A method, device, electronic device and storage medium for determining the same origin of domain names

Abstract

The present application discloses a domain name homology determination method, device, electronic device and storage medium, comprising: obtaining a domain name to be detected and obtaining a first feature of the domain name to be detected; inputting the first feature of the domain name to be detected into a CDN domain name recognition model to obtain a domain name recognition result, wherein the CDN domain name recognition model is obtained by training according to a preset classification model based on the first feature of a domain name sample; if it is determined that the domain name to be detected is a CDN domain name, obtaining a second feature of the domain name to be detected; inputting the second feature of the domain name to be detected into a domain name suffix extraction model to obtain a domain name suffix of the domain name to be detected, wherein the domain name suffix extraction model is obtained by training according to a preset classification model based on the second feature of the CDN domain name sample; searching for the domain name suffix of the domain name to be detected in a preset blacklist and a preset whitelist respectively, and if it is determined that the preset blacklist or the preset whitelist contains a CDN domain name with the same domain name suffix, determining that the domain name to be detected and the CDN domain name are of the same domain name origin.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method, device, electronic device and storage medium for determining domain name homology. Background Art

[0002] In the relevant technology, when the domain name and the organization are accurately associated, the filtering or blocking strategy based on the domain name blacklist has the characteristics of strong targeting and high effectiveness. This type of domain name that can be clearly mapped to the same organization is called domain name homology. These domain names can correspond to the same domain name suffix. For example, the domain names "www.organizationxxx.com" and "sp1.organizationxxx.com" are domain name homology, and both have the same domain name suffix "organizationxxx.com". Assuming that "www.organizationxxx.com" is in the whitelist and "sp1.organizationxxx.com" is not added to the whitelist, since the two domain names are of the same origin, the domain name whitelist can be extended through domain name homology, and "sp1.organizationxxx.com" can also be added to the domain name whitelist. Similarly, the domain name blacklist can be extended through domain name homology to achieve rapid blocking of malicious domain names.

[0003] The domain name suffix information of general domain names can be directly extracted through the top-level domain name (TLD). However, for some cloud service domain names provided by cloud service providers, namely CDN domain names (Content Delivery Network), the actual services corresponding to the same domain name suffix belong to different organizations. For example, the cloud service domain name "d360qkwpkfhw70.cloudfront.net" and the cloud service domain name "d7mr9t4gg59vq.cloudfront.net" are both addresses provided by the cloud service provider Amazon, but their actual users are different organizations. If the cloud service domain name suffix "cloudfront.net" is directly judged as the domain name suffix of the organization, it will be misjudged. Their domain name suffixes should actually be third-level domain names. Therefore, the accuracy of existing cloud service domain name homology judgment is low. Some attackers also register malicious domain names by imitating legitimate cloud service addresses. For example, "pk.cdn-edu.net" is a malicious domain name registered by an attacker. It is easily misidentified as a cloud service domain name address, causing many attacks to escape detection. Therefore, there are certain challenges in determining cloud service domain names, which in turn affects the accuracy of cloud service domain name homology determination. Summary of the Invention

[0004] In order to solve the problem of low accuracy in existing cloud service domain name homology determination, embodiments of the present application provide a domain name homology determination method, device, electronic device and storage medium.

[0005] In a first aspect, an embodiment of the present application provides a method for determining domain name homology, comprising:

[0006] Acquire a domain name to be detected, and obtain a first feature of the domain name to be detected, the first feature comprising: a first domain name statistical feature and a first domain name resolution feature, the first domain name statistical feature of the domain name to be detected representing a structural feature of the domain name to be detected, and the first domain name resolution feature of the domain name to be detected representing an associated feature of the domain name to be detected extracted from a Passive Domain Name System (PDNS) log;

[0007] Inputting the first feature of the domain name to be detected into a content delivery network (CDN) domain name recognition model to obtain a domain name recognition result, wherein the CDN domain name recognition model is trained according to a preset classification model based on the first feature of the domain name sample;

[0008] If it is determined that the domain name identification result is that the domain name to be detected is a CDN domain name, obtaining a second feature of the domain name to be detected, the second feature including: a second domain name statistical feature and a second domain name resolution feature, the second domain name statistical feature of the domain name to be detected representing a structural feature of a candidate domain name suffix and a candidate domain name prefix of the domain name to be detected, and the second domain name resolution feature of the domain name to be detected representing an association feature of the domain name to be detected and an association feature of the candidate domain name suffix of the domain name to be detected extracted according to the PDNS log;

[0009] Inputting the second feature of the domain name to be detected into a domain name suffix extraction model to obtain the domain name suffix of the domain name to be detected, wherein the domain name suffix extraction model is trained according to the preset classification model based on the second feature of the CDN domain name sample;

[0010] The domain name suffix of the domain name to be detected is searched in a preset blacklist and a preset whitelist respectively. If it is determined that the preset blacklist or the preset whitelist contains a CDN domain name with the same domain name suffix, it is determined that the domain name to be detected and the CDN domain name are of the same domain name origin, and the domain name to be detected is added to the preset blacklist or the preset whitelist.

[0011] In a possible implementation, the domain name samples include domain name training samples and domain name prediction samples;

[0012] The CDN domain name recognition model is trained by the following method:

[0013] Obtaining a first feature of the domain name training sample based on the PDNS log;

[0014] Performing iterative training on the first feature of the domain name training sample in the current round according to the preset classification model to obtain a candidate CDN domain name recognition model;

[0015] Obtaining a first feature of the domain name prediction sample based on the PDNS log;

[0016] Inputting the first feature of the domain name prediction sample into the candidate CDN domain name recognition model to perform domain name prediction and obtain a prediction result;

[0017] The domain name prediction samples with accurate prediction results are determined as new domain name training samples;

[0018] A new round of iterative training is performed on the candidate CDN domain name recognition model according to the domain name training samples and the newly added domain name training samples until a preset iterative round is reached to obtain the CDN domain name recognition model.

[0019] In a possible implementation, the CDN domain name samples include CDN domain name training samples and CDN domain name prediction samples;

[0020] The domain name suffix extraction model is trained in the following way:

[0021] Obtaining a candidate domain name suffix of the CDN domain name training sample, and obtaining a second feature of the CDN domain name training sample based on the candidate domain name suffix of the CDN domain name training sample and the PDNS log;

[0022] Performing a current round of iterative training according to the preset classification model based on the second feature of the CDN domain name training sample and the candidate domain name suffixes of the CDN domain name training sample to obtain a candidate domain name suffix extraction model;

[0023] Obtaining a candidate domain name suffix of the CDN domain name prediction sample, and obtaining a second feature of the CDN domain name prediction sample based on the candidate domain name suffix of the CDN domain name prediction sample and the PDNS log;

[0024] Inputting the second feature of the CDN domain name prediction sample into the candidate domain name suffix extraction model to perform domain name suffix prediction to obtain a prediction result;

[0025] Determine the CDN domain name prediction samples with accurate prediction results as new CDN domain name training samples;

[0026] A new round of iterative training is performed on the candidate domain name suffix extraction model according to the CDN domain name training samples and the newly added CDN domain name training samples until a preset iterative round is reached to obtain the domain name suffix extraction model.

[0027] In a possible implementation, obtaining the first feature of the domain name training sample based on the PDNS log specifically includes:

[0028] Extracting a first domain name statistical feature of the domain name training sample, and extracting a first domain name resolution feature of the domain name training sample based on the PDNS log, and obtaining a first feature of the domain name training sample according to the first domain name statistical feature of the domain name training sample and the first domain name resolution feature of the domain name training sample; and

[0029] Obtaining a first feature of the domain name prediction sample based on the PDNS log specifically includes:

[0030] Extract the first domain name statistical feature of the domain name prediction sample, and extract the first domain name resolution feature of the domain name prediction sample based on the PDNS log, and obtain the first feature of the domain name prediction sample according to the first domain name statistical feature of the domain name prediction sample and the first domain name resolution feature of the domain name prediction sample.

[0031] In a possible implementation, obtaining the second feature of the CDN domain name training sample based on the candidate domain name suffix of the CDN domain name training sample and the PDNS log specifically includes:

[0032] Extracting a second domain name statistical feature of the CDN domain name training sample based on the candidate domain name suffix of the CDN domain name training sample, extracting a second domain name resolution feature of the CDN domain name training sample in the PDNS log based on the candidate domain name suffix of the CDN domain name training sample, and obtaining a second feature of the CDN domain name training sample based on the second domain name statistical feature of the CDN domain name training sample and the second domain name resolution feature of the CDN domain name training sample; and

[0033] Obtaining a second feature of the CDN domain name prediction sample based on the candidate domain name suffix of the CDN domain name prediction sample and the PDNS log specifically includes:

[0034] A second domain name statistical feature of the CDN domain name prediction sample is extracted based on the candidate domain name suffix of the CDN domain name prediction sample, and a second domain name resolution feature of the CDN domain name prediction sample is extracted in the PDNS log based on the candidate domain name suffix of the CDN domain name prediction sample. The second feature of the CDN domain name prediction sample is obtained according to the second domain name statistical feature of the CDN domain name prediction sample and the second domain name resolution feature of the CDN domain name prediction sample.

