudgment as independent domain name servers. This accurate filtering mechanism significantly improves the reliability of the detection result.

[0048] The embodiment combines network detection and service recognition technology to improve detection efficiency while ensuring identification accuracy. Through coroutine pool, efficient detection is realized, and through multi-dimensional analysis, the accuracy of server type judgment is ensured. This design concept of balancing efficiency and accuracy provides a reliable data foundation for domain name system security detection.

[0049] The embodiment provides an innovative technical solution for domain name system asset detection. Through distributed detection and accurate identification, the system can quickly build a domain name server distribution map of the target area. This automated detection method significantly improves the efficiency and accuracy of domain name system asset mapping.

[0050] The embodiment realizes complete asset discovery through the construction of the initial domain name server address list. The server list verified multiple times ensures the accuracy of asset information and maintains high detection efficiency. This detection method focusing on quality and efficiency provides reliable data support for subsequent security analysis.

[0051] The detection method used in this embodiment has good scalability. By adjusting the detection strategy and identification rules, the system can adapt to different sizes and types of network environments. This flexible detection framework provides a general technical solution for domain name system security detection. This adaptive detection method not only improves the efficiency of discovery, but also enhances the practical value of the solution.

[0052] Step S102: Collecting multi-source network information to obtain a seed domain name set, acquiring a certificate transparency log in real time to extract new domain names, querying a domain name registration database to obtain registration information, parsing dynamic web scripts to extract hidden domain names, training a character transition probability model based on the seed domain name set, generating brand word deformation domain names and digital variant domain names as first-level expanded domain names using the character transition probability model, combining and sampling the first-level expanded domain names to generate second-level expanded domain names, verifying the accessibility of the first-level expanded domain names and the second-level expanded domain names to generate third-level expanded domain names, and taking the third-level expanded domain names as new seed domain names to cyclically perform domain name expansion;

[0053] Optionally, to solve the problems of incomplete domain name coverage and low expansion efficiency in domain name system security detection, the embodiment innovatively designs a domain name expansion scheme based on multi-source information fusion and a probability model. In the character transition probability calculation process, the embodiment designs a dynamic weight calculation formula: P(ci|cj)=(count(ci,cj)+α) / (Σcount(ck,cj)+α×V), where ci and cj represent adjacent characters, count represents co-occurrence frequency, α is a smoothing factor, and V is the size of the character table. A domain name similarity scoring formula is also introduced: Similarity=(1-β)EditDistance+βCharacterOverlap, which is used to evaluate the quality of generated domain names, where β is a balance factor used to adjust the weights of edit distance and character overlap.

[0054] The embodiment deeply optimizes the multi-source information collection strategy. In the search engine collection process, the system uses an adaptive crawler strategy to dynamically adjust the collection depth according to the page relevance. For data acquisition of domain name registration authorities, a distributed query method is used to ensure the continuity of the query through a rotating API key pool. In the data acquisition of the network space mapping platform, the focus is on asset clustering information, and the mapping relationship between domain names and IPs is extracted. This multi-dimensional information acquisition method provides rich basic data for subsequent domain name expansion. In the certificate transparency log subscription process, the system implements an incremental log processing mechanism, which records the latest tree size and consistency proof to ensure the timely acquisition and verification of new certificates.

[0055] This embodiment innovatively implements a dynamic webpage content extraction mechanism. In a headless browser environment, the system not only simulates basic page loading behavior but also implements complex JavaScript event triggering and AJAX request capture. By injecting custom JavaScript hook functions, the system can monitor dynamically loaded DOM changes and capture domain information injected asynchronously. For SPA (Single Page Application) websites, the system uses route history analysis and state manager monitoring to ensure that no dynamically generated domains are missed. This deep content extraction strategy significantly improves the efficiency of discovering hidden domains.

[0056] This embodiment achieves high-quality domain name generation using a Markov chain model. During model training, the system considers not only character-level transition probabilities but also phoneme and semantic features. By analyzing the word formation patterns of existing brand domain names, the system establishes a multi-level feature extractor. During domain name transformation generation, the system dynamically adjusts the sampling probability according to different transformation strategies. For example, for homophone replacement, the system prioritizes commonly used substitute characters in the target language; for similar-looking character replacement, it considers the visual similarity of the characters.

[0057] This embodiment establishes a complete domain name accessibility verification mechanism. During the verification process, the system employs a multi-layered detection strategy, including DNS resolution verification, HTTP response verification, and certificate verification. By constructing a geographically distributed verification node pool, the system can eliminate the impact of regional access restrictions. For domain names requiring deep verification, the system also analyzes their web service characteristics, including server fingerprints and response content characteristics, to ensure the actual usability of the generated domain names.

[0058] This embodiment combines probabilistic models and engineering practices to improve domain name expansion efficiency while ensuring generation quality. Intelligent character generation is achieved through a Markov chain model, and multiple verifications ensure the validity of the domain names. This design philosophy, balancing generation efficiency and quality, provides reliable technical support for domain name system security testing.

[0059] This embodiment provides an innovative solution for domain name asset detection. Through continuous domain name expansion and verification, the system can comprehensively discover domain name assets in the target region. This automated domain name discovery method significantly improves the efficiency and coverage of asset assessment.

[0060] This embodiment achieves continuous domain name discovery through a cyclical expansion mechanism. By reintegrating verified domain names into the seed set, the system forms a virtuous cycle of expansion. This dynamically updated expansion method ensures the continuity and adaptability of the domain name discovery process.

[0061] The domain name expansion method adopted in the embodiment has good scalability. By adjusting model parameters and verification strategies, the system can adapt to different types of domain name discovery requirements. This flexible expansion framework provides a general technical solution for domain name system security detection.

[0062] Step S103: performing recursive domain name resolution on the domain name servers in the initial domain name server address list, tracking the path of the recursive domain name resolution to obtain domain name service records, taking the domain name servers addresses and the domain names and subdomain names in the domain name service records as nodes, taking the path of the recursive domain name resolution as edges to construct a scope relationship graph, analyzing the management scope of the domain name servers based on the scope relationship graph, and outputting domain name system distribution information of a target region.

[0063] Optionally, the embodiment innovatively designs a domain name system topology discovery scheme based on recursive resolution and graph theory analysis to solve the problems of complex domain name system hierarchical relationship and difficulty in defining the management scope. In the process of evaluating the importance of nodes, the embodiment designs a comprehensive weight calculation formula: Node_Weight=αDegree_Centrality+βBetweenness_Centrality+γ×Domain_Authority, where α, β, and γ are weight coefficients, respectively representing the influence factors of degree centrality, betweenness centrality, and domain authority. A community clustering score formula: Cluster_Score=(Internal_Edges×2) / (Internal_Edges+External_Edges) is introduced to evaluate the cohesiveness of node clusters, where Internal_Edges represents the number of intra-cluster edges, and External_Edges represents the number of inter-cluster edges.

[0064] The embodiment deeply optimizes the recursive resolution strategy. In the recursive query process, the system adopts an intelligent request control mechanism to dynamically adjust the query strategy according to the server response characteristics. For servers that respond in a timely manner, the system appropriately increases the query frequency; for servers with high response delay, the system increases the retry interval. In terms of query parameter settings, the system adjusts the recursive flag bit and other DNS message fields according to the characteristics of different types of domain name servers. This adaptive query strategy not only ensures the integrity of the resolution data, but also avoids excessive pressure on the servers.

[0065] The embodiment innovatively realizes the analysis of the path tracking mechanism. In the recursive analysis process, the system not only records the directly returned DNS record, but also analyzes the authoritative server information involved in each layer of the analysis process. By constructing a complete analysis link, the system can accurately restore the hierarchical relationship of domain name resolution. For some special analysis cases, such as CNAME chain or alias resolution, the system will pay special attention to all intermediate nodes involved, ensuring that no key server node is missed. This detailed path tracking method significantly improves the accuracy of topology discovery.

