Data detection method and related device

Abstract

The embodiment of the invention provides a data detection method and a related device, and the method comprises the steps: mapping collected domain name system data to a virtual table, and generating a temporary analysis view; detecting the domain name system data in the temporary analysis view based on a time constraint condition and a node aggregation query rule, and determining abnormal nodes in the domain name system data; and for each piece of domain name system data, determining a data detection result based on the type of the abnormal node and the proportion of each type of abnormal node in the total node. According to the method, the dynamic threshold algorithm based on the proportion is introduced, and the data detection result is determined based on the types of the abnormal nodes and the proportion of each type of abnormal nodes in the total node, so that false alarm and missing alarm caused by abnormity or short-term fluctuation of a single node can be effectively reduced, and the detection accuracy is improved.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to a data detection method and related apparatus. Background Technology

[0002] With the rapid increase in the scale and complexity of internet infrastructure, the Domain Name System (DNS) has become a core support for the digital economy and social operation.

[0003] Currently, methods based on relational databases or log search platforms can identify anomalous nodes in Domain Name System (DNS) data by storing DNS query logs and combining them with preset rules or simple statistics (such as query frequency thresholds). However, these methods rely on fixed thresholds for detecting anomalous nodes, resulting in low detection accuracy.

[0004] Therefore, there is an urgent need for a solution to address the aforementioned technical problems. Summary of the Invention

[0005] In view of the above problems, this application provides a data detection method and related apparatus, which aims to solve the above technical problems.

[0006] The embodiments of this application disclose the following technical solutions:

[0007] Firstly, embodiments of this application provide a data detection method, including:

[0008] The collected domain name system data is mapped to a virtual table to generate a temporary analysis view;

[0009] Based on time constraints and node aggregation query rules, the domain name system data in the temporary analysis view is detected to identify abnormal nodes in each domain name system data.

[0010] For each of the domain name system data, the data detection result is determined based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes.

[0011] In one possible implementation, mapping the collected Domain Name System (DNS) data to a virtual table to generate a temporary analysis view includes:

[0012] Convert the collected domain name system data into JSONL format data files;

[0013] The JSONL format data file is mapped to a virtual table to generate a temporary analysis view.

[0014] In one possible implementation, the query rules based on time constraints and node aggregation are used to detect abnormal nodes in each DNS system data in the temporary analysis view, including:

[0015] Based on time constraints, within a preset time range, according to the query rules for node aggregation, domain name detection and URL detection are performed on each domain name system data in the temporary analysis view to identify abnormal nodes in each domain name system data.

[0016] In one possible implementation, determining the data detection result based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes includes:

[0017] The degree of abnormality of the abnormal node is determined based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes.

[0018] Based on the degree of anomaly, the data detection result is determined.

[0019] In one possible implementation, after determining the data detection result for each of the Domain Name System (DNS) data based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes, the method further includes:

[0020] The anomaly detection information in the data detection results is written into a distributed memory-based key-value database to generate alarm information.

[0021] In one possible implementation, after writing the anomaly detection information from the data detection results into a distributed in-memory key-value database and generating alarm information, the method further includes:

[0022] For each abnormal node, if no new alarm information for the abnormal node is added within a preset period, the alarm information corresponding to the abnormal node is deleted.

[0023] In one possible implementation, after writing the anomaly detection information from the data detection results into a distributed in-memory key-value database and generating alarm information, the method further includes:

[0024] The alarm information is aggregated and statistically analyzed, and classified based on four dimensions: domain name correctness, domain name availability, URL correctness, and URL availability, to determine the type of alarm information;

[0025] Statistical results are generated based on the type of alarm information and the timestamp corresponding to the alarm information.

[0026] Second aspect: Embodiments of this application provide a data detection device, including:

[0027] A generation unit, a first determining unit, and a second determining unit;

[0028] The generation unit is used to map the collected domain name system data to a virtual table and generate a temporary analysis view;

[0029] The first determining unit is used to detect each domain name system data in the temporary analysis view based on time constraints and query rules for node aggregation, and to determine abnormal nodes in each domain name system data.

[0030] The second determining unit is used to determine the data detection result for each of the domain name system data, based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes.

