Domain name identification method, device, electronic device and medium

Abstract

The present disclosure provides a domain name identification method, which can be used in the financial field or other fields. The method includes: obtaining a first domain name set recorded by a domain name management system; extracting the domain name features of each domain name in the first domain name set respectively to obtain N domain name feature sets; obtaining a second domain name set recorded by an application management system; based on the second domain name set, dividing the N domain names in the first domain name set into N1 identified domain names and N2 unidentified domain names; for each unidentified domain name in the N2 unidentified domain names, matching the domain name feature set of the unidentified domain name with the domain name feature set of the N1 identified domain names to obtain a matching result of the unidentified domain name; and determining the identification result of the unidentified domain name based on the matching result. The present disclosure also provides a domain name identification device, equipment, storage medium and program product.

Description

Technical Field

[0001] The present disclosure relates to the field of domain name management and can also be used in the financial field or other fields. Specifically, it relates to a domain name identification method, device, equipment, medium and program product. Background Art

[0002] In the current application architecture design, domain names are used as an important means to decouple application design from operation and maintenance design. They are used to represent applications or application servers, and based on this, related means of application design and network management are derived, making domain names a basic design and operation and maintenance asset. In domain name management, domain names often need to be identified due to historical issues, synchronization issues between systems, changes in application names, and adding domain names after registration.

[0003] In the process of realizing the concept of the present disclosure, the inventors found that currently, when identifying domain names, a method of manual confirmation one by one is usually adopted, which has a slow recognition speed, low recognition efficiency and low accuracy. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a domain name identification method, apparatus, device, medium and program product.

[0005] According to a first aspect of the present disclosure, a domain name identification method is provided, comprising: obtaining a first domain name set recorded by a domain name management system, wherein the first domain name set includes a plurality of domain names; extracting domain name features of each domain name in the first domain name set respectively to obtain N domain name feature sets, wherein N is an integer greater than or equal to 1; obtaining a second domain name set recorded by an application management system, wherein the first domain name set includes the second domain name set, the second domain name set includes N1 domain names, each of the N1 domain names corresponds to an application, N1 is an integer greater than or equal to 0, and N1 is less than or equal to N; based on the second domain name set, dividing the N domain names in the first domain name set into N1 identified domain names and N2 unidentified domain names, wherein N2 is an integer greater than or equal to 0, and N1+N2=N; for each unidentified domain name in the N2 unidentified domain names, matching the domain name feature set of the unidentified domain name with the domain name feature set of the N1 identified domain names to obtain a matching result of the unidentified domain name; and determining an identification result of the unidentified domain name based on the matching result.

[0006] According to an embodiment of the present disclosure, the step of respectively extracting domain name features of each domain name in the first domain name set to obtain N domain name feature sets includes: removing invalid domain names in the first domain name set; for each domain name in the first domain name set after removing the invalid domain names, extracting multiple candidate domain name features of the domain name to obtain N candidate domain name feature sets, wherein each candidate domain name feature includes a location identifier; and based on the location identifier of each candidate domain name feature, using a statistical method to screen the candidate domain name features in each candidate domain name feature set to obtain N domain name feature sets.

[0007] According to an embodiment of the present disclosure, the step of using a statistical method to screen the candidate domain name features in each candidate domain name feature set to obtain N domain name feature sets includes: obtaining candidate domain name features with the same position identifier in the N candidate domain name feature sets, and determining the multiple candidate domain name feature types to which the candidate domain name features with the same position identifier belong; presetting a frequency threshold; for each candidate domain name feature type, counting the frequency of the candidate domain name feature type; screening out a target domain name feature type whose frequency is less than the frequency threshold from the candidate domain name feature types; and for each candidate domain name feature set in the N candidate domain name feature sets, retaining only the domain name features of the target domain name feature type to obtain N domain name feature sets.

[0008] According to an embodiment of the present disclosure, the domain name includes multiple character segments and separators; the step of extracting multiple candidate domain name features of each of the N domain names includes: removing the main domain name character segment from the multiple character segments of the domain name; and splitting the remaining character segments of the domain name according to the separators to obtain multiple candidate domain name features of the domain name.

[0009] According to an embodiment of the present disclosure, the step of matching the domain name feature set of the unidentified domain name with the domain name feature sets of the N1 identified domain names to obtain a matching result of the unidentified domain name includes: calculating the similarity between the domain name feature set of the unidentified domain name and the domain name feature set of the identified domain name for each domain name feature set of the N1 identified domain names; presetting a similarity threshold; selecting K identified domain names whose domain name feature set similarity is greater than the similarity threshold; and obtaining applications corresponding to the K identified domain names as the matching result of the unidentified domain name, wherein K is an integer greater than or equal to 0.

[0010] According to an embodiment of the present disclosure, the step of calculating the similarity between the domain name feature set of the unidentified domain name and the domain name feature set of the identified domain name includes: calculating the number of identical domain name features in the domain name feature set of the unidentified domain name and the domain name feature set of the identified domain name as the similarity between the domain name feature set of the unidentified domain name and the domain name feature set of the identified domain name.

[0011] According to an embodiment of the present disclosure, the step of determining the identification result of the unrecognized domain name based on the matching result includes: when K is greater than or equal to 1, sending the matching result of the unrecognized domain name; receiving a confirmation result of the matching result; and based on the confirmation result, obtaining the identification result of the unrecognized domain name; and, when K is equal to 0, broadcasting the unrecognized domain name to obtain the identification result of the unrecognized domain name. .

[0012] A second aspect of the present disclosure provides a domain name identification device, including: a first acquisition module, used to acquire a first domain name set recorded in a domain name management system, wherein the first domain name set includes multiple domain names; an extraction module, used to extract domain name features of each domain name in the first domain name set respectively, to obtain N domain name feature sets, wherein N is an integer greater than or equal to 1; a second acquisition module, used to acquire a second domain name set recorded in an application management system, wherein the first domain name set includes the second domain name set, the second domain name set includes N1 domain names, each of the N1 domain names corresponds to an application, and N1 is An integer greater than or equal to 0, and N1 is less than or equal to N; a division module, used to divide the N domain names in the first domain name set into N1 recognized domain names and N2 unrecognized domain names based on the second domain name set, wherein N2 is an integer greater than or equal to 0, and N1+N2=N; a matching module, used to match the domain name feature set of the unrecognized domain name with the domain name feature set of the N1 recognized domain names for each unrecognized domain name in the N2 unrecognized domain names, to obtain a matching result of the unrecognized domain name; and a result generation module, used to determine an identification result of the unrecognized domain name based on the matching result.