[0066] The embodiment realizes the visual expression of the domain name system structure through the construction of the scope relationship graph. In the graph construction process, the system adopts a multi-level node representation method. The top-level node represents the authoritative domain name server, the intermediate node represents the domain name at each level, and the bottom-level node represents the specific subdomain name. The attributes of the edge are used to represent the type of the analysis relationship, such as direct analysis, delegated analysis, etc. This hierarchical graph structure design intuitively shows the management hierarchy and server responsibility division of the domain name system.

[0067] The embodiment establishes a complete management range analysis framework. By applying the community discovery algorithm to the scope relationship graph, the system can automatically identify the server group with close association. In the analysis process, not only the topological structure characteristics are considered, but also the semantic association of the domain name is combined. For example, when multiple domain names have similar naming patterns, the system will consider them to belong to the same management range. This multi-dimensional analysis method improves the accuracy of the management range definition.

[0068] The embodiment combines network measurement and graph analysis technology, improves the analysis efficiency while ensuring the interpretability of the results. By recursive analysis, complete domain name system data is obtained, and the structure characteristics of the system are revealed through graph analysis. This combination of practical observation and theoretical analysis provides reliable technical support for domain name system security evaluation.

[0069] The embodiment provides an innovative solution for domain name system structure analysis. Through automated topology discovery and analysis, the system can quickly construct the domain name system structure atlas of the target area. This intelligent analysis method significantly improves the efficiency and accuracy of domain name system evaluation.

[0070] The embodiment realizes a complete analysis closed loop through the output of distribution information. After multi-dimensional structure analysis, the system can generate a comprehensive report containing server distribution, management hierarchy, domain name coverage, etc. This comprehensive analysis result provides an important decision basis for the security management of the domain name system.

[0071] The analysis method used in this embodiment has good scalability. By adjusting the analysis parameters and evaluation criteria, the system can adapt to different scales and types of domain name system analysis requirements. This flexible analysis framework provides a general technical solution for domain name system security detection. This adaptive analysis method not only improves the efficiency of discovery, but also enhances the practical value of the solution.

[0072] As can be known from the above description, the domain name system security detection method based on multi-dimensional active security detection provided by the embodiments of the application can realize efficient identification of domain name servers through the innovative construction of a distributed detection mechanism, asynchronous coroutine scheduling, and hierarchical time delay analysis. A domain name expansion mechanism based on a probability model is designed, combined with multi-source information acquisition and a three-level expansion strategy, to establish a comprehensive domain name discovery method. A scope relationship graph analysis mechanism is introduced, through recursive path tracking and graph structure modeling, to realize accurate description of the domain name system topology. This method effectively solves the shortcomings of traditional technologies in server detection, domain name expansion, and system analysis, significantly improving the effect of domain name system security detection.

[0073] In an embodiment of the domain name system security detection method based on multi-dimensional active security detection of the application, the following content can also be specifically included:

[0074] Step S201: According to the network address prefix length of the target area, the network address space of the target area is divided into a plurality of twenty-four-bit prefix subnets, a distributed detection cluster node pool is constructed, the subnets are allocated to the nodes in the detection cluster node pool according to network address continuity, task synchronization of each node in the detection cluster node pool is realized based on an inter-process communication mechanism, and a coroutine-based asynchronous task scheduling model is created.

[0075] Step S202: Select a detection node from the detection cluster node pool, create a plurality of coroutine tasks based on the asynchronous task scheduling model, allocate the coroutine tasks to the detection node, and the detection node sends a standard domain name query request to the domain name service port of each network address in the allocated subnet through the coroutine task, dynamically adjusts the sending frequency of the standard domain name query request, and fakes the source address distribution.

[0076] Optionally, the embodiment is directed to the problem of low efficiency of large-scale network address space exploration, unbalanced task scheduling, etc. A distributed exploration scheme based on address prefix division and coroutine pool is innovatively designed. In terms of task load balancing, the embodiment designs a node load calculation formula: Node_Load = a x (Active_Tasks / Max_Tasks) + b x (Avg_Response_Time / Target_Time) + g x (Failed_Ratio), where a, b, and g are weight coefficients, respectively representing the influence factors of task quantity, response time, and failure rate. At the same time, a subnet segment allocation scoring formula: Subnet_Score = (Address_Density x Connectivity_Rate) / (Historical_Latency + 1) is introduced to optimize the subnet allocation strategy.

[0077] The embodiment deeply optimizes the network address space division strategy. When dividing 24-bit prefixes, the system first analyzes the address allocation characteristics of the target region. For large organization address blocks, it usually shows continuous address segments, and the system will maintain its integrity for division; for scattered address space, a dynamic aggregation strategy is used to combine address segments with similar geographical location or network characteristics. This intelligent division method not only improves the exploration efficiency, but also avoids repeated exploration of the same network region. For example, when processing a / 16 address block, the system will divide it into multiple / 24 subnets with similar characteristics according to historical exploration data and activity information.

[0078] The embodiment innovatively realizes the distributed node pool management mechanism. In the node pool construction process, the system adopts a multi-level node grouping strategy. Each node is assigned different roles and weights according to its computing power, network bandwidth, and geographical location. By monitoring the performance indicators of the nodes in real time, the system can dynamically adjust the task quota of the nodes. When assigning tasks, the system will consider the characteristics of the network segment and the adaptability of the node, such as assigning high-delay network segments to nodes with better retry mechanisms and assigning high-density network segments to nodes with stronger processing capabilities.

[0079] The embodiment realizes task synchronization through an efficient inter-process communication mechanism. Based on a hybrid architecture of shared memory and message queue, the system realizes low-latency state synchronization and task scheduling. Each node maintains a local task queue and reports task execution status through regular heartbeat messages. When a node is found to have a high load or abnormal response, the system will trigger a task rebalancing mechanism to migrate some tasks to other idle nodes. This fine-grained task management ensures the overall efficiency of the exploration cluster.

[0080] The embodiment establishes a complete coroutine scheduling framework. During the creation of coroutine tasks, the system adopts a multi-level task queue structure, realizing priority-based task scheduling. Each coroutine is responsible for handling detection tasks for a specific network segment, and high-concurrency queries are achieved through asynchronous I / O mechanisms. The system dynamically adjusts concurrency according to the execution state of coroutines, maximizing resource utilization while ensuring detection quality. For different types of query tasks, the system sets different timeout thresholds and retry strategies.

[0081] The embodiment combines network detection and task scheduling techniques, improving detection efficiency while ensuring system stability. Through intelligent address space partitioning and balanced task allocation, the system achieves efficient large-scale detection. This design philosophy, which focuses on efficiency and stability, provides reliable technical support for domain name system detection.

[0082] The embodiment provides an innovative solution for network address detection. Through dynamic frequency control and source address spoofing, the system can effectively evade the protective measures of target networks. This intelligent detection method significantly improves the success rate and stealth of address space scanning. For example, the system dynamically adjusts query frequency based on the response characteristics of target networks and randomizes source addresses through a distributed node pool.

[0083] The embodiment improves detection efficiency through continuous detection strategy optimization. By analyzing detection results in real time, the system can continuously adjust task allocation strategies and detection parameters. This adaptive optimization mechanism ensures the continuous and efficient operation of the detection process.

[0084] The detection method used in the embodiment has good scalability. By adjusting the size of the node pool and scheduling strategies, the system can adapt to different scales of address space detection requirements. This flexible detection framework provides a general technical solution for domain name system security detection. This adaptive detection method not only improves the efficiency of discovery but also enhances the practical value of the solution.

[0085] In an embodiment of the domain name system security detection method based on multi-dimensional active security detection in the present application, the following content can also be specifically included:

[0086] Step S301: Hierarchical statistics are performed on the response delay of the standard domain name query request, network addresses with response delays lower than a first delay threshold are marked as suspected domain name servers, network addresses with response delays between the first delay threshold and a second delay threshold are marked as suspected network servers, a reverse address resolution request is sent to the suspected domain name servers to obtain an authoritative domain name, a mapping relationship between the suspected domain name servers and the authoritative domain name is established, a connection is established with the suspected domain name servers based on a transport layer security protocol, a security certificate of the suspected domain name servers is obtained, and a bound domain name is extracted from a subject alternative name field of the security certificate;

[0087] Step S302: The network addresses of the suspected domain name servers are compared with a content distribution network node database, matched network addresses are removed, the remaining network addresses are taken as domain name server addresses, a correspondence table of the domain name server addresses and the authoritative domain name and the bound domain name is constructed, and an initial domain name server address list is generated.