[0031] In one possible implementation, the generation unit is specifically used to: convert the collected domain name system data into a JSONL format data file; map the JSONL format data file to a virtual table to generate a temporary analysis view.

[0032] In one possible implementation, the first determining unit is specifically used to: based on time constraints, within a preset time range, perform domain name detection and URL detection on each domain name system data in the temporary analysis view according to the query rules of node aggregation, and determine abnormal nodes in each domain name system data.

[0033] In one possible implementation, the second determining unit is specifically used for:

[0034] The degree of abnormality of the abnormal node is determined based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes.

[0035] Based on the degree of anomaly, the data detection result is determined.

[0036] In one possible implementation, the device further includes: an alarm unit;

[0037] The alarm unit is used to write the anomaly detection information in the data detection results into a distributed memory-based key-value database to generate alarm information.

[0038] In one possible implementation, the device further includes: a deletion unit;

[0039] The deletion unit is used to delete the alarm information corresponding to each abnormal node when no new alarm information for the abnormal node is added within a preset period.

[0040] In one possible implementation, the device further includes: a statistical unit;

[0041] The statistical unit is used to aggregate and statistically analyze alarm information. Based on four dimensions—domain name correctness, domain name availability, URL correctness, and URL availability—it classifies the alarm information and determines the type of alarm information. Based on the type of alarm information and the timestamp corresponding to the alarm information, it generates statistical results.

[0042] Third aspect: This application provides a computer device, which includes a processor and a memory;

[0043] The memory is used to store program code and transmit the program code to the processor;

[0044] The processor is used to execute the steps of a data detection method as described above, according to the instructions in the program code.

[0045] Fourth aspect: Embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of a data detection method as described above.

[0046] Fifth aspect: This application provides a computer program product, which, when run on a computer, executes the steps of a data detection method as described above.

[0047] Sixth aspect: This application provides a chip including a processor coupled to a memory for executing a computer program or instructions stored in the memory, so that the chip implements the steps of a data detection method as described above.

[0048] Compared with the prior art, this application has the following advantages:

[0049] This application provides a data detection method that generates a temporary analysis view by mapping collected Domain Name System (DNS) data to a virtual table. Based on time constraints and node aggregation query rules, the method detects each DNS data point in the temporary analysis view to identify anomalous nodes. For each DNS data point, the method determines the data detection result based on the type of the anomalous node and the proportion of each type of anomalous node in the total number of nodes. This application introduces a proportion-based dynamic threshold algorithm to determine the data detection result based on the type of anomalous node and the proportion of each type of anomalous node in the total number of nodes. This effectively reduces false positives and false negatives caused by individual node anomalies or short-term fluctuations, thus improving detection accuracy. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 A flowchart illustrating a data detection method provided in an embodiment of this application;

[0052] Figure 2 A logic diagram of a detection module provided in an embodiment of this application;

[0053] Figure 3 This is a schematic diagram of an alarm information cache provided in an embodiment of this application;

[0054] Figure 4 A system framework diagram provided for an embodiment of this application;

[0055] Figure 5 This is a schematic diagram of the structure of a data detection device provided in an embodiment of this application. Detailed Implementation

[0056] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. The terminology used in the following embodiments is for the purpose of describing specific embodiments only and is not intended to be a limitation of this application. As used in the specification and appended claims of this application, the singular expressions "a," "an," "the," "the," "the," and "this" are intended to also include expressions such as "one or more," unless the context clearly indicates otherwise. It should also be understood that in the embodiments of this application, "one or more" refers to one, two, or more; "and / or" describes the relationship between related objects, indicating that three relationships may exist; for example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship.

[0057] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0058] The "multiple" mentioned in the embodiments of this application refers to two or more. It should be noted that in the description of the embodiments of this application, terms such as "first" and "second" are used only for the purpose of distinguishing descriptions and should not be construed as indicating or implying relative importance, nor should they be construed as indicating or implying order.

[0059] Currently, methods based on relational databases or log search platforms can identify anomalous nodes in Domain Name System (DNS) data by storing DNS query logs and combining them with preset rules or simple statistics (such as query frequency thresholds). However, these methods rely on fixed thresholds for detecting anomalous nodes, resulting in low detection accuracy.

