A method and apparatus for identifying a content distribution network address

Abstract

Embodiments of the present application provide a method and device for identifying a content distribution network address, comprising: obtaining a corresponding response data packet after sending a probe packet; analyzing the response data packet to obtain network information; wherein the network information comprises a network address, a domain name and a service type; counting a plurality of domain names and service types corresponding to the same network address, and calculating a network address similarity between the network address and each domain name based on the counting result; and determining whether the network address is a content distribution network address according to the network address similarity. The method of the present application can accurately identify a content distribution network address.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of network, and in particular, to a method and device for identifying a content delivery network address. BACKGROUND

[0002] A content delivery network (CDN) can provide required content for a user in proximity, reduce network congestion, and improve response speed. Identifying a content delivery network address based on network traffic can provide support for network supervision. Currently, some common system commands can be used to obtain relevant information of network traffic, and whether the network traffic is a content delivery network address can be determined by analysis or queried from a constructed CDN address database; however, the results determined by these methods are not accurate and comprehensive enough, and false positives and false negatives exist. SUMMARY

[0003] Therefore, embodiments of the present application aim to provide a method and device for identifying a content delivery network address, which can accurately identify a content delivery network address.

[0004] To achieve the above purpose, the embodiments of the present application provide a method for identifying a content delivery network address, which comprises:

[0005] After sending a probe packet, corresponding response data packets are obtained;

[0006] The response data packets are parsed to obtain network information, wherein the network information comprises a network address, a domain name, and a service type;

[0007] Multiple domain names and service types corresponding to the same network address are counted, and network address similarity between the network address and each domain name is calculated based on the counting result;

[0008] Whether the network address is a content delivery network address is determined according to the network address similarity.

[0009] Optionally, the network information further comprises label content for identifying website features; whether the network address is a content delivery network address is determined according to the network address similarity, which comprises:

[0010] When the network address similarity is greater than a preset address similarity threshold, a website similarity is determined according to the label content and a preset website identification model;

[0011] Whether the network address is a content delivery network address is determined according to the website similarity.

[0012] calculating an average distance of the network address to each domain name corresponding to the network address when the network address similarity is less than the address similarity threshold value;

[0013] regarding the network address as a content distribution network address when the average distance is greater than a preset distance threshold value.

[0014] Optionally, determining whether the network address is a content distribution network address according to the website similarity comprises:

[0015] regarding the network address as a content distribution network address when the website similarity is less than a preset website similarity threshold value and the organizations to which the domain names corresponding to the network address belong are different.

[0016] Optionally, the network address comprises an IP address and a port number; and the multiple domain names and service types corresponding to the same network address are counted, comprising:

[0017] determining an intersection of each port number and service type corresponding to the IP address and the port number and service type corresponding to each domain name, counting the number of elements in each intersection; and determining a union of each port number and service type corresponding to the IP address and the port number and service type corresponding to all domain names, counting the number of elements in the union.

[0018] calculating a network address similarity according to the multiple domain names and service types corresponding to the same network address, comprising:

[0019] calculating the network address similarity according to the number of elements in each intersection, the number of elements in the union and the number of domain names.

[0020] Optionally, the method for calculating the network address similarity comprises:

[0021] calculating the network address similarity according to the following formula:

[0022] wherein Similarity is the network address similarity, Pi is the number of elements in the ith intersection, Q is the number of elements in the union, and n is the number of domain names. i represents the ratio of the number of elements in the ith intersection to the number of elements in the union.

[0023] Optionally, the method for calculating the average distance of the network address to each domain name corresponding to the network address comprises:

[0024] calculating the distance of the network address to each domain name; ​​

[0025] According to the distance of the network address to each domain name, the average distance is calculated.

[0026] Optionally, the method for calculating the distance of the network address to each domain name comprises:

[0027]

[0028] Wherein, d is the distance of the network address to the domain name, R is the radius of the earth, lat1 is the latitude corresponding to the network address, lat2 is the latitude corresponding to the domain name, lon1 is the longitude corresponding to the network address, and lon2 is the longitude corresponding to the domain name.