[0088] Optionally, the embodiment innovatively designs a server classification scheme based on multi-dimensional features to solve the problems of low domain name server identification accuracy and difficult server identity confirmation. In terms of delay analysis, the embodiment designs a response delay score formula: Delay_Score=α×(Base_Delay / Actual_Delay)+β×(Success_Rate)+γ×(Stability_Factor), where α, β, and γ are weight coefficients, representing the influence of the base delay ratio, success rate, and stability factor, respectively. A server trust score formula: Trust_Score=(Auth_Weight×PTR_Match+Cert_Weight×SSL_Valid) / (Auth_Weight+Cert_Weight) is introduced to comprehensively evaluate the reliability of the server identity.

[0089] The embodiment deeply optimizes the delay analysis strategy. In the response delay statistics process, the system uses an adaptive sampling window to dynamically adjust the sampling frequency and window size according to the network status. For each response sample, the system not only records the absolute delay value, but also calculates the deviation relative to the local reference time. The first delay threshold is set to 1.5 times the average response time of the standard DNS query, which is used to quickly identify local cache servers; the second delay threshold is set to the median of the standard response time of the Web service, which is used to distinguish other network services. This multi-level delay analysis method significantly improves the accuracy of server type judgment.

[0090] The embodiment innovatively realizes the reverse resolution verification mechanism. When sending the reverse resolution request, the system adopts an intelligent retry strategy. For the address of the first request failure, the system will try to query using different resolution servers to exclude the influence of single resolution server failure. After obtaining the authoritative domain name, the system will perform forward and reverse resolution consistency verification to ensure the reliability of the resolution result. This two-way verification method effectively improves the accuracy of server identity recognition.

[0091] The embodiment realizes reliable acquisition of certificate information through TLS connection establishment. During the certificate acquisition process, the system simulates different TLS versions and encryption suites to adapt to the configuration requirements of different servers. For the acquired certificate, the system performs integrity and validity verification, including certificate chain verification, validity period check and revocation status query. When extracting domain names from the subject alternative name field, the system will normalize the domain names to ensure the consistency of the extraction results. This strict certificate processing mechanism ensures the reliability of the bound domain name information.

[0092] The embodiment establishes a complete CDN node filtering framework. The system maintains a real-time updated CDN node feature library containing IP address ranges, ASN information and feature fingerprints of mainstream CDN service providers. During the filtering process, the system not only performs address matching, but also analyzes the response characteristics and certificate characteristics of the server. For new or unknown CDN nodes, the system will identify them through behavior analysis, such as analyzing the response header characteristics and load balancing characteristics of the server. This multi-dimensional filtering strategy effectively improves the accuracy of server classification.

[0093] The embodiment combines network measurement and identity verification technology to improve identification accuracy while optimizing verification efficiency. Preliminary classification is achieved through delay analysis, and identity reliability is ensured through multiple verification. This design concept of balancing efficiency and accuracy provides reliable technical support for domain name system asset identification.

[0094] The embodiment provides an innovative solution for domain name server identification. Through multi-dimensional feature analysis and verification, the system can accurately identify real domain name servers. This intelligent identification method significantly improves the accuracy and reliability of asset discovery.

[0095] The embodiment realizes complete identity mapping through relationship table construction. For each confirmed domain name server, the system will establish a complete mapping relationship containing network address, authoritative domain name and bound domain name. This structured information organization method provides a reliable data foundation for subsequent security analysis.

[0096] The recognition method used in this embodiment has good scalability. By adjusting the judgment standard and verification strategy, the system can adapt to different types of server recognition requirements. This flexible recognition framework provides a general technical solution for domain name system asset discovery. This adaptive recognition method not only improves the accuracy of discovery, but also enhances the practical value of the solution.

[0097] In an embodiment of the domain name system security detection method based on multi-dimensional active security detection of the present application, the following content can also be specifically included:

[0098] Step S401: Collect domain name information from search engines, domain name registration authorities, and network space mapping platforms, subscribe to certificate transparency log services to obtain real-time certificate records, extract new domain names from the certificate records, send batch query requests to domain name registration databases to obtain domain name registration information, create a headless browser environment to load web pages, parse dynamic scripts in the web pages to extract hidden domain names, merge and deduplicate the new domain names, domain name registration information, and hidden domain names to build a seed domain name set.

[0099] Step S402: Split the domain names in the seed domain name set by characters, count the co-occurrence frequency of adjacent characters, calculate the transition probability between characters, construct a character transition probability matrix, train a Markov chain model based on the character transition probability matrix, and use the Markov chain model as a character transition probability model for subsequent domain name expansion.

[0100] Optionally, to address the problems of incomplete domain name information collection and inaccurate character pattern analysis, the embodiment innovatively designs a domain name feature extraction scheme based on multi-source information fusion and probability models. In terms of character transition probability calculation, the embodiment designs a conditional probability smoothing formula: P(ci|ci-1) = (Count(ci-1,ci) + α) / (Count(ci-1) + α×V), where ci represents the current character, ci-1 represents the previous character, Count represents the number of occurrences, α is a smoothing factor, and V is the size of the character set. A character correlation score formula is also introduced: Correlation_Score = (Co_occurrence × Position_Weight) / (Expected_frequency × Distance_Factor), which is used to evaluate the correlation strength between characters.

[0101] This embodiment deeply optimizes the multi-source information collection strategy. During search engine data acquisition, the system employs a distributed crawler architecture, avoiding anti-crawling restrictions through dynamic proxy pools and request latency control. For each search result page, the system not only extracts explicit domain information but also analyzes hyperlinks and referencing relationships within the page. In domain registry data collection, the system implements an adaptive query strategy, dynamically adjusting the query frequency and batch size based on the API limitations of different registryes. This multi-dimensional information acquisition approach ensures the integrity and diversity of the original data.

[0102] This embodiment innovatively implements a certificate transparency log processing mechanism. The system employs an incremental log subscription strategy, achieving real-time monitoring by maintaining the latest tree hash and consistency proof. During certificate record resolution, the system not only focuses on the primary domain name but also extracts all alternative domain names and wildcard domain names. For each certificate record, the system verifies its legitimacy and extracts the complete domain name chain. This refined certificate processing significantly improves the efficiency of discovering new domain names.

[0103] This embodiment implements dynamic content extraction using a headless browser environment. During webpage loading, the system not only simulates basic DOM events but also implements complex user interaction simulations. By injecting custom JavaScript listeners, the system can capture dynamically loaded resources and AJAX requests. For SPA (Single Page Application) websites, the system uses route listening and state manager analysis to ensure that no dynamically generated domains are missed. This deep content extraction strategy significantly improves the discovery rate of hidden domains.

[0104] This embodiment establishes a complete character analysis framework. During domain name segmentation, the system employs a multi-granularity segmentation strategy, including character-level, phoneme-level, and morpheme-level segmentation. By analyzing character combination features at different granularities, the system can more accurately capture the construction patterns of domain names. When calculating character transition probabilities, the system considers not only first-order transition relationships but also analyzes longer-distance dependencies; this multi-level probability analysis improves the model's prediction accuracy.

[0105] This embodiment combines information retrieval and probabilistic modeling techniques, improving information collection efficiency while optimizing feature extraction quality. It obtains comprehensive domain name information through multi-source data fusion and captures the structural features of domain names through probabilistic models. This approach, combining data collection and pattern analysis, provides reliable technical support for domain name expansion.

[0106] This embodiment provides an innovative solution for domain name feature extraction. Through automated information collection and probabilistic modeling, the system can accurately characterize the character distribution features of a domain name. This intelligent feature extraction method significantly improves the effectiveness of subsequent domain name expansion.

[0107] The embodiment realizes the theoretical basis of domain name generation through a Markov chain model. Through learning a large number of real domain names, the model can accurately grasp the regularity of character combination. This generation mechanism based on statistical learning provides reliable probability guidance for subsequent domain name expansion.

