A network traffic processing method, device and processing equipment based on domain name

Abstract

The present application provides a domain name-based network traffic processing method, device and processing equipment, which are used to obtain specific network traffic more concisely and achieve accurate network traffic capture effect. The domain name-based network traffic processing method provided by the present application includes: obtaining the network traffic to be processed, wherein the network traffic to be processed is used to analyze whether it belongs to the network traffic of the preset target object; extracting the domain name of the receiver and the domain name of the sender of the network traffic to be processed at the application level; determining whether the network traffic to be processed matches the domain name matching rule of the preset target object based on the domain name of the receiver and the domain name of the sender; if it matches, determining that the network traffic to be processed belongs to the network traffic of the target object.

Description

Technical Field

[0001] The present application relates to the field of Internet, and in particular to a domain name-based network traffic processing method, device and processing equipment. Background Art

[0002] The Domain Name System (DNS) protocol is a very important protocol in computer networks, which realizes the conversion between domain names and Internet Protocol Addresses (IP). Therefore, in the DNS devices in the network architecture, the DNS traffic is the traffic that is easy to focus on in network traffic monitoring.

[0003] However, the inventors of the present application have discovered that due to the large amount of DNS traffic in the network, the traffic monitoring systems in the prior art often capture and display all traffic indiscriminately, which means that a large amount of storage resources such as hard disks or databases are required for storage, which obviously results in high application costs or inconvenience in application. Summary of the invention

[0004] The present application provides a domain name-based network traffic processing method, apparatus, and processing device for more concisely acquiring specific network traffic and achieving accurate network traffic capture effects.

[0005] In a first aspect, the present application provides a method for processing network traffic based on a domain name, the method comprising:

[0006] Obtaining the network traffic to be processed, wherein the network traffic to be processed is used to analyze whether it belongs to the network traffic of a preset target object;

[0007] Extract the domain name of the receiver and the domain name of the sender of the network traffic to be processed at the application level;

[0008] Determine whether the network traffic to be processed matches the preset domain name matching rule of the target object according to the domain name of the receiver and the domain name of the sender;

[0009] If there is a match, it is determined that the network traffic to be processed belongs to the network traffic of the target object.

[0010] In combination with the first aspect of the present application, in a first possible implementation manner of the first aspect of the present application, if the network traffic to be processed belongs to a request message type and the target object is a target session, after determining that the network traffic to be processed belongs to the network traffic of the target object, the method further includes:

[0011] Create a log of the target object;

[0012] The relevant session features of the network traffic to be processed are written into the log of the target session for storage.

[0013] In combination with the first aspect of the present application, in a second possible implementation manner of the first aspect of the present application, if the network traffic to be processed belongs to a response message type and the target object is a target session, after determining that the network traffic to be processed belongs to the network traffic of the target object, the method further includes:

[0014] The relevant session features of the network traffic to be processed are written into the log of the target session for storage.

[0015] In combination with the first or second possible implementation of the first aspect of the present application, in a third possible implementation of the first aspect of the present application, the method further includes:

[0016] Extracting five-tuple information of the network traffic to be processed, wherein the five-tuple information specifically includes source IP, destination IP, source port, destination port and protocol type;

[0017] Determine whether the network traffic to be processed belongs to the target session based on the five-tuple information.

[0018] In combination with the third possible implementation manner of the first aspect of the present application, in a fourth possible implementation manner of the first aspect of the present application, if the network traffic to be processed does not contain a relevant query message or response message, and the target object is a target session, the method further includes:

[0019] In the log of the target session of the network traffic to be processed, a missing flag is added to the network traffic to be processed, wherein the missing flag is used to identify that there is no related query message or response message in the network traffic to be processed.

[0020] In combination with the first aspect of the present application, in a fifth possible implementation of the first aspect of the present application, determining whether the to-be-processed network traffic matches a preset domain name matching rule of the target object according to the domain name of the receiver and the domain name of the sender includes:

[0021] Based on the domain name of the receiver and the domain name of the sender, the hyperscan engine is used to determine whether the network traffic to be processed matches the preset domain name matching rule of the target object, wherein the hyperscan engine writes the domain name keyword and the corresponding ID number for matching.