[0060] Based on this, embodiments of this application provide a data detection method. This method generates a temporary analysis view by mapping collected Domain Name System (DNS) data to a virtual table. Based on time constraints and node aggregation query rules, it detects each DNS data point in the temporary analysis view to identify abnormal nodes. For each DNS data point, the data detection result is determined based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes. This application introduces a proportion-based dynamic threshold algorithm to determine the data detection result based on the type of abnormal node and the proportion of each type of abnormal node in the total number of nodes. This effectively reduces false positives and false negatives caused by individual node anomalies or short-term fluctuations, thus improving detection accuracy.

[0061] like Figure 1 As shown, this figure is a flowchart of a data detection method provided in an embodiment of this application, including S101-S103.

[0062] S101. Map the collected Domain Name System data to a virtual table to generate a temporary analysis view.

[0063] In this embodiment, domain name system data of each node can be collected, the collected domain name system data can be converted into JSONL format data files, and on this basis, the JSONL format data files can be mapped to virtual tables to generate temporary analysis views.

[0064] For example, the columnar analysis engine's ability to automatically parse semi-structured log files can be used to convert the collected DNS data into JSONL format data files, map the JSONL format data files to virtual tables, and generate temporary analysis views to achieve efficient loading and querying of large-scale DNS data.

[0065] In this embodiment, by employing a columnar analysis engine, the query speed can be significantly improved when processing semi-structured logs. Especially in scenarios involving large-scale JSON data, it can effectively avoid the input / output (IO) bottlenecks generated by traditional relational databases during the data parsing and querying stages, ensuring the real-time performance of data detection.

[0066] S102. Based on time constraints and node aggregation query rules, the domain name system data in the temporary analysis view is detected to identify abnormal nodes in each domain name system data.

[0067] In this embodiment, time constraints and node aggregation query rules are introduced, which can identify the distribution and severity of abnormal nodes in a short time while ensuring the real-time performance of data processing.

[0068] Based on time constraints, domain name detection and URL detection can be performed on each domain name system data in the temporary analysis view within a preset time range according to the query rules of node aggregation, so as to identify abnormal nodes in each domain name system data.

[0069] Domain name detection may include, but is not limited to, domain name correctness detection and domain name availability detection; URL detection may include, but is not limited to, URL correctness detection and URL availability detection.

[0070] For example, such as Figure 2 As shown, this figure is a logic diagram of a detection module provided in an embodiment of this application. The detection module uses an alarm analyzer abstract class as its core, predefines general methods for data querying, result formatting, and data detection, and implements detection logic for different types of abnormal nodes through an inheritance mechanism.

[0071] like Figure 2 The design shown enables domain name correctness detection, URL correctness detection, domain name availability detection, and URL availability detection to be flexibly implemented within the same framework, while ensuring the scalability of the system structure, allowing the system to quickly adapt to new detection requirements.

[0072] For example, when there are new detection requirements, the corresponding subclass logic can be extended to support the new detection requirements, avoiding the drawback of traditional systems that require large-scale system reconstruction when new detection requirements are added.

[0073] It is understood that the preset time range is not specifically limited in the embodiments of this application, and can be set according to actual needs.

[0074] S103. For each of the domain name system data, based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes, determine the data detection result.

[0075] This application introduces a ratio-based dynamic threshold algorithm to determine the data detection results based on the type of abnormal node and the proportion of each type of abnormal node in the total number of nodes. This can effectively reduce false alarms and false negatives caused by abnormality of a single node or short-term fluctuations, and improve detection accuracy.

[0076] In one possible implementation, the degree of abnormality of the abnormal node is determined based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes; and the data detection result is determined based on the degree of abnormality.

[0077] For example, the types of abnormal nodes may include, but are not limited to, domain name error, domain name unavailable, URL error, and URL unavailable.

[0078] In one example, different types of abnormal nodes can correspond to different proportion thresholds. Based on the proportion of each type of abnormal node in the total number of nodes and the corresponding proportion threshold, the degree of abnormality of the abnormal node can be determined.

