Domain name resolution method and device based on domain name request risk management and control

Abstract

The application discloses a domain name resolution method and device based on domain name request risk management and control, the method comprises the following steps: identifying domain name requests as normal domain name requests or abnormal domain name requests; according to the user domain name access behavior data set and the abnormal domain name association strength, evaluating the security rating and the security score of the user; sending the normal domain name requests initiated by users with different security ratings to the DNS server subset cluster corresponding to their levels, so that the DNS server subset cluster of the level responds to the normal domain name requests in order based on the security score; predicting the normal domain names with high probability of access to form a domain name resource list, which is used to cache the domain name resource list to the selected DNS server when the security rating of the user is higher than the set threshold, so as to improve the domain name resolution cache hit rate and the resolution efficiency. The application solves the problem of reduced performance of the domain name server caused by the low utilization rate of the conventional DNS server due to the zombie network attack.

Description

Technical Field

[0001] This article relates to the field of domain name resolution technology, and in particular to a domain name resolution method and device based on domain name request risk management. Background Technology

[0002] The stable operation of the Domain Name System (DNS) heavily relies on the security and reliability of its DNS resolution service. Therefore, DNS server resolution is often combined with intrusion detection technology. Currently, intrusion detection systems monitor network traffic, providing a degree of protection for the underlying DNS resolution system. However, due to the sheer size of the DNS system, intrusion detection systems gradually consume their available processing power when facing attacks such as botnets, leading to false positives or false negatives in request traffic and impacting subsequent legitimate DNS resolution services.

[0003] RFC 4732 details denial-of-service attacks and their potential harms. One such attack attempts to cause network congestion on the DNS server's connection, preventing the DNS server from responding. Such attacks can result in denial of service to legitimate users and severely reduced DNS server utilization. Therefore, to effectively address the risks of domain name request-based attacks, it is necessary not only to monitor request traffic beforehand but also to manage the risks of the DNS resolution service afterwards, thereby ensuring the server performance and service quality of the domain name resolution system. Summary of the Invention

[0004] This invention discloses a domain name resolution method and apparatus based on domain name request risk control, in order to solve the problem of domain name server performance degradation caused by botnet attacks and low cache utilization of conventional DNS servers, and provides an engineering implementation architecture.

[0005] To achieve the above objectives, the technical content of the present invention includes:

[0006] According to a first aspect of the embodiments of this application, a domain name resolution method based on domain name request risk control is provided, the method comprising:

[0007] Based on the domain name requests received by the domain name resolution cluster from users, the domain name requests are identified as normal domain name requests or abnormal domain name requests, user domain name access behavior data is collected and stored in the domain name access behavior database; wherein, the domain name access behavior database contains a set of user domain name access behavior data for several users.

[0008] Based on the density distribution of data in the user domain access behavior database, the number of user security ratings is determined. Then, based on the strength of the association between the user domain access behavior data set and the abnormal domains, the user's security rating and security score are evaluated.

[0009] Based on the user domain name access behavior data set, predict the normal domain names that are likely to be accessed and form a domain name resource list; wherein, the domain name resource list is used to select one or more DNS servers in the DNS server sub-cluster corresponding to the user level according to the user's security rating and geographical location information when the user's security rating is higher than a set threshold, and load the domain name resource list into the DNS server to improve the domain name resolution cache hit rate and resolution efficiency.

[0010] Based on the user's security rating, normal domain name requests initiated by users with different security ratings are sent to the DNS server sub-clusters corresponding to their respective levels. This allows the DNS server sub-clusters of each level to respond to the normal domain name requests sequentially based on the security score, prioritizing those with higher security scores. The levels of the DNS server sub-clusters are determined according to the user's security rating, and the computing power and security protection level of each sub-cluster increase or decrease as the level rises or falls. At the same time, computing resources are isolated between users with different ratings.