[0029] Optionally, before the distance of the network address to each domain name is calculated, the method further comprises:

[0030] According to the network address and each domain name, a preset geographic information database is queried;

[0031] When the geographic location information corresponding to the network address and each domain name is queried, the distance of the network address to each domain name is calculated according to the geographic location information; wherein, the geographic location information comprises longitude and latitude;

[0032] When the geographic location information is not queried, the website similarity is determined according to the label content and by using a preset website recognition model.

[0033] Optionally, the label content comprises a title and a description; according to the label content, the website similarity is determined by using a preset website recognition model, which comprises:

[0034] The title and the description are taken as website features, which are input into the website recognition model, and the website similarity is output by the website recognition model.

[0035] Embodiments of the present application also provide a content distribution network address identification device, which comprises:

[0036] An acquisition module is configured to acquire a corresponding response data packet after sending a probe packet.

[0037] An analysis module is configured to analyze the response data packet to obtain network information; wherein, the network information comprises a network address, a domain name, and a service type.

[0038] A statistics module is configured to count a plurality of domain names and service types corresponding to a same network address to obtain a statistics result.

[0039] A calculation module is configured to calculate a network address similarity between the network address and each domain name based on the statistics result.

[0040] The identification module is configured to determine whether the network address is a content distribution network address according to the network address similarity.

[0041] Optionally, the network information further comprises label content used for identifying website features.

[0042] The identification module is configured to determine a website similarity according to the label content and a preset website identification model when the network address similarity is greater than a preset address similarity threshold; determine whether the network address is a content distribution network address according to the website similarity; calculate an average distance of the network address to each domain name corresponding to the network address when the network address similarity is less than the address similarity threshold; and determine the network address as a content distribution network address when the average distance is greater than a preset distance threshold.

[0043] Optionally, the identification module is configured to acquire organizations to which each domain name corresponding to the network address belongs according to a preset instruction when the website similarity is less than a preset website similarity threshold, and determine the network address as a content distribution network address if the organizations to which each domain name belongs are all different.

[0044] Optionally, the network address comprises an IP address and a port number.

[0045] The statistical module is configured to determine intersections of each port number and service type corresponding to the IP address and each domain name, count numbers of elements in each intersection, determine a union set of each port number and service type corresponding to the IP address and each domain name, and count a number of elements in the union set.

[0046] The calculation module is configured to calculate the network address similarity according to the number of elements in each intersection, the number of elements in the union set, and the number of domain names.

[0047] Optionally, the method for calculating the network address similarity comprises:

[0048] calculating the network address similarity according to the following formula:

[0049] wherein, Similarity is the network address similarity, Pi is the number of elements in the ith intersection, Q is the number of elements in the union set, and n is the number of domain names. i represents a ratio of the number of elements in the ith intersection to the number of elements in the union set.

[0050] Optionally, the identification module is configured to calculate distances of the network address to each domain name, and calculate the average distance according to the distances of the network address to each domain name.​​

[0051] Optionally, the method for calculating the distance from the network address to each domain name comprises:

[0052]

[0053] wherein d is the distance from the network address to the domain name, R is the radius of the earth, lat1 is the latitude corresponding to the network address, lat2 is the latitude corresponding to the domain name, lon1 is the longitude corresponding to the network address, and lon2 is the longitude corresponding to the domain name.

[0054] Optionally, the identification module is further configured to query a preset geographic information database according to the network address and the domain names, and calculate the distance from the network address to each domain name according to geographic location information corresponding to the network address and the domain names when the geographic location information is queried; wherein the geographic location information comprises longitude and latitude, and determine the similarity of the website according to the label content and the website identification model when the geographic location information is not queried.

[0055] Optionally, the label content comprises a title and a description.

[0056] The identification module is configured to input the title and the description as website features into the website identification model, and output the similarity from the website identification model.

[0057] Based on the same idea, the present application further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method according to any one of the preceding embodiments.

[0058] Based on the same idea, the present application further provides a non-transitory computer readable storage medium storing computer instructions for causing a computer to execute the method according to any one of the preceding embodiments.