[0108] In an embodiment of the domain name system security detection method based on multi-dimensional active security detection provided in the application, the following content can be specifically included:

[0109] Step S501: based on the character transition probability model, performing character replacement and deformation on brand words in the seed domain name set to generate brand word deformation domain names, performing increment and decrement transformation on numbers contained in the seed domain name set to generate number variant domain names, combining the brand word deformation domain names and the number variant domain names to construct a first-level expansion domain name set, randomly selecting domain name pairs from the first-level expansion domain name set for combination sampling, and constructing new domain names generated by the sampling into a second-level expansion domain name set;

[0110] Step S502: sending a domain name resolution request to domain names in the first-level expansion domain name set and the second-level expansion domain name set, recording domain name resolution results, marking domain names with successful resolution as valid domain names to construct a third-level expansion domain name set, updating the third-level expansion domain name set to the seed domain name set, and repeatedly performing a domain name expansion operation based on the updated seed domain name set.

[0111] Optionally, the embodiment innovatively designs a multi-level domain name expansion scheme based on a probability model to solve the problems of low efficiency of domain name variant generation and poor effectiveness of expanded domain names. In the variant generation process, the embodiment designs a brand word similarity calculation formula: Brand_Similarity=α×(Character_Match / Total_Length)+β×(Phonetic_Score)+γ×(Visual_Score), where α, β, and γ are weight coefficients, respectively representing the influence factors of character matching degree, phonetic similarity, and visual similarity. A domain name combination scoring formula: Combination_Score=(Pattern_Similarity×Feature_Weight) / (Edit_Distance+1) is introduced to evaluate the rationality of domain name combination.

[0112] This embodiment deeply optimizes the brand word deformation strategy. In the character replacement process, the system calculates the optimal replacement character for each position based on the Markov chain model. For different types of brand words, the system adopts differentiated deformation strategies: for pure English brand words, consider the replacement of homophonic letters, similar letters, and adjacent characters in keyboard layout; for brand words containing numbers, consider the shape similarity and semantic association of numbers; for mixed brand words, consider multiple dimensions of deformation possibilities. This intelligent deformation strategy significantly improves the confusion and practicality of generated domain names.

[0113] This embodiment innovatively implements the digital variant generation mechanism. The system not only considers simple incremental and decremental transformation, but also analyzes the semantic role of numbers in domain names. For example, when the number represents the year, the system will generate variants of adjacent years; when the number represents the version number, the progressive rule of the version number will be considered; when the number has a special meaning, the variant will be generated based on the homophonic or shape characteristics of the number. This semantic-aware number processing method significantly improves the relevance of the variant domain name.

[0114] This embodiment realizes the intelligent generation of two-level extended domain names through combination sampling. In the domain name pair selection process, the system adopts a heuristic sampling strategy, preferentially selecting domain names with similar structures or related semantics for combination. By analyzing the grammatical structure and composition characteristics of domain names, the system can generate new domain names that conform to naming rules. For each generated combination, the system will evaluate its reasonableness and usability, filtering out obviously unreasonable combinations. This combination strategy based on rules and probabilities ensures the quality of generated domain names.

[0115] This embodiment establishes a complete domain name verification framework. When sending resolution requests, the system uses distributed verification nodes to perform cross-verification through multiple authoritative DNS servers. For each domain name resolution result, the system not only verifies its resolvability, but also analyzes the type and content of the resolution record. For example, for A records, the system will verify the validity of the IP address; for CNAME records, it will track the complete resolution chain. This multi-dimensional verification method ensures the actual usability of the extended domain name.

[0116] This embodiment combines probability models and verification techniques to improve generation efficiency while ensuring domain name quality. Through the probability model to guide deformation generation, and through actual verification to ensure domain name effectiveness. This design concept of balancing efficiency and quality provides reliable technical support for domain name extension.

[0117] This embodiment provides an innovative solution for domain name variant discovery. Through multi-level extension and verification, the system can continuously discover potential related domain names. This iterative extension method significantly improves the coverage and accuracy of domain name asset discovery.

[0118] The embodiment realizes continuous domain name discovery through a cyclic update mechanism. The verified domain names are reintegrated into the seed set, forming a benign expansion cycle. This dynamic update discovery mechanism ensures the continuity and effectiveness of the domain name expansion process.

[0119] The expansion method adopted by the embodiment has good scalability. By adjusting the generation strategy and verification criteria, the system can adapt to different types of domain name expansion requirements. This flexible expansion framework provides a general technical solution for domain name asset discovery. This adaptive expansion method not only improves the efficiency of discovery, but also enhances the practical value of the solution.

[0120] In an embodiment of the domain name system security detection method based on multi-dimensional active security detection of the present application, the following content can also be specifically included:

[0121] Step S601: Read the domain name server address from the initial domain name server address list, send a recursive domain name resolution request to the domain name server address, set the recursive query flag of the recursive domain name resolution request, construct a resolution path with the domain name server address as the starting node, record the domain name service record returned by the domain name server, and extract the subordinate authoritative domain name server address from the domain name service record;

[0122] Step S602: Continuously send a recursive domain name resolution request based on the subordinate authoritative domain name server address, append each level of domain name server address to the resolution path until the final domain name resolution result is obtained, and save each level of domain name server address recorded in the resolution path and the corresponding domain name service record as recursive resolution link data.

[0123] Optionally, the embodiment innovatively designs a set of resolution link discovery scheme based on recursive query to solve the problems of incomplete domain name resolution path tracking and low efficiency of recursive link analysis. In the aspect of resolution path evaluation, the embodiment designs a path integrity scoring formula: Path_Score=α×(Authority_Level / Max_Level)+β×(Record_Complete)+γ×(Response_Valid), where α, β, and γ are weight coefficients, respectively representing the influence factors of authority level, record integrity, and response validity. At the same time, a server trustworthiness calculation formula: Trust_Score=(Authority_Weight×Zone_Match+Response_Weight×Record_Valid) / (Authority_Weight+Response_Weight) is introduced to evaluate the reliability of the resolution server.

[0124] The embodiment deeply optimizes the recursive query strategy. When sending a recursive domain name resolution request, the system adopts an intelligent request control mechanism. For each domain name server, it first verifies whether it supports the recursive query function, determines the optimal query strategy by analyzing the server's capability flag and response characteristics, and adjusts the request parameters according to the characteristics of different servers when setting the recursive query flag. For example, for servers that support DNSSEC, security-related records are requested simultaneously; for servers that support EDNS, extension options are added to obtain more resolution information. This differentiated query strategy significantly improves the completeness of the resolution data.

[0125] The embodiment innovatively implements a resolution path construction mechanism. Starting from the initial domain name server, the system records the complete resolution process through dynamic path tracking technology. When receiving a server response, the system analyzes the authorization information and additional information in the response, extracts the address of the next level authoritative server, and for each resolution node, records not only its IP address but also the complete service record information, including TTL value, record type and record content. This detailed path recording method ensures the completeness and traceability of the resolution link.

[0126] The embodiment realizes reliable acquisition of service information through precise record extraction. When processing domain name service records, the system adopts a multi-level resolution strategy. For standard resource records, the system will analyze their type and content; for extended records, it will further analyze their special fields and option values. In particular, for CNAME chains and alias resolution, the system will track the complete resolution chain to ensure that no intermediate nodes are missed. This deep record analysis method provides rich resolution path information.

[0127] The embodiment establishes a complete link data preservation framework. The system uses a structured data organization method to store the information of each node in the resolution path and the corresponding service records in order. For each resolution link, not only the basic address and record information are saved, but also metadata such as timestamp and response status. This systematic data management method provides a reliable data foundation for subsequent path analysis.

[0128] The embodiment combines network detection and data analysis techniques to improve tracking efficiency while ensuring data quality. By recursive query, complete resolution information is obtained, and by link analysis, the structural characteristics of the domain name system are revealed. This combination of practical observation and theoretical analysis provides reliable technical support for domain name system research.