[0079] Taking domain name errors as an example, if the proportion of abnormal nodes with domain name errors in the total number of nodes is greater than the corresponding threshold for domain name errors, then the abnormality level of the abnormal node is determined to be high; if the proportion of abnormal nodes with domain name errors in the total number of nodes is less than or equal to the corresponding threshold for domain name errors, then the abnormality level of the abnormal node is determined to be low.

[0080] In one example, different types of anomalous nodes can correspond to different proportion thresholds, and the same type of anomalous node can correspond to multiple proportion thresholds. Based on the proportion of each type of anomalous node in the total number of nodes and the corresponding multiple proportion thresholds, the anomalousness of the anomalous node can be determined.

[0081] Taking domain name errors as an example, the threshold for the proportion of domain name errors includes a first sub-threshold and a second sub-threshold, with the second sub-threshold being greater than the first sub-threshold. Therefore, if the proportion of abnormal nodes with domain name errors in the total number of nodes is greater than the first sub-threshold and less than or equal to the second sub-threshold, the abnormality level of the abnormal node is determined to be medium; if the proportion of abnormal nodes with domain name errors in the total number of nodes is greater than the second sub-threshold, the abnormality level of the abnormal node is determined to be high; and if the proportion of abnormal nodes with domain name errors in the total number of nodes is less than the first sub-threshold, the abnormality level of the abnormal node is determined to be low.

[0082] It should be noted that the specific value of the ratio threshold is not specifically limited in the embodiments of this application, and it can be set according to actual needs; the classification of the degree of abnormality is also not specifically limited, and the above only uses low, medium and high as examples.

[0083] For each of the domain name system data, based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes, after determining the data detection result, the abnormal detection information in the data detection result can be written into a distributed memory key-value database to generate alarm information.

[0084] In this embodiment of the application, writing the anomaly detection information from the data detection results into a distributed memory-based key-value database enables high-performance access to multi-dimensional alarm information at the domain level, such as... Figure 3 As shown in the figure, this figure is a schematic diagram of an alarm information cache provided in an embodiment of this application.

[0085] In this embodiment, a dynamic cleanup mechanism is adopted. For each abnormal node, if no new alarm information for the abnormal node is added within a preset period, the alarm information corresponding to the abnormal node is deleted.

[0086] It is understood that the preset period is not specifically limited in the embodiments of this application, and it can be set according to actual needs.

[0087] When no new alarm information for the abnormal node is added within the preset period, it means that the abnormal node has not shown any abnormality in the new analysis period. In this case, its original alarm information can be deleted to ensure that the alarm status stored in the cache is consistent with the actual domain name status, and to avoid false alarms and misjudgments caused by expired data.

[0088] In one possible implementation, the anomaly detection information from the data detection results is written into a distributed in-memory key-value database. After generating alarm information, the alarm information is aggregated and statistically analyzed. Based on four dimensions—domain name correctness, domain name availability, URL correctness, and URL availability—the alarm information can be classified to determine its type. Statistical results are generated based on the type of alarm information and the timestamp corresponding to the alarm information.

[0089] For example, by aggregating and statistically analyzing daily alarm information, different types of data, such as domain name correctness, domain name availability, URL correctness, and URL availability, can be distinguished, and timestamped statistical results can be generated. Furthermore, the method provided in this application supports historical data retrieval and analysis across date ranges, providing reliable quantitative evidence for trend monitoring, operational evaluation, and strategy adjustment, further expanding the system's analytical depth and application value.

[0090] To facilitate understanding, the following will be combined with... Figure 4 This application provides an overall overview of the solutions provided in its embodiments. Figure 4 This is a system framework diagram provided for an embodiment of this application.

[0091] Based on the alarm analyzer framework, the domain name correctness analyzer can be invoked to extract domain name system data collected by each node within a preset time range.

[0092] The domain name correctness analyzer parses the log files using a columnar analysis engine and generates a resolution record for each domain name and its corresponding node.

[0093] Based on this, the proportion of nodes with incorrect domain names in the total number of nodes can be calculated. When the proportion reaches or exceeds 80%, the system can determine that the resolution result of the domain name has a general abnormality and trigger a correctness alarm.