[0022] In combination with the first aspect of the present application, in a sixth possible implementation of the first aspect of the present application, the traffic to be processed is specifically DNS traffic passing through the DNS device.

[0023] In a second aspect, the present application provides a domain name-based network traffic processing device, the device comprising:

[0024] An acquisition unit, used for acquiring the network traffic to be processed, wherein the network traffic to be processed is used to analyze whether it belongs to the network traffic of a preset target object;

[0025] An extraction unit, used for extracting the domain name of the receiver and the domain name of the sender of the network traffic to be processed at the application level;

[0026] The determination unit is used to determine whether the network traffic to be processed matches the preset domain name matching rule of the target object according to the domain name of the receiver and the domain name of the sender. If so, the network traffic to be processed is determined to be the network traffic of the target object.

[0027] In conjunction with the second aspect of the present application, in a first possible implementation of the second aspect of the present application, the device further includes a log processing unit, which, if the network traffic to be processed belongs to a request message type and the target object is a target session, is used to:

[0028] Create a log of the target object;

[0029] The relevant session features of the network traffic to be processed are written into the log of the target session for storage.

[0030] In combination with the second aspect of the present application, in a second possible implementation of the second aspect of the present application, the device further includes a log processing unit, which, if the network traffic to be processed belongs to a response message type and the target object is a target session, is used to:

[0031] The relevant session features of the network traffic to be processed are written into the log of the target session for storage.

[0032] In combination with the first or second possible implementation manner of the second aspect of the present application, in a third possible implementation manner of the second aspect of the present application, the determining unit is further used to:

[0033] Extracting five-tuple information of the network traffic to be processed, wherein the five-tuple information specifically includes source IP, destination IP, source port, destination port and protocol type;

[0034] Determine whether the network traffic to be processed belongs to the target session based on the five-tuple information.

[0035] In combination with the third possible implementation manner of the second aspect of the present application, in a fourth possible implementation manner of the second aspect of the present application, the device further includes a log processing unit, which, if there is no relevant query message or response message in the network traffic to be processed, and the target object is a target session, is used to:

[0036] In the log of the target session of the network traffic to be processed, a missing flag is added to the network traffic to be processed, wherein the missing flag is used to identify that there is no related query message or response message in the network traffic to be processed.

[0037] In conjunction with the second aspect of the present application, in a fifth possible implementation manner of the second aspect of the present application, the determining unit is specifically configured to:

[0038] Based on the domain name of the receiver and the domain name of the sender, the hyperscan engine is used to determine whether the network traffic to be processed matches the preset domain name matching rule of the target object, wherein the hyperscan engine writes the domain name keyword and the corresponding ID number for matching.

[0039] In combination with the second aspect of the present application, in a sixth possible implementation of the second aspect of the present application, the traffic to be processed is specifically DNS traffic passing through the DNS device.

[0040] In a third aspect, the present application provides a processing device, including a processor and a memory, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the method provided in the first aspect of the present application or any possible implementation method of the first aspect of the present application is executed.

[0041] In a fourth aspect, the present application provides a computer-readable storage medium, which stores multiple instructions, and the instructions are suitable for a processor to load to execute the method provided by the first aspect of the present application or any possible implementation of the first aspect of the present application.

[0042] From the above content, it can be concluded that the present application has the following beneficial effects:

[0043] For the need to capture specific network traffic, this application starts from the application layer of the network traffic to be processed, determines the domain name of the receiver and the domain name of the sender, and then combines the domain name matching rules of the target object to determine the matching relationship between the network traffic to be processed and the target object. Under this convenient processing architecture, there is no need to pay attention to and analyze the specific traffic content, and the acquisition of specific network traffic (network traffic of the target object) can be carried out more concisely to achieve accurate network traffic capture effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0045] Figure 1 A flowchart of a domain name-based network traffic processing method of the present application;

[0046] Figure 2 A workflow diagram for the domain name matching process of this application;

[0047] Figure 3 A schematic diagram of the structure of a domain name-based network traffic processing device of the present application;

[0048] Figure 4 A schematic diagram of the structure of the processing equipment of this application. DETAILED DESCRIPTION

[0049] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0050] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described here can be implemented in an order other than that illustrated or described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices. The naming or numbering of steps in this application does not mean that the steps in the method flow must be executed in the time / logical sequence indicated by the naming or numbering. The process steps that have been named or numbered can change the execution order according to the technical purpose to be achieved, as long as the same or similar technical effects can be achieved.

