Domain name backfill method, device, electronic device and readable storage medium

Abstract

In the implementation of the present invention, a domain name backfilling method, device, electronic device and readable storage medium are provided. The method obtains encrypted transmission data, domain name real-time record data and historical record data based on network transmission data; when the domain name field in the encrypted transmission data does not meet the preset requirements, the address data corresponding to the domain name field that does not meet the preset requirements is determined as the target address data; based on the domain name real-time record data and historical record data, the target domain name corresponding to the target address data is obtained; the target domain name is backfilled into the domain name field that does not meet the preset requirements to obtain encrypted transmission data that meets the preset requirements. In this way, the corresponding target domain name can be obtained through the domain name real-time record data and historical record data, and the validity of the domain name data in the encrypted transmission data can be guaranteed by backfilling the target domain name into the domain name field that does not meet the preset requirements.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a domain name backfilling method, device, electronic device and readable storage medium. Background Art

[0002] With the gradual development of computer networks, various websites or applications are used more and more frequently in daily life. Correspondingly, the transmission data of users visiting websites or applications often contains information such as domain names, and domain name information plays a certain role in subsequent data applications.

[0003] In the prior art, domain name information is usually obtained by directly obtaining the transmission data packets between the user and the website or application. However, in order to ensure the security of data and information transmission, more and more websites and applications are upgrading the Hypertext Transfer Protocol (http) to Hypertext Transfer Protocol Secure (https). Due to the encryption technology of https, there are often a large number of inaccurate domain names in the collected https data, which makes the domain name data invalid. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a domain name backfilling method, device, electronic device and readable storage medium to at least solve the above problems. The specific technical solution is as follows:

[0005] In a first aspect of the present invention, a domain name backfilling method is provided, which may include:

[0006] Obtain encrypted transmission data, domain name real-time record data and historical record data based on network transmission data;

[0007] In the case where the domain name field in the encrypted transmission data does not meet the preset requirements, determining the address data corresponding to the domain name field that does not meet the preset requirements as the target address data;

[0008] Acquire a target domain name corresponding to the target address data based on the domain name real-time record data and the historical record data;

[0009] The target domain name is backfilled into the domain name field that does not meet the preset requirements to obtain encrypted transmission data that meets the preset requirements.

[0010] In a second aspect of the present invention, a domain name backfilling device is provided, which may include:

[0011] A data acquisition module, used to acquire encrypted transmission data, domain name real-time record data and historical record data based on network transmission data;

[0012] A target address acquisition module, configured to determine, when a domain name field in the encrypted transmission data does not meet a preset requirement, address data corresponding to the domain name field that does not meet the preset requirement as target address data;

[0013] A target domain name acquisition module, used to acquire a target domain name corresponding to the target address data based on the domain name real-time record data and the historical record data;

[0014] The domain name writing module is used to fill the target domain name back into the domain name field that does not meet the preset requirements to obtain encrypted transmission data that meets the preset requirements.

[0015] A third aspect of the present invention further provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0016] Memory, used to store computer programs;

[0017] The processor is used to perform any of the above-mentioned domain name backfilling methods when executing a program stored in the memory.

[0018] In a fourth aspect of the implementation of the present invention, a computer-readable storage medium is further provided, wherein instructions are stored in the computer-readable storage medium, and when the instructions are executed on a computer, the computer is enabled to perform any of the domain name backfilling methods described above.

[0019] In a fifth aspect of the implementation of the present invention, a computer program product comprising instructions is also provided, which, when executed on a computer, enables the computer to perform any of the domain name backfilling methods described above.

[0020] The embodiment of the present invention obtains encrypted transmission data, domain name real-time record data and historical record data based on network transmission data; when the domain name field in the encrypted transmission data does not meet the preset requirements, the address data corresponding to the domain name field that does not meet the preset requirements is determined as the target address data; based on the domain name real-time record data and the historical record data, the target domain name corresponding to the target address data is obtained; the target domain name is backfilled into the domain name field that does not meet the preset requirements to obtain the encrypted transmission data that meets the preset requirements. In this way, when the domain name field in the encrypted transmission data does not meet the preset requirements, the corresponding target domain name can be obtained through the domain name real-time record data and the historical record data, and by backfilling the target domain name into the domain name field that does not meet the preset requirements, the domain name data in the encrypted transmission data can be made more accurate, thereby ensuring the validity of the domain name data in the encrypted transmission data and improving the use value of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art are briefly introduced below.