[0094] While triggering a correctness alarm, a detailed list of abnormal nodes can be generated to identify the specific source of the abnormality and the distribution of the nodes. This result is then written to a high-speed memory cache module to support subsequent fast queries and access.

[0095] In this embodiment, the alarm status of the domain name is included in the statistical data by automatically updating the daily alarm statistics table, forming complete daily alarm information. The alarm status, abnormal node details, and historical trend curves of the domain name can be displayed in real time in the management interface, thereby helping relevant technical personnel to quickly locate the problematic domain name, grasp its development and change trend, and take targeted measures accordingly.

[0096] It is understandable that this introduction only uses domain name correctness detection as an example. Domain name availability detection, URL correctness detection, and URL availability detection are similar to the process of domain name correctness detection, and will not be repeated here.

[0097] In summary, this application's embodiments achieve a more intelligent alarm mechanism by introducing a ratio-based dynamic threshold algorithm, instead of the traditional fixed threshold setting. An alarm is only triggered when the proportion of abnormal nodes exceeds the corresponding ratio threshold, effectively reducing false alarms and missed alarms caused by single-point anomalies or short-term fluctuations.

[0098] Meanwhile, by employing a columnar analysis engine in this embodiment, query speed can be significantly improved when processing semi-structured logs. Especially in scenarios involving large-scale JSON data, it can effectively avoid the input / output (IO) bottlenecks generated by traditional relational databases during the data parsing and querying stages, ensuring the real-time performance of data detection.

[0099] By implementing a layered design through an abstract detection module framework, various specific alarm logics can be implemented through inheritance and extension. This architecture significantly reduces the development cost of adding new detection requirements and improves the system's adaptability to diverse detection needs.

[0100] In this embodiment, alarm information can be written and read quickly, achieving a response time of seconds. When users or upper-layer applications request to query alarm information, they can directly obtain cached results without re-triggering a full calculation, thereby significantly reducing the latency of alarm display.

[0101] The method provided in this application does not rely on a complex distributed storage system. It only needs to rely on log files and an embedded computing engine to run. It has low deployment environment requirements, is suitable for large-scale cluster environments, and can also run efficiently in single-machine or edge node environments. It has good promotion and application value.

[0102] This application provides a data detection device, see [link to relevant documentation] Figure 5 The figure is a schematic diagram of the structure of a data detection device provided in an embodiment of this application. Its specific implementation method is consistent with the implementation method and the technical effect achieved in the embodiments of the above method. Some contents will not be repeated.

[0103] This application provides a data detection device 5100, including:

[0104] Generation unit 5101, first determining unit 5102 and second determining unit 5103;

[0105] The generation unit 5101 is used to map the collected domain name system data to a virtual table and generate a temporary analysis view;

[0106] The first determining unit 5102 is used to detect each domain name system data in the temporary analysis view based on time constraints and query rules for node aggregation, and to determine abnormal nodes in each domain name system data.

[0107] The second determining unit 5103 is used to determine the data detection result for each of the domain name system data based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes.

[0108] In one possible implementation, the generation unit is specifically used to: convert the collected domain name system data into a JSONL format data file; map the JSONL format data file to a virtual table to generate a temporary analysis view.

[0109] In one possible implementation, the first determining unit is specifically used to: based on time constraints, within a preset time range, perform domain name detection and URL detection on each domain name system data in the temporary analysis view according to the query rules of node aggregation, and determine abnormal nodes in each domain name system data.

[0110] In one possible implementation, the second determining unit is specifically used for:

[0111] The degree of abnormality of the abnormal node is determined based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes.

[0112] Based on the degree of anomaly, the data detection result is determined.

[0113] In one possible implementation, the device further includes: an alarm unit;

[0114] The alarm unit is used to write the anomaly detection information in the data detection results into a distributed memory-based key-value database to generate alarm information.

[0115] In one possible implementation, the device further includes: a deletion unit;

[0116] The deletion unit is used to delete the alarm information corresponding to each abnormal node when no new alarm information for the abnormal node is added within a preset period.