[0059] As can be seen from the above, the method and device for identifying a content distribution network address provided by the embodiments of the present application can obtain network information by analyzing the response data packet after sending the probe packet, count the domain names and service types corresponding to the same network address, calculate the network address similarity, and determine whether the network address is a content distribution network address according to the network address similarity. The present application can accurately and comprehensively identify the content distribution network address, and provide technical support for network supervision. BRIEF DESCRIPTION OF DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, the accompanying drawings in the following description only need to explain the present application, and other drawings can be obtained by those of ordinary skill in the art without any creative work on the premise of the accompanying drawings.

[0061] Figure 1 The method flowchart of the embodiment of the present application is shown in the figure.

[0062] Figure 2 The method flowchart of another embodiment of the present application is shown in the figure.

[0063] Figure 3 The device structure diagram of the embodiment of the present application is shown in the figure.

[0064] Figure 4 The electronic device structure diagram of the embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0065] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0066] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be understood as the general meaning understood by those skilled in the art to which the present application belongs. The terms "first", "second" and the like used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. The terms "include" or "contain" and the like mean that the elements or objects before the terms cover the elements or objects listed after the terms and their equivalents, and do not exclude other elements or objects. The terms "connect" or "connected" and the like do not mean physical or mechanical connection, but can include electrical connection, whether direct or indirect. The terms "up", "down", "left", "right" and the like are only used to represent relative positional relationship, and when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0067] As shown in Figure 1 , 2 The present application provides a content distribution network address identification method, which comprises:

[0068] S101: After sending the probe packet, the corresponding response data packet is obtained.

[0069] In this embodiment, the electronic device sends a probe packet to the network at a certain time interval, and receives a response data packet corresponding to the probe packet. The probe packet can be selected according to the protocol type and the probe content, for example, an http get packet for probing a web server, an ftp probe packet or a probe command for probing an ftp server, and the specific form of the probe packet is not limited.

[0070] S102: Analyzing the response data packet to obtain network information; wherein the network information includes a network address, a domain name and a service type;

[0071] In this embodiment, after obtaining the response data packet, all the response data packets are analyzed to obtain the network information of each response data packet. In some modes, the network information that can be obtained from the response data packet includes a network address, a domain name, a service type, load content, application data, and the like, and the specific content is not limited. The network address can include a source IP address, a destination IP address, a source port number, and a destination port number.

[0072] For the response data packet, the service type that can be provided by the server sending the response data packet can be determined through the port number, for example, port number 21 is an FTP service, port number 23 is a Telnet service, port number 1433 is a SQL service, port number 25 is an SMTP service, port number 53 is a DNS service, the identification field GET / POST HTTP is a web service, the identification field FINS is a FINS service, the identification field rtsp: / / RTSP is an RTSP service, and the like.

[0073] S103: Counting multiple domain names and service types corresponding to the same network address to obtain a statistical result;

[0074] In this embodiment, after the network information of all response data packets is parsed, the network information is statistically analyzed according to network addresses, and all domain names and service types corresponding to the same network address are counted. The network address includes an IP address and a port number. In a server, one IP address can open multiple different ports, and each port provides different services. One IP address can be configured with multiple domain names. Therefore, based on the parsed network information, multiple port numbers, multiple domain names, and multiple service types corresponding to each IP address are counted. For a response data packet, the IP address of each response and the corresponding multiple port numbers, multiple domain names, and multiple service types are counted. For example, according to the agreement of RFC 3232, in general, the port and service information opened by IP address A are subject to default constraints. For example, IP address A opens port number 21 to provide FTP service, opens port number 22 to provide SSH service, opens port number 23 to provide TELNET service, opens port number 80 to provide HTTP service, opens port number 443 to provide HTTPS service, and IP address A corresponds to two or more subdomain names.

[0075] S104: According to the statistical result, the network address similarity between the network address and each domain name is calculated.

[0076] In this embodiment, after the multiple domain names and service types corresponding to the same network address are counted, the network address similarity is calculated according to the network address and the multiple domain names and service types corresponding to the network address.

[0077] In some embodiments, counting the multiple domain names and service types corresponding to the same network address includes:

[0078] According to the multiple port numbers and service types corresponding to the same IP address and the port numbers and service types corresponding to each domain name, the intersection of the port numbers and service types corresponding to the IP address and the port numbers and service types corresponding to each domain name is determined, and the number of elements in each intersection is counted. The union of the port numbers and service types corresponding to the IP address and the port numbers and service types corresponding to all domain names is determined, and the number of elements in the union is counted.