[0011] Furthermore, the step of identifying user domain name requests as normal or abnormal requests based on the domain name resolution cluster, collecting user domain name access behavior data, and storing it in the domain name access behavior database includes:

[0012] The domain name data of the domain name request is filtered by k hash functions used by the Bloom filter to identify normal domain name requests and suspected abnormal domain name requests.

[0013] By vectorizing the domain names in suspected abnormal domain name requests, the suspected abnormal domain names are represented as a two-dimensional tensor sequence;

[0014] For the two-dimensional tensor sequence, information at different scales is extracted by multiple convolutional kernels, and the information at different scales is fused by concatenation to obtain a fused representation; wherein, after each convolution, nonlinearization is performed by the ReLU activation function, and downsampling is performed by max pooling;

[0015] The fused multidimensional tensor is flattened into a one-dimensional vector, which is then input into multiple fully connected layers. The output of these fully connected layers is nonlinearized using ReLU and then input into a fully connected layer to obtain a layer containing several nodes.

[0016] The argmax function is used to determine whether the suspected abnormal domain name is a normal domain name request or an abnormal domain name request.

[0017] Collect user domain access behavior data for both normal and abnormal domain requests, and store it in the domain access behavior database.

[0018] Furthermore, the step of identifying user domain name requests as normal or abnormal requests based on the domain name resolution cluster, collecting user domain name access behavior data, and storing it in the domain name access behavior database also includes:

[0019] Intercept requests for abnormal domain names.

[0020] Furthermore, the step of assessing the user's security rating and security score based on the correlation between the user's domain access behavior data set and the abnormal domains includes:

[0021] Obtain user behavior data from the user domain access behavior data set; wherein, the user behavior data includes: IP address, region, access domain name, and access time;

[0022] Based on the user behavior data, the frequency of user access to abnormal domains and the characteristics of the accessed domains are obtained; based on the frequency of user access to the abnormal domains and the characteristics of the accessed domains, a user security assessment model based on random forest is constructed.

[0023] By inputting the frequency of a user's access to abnormal domains and the characteristics of the abnormal domains accessed into the user security assessment model, the user's security score and security rating are obtained.

[0024] Furthermore, the step of predicting high-probability accessed normal domains based on the user domain access behavior data set to form a domain resource list includes:

[0025] A user domain access behavior matrix is ​​constructed based on the access behavior data corresponding to normal domain requests in the user domain access behavior data set.

[0026] The user domain name access behavior matrix is ​​decomposed using the alternating least squares (ALS) matrix decomposition method to obtain the user feature matrix and the domain name feature matrix.

[0027] By organizing the domain name feature matrix, we can obtain the IP address and port number that issued the DNS request, the requested domain name, and the number of requests.

[0028] The IP address and port number that make the DNS request are considered as users, the requested domain name is considered as an item, the number of requests is considered as a rating, and a collaborative filtering recommendation algorithm is used to predict normal domain names that are highly likely to be accessed.

[0029] A list of domain name resources is formed based on the normal domain names that are accessed with a high probability.

[0030] According to a second aspect of the embodiments of this application, a domain name resolution device based on domain name request risk control is provided, the device comprising:

[0031] The domain name detection module is used to collect user domain name access behavior data based on the domain name requests received by the domain name resolution cluster, and after identifying the domain name requests as normal or abnormal domain name requests, store them in the domain name access behavior database; wherein, the domain name access behavior database contains a set of user domain name access behavior data of several users;

[0032] The user security assessment module is used to determine the number of user security ratings based on the density distribution of data in the user domain access behavior database, and then assess the user's security rating and security score based on the strength of the association between the user domain access behavior data set and the abnormal domains.

[0033] The domain name access prediction module is used to predict normal domain names with a high probability of being accessed based on the user domain name access behavior data set, and form a domain name resource list.