[0129] The embodiment provides an innovative solution for domain name resolution link analysis. Through automated path tracking and record analysis, the system can accurately restore the complete process of domain name resolution. This intelligent analysis method significantly improves the depth and accuracy of domain name system research.

[0130] The embodiment realizes complete link discovery through continuous request sending. The system continuously tracks new authoritative servers until the final resolution result is obtained. This iterative discovery mechanism ensures the completeness and accuracy of the resolution link.

[0131] The analysis method adopted by the embodiment has good scalability. By adjusting the tracking strategy and data processing method, the system can adapt to different types of domain name resolution analysis requirements. This flexible analysis framework provides a general technical solution for domain name system research. This adaptive analysis method not only improves the efficiency of discovery, but also enhances the practical value of the solution.

[0132] In an embodiment of the domain name system security detection method based on multi-dimensional active security detection provided in the present application, the following contents can also be specifically included:

[0133] Step S701: The domain name server address and the domain name and subdomain name in the domain name service record are constructed as a node set, an edge set is constructed based on the recursive resolution link data, the node set and the edge set are combined to generate a scope relationship graph, the nodes in the scope relationship graph are assigned a weight attribute, the in-degree, out-degree and centrality of the nodes are calculated, and the degree metric of the nodes is used as the node weight;

[0134] Step S702: A community discovery algorithm is executed on the scope relationship graph to divide node clusters, the management range of the domain name server is analyzed based on the connectivity of the node clusters, the size and distribution characteristics of each node cluster are counted, the hierarchical relationship between the node clusters is extracted, and the domain name system distribution information of the target area is generated.

[0135] Optionally, the embodiment is directed to the problem of domain name system structure complexity, management range definition difficulty, etc., and innovatively designs a set of domain name system structure discovery scheme based on graph analysis. In the aspect of node importance evaluation, the embodiment designs a comprehensive weight calculation formula: Node_Weight = a x (In_Degree / Max_In) + b x (Out_Degree / Max_Out) + g x (Betweenness / Max_Between), wherein a, b, g are weight coefficients, respectively representing the influence factors of in-degree, out-degree and betweenness. At the same time, the cohesion score formula: Cohesion_Score = (Internal_Links x Node_Weight) / (Total_Links x Average_Weight) is introduced to evaluate the tightness of the node cluster.

[0136] The embodiment deeply optimizes the node construction strategy. In the node set construction process, the system adopts a multi-level node representation method. For domain name server addresses, the system not only records its IP address, but also associates its service type and capability flag; for domain names and subdomain names, the complete hierarchical information and attribute characteristics are saved. Through analyzing the naming mode of domain name and the type of service record, the system can accurately identify the functional role of different nodes. For example, for authoritative domain name servers, the system will pay special attention to the domain name space range it is responsible for; for cache servers, it will analyze its cache strategy and forwarding rules. This detailed node description method provides rich feature information for subsequent structure analysis.

[0137] The embodiment innovatively realizes the edge set construction mechanism. Based on recursive analysis of link data, the system describes the association strength between nodes through intelligent edge weight allocation strategy. For direct resolution relationship, the system will allocate higher weight according to query frequency and response stability; for indirect forwarding relationship, the weight value will be adjusted according to the number of intermediate nodes and forwarding delay. Especially for server groups with backup relationship, the system will mark their redundancy characteristics through special edge attributes. This multi-dimensional edge construction method ensures that the relationship graph can accurately reflect the actual structure of the system.

[0138] The embodiment realizes weight allocation through accurate node measurement. In calculating the measurement indicators of nodes, the system adopts an improved centrality calculation algorithm. The in-degree calculation considers the diversity of upstream queries, the out-degree calculation focuses on the coverage range of downstream services, and the centrality reflects the importance of the node in the whole system. Through the comprehensive measurement of these indicators, the system can accurately evaluate the actual importance of each node. This comprehensive weight evaluation mechanism provides a reliable basis for community discovery.

[0139] This embodiment establishes a complete community discovery framework. When executing the community discovery algorithm, the system adopts a multi-stage clustering strategy. First, preliminary grouping is performed based on the functional similarity of nodes, then the group boundary is optimized according to the connection density, and finally the clustering result is refined through node migration. For each discovered community, the system analyzes its internal structural characteristics and external connection patterns, and evaluates the stability and independence of the community. This progressive community discovery approach ensures the accuracy and reasonableness of the division result.

[0140] This embodiment combines graph analysis and statistical learning techniques to improve analysis efficiency while ensuring the interpretability of the results. By expressing the topological relationship of the domain name system through graph structure, the management structure of the system is revealed through community analysis. This combination of quantitative analysis and qualitative research provides reliable technical support for domain name system management.

[0141] This embodiment provides an innovative solution for domain name system structure analysis. Through automated community discovery and feature extraction, the system can accurately identify the management scope and hierarchical relationship of domain name servers. This intelligent analysis approach significantly improves the depth and accuracy of domain name system research.

[0142] This embodiment realizes complete analysis output through the generation of distribution information. The system not only provides detailed node cluster statistical information, but also analyzes the interaction patterns and hierarchical relationships between clusters. This comprehensive analysis result provides important decision-making basis for the optimized management of the domain name system.

[0143] The analysis method adopted in this embodiment has good scalability. By adjusting the clustering parameters and evaluation criteria, the system can adapt to different scales and types of domain name system analysis requirements. This flexible analysis framework provides a general technical solution for domain name system research. This adaptive analysis approach not only improves the efficiency of discovery, but also enhances the practical value of the solution.

[0144] In order to effectively solve the deficiencies of traditional technology in server detection, domain name expansion and system analysis, and significantly improve the effect of domain name system security detection, the present application provides an embodiment of a domain name system security detection device based on multi-dimensional active security detection for implementing all or part of the content of the domain name system security detection method based on multi-dimensional active security detection, see Figure 2 , the domain name system security detection device based on multi-dimensional active security detection specifically contains the following contents:

[0145] The domain name processing module 10 is configured to construct a distributed detection cluster based on a network address space of a target region, divide the network address space of the target region into a plurality of subnet segments, create an asynchronous coroutine pool scheduling model, send a standard domain name query request to a domain name service port of each network address in the subnet segment, distinguish a domain name server from a network server through a hierarchical time delay threshold, perform a reverse address resolution query on the domain name server to obtain an authoritative domain name, capture a security certificate of the domain name server to obtain a bound domain name set, filter a content distribution network address based on a node database, and construct an initial domain name server address list.

[0146] The expansion processing module 20 is configured to collect multi-source network information to obtain a seed domain name set, capture a certificate transparency log to extract a new domain name, query a domain name registration database to obtain registration information, parse a dynamic web page script to extract a hidden domain name, train a character transition probability model based on the seed domain name set, generate a brand word deformation domain name and a digital variant domain name as a first-level expansion domain name by using the character transition probability model, combine and sample the first-level expansion domain name to generate a second-level expansion domain name, verify the accessibility of the first-level expansion domain name and the second-level expansion domain name to generate a third-level expansion domain name, and take the third-level expansion domain name as a new seed domain name to perform domain name expansion cyclically.

[0147] The security detection module 30 is configured to perform recursive domain name resolution on a domain name server in the initial domain name server address list, track a path of the recursive domain name resolution to obtain a domain name service record, take the domain name server address and the domain name and subdomain name in the domain name service record as nodes, take the path of the recursive domain name resolution as an edge to construct a scope relationship graph, analyze a management range of the domain name server based on the scope relationship graph, and output domain name system distribution information of the target region.

[0148] As can be seen from the above description, the domain name system security detection device based on multi-dimensional active security detection provided by the embodiments of the present application can realize efficient identification of a domain name server by innovatively constructing a distributed detection mechanism, performing asynchronous coroutine scheduling and hierarchical time delay analysis. A domain name expansion mechanism based on a probability model is designed, multi-source information acquisition and a three-level expansion strategy are combined, and a comprehensive domain name discovery method is established. A scope relationship graph analysis mechanism is introduced, recursive resolution path tracking and graph structure modeling are performed, and accurate description of a domain name system topology is realized. The method effectively solves the deficiencies of traditional technologies in server detection, domain name expansion and system analysis, and significantly improves the effect of domain name system security detection.