[0051] The division of modules in this application is a logical division. There may be other division methods when it is implemented in actual applications. For example, multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection between modules can be electrical or other similar forms, which are not limited in this application. In addition, the modules or submodules described as separate components may or may not be physically separated, may or may not be physical modules, or may be distributed in multiple circuit modules, and some or all of the modules may be selected according to actual needs to achieve the purpose of the present application.

[0052] Before introducing the domain name-based network traffic processing method provided by the present application, the background content involved in the present application is first introduced.

[0053] The domain name-based network traffic processing method, device and computer-readable storage medium provided in the present application can be applied to processing equipment to obtain specific network traffic more concisely and achieve accurate network traffic capture effect.

[0054] The domain name-based network traffic processing method mentioned in this application can be executed by a domain name-based network traffic processing device, or a server, physical host or user equipment (UE) and other different types of processing devices integrated with the domain name-based network traffic processing device. Among them, the domain name-based network traffic processing device can be implemented in hardware or software, and the UE can be a terminal device such as a smart phone, a tablet computer, a laptop computer, a desktop computer or a personal digital assistant (PDA), and the processing device can be set in a device cluster.

[0055] It should be understood that the processing device only needs to have the ability to execute the functional services involved in the domain name-based network traffic processing method of this application. Therefore, the device form and the device architecture in which it is located can be adaptively adjusted according to actual needs. Returning to the network architecture scenario, it is obvious that the processing device can directly be a specific network device node in the network architecture that needs to perform traffic capture and traffic monitoring, so that the network device node itself can achieve convenient and accurate traffic capture effects through its own domain name-based network traffic processing method.

[0056] Next, we will introduce the domain name-based network traffic processing method provided by this application.

[0057] First, see Figure 1 , Figure 1 A schematic diagram of a flow chart of a domain name-based network traffic processing method of the present application is shown. The domain name-based network traffic processing method provided by the present application may specifically include the following steps S101 to S105:

[0058] Step S101, obtaining the network traffic to be processed, wherein the network traffic to be processed is used to analyze whether it belongs to the network traffic of a preset target object;

[0059] It can be understood that, corresponding to the network traffic analysis scenario involved in this application, the first thing to do is to determine the current or current network traffic that needs to be processed. For the convenience of explanation, it is recorded as the network traffic to be processed.

[0060] Among them, the network traffic to be processed can be either the traffic monitored in real time or the traffic monitored historically. In addition, the acquisition and processing of the network traffic to be processed can be either the acquisition and processing initiated by the processing device itself or the traffic transmitted for processing by other devices for the network traffic analysis scenario involved in this application. Obviously, it has high flexibility in actual applications and can be adjusted according to actual needs.

[0061] In addition, the present application is proposed based on the defects of DNS traffic involved in the prior art. Therefore, the network traffic to be processed can specifically be DNS traffic. Of course, in practical applications, considering that in addition to DNS traffic, the present application can also achieve simple and accurate capture effects on other types of network traffic, so it can also be applied to other types of network traffic or network traffic at other device nodes.

[0062] As for the DNS traffic itself, which is the main target of this application, as a specific implementation method, the traffic to be processed can be specifically the DNS traffic passing through the DNS device. Therefore, this application can focus on the NDS device and easily and accurately capture specific network traffic from the DNS traffic passing through it for use by related data applications.

[0063] For the sake of convenience, the following content takes DNS traffic as an example.

[0064] Step S102, extracting the domain name of the receiver and the domain name of the sender of the network traffic to be processed at the application level;

[0065] It can be understood that the capture of network traffic in this application does not focus on the actual content to be transmitted, but rather distinguishes network traffic based on its domain name.