[0034] The domain name resource scheduling module is used for:

[0035] Based on the user assessment results provided by the user security assessment module, normal domain name requests initiated by users with different security ratings are sent to the DNS server sub-clusters corresponding to their respective ratings. This allows the DNS server sub-clusters to respond to the normal domain name requests sequentially based on the principle of prioritizing higher security scores. The ratings of the DNS server sub-clusters are determined based on user security ratings, and the computing power and security protection level of each sub-cluster increase with the rating. At the same time, computing resources are isolated between users with different ratings.

[0036] Based on the domain name resource list provided by the domain name access prediction module, if the user's security rating is higher than a set threshold, one or more DNS servers in the DNS server sub-cluster that are geographically close to the user and correspond to the user's level are selected based on the user's security rating and geographical location information. The domain name resource list is then loaded into the DNS server to improve the domain name resolution cache hit rate and resolution efficiency.

[0037] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the methods described above.

[0038] The present invention also provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program, which is loaded and executed by the processor to implement any of the methods described above.

[0039] The technical solutions provided by the embodiments of the present invention have the following beneficial effects:

[0040] 1. Unlike traditional single-mode DGA domain name detection models, this invention combines a Bloom filter with the DGA domain name detection model. Leveraging the rapid filtering capabilities of Bloom filters and based on whitelist information, it can quickly filter out the majority of normal domain names from massive domain name requests, only forwarding suspected anomalies. This significantly reduces the load on subsequent DGA domain name detection models and improves system performance. Therefore, it can better handle the problem of massive DNS request concurrency in real-world production environments.

[0041] 2. This invention proposes a DNS server cluster isolation partitioning strategy based on user security assessment, which matches users with different security ratings into different DNS server sub-clusters. This effectively isolates the domain name resolution resources used by high-risk users from those used by safe users, reduces the risk of the entire DNS server cluster being attacked by external forces, and improves system security.

[0042] 3. This invention applies a collaborative filtering model, which is widely used in the field of search recommendation, to predict user domain name access. It pre-schedules domain name resources that are likely to be accessed to the DNS server cache, which helps to improve the domain name resolution cache hit rate, better explore the performance of the DNS server, and solve the problem of reduced DNS server performance caused by low cache utilization.

[0043] 4. This invention proposes a hierarchical response strategy for domain name resolution based on user security assessment. Unlike the traditional approach of treating all DNS server clusters equally, this strategy prioritizes the domain name resolution needs of high-security users. When resolution resources are scarce, it helps to reduce the impact on the user experience of domain name resolution services for high-security users and improve service quality.

[0044] 5. This invention proposes a domain name resolution method based on domain name request risk management from five dimensions: domain name data security, user security, system security, system performance and service quality assurance. It can better address issues that DNS server clusters may face in real production environments, such as botnets, network attacks, low cache hit rates, low server utilization, and dangerous users crowding out normal users' resources, thereby improving the security and performance of DNS clusters in multiple dimensions. Attached Figure Description

[0045] Figure 1 This is a flowchart illustrating a domain name resolution method based on domain name request risk control proposed in an embodiment of this application.

[0046] Figure 2 This is an architecture diagram of a domain name resolution system based on domain name request risk management proposed in an embodiment of this application.

[0047] Figure 3 This is a flowchart illustrating the domain name detection module proposed in an embodiment of this application.

[0048] Figure 4 This is a flowchart of the workflow of a DGA domain name detection model proposed in an embodiment of this application.

[0049] Figure 5 This is a flowchart illustrating the user security assessment module proposed in an embodiment of this application.

[0050] Figure 6 This is a flowchart illustrating the domain name access prediction module proposed in an embodiment of this application.

[0051] Figure 7 This is a flowchart illustrating the domain name resource scheduling module proposed in an embodiment of this application. Detailed Implementation

[0052] The technical solutions of the present invention will be fully described below with reference to the accompanying drawings.