[0013] According to an embodiment of the present disclosure, the extraction module includes: an extraction unit, which is used to remove invalid domain names in the first domain name set; for each domain name in the first domain name set after the invalid domain names are removed, multiple candidate domain name features of the domain name are extracted to obtain N candidate domain name feature sets, wherein each candidate domain name feature includes a location identifier; and a screening unit, which is used to screen the candidate domain name features in each candidate domain name feature set based on the location identifier of each candidate domain name feature using a statistical method to obtain N domain name feature sets.

[0014] According to an embodiment of the present disclosure, the screening unit includes: a first acquisition submodule, used to obtain candidate domain name features with the same position identifier in the N candidate domain name feature sets, and determine the multiple candidate domain name feature types to which the candidate domain name features with the same position identifier belong; a preset submodule, used to preset a frequency threshold; a statistical submodule, used to count the frequency of each candidate domain name feature type; a screening submodule, used to screen out a target domain name feature type whose frequency is less than the frequency threshold from the candidate domain name feature types; and a set generation submodule, used to retain only the domain name features of the target domain name feature type for each candidate domain name feature set in the N candidate domain name feature sets, to obtain N domain name feature sets.

[0015] According to an embodiment of the present disclosure, the domain name includes multiple character segments and separators; the extraction unit includes: a removal submodule, used to remove the main domain name character segment from the multiple character segments of the domain name; and a splitting submodule, used to split the remaining character segments of the domain name according to the separators to obtain multiple candidate domain name features of the domain name.

[0016] According to an embodiment of the present disclosure, the matching module includes: a first calculation unit, used to calculate the similarity between the domain name feature set of the unidentified domain name and the domain name feature set of the identified domain name for each domain name feature set of the N1 identified domain names; a preset unit, used to preset a similarity threshold; select K identified domain names whose domain name feature set similarity is greater than the similarity threshold; and a first acquisition unit, used to acquire applications corresponding to the K identified domain names as matching results of the unidentified domain name, wherein K is an integer greater than or equal to 0.

[0017] According to an embodiment of the present disclosure, the first calculation unit includes: a first calculation submodule, used to calculate the number of identical domain name features in the domain name feature set of the unrecognized domain name and the domain name feature set of the recognized domain name as the similarity between the domain name feature set of the unrecognized domain name and the domain name feature set of the recognized domain name.

[0018] According to an embodiment of the present disclosure, the result generation module includes: a first confirmation submodule, used to send the matching result of the unrecognized domain name when K is greater than or equal to 1; receive a confirmation result of the matching result; and obtain an identification result of the unrecognized domain name based on the confirmation result; and, a second confirmation submodule, used to broadcast the unrecognized domain name when K is equal to 0 to obtain the identification result of the unrecognized domain name.

[0019] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above method.

[0020] The fourth aspect of the present disclosure also provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above method.

[0021] The fifth aspect of the present disclosure also provides a computer program product, including a computer program, which implements the above method when executed by a processor.

[0022] One or more of the above embodiments have the following advantages or beneficial effects: The domain name identification method provided by the embodiments of the present disclosure uses a statistical method to generate domain name features of an identified domain name, matches an unidentified domain name with the domain name features of an identified domain name, and obtains an identification result of the unidentified domain name by calculating the similarity of the domain name features. The method gradually narrows the application scope of domain name mapping based on existing known information, greatly improves the recognition speed and efficiency of domain names, and at the same time improves the accuracy of domain name recognition and reduces the cost of manual confirmation and verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0024] Figure 1 A diagram schematically illustrates an application scenario of a domain name identification method, apparatus, device, medium, and program product according to an embodiment of the present disclosure;

[0025] Figure 2 A flowchart of a domain name identification method according to an embodiment of the present disclosure is schematically shown;

[0026] Figure 3 A flowchart of obtaining N domain name feature sets according to an embodiment of the present disclosure is schematically shown;

[0027] Figure 4 A flowchart schematically illustrates the use of a statistical method to screen candidate domain name features in each candidate domain name feature set according to an embodiment of the present disclosure;

[0028] Figure 5 A flowchart of obtaining a matching result of the unrecognized domain name according to an embodiment of the present disclosure is schematically shown;

[0029] Figure 6 A schematic diagram schematically shows a domain name management method according to an embodiment of the present disclosure;

[0030] Figure 7 The schematic diagram shows the structure of the domain name management module 1 according to the embodiment of the present disclosure;

[0031] Figure 8 The schematic diagram of the structure of the application management module 2 according to the embodiment of the present disclosure is shown;

[0032] Fig. 9 A structural block diagram of a domain name identification device according to an embodiment of the present disclosure is schematically shown; and

[0033] Fig.10 A block diagram of an electronic device suitable for implementing a domain name identification method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0034] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0035] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0036] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0037] When using expressions such as "at least one of A, B, and C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, features defined as "first" and "second" may explicitly or implicitly include one or more of the said features.

[0038] The related concepts involved in the embodiments of the present disclosure are explained as follows:

[0039] Application, from the business perspective, is a collection of functions that realizes a business unit. It generally includes data reception, data processing, data feedback, data storage and other functions. Applications can be large or small. Generally, a specific application node is responsible for external communication and interconnects with other applications through application interfaces. For example, official document systems, training systems, online banking, etc. Each application can have one or more domain names, corresponding to multiple business scenarios.

[0040] Application nodes, multiple application nodes constitute an application, each application node implements a sub-function of the application, application nodes are interconnected and call each other through application node interfaces, and each application node can also have one or more domain names to correspond to inter-node and operation and maintenance access requirements.

[0041] Domain names are classified into intranet domain names and Internet domain names according to usage scenarios. Intranet domain names are further divided into application domain names and application node domain names. Intranet domain names are domain names used in local area networks, and users identify and locate application functions or servers. The disclosed embodiments relate to application node domain names in intranet domain names, which are used within the enterprise. In order to avoid conflicts in use, they have certain regularities when naming, and each segment has a certain meaning. However, due to changes in the application itself, such as changes and adjustments in application names, application node names, and irregular registration, it is impossible to directly establish an association with the application. The role of domain names: When applications are external and application nodes access each other, in the early stage, the IP address is used. The adjustment requires adjusting the code or configuration files one by one. As the scale of application nodes increases, the complexity of this work cannot be completed by manpower. By introducing domain names instead of IP addresses, mutual visits between applications and application nodes are decoupled through domain names.

[0042] The primary domain name, also known as the first-level domain name, is used to mark the domain to which the domain name belongs, such as the organization to which it belongs. It is one or more pieces of information located on the right side of the overall structure of the domain name.

[0043] Domain name resolution service DNS provides a mapping relationship between domain names and IP addresses. By using DNS, when configuring access relationships between application nodes, the domain name is used to define them. When the IP address of the application node changes, the mapping relationship between the domain name and IP address in the DNS service can be adjusted to synchronize the access relationship. Compared with directly configuring the IP address, this method does not require adjusting the configuration of application node access and has minimal impact on the application.