[0149] From the hardware level, in order to effectively solve the deficiencies of the traditional technology in server detection, domain name expansion and system analysis, and significantly improve the effect of domain name system security detection, the present application provides an embodiment of an electronic device for implementing all or part of the contents of the domain name system security detection method based on multi-dimensional active security detection, which specifically includes the following contents:

[0150] A processor, a memory, a communications interface and a bus; wherein the processor, the memory and the communications interface complete mutual communication through the bus; the communications interface is used for realizing information transmission between the domain name system security detection device based on multi-dimensional active security detection and related devices such as a core business system, a user terminal and a related database; the logic controller can be a desktop computer, a tablet computer and a mobile terminal, and the embodiment is not limited thereto. In the embodiment, the logic controller can be implemented with reference to the embodiment of the domain name system security detection method based on multi-dimensional active security detection and the embodiment of the domain name system security detection device based on multi-dimensional active security detection in the embodiment, the contents of which are incorporated herein, and repeated descriptions are omitted.

[0151] It can be understood that the user terminal can include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device and the like. The smart wearable device can include smart glasses, a smart watch, a smart bracelet and the like.

[0152] In actual application, part of the domain name system security detection method based on multi-dimensional active security detection can be executed on the electronic device as described above, or all operations can be completed in the client device. Specifically, the selection can be made according to the processing capacity of the client device and the limitation of the user use scenario, and the present application is not limited thereto. If all operations are completed in the client device, the client device can further include a processor.

[0153] The client device described above can have a communications module (i.e. a communications unit) and can be communicatively connected with a remote server to realize data transmission with the server. The server can include a server of a task scheduling center side, and can further include a server of an intermediate platform in other implementation scenarios, such as a server of a third-party server platform communicatively connected with the server of the task scheduling center. The server can include a single computer device, a server cluster composed of multiple servers, or a server structure of a distributed device.

[0154] Figure 3This is a schematic block diagram illustrating the system configuration of the electronic device 9600 according to an embodiment of this application. Figure 3 As shown, the electronic device 9600 may include a central processing unit 9100 and a memory 9140; the memory 9140 is coupled to the central processing unit 9100. It is worth noting that... Figure 3 This is an example; other types of structures can also be used to supplement or replace this structure to achieve telecommunications functions or other functions.

[0155] In one embodiment, the domain name system security detection method based on multi-dimensional proactive security detection can be integrated into the central processing unit 9100. The central processing unit 9100 can be configured to perform the following controls:

[0156] Step S101: Construct a distributed probe cluster based on the network address space of the target area, divide the network address space of the target area into multiple subnets, create an asynchronous coroutine pool scheduling model, send standard domain name query requests to the domain name service ports of each network address in the subnets, distinguish between domain name servers and network servers through hierarchical latency thresholds, perform reverse address resolution queries on the domain name servers to obtain authoritative domain names, capture the security certificates of the domain name servers to obtain the set of bound domain names, filter content and distribute network addresses based on the node database, and construct an initial list of domain name server addresses;

[0157] Step S102: Collect multi-source network information to obtain a set of seed domain names, obtain certificate transparency logs in real time to extract newly added domain names, query the domain name registration database to obtain registration information, parse dynamic web page scripts to extract hidden domain names, train a character transfer probability model based on the set of seed domain names, use the character transfer probability model to generate brand word variant domain names and numeric variant domain names as first-level extended domain names, combine and sample the first-level extended domain names to generate second-level extended domain names, verify the accessibility of the first-level extended domain names and the second-level extended domain names to generate third-level extended domain names, and use the third-level extended domain names as new seed domain names to perform domain name extension in a loop;

[0158] Step S103: Perform recursive domain name resolution on the domain name servers in the initial domain name server address list, trace the path of the recursive domain name resolution to obtain domain name service records, use the domain name server address, the domain name and subdomain in the domain name service record as nodes, and use the path of the recursive domain name resolution as edges to construct a scope relationship graph, analyze the management scope of the domain name server based on the scope relationship graph, and output the domain name system distribution information of the target area.

[0159] From the above description, the electronic device provided by the embodiment of the application can realize efficient identification of the domain name server by innovatively constructing a distributed detection mechanism, through asynchronous coroutine scheduling and hierarchical time delay analysis. A domain name expansion mechanism based on a probability model is designed, multi-source information acquisition and a three-level expansion strategy are combined, and a comprehensive domain name discovery method is established. A scope relationship graph analysis mechanism is introduced, recursive path tracking and graph structure modeling are used to realize accurate description of the domain name system topology. The method effectively solves the deficiencies of the traditional technology in server detection, domain name expansion and system analysis, and significantly improves the effect of domain name system security detection.

[0160] In another embodiment, the domain name system security detection device based on multi-dimensional active security detection can be configured separately from the central processor 9100, for example, the domain name system security detection device based on multi-dimensional active security detection can be configured as a chip connected with the central processor 9100, and the function of the domain name system security detection method based on multi-dimensional active security detection is realized through the control of the central processor.

[0161] As shown in Figure 3 , the electronic device 9600 can also include a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It should be noted that the electronic device 9600 does not necessarily include all the components shown in Figure 3 ; in addition, the electronic device 9600 can also include components not shown in Figure 3 , which can be referred to prior art.

[0162] As shown in Figure 3 , the central processor 9100, also known as a controller or operation control, can include a microprocessor or other processor device and / or logic device, which receives input and controls the operation of various components of the electronic device 9600.

[0163] The memory 9140, for example, can be one or more of a buffer, a flash memory, a hard drive, a removable media, a volatile memory, a non-volatile memory, or other suitable device. Information related to failure can be stored, and programs for executing related information can also be stored. The central processor 9100 can execute the programs stored in the memory 9140 to realize information storage or processing, etc.

[0164] The input unit 9120 provides input to the central processor 9100. The input unit 9120 is, for example, a key or a touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used to display display objects such as images and text. The display can be, for example, an LCD display, but is not limited thereto.

[0165] The memory 9140 can be a solid state memory such as a read only memory (ROM), a random access memory (RAM), a SIM card, or the like. It can also be a memory that retains information even when power is off, can be selectively erased, and is provided with more data, an example of which is sometimes referred to as an EPROM or the like. The memory 9140 can also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 can include an application / function storage 9142 for storing application programs and function programs or for storing a flow for executing an operation of the electronic device 9600 by the central processing unit 9100.

[0166] The memory 9140 can also include a data storage 9143 for storing data such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. A driver storage 9144 of the memory 9140 can include various drivers of the electronic device for a communication function and / or for performing other functions of the electronic device such as a messaging application, an address book application, and the like.

[0167] The communication module 9110 is a transmitter / receiver that transmits and receives signals via an antenna 9111. The communication module 9110 (transmitter / receiver) is coupled to the central processing unit 9100 to provide input signals and receive output signals, which can be the same as in the case of a conventional mobile communication terminal.

[0168] Based on different communication technologies, a plurality of communication modules 9110 such as a cellular network module, a Bluetooth module, and / or a wireless local area network module, and the like can be provided in the same electronic device. The communication module 9110 (transmitter / receiver) is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide audio output via the speaker 9131 and receive audio input from the microphone 9132, thereby enabling a conventional telecommunication function. The audio processor 9130 can include any suitable buffer, decoder, amplifier, and the like. In addition, the audio processor 9130 is also coupled to the central processing unit 9100, thereby enabling recording on a local machine through the microphone 9132 and enabling playing of a sound stored on the local machine through the speaker 9131.