[0053] The domain name resolution method of this invention performs anomaly detection on domain name request data sent by user terminals, identifies normal domain name requests and abnormal domain name requests, and records user domain name access behavior data in a database. Secondly, based on the user domain name access behavior data, a user security assessment model is established to assign security ratings and scores to users. Then, the DNS server cluster is divided into multi-level sub-clusters, and a domain name resolution service capacity allocation algorithm based on user security ratings is constructed. Normal domain name requests initiated by each user are sent to the DNS server sub-cluster matching their security rating, and resolution responses are performed based on the principle of prioritizing users with higher security ratings. Furthermore, a user domain name resource access prediction model is established to predict domain names that users are highly likely to access. Finally, a domain name cache resource scheduling model is established to pre-cache domain name resources that high-security-rated users are highly likely to access in domain name servers near the user, improving the cache hit rate.

[0054] Specifically, such as Figure 1 As shown, the present invention includes the following process: Step S110 performs anomaly detection on the domain name request data sent by the user terminal and identifies normal domain name requests and abnormal domain name requests.

[0055] In one example, this invention performs anomaly detection on domain name request data sent by user terminals. Using a whitelist-based Bloom filter, domain name requests are categorized into normal domain name requests and suspected abnormal domain name requests. Subsequently, a deep learning-based DGA domain name detection model is used to further classify suspected abnormal domain name requests into normal domain names and 14 categories of DGA abnormal domain names.

[0056] Step S120: Normal domain name requests are returned to the DNS server for resolution, abnormal domain name requests are intercepted, and user domain name access behavior data is recorded in the database.

[0057] Step S130: Obtain user domain access behavior data and assess the user's security rating and security score.

[0058] In one example, the present invention obtains user behavior data from the database, constructs a user security assessment model based on random forest by the frequency of users' access to abnormal domains and the characteristics of the accessed domains, and performs security rating and user security score on the user's situation.

[0059] Step S140: Send the user's normal domain name request to the DNS server cluster that matches its security rating and resolve the request.

[0060] In one example, the present invention divides the DNS server cluster into multi-level sub-clusters, constructs a domain name resolution service capability allocation algorithm based on user security rating results, and assigns users of different levels to DNS server sub-clusters that match their security ratings for service. At the same time, for each DNS server, based on the user security score results, it responds to normal domain name requests initiated by users in sequence according to the principle of prioritizing higher security scores.

[0061] Step S150: Predict a list of normal domain name resources with a high probability of being accessed based on the user domain name access behavior data set.

[0062] In one example, the present invention constructs a user domain name resource access prediction model using user domain name access behavior data, including multi-dimensional information such as IP address ranges, regions, user groups, access targets, and resource consumption, to predict normal domain names that users are likely to access and to form a domain name resource list.

[0063] Step S160: When a user's security rating is higher than a set threshold, load the user's domain name resource list into the DNS server near the user.

[0064] In one example, when a user's security rating is higher than a set threshold, a domain name caching resource scheduling algorithm is used to schedule and cache the list of domain name resources that the user is likely to access to in a DNS server near the user. This ensures the service quality for users with high security ratings while improving the resolution hit rate and resolution efficiency.

[0065] Those skilled in the art should understand that, Figure 1 The steps S110 to S160 in the flowchart are not necessarily executed sequentially according to the arrow indications; these steps are not strictly performed in order. Furthermore, Figure 1Each step in the process can contain multiple sub-parts, which are not limited to being executed at the same time, nor are there any strict order restrictions on the execution of the sub-parts.

[0066] Corresponding to the above methods, such as Figure 2 As shown, another embodiment of the present invention also provides a domain name resolution device based on domain name request risk control, including: a domain name detection module, a user security assessment module, a domain name access prediction module, and a domain name resource scheduling module, wherein,

[0067] The domain name detection module, upon receiving domain name request data from the user terminal, performs anomaly detection on the domain name, distinguishing between normal and abnormal domain name requests. Normal domain name requests are returned to the DNS server for further resolution, while abnormal domain name requests are blocked. The user's domain name access behavior data is also recorded in the database.

[0068] The user security assessment module acquires and processes user domain name access behavior data from the database, periodically performs security ratings and scores on users, and sends the assessment results to the DNS server cluster and domain name resource scheduling module.