[0079] According to the multiple domain names and service types corresponding to the same network address, the network address similarity is calculated, including: according to the number of elements in the intersection, the number of elements in the union, and the number of domain names, the network address similarity is calculated.

[0080] The method for calculating the network address similarity Similarity is:

[0081]

[0082] P iPi is the number of elements in the ith intersection, Q is the number of elements in the union, and n is the number of domain names. The ratio of the number of elements in the ith intersection to the number of elements in the union is calculated.

[0083] Specifically, for a specific IP address, the number of port numbers and service types corresponding to the IP address is counted, the number of domain names corresponding to the IP address is counted, the number of domain names corresponding to the IP address is n, the number of port numbers and service types corresponding to each domain name is counted; then, the intersection between the port numbers and service types corresponding to the IP address and the port numbers and service types corresponding to each domain name is determined, and the number of elements in each intersection is counted P; at the same time, the union between the port numbers and service types corresponding to the IP address and the port numbers and service types corresponding to all domain names is determined, and the number of elements in the union is counted Q; then, the network address similarity Similarity is calculated according to formula (1).

[0084] For example, the port numbers opened by IP address A include 80, 81, 82, 83, 84, 88, 1433, the service types opened by IP address A include DHCP, DNS, FTP, Telnet, SMTP, IP address A corresponds to domain name 1 and domain name 2, the port numbers opened by domain name 1 include 80, 83, 84, 85, 88, 1433, the service types opened by domain name 1 include DHCP, DNS, FTP, Telnet, WINS, the port numbers opened by domain name 2 include 80, 81, 82, 84, 88, 1433, and the service types opened by domain name 2 include DHCP, DNS, FTP, Telnet, SMTP. The intersection of IP address A and domain name 1 is A1 = {80, 83, 84, 88, 1433, DHCP, DNS, FTP, Telnet}, the number of elements in the intersection A1 is 9, the intersection of IP address A and domain name 2 is A2 = {80, 81, 82, 84, 88, 1433, DHCP, DNS, FTP, Telnet, SMTP}, the number of elements in the intersection A2 is 11, the union of IP address A and domain name 1 and domain name 2 is A3 = {80, 81, 82, 83, 84, 85, 88, 1433, DHCP, DNS, FTP, Telnet, SMTP, WINS}, the number of elements in the union A3 is 14, and the number of domain names is 2. The results are brought into formula (1) to obtain:

[0085]

[0086] That is, through statistical analysis and calculation, the network address similarity is 71.4%.

[0087] S105: determining whether the network address is a content distribution network address according to the network address similarity.

[0088] In this embodiment, after the network address similarity is calculated, it is determined whether the network address is a content distribution network address based on the network address similarity analysis.

[0089] In some embodiments, the network information further comprises a website feature tag content; and determining whether the network address is a content distribution network address according to the network address similarity comprises:

[0090] When the network address similarity is greater than a preset address similarity threshold, determining a website similarity according to the tag content and a preset website recognition model;

[0091] Determining whether the network address is a content distribution network address according to the website similarity;

[0092] When the network address similarity is less than the address similarity threshold, calculating an average distance of the network address to each domain name corresponding to the network address;

[0093] When the average distance is greater than a preset distance threshold, the network address is determined as a content distribution network address.

[0094] In combination with Figure 2 As shown in the figure, in this embodiment, after the network address similarity is calculated, it is determined whether the network address similarity is greater than an address similarity threshold. If it is greater than the address similarity threshold, a website similarity is determined according to the parsed tag content, and it is further determined whether it is a content distribution network address according to the website similarity. If it is less than the address similarity threshold, an average distance of the network address to each domain name corresponding to the network address is calculated. If the average distance is greater than a distance threshold, it can be determined that the network address is a content distribution network address. If the average distance is less than the distance threshold, it can be determined that the network address is not a content distribution network address.