[0035] In a possible implementation, obtaining the candidate domain name suffix of the CDN domain name training sample specifically includes:

[0036] For each CDN domain name training sample, extract the domain name suffix of the CDN domain name training sample;

[0037] The sub-blocks except the first sub-block in the domain name training sample prefix are sequentially combined with the domain name suffix according to the adjacency principle to obtain a candidate domain name suffix corresponding to the CDN domain name training sample.

[0038] In a second aspect, an embodiment of the present application provides a domain name homology determination device, comprising:

[0039] a first feature extraction unit, configured to obtain a domain name to be detected and obtain a first feature of the domain name to be detected, wherein the first feature includes: a first domain name statistical feature and a first domain name resolution feature, wherein the first domain name statistical feature of the domain name to be detected represents a structural feature of the domain name to be detected, and the first domain name resolution feature of the domain name to be detected represents an associated feature of the domain name to be detected extracted from a Passive Domain Name System (PDNS) log;

[0040] A domain name recognition unit, configured to input the first feature of the domain name to be detected into a content delivery network (CDN) domain name recognition model to obtain a domain name recognition result, wherein the CDN domain name recognition model is trained according to a preset classification model based on the first feature of the domain name sample;

[0041] a second feature extraction unit configured to obtain, if it is determined that the domain name to be detected is a CDN domain name as a result of the domain name identification, a second feature of the domain name to be detected, the second feature comprising: a second domain name statistical feature and a second domain name resolution feature, the second domain name statistical feature of the domain name to be detected representing structural features of a candidate domain name suffix and a candidate domain name prefix of the domain name to be detected, and the second domain name resolution feature of the domain name to be detected representing correlation features of the domain name to be detected and correlation features of the candidate domain name suffix of the domain name to be detected extracted based on the PDNS log;

[0042] A domain name suffix extraction unit, configured to input the second feature of the domain name to be detected into a domain name suffix extraction model to obtain the domain name suffix of the domain name to be detected, wherein the domain name suffix extraction model is trained according to the preset classification model based on the second feature of the CDN domain name sample;

[0043] The domain name homology determination unit is used to search for the domain name suffix of the domain name to be detected in a preset blacklist and a preset whitelist respectively. If it is determined that the preset blacklist or the preset whitelist contains a CDN domain name with the same domain name suffix, it is determined that the domain name to be detected and the CDN domain name are of the same domain name origin, and the domain name to be detected is added to the preset blacklist or the preset whitelist.

[0044] In a possible implementation, the domain name samples include domain name training samples and domain name prediction samples;

[0045] The domain name recognition unit is specifically configured to train and obtain the CDN domain name recognition model in the following manner: obtaining a first feature of the domain name training sample based on the PDNS log; performing a current round of iterative training on the first feature of the domain name training sample according to the preset classification model to obtain a candidate CDN domain name recognition model; obtaining a first feature of the domain name prediction sample based on the PDNS log; inputting the first feature of the domain name prediction sample into the candidate CDN domain name recognition model to perform domain name prediction and obtain a prediction result; determining the domain name prediction sample with an accurate prediction result as a newly added domain name training sample; performing a new round of iterative training on the candidate CDN domain name recognition model based on the domain name training sample and the newly added domain name training sample until a preset iterative round is reached to obtain the CDN domain name recognition model.

[0046] In a possible implementation, the CDN domain name samples include CDN domain name training samples and CDN domain name prediction samples;

[0047] The domain name suffix extraction unit is specifically used to train and obtain the domain name suffix extraction model in the following manner: obtain candidate domain name suffixes of the CDN domain name training samples, and obtain the second feature of the CDN domain name training samples based on the candidate domain name suffixes of the CDN domain name training samples and the PDNS log; perform a current round of iterative training according to the preset classification model based on the second feature of the CDN domain name training samples and the candidate domain name suffixes of the CDN domain name training samples to obtain a candidate domain name suffix extraction model; obtain candidate domain name suffixes of the CDN domain name prediction samples, and obtain the second feature of the CDN domain name prediction samples based on the candidate domain name suffixes of the CDN domain name prediction samples and the PDNS log; input the second feature of the CDN domain name prediction samples into the candidate domain name suffix extraction model to perform domain name suffix prediction and obtain a prediction result; determine the CDN domain name prediction samples with accurate prediction results as newly added CDN domain name training samples; perform a new round of iterative training on the candidate domain name suffix extraction model based on the CDN domain name training samples and the newly added CDN domain name training samples until a preset iterative round is reached to obtain the domain name suffix extraction model.

[0048] In a possible embodiment, the domain name identification unit is specifically used to extract the first domain name statistical feature of the domain name training sample, and extract the first domain name resolution feature of the domain name training sample based on the PDNS log, and obtain the first feature of the domain name training sample according to the first domain name statistical feature of the domain name training sample and the first domain name resolution feature of the domain name training sample; and extract the first domain name statistical feature of the domain name prediction sample, and extract the first domain name resolution feature of the domain name prediction sample based on the PDNS log, and obtain the first feature of the domain name prediction sample according to the first domain name statistical feature of the domain name prediction sample and the first domain name resolution feature of the domain name prediction sample.

[0049] In a possible embodiment, the domain name suffix extraction unit is specifically used to extract the second domain name statistical feature of the CDN domain name training sample based on the candidate domain name suffix of the CDN domain name training sample, and extract the second domain name resolution feature of the CDN domain name training sample in the PDNS log based on the candidate domain name suffix of the CDN domain name training sample, and obtain the second feature of the CDN domain name training sample according to the second domain name statistical feature of the CDN domain name training sample and the second domain name resolution feature of the CDN domain name training sample; and extract the second domain name statistical feature of the CDN domain name prediction sample based on the candidate domain name suffix of the CDN domain name prediction sample, and extract the second domain name resolution feature of the CDN domain name prediction sample in the PDNS log based on the candidate domain name suffix of the CDN domain name prediction sample, and obtain the second feature of the CDN domain name prediction sample according to the second domain name statistical feature of the CDN domain name prediction sample and the second domain name resolution feature of the CDN domain name prediction sample.

[0050] In a possible implementation, the domain name suffix extraction unit is specifically used to extract the domain name suffix of each CDN domain name training sample; and combine the sub-blocks except the first sub-block in the domain name training sample prefix with the domain name suffix in sequence according to the adjacency principle to obtain a candidate domain name suffix corresponding to the CDN domain name training sample.

[0051] In a third aspect, an embodiment of the present application provides an electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the domain name homology determination method described in the present application when executing the program.

[0052] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the domain name homology determination method described in the present application.

[0053] Other features and advantages of the present application will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present application. The purposes and other advantages of the present application can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0054] The beneficial effects of the embodiments of the present application are as follows:

[0055] In the domain name homology determination scheme provided in the embodiment of the present application, a domain name to be detected is obtained, and a first feature of the domain name to be detected is obtained. The first feature includes: a first domain name statistical feature and a first domain name resolution feature. The first domain name statistical feature of the domain name to be detected represents the structural feature of the domain name to be detected. The first domain name resolution feature of the domain name to be detected represents the structural feature of the domain name to be detected according to PDNS (Passive Domain Name System, Passive Domain Name System) log extracted the associated features of the domain name to be detected, input the first feature of the domain name to be detected into the CDN domain name recognition model to obtain the domain name recognition result, wherein the CDN domain name recognition model is obtained based on the first feature of the domain name sample trained according to the preset classification model, if it is determined that the domain name recognition result is that the domain name to be detected is a CDN domain name, then obtain the second feature of the domain name to be detected, the second feature includes: a second domain name statistical feature and a second domain name resolution feature, the second domain name statistical feature of the domain name to be detected represents the structural features of the candidate domain name suffix and the candidate domain name prefix of the domain name to be detected, the second domain name resolution feature of the domain name to be detected represents the associated features of the domain name to be detected extracted according to the PDNS log and the associated features of the candidate domain name suffix of the domain name to be detected, then, input the second feature of the domain name to be detected into the domain name suffix extraction model to obtain the domain name suffix of the domain name to be detected, wherein the domain name suffix extraction model is obtained based on the second feature of the CDN domain name sample trained according to the preset classification model, search the domain name suffix of the domain name to be detected in the preset blacklist and the preset whitelist respectively, if it is determined that the preset blacklist or the preset whitelist contains a CDN domain name with the same domain name suffix as the domain name to be detected, then determine that the domain name to be detected and the CDN domain name are domain names. The CDN domain name is of the same origin, and the domain name to be detected is added to the preset blacklist or preset whitelist, that is, the list to which the CDN domain name belongs. Compared with the prior art, in the embodiment of the present application, the first feature of the domain name sample is pre-trained according to the preset classification model to obtain a CDN domain name recognition model, and the second feature of the CDN domain name sample is trained to obtain a domain name suffix extraction model. The CDN domain name recognition model is first used to determine whether the domain name to be detected is a CDN domain name. If it is a CDN domain name, the domain name suffix extraction model is further used to extract the domain name suffix of the domain name to be detected. The domain name suffix is found in the preset blacklist and preset whitelist according to the domain name suffix. The domain name to be detected is added to the corresponding list. Since the training of the CDN domain name recognition model and the domain name suffix extraction model fully utilizes the statistical characteristics of the domain name and the resolution characteristics of the domain name extracted based on the PDNS log, the accuracy of CDN domain name and domain name suffix prediction is improved, that is, the detection accuracy of cloud service domain name and domain name suffix is improved. In addition, the CDN domain name to be detected is first identified. If the domain name to be detected is a CDN domain name, the domain name suffix is extracted, which further improves the accuracy of CDN domain name suffix detection, thereby improving the accuracy of CDN domain name (that is, cloud service domain name) homology determination. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0057] Figure 1 A flowchart of a method for determining domain name homology provided in an embodiment of the present application;

[0058] Figure 2 A schematic diagram of the training process of the CDN domain name recognition model provided in an embodiment of the present application;

[0059] Figure 3 A schematic diagram of the training process of the domain name suffix extraction model provided in an embodiment of the present application;

[0060] Figure 4 A schematic diagram of the structure of a domain name homology determination device provided in an embodiment of the present application;

[0061] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] In order to solve the problem of low accuracy in existing cloud service domain name homology determination, embodiments of the present application provide a domain name homology determination method, device, electronic device and storage medium.