[0169] The embodiments of the present application also provide a computer readable storage medium capable of realizing all steps of the domain name system security detection method based on multi-dimensional active security detection with the execution subject being a server or a client in the above embodiments, and the computer program is stored on the computer readable storage medium, and when the computer program is executed by a processor, all steps of the domain name system security detection method based on multi-dimensional active security detection with the execution subject being a server or a client in the above embodiments are realized, for example, when the processor executes the computer program, the following steps are realized:

[0170] Step S101: constructing a distributed detection cluster based on a network address space of a target region, dividing the network address space of the target region into a plurality of subnet segments, creating an asynchronous coroutine pool scheduling model, sending a standard domain name query request to a domain name service port of each network address in the subnet segment, distinguishing a domain name server from a network server through a hierarchical time delay threshold, performing a reverse address resolution query on the domain name server to obtain an authoritative domain name, capturing a security certificate of the domain name server to obtain a bound domain name set, filtering a content distribution network address based on a node database, and constructing an initial domain name server address list;

[0171] Step S102: collecting a seed domain name set from multi-source network information, obtaining a new domain name from a certificate transparency log in real time, obtaining registration information from a domain name registration database, extracting a hidden domain name from a dynamic web page script, training a character transfer probability model based on the seed domain name set, generating a brand word deformation domain name and a digital variant domain name as a first-level expanded domain name by using the character transfer probability model, combining and sampling the first-level expanded domain name to generate a second-level expanded domain name, verifying the accessibility of the first-level expanded domain name and the second-level expanded domain name to generate a third-level expanded domain name, and taking the third-level expanded domain name as a new seed domain name to perform domain name expansion cyclically;

[0172] Step S103: performing recursive domain name resolution on the domain name servers in the initial domain name server address list, tracking a path of the recursive domain name resolution to obtain a domain name service record, taking the domain name servers and the domain names and subdomains in the domain name service record as nodes, taking the path of the recursive domain name resolution as an edge to construct a scope relationship graph, analyzing the management range of the domain name servers based on the scope relationship graph, and outputting domain name system distribution information of the target region.

[0173] From the above description, the computer readable storage medium provided by the embodiments of the application can realize efficient identification of domain name servers by innovatively constructing a distributed detection mechanism, through asynchronous coroutine scheduling and hierarchical time delay analysis. A domain name expansion mechanism based on a probability model is designed, combined with multi-source information acquisition and a three-level expansion strategy, to establish a comprehensive domain name discovery method. A scope relationship graph analysis mechanism is introduced, through recursive path tracking and graph structure modeling, to realize accurate description of the domain name system topology. This method effectively solves the deficiencies of traditional technologies in server detection, domain name expansion and system analysis, and significantly improves the effect of domain name system security detection.

[0174] The embodiments of the application also provide a computer program product capable of realizing all steps of the domain name system security detection method based on multi-dimensional active security detection in which the execution subject in the above embodiments is a server or a client. The computer program / instruction is executed by a processor to realize the steps of the domain name system security detection method based on multi-dimensional active security detection, for example, the computer program / instruction realizes the following steps:

[0175] Step S101: Constructing a distributed detection cluster based on the network address space of a target area, dividing the network address space of the target area into a plurality of subnet segments, creating an asynchronous coroutine pool scheduling model, sending a standard domain name query request to the domain name service port of each network address in the subnet segment, distinguishing domain name servers from network servers through hierarchical time delay thresholds, performing reverse address resolution queries on the domain name servers to obtain authoritative domain names, capturing security certificates of the domain name servers to obtain a bound domain name set, filtering content distribution network addresses based on a node database, and constructing an initial domain name server address list;

[0176] Step S102: Collecting a seed domain name set from multi-source network information acquisition, real-time extracting new domain names from certificate transparency logs, querying a domain name registration database to obtain registration information, parsing dynamic web scripts to extract hidden domain names, training a character transfer probability model based on the seed domain name set, generating brand word deformation domain names and digital variant domain names as first-level expansion domain names using the character transfer probability model, combining and sampling the first-level expansion domain names to generate second-level expansion domain names, verifying the accessibility of the first-level expansion domain names and the second-level expansion domain names to generate third-level expansion domain names, and taking the third-level expansion domain names as new seed domain names to cyclically perform domain name expansion;

[0177] Step S103: performing recursive domain name resolution on the domain name servers in the initial domain name server address list, tracking a path of the recursive domain name resolution to obtain a domain name service record, taking the domain name servers and domain names in the domain name service record as nodes, taking the path of the recursive domain name resolution as an edge to construct a scope relation graph, analyzing a management range of the domain name servers based on the scope relation graph, and outputting domain name system distribution information of a target region.

[0178] From the above description, the computer program product provided by the embodiments of the present application can realize efficient identification of domain name servers through the innovative construction of a distributed detection mechanism, asynchronous coroutine scheduling, and hierarchical time delay analysis. The domain name expansion mechanism based on a probability model is designed, multi-source information acquisition and a three-level expansion strategy are combined, and a comprehensive domain name discovery method is established. The scope relation graph analysis mechanism is introduced, the recursive resolution path tracking and the graph structure modeling are performed, and the accurate description of the domain name system topology is realized. The method effectively solves the deficiencies of the traditional technology in server detection, domain name expansion, and system analysis, and significantly improves the effect of domain name system security detection.

[0179] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, device, or computer program product. Therefore, the present application can adopt a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer usable storage media containing computer usable program code (including but not limited to disk storage, CD-ROM, optical storage, etc.).

[0180] The present application is described with reference to flowcharts and / or block diagrams of the method, device (apparatus), and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing apparatus to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing apparatus produce a device that implements the functions specified in the flowcharts and / or block diagrams. Figure 1 The device that implements the functions specified in one or more flows and / or blocks. Figure 1 The device that implements the functions specified in one or more flows and / or blocks.

[0181] These computer program instructions can also be stored in a computer readable storage medium that can guide the computer or other programmable data processing apparatus to work in a specific manner, so that the instructions stored in the computer readable storage medium produce a manufactured product including instruction devices that implement the functions specified in the flowcharts and / or block diagrams. Figure 1one or more processes and / or blocks Figure 1 the function specified in the one or more blocks.

[0182] These computer program instructions can also be loaded into computer or other programmable data processing devices, so that a series of operation steps are performed on the computer or other programmable data processing devices to generate a computer implemented process, so that the instructions executed on the computer or other programmable data processing devices provide a process for implementing the flow Figure 1 one or more processes and / or blocks Figure 1 the function specified in the one or more blocks.

[0183] The principles and implementation manners of the present application are described in the specific embodiments. The above embodiment description is only used to help understand the method and core idea of the present application; meanwhile, for those skilled in the art, according to the idea of the present application, the specific implementation manners and application ranges will be changed, and the above description should not be understood as a limitation on the present application.

Claims

1. A domain name system security detection method based on multi-dimensional proactive security detection, characterized in that, The method includes: A distributed probing cluster is constructed based on the network address space of the target area. The network address space of the target area is divided into multiple subnets. An asynchronous coroutine pool scheduling model is created. Standard domain name query requests are sent to the domain name service ports of each network address in the subnets. Domain name servers and network servers are distinguished by hierarchical latency thresholds. Reverse address resolution queries are performed on the domain name servers to obtain authoritative domain names. The security certificates of the domain name servers are captured to obtain the set of bound domain names. Network addresses are distributed based on content filtering in the node database to construct an initial list of domain name server addresses. Collect multi-source network information to obtain a set of seed domain names, obtain certificate transparency logs in real time to extract newly added domain names, query the domain name registration database to obtain registration information, parse dynamic web page scripts to extract hidden domain names, train a character transfer probability model based on the set of seed domain names, use the character transfer probability model to generate brand word variant domain names and numeric variant domain names as first-level extended domain names, combine and sample the first-level extended domain names to generate second-level extended domain names, verify the accessibility of the first-level extended domain names and the second-level extended domain names to generate third-level extended domain names, and use the third-level extended domain names as new seed domain names to perform domain name extension in a loop; Recursive domain name resolution is performed on the domain name servers in the initial domain name server address list. The path of the recursive domain name resolution is traced to obtain domain name service records. The domain name server address, the domain name and subdomain in the domain name service records are used as nodes, and the path of the recursive domain name resolution is used as edges to construct a scope relationship graph. Based on the scope relationship graph, the management scope of the domain name server is analyzed, and the domain name system distribution information of the target area is output.