[0095] In some ways, the average distance of the network address to each domain name corresponding to the network address is calculated by: calculating a distance of the network address to each domain name; and calculating the average distance according to the distance of the network address to each domain name. That is, the distance of the network address to each domain name is calculated first, and then the average distance of the network address to each domain name is calculated according to the distance to each domain name and the number of domain names.

[0096] The method for calculating the distance d of the network address to each domain name is as follows:

[0097]

[0098] Wherein, R is the earth radius, taking the value of 6378km, lat1 is the latitude corresponding to the network address, lat2 is the latitude corresponding to a domain name associated with the network address, lon1 is the longitude corresponding to the network address, and lon2 is the longitude corresponding to the domain name.

[0099] In some embodiments, before calculating the distance from the network address to each domain name, the method further comprises:

[0100] According to the network address and each domain name, querying a preset geographic information database;

[0101] When the geographic location information corresponding to the network address and each domain name is queried, calculating the distance from the network address to each domain name; wherein, the geographic location information comprises longitude and latitude.

[0102] When the geographic location information is not queried, determining the website similarity according to the label content and a preset website recognition model.

[0103] In this embodiment, in order to calculate the distance between the network address and the domain name, the geographic location information of the network address and each domain name associated therewith needs to be obtained, wherein the geographic location information comprises longitude and latitude. The geographic information database is used to save the network address and the domain name and the corresponding geographic location information. Before calculating the distance, the geographic information database is queried according to the IP address to obtain the geographic location information corresponding to the IP address, and the geographic information database is queried according to the domain name to obtain the geographic location information corresponding to the domain name. Then, according to formula (3), the distance from the network address to each domain name is calculated. As shown in the formula (3), if the geographic location information of the network address and / or the domain name is not queried in the geographic information database, the distance does not need to be calculated, and the website similarity is determined to determine whether it is a content distribution network address. Figure 2

[0104] After calculating the distance from the network address to each domain name according to formula (3), the average distance is calculated, and the formula is as follows:

[0105]

[0106] Wherein, d(i) is the distance from the network address to the i-th domain name.

[0107] In some embodiments, the parsed label content comprises a title and a description; according to the label content, the website similarity is determined by using a preset website recognition model, comprising:

[0108] The title and the description are taken as the website features, and are input into the website recognition model, and the website similarity is output by the website recognition model.

[0109] ​In the embodiment, when the network address similarity is greater than the address similarity threshold, each item of label content is taken as a website feature and input into a pre-trained website identification model, and the website similarity is output by the website identification model, wherein the last layer of the website identification model adopts cosine similarity to calculate the website similarity. Optionally, the website identification model is obtained by training based on an ERNIE-Doc model.

[0110] In some embodiments, according to the website similarity, it is determined whether the network address is a content distribution network address, comprising:

[0111] When the website similarity is less than a preset website similarity threshold, each domain name to which the network address belongs is obtained by using a preset instruction, and if the organizations to which the domain names belong are different, the network address is taken as a content distribution network address.

[0112] In the embodiment, after the website similarity is determined, the website similarity is compared with a website similarity threshold, if the website similarity is less than the website similarity threshold, each domain name to which the network address belongs is further queried by using a preset instruction, if the organizations to which the domain names belong are different, it can be determined that the network address is a content distribution network address, and if the organizations to which the domain names belong are the same, the network address does not belong to a content distribution network address. Optionally, the whois instruction is used to query the organization to which the domain name belongs.

[0113] The embodiment of the application provides a content distribution network address identification method, network traffic is obtained and analyzed to obtain network information, a plurality of domain names, port numbers and service types corresponding to the same IP address are counted according to the network information, and the port numbers and service types corresponding to each domain name are counted; the network address similarity is calculated according to the counting result. When it is determined that the network address similarity is greater than or equal to the address similarity threshold, the website similarity is determined according to the label content, if the website similarity is less than the website similarity threshold, the organization to which each domain name belongs is obtained by using a specific instruction, if the organizations to which the domain names belong are different, it can be determined that the IP address is a content distribution network address; when it is determined that the network address similarity is less than the address similarity threshold, the average distance between the IP address and each domain name is calculated, and if the average distance is greater than a distance threshold, it can be determined that the IP address is a content distribution network address.