[0063] The preferred embodiments of the present application are described below in conjunction with the drawings in the specification. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present application and are not used to limit the present application. In addition, the embodiments and features in the embodiments of the present application can be combined with each other if there is no conflict.

[0064] In this article, it is necessary to understand that the technical terms involved in the present invention are:

[0065] 1. CNAME (Canonical Name): This record, also known as an alias record, allows multiple names to be mapped to the same computer. It is commonly used for computers that provide both WWW and MAIL services. For example, consider a computer named "host.mydomain.com" (A record), which provides both WWW and MAIL services. To facilitate user access, two aliases (CNAMEs) can be set for this computer: WWW and MAIL. This same method can be used when multiple domain names need to point to the same server IP address. In this case, one domain name can be created as an A record, pointing to the server IP address. Other domain names can then be aliased (CNAMEs) to the domain name in the A record. Therefore, if the server IP address changes, there's no need to re-map each domain name individually. Simply change the domain name in the A record to the server's new IP address, and the other aliased (CNAMEs) will automatically redirect to the new IP address. (All of this must be done in the DNS server.) The A record specifies the IP address corresponding to a domain name (or host name). Users can then point the website server associated with that domain to their own web server.

[0066] The domain name homology determination method provided in this application can be applied to a server or a terminal device, and the embodiments of this application do not limit this.

[0067] The server can be an independent physical server, a cluster server, or a cloud server that provides basic cloud computing services such as cloud servers, cloud databases, and cloud storage. The terminal device can be, but is not limited to, a smart terminal, a tablet computer, a laptop computer, a desktop computer, etc., and this embodiment of the application does not limit this.

[0068] The embodiment of the present application is only described by taking application to a server as an example.

[0069] like Figure 1 As shown, it is a schematic diagram of the implementation process of the domain name homology determination method provided in an embodiment of the present application, which can be applied to a server and includes the following steps:

[0070] S11. Acquire the domain name to be detected and obtain the first feature of the domain name to be detected.

[0071] During specific implementation, the server pre-trains the CDN domain name recognition model and domain name suffix extraction model.

[0072] The CDN domain name recognition model is obtained by training according to a preset classification model based on the first feature of the domain name sample. The first feature includes: a first domain name statistical feature and a first domain name resolution feature. The first feature of the domain name sample includes: the domain name statistical feature of the domain name sample (which can be recorded as the first domain name statistical feature of the domain name sample) and the domain name resolution feature of the domain name sample (which can be recorded as the first domain name resolution feature of the domain name sample). The first statistical feature of the domain name sample represents the structural feature of the domain name sample, and the first resolution feature of the domain name sample represents the associated feature of the domain name sample extracted from the PDNS log. The domain name sample includes positive samples and negative samples. The positive sample is the CDN domain name sample, and the negative sample is the non-CDN domain name sample.

[0073] The first domain name statistical feature of a domain name may include at least but not limited to one or more of the following features: whether the domain name contains a public top-level domain, whether the domain name contains a popular field, the length of the domain name's block (i.e., the number of domain name blocks), the number of subdomains of the domain name, the number of subdomains of the domain name containing popular fields, the average block length of the domain name's subdomains, etc. Among them, the popular field is a commonly used field used in the domain name, such as "www", etc., and the block in a domain name refers to the character block of each part separated by ".", for example, "www.organizationxxx.com" contains the following three blocks: "www", "organizationxxx" and "com".

[0074] The first domain name resolution feature of a domain name includes at least but is not limited to a combination of one or more of the following features: in the PDNS log, the number of IP addresses corresponding to the domain name (that is, the number of IP addresses pointed to by the domain name), the number of CNAMEs corresponding to the domain name, the number of other domain names resolved to the domain name, and the geographical distribution corresponding to the domain name, etc.

[0075] The domain name suffix extraction model extracts the suffix of the CDN domain name. The domain name suffix extraction model is obtained by training according to the preset classification model based on the second feature of the CDN domain name sample. The second feature includes: the second domain name statistical feature and the second domain name resolution feature. The second feature of the CDN domain name sample includes: the second domain name statistical feature of the CDN domain name sample and the second domain name resolution feature of the CDN domain name sample. The second statistical feature of the CDN domain name sample represents the structural features of the candidate domain name suffix and the candidate domain name prefix of the CDN domain name sample. The second resolution feature of the CDN domain name sample represents the association features of the CDN domain name sample extracted according to the PDNS log and the association features of the candidate domain name suffix of the CDN domain name sample.

[0076] The second domain name statistical feature of a domain name may include at least one or a combination of the following features, but is not limited to: whether the candidate domain name prefix contains a public top-level domain, whether the candidate domain name prefix contains a popular field, the length of the block of the candidate domain name prefix, the number of subdomains of the candidate domain name suffix, the number of subdomains with popular prefixes in the subdomains of the candidate domain name suffix, and the average block length of the subdomains of the candidate domain name suffix. The candidate domain name suffix of a domain name may be obtained by extracting the domain name suffix of the domain name, and combining the subblocks of the domain name prefix except the first subblock with the domain name suffix in sequence according to the principle of proximity to obtain the candidate domain name suffix of the domain name. The portion of the domain name preceding the candidate domain name suffix is the candidate domain name prefix.

[0077] The second domain name resolution feature of a domain name includes at least but is not limited to a combination of one or more of the following features: the number of domain names corresponding to the candidate domain name suffix (that is, how many different domain names the candidate domain name suffix appears in), the number of CNAMEs corresponding to the candidate domain name suffix, the number of IP addresses corresponding to the domain name, the number of CNAMEs corresponding to the domain name, the number of other domain names resolved to the domain name, and the geographical distribution corresponding to the domain name, etc.

[0078] As a possible implementation method, the domain name samples for training the CDN domain name recognition model may include domain name training samples and domain name prediction samples. The domain name training samples are used to train the CDN domain name recognition model, and the domain name prediction samples are used to predict the trained candidate CDN domain name recognition model to determine the accuracy of the model, that is, whether the domain name prediction sample is a CDN domain name (address).

[0079] You can follow the Figure 2 The CDN domain name recognition model is trained using the following process:

[0080] S21. Obtain the first feature of the domain name training sample based on the PDNS log.

[0081] In specific implementation, domain name samples can be constructed in the following ways:

[0082] A CDN domain name address knowledge base can be constructed based on the CDN domain names collected by major cloud service providers publicly available on the Internet for accelerating the configuration of CNAMEs. The CDN domain names in the CDN domain name address knowledge base can be used to identify whether a given domain name is a real CDN domain name during training. The domain name ownership can be queried through the whois tool, and the domain name suffix can be determined by querying the subdomain information of the domain name through the DNSgrep tool or the Virsustotal tool. A correspondence between the domain name and the domain name suffix is established to construct an initial domain name homology knowledge base. PDNS log data within a set time period is collected, and domain name features are extracted based on the PDNS log. The set time period can be set arbitrarily, such as the most recent year, and this embodiment of the present application does not limit this. Domain name samples are constructed based on the constructed domain name homology knowledge base, and a certain proportion of CDN domain names are obtained from the domain name homology knowledge base as positive samples of domain name training samples. Other CDN domain names can be used as positive samples of domain name prediction samples. Non-CDN domain names are collected from the Internet, and a portion of non-CDN domain names are selected as negative samples of domain name training samples, and other non-CDN domain names are used as negative samples of domain name prediction samples. CDN domain names are cloud service domain names provided by major cloud service providers, and non-CDN domain names are non-cloud service domain names.

[0083] It should be noted that in this application, the domain name suffix refers to a character segment that can correspond to an organization, and the domain name prefix in this application refers to all character segments before the domain name suffix. For example, the domain name suffix of the domain name "www.baidu.com" is "baidu.com", the domain name prefix is "www", and the domain name suffix "baidu.com" can correspond to the organization "Baidu".

[0084] Specifically, for each domain name training sample, the first feature of the domain name training sample can be obtained in the following manner: extract the first domain name statistical feature of the domain name training sample, and extract the first domain name resolution feature of the domain name training sample based on the PDNS log, and obtain the first feature of the domain name training sample based on the first domain name statistical feature of the domain name training sample and the first domain name resolution feature of the domain name training sample.