[0044] In the current application architecture design, domain names are used as an important means to decouple application design from operation and maintenance design. They are used to represent applications or application servers, and based on this, related means of application design and network management are derived, making domain names a basic design and operation and maintenance asset.

[0045] At present, the application management system manages assets from the perspective of application, and records information including: application name (key), application design attribute information, including intranet domain name, which is non-mandatory registration information. The network domain name management system manages domain names from the perspective of network, and records information including: domain name (key), network attributes corresponding to the domain name, including IP, operation and maintenance environment, network management authority, etc. Since the two systems belong to different fields, the network domain name management system is relatively lacking in attribute management of the application dimension, and cannot directly map domain names with related functions, but needs to rely on the association with the application system. However, in the association process, for some existing data, due to historical problems or synchronization problems between systems, application name changes, domain names added after registration, etc., there will be differences between the domain name resolution system (DNS) ledger and the application management ledger, resulting in differences between network domain name assets and application assets, which affects the value of domain names in the design and operation and maintenance process. Therefore, it is necessary to identify domain names. At present, when identifying domain names, the method of manual confirmation one by one is usually adopted, that is, for unconfirmed domain names, they are sent to all relevant personnel for claim confirmation. In the current architecture design process, the interaction between application function modules requires access through domain names, and depending on the usage scenario, a service node may have multiple domain names. For systems with more than 100 applications, according to industry statistics, the number of intranet domain names generally exceeds 10,000. For existing solutions, in theory, if the relevant work involves n domain names to be confirmed and m applications, the number of confirmations can reach up to n×m times, and in the worst case, the number of confirmations may reach millions. At the same time, it is necessary to face the situation where there is no application associated with the invalid domain name. For large-scale systems, the associated confirmation work and the confirmation of invalid domain names, this identification method has a slow identification speed, low identification efficiency, heavy workload, high communication and coordination costs, and low accuracy.

[0046] In view of the above problems, an embodiment of the present disclosure provides a domain name identification method, including: obtaining a first domain name set recorded by a domain name management system, wherein the first domain name set includes multiple domain names; extracting domain name features of each domain name in the first domain name set respectively to obtain N domain name feature sets, wherein N is an integer greater than or equal to 1; obtaining a second domain name set recorded by an application management system, wherein the first domain name set includes the second domain name set, the second domain name set includes N1 domain names, each of the N1 domain names corresponds to an application, N1 is an integer greater than or equal to 0, and N1 is less than or equal to N; based on the second domain name set, dividing the N domain names in the first domain name set into N1 recognized domain names and N2 unrecognized domain names, wherein N2 is an integer greater than or equal to 0, and N1+N2=N; for each unrecognized domain name in the N2 unrecognized domain names, matching the domain name feature set of the unrecognized domain name with the domain name feature set of the N1 recognized domain names to obtain a matching result of the unrecognized domain name; and determining an identification result of the unrecognized domain name based on the matching result. The domain name recognition method provided by the embodiment of the present disclosure utilizes a statistical method to generate domain name features of an identified domain name, matches an unidentified domain name with the domain name features of an identified domain name, and obtains an identification result of the unidentified domain name by calculating the similarity of the domain name features. The method gradually narrows the application scope of domain name mapping based on existing known information, greatly improves the recognition speed and efficiency of domain names, and at the same time improves the accuracy of domain name recognition and reduces the cost of manual confirmation and verification.

[0047] It should be noted that the method and device determined in the present disclosure can be used for domain name identification in the financial field, and can also be used for domain name identification in any field other than the financial field. The application field of the method and device for domain name identification in the present disclosure is not limited.

[0048] Figure 1 The application scenario diagram of the domain name identification method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0049] like Figure 1 As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0050] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0051] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0052] The server 105 may be a server that provides various services, such as a background management server (only an example) that provides support for websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0053] It should be noted that the domain name identification method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the domain name identification device provided in the embodiment of the present disclosure can generally be set in the server 105. The domain name identification method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the domain name identification device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0054] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0055] Figure 2 The flowchart of the domain name identification method according to the embodiment of the present disclosure is schematically shown.

[0056] like Figure 2 As shown, the domain name identification method of this embodiment includes operations S210 to S260.

[0057] In operation S210, a first domain name set recorded in a domain name management system is obtained, wherein the first domain name set includes a plurality of domain names.

[0058] In operation S220, domain name features of each domain name in the first domain name set are extracted respectively to obtain N domain name feature sets, where N is an integer greater than or equal to 1.

[0059] Figure 3 The flowchart of obtaining N domain name feature sets according to an embodiment of the present disclosure is schematically shown.

[0060] like Figure 3 As shown, the process of obtaining N domain name feature sets in this embodiment includes operations S310 to S330.

[0061] In operation 310, invalid domain names are removed from the first domain name set, where an invalid domain name refers to a domain name that is no longer in use due to historical reasons or domain name name changes. Such domain names do not need to be identified, so removing invalid domain names can reduce noise interference in subsequent domain name identification and improve identification efficiency.

[0062] In operation S320, for each domain name in the first domain name set after the invalid domain names are removed, multiple candidate domain name features of the domain name are extracted to obtain N candidate domain name feature sets, wherein each candidate domain name feature includes a location identifier.

[0063] According to an embodiment of the present disclosure, the domain name includes multiple character segments and separators; the step of extracting multiple candidate domain name features of each of the N domain names includes: removing the main domain name character segment from the multiple character segments of the domain name; and splitting the remaining character segments of the domain name according to the separator to obtain multiple candidate domain name features of the domain name. It should be noted that the domain name itself belongs to semi-structured data, which is composed of multiple segments of character data and is used for marking and identifying application nodes. The segments are marked by separating "." characters. The content and order of each segment generally follow certain rules. Common ones include the application name corresponding to the domain name, the group to which it belongs, the location, the organization code and other information. Relevant information is generally stored and managed in the application management system and the network domain name management system. Among them, the main domain name field is a common field, which has limited significance for domain name identification and judgment. In order to improve the recognition efficiency, it is removed and the recognition noise is reduced.

[0064] In operation S330, based on the position identifier of each candidate domain name feature, a statistical method is used to screen the candidate domain name features in each candidate domain name feature set to obtain N domain name feature sets.

[0065] Optionally, each segment of the multiple candidate domain name features obtained after splitting according to the separator can be marked with positions from left to right, namely 1, ..., n.

[0066] Figure 4The flowchart of using a statistical method to screen the candidate domain name features in each candidate domain name feature set according to an embodiment of the present disclosure is schematically shown.

[0067] like Figure 4 As shown, the method of using a statistical method to screen the candidate domain name features in each candidate domain name feature set in this embodiment includes operations S410 to S450.