[0069] The domain name access prediction module acquires a set of user domain name access behavior data, calculates the normal domain names that users are likely to access within a set time window in the future based on the user's access behavior data for normal domain name requests, and periodically generates a list of domain name resources and pushes it to the domain name resource scheduling module.

[0070] The domain name resource scheduling module, on the one hand, based on the user's security rating and score, uses a domain name resolution service capacity allocation algorithm to allocate normal domain name requests initiated by the user to the DNS server sub-cluster corresponding to their security rating to obtain resolution services. The DNS server responds to the resolution based on the principle of prioritizing users with high security scores. On the other hand, based on the user's security rating and geographical location information, the domain name resource table that the user is likely to access is cached in the DNS server near the user and that matches their security rating, thereby improving the domain name resolution cache hit rate and resolution efficiency.

[0071] The working principles of the domain name detection module, user security assessment module, domain name access prediction module, and domain name resource scheduling module are described in detail below.

[0072] Domain name detection module, such as Figure 3As shown: The domain name data in the domain name request message sent by the user is verified using a two-layer architecture of Bloom filter and DGA domain name detection model based on deep learning. Step S220 specifically includes: Bloom filter is a data structure based on hash function, which has significant advantages in terms of time and space, and has constant-level query time complexity, and can be used as a preliminary verification to improve the efficiency of domain name detection. On the other hand, high-frequency access domain names provided by Alexa are often considered normal domain names, so the Alexa frequently accessed TOP10000 domain names are used as a whitelist. For the obtained domain name request message, the domain name data is quickly filtered by k hash functions used by the Bloom filter. When determining whether a domain name data is a normal domain name request, if the Bloom filter determines that it is in the whitelist, it is directly judged as a normal domain name request and no processing is performed; otherwise, it is a suspected abnormal domain name request, and the subsequent DGA domain name detection model is used for further judgment.

[0073] Step S230 specifically includes identifying DGA domains through domain name character features, which is one of the main methods for existing DGA domain name detection. To obtain the structured features between DGA domain name characters, this method uses the N-gram model, commonly used in Natural Language Processing (NLP), to vectorize the domain name. Ngram is a statistical language model that predicts the nth language element based on n-1 language elements, and can lightweightly capture the co-occurrence and sequence relationship features between language elements. The size of n is often between 1 and 5. Since the length of a domain name string is often within 20 characters, bigram is chosen as the encoding method, which can preserve the structured information of the domain name to a certain extent while extracting the relative relationships between characters within the domain name words. There are 38 possible values ​​for characters in a domain name ('0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', ​​'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', '-', '.'), meaning there are 38 * 38 = 144 possible values ​​for a bigram. Considering that DNS domain names are all much shorter than 255 characters, each domain name is represented as a 1444 * 64 two-dimensional tensor.

[0074] Convolutional neural networks are widely used in image recognition, effectively extracting local features from images without being affected by the image's orientation. For example... Figure 4As shown, in this method, the DGA domain name detection model takes a two-dimensional tensor based on bigram encoding as input and uses a convolutional neural network to extract intra-word local features from the domain name sequence. Simultaneously, the local translation invariance of the convolutional neural network helps the model's judgment to be unaffected by the position of features within the domain name characters. In the feature extraction stage using convolutional operations, it is not a simple stacking of multiple convolutional layers, but rather multiple convolutional kernels extract information at different scales, and then these parts of information are fused through concatenation to obtain a better representation. After each convolution, the model is non-linearized using the ReLU activation function, and downsampled using max pooling for feature selection and data dimensionality reduction. After fusion, the multi-dimensional tensor is flattened into a one-dimensional vector by Flatten and input into a series of fully connected layers to integrate and classify the collected domain name features. Each fully connected layer includes a Dropout function to prevent overfitting. The output of the multi-layer fully connected layers is non-linearized using ReLU and then input into another fully connected layer, resulting in a layer with 15 nodes (corresponding to normal domain names and 14 types of DGA domain names). Finally, the argmax function is used to determine the label of the category to which the input domain name most likely belongs (where 0 represents a normal domain name and 1-14 represent DGA domain names).