[0085] In a specific implementation, a combination of one or more of the following features of the domain name training sample can be extracted as the first domain name statistical feature of the domain name training sample: whether the domain name training sample contains a public top-level domain name, whether the domain name training sample contains a popular field, the length of the block of the domain name training sample, the number of subdomains of the domain name training sample, the number of subdomains of the domain name training sample that contain popular fields, the average block length of the subdomains of the domain name training sample, etc. A combination of one or more of the following features of the domain name training sample can be extracted from the PDNS log as the first domain name resolution feature of the domain name training sample: the number of IP addresses corresponding to the domain name training sample in the PDNS log (i.e., the number of IP addresses pointed to by the domain name training sample), the number of CNAMEs corresponding to the domain name training sample, the number of other domain names resolved to the domain name training sample, and the geographical distribution corresponding to the domain name training sample, etc. The extracted first domain name statistical feature of the domain name training sample and the first domain name resolution feature of the domain name training sample are used as the first feature of the domain name training sample.

[0086] S22. Perform iterative training on the first feature of the domain name training sample in the current round according to the preset classification model to obtain a candidate CDN domain name recognition model.

[0087] During specific implementation, the first features of each existing domain name training sample are respectively input into the preset classification model, and the preset classification model is iteratively trained according to the error between the marked true label and the predicted label. The model parameters are adjusted to obtain the CDN domain name recognition model after the current round of training, and the CDN domain name recognition model trained in the current round is used as the candidate CDN domain name recognition model.

[0088] The first feature of the domain name is input into the CDN domain name recognition model, and the output result is whether the domain name is a CDN domain name. The preset classification model can be, but is not limited to, a decision tree classification model, which is not limited in the embodiment of the present application.

[0089] S23. Obtain the first feature of the domain name prediction sample based on the PDNS log.

[0090] During specific implementation, for each domain name prediction sample, the first domain name statistical feature of the domain name prediction sample is extracted, and the first domain name resolution feature of the domain name prediction sample is extracted based on the PDNS log, and the first feature of the domain name prediction sample is obtained based on the first domain name statistical feature of the domain name prediction sample and the first domain name resolution feature of the domain name prediction sample.

[0091] The extraction of the first domain name statistical features and the first domain name resolution features of the domain name prediction samples can refer to the extraction of the first domain name statistical features and the first domain name resolution features of the domain name training samples mentioned above, which will not be repeated here.

[0092] S24: Input the first feature of the domain name prediction sample into the candidate CDN domain name recognition model to perform domain name prediction and obtain a prediction result.

[0093] In specific implementation, the first feature of each domain name prediction sample is input into the candidate CDN domain name recognition model of the current round for domain name prediction to obtain the corresponding prediction results, that is, whether each domain name prediction sample is a CDN domain name.

[0094] S25. Determine the domain name prediction samples with accurate prediction results as new domain name training samples.

[0095] In specific implementations, for each domain name prediction sample, if the prediction result is consistent with the actual domain name attributes of the domain name prediction sample, the prediction result is determined to be accurate. For example, if a domain name training sample is a CDN domain name, if the candidate CDN domain name recognition model determines that the domain name training sample is a CDN domain name, the prediction result is accurate. If the domain name training sample is determined to be a non-CDN domain name, the prediction result is incorrect, and vice versa.

[0096] Specifically, the following methods can be used to jointly determine whether a domain name is a CDN domain name:

[0097] Verification methods based on domain semantics and domain affiliation relationships. Domain semantics-based verification relies on semantic analysis of web information obtained through crawling. To promote their services, CDN vendors need to introduce their domain addresses and services. Searching for domain names through search engines or directly accessing domain addresses can often link them to corresponding web addresses. Using a crawler-based batch verification method, webpage keywords (such as CDN, cloud services, and webpage descriptions) are extracted and semantically analyzed to verify whether a domain name is a genuine CDN domain. Verification based on domain affiliation relationships relies on CNAME records. A CNAME record is a type of record in the domain name system that maps a domain name to a real name. Typically, a CDN domain name refers to the CDN vendor's IP assets or internal domain addresses. Therefore, verification can be performed based on the (name, value) CNAME pair resolved by DNS. If a pair exists where "name" is a known domain name, then "value" is determined to be a CDN domain name. This method can further identify domain names that cannot be identified using crawling methods.

[0098] If the prediction result of any domain name prediction sample is accurate, the domain name prediction sample will be determined as a new domain name training sample and added to the training sample library to enrich the training sample library. The existing domain name training samples and the newly added domain name training samples will be used as domain name training samples for the next round. In this way, since the CDN domain name recognition model is continuously trained with the accurately predicted domain name prediction samples as domain name training samples, the accuracy of the model can be improved.

[0099] S26. Perform a new round of iterative training on the candidate CDN domain name recognition model based on the domain name training samples and the newly added domain name training samples until a preset iterative round is reached to obtain a CDN domain name recognition model.

[0100] In specific implementation, a new round of iterative training is performed on the candidate CDN domain name recognition model based on the current existing domain name training samples and the newly added domain name training samples. That is, a new round of iterative training is performed on the candidate CDN domain name recognition model of the current round based on the domain name training samples currently included in the updated training sample library to obtain a new round of candidate CDN domain name recognition model. Steps S24 and S25 are repeated until a preset number of iterations is reached or the prediction accuracy reaches a set threshold, thereby obtaining a trained CDN domain name recognition model. The preset number of iterations can be set voluntarily, and the set threshold can also be set voluntarily according to needs, for example, it can be set to 90%, which is not limited in this embodiment of the present application.

[0101] Since the domain name suffix extraction model extracts the domain name suffix of the CDN domain name, CDN domain name samples are used for training when training the domain name suffix model.

[0102] In specific implementation, Figure 3 The domain name suffix extraction model is trained using the process shown below:

[0103] S31. Obtain a candidate domain name suffix of the CDN domain name training sample, and obtain a second feature of the CDN domain name training sample based on the candidate domain name suffix of the CDN domain name training sample and the PDNS log.

[0104] In specific implementation, for each CDN domain name training sample, the domain name suffix of the CDN domain name training sample is extracted, and the sub-blocks except the first sub-block in the domain name training sample prefix are combined with the domain name suffix in sequence according to the adjacent principle to obtain the candidate domain name suffix corresponding to the CDN domain name training sample.

[0105] Specifically, the domain name suffix of the domain name can be extracted through the public public suffix list and TLD list. For example, the domain name "vm.abc123xxx.cn.cloud.tc.qq.com" will be used as the domain name suffix based on the public public suffix list query method, but the actual domain name suffix of the domain name should be "cloud.tc.qq.com". When "qq.com" is used as the domain name suffix, the domain name prefix is "vm.abc123xxx.cn.cloud.tc". By combining the blocks other than "vm" in "qq.com" and "vm.abc123xxx.cn.cloud.tc" in sequence according to the adjacent principle, the following candidate domain name suffixes can be obtained: "tc.qq.com", "cl The candidate domain name prefix corresponding to the candidate domain name suffix "tc.qq.com" is "vm.abc123xxx.cn.cloud", the candidate domain name prefix corresponding to the candidate domain name suffix "cloud.tc.qq.com" is "vm.abc123xxx.cn", the candidate domain name prefix corresponding to the candidate domain name suffix "cn.cloud.tc.qq.com" is "vm.abc123xxx", and the candidate domain name prefix corresponding to the candidate domain name suffix "abc123xxx.cn.cloud.tc.qq.com" is "vm".

[0106] During training, when the domain name "vm.abc123xxx.cn.cloud.tc.qq.com" is used as a domain name training sample, among the candidate domain name suffixes, only one is the accurate domain name suffix, namely: "cloud.tc.qq.com", which is used as a positive sample, and "tc.qq.com", "cn.cloud.tc.qq.com" and "abc123xxx.cn.cloud.tc.qq.com" are used as negative samples. By learning the accurate domain name suffix of the domain name, the model parameters are adjusted.

[0107] After obtaining the candidate domain name suffix of the CDN domain name training sample, the second domain name statistical features and the second domain name resolution features of the CDN domain name training sample are obtained based on the candidate domain name suffix of the CDN domain name training sample and the PDNS log.

[0108] In specific implementation, the second domain name statistical features of the CDN domain name training samples are extracted based on the candidate domain name suffix of the CDN domain name training samples, and the second domain name resolution features of the CDN domain name training samples are extracted in the PDNS log based on the candidate domain name suffix of the CDN domain name training samples. The second features of the CDN domain name training samples are obtained according to the second domain name statistical features of the CDN domain name training samples and the second domain name resolution features of the CDN domain name training samples.