[0068] In operation S410, candidate domain name features with the same position identifier are obtained from the N candidate domain name feature sets, and multiple candidate domain name feature types to which the candidate domain name features with the same position identifier belong are determined. For example, a domain name feature with a position identifier of 2 can be selected.

[0069] In operation S420, a frequency threshold is preset. Among them, data below the frequency threshold is valid data, and when the threshold is n, information with a frequency less than or equal to n is retained. When the threshold is 0, all duplicate items are excluded; when the threshold is 1, all items are retained. For data with low repetition rate lower than the large sample, it is recommended to set the frequency threshold closer to 0; for data with high repetition rate of small sample, it is recommended to set the frequency threshold closer to 1.

[0070] In operation S430, for each candidate domain name feature type, the frequency of the candidate domain name feature type is counted, where frequency = the number of times a certain candidate domain name feature appears / the total number of times domain name features of the candidate domain name feature type appear.

[0071] In operation S440, a target domain name feature type having a frequency less than the frequency threshold is screened out from the candidate domain name feature types.

[0072] In operation S450, for each of the N candidate domain name feature sets, only the domain name features of the target domain name feature type are retained to obtain N domain name feature sets. By retaining only the domain name features of the target domain name feature type whose frequency is less than the frequency threshold, common high-frequency information such as the park where the domain name is located can be removed from each candidate domain name feature set, so that the retained domain name features are more typical and more conducive to improving the accuracy and efficiency of subsequent recognition.

[0073] In operation S230, a second domain name set recorded in the application management system is obtained, wherein the first domain name set includes the second domain name set, the second domain name set includes N1 domain names, each of the N1 domain names corresponds to an application, N1 is an integer greater than or equal to 0, and N1 is less than or equal to N.

[0074] Exemplarily, the second domain name set is the domain names that have been recorded in the application management system, that is, the domain names that have been associated with the application, and such domain names that have been associated with the application belong to the identified domain names. Since the domain names in the application management system are non-mandatory registration information, N1 is less than or equal to N.

[0075] In operation S240, based on the second domain name set, the N domain names in the first domain name set are divided into N1 identified domain names and N2 unidentified domain names, where N2 is an integer greater than or equal to 0, and N1+N2=N.

[0076] In operation S250, for each of the N2 unrecognized domain names, the domain name feature set of the unrecognized domain name is matched with the domain name feature set of the N1 recognized domain names to obtain a matching result of the unrecognized domain name. Since similar domain name features are often associated with the same application in an intranet system, the unrecognized domain name can be identified based on the domain name features of the recognized domain names to simplify the identification process and improve the efficiency of identification.

[0077] Figure 5 A flow chart for obtaining a matching result of the unrecognized domain name according to an embodiment of the present disclosure is schematically shown.

[0078] like Figure 5 As shown, the process of obtaining the matching result of the unrecognized domain name in this embodiment includes operations S510 to S540.

[0079] In operation S510, for each domain name feature set of the N1 identified domain names, the similarity between the domain name feature set of the unidentified domain name and the domain name feature set of the identified domain name is calculated.

[0080] According to an embodiment of the present disclosure, the step of calculating the similarity between the domain name feature set of the unrecognized domain name and the domain name feature set of the recognized domain name includes: calculating the number of identical domain name features in the domain name feature set of the unrecognized domain name and the domain name feature set of the recognized domain name as the similarity between the domain name feature set of the unrecognized domain name and the domain name feature set of the recognized domain name. This method of calculating similarity by the number of similar features has a simple calculation process and improves recognition efficiency.

[0081] Optionally, the number of the same location identifier and domain name features in the domain name feature set of the unrecognized domain name and the domain name feature set of the recognized domain name can be further improved to further improve the accuracy of recognition. It should be noted that if the similarity calculation is limited to the same location identifier and domain name features at the same time, the number of results obtained will be small, and there may be a risk of filtering out valid data. Therefore, the similarity calculation method can be selected according to the actual situation, and the embodiments of the present disclosure do not limit this.

[0082] In operation S520, a similarity threshold is preset.

[0083] In operation S530, K identified domain names whose similarity of the domain name feature set is greater than the similarity threshold are selected.

[0084] In operation S540, applications corresponding to the K identified domain names are obtained as matching results of the unidentified domain names, where K is an integer greater than or equal to 0. This similarity calculation method simplifies the matching process and can flexibly adjust the similarity threshold according to actual conditions to improve recognition efficiency.

[0085] Optionally, the identified domain names may be sorted in descending order according to similarity, and the applications corresponding to the first F identified domain names are selected as the matching results of the unidentified domain names, where F is an integer greater than or equal to 0. The specific method for obtaining the matching results of the unidentified domain names may be selected according to actual conditions, and the embodiments of the present disclosure do not limit this.

[0086] In operation S260, based on the matching result, an identification result of the unrecognized domain name is determined.

[0087] According to an embodiment of the present disclosure, the step of determining the identification result of the unidentified domain name based on the matching result includes: when K is greater than or equal to 1, sending the matching result of the unidentified domain name; receiving the confirmation result of the matching result; and obtaining the identification result of the unidentified domain name based on the confirmation result. Wherein, when K is greater than or equal to 1, it indicates that the unidentified domain name is successfully identified based on the identified domain name. At the same time, since an unidentified domain name has obtained K possible applications, in order to further ensure the accuracy of the identification result and find the application that only corresponds to the unidentified domain name, it is necessary to confirm the K possible applications one by one. The K possible applications of the unknown domain name can be sent to the architect of the application, and the identification result of the unknown domain name can be obtained based on the confirmation result of the architect.

[0088] According to an embodiment of the present disclosure, when K is equal to 0, the unidentified domain name is broadcasted to obtain the identification result of the unidentified domain name. The applications corresponding to the K identified domain names are used to obtain the identification result of the unidentified domain name. Among them, when K is equal to 0, it indicates that the identification of the unidentified domain name based on the identified domain name fails and no identification result is obtained. At this time, the traditional one-by-one confirmation method is required to be adopted by broadcasting to each possible architect for manual claiming.

[0089] Exemplarily, for the case of n domain names to be confirmed and m applications, the method of the embodiment of the present disclosure divides the n domain names into n1 invalid domain names, n2 identified domain names, and n3 unidentified domain names. Among the n3 unidentified domain names, the number of domain names successfully identified using the method of the embodiment of the present disclosure is n4, and the number of domain names that failed to be identified is n5. Even if it is assumed that the prior art has removed invalid domain names and identified domain names in advance when performing identification, the number of confirmations required for the prior art to identify unidentified domain names is still as high as n3×m times. The method of the embodiment of the present disclosure only requires the following number of confirmations: ∑n4+n5×m, where ∑n4 is the sum of the K applications obtained for each successfully identified domain name. Since the K applications obtained for each successfully identified domain name need to be confirmed one by one, the total number of confirmations is ∑n4; n5×m is the number of confirmations for the domain name that needs to be broadcast and claimed due to failed identification. Since n5 after identification is much smaller than n3, and K is much smaller than m, according to statistical experience, the original confirmation work of one million times can be completed through more than a thousand confirmations, which greatly improves the efficiency of domain name identification. At the same time, it greatly reduces the errors caused by relying entirely on manual identification and improves the accuracy of identification.