[0114] The application can comprehensively judge whether the network address is a content distribution service from the dimensions of network address, average distance and website similarity. From the network level, the similarity between the IP address and the domain name associated with the IP address is evaluated according to the open service and port; from the physical level, if the IP address and the domain name associated with the IP address have a large similarity at the network level and the average distance between the IP address and the domain name is large, it can be determined that the network address is a content distribution network address; from the application level, considering that the website contents of different IP addresses are different, the website similarity is combined to determine whether the network address is a content distribution network address. Through comprehensive analysis and judgment, accurate and comprehensive recognition results can be obtained, on the basis of which, dynamic recognition of network addresses can be supported, and the existing CDN address database can be enriched based on the recognition results, thereby providing technical support for network supervision.

[0115] It should be noted that the method of the embodiments of the application can be executed by a single device, such as a computer or a server. The method of the embodiments can also be applied in a distributed scenario, and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only execute one or more steps in the method of the embodiments of the application, and the multiple devices can interact with each other to complete the method.

[0116] It should be noted that the above describes specific embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the acts or steps recited in the claims can be performed in an order other than that in the embodiments and still achieve desirable results. In addition, the processes depicted in the figures do not necessarily require the particular order shown or sequential order to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous.

[0117] As shown in Figure 3 The embodiments of the application also provide a content distribution network address identification device, which comprises:

[0118] The acquisition module is configured to acquire the corresponding response data packet after sending the probe packet.

[0119] The analysis module is configured to analyze the response data packet to obtain network information, wherein the network information comprises a network address, a domain name and a service type.

[0120] The statistics module is configured to count a plurality of domain names and service types corresponding to the same network address to obtain a statistics result.

[0121] The calculation module is configured to calculate the network address similarity based on the statistics result.

[0122] The identification module is configured to determine whether the network address is a content distribution network address according to the network address similarity.

[0123] In some embodiments, the network information further comprises label content used to identify features of the website;

[0124] The identification module is configured to, when the network address similarity is greater than a preset address similarity threshold, determine a website similarity according to the label content and a preset website identification model; determine whether the network address is a content distribution network address according to the website similarity; when the network address similarity is less than the address similarity threshold, calculate an average distance from the network address to each domain name corresponding to the network address; and when the average distance is greater than a preset distance threshold, determine the network address as a content distribution network address.

[0125] In some embodiments, the identification module is configured to, when the website similarity is less than a preset website similarity threshold, obtain organizations to which each domain name corresponding to the network address belongs according to a preset instruction, and determine the network address as a content distribution network address if the organizations to which each domain name belongs are all different.

[0126] In some embodiments, the network address comprises an IP address and a port number.

[0127] The statistics module is configured to determine intersections of each port number and service type corresponding to the IP address and each domain name, and count a number of elements in each intersection; determine a union set of each port number and service type corresponding to the IP address and each domain name, and count a number of elements in the union set.

[0128] The calculation module is configured to calculate the network address similarity according to the number of elements in each intersection, the number of elements in the union set, and a number of domain names.

[0129] In some embodiments, the network address similarity is calculated by using formula (1).

[0130] In some embodiments, the identification module is configured to calculate a distance from the network address to each domain name, and calculate the average distance according to the distance from the network address to each domain name.

[0131] In some embodiments, the distance from the network address to each domain name is calculated by using formula (3).

[0132] In some embodiments, the identification module is further configured to query a preset geographic information database according to the network address and each domain name; when geographic location information corresponding to the network address and each domain name is queried, calculate the distance from the network address to each domain name according to the geographic location information; wherein the geographic location information comprises longitude and latitude; and when the geographic location information is not queried, determine the website similarity according to the label content and the website identification model.

[0133] In some embodiments, the label content includes a title and a description.

[0134] The identification module inputs the title and the description as website features into a website identification model, and outputs a similarity from the website identification model.

[0135] For the convenience of description, the above apparatus is described in various modules in terms of functions. Of course, in the implementation of the embodiments of the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0136] The apparatus of the above embodiments is used to implement the corresponding method in the foregoing embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here again.