[0075] The domain name detection module performs anomaly detection on the received domain name data. Normal domain names filtered by the Bloom filter are not processed; their requests are returned to the DNS server for further resolution. For DGA domain name detection model classification results, domain names with a label of 0 are identified as normal, while those with labels 1-14 are identified as abnormal. Normal domain name requests are sent to the DNS server for resolution, while abnormal domain name requests are intercepted. Simultaneously, user domain name access behavior data is recorded in the database.

[0076] The user security assessment module is used to evaluate a user's security rating and score based on information such as the strength of the association between the user and abnormal domains in the behavioral data. To better adapt to the needs of the scenario, this invention first calculates the number of user security ratings based on the density distribution of the data in the user domain access behavior dataset before calculating user security. Using the elbow method in k-means clustering, the number of security rating levels k starts from 1 and is incremented to a suitable upper limit. For each k value, clustering is performed, and the corresponding SSE (sum of squared errors) is recorded. Then, a graph showing the relationship between k and SSE is plotted, and finally, the k corresponding to the elbow is selected as the optimal number of all rating levels. After obtaining the number of user security ratings, as follows... Figure 5 As shown, the user security assessment module includes:

[0077] Step S310: Read the user domain access behavior data recorded in the database.

[0078] Step S320: Specifically, this involves constructing a user security assessment model using information such as domain name category, domain name characteristics, user access domain name categories, and access frequency to score and rate the security status of recorded users. The training process of the user security assessment model mainly includes the following steps: First, the user access frequency and characteristics of various domain names in the user domain name access behavior data are selected as the training data for the model; the selected abnormal domain name features include suspected abnormal domain names identified by the Bloom filter, abnormal domain names identified by the subsequent DGA domain name detection model, and domain names belonging to the DGA category; since unsupervised rating and classification of a large number of users is required, a powerful and lightweight unsupervised model, Random Forest, is used; Random Forest is a Bagging algorithm that uses decision trees as estimators. It constructs multiple decision trees by randomly selecting subsets of data with replacement and randomly selecting some features, and outputs the final classification model by combining the classification results of each decision tree. Therefore, for a user security rating model with n rating levels, a random forest model is constructed based on user behavior data (IP, region, access domain name, access time, etc.), the access frequency of abnormal domain names and the characteristics of the abnormal domain names accessed (only Bloom filter judges abnormality, two-layer architecture model judges abnormality and DGA category).

[0079] Step S330: Periodically perform security scoring and rating on users in the database.

[0080] Step S340: Push the evaluation results to the DNS server cluster and domain name resource scheduling module.

[0081] Domain access prediction module, such as Figure 6The process involves reading user domain name access behavior data recorded in the database. Step S350 specifically includes constructing a user domain name resource access prediction model using information such as IP address ranges, regions, user groups, access targets, and resource consumption to predict domain names that users are likely to access in the future. The training process of the user domain name resource access prediction model mainly includes the following steps: First, reading the request records of secure users for normal domain names from the user domain name access behavior data and organizing them into a user domain name access behavior matrix (the number of times a user accesses a domain name); second, given the sparsity of the user domain name access behavior matrix, using the Alternating Least Squares (ALS) matrix factorization method to extract the user feature matrix and the domain name feature matrix; then, since users' domain name access preferences are often stable, there is no need to help users discover more domain names they might be interested in; only the domain names that might be accessed need to be predicted. Therefore, a collaborative filtering recommendation algorithm based on domain name feature similarity (itemCF) is used. By organizing the data, the IP address + port number that issues the DNS request is considered as the user, the requested domain name is considered as the item, and the number of requests is considered as the rating. The collaborative filtering recommendation algorithm (itemCF) is used to calculate the list of domain name resources that the user is most likely to request. Finally, based on the amount of data processed, the domain name resource list data is pushed to the domain name resource scheduling module at regular intervals.