[0090] The domain name recognition method provided by the embodiment of the present disclosure utilizes a statistical method to generate domain name features of an identified domain name, matches an unidentified domain name with the domain name features of an identified domain name, and obtains an identification result of the unidentified domain name by calculating the similarity of the domain name features. The method gradually narrows the application scope of domain name mapping based on existing known information, greatly improves the recognition speed and efficiency of domain names, and at the same time improves the accuracy of domain name recognition and reduces the cost of manual confirmation and verification.

[0091] Figure 6 A schematic diagram of a domain name management method according to an embodiment of the present disclosure is schematically shown.

[0092] like Figure 6 As shown, the domain name management method of the embodiment of the present disclosure involves modules including a domain name management module 1, an application management module 2, a domain name data cleaning module 3, a domain name data splitting module 4, a domain name data statistical analysis module 5 and an application domain name feature recording module 6.

[0093] The domain name management module 1 and the application management module 2 are data sources. The domain name data cleaning module 3 obtains data from the domain name management module 1 and the application management module 2. The data processed by the domain name data cleaning module 3 is provided to the domain name data splitting module 4 for processing. The data processed by the domain name data splitting module 4 is provided to the domain name data statistical analysis module 5. The data statistical analysis module 5 calls the data of the application management module 2, combines the data of the domain name data splitting module 4, and provides the processed data to the application domain name feature recording module 6. The application domain name feature recording module 6 calls the data of the application management module 2, and finally generates the domain name and application association 7. Specifically:

[0094] The domain name management module 1 is used to manage domain name information, which mainly includes domain name information and network attribute information corresponding to the domain name, such as IP address, domain name type and other data. As one of the basic data sources, it is associated with the domain name data cleaning module 3 and the domain name application association 7 in the entire processing flow.

[0095] The application management module 2 is used to manage application information, which mainly includes business attributes such as application name, function description, and business group to which the application belongs. As one of the basic data sources, it is associated with the domain name data statistical analysis module 5 and the application domain name feature recording module 6 in the entire processing flow.

[0096] The domain name data cleaning module 3 screens out invalid IPs according to the validity of the IPs, and classifies and marks the identified and unidentified domain names according to their association with the application management module.

[0097] The domain name data splitting module 4 simplifies the domain name, removes the main domain name, splits it according to the separator, and marks the segments with length less than 3 and only numbers as invalid according to the mapping requirements for the characteristics of each segment of the candidate domain name after the split.

[0098] The domain name data statistical analysis module 5 performs statistical distribution analysis on the data provided by the domain name data splitting module 4 by segment latitude and vertical direction, sets a frequency threshold, and the domain name features below the frequency threshold are valid domain name features. After this step of processing, a domain name feature set of the domain name is generated.

[0099] The application domain name feature recording module 6 obtains the application list information in the application management module and associates it with the domain name feature set. If an association is generated, the relevant application name may be added to the domain name and application association information.

[0100] Figure 7 The structural diagram of the domain name management module 1 according to the embodiment of the present disclosure is schematically shown.

[0101] like Figure 7As shown, the domain name management module 1 performs information management on the network side according to the domain name dimension, and mainly includes: a domain name list unit 11 and a domain name maintenance information unit 12, wherein the domain name list unit 11 is used to record the production domain name situation, and the domain name data splitting module 4 calls the relevant information to obtain the domain name list; the domain name maintenance information unit 12 records the IP, area and other information corresponding to the domain name, and the domain name data splitting module 4 calls the relevant information to determine the validity of the domain name.

[0102] Figure 8 The structural diagram of the application management module 2 according to the embodiment of the present disclosure is schematically shown.

[0103] like Figure 8 As shown, the application management module 2 performs information management on the application side according to the application dimension, and mainly includes: an application list unit 21, an associated domain name unit 22 and an application information maintenance unit 23, wherein the application list unit 21 mainly includes application list information, a domain name data statistical analysis module 5, and an application domain name feature recording module 6 call this information as a data source for processing; the associated domain name unit 22 records the associated domain names, and the domain name data splitting module 4 calls the relevant information to mark the associated domain names; the application information maintenance unit 23 mainly includes the information of the person in charge of the maintenance department corresponding to the application, and the application domain name feature recording module 6 calls this information to produce a domain name associated with the application 7.

[0104] The processing process of the domain name data cleaning module 3 includes obtaining domain name data S101, obtaining application data S102, making association marks S103 and filtering according to IP validity S104. Specifically:

[0105] Step S101, through an interface call, obtain the domain name list unit 11 of the domain name management module 1, which contains the full domain name information of the existing network side, and obtain the domain name maintenance information unit 12 of the domain name management module 1;

[0106] Step S102, obtaining the application list unit 21, the associated domain name unit 22, and the application information maintenance unit 23 of the application management module 2 through interface calling;

[0107] Step S103, through the associated domain name unit 22 of the application management module 2, the domain name list unit 11 of the domain name management module 1 is associated, and the domain names already in the associated domain name unit 22 of the application management module 2 are marked as "identified", and the domain names not in the associated domain name unit 22 of the application management module 2 are marked as "unidentified".

[0108] Step S104, through the IP address information of the domain name maintenance information unit 12 of the domain name management module 1, combined with the actual network situation, the domain name corresponding to the invalid IP address is marked as "invalid" and not included in the subsequent processing flow.

[0109] After the above processing, the domain name is divided into three categories, namely "invalidated", "identified" and "unidentified", and the relevant information is added to the domain name information for recording.

[0110] The domain name data splitting module 4 splits the domain name data processed by the domain name data cleaning module 3, and filters each segment after the split, specifically including the following steps:

[0111] Step S201, remove the primary domain name field;

[0112] Step S202, segmenting the domain name according to the domain name separator to form multiple independent data segments as the basis for subsequent identification processing, and marking the position of each segment from left to right, which are 1, ..., n respectively;

[0113] Step S203: for the segments that have been split, according to the application naming rules, pure numbers will not be used to name or represent the application, which does not have the meaning of application information identification, so the pure digital information is removed. This parameter is configurable and can be set according to the specific situation;

[0114] Step S204, for the data processed by S203, according to the application naming rule, the application name length is not less than L (the default is 3), and the segments with field length less than L are further eliminated to further reduce information noise. This parameter is configurable and can be set according to the specific situation.

[0115] After processing, the domain name management information generates a structure of: <domain name>.segment 1,...segment n data, and the application management information generates a structure of: <application><domain name>.segment 1,...segment n data.