2. The domain name system security detection method based on multi-dimensional active security detection according to claim 1, characterized in that, The distributed probing cluster is constructed based on the network address space of the target region. The network address space of the target region is divided into multiple subnets, and an asynchronous coroutine pool scheduling model is created. Standard domain name query requests are sent to the domain name service ports of each network address in the subnets, including: Based on the network address prefix length of the target area, the network address space of the target area is divided into multiple subnets with 24-bit prefixes, a distributed probe cluster node pool is constructed, the subnets are allocated to the nodes in the probe cluster node pool according to the network address continuity, the task synchronization of each node in the probe cluster node pool is realized based on the inter-process communication mechanism, and an asynchronous task scheduling model based on coroutines is created. A probe node is selected from the probe cluster node pool. Multiple coroutine tasks are created based on the asynchronous task scheduling model. The coroutine tasks are assigned to the probe node. The probe node sends standard domain name query requests to the domain name service ports of each network address in the assigned subnet through the coroutine tasks. The sending frequency of the standard domain name query requests is dynamically adjusted and the source address distribution is forged.

3. The domain name system security detection method based on multi-dimensional active security detection according to claim 1, characterized in that, The process involves differentiating domain name servers from network servers using hierarchical latency thresholds, performing reverse address resolution queries on the domain name servers to obtain authoritative domain names, capturing the security certificates of the domain name servers to obtain a set of bound domain names, filtering content distribution network addresses based on a node database, and constructing an initial list of domain name server addresses, including: The response latency of the standard domain name query request is statistically analyzed in layers. Network addresses with response latencies below a first latency threshold are marked as suspected domain name servers, and network addresses with response latencies between the first and second latency thresholds are marked as suspected network servers. A reverse address resolution request is sent to the suspected domain name server to obtain the authoritative domain name. A mapping relationship between the suspected domain name server and the authoritative domain name is established. A connection is established with the suspected domain name server based on the transport layer security protocol. The security certificate of the suspected domain name server is obtained, and the bound domain name is extracted from the subject alternative name field of the security certificate. The network addresses of the suspected domain name servers are compared with the content delivery network node database. The network addresses that match are removed, and the remaining network addresses are used as domain name server addresses. A correspondence table between the domain name server addresses and the authoritative domain name and the bound domain name is constructed to generate an initial list of domain name server addresses.

4. The domain name system security detection method based on multi-dimensional active security detection according to claim 1, characterized in that, The process of collecting multi-source network information to obtain a seed domain name set, extracting newly added domain names from real-time certificate transparency logs, querying the domain name registration database to obtain registration information, parsing dynamic web page scripts to extract hidden domain names, and training a character transition probability model based on the seed domain name set includes: Domain information is collected from search engines, domain name registration agencies, and cyberspace mapping platforms. Real-time certificate records are obtained by subscribing to certificate transparency log services. New domain names are extracted from the certificate records. Batch query requests are sent to the domain name registration database to obtain domain name registration information. A headless browser environment is created to load web pages. The dynamic scripts in the web pages are parsed to extract hidden domain names. The new domain names, the domain name registration information, and the hidden domain names are merged and deduplicated to construct a seed domain name set. The domain names in the seed domain name set are segmented according to characters, the co-occurrence frequency of adjacent characters is counted, the transition probability between characters is calculated, a character transition probability matrix is ​​constructed, a Markov chain model is trained based on the character transition probability matrix, and the Markov chain model is used as the character transition probability model for subsequent domain name expansion.

5. The domain name system security detection method based on multi-dimensional active security detection according to claim 1, characterized in that, The process of generating brand word variant domains and numeric variant domains using the character transition probability model as first-level extended domains, combining and sampling the first-level extended domains to generate second-level extended domains, verifying the accessibility of the first-level and second-level extended domains to generate third-level extended domains, and using the third-level extended domains as new seed domains to perform domain expansion cyclically includes: Based on the character transition probability model, the brand words in the seed domain name set are replaced and transformed to generate brand word variant domain names. The numbers contained in the seed domain name set are transformed by incrementing and decrementing to generate number variant domain names. The brand word variant domain names and the number variant domain names are merged to construct a first-level extended domain name set. Domain name pairs are randomly selected from the first-level extended domain name set for combined sampling. The new domain names generated by the sampling are constructed into a second-level extended domain name set. Send domain name resolution requests to the domains in the first-level extended domain name set and the second-level extended domain name set, record the domain name resolution results, mark the successfully resolved domain names as valid domain names to construct a third-level extended domain name set, update the third-level extended domain name set to the seed domain name set, and repeat the domain name extension operation based on the updated seed domain name set.

6. The domain name system security detection method based on multi-dimensional active security detection according to claim 1, characterized in that, The step of performing recursive domain name resolution on the domain name servers in the initial domain name server address list, and tracing the path of the recursive domain name resolution to obtain domain name service records, includes: Read the domain name server address from the initial domain name server address list, send a recursive domain name resolution request to the domain name server address, set the recursive query flag of the recursive domain name resolution request, construct the resolution path with the domain name server address as the starting node, record the domain name service record returned by the domain name server, and extract the lower-level authoritative domain name server address from the domain name service record. Based on the address of the lower-level authoritative name server, recursive domain name resolution requests are continuously sent, and the address of each level of name server is appended to the resolution path until the final domain name resolution result is obtained. The address of each level of name server and the corresponding domain name service record recorded in the resolution path are saved as recursive resolution link data.

7. The domain name system security detection method based on multi-dimensional active security detection according to claim 1, characterized in that, The process involves constructing a scope relationship graph by using the domain name server address, the domain name and subdomain in the domain name service record as nodes, and the recursive domain name resolution path as edges. Based on the scope relationship graph, the management scope of the domain name server is analyzed, and the domain name system distribution information of the target region is output, including: The domain name server address, the domain name and subdomain in the domain name service record are constructed into a node set, and an edge set is constructed based on the recursive resolution link data. The node set and the edge set are combined to generate a scope relation graph. Weight attributes are assigned to the nodes in the scope relation graph, the in-degree, out-degree and centrality of the nodes are calculated, and the node's metric is used as the node weight. The community discovery algorithm is applied to the scope relationship graph to divide the nodes into clusters. Based on the connectivity analysis of the node clusters, the management scope of the domain name server is determined. The size and distribution characteristics of each node cluster are statistically analyzed. The hierarchical relationship between the node clusters is extracted, and the domain name system distribution information of the target region is generated.

8. A domain name system security detection device based on multi-dimensional active security detection, characterized in that, The device includes: The domain name processing module is used to build a distributed probe cluster based on the network address space of the target area, divide the network address space of the target area into multiple subnets, create an asynchronous coroutine pool scheduling model, send standard domain name query requests to the domain name service ports of each network address in the subnets, distinguish between domain name servers and network servers through hierarchical latency thresholds, perform reverse address resolution queries on the domain name servers to obtain authoritative domain names, capture the security certificates of the domain name servers to obtain the set of bound domain names, filter content and distribute network addresses based on the node database, and build an initial list of domain name server addresses. The extended processing module is used to collect multi-source network information to obtain a set of seed domain names, obtain certificate transparency logs in real time to extract newly added domain names, query the domain name registration database to obtain registration information, parse dynamic web page scripts to extract hidden domain names, train a character transfer probability model based on the set of seed domain names, use the character transfer probability model to generate brand word variant domain names and numeric variant domain names as first-level extended domain names, combine and sample the first-level extended domain names to generate second-level extended domain names, verify the accessibility of the first-level extended domain names and the second-level extended domain names to generate third-level extended domain names, and use the third-level extended domain names as new seed domain names to perform domain name extension in a loop. The security detection module is used to perform recursive domain name resolution on the domain name servers in the initial domain name server address list, trace the path of the recursive domain name resolution to obtain domain name service records, construct a scope relationship graph by using the domain name server address, the domain name and subdomain in the domain name service record as nodes, and the path of the recursive domain name resolution as edges, analyze the management scope of the domain name server based on the scope relationship graph, and output the domain name system distribution information of the target area.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the domain name system security detection method based on multi-dimensional active security detection as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the domain name system security detection method based on multi-dimensional active security detection as described in any one of claims 1 to 7.

Images