[0082] Domain name resource scheduling module, such as Figure 7 As shown: On the one hand, based on the security rating and security score results pushed by the user security assessment module, a domain name resolution service capacity allocation algorithm is constructed. Specifically, steps S420 and S430 include: to ensure the security of the system during the resolution capacity allocation process, the DNS server cluster is divided into multi-level sub-clusters based on the number of user security ratings, so that each sub-cluster corresponds to each user's security rating, and its computing power increases with the level, while the computing resources of users with different ratings are isolated from each other. The priority of resolution request responses is arranged. For each cluster's DNS server, when it simultaneously receives resolution requests from high-scoring users and low-scoring users, based on the principle of high-scoring priority, the DNS server sub-cluster matching the high-scoring user is used to prioritize the resolution response for the user with the higher security score.

[0083] On the other hand, based on the user rating results and domain resource list provided by the user security assessment module and the domain access prediction module, a domain caching resource scheduling model is constructed to schedule domain resources that users are likely to access. Specifically, steps S450 and S460 include: when a user's security rating is higher than a set threshold, the domain caching resource scheduling model prioritizes caching the user's domain resource list in a nearby DNS server that matches the user's security rating. Therefore, while ensuring the service quality for users with high security ratings, it improves the resolution hit rate and resolution efficiency.

[0084] The foregoing description illustrates and describes several preferred embodiments of the present invention, but as stated above, it is not intended to limit the patent scope of the present invention. It should be understood that various parts of the present invention can be implemented in multiple combinations, and multiple steps or methods shown in the specification and drawings are implemented by an instruction execution system executing suitable software or hardware. All of the above descriptions are included within the patent protection scope of the present invention.

Claims

1. A domain name resolution method based on domain name request risk control, characterized in that, The method includes: Based on the domain name requests received by the domain name resolution cluster from users, the domain name requests are identified as normal domain name requests or abnormal domain name requests, user domain name access behavior data is collected and stored in the domain name access behavior database; wherein, the domain name access behavior database contains a set of user domain name access behavior data for several users. Based on the density distribution of data in the user domain access behavior database, the number of user security ratings is determined. Then, based on the strength of the association between the user domain access behavior data set and the abnormal domains, the user's security rating and security score are evaluated. Based on the user domain name access behavior data set, predict the normal domain names that are likely to be accessed and form a domain name resource list; wherein, the domain name resource list is used to select one or more DNS servers in the DNS server sub-cluster corresponding to the user level according to the user's security rating and geographical location information when the user's security rating is higher than a set threshold, and load the domain name resource list into the DNS server to improve the domain name resolution cache hit rate and resolution efficiency. Based on the user's security rating, normal domain name requests initiated by users with different security ratings are sent to the DNS server sub-clusters corresponding to their respective levels. This allows the DNS server sub-clusters of each level to respond to the normal domain name requests sequentially based on the security score, prioritizing those with higher security scores. The levels of the DNS server sub-clusters are determined according to the user's security rating, and the computing power and security protection level of each sub-cluster increase or decrease as the level rises or falls. At the same time, computing resources are isolated between users with different ratings.

2. The method as described in claim 1, characterized in that, The process of receiving user domain name requests based on the domain name resolution cluster, identifying the domain name requests as normal or abnormal requests, collecting user domain name access behavior data, and storing it in the domain name access behavior database includes: The domain name data of the domain name request is filtered by k hash functions used by the Bloom filter to identify normal domain name requests and suspected abnormal domain name requests. By vectorizing the domain names in suspected abnormal domain name requests, the suspected abnormal domain names are represented as a two-dimensional tensor sequence; For the two-dimensional tensor sequence, information at different scales is extracted by multiple convolutional kernels, and the information at different scales is fused by concatenation to obtain a fused representation; wherein, after each convolution, nonlinearization is performed by the ReLU activation function, and downsampling is performed by max pooling; The fused multidimensional tensor is flattened into a one-dimensional vector, which is then input into multiple fully connected layers. The output of these fully connected layers is nonlinearized using ReLU and then input into a fully connected layer to obtain a layer containing several nodes. The argmax function is used to determine whether the suspected abnormal domain name is a normal domain name request or an abnormal domain name request. Collect user domain access behavior data for both normal and abnormal domain requests, and store it in the domain access behavior database.