[0066] In this way, domain name extraction and processing can be performed starting from the application layer. Specifically, the domain name of the relevant recipient and sender can be extracted from the specific location of the domain name in the application layer data of the network traffic to be processed, laying the foundation for subsequent domain name identification.

[0067] Step S103, determining whether the to-be-processed network traffic matches a preset domain name matching rule of the target object according to the domain name of the receiver and the domain name of the sender, and if so, triggering step S104;

[0068] It can be understood that the network traffic analysis performed in this application is accurately captured based on domain names. Therefore, domain name matching rules can be pre-configured so that the corresponding domain names can be adapted in subsequent applications, thereby determining specific network traffic.

[0069] Among them, the domain name matching rule is configured based on the corresponding object. Under this setting, each domain name matching rule corresponds to an object. In this way, the specific network traffic determined corresponds to a specific object, achieving the effect of capturing network traffic based on the domain name and targeting the specific object.

[0070] Correspondingly, after determining the domain name of the receiver and the domain name of the sender of the current network traffic to be processed, they can be matched with the preset domain name matching rules of the target object. If there is a match, it can be obviously determined as network traffic related to the target object.

[0071] It is worth adding that the target object may be one object or multiple objects, and each object may be configured with its own corresponding domain name matching rule.

[0072] Step S104: determine whether the network traffic to be processed belongs to the network traffic of the target object.

[0073] After determining that there is a match, the current network traffic to be processed can be determined as network traffic belonging to the target object according to a specific result determination mechanism.

[0074] Among them, the determination process can obviously be carried out according to actual needs to determine the specific processing content, and is generally adjusted later based on the relevant data application of the specific captured network traffic.

[0075] from Figure 1 It can be seen from the illustrated embodiments that, in order to meet the need to capture specific network traffic, the present application starts from the application layer of the network traffic to be processed, determines the domain name of the receiver and the domain name of the sender, and then combines the domain name matching rule of the target object to determine the matching relationship between the network traffic to be processed and the target object. Under this convenient processing architecture, there is no need to pay attention to or analyze the specific traffic content, and the acquisition of specific network traffic (network traffic of the target object) can be performed more concisely to achieve accurate network traffic capture effect.

[0076] Continue to the above Figure 1 Each step of the illustrated embodiment and possible implementation methods thereof in practical applications are described in detail.

[0077] It can be understood that the execution unit for capturing network traffic in the present application, that is, the specific object mentioned above, can specifically be a session. That is to say, the present application can accurately capture the corresponding network traffic for a specific session (for example, the existence of a specific conversation party, a specific time point, and other specific conversation features). In network work, this can involve both operational business considerations and network security considerations, and obviously has outstanding practical value.

[0078] For example, network request messages are distinguished by session according to the five-tuple information. Messages with the same five-tuple or with only the source IP and destination IP swapped can obviously be directly considered to belong to the same session.

[0079] As an example, a hash calculation may be performed based on the five-tuple information to generate a hash table as a session table, which can facilitate rapid query of the session to which a certain message belongs.

[0080] The session table data structure may be configured as follows:

[0081]

[0082] Correspondingly, for the subsequent determination process of whether it belongs to the target session, the method of the present application may also include the following contents:

[0083] Extracting five-tuple information of the network traffic to be processed, wherein the five-tuple information specifically includes source IP, destination IP, source port, destination port and protocol type;

[0084] Determine whether the network traffic to be processed belongs to the target session based on the five-tuple information.

[0085] Among them, the source IP and the destination IP between the five-tuple information of the network traffic to be processed and the five-tuple information specific to the target session can be set to be the same relationship or the exchange relationship.

[0086] Furthermore, when the network traffic is presented in the form of messages, the present application can also divide it into two types: request and response, i.e., request message type and response message type, so as to perform network traffic analysis at a smaller granularity.

[0087] In the process of network traffic analysis, log factors can also be introduced to provide more detailed feature annotation effects for the traffic capture processing of session units, so that concise and rich feature references can be provided in the subsequent related analysis and processing of the captured network traffic.