[0116] The domain name data statistical analysis module 5 performs statistical analysis on the data passed through the domain name data splitting module 4, and generates domain name identification features based on the statistical information, which specifically includes the following steps:

[0117] Step S301, performing statistics vertically on the position information split and marked in step S202, that is, performing statistics on the information with the same position identifier, and marking the frequency of occurrence of each information;

[0118] Step S302, according to the set threshold, determine the selection of each column and each information that appears. When the threshold is n, the information with an appearance frequency less than or equal to n is retained. For example, when the threshold is 1, all identification information is retained. It should be noted that after removing a feature, the original position of the feature can be marked as empty or marked as other characters as needed;

[0119] Step S303, the information identified by the vertical statistics is recorded in the corresponding domain name information as a feature associated with the application in the future.

[0120] After the above data processing, the high-frequency data is excluded to improve the recognition accuracy. After recognition, the domain name management side information is <domain name>.Feature 1, ..., feature n, and the application side related information becomes <application><domain name>.Feature 1, ..., feature n.

[0121] The application domain name feature recognition module 6 extracts domain name features from the domain name identified in step S103 in combination with the data statistical analysis step 5, establishes an association between the application and the domain name identification information, and extracts the unidentified domain name in step S103, and establishes an association between the unidentified domain name and the application information through the identification features, specifically including the following steps:

[0122] Step S401, according to the "identified" mark of step S103, extract the domain name identification features (feature 1, ... feature n) of the domain name data statistical analysis module 5, and obtain the mapping relationship between the application and the domain name features by obtaining the corresponding relationship between the application and the domain name in the application management module 2. This step supports manual adjustment and optimizes special extraction with the help of the experience of operation and maintenance personnel;

[0123] Step S402, according to the "unrecognized" mark of step S103, the results of the domain name data statistical analysis module 5 are screened to generate an "unrecognized" domain name information set;

[0124] Step S403: associate the information of step S401 and step S402 through the domain name identification feature to generate the association relationship between the "unidentified" domain name of step S103 and the application

[0125] After association, application information is added to the domain name management information, and its data format is <domain name>. application 1, ..., application n.

[0126] In the association of domain names with applications 7, the data of the application domain name feature identification module 6 is classified and processed according to the type, specifically including the following steps:

[0127] Step S501: For the domains marked as invalid in step S104, send them to the domain name management module 1 for data update and delete the invalid domain names;

[0128] Step S502, for the domain name successfully identified in step S403, the application information maintenance unit 23 of the associated application management module 2 establishes an association between the domain name and the application maintenance information with the application;

[0129] Step S503, for the domain names that failed to be identified in step S403, they are processed by broadcasting, first marked with manual identification, and for those that still cannot be identified, they are confirmed by broadcasting.

[0130] For example, based on the above domain name management method, assume that there are three domain names in the application management module:

[0131] Domain name 1: App1.node-n.web.a.1.cs.bank, corresponding application: app1

[0132] Domain name 2: App21.node-n.web.b.7.bank, corresponding application: app2

[0133] Domain name 3: App2.node-n.web.a.6.dr.bank, corresponding application: app2

[0134] In addition to these three domain names, the domain name management module also has the following three domain names:

[0135] Domain 1: App1.node-n.web.a.1.cs.bank

[0136] Domain 2: App21.node-n.web.b.7.bank

[0137] Domain 3: App2.node-n.web.a.6.dr.bank

[0138] Domain 4: App3.0.web.a.1.cs.bank

[0139] Domain 5: App4.node-n.web.b.bank

[0140] Domain 6: App21.node-n.web.a.6.bank

[0141] In order to identify the applications corresponding to domain names 4, 5, and 6, the domain name data cleaning module 3 first associates the application system and the network management system through the domain name, and determines the validity of domain names 1, 2, and 3 according to the IP and domain name registration status in the network system. If the domain name and IP in the network system are both valid, further processing is performed, otherwise it is excluded. After association, the information processing information becomes:

[0142] Domain name 1: App1.node-n.web.alcs.bank, corresponding application: app1

[0143] Domain name 2: App21.node-n.web.b.7.bank, corresponding application: app2

[0144] Domain name 3: App2.node-n.web.a.6.dr.bank, corresponding application: app2

[0145] Domain name 4: App3.0.web.a.1.cs.bank, corresponding application: unknown

[0146] Domain name 5: App4.node-n.web.b.bank, corresponding application: unknown

[0147] Domain name 6: App21.node-n.web.a.6.bank, corresponding application: unknown

[0148] It should be noted that in node-n, n is the application group number and node is the application node name, which are not necessarily the same.

[0149] The domain name data splitting module 4 simplifies the domain name, removes the main domain name, and splits it according to the separator, where bank, cs.bank, and dr.bank are the main domain names (first-level domain names), and splits them into an array format. In addition, whether to mark [a], [1] and the like as invalid can be configured through definition. The splitting result is:

[0150] Domain name 1: [App1][node-n][web][a][1], corresponding application: app1

[0151] Domain name 2: [App21][node-n][web][b][7], corresponding application: app2

[0152] Domain name 3: [App2][node-n][web][a][6], corresponding application: app2

[0153] Domain name 4: [App3][0][web][a][1], corresponding application: unknown

[0154] Domain name 5: [App4][node-n][web][b], corresponding application: unknown

[0155] Domain name 6: [App21][node-n][web][a][6], corresponding application: unknown

[0156] The domain name data statistical analysis module 5 performs statistical distribution analysis on the data provided by the domain name data splitting module 4 by segment latitude and vertical direction, that is, statistics are performed on data with the same location identifier. A frequency threshold is set, and data below the frequency threshold is valid data. After this step, the extracted features of the generated domain name are as follows:

[0157] Domain name 1: [App1][node-n][web][a][1], corresponding application: app1

[0158] Domain name 2: [App21][node-n][web][b][7], corresponding application: app2

[0159] Domain name 3: [App2][node-n][web][a][6], corresponding application: app2

[0160] Domain name 4: [App3][0][web][a][1], corresponding application: unknown

[0161] Domain name 5: [App4][node-n][web][b], corresponding application: unknown

[0162] Domain name 6: [App21][node-n][web][a][6], corresponding application: unknown

[0163] Analyze the vertical data statistical features. For example, the first column from left to right, that is, the features with position identifiers of 1, includes app1 once, app2 three times, app3 once, and app4 once; the third column, that is, the features with position identifiers of 3, includes web six times.

[0164] The domain name feature recording module 6 obtains the application list information from the application management module 2 and associates it with the domain name feature. If an association is generated, the relevant application name may be added to the domain name and application association information.