3. The method as described in claim 1, characterized in that, The process of identifying user domain requests as normal or abnormal requests based on the domain name resolution cluster, collecting user domain access behavior data, and storing it in the domain access behavior database also includes: Intercept requests for abnormal domain names.

4. The method as described in claim 1, characterized in that, The process of assessing a user's security rating and security score based on the correlation between the user's domain access behavior data set and the abnormal domains includes: Obtain user behavior data from the user domain access behavior data set; wherein, the user behavior data includes: IP address, region, access domain name, and access time; Based on the user behavior data, the frequency of user access to abnormal domains and the characteristics of the accessed domains are obtained; based on the frequency of user access to the abnormal domains and the characteristics of the accessed domains, a user security assessment model based on random forest is constructed. By inputting the frequency of a user's access to abnormal domains and the characteristics of the abnormal domains accessed into the user security assessment model, the user's security score and security rating are obtained.

5. The method as described in claim 1, characterized in that, The process of predicting high-probability access to normal domains based on the user domain access behavior data set, forming a domain resource list, includes: A user domain access behavior matrix is ​​constructed based on the access behavior data corresponding to normal domain requests in the user domain access behavior data set. The user domain name access behavior matrix is ​​decomposed using the alternating least squares (ALS) matrix decomposition method to obtain the user feature matrix and the domain name feature matrix. By organizing the domain name feature matrix, we can obtain the IP address and port number that issued the DNS request, the requested domain name, and the number of requests. The IP address and port number that make the DNS request are considered as users, the requested domain name is considered as an item, the number of requests is considered as a rating, and a collaborative filtering recommendation algorithm is used to predict normal domain names that are highly likely to be accessed. A list of domain name resources is formed based on the normal domain names that are accessed with a high probability.

6. A domain name resolution device based on domain name request risk control, characterized in that, The device includes: The domain name detection module is used to collect user domain name access behavior data based on the domain name requests received by the domain name resolution cluster, and after identifying the domain name requests as normal or abnormal domain name requests, store them in the domain name access behavior database; wherein, the domain name access behavior database contains a set of user domain name access behavior data of several users; The user security assessment module is used to determine the number of user security ratings based on the density distribution of data in the user domain access behavior database, and then assess the user's security rating and security score based on the strength of the association between the user domain access behavior data set and the abnormal domains. The domain name access prediction module is used to predict normal domain names with a high probability of being accessed based on the user domain name access behavior data set, and form a domain name resource list. The domain name resource scheduling module is used for: Based on the user assessment results provided by the user security assessment module, normal domain name requests initiated by users with different security ratings are sent to the DNS server sub-clusters corresponding to their respective levels. This allows the DNS server sub-clusters to respond to the normal domain name requests in sequence according to the principle of prioritizing higher security scores. The levels of the DNS server sub-clusters are divided based on user security ratings, and the computing power and security protection level of each sub-cluster increase with the level. At the same time, computing resources are isolated between users with different ratings. Based on the domain name resource list provided by the domain name access prediction module, if the user's security rating is higher than a set threshold, one or more DNS servers in the DNS server sub-cluster that are geographically close to the user and correspond to the user's level are selected based on the user's security rating and geographical location information. The domain name resource list is then loaded into the DNS server to improve the domain name resolution cache hit rate and resolution efficiency.

7. A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method of any one of claims 1-5.

8. An electronic device comprising a memory and a processor, the memory storing a computer program which is loaded and executed by the processor to implement the method of any one of claims 1-5.

Images