[0109] Specifically, a combination of one or more of the following features of the CDN domain name training sample can be extracted as the second domain name statistical feature of the CDN domain name training sample: whether the candidate domain name prefix of the CDN domain name training sample contains a public top-level domain name, whether the candidate domain name prefix of the CDN domain name training sample contains a popular field, the block length of the candidate domain name prefix of the CDN domain name training sample, the number of subdomains of the candidate domain name suffix of the CDN domain name training sample, the number of subdomains with popular prefixes among the subdomains of the candidate domain name suffix of the CDN domain name training sample, and the average block length of the subdomains of the candidate domain name suffix of the CDN domain name training sample. A combination of one or more of the following features of the CDN domain name training sample can be extracted from the PDNS log as the second domain name resolution feature of the CDN domain name training sample: the number of domain names corresponding to the candidate domain name suffix of the CDN domain name training sample, the number of CNAMEs corresponding to the candidate domain name suffix of the CDN domain name training sample, the number of IP addresses corresponding to the CDN domain name training sample, the number of CNAMEs corresponding to the CDN domain name training sample, the number of other domain names that resolve to the CDN domain name training sample, and the geographical distribution of the CDN domain name training sample. The extracted second domain name statistical feature of the CDN domain name training sample and the second domain name resolution feature of the CDN domain name training sample are used as the second feature of the CDN domain name training sample.

[0110] S32. Perform the current round of iterative training based on the second feature of the CDN domain name training sample and the candidate domain name suffix of the CDN domain name training sample according to the preset classification model to obtain a candidate domain name suffix extraction model.

[0111] In specific implementation, the following steps can be used to train and obtain the candidate domain name suffix extraction model for the current round:

[0112] Step 1: Input the second feature of the CDN domain name training sample into the preset classification model to obtain the predicted probability of being predicted as each candidate domain name suffix.

[0113] For each CDN domain name training sample, the second feature of the CDN domain name training sample is input into a preset classification model to obtain a prediction probability of each candidate domain name suffix being predicted to be the CDN domain name training sample.

[0114] Among them, the preset classification model can be but is not limited to a decision tree classification model, and the embodiments of the present application do not limit this.

[0115] Step 2: Adjust the parameters of the preset classification model based on the true probability of the CDN domain name training sample being each candidate domain name suffix and the predicted probability of being each candidate domain name suffix to obtain the candidate domain name suffix extraction model for the current round.

[0116] In specific implementation, a round of iterative training is performed on the preset classification model based on the true probability of each existing CDN domain name training sample being each candidate domain name suffix and the error between the predicted probability of being each candidate domain name suffix, and the parameters of the preset classification model are adjusted to obtain a trained domain name suffix extraction model, and the trained domain name suffix extraction model is used as the candidate domain name suffix extraction model for the current round.

[0117] The second feature of the domain name is input into the candidate domain name suffix extraction model, and the output result is the domain name suffix of the domain name.

[0118] S33. Obtain a candidate domain name suffix of the CDN domain name prediction sample, and obtain a second feature of the CDN domain name prediction sample based on the candidate domain name suffix of the CDN domain name prediction sample and the PDNS log.

[0119] During specific implementation, the second domain name statistical features of the CDN domain name prediction sample are extracted based on the candidate domain name suffix of the CDN domain name prediction sample, and the second domain name resolution features of the CDN domain name prediction sample are extracted in the PDNS log based on the candidate domain name suffix of the CDN domain name prediction sample. The second features of the CDN domain name prediction sample are obtained according to the second domain name statistical features of the CDN domain name prediction sample and the second domain name resolution features of the CDN domain name prediction sample.

[0120] The extraction of the second domain name statistical features of CDN domain name prediction samples and the second domain name resolution features of CDN domain name prediction samples can refer to the extraction of the second domain name statistical features of CDN domain name training samples and the second domain name resolution features of CDN domain name training samples mentioned above, which will not be repeated here.

[0121] S34. Input the second feature of the CDN domain name prediction sample into the candidate domain name suffix extraction model to perform domain name suffix prediction and obtain a prediction result.

[0122] Specifically, the second features of each CDN domain name prediction sample are input into the candidate domain name suffix extraction model of the current round to perform domain name suffix prediction, and obtain the corresponding prediction results, namely: the domain name suffix of each CDN domain name prediction sample.

[0123] S35. Determine the CDN domain name prediction samples with accurate prediction results as new CDN domain name training samples.

[0124] In specific implementation, the following methods can be used to determine whether the predicted result of the domain name suffix is accurate, that is, whether the extracted domain name suffix is accurate:

[0125] In this application, the domain name suffix is a domain name address that can clearly correspond to an organization. Therefore, the accuracy of the extracted domain name suffix is determined by verifying whether the domain name suffix uniquely identifies an organization.

[0126] Specifically, the domain name ownership of the extracted domain name suffix can be queried through the whois query tool. In this way, it can be queried whether the domain name to which the extracted domain name suffix belongs is the corresponding CDN domain name prediction sample, or the subdomain information of the domain name can be queried through tools such as DNSGrep, or the domain name can be directly accessed through a browser, etc., and a comprehensive judgment can be made based on the characteristics of the domain name suffix.

[0127] If the prediction result of any CDN domain name prediction sample is accurate, the CDN domain name prediction sample will be determined as a new CDN domain name training sample and added to the CDN training sample library to enrich the CDN training sample library. The existing CDN domain name training samples and the newly added CDN domain name training samples will be used as CDN domain name training samples for the next round. In this way, since the accurately predicted CDN domain name prediction samples are used as CDN domain name training samples to continue training the domain name suffix extraction model, the accuracy of the model can be improved.

[0128] S36. Perform a new round of iterative training on the candidate domain name suffix extraction model based on the CDN domain name training samples and the newly added CDN domain name training samples until a preset iterative round is reached to obtain a domain name suffix extraction model.

[0129] During specific implementation, a new round of iterative training is performed on the candidate domain name suffix extraction model based on the current existing CDN domain name training samples and the newly added CDN domain name training samples. That is, a new round of iterative training is performed on the candidate domain name suffix extraction model of the current round based on the domain name training samples currently contained in the updated CDN training sample library to obtain a new round of candidate domain name suffix extraction model. Steps S34 and S35 are repeated until the preset iteration round is reached, or the prediction accuracy reaches the set threshold, and the trained domain name suffix extraction model is obtained.

[0130] Furthermore, the trained CDN domain name recognition model and domain name suffix extraction model are used to detect the domain name and determine whether the domain name is of the same origin.

[0131] In a specific implementation, the server obtains the domain name to be detected sent by the client and obtains a first feature of the domain name to be detected. The first feature of the domain name to be detected includes: a first statistical feature of the domain name to be detected and a first resolution feature of the domain name to be detected. The first statistical feature of the domain name to be detected represents a structural feature of the domain name to be detected, and the first resolution feature of the domain name to be detected represents an associated feature of the domain name to be detected extracted from the PDNS log.

[0132] Specifically, the server extracts the first domain name statistical feature of the domain name to be detected, extracts the first domain name resolution feature of the domain name to be detected based on the PDNS log, and obtains the first feature of the domain name to be detected according to the first domain name statistical feature of the domain name to be detected and the first domain name resolution feature of the domain name to be detected.

[0133] Specifically, a combination of one or more of the following features of the domain name to be detected can be extracted as the first domain name statistical feature of the domain name to be detected: whether the domain name to be detected contains a public top-level domain name, whether the domain name to be detected contains a popular field, the length of the block of the domain name to be detected, the number of subdomains of the domain name to be detected, the number of subdomains of the subdomains of the domain name to be detected that contain popular fields, the average block length of the subdomains of the domain name to be detected, etc. A combination of one or more of the following features of the domain name to be detected can be extracted from the PDNS log as the first domain name resolution feature of the domain name to be detected: in the PDNS log, the number of IP addresses corresponding to the domain name to be detected (i.e., the number of IP addresses pointed to by the domain name to be detected), the number of CNAMEs corresponding to the domain name to be detected, the number of other domain names resolved to the domain name to be detected, and the geographical distribution corresponding to the domain name to be detected, etc. The extracted first domain name statistical feature of the domain name to be detected and the first domain name resolution feature of the domain name to be detected are used as the first feature of the domain name to be detected.

[0134] S12: Input the first feature of the domain name to be detected into the CDN domain name recognition model to obtain a domain name recognition result.

[0135] During specific implementation, the server inputs the first feature of the domain name to be detected into the CDN domain name recognition model, and can predict whether the domain name to be detected is a CDN domain name.

[0136] S13. If it is determined that the domain name identification result is that the domain name to be detected is a CDN domain name, a second feature of the domain name to be detected is obtained.

[0137] In specific implementation, if the domain name identification result shows that the domain name to be detected is a real CDN domain name, the server obtains the candidate domain name suffix of the domain name to be detected, and obtains the second feature of the domain name to be detected based on the candidate domain name suffix of the domain name to be detected and the PDNS log.

[0138] The method for obtaining the candidate domain name suffix of the domain name to be detected refers to the method for obtaining the candidate domain name suffix of the CDN domain name training sample in step S31, which will not be described here.

[0139] Specifically, the second domain name statistical features of the domain name to be detected can be extracted based on the candidate domain name suffix of the domain name to be detected, and the second domain name resolution features of the domain name to be detected can be extracted in the PDNS log based on the candidate domain name suffix of the domain name to be detected. The second features of the domain name to be detected are obtained according to the second domain name statistical features of the domain name to be detected and the second domain name resolution features of the domain name to be detected.