[0117] In one possible implementation, the device further includes: a statistical unit;

[0118] The statistical unit is used to aggregate and statistically analyze alarm information. Based on four dimensions—domain name correctness, domain name availability, URL correctness, and URL availability—it classifies the alarm information and determines the type of alarm information. Based on the type of alarm information and the timestamp corresponding to the alarm information, it generates statistical results.

[0119] In summary, this application's embodiments achieve a more intelligent alarm mechanism by introducing a ratio-based dynamic threshold algorithm, instead of the traditional fixed threshold setting. An alarm is only triggered when the proportion of abnormal nodes exceeds the corresponding ratio threshold, effectively reducing false alarms and missed alarms caused by single-point anomalies or short-term fluctuations, and improving the accuracy of data detection.

[0120] This application provides a computer device, which includes a processor and a memory;

[0121] The memory is used to store program code and transmit the program code to the processor;

[0122] The processor is used to execute the steps of a data detection method as described above, according to the instructions in the program code.

[0123] This application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of a data detection method as described above.

[0124] This application provides a computer program product that, when run on a computer, executes the steps of a data detection method as described above.

[0125] This application provides a chip including a processor coupled to a memory for executing a computer program or instructions stored in the memory, thereby enabling the chip to implement the steps of a data detection method as described above.

[0126] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments. The device and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components indicated as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the solution in this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0127] The above description is merely one specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data detection method, characterized in that, include: The collected domain name system data is mapped to a virtual table to generate a temporary analysis view; Based on time constraints and node aggregation query rules, the domain name system data in the temporary analysis view is detected to identify abnormal nodes in each domain name system data. For each of the domain name system data, the data detection result is determined based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes.

2. The method according to claim 1, characterized in that, The step of mapping the collected Domain Name System (DNS) data to a virtual table to generate a temporary analysis view includes: Convert the collected domain name system data into JSONL format data files; The JSONL format data file is mapped to a virtual table to generate a temporary analysis view.

3. The method according to claim 1, characterized in that, The query rules based on time constraints and node aggregation are used to detect abnormal nodes in the domain name system data in the temporary analysis view, including: Based on time constraints, within a preset time range, according to the query rules for node aggregation, domain name detection and URL detection are performed on each domain name system data in the temporary analysis view to identify abnormal nodes in each domain name system data.

4. The method according to claim 1, characterized in that, The determination of data detection results based on the type of the abnormal nodes and the proportion of each type of abnormal node in the total number of nodes includes: The degree of abnormality of the abnormal node is determined based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes. Based on the degree of anomaly, the data detection result is determined.

5. The method according to any one of claims 1-4, characterized in that, After determining the data detection result for each of the Domain Name System (DNS) data based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes, the process further includes: The anomaly detection information in the data detection results is written into a distributed memory-based key-value database to generate alarm information.

6. The method according to claim 5, characterized in that, After writing the anomaly detection information from the data detection results into a distributed in-memory key-value database and generating alarm information, the process further includes: For each abnormal node, if no new alarm information for the abnormal node is added within a preset period, the alarm information corresponding to the abnormal node is deleted.

7. The method according to claim 5, characterized in that, After writing the anomaly detection information from the data detection results into a distributed in-memory key-value database and generating alarm information, the process further includes: The alarm information is aggregated and statistically analyzed, and classified based on four dimensions: domain name correctness, domain name availability, URL correctness, and URL availability, to determine the type of alarm information; Statistical results are generated based on the type of alarm information and the timestamp corresponding to the alarm information.

8. A data detection device, characterized in that, include: A generation unit, a first determining unit, and a second determining unit; The generation unit is used to map the collected domain name system data to a virtual table and generate a temporary analysis view; The first determining unit is used to detect each domain name system data in the temporary analysis view based on time constraints and query rules for node aggregation, and to determine abnormal nodes in each domain name system data. The second determining unit is used to determine the data detection result for each of the domain name system data, based on the type of the abnormal node and the proportion of each type of abnormal node in the total number of nodes.

9. A computer device, characterized in that, The computer device includes: a processor and a memory; The memory is used to store program code and transmit the program code to the processor; The processor is configured to execute the steps of a data detection method as described in any one of claims 1-7 according to instructions in the program code.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of a data detection method as described in any one of claims 1-7.

Images