[0088] Specifically, as another specific implementation, if the network traffic to be processed belongs to the request message type, and the target object is the target session, after step S104 determines that the network traffic to be processed belongs to the network traffic of the target object, the method of the present application may further include:

[0089] Create a log of the target object;

[0090] The relevant session features of the network traffic to be processed are written into the log of the target session for storage.

[0091] It can be understood that each session is triggered by a request message. If the session proceeds normally, there will be a corresponding response message. In this way, when it is determined that there is a request message corresponding to the target session, the corresponding log can be created first, and the relevant session features of the current response message (current network traffic to be processed) can be written into the log for feature storage for subsequent use.

[0092] After the log of the target session is created according to the request message, the subsequent messages belonging to the same target session can continue to extract their session features and continue to write them into the log, thus forming a complete session feature recording effect of the target session.

[0093] Correspondingly, there is another situation where the currently processed message is already a response message type, that is, if the network traffic to be processed belongs to the response message type and the target object is a target session, then after step S104 determines that the network traffic to be processed belongs to the network traffic of the target object, the method of the present application may further include:

[0094] The relevant session features of the network traffic to be processed are written into the log of the target session for storage.

[0095] It can be understood that the log written here is created based on the corresponding request message.

[0096] For the session features of the response message, in addition to the basic session features that can be extracted from the request message, such as the domain name and the corresponding IP, it can also involve session features related to the response, such as the query return code and response time.

[0097] In addition, the present application also takes into account the interference of abnormal factors such as network fluctuations, message disorder or packet loss that may exist in actual applications, which may lead to the lack of request messages or response messages in a session. For example, the DNS response message is received first, or only the DNS query message is received without a corresponding response. In this way, in the logs related to network traffic, it is obvious that due to the lack of requests, there will also be a lack of records of session characteristics of related requests. For this situation, the present application can also mark it out to record the relevant session situation more accurately and delicately, and continue to improve the recorded content.

[0098] Specifically, if there is no relevant query message or response message in the network traffic to be processed, as another specific implementation manner, the method of the present application may further include:

[0099] In the log of the network traffic to be processed, a missing flag is added for the network traffic to be processed, wherein the missing flag is used to indicate that there is no related query message or response message for the network traffic to be processed.

[0100] It is easy to understand that, through the configuration of the missing identifier, the situation in which the corresponding message of the same session is missing is concisely and clearly identified.

[0101] In addition, corresponding to the settings of this application for capturing network traffic for sessions and configuring corresponding logs for sessions, the configuration of the missing identifier here can be directly configured in the log to continue to improve the content recorded in the corresponding log of the session.

[0102] Correspondingly, in another specific implementation, the target object is a target session, and in the log of the network traffic to be processed, a missing mark is added to the network traffic to be processed, which may specifically include the following contents:

[0103] In the log of the target session of the network traffic to be processed, a missing flag is added to the network traffic to be processed, wherein the missing flag is used to identify that there is no related query message or response message in the network traffic to be processed.

[0104] In addition, for the matching processing involved in this application, that is, the matching processing based on the domain name matching rules of the pre-set target object, it can be understood that the staff can set up the domain name matching rules involved in advance, and each rule can contain several domain names. These rules represent the corresponding domain names of the DNS traffic that the staff wants to pay attention to. The system then parses the received DNS message, obtains its domain name information, and matches it in the user's preset rule list to check whether it is the traffic of concern.

[0105] In addition, an update mechanism can be introduced for the use of logs. After the subsequent application is completed (such as for front-end interface query and display or other purposes), data clearing operations and log structure data space release operations can be performed. This provides a more favorable processing environment for subsequent traffic capture and processing of other network traffic to be processed, which is beneficial to the overall data processing effect.

[0106] During this process, the applicant discovered that if conventional practices are followed and character strings are compared one by one against the domain name rules when performing domain name matching, this may become a bottleneck for the system when the DNS traffic is large and / or there are many domain name matching rules, and it is difficult to handle massive matching processing within a unit of time.