[0140] During implementation, a combination of one or more of the following features of the domain name to be detected can be extracted as the second domain name statistical feature of the domain name to be detected: whether the candidate domain name prefix of the domain name to be detected contains a public top-level domain, whether the candidate domain name prefix of the domain name to be detected contains a popular field, the length of the block of the candidate domain name prefix of the domain name to be detected, the number of subdomains of the candidate domain name suffix of the domain name to be detected, the number of subdomains with popular prefixes in the subdomains of the candidate domain name suffix of the domain name to be detected, and the average block length of the subdomains of the candidate domain name suffix of the domain name to be detected. A combination of one or more of the following features of the domain name to be detected can be extracted from the PDNS log as the second domain name resolution feature of the domain name to be detected: the number of domain names corresponding to the candidate domain name suffix of the domain name to be detected, the number of CNAMEs corresponding to the candidate domain name suffix of the domain name to be detected, the number of IP addresses corresponding to the domain name to be detected, the number of CNAMEs corresponding to the domain name to be detected, the number of other domain names resolved to the domain name to be detected, and the geographical distribution corresponding to the domain name to be detected. The extracted second domain name statistical feature of the domain name to be detected and the second domain name resolution feature of the domain name to be detected are used as the second feature of the domain name to be detected.

[0141] S14. Input the second feature of the domain name to be detected into the domain name suffix extraction model to obtain the domain name suffix of the domain name to be detected.

[0142] During specific implementation, the server inputs the second feature of the domain name to be detected into the domain name suffix extraction model to obtain the predicted domain name suffix of the domain name to be detected.

[0143] S15. Search the preset blacklist and the preset whitelist for the domain name suffix of the domain name to be detected. If it is determined that the preset blacklist or the preset whitelist contains the CDN domain name with the same domain name suffix, it is determined that the domain name to be detected and the CDN domain name are of the same origin, and the domain name to be detected is added to the preset blacklist or the preset whitelist.

[0144] During specific implementation, the server sets a preset blacklist and a preset whitelist, wherein the preset blacklist stores the correspondence between the CDN domain names set as blacklist and their domain name suffixes, and the preset whitelist stores the correspondence between the CDN domain names set as whitelist and their domain name suffixes.

[0145] Specifically, after predicting the domain name suffix of the domain name to be detected, the domain name suffix of the domain name to be detected is searched in the preset blacklist and the preset whitelist. If the domain name suffix of the domain name to be detected is found in the preset blacklist, it is determined that the domain name to be detected and the CDN domain name corresponding to the domain name suffix in the preset blacklist are of the same domain name origin, and the domain name to be detected is added to the preset blacklist. If the domain name suffix of the domain name to be detected is found in the preset whitelist, it is determined that the domain name to be detected and the CDN domain name corresponding to the domain name suffix in the preset whitelist are of the same domain name origin, and the domain name to be detected is added to the preset whitelist, and the correspondence between the domain name to be detected and the domain name suffix is stored. Furthermore, the network traffic of the CDN domain name in the blacklist can be further intercepted.

[0146] In the domain name homology determination method provided in the embodiment of the present application, a domain name to be detected is obtained, and a first feature of the domain name to be detected is obtained. The first feature includes: a first domain name statistical feature and a first domain name resolution feature. The first domain name statistical feature of the domain name to be detected represents the structural feature of the domain name to be detected, and the first domain name resolution feature of the domain name to be detected represents the associated feature of the domain name to be detected extracted according to the PDNS log. The first feature of the domain name to be detected is input into the CDN domain name recognition model to obtain a domain name recognition result, wherein the CDN domain name recognition model is obtained by training according to a preset classification model based on the first feature of the domain name sample. If it is determined that the domain name recognition result is that the domain name to be detected is a CDN domain name, the second feature of the domain name to be detected is obtained. The second feature includes: a second domain name statistical feature and a second domain name resolution feature. The second domain name statistical feature of the domain name to be detected represents the structural features of the candidate domain name suffix and the candidate domain name prefix of the domain name to be detected. The second domain name resolution feature of the domain name to be detected represents the associated features of the domain name to be detected and the associated features of the candidate domain name suffix of the domain name to be detected extracted according to the PDNS log. Then, the second feature of the domain name to be detected is input into the domain name suffix extraction model to obtain the domain name suffix of the domain name to be detected, wherein the domain name suffix extraction model is obtained by training according to the preset classification model based on the second feature of the CDN domain name sample, and the domain name suffix of the domain name to be detected is searched in the preset blacklist and the preset whitelist respectively. If the preset If the blacklist or preset whitelist contains a CDN domain name with the same domain name suffix as the domain name to be detected, it is determined that the domain name to be detected and the CDN domain name are of the same domain name origin, and the domain name to be detected is added to the preset blacklist or preset whitelist, that is, the list to which the CDN domain name belongs. Compared with the prior art, in the embodiment of the present application, the first feature of the domain name sample is pre-trained according to the preset classification model to obtain a CDN domain name recognition model, and the second feature of the CDN domain name sample is trained to obtain a domain name suffix extraction model. The CDN domain name recognition model is first used to determine whether the domain name to be detected is a CDN domain name. If it is a CDN domain name, the domain name suffix extraction model is further used to extract the domain name suffix of the domain name to be detected. According to the domain name suffix found in the preset blacklist and preset whitelist, the domain name to be detected is added to the corresponding list. Since the training of the CDN domain name recognition model and the domain name suffix extraction model fully utilizes the statistical characteristics of the domain name and the resolution characteristics of the domain name extracted based on the PDNS log, the accuracy of the CDN domain name and domain name suffix prediction is improved, that is, the detection accuracy of the cloud service domain name and domain name suffix is improved. In addition, the CDN domain name is first identified for the domain name to be detected. If the domain name to be detected is a CDN domain name, the domain name suffix is extracted, which further improves the accuracy of the CDN domain name suffix detection, thereby improving the accuracy of the CDN domain name (that is, the cloud service domain name) homology determination.

[0147] Based on the same inventive concept, an embodiment of the present application also provides a domain name homology determination device. Since the principle of solving the problem by the above-mentioned domain name homology determination device is similar to that of the domain name homology determination method, the implementation of the above-mentioned device can refer to the implementation of the method, and the repeated parts will not be repeated.

[0148] like Figure 4 As shown, it is a schematic diagram of the structure of the domain name homology determination device provided by an embodiment of the present application, which may include:

[0149] A first feature extraction unit 41 is configured to obtain a domain name to be detected and obtain a first feature of the domain name to be detected, wherein the first feature includes: a first domain name statistical feature and a first domain name resolution feature, wherein the first domain name statistical feature of the domain name to be detected represents a structural feature of the domain name to be detected, and the first domain name resolution feature of the domain name to be detected represents an associated feature of the domain name to be detected extracted from a Passive Domain Name System (PDNS) log;

[0150] A domain name recognition unit 42 is configured to input the first feature of the domain name to be detected into a content delivery network (CDN) domain name recognition model to obtain a domain name recognition result, wherein the CDN domain name recognition model is trained according to a preset classification model based on the first feature of the domain name sample;

[0151] A second feature extraction unit 43 is configured to obtain a second feature of the domain name to be detected if it is determined that the domain name to be detected is a CDN domain name as a result of the domain name identification, the second feature comprising: a second domain name statistical feature and a second domain name resolution feature, the second domain name statistical feature of the domain name to be detected representing a structural feature of a candidate domain name suffix and a candidate domain name prefix of the domain name to be detected, and the second domain name resolution feature of the domain name to be detected representing an association feature of the domain name to be detected and an association feature of the candidate domain name suffix of the domain name to be detected extracted based on the PDNS log;

[0152] A domain name suffix extraction unit 44 is configured to input the second feature of the domain name to be detected into a domain name suffix extraction model to obtain the domain name suffix of the domain name to be detected, wherein the domain name suffix extraction model is trained according to the preset classification model based on the second feature of the CDN domain name sample;

[0153] The domain name homology determination unit 45 is used to search for the domain name suffix of the domain name to be detected in the preset blacklist and the preset whitelist respectively. If it is determined that the preset blacklist or the preset whitelist contains a CDN domain name with the same domain name suffix, it is determined that the domain name to be detected and the CDN domain name are of the same domain name origin, and the domain name to be detected is added to the preset blacklist or the preset whitelist.

[0154] In a possible implementation, the domain name samples include domain name training samples and domain name prediction samples;

[0155] The domain name identification unit 42 is specifically configured to train and obtain the CDN domain name identification model in the following manner: obtaining a first feature of the domain name training sample based on the PDNS log; performing a current round of iterative training on the first feature of the domain name training sample according to the preset classification model to obtain a candidate CDN domain name identification model; obtaining a first feature of the domain name prediction sample based on the PDNS log; inputting the first feature of the domain name prediction sample into the candidate CDN domain name identification model to perform domain name prediction and obtain a prediction result; determining the domain name prediction sample with an accurate prediction result as a newly added domain name training sample; performing a new round of iterative training on the candidate CDN domain name identification model based on the domain name training sample and the newly added domain name training sample until a preset iterative round is reached to obtain the CDN domain name identification model.