[0165] Through the processing of module 5, the extracted features of the above domain names are converted into a known feature library and a feature library to be identified, wherein the known feature library is:

[0166] Application: app1Domain 1Features: [App1][node-n]

[0167] Application: app2 Domain 2 Features: [App21][node-n][App2][node-n]

[0168] The feature library to be identified is:

[0169] Application: Unknown domain 4 features [App3][node-n]

[0170] Application: Unknown domain 5 features [App4][node-n]

[0171] Application: Unknown domain name 6 features [App2][node-n]

[0172] In addition, the application name can also be used as a feature library and added to the known feature library. The final known feature library is as follows:

[0173] Application: app1 domain 1 feature [App1][node-n]

[0174] Application: app2 domain 2 feature [App21][node-n][App2][node-n]

[0175] Application: app3 domain null feature [App3]

[0176] Application: app4 domain null feature [App4]

[0177] The feature library to be identified is matched with the known feature library, and the identification result is obtained by matching the feature fields:

[0178] For example, the feature "Application: Unknown domain name 4 [App3] [node-n]" in the recognition feature library is associated with the feature "Application: app3 domain name null [App3]" in the known feature library, and the result is "Application: app3, domain name 4, confirmation status [pending confirmation]. To ensure the accuracy of the result, the application architect of app3 is asked to confirm whether domain name 4 is its domain name. After confirmation, it becomes "Application: app3, domain name 4, confirmation status [confirmed]", and then entered into the application management system 2 for synchronization, and the feature of domain name 4 is processed according to the above process and added to the known feature library for subsequent use.

[0179] Based on the above domain name identification method, the present disclosure also provides a domain name identification device. Fig. 9 The device is described in detail.

[0180] Fig. 9 The structural block diagram of the domain name identification device according to an embodiment of the present disclosure is schematically shown.

[0181] like Fig. 9 As shown, the domain name identification device 900 of this embodiment includes a first acquisition module 910 , an extraction module 920 , a second acquisition module 930 , a division module 940 , a matching module 950 and a result generation module 960 .

[0182] The first acquisition module 910 is used to acquire a first domain name set recorded in the domain name management system, wherein the first domain name set includes multiple domain names. In one embodiment, the first acquisition module 910 can be used to perform the operation S210 described above, which will not be described in detail here.

[0183] The extraction module 920 is used to extract the domain name features of each domain name in the first domain name set respectively to obtain N domain name feature sets, where N is an integer greater than or equal to 1. In one embodiment, the extraction module 920 can be used to perform the operation S220 described above, which will not be repeated here.

[0184] The second acquisition module 930 is used to acquire a second domain name set recorded by the application management system, wherein the first domain name set includes the second domain name set, the second domain name set includes N1 domain names, each of the N1 domain names corresponds to an application, N1 is an integer greater than or equal to 0, and N1 is less than or equal to N. In an embodiment, the second acquisition module 930 can be used to perform the operation S230 described above, which will not be repeated here.

[0185] The division module 940 is used to divide the N domain names in the first domain name set into N1 identified domain names and N2 unidentified domain names based on the second domain name set, where N2 is an integer greater than or equal to 0, and N1+N2=N. In one embodiment, the division module 940 can be used to perform the operation S240 described above, which will not be repeated here.

[0186] The matching module 950 is used to match the domain name feature set of each of the N2 unrecognized domain names with the domain name feature set of the N1 recognized domain names to obtain a matching result of the unrecognized domain name. In one embodiment, the matching module 950 can be used to perform the operation S250 described above, which will not be described in detail here.

[0187] The result generation module 960 is used to determine the recognition result of the unrecognized domain name based on the matching result. In one embodiment, the result generation module 960 can be used to perform the operation S260 described above, which will not be described in detail here.

[0188] According to an embodiment of the present disclosure, the extraction module includes: a removal unit, used to remove invalid domain names in the first domain name set; an extraction unit, used to extract multiple candidate domain name features of each domain name in the first domain name set after the invalid domain names are removed, to obtain N candidate domain name feature sets, wherein each candidate domain name feature includes a position identifier; and a screening unit, used to screen the candidate domain name features in each candidate domain name feature set based on the position identifier of each candidate domain name feature using a statistical method to obtain N domain name feature sets.

[0189] According to an embodiment of the present disclosure, the screening unit includes: a first acquisition submodule, used to obtain candidate domain name features with the same position identifier in the N candidate domain name feature sets, and determine the multiple candidate domain name feature types to which the candidate domain name features with the same position identifier belong; a preset submodule, used to preset a frequency threshold; a statistical submodule, used to count the frequency of each candidate domain name feature type; a screening submodule, used to screen out a target domain name feature type whose frequency is less than the frequency threshold from the candidate domain name feature types; and a set generation submodule, used to retain only the domain name features of the target domain name feature type for each candidate domain name feature set in the N candidate domain name feature sets, to obtain N domain name feature sets.

[0190] According to an embodiment of the present disclosure, the domain name includes multiple character segments and separators; the extraction unit includes: a removal submodule, used to remove the main domain name character segment from the multiple character segments of the domain name; and a splitting submodule, used to split the remaining character segments of the domain name according to the separators to obtain multiple candidate domain name features of the domain name.

[0191] According to an embodiment of the present disclosure, the matching module includes: a first calculation unit, used to calculate the similarity between the domain name feature set of the unidentified domain name and the domain name feature set of the identified domain name for each domain name feature set of the N1 identified domain names; a preset unit, used to preset a similarity threshold; select K identified domain names whose domain name feature set similarity is greater than the similarity threshold; and a first acquisition unit, used to acquire applications corresponding to the K identified domain names as matching results of the unidentified domain name, wherein K is an integer greater than or equal to 0.

[0192] According to an embodiment of the present disclosure, the first calculation unit includes: a first calculation submodule, used to calculate the number of identical domain name features in the domain name feature set of the unrecognized domain name and the domain name feature set of the recognized domain name as the similarity between the domain name feature set of the unrecognized domain name and the domain name feature set of the recognized domain name.

[0193] According to an embodiment of the present disclosure, the result generation module includes: a first confirmation submodule, which is used to send the matching result of the unrecognized domain name when K is greater than or equal to 1; receive the confirmation result of the matching result; and obtain the identification result of the unrecognized domain name based on the confirmation result; and, a second confirmation submodule, which is used to broadcast the unrecognized domain name when K is equal to 0 to obtain the identification result of the unrecognized domain name.

[0194] According to an embodiment of the present disclosure, any multiple modules of the first acquisition module 910, the extraction module 920, the second acquisition module 930, the partition module 940, the matching module 950 and the result generation module 960 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first acquisition module 910, the extraction module 920, the second acquisition module 930, the partition module 940, the matching module 950 and the result generation module 960 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation modes of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the first acquisition module 910, the extraction module 920, the second acquisition module 930, the division module 940, the matching module 950 and the result generation module 960 can be at least partially implemented as a computer program module, which can perform corresponding functions when executed.