[0137] Figure 4 A more specific hardware structure of an electronic device is shown, which can include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 for communication within the device.

[0138] The processor 1010 can be implemented in the form of a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, etc., for executing related programs to implement the technical solutions provided by the embodiments of the present specification.

[0139] The memory 1020 can be implemented in the form of a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 1020 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present specification are implemented by software or firmware, the related program codes are saved in the memory 1020 and called and executed by the processor 1010.

[0140] The input / output interface 1030 is configured to connect an input / output module to realize information input and output. The input / output module can be configured as a component in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. The input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.

[0141] The communication interface 1040 is configured to connect a communication module (not shown in the figure) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired manner (such as a USB, a network cable, etc.) or a wireless manner (such as a mobile network, WIFI, Bluetooth, etc.).

[0142] The bus 1050 includes a channel to transmit information between various components (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040) of the device.

[0143] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only contain components necessary for implementing the embodiments of the present specification, and does not have to contain all the components shown in the figure.

[0144] The electronic device of the above embodiment is used to realize the corresponding method in the above embodiment, and has the beneficial effects of the corresponding method embodiment, which are not described here.

[0145] The computer readable medium of the embodiment includes permanent and non-permanent, removable and non-removable media, which can be realized by any method or technology to store information. The information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0146] Those of ordinary skill in the art will realize that the foregoing discussion of any of the embodiments has been presented for the purpose of illustration and description and is not intended to be exhaustive or to limit the scope of the disclosure to the precise embodiments discussed. Many modifications and variations will be apparent to those of ordinary skill in the art upon reading this disclosure. For example, embodiments can be practiced in conjunction with a variety of storage architectures (e.g., dynamic RAM (DRAM)) using the techniques discussed. Further, the steps of the embodiments can be implemented in any order, unless otherwise specified and may

[0147] In addition, for simplicity and clarity of illustration, power / ground connections to some of integrated circuit (IC) chips and other components can or can not be shown in the provided figures (if any exist). Further, aspects of the disclosure can be implemented in any of a variety of platform types and operating systems or operating systems running within these platforms, and such platform types are contemplated to be within the scope of the present disclosure. Additionally, although the description of examples has included the context of a personal computer, those of ordinary skill in the art will recognize that other implementations can be contemplated that do not include such a device. Further, where appropriate, functions described have been shown with exemplary structural components, including electrical circuitry, one or more processors or controller(s), or memory, regardless of whether such components are preexisting, manufactured, or produced. The embodiments are not limited to these functionality components or to the complementary components that can be used in connection with them. Therefore, although the present disclosure has been described in relation to particular embodiments thereof, many other changes, modifications, and variations can be made by one of ordinary skill in the art thereunto pertaining. It is therefore desired that the present disclosure be construed as being limited only by the scope of the appended claims, and not by the specific exemplary embodiments described herein.

[0148] While the present disclosure has been described with respect to a limited number of embodiments, those skilled in the art will appreciate numerous modifications and variations therefrom. It is intended that the appended claims cover all such modifications and variations as fall within the scope of this present disclosure. Thus, any of the above-described embodiments can be combined with any other embodiment(s) to create further embodiments.

[0149] It is intended that the present disclosure encompass all such alternatives, modifications, and variations as fall within the broad scope of the appended claims. Accordingly, any and all modifications, variations or equivalent arrangement and operations described herein are contemplated to be within the scope of the present disclosure. Additionally, the various embodiments described herein are presented for purposes of illustration and description only. They are not intended to be exhaustive or to be limiting to the precise forms described. Accordingly, the various embodiments described herein are intended to be illustrative only and variations are possible. Further, the examples set forth in the examples are not intended to be exhaustive or otherwise limiting of the examples as set forth herein and many modifications and variations thereto are possible assuredly as would be understood by those having ordinary skill in the art.