[0107] Therefore, as another specific implementation method, the present application introduces the hyperscan matching engine to perform matching processing, that is, step S103 determines whether the to-be-processed network traffic matches the preset domain name matching rule of the target object according to the domain name of the receiver and the domain name of the sender, which may specifically include:

[0108] Based on the domain name of the receiver and the domain name of the sender, the hyperscan engine is used to determine whether the network traffic to be processed matches the preset domain name matching rule of the target object, wherein the hyperscan engine writes the domain name keyword and the corresponding ID number for matching.

[0109] As for the hyperscan engine, it is a regular expression engine focusing on high-performance multi-mode and streaming matching. It can quickly and effectively complete domain name matching and directly return matching results, greatly improving matching efficiency.

[0110] To illustrate with an example, if the administrator of the DNS device wants to monitor the DNS traffic for domain names XXX.com and YYY.com in the network, he can configure corresponding domain name rule 1 and domain name rule 2 to include the above two domain names respectively.

[0111] During the configuration of the hyperscan engine, two corresponding rule_ids can be generated. The rule_id is locally unique and is used to distinguish different rules. Then, the two domain names XXX.com and YYY.com are added as keywords to the keyword array (here, keyword information can be formed according to the grammatical rules of regular expressions as needed to achieve exact matching or fuzzy matching);

[0112] At the same time, each rule_id is added as a keyword number to the id number array and returned as a matching result later.

[0113] Then call the hyperscan compilation API interface for compilation. The API requires the entry of a keyword array and an id number array, so that the keyword information and rule_id involved in the domain name matching rules of the two domain names XXX.com and YYY.com are added to the hyperscan engine database, so that the hyperscan engine can carry out its corresponding domain name matching processing.

[0114] In the specific domain name matching process, you can call the hyperscan matching API for matching. The API requires a user-defined callback function to perform post-matching operations. The function directly returns the matched rule rule_id so that you can find which rule is matched.

[0115] To facilitate understanding of the above content, you can also combine Figure 2 A workflow diagram of the domain name matching process of the present application is shown for understanding.

[0116] After completing the capture of domain name-based network traffic, as mentioned above, the corresponding data application can be carried out to achieve the data application effect of network traffic with a precise range, such as the application of logs mentioned above.

[0117] In addition, other types of data applications can be performed according to system characteristics or application requirements, such as displaying logs, counting the proportion of matching DNS traffic, drawing domain name and IP association diagrams, etc., which can be flexibly adjusted according to actual conditions. Since the processing object, that is, network traffic captured based on domain names, has a highly accurate capture effect, it can bring highly accurate data application effects.

[0118] The above is an introduction to the domain name-based network traffic processing method provided by the present application. In order to facilitate better implementation of the domain name-based network traffic processing method provided by the present application, the present application also provides a domain name-based network traffic processing device from the perspective of functional modules.

[0119] See also Figure 3 , Figure 3 This is a structural diagram of a domain name-based network traffic processing device of the present application. In the present application, the domain name-based network traffic processing device 300 may specifically include the following structure:

[0120] An acquisition unit 301 is used to acquire the network traffic to be processed, wherein the network traffic to be processed is used to analyze whether it belongs to the network traffic of a preset target object;

[0121] An extraction unit 302, configured to extract the domain name of the receiver and the domain name of the sender of the network traffic to be processed at the application level;

[0122] The determination unit 303 is used to determine whether the network traffic to be processed matches the preset domain name matching rule of the target object according to the domain name of the receiver and the domain name of the sender. If so, the network traffic to be processed is determined to be the network traffic of the target object.

[0123] In an exemplary implementation, the device further includes a log processing unit 304, which, if the network traffic to be processed is of a request message type and the target object is a target session, is used to:

[0124] Create a log of the target object;

[0125] The relevant session features of the network traffic to be processed are written into the log of the target session for storage.

[0126] In another exemplary implementation, the device further includes a log processing unit 304, which, if the network traffic to be processed is a response message type and the target object is a target session, is used to:

[0127] The relevant session features of the network traffic to be processed are written into the log of the target session for storage.