[0156] In a possible implementation, the CDN domain name samples include CDN domain name training samples and CDN domain name prediction samples;

[0157] The domain name suffix extraction unit 44 is specifically configured to train and obtain the domain name suffix extraction model in the following manner: obtaining candidate domain name suffixes of the CDN domain name training samples, and obtaining a second feature of the CDN domain name training samples based on the candidate domain name suffixes of the CDN domain name training samples and the PDNS log; performing a current round of iterative training according to the preset classification model based on the second feature of the CDN domain name training samples and the candidate domain name suffixes of the CDN domain name training samples to obtain a candidate domain name suffix extraction model; obtaining candidate domain name suffixes of the CDN domain name prediction samples, and obtaining a second feature of the CDN domain name prediction samples based on the candidate domain name suffixes of the CDN domain name prediction samples and the PDNS log; inputting the second feature of the CDN domain name prediction samples into the candidate domain name suffix extraction model to perform domain name suffix prediction and obtain a prediction result; determining the CDN domain name prediction samples with accurate prediction results as newly added CDN domain name training samples; and performing a new round of iterative training on the candidate domain name suffix extraction model based on the CDN domain name training samples and the newly added CDN domain name training samples until a preset iterative round is reached to obtain the domain name suffix extraction model.

[0158] In a possible embodiment, the domain name identification unit 42 is specifically used to extract the first domain name statistical feature of the domain name training sample, and extract the first domain name resolution feature of the domain name training sample based on the PDNS log, and obtain the first feature of the domain name training sample according to the first domain name statistical feature of the domain name training sample and the first domain name resolution feature of the domain name training sample; and extract the first domain name statistical feature of the domain name prediction sample, and extract the first domain name resolution feature of the domain name prediction sample based on the PDNS log, and obtain the first feature of the domain name prediction sample according to the first domain name statistical feature of the domain name prediction sample and the first domain name resolution feature of the domain name prediction sample.

[0159] In a possible implementation, the domain name suffix extraction unit 44 is specifically configured to extract the second domain name statistical feature of the CDN domain name training sample based on the candidate domain name suffix of the CDN domain name training sample, and extract the second domain name resolution feature of the CDN domain name training sample in the PDNS log based on the candidate domain name suffix of the CDN domain name training sample, and obtain the second feature of the CDN domain name training sample based on the second domain name statistical feature of the CDN domain name training sample and the second domain name resolution feature of the CDN domain name training sample; and extract the second domain name statistical feature of the CDN domain name prediction sample based on the candidate domain name suffix of the CDN domain name prediction sample, and extract the second domain name resolution feature of the CDN domain name prediction sample in the PDNS log based on the candidate domain name suffix of the CDN domain name prediction sample, and obtain the second feature of the CDN domain name prediction sample based on the second domain name statistical feature of the CDN domain name prediction sample and the second domain name resolution feature of the CDN domain name prediction sample.

[0160] In a possible implementation, the domain name suffix extraction unit 44 is specifically configured to extract the domain name suffix of each CDN domain name training sample; and combine the sub-blocks except the first sub-block in the domain name training sample prefix with the domain name suffix in sequence according to the adjacency principle to obtain a candidate domain name suffix corresponding to the CDN domain name training sample.

[0161] Based on the same technical concept, the embodiment of the present application further provides an electronic device 500, referring to Figure 5 As shown, the electronic device 500 is used to implement the domain name homology determination method described in the above method embodiment. The electronic device 500 of this embodiment may include: a memory 501, a processor 502, and a computer program stored in the memory and executable on the processor, such as a domain name homology determination program. When the processor executes the computer program, the steps in each of the above domain name homology determination method embodiments are implemented, such as Figure 1Alternatively, when the processor executes the computer program, the functions of the modules / units in the above-mentioned device embodiments are realized, such as step S11.

[0162] The specific connection medium between the memory 501 and the processor 502 is not limited in the embodiment of the present application. Figure 5 In the embodiment, the memory 501 and the processor 502 are connected via a bus 503. The bus 503 is connected to the processor 502 via a bus 503. Figure 5 The bus 503 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or one type of bus.

[0163] Memory 501 may be a volatile memory, such as random-access memory (RAM); a non-volatile memory, such as read-only memory, flash memory, a hard disk drive (HDD), or a solid-state drive (SSD); or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. Memory 501 may be a combination of the above memories.

[0164] Processor 502 is used to implement Figure 1 A domain name homology determination method shown includes:

[0165] The processor 502 is configured to call the computer program stored in the memory 501 to execute the following Figure 1 Steps S11 to S15 shown in FIG.

[0166] An embodiment of the present application also provides a computer-readable storage medium that stores computer-executable instructions required to execute the above-mentioned processor, which includes a program required to execute the above-mentioned processor.

[0167] In some possible implementations, various aspects of the domain name homology determination method provided in the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on an electronic device, the program code is used to enable the electronic device to execute the steps of the domain name homology determination method according to various exemplary embodiments of the present application described above in this specification. For example, the electronic device may execute the following steps: Figure 1 Steps S11 to S15 shown in FIG.

[0168] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0169] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (apparatus), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0170] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0171] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0172] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0173] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for determining domain name homology, characterized in that: include: Obtaining a domain name to be detected, and obtaining a first feature of the domain name to be detected, the first feature including: a first domain name statistical feature and a first domain name resolution feature, the first domain name statistical feature of the domain name to be detected representing a structural feature of the domain name to be detected, the first domain name resolution feature of the domain name to be detected representing an associated feature of the domain name to be detected extracted based on a passive domain name system (PDNS) log, the associated feature of the domain name to be detected including at least a combination of one or more of the following features: the number of network protocol IP addresses corresponding to the domain name to be detected, the number of canonical names (CNAMEs) corresponding to the domain name to be detected, the number of other domain names resolved to the domain name to be detected, and the geographical distribution corresponding to the domain name to be detected; Inputting the first feature of the domain name to be detected into a content delivery network (CDN) domain name recognition model to obtain a domain name recognition result, wherein the CDN domain name recognition model is trained according to a preset classification model based on the first feature of the domain name sample; If it is determined that the domain name identification result is that the domain name to be detected is a CDN domain name, a second feature of the domain name to be detected is obtained, and the second feature includes: a second domain name statistical feature and a second domain name resolution feature, the second domain name statistical feature of the domain name to be detected represents the structural features of the candidate domain name suffix and the candidate domain name prefix of the domain name to be detected, and the second domain name resolution feature of the domain name to be detected represents the association features of the domain name to be detected and the association features of the candidate domain name suffix of the domain name to be detected extracted according to the PDNS log, and the association features of the candidate domain name suffix of the domain name to be detected include at least one or more of the following features: the number of domain names corresponding to the candidate domain name suffix of the domain name to be detected and the number of CNAMEs corresponding to the candidate domain name suffix of the domain name to be detected; the candidate domain name suffix of the domain name to be detected is obtained in the following manner: extract the domain name suffix of the domain name to be detected, and combine the other sub-blocks except the first sub-block in the domain name prefix to be detected with the domain name suffix of the domain name to be detected in sequence according to the adjacent principle to obtain the candidate domain name suffix of the domain name to be detected; Inputting the second feature of the domain name to be detected into a domain name suffix extraction model to obtain the domain name suffix of the domain name to be detected, wherein the domain name suffix extraction model is trained according to the preset classification model based on the second feature of the CDN domain name sample; The domain name suffix of the domain name to be detected is searched in a preset blacklist and a preset whitelist respectively. If it is determined that the preset blacklist or the preset whitelist contains a CDN domain name with the same domain name suffix, it is determined that the domain name to be detected and the CDN domain name are of the same domain name origin, and the domain name to be detected is added to the preset blacklist or the preset whitelist.

2. The method according to claim 1, wherein The domain name samples include domain name training samples and domain name prediction samples; The CDN domain name recognition model is trained by the following method: Obtaining a first feature of the domain name training sample based on the PDNS log; Performing iterative training on the first feature of the domain name training sample in the current round according to the preset classification model to obtain a candidate CDN domain name recognition model; Obtaining a first feature of the domain name prediction sample based on the PDNS log; Inputting the first feature of the domain name prediction sample into the candidate CDN domain name recognition model to perform domain name prediction and obtain a prediction result; The domain name prediction samples with accurate prediction results are determined as new domain name training samples; A new round of iterative training is performed on the candidate CDN domain name recognition model according to the domain name training samples and the newly added domain name training samples until a preset iterative round is reached to obtain the CDN domain name recognition model.

3. The method according to claim 1, wherein The CDN domain name samples include CDN domain name training samples and CDN domain name prediction samples; The domain name suffix extraction model is trained in the following way: Obtaining a candidate domain name suffix of the CDN domain name training sample, and obtaining a second feature of the CDN domain name training sample based on the candidate domain name suffix of the CDN domain name training sample and the PDNS log; Performing a current round of iterative training according to the preset classification model based on the second feature of the CDN domain name training sample and the candidate domain name suffixes of the CDN domain name training sample to obtain a candidate domain name suffix extraction model; Obtaining a candidate domain name suffix of the CDN domain name prediction sample, and obtaining a second feature of the CDN domain name prediction sample based on the candidate domain name suffix of the CDN domain name prediction sample and the PDNS log; Inputting the second feature of the CDN domain name prediction sample into the candidate domain name suffix extraction model to perform domain name suffix prediction to obtain a prediction result; Determine the CDN domain name prediction samples with accurate prediction results as new CDN domain name training samples; A new round of iterative training is performed on the candidate domain name suffix extraction model according to the CDN domain name training samples and the newly added CDN domain name training samples until a preset iterative round is reached to obtain the domain name suffix extraction model.