[0022] Figure 1 is a flowchart of a method for backfilling a domain name provided by an embodiment of the present invention;

[0023] Figure 2 is a schematic diagram of a domain name backfilling scenario provided by an embodiment of the present invention;

[0024] Figure 3 It is a structural block diagram of a domain name backfilling device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The technical solutions in the embodiments of the present invention will be described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0026] Figure 1 The following is a flowchart of a domain name processing method provided by an embodiment of the present invention. The method may include the following steps:

[0027] Step 101: Obtain encrypted transmission data, domain name real-time record data, and historical record data based on network transmission data.

[0028] Among them, the above-mentioned network transmission data refers to the transmission data generated by network users communicating through the network. Specifically, it may be generated by users visiting websites or applications, and may include access time, access duration, destination address (Destination Intellectual Property, destination IP), source address (Source Intellectual Property, source IP), upstream traffic, downstream traffic, domain name, host (host) and uniform resource locator (uniform resource locator, URL) and other information data.

[0029] Among them, the above encrypted transmission data refers to https data, the above domain name real-time record data refers to domain name system (Domain Name System, DNS) data, and the above historical record data refers to http data. Specifically, the above three types of data can be obtained through a preset signaling collection system, and further, can be obtained by parsing different network transmission protocols through deep detection technology (Deep Packet Inspection, DPI), so that the above domain name real-time record data can be called perception DPI-DNS data, the above encrypted transmission data can be called mobile DPI-https data, and the above historical record data can be called mobile DPI-http data.

[0030] Step 102: When the domain name field in the encrypted transmission data does not meet the preset requirements, the address data corresponding to the domain name field that does not meet the preset requirements is determined as the target address data.

[0031] Among them, the above-mentioned DPI-https data format usually includes multiple transmission data when network users use the network to access websites or applications, and the format of each transmission data usually includes an access time field, an address field and a domain name field. The data in the access time field, the data in the address field and the data in the domain name field are one-to-one corresponding. The above-mentioned preset requirements refer to the data in the domain name field being normal data. Correspondingly, failure to meet the above-mentioned preset requirements refers to the data in the domain name field being abnormal data, which may be that the domain name field is an empty value or the data in the domain name field does not conform to the format of the domain name, etc.

[0032] Specifically, the above-mentioned DPI-https data is obtained by parsing the data of the https protocol. Due to the encryption technology of the https protocol, the domain name (DomainName) field in the obtained DPI-https data does not meet the preset requirements. In an embodiment of the present invention, each domain name field in the DPI-https data can be traversed to obtain the transmission data corresponding to the domain name field that does not meet the preset requirements, and the data of the address field in the transmission data is used as the target address data.

[0033] Step 103: Acquire a target domain name corresponding to the target address data based on the domain name real-time record data and the historical record data.

[0034] Step 104: fill the target domain name back into the domain name field that does not meet the preset requirement to obtain encrypted transmission data that meets the preset requirement.

[0035] The above domain name real-time record data is generated through the user's real-time access data, which contains the real-time mapping relationship between the real-time domain name (DNS domain name) corresponding to the user's access request and the target IPv4 or IPv6 address (i.e., the above address data) accessed, which is usually obtained based on the resolution and forwarding of the DNS domain name, and has high accuracy. The above historical record data contains the correspondence between the IP and domain name accumulated through historical log data, and the mobile DPI-http data is not encrypted, so the integrity of the data field collected is high.

[0036] Among them, the above-mentioned backfill operation refers to writing the target domain name into the corresponding domain name field. Specifically, since the domain name real-time record data and the historical record data both contain the mapping relationship between address data and domain name data, the target domain name corresponding to the above-mentioned target address data can be obtained from the mapping relationship, and the corresponding target domain name can be written into the corresponding domain name field, thereby realizing domain name backfill and obtaining encrypted transmission data that meets the above-mentioned preset requirements.