Claims

1. A method for identifying a content delivery network address, characterized in that, include: After sending the probe message, obtain the corresponding response data packet; The response data packet is parsed to obtain network information; wherein, the network information includes network address, domain name, service type, and tag content used to identify website characteristics; the network address includes IP address and port number; This involves statistically analyzing multiple domain names and service types corresponding to the same network address, and calculating the network address similarity between the network address and each domain name based on the statistical results. This includes: determining the intersection of each port number and service type corresponding to the IP address with the port number and service type corresponding to each domain name, and counting the number of elements in each intersection; determining the union of each port number and service type corresponding to the IP address with the port numbers and service types corresponding to all domain names, and counting the number of elements in the union. Based on the number of elements in each intersection, the number of elements in the union, and the number of domain names, according to the formula... Calculate the network address similarity; Where Similarity represents the network address similarity, P i Let Q be the number of elements in the i-th intersection, Q be the number of elements in the union, and n be the number of domain names. This represents the ratio of the number of elements in the i-th intersection to the number of elements in the union; Determining whether a network address is a content delivery network address based on the network address similarity includes: When the network address similarity is greater than a preset address similarity threshold, the website similarity is determined based on the tag content and the preset website recognition model; Based on the website similarity, determine whether the network address is a content delivery network address; When the network address similarity is less than the address similarity threshold, calculate the average distance from the network address to each domain name corresponding to the network address; When the average distance is greater than a preset distance threshold, the network address is used as the content distribution network address.

2. The method according to claim 1, characterized in that, Determining whether a network address is a content delivery network address based on the website similarity includes: When the website similarity is less than a preset website similarity threshold, the organization to which each domain name belongs is obtained through a preset instruction. If the organizations to which each domain name belongs are different, the network address is used as the content distribution network address.

3. The method according to claim 1, characterized in that, The calculation of the average distance from the network address to each domain name corresponding to the network address includes: Calculate the distance from the network address to each domain name; The average distance is calculated based on the distance from the network address to each domain name.

4. The method according to claim 3, characterized in that, The method for calculating the distance from the network address to each domain name is as follows: Where d is the distance from the network address to the domain name, R is the Earth's radius, lat1 is the latitude corresponding to the network address, lat2 is the latitude corresponding to the domain name, lon1 is the longitude corresponding to the network address, and lon2 is the longitude corresponding to the domain name.

5. The method according to claim 4, characterized in that, Before calculating the distance from the network address to each domain name, the process also includes: Based on the network address and domain names, query the preset geographic information database; When the geographic location information corresponding to the network address and each domain name is retrieved, the distance from the network address to each domain name is calculated based on the geographic location information; wherein, the geographic location information includes longitude and latitude; If the geographic location information is not found, the website similarity is determined based on the tag content and the website recognition model.

6. The method according to claim 1, characterized in that, The tag content includes a title and a description; based on the tag content, a preset website recognition model is used to determine website similarity, including: The title and description are used as website features and input into the website identification model, which then outputs the website similarity score.

7. A content delivery network address identification device, characterized in that, include: The acquisition module is used to acquire the corresponding response data packet after sending a probe message; The parsing module is used to parse the response data packet to obtain network information; wherein, the network information includes network address, domain name, service type, and tag content used to identify website characteristics; the network address includes IP address and port number; The statistics module is used to count multiple domain names and service types corresponding to the same network address and obtain statistical results, including: determining the intersection of each port number and service type corresponding to the IP address with the port number and service type corresponding to each domain name, and counting the number of elements in each intersection; determining the union of each port number and service type corresponding to the IP address with the port number and service type corresponding to all domain names, and counting the number of elements in the union. The calculation module is used to calculate the network address similarity between network addresses and each domain name based on the statistical results, including: according to the number of elements in each intersection, the number of elements in the union, and the number of domain names, according to the formula... Calculate the network address similarity; Where Similarity represents the network address similarity, P i Let Q be the number of elements in the i-th intersection, Q be the number of elements in the union, and n be the number of domain names. This represents the ratio of the number of elements in the i-th intersection to the number of elements in the union; The identification module is used to determine whether a network address is a content distribution network address based on the network address similarity, including: when the network address similarity is greater than a preset address similarity threshold, determining the website similarity based on the tag content and a preset website identification model; Based on the website similarity, determine whether the network address is a content delivery network address; When the network address similarity is less than the address similarity threshold, calculate the average distance from the network address to each domain name corresponding to the network address; When the average distance is greater than a preset distance threshold, the network address is used as the content distribution network address.

Images