[0128] In yet another exemplary implementation, the determining unit 303 is further configured to:

[0129] Extracting five-tuple information of the network traffic to be processed, wherein the five-tuple information specifically includes source IP, destination IP, source port, destination port and protocol type;

[0130] Determine whether the network traffic to be processed belongs to the target session based on the five-tuple information.

[0131] In another exemplary implementation, the device further includes a log processing unit 304, which, if the network traffic to be processed does not contain a related query message or response message, and the target object is a target session, is used to:

[0132] In the log of the target session of the network traffic to be processed, a missing flag is added to the network traffic to be processed, wherein the missing flag is used to identify that there is no related query message or response message in the network traffic to be processed.

[0133] In yet another exemplary implementation, the determining unit 303 is specifically configured to:

[0134] Based on the domain name of the receiver and the domain name of the sender, the hyperscan engine is used to determine whether the network traffic to be processed matches the preset domain name matching rule of the target object, wherein the hyperscan engine writes the domain name keyword and the corresponding ID number for matching.

[0135] In yet another exemplary implementation, the traffic to be processed is specifically DNS traffic passing through a DNS device.

[0136] This application also provides a processing device from the perspective of hardware structure, see Figure 4 , Figure 4 401, a computer program stored in the memory 402, and an input / output device 403. The processor 401 is used to execute the computer program stored in the memory 402. Figure 1 The steps of the domain name-based network traffic processing method in the corresponding embodiment; or, the processor 401 is used to execute the computer program stored in the memory 402 to implement the following Figure 3 Corresponding to the functions of each unit in the embodiment, the memory 402 is used to store the processor 401 executing the above Figure 1 The computer program required by the domain name-based network traffic processing method in the corresponding embodiment.

[0137] Exemplarily, the computer program may be divided into one or more modules / units, one or more modules / units are stored in the memory 402, and executed by the processor 401 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the computer device.

[0138] The processing device may include, but is not limited to, a processor 401, a memory 402, and an input / output device 403. Those skilled in the art will appreciate that the illustration is merely an example of a processing device and does not constitute a limitation on the processing device, and may include more or fewer components than shown in the illustration, or a combination of certain components, or different components. For example, the processing device may also include a network access device, a bus, etc., and the processor 401, the memory 402, the input / output device 403, etc. are connected via a bus.

[0139] The processor 401 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the processing device, and uses various interfaces and lines to connect various parts of the entire device.

[0140] The memory 402 can be used to store computer programs and / or modules. The processor 401 implements various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 402 and calling the data stored in the memory 402. The memory 402 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the processing device, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (SecureDigital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0141] When the processor 401 is used to execute the computer program stored in the memory 402, the following functions can be implemented:

[0142] Obtaining the network traffic to be processed, wherein the network traffic to be processed is used to analyze whether it belongs to the network traffic of a preset target object;

[0143] Extract the domain name of the receiver and the domain name of the sender of the network traffic to be processed at the application level;

[0144] Determine whether the network traffic to be processed matches the preset domain name matching rule of the target object according to the domain name of the receiver and the domain name of the sender;

[0145] If there is a match, it is determined that the network traffic to be processed belongs to the network traffic of the target object.

[0146] Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the domain name-based network traffic processing device, processing equipment and corresponding units described above can refer to the following. Figure 1 The description of the domain name-based network traffic processing method in the corresponding embodiment will not be repeated here.

[0147] A person of ordinary skill in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be completed by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0148] To this end, the present application provides a computer-readable storage medium, in which a plurality of instructions are stored, and the instructions can be loaded by a processor to execute the present application as follows: Figure 1 The steps of the domain name-based network traffic processing method in the corresponding embodiment, the specific operations can refer to the following Figure 1 The description of the domain name-based network traffic processing method in the corresponding embodiment will not be repeated here.

[0149] The computer-readable storage medium may include: a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0150] Due to the instructions stored in the computer-readable storage medium, the present application can be executed. Figure 1 The steps of the domain name-based network traffic processing method in the corresponding embodiment, therefore, the present application can be implemented as follows Figure 1 The beneficial effects that can be achieved by the domain name-based network traffic processing method in the corresponding embodiment are detailed in the previous description and will not be repeated here.