4. The method according to claim 2, wherein Obtaining a first feature of the domain name training sample based on the PDNS log specifically includes: Extracting a first domain name statistical feature of the domain name training sample, and extracting a first domain name resolution feature of the domain name training sample based on the PDNS log, and obtaining a first feature of the domain name training sample according to the first domain name statistical feature of the domain name training sample and the first domain name resolution feature of the domain name training sample; and Obtaining a first feature of the domain name prediction sample based on the PDNS log specifically includes: Extract the first domain name statistical feature of the domain name prediction sample, and extract the first domain name resolution feature of the domain name prediction sample based on the PDNS log, and obtain the first feature of the domain name prediction sample according to the first domain name statistical feature of the domain name prediction sample and the first domain name resolution feature of the domain name prediction sample.

5. The method according to claim 3, wherein Obtaining a second feature of the CDN domain name training sample based on the candidate domain name suffix of the CDN domain name training sample and the PDNS log specifically includes: Extracting a second domain name statistical feature of the CDN domain name training sample based on the candidate domain name suffix of the CDN domain name training sample, extracting a second domain name resolution feature of the CDN domain name training sample in the PDNS log based on the candidate domain name suffix of the CDN domain name training sample, and obtaining a second feature of the CDN domain name training sample based on the second domain name statistical feature of the CDN domain name training sample and the second domain name resolution feature of the CDN domain name training sample; and Obtaining a second feature of the CDN domain name prediction sample based on the candidate domain name suffix of the CDN domain name prediction sample and the PDNS log specifically includes: A second domain name statistical feature of the CDN domain name prediction sample is extracted based on the candidate domain name suffix of the CDN domain name prediction sample, and a second domain name resolution feature of the CDN domain name prediction sample is extracted in the PDNS log based on the candidate domain name suffix of the CDN domain name prediction sample. The second feature of the CDN domain name prediction sample is obtained according to the second domain name statistical feature of the CDN domain name prediction sample and the second domain name resolution feature of the CDN domain name prediction sample.

6. The method according to claim 3 or 5, wherein: Obtaining the candidate domain name suffix of the CDN domain name training sample specifically includes: For each CDN domain name training sample, extract the domain name suffix of the CDN domain name training sample; The sub-blocks except the first sub-block in the prefix of the CDN domain name training sample are sequentially combined with the domain name suffix according to the adjacent principle to obtain a candidate domain name suffix corresponding to the CDN domain name training sample.

7. A domain name homology determination device, characterized in that: include: a first feature extraction unit, configured to obtain a domain name to be detected and obtain a first feature of the domain name to be detected, wherein the first feature includes: a first domain name statistical feature and a first domain name resolution feature, wherein the first domain name statistical feature of the domain name to be detected represents a structural feature of the domain name to be detected, and the first domain name resolution feature of the domain name to be detected represents an associated feature of the domain name to be detected extracted based on a passive domain name system (PDNS) log, wherein the associated feature of the domain name to be detected includes at least a combination of one or more of the following features: the number of network protocol IP addresses corresponding to the domain name to be detected, the number of canonical names (CNAMEs) corresponding to the domain name to be detected, the number of other domain names resolved to the domain name to be detected, and the geographical distribution corresponding to the domain name to be detected; A domain name recognition unit, configured to input the first feature of the domain name to be detected into a content delivery network (CDN) domain name recognition model to obtain a domain name recognition result, wherein the CDN domain name recognition model is trained according to a preset classification model based on the first feature of the domain name sample; A second feature extraction unit is configured to obtain a second feature of the domain name to be detected if it is determined that the domain name identification result is that the domain name to be detected is a CDN domain name, the second feature including: a second domain name statistical feature and a second domain name resolution feature, the second domain name statistical feature of the domain name to be detected representing structural features of the candidate domain name suffix and the candidate domain name prefix of the domain name to be detected, the second domain name resolution feature of the domain name to be detected representing the association features of the domain name to be detected and the association features of the candidate domain name suffix of the domain name to be detected extracted according to the PDNS log, the association features of the candidate domain name suffix of the domain name to be detected including at least one or more of the following features: the number of domain names corresponding to the candidate domain name suffix of the domain name to be detected and the number of CNAMEs corresponding to the candidate domain name suffix of the domain name to be detected; the candidate domain name suffix of the domain name to be detected is obtained by extracting the domain name suffix of the domain name to be detected, and combining the sub-blocks except the first sub-block in the domain name prefix to be detected with the domain name suffix of the domain name to be detected in sequence according to the adjacent principle to obtain the candidate domain name suffix of the domain name to be detected; A domain name suffix extraction unit, configured to input the second feature of the domain name to be detected into a domain name suffix extraction model to obtain the domain name suffix of the domain name to be detected, wherein the domain name suffix extraction model is trained according to the preset classification model based on the second feature of the CDN domain name sample; The domain name homology determination unit is used to search for the domain name suffix of the domain name to be detected in a preset blacklist and a preset whitelist respectively. If it is determined that the preset blacklist or the preset whitelist contains a CDN domain name with the same domain name suffix, it is determined that the domain name to be detected and the CDN domain name are of the same domain name origin, and the domain name to be detected is added to the preset blacklist or the preset whitelist.

8. The device according to claim 7, wherein The domain name samples include domain name training samples and domain name prediction samples; The domain name recognition unit is specifically configured to train and obtain the CDN domain name recognition model by: obtaining a first feature of the domain name training sample based on the PDNS log; Performing iterative training on the first feature of the domain name training sample in the current round according to the preset classification model to obtain a candidate CDN domain name recognition model; obtaining the first feature of the domain name prediction sample based on the PDNS log; Inputting the first feature of the domain name prediction sample into the candidate CDN domain name recognition model to perform domain name prediction to obtain a prediction result; determining the domain name prediction sample with an accurate prediction result as a new domain name training sample; A new round of iterative training is performed on the candidate CDN domain name recognition model according to the domain name training samples and the newly added domain name training samples until a preset iterative round is reached to obtain the CDN domain name recognition model.

9. The device according to claim 7, wherein The CDN domain name samples include CDN domain name training samples and CDN domain name prediction samples; The domain name suffix extraction unit is specifically configured to train the domain name suffix extraction model by: obtaining a candidate domain name suffix of the CDN domain name training sample, and obtaining a second feature of the CDN domain name training sample based on the candidate domain name suffix of the CDN domain name training sample and the PDNS log; Based on the second feature of the CDN domain name training sample and the candidate domain name suffix of the CDN domain name training sample, the current round of iterative training is performed according to the preset classification model to obtain a candidate domain name suffix extraction model; the candidate domain name suffix of the CDN domain name prediction sample is obtained, and the second feature of the CDN domain name prediction sample is obtained based on the candidate domain name suffix of the CDN domain name prediction sample and the PDNS log; the second feature of the CDN domain name prediction sample is input into the candidate domain name suffix extraction model to perform domain name suffix prediction and obtain a prediction result; the CDN domain name prediction sample with an accurate prediction result is determined as a new CDN domain name training sample; a new round of iterative training is performed on the candidate domain name suffix extraction model based on the CDN domain name training sample and the new CDN domain name training sample until a preset iterative round is reached to obtain the domain name suffix extraction model.

10. The device according to claim 8, wherein The domain name identification unit is specifically configured to extract a first domain name statistical feature of the domain name training sample, extract a first domain name resolution feature of the domain name training sample based on the PDNS log, and obtain a first feature of the domain name training sample based on the first domain name statistical feature of the domain name training sample and the first domain name resolution feature of the domain name training sample; And extract the first domain name statistical feature of the domain name prediction sample, and extract the first domain name resolution feature of the domain name prediction sample based on the PDNS log, and obtain the first feature of the domain name prediction sample according to the first domain name statistical feature of the domain name prediction sample and the first domain name resolution feature of the domain name prediction sample.

11. The device according to claim 9, wherein The domain name suffix extraction unit is specifically configured to extract a second domain name statistical feature of the CDN domain name training sample based on the candidate domain name suffix of the CDN domain name training sample, extract a second domain name resolution feature of the CDN domain name training sample in the PDNS log based on the candidate domain name suffix of the CDN domain name training sample, and obtain a second feature of the CDN domain name training sample based on the second domain name statistical feature of the CDN domain name training sample and the second domain name resolution feature of the CDN domain name training sample; And based on the candidate domain name suffix of the CDN domain name prediction sample, the second domain name statistical feature of the CDN domain name prediction sample is extracted, and based on the candidate domain name suffix of the CDN domain name prediction sample, the second domain name resolution feature of the CDN domain name prediction sample is extracted in the PDNS log, and the second feature of the CDN domain name prediction sample is obtained according to the second domain name statistical feature of the CDN domain name prediction sample and the second domain name resolution feature of the CDN domain name prediction sample.

12. The device according to claim 9 or 11, characterized in that The domain name suffix extraction unit is specifically used to extract the domain name suffix of each CDN domain name training sample; combine the other sub-blocks except the first sub-block in the CDN domain name training sample prefix with the domain name suffix in sequence according to the adjacent principle to obtain the candidate domain name suffix corresponding to the CDN domain name training sample.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the domain name homology determination method according to any one of claims 1 to 6 is implemented.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the domain name homology determination method according to any one of claims 1 to 6 are implemented.

Images