[0195] Fig.10 A block diagram of an electronic device suitable for implementing a domain name identification method according to an embodiment of the present disclosure is schematically shown.

[0196] like Fig.10 As shown, the electronic device 1000 according to an embodiment of the present disclosure includes a processor 1001, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage part 1008 into a random access memory (RAM) 1003. The processor 1001 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 1001 may also include an onboard memory for caching purposes. The processor 1001 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0197] In RAM 1003, various programs and data required for the operation of electronic device 1000 are stored. Processor 1001, ROM 1002 and RAM 1003 are connected to each other via bus 1004. Processor 1001 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 1002 and / or RAM 1003. It should be noted that the program can also be stored in one or more memories other than ROM 1002 and RAM 1003. Processor 1001 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0198] According to an embodiment of the present disclosure, the electronic device 1000 may further include an input / output (I / O) interface 1005, which is also connected to the bus 1004. The electronic device 1000 may further include one or more of the following components connected to the I / O interface 1005: an input portion 1006 including a keyboard, a mouse, etc.; an output portion 1007 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 1008 including a hard disk, etc.; and a communication portion 1009 including a network interface card such as a LAN card, a modem, etc. The communication portion 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the I / O interface 1005 as needed. A removable medium 1011, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1010 as needed, so that a computer program read therefrom is installed into the storage portion 1008 as needed.

[0199] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0200] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 1002 and / or RAM 1003 described above and / or one or more memories other than ROM 1002 and RAM 1003.

[0201] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method of the embodiment of the present disclosure.

[0202] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 1001. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0203] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 1009, and / or installed from the removable medium 1011. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0204] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 1009, and / or installed from the removable medium 1011. When the computer program is executed by the processor 1001, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0205] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0206] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0207] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0208] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A domain name identification method, characterized in that: The method comprises: Acquire a first domain name set recorded in a domain name management system, wherein the first domain name set includes multiple domain names; Extracting domain name features of each domain name in the first domain name set respectively to obtain N domain name feature sets, where N is an integer greater than or equal to 1; Obtain a second domain name set recorded in the application management system, wherein the first domain name set includes the second domain name set, the second domain name set includes N1 domain names, each of the N1 domain names corresponds to an application, N1 is an integer greater than or equal to 0, and N1 is less than or equal to N; Based on the second domain name set, divide the N domain names in the first domain name set into N1 identified domain names and N2 unidentified domain names, where N2 is an integer greater than or equal to 0, and N1+N2=N; For each of the N2 unrecognized domain names, matching the domain name feature set of the unrecognized domain name with the domain name feature sets of the N1 recognized domain names to obtain a matching result of the unrecognized domain name; and Based on the matching result, an identification result of the unrecognized domain name is determined.

2. The method according to claim 1, characterized in that The step of respectively extracting the domain name features of each domain name in the first domain name set to obtain N domain name feature sets includes: Removing invalid domain names from the first domain name set; For each domain name in the first domain name set after the invalid domain names are removed, extract multiple candidate domain name features of the domain name to obtain N candidate domain name feature sets, wherein each candidate domain name feature includes a location identifier; and Based on the position identifier of each candidate domain name feature, the candidate domain name features in each candidate domain name feature set are screened using a statistical method to obtain N domain name feature sets.

3. The method according to claim 2, characterized in that The step of using a statistical method to screen the candidate domain name features in each candidate domain name feature set to obtain N domain name feature sets includes: In the N candidate domain name feature sets, candidate domain name features with the same position identifier are obtained, and multiple candidate domain name feature types to which the candidate domain name features with the same position identifier belong are determined; Preset frequency threshold; For each candidate domain name feature type, counting the frequency of the candidate domain name feature type; Filtering out a target domain name feature type whose frequency is less than the frequency threshold from the candidate domain name feature types; and For each candidate domain name feature set in the N candidate domain name feature sets, only domain name features of the target domain name feature type are retained to obtain N domain name feature sets.

4. The method according to claim 2 or 3, characterized in that: The domain name includes a plurality of character segments and separators; The step of extracting multiple candidate domain name features of each of the N domain names comprises: removing the primary domain name character segment from the multiple character segments of the domain name; and The remaining character segments of the domain name are split according to the separators to obtain multiple candidate domain name features of the domain name.

5. The method according to claim 1, characterized in that The step of matching the domain name feature set of the unrecognized domain name with the domain name feature sets of the N1 recognized domain names to obtain a matching result of the unrecognized domain name includes: For each domain name feature set of the N1 identified domain names, calculating the similarity between the domain name feature set of the unidentified domain name and the domain name feature set of the identified domain name; Preset similarity threshold; Selecting K identified domain names whose similarity of the domain name feature set is greater than the similarity threshold; and Applications corresponding to the K identified domain names are obtained as matching results of the unidentified domain names, where K is an integer greater than or equal to 0.

6. The method according to claim 5, characterized in that The step of calculating the similarity between the domain name feature set of the unrecognized domain name and the domain name feature set of the recognized domain name comprises: The number of identical domain name features in the domain name feature set of the unrecognized domain name and the domain name feature set of the recognized domain name is calculated as the similarity between the domain name feature set of the unrecognized domain name and the domain name feature set of the recognized domain name.

7. The method according to claim 5 or 6, characterized in that: The step of determining the identification result of the unrecognized domain name based on the matching result comprises: When K is greater than or equal to 1, sending the matching result of the unrecognized domain name; receiving a confirmation result of the matching result; and Based on the confirmation result, obtaining an identification result of the unrecognized domain name; and, When K is equal to 0, the unrecognized domain name is broadcasted to obtain an identification result of the unrecognized domain name.

8. A domain name identification device, comprising: A first acquisition module, configured to acquire a first domain name set recorded in the domain name management system, wherein the first domain name set includes a plurality of domain names; An extraction module, used to extract domain name features of each domain name in the first domain name set respectively, to obtain N domain name feature sets, where N is an integer greater than or equal to 1; A second acquisition module is used to acquire a second domain name set recorded by the application management system, wherein the first domain name set includes the second domain name set, the second domain name set includes N1 domain names, each of the N1 domain names corresponds to an application, N1 is an integer greater than or equal to 0, and N1 is less than or equal to N; a division module, configured to divide the N domain names in the first domain name set into N1 identified domain names and N2 unidentified domain names based on the second domain name set, wherein N2 is an integer greater than or equal to 0, and N1+N2=N; a matching module, configured to match, for each of the N2 unrecognized domain names, a domain name feature set of the unrecognized domain name with a domain name feature set of the N1 recognized domain names, to obtain a matching result of the unrecognized domain name; and The result generating module is used to determine the recognition result of the unrecognized domain name based on the matching result.

9. An electronic device, comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images