[0151] The domain name-based network traffic processing method, apparatus, processing equipment and computer-readable storage medium provided by the present application are introduced in detail above. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for processing network traffic based on domain name, characterized in that: The method comprises: Acquire the network traffic to be processed, wherein the network traffic to be processed is used to analyze whether it belongs to the network traffic of a preset target object; Extracting the domain name of the receiver and the domain name of the sender of the network traffic to be processed at the application level; Determining whether the to-be-processed network traffic matches a preset domain name matching rule of the target object according to the domain name of the receiver and the domain name of the sender; If there is a match, determining that the network traffic to be processed belongs to the network traffic of the target object; If the to-be-processed network traffic belongs to a request message type, and the target object is a target session, after determining that the to-be-processed network traffic belongs to the network traffic of the target object, the method further includes: Creating a log of the target object; Writing the relevant session features of the to-be-processed network traffic into the log of the target session for storage; If the to-be-processed network traffic belongs to a response message type, and the target object is a target session, after determining that the to-be-processed network traffic belongs to the network traffic of the target object, the method further includes: Writing the relevant session features of the to-be-processed network traffic into the log of the target session for storage; The method further comprises: Extracting the five-tuple information of the network traffic to be processed, wherein the five-tuple information specifically includes the source IP, destination IP, source port, destination port and protocol type; Determining, according to the five-tuple information, whether the to-be-processed network traffic belongs to the target session; If the to-be-processed network traffic does not contain any relevant query message or response message, and the target object is a target session, the method further includes: In the log of the to-be-processed network traffic about the target session, a missing flag is added to the to-be-processed network traffic, wherein the missing flag is used to identify that the to-be-processed network traffic does not have a related query message or response message.

2. The method according to claim 1, characterized in that The determining, based on the domain name of the receiver and the domain name of the sender, whether the to-be-processed network traffic matches a preset domain name matching rule of the target object includes: Based on the domain name of the receiver and the domain name of the sender, the hyperscan engine is used to determine whether the network traffic to be processed matches the preset domain name matching rule of the target object, wherein the hyperscan engine writes the domain name keyword and the corresponding ID number for matching.

3. The method according to claim 1, characterized in that: The traffic to be processed is specifically the DNS traffic passing through the DNS device.

4. A network traffic processing device based on domain name, characterized in that: The device comprises: An acquisition unit, used for acquiring the network traffic to be processed, wherein the network traffic to be processed is used for analyzing whether it belongs to the network traffic of a preset target object; An extraction unit, configured to extract, at an application level, a domain name of a receiver and a domain name of a sender of the network traffic to be processed; A determination unit, configured to determine whether the to-be-processed network traffic matches a preset domain name matching rule of the target object according to the domain name of the receiver and the domain name of the sender, and if so, determine that the to-be-processed network traffic belongs to the network traffic of the target object; The device further includes a log processing unit, which, if the network traffic to be processed is of a request message type and the target object is a target session, is used to: Creating a log of the target object; Writing the relevant session features of the to-be-processed network traffic into the log of the target session for storage; Alternatively, if the network traffic to be processed is of a response message type and the target object is a target session, the log processing unit is used to: Writing the relevant session features of the to-be-processed network traffic into the log of the target session for storage; The determining unit is further configured to: Extracting the five-tuple information of the network traffic to be processed, wherein the five-tuple information specifically includes the source IP, destination IP, source port, destination port and protocol type; Determining, according to the five-tuple information, whether the to-be-processed network traffic belongs to the target session; If the to-be-processed network traffic does not contain any relevant query message or response message, and the target object is a target session, the log processing unit is used to: In the log of the to-be-processed network traffic about the target session, a missing flag is added to the to-be-processed network traffic, wherein the missing flag is used to identify that the to-be-processed network traffic does not have a related query message or response message.

5. A processing device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and the processor executes the method according to any one of claims 1 to 3 when calling the computer program in the memory.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor to execute the method according to any one of claims 1 to 3.

Images