[0037] In summary, the embodiment of the present invention obtains encrypted transmission data, domain name real-time record data and historical record data based on network transmission data; when the domain name field in the encrypted transmission data does not meet the preset requirements, the address data corresponding to the domain name field that does not meet the preset requirements is determined as the target address data; based on the domain name real-time record data and the historical record data, the target domain name corresponding to the target address data is obtained; the target domain name is backfilled into the domain name field that does not meet the preset requirements to obtain the encrypted transmission data that meets the preset requirements. In this way, when the domain name field in the encrypted transmission data does not meet the preset requirements, the corresponding target domain name can be obtained through the domain name real-time record data and the historical record data, and by backfilling the target domain name into the domain name field that does not meet the preset requirements, the domain name data in the encrypted transmission data can be made more accurate, thereby ensuring the validity of the domain name data in the encrypted transmission data and improving the use value of the data.

[0038] Optionally, the domain name real-time record data includes a real-time correspondence between address data and domain name data within a domain name refresh cycle; the operation of obtaining a target domain name corresponding to the target address data based on the domain name real-time record data and the historical record data may specifically include the following steps in this embodiment of the present invention:

[0039] Step 201: Based on the target address data, determine whether there is domain name data uniquely corresponding to the target address data in the real-time correspondence between the address data and the domain name data.

[0040] Step 202: If it exists, determine the domain name data uniquely corresponding to the target address data as the target domain name.

[0041] Step 203: If it does not exist, obtain the target domain name corresponding to the target address data based on the historical record data.

[0042] Among them, since some websites or applications will dynamically update the domain name regularly, accordingly, the above-mentioned domain name refresh cycle refers to the domain name update cycle. In a domain name refresh cycle, one address data corresponds to one domain name data, and the domain name data is the domain name updated most recently, and has a high timeliness. It can be understood that the update time of the data in the domain name real-time record data can be consistent with the domain name update cycle.

[0043] Specifically, the embodiments of the present invention can preferentially backfill the domain name through the real-time correspondence in the DPI-DNS data, and can obtain the latest unique domain name data corresponding to the above-mentioned target address data from the real-time correspondence, and use the data as the above-mentioned target domain name, thereby ensuring the timeliness of the domain name backfill. Specifically, in the case where there is domain name data uniquely corresponding to the target address data in the real-time correspondence, the domain name data corresponding to the target address data at the access time can be obtained according to the access time of the record data indicated by the above-mentioned target address data and the specific address data.

[0044] Furthermore, when there is no domain name data uniquely corresponding to the target address data in the above real-time correspondence, it may be that the access time corresponding to the target address data exceeds a refresh cycle of a domain name. At this time, the target domain name can be obtained according to the historical record data.

[0045] In an embodiment of the present invention, the domain name real-time record data contains a real-time correspondence between address data and domain name data within a domain name refresh cycle. Based on the target address data, it is determined whether there is domain name data uniquely corresponding to the target address data in the real-time correspondence between the address data and the domain name data; if there is, the domain name data uniquely corresponding to the target address data is determined as the target domain name; if not, the target domain name corresponding to the target address data is obtained based on the historical record data. In this way, the unique real-time domain name data corresponding to the target address data can be obtained through the domain name real-time record data. Since the domain name real-time record data contains the correspondence between data within a domain name cycle, the timeliness of the target domain name can be guaranteed by obtaining the target domain name through the domain name real-time record data, and the validity of the domain name data can be further guaranteed.

[0046] Optionally, the historical record data includes a historical correspondence between address data and domain name data in multiple domain name refresh cycles; the operation of acquiring a target domain name corresponding to the target address data based on the historical record data may specifically include the following steps in this embodiment of the present invention:

[0047] Step 301: Based on the target address data, a plurality of historical domain name data corresponding to the target address data are obtained from the historical correspondence between the address data and the domain name data.

[0048] Step 302: Determine the target domain name from the plurality of historical domain name data.

[0049] The time corresponding to the refresh cycles of the above-mentioned multiple domain names may be 15 days, 30 days, 60 days, etc. The above-mentioned historical record data includes the historical correspondence between the IP address and the domain name, and due to the existence of dynamic domain names, the same IP address in the historical record data may correspond to multiple domain name data, so that the embodiment of the present invention can obtain multiple historical domain name data corresponding to the above-mentioned target address data through the historical correspondence, and obtain the target domain name from the multiple historical domain name data.

[0050] Specifically, the above operation of determining the target domain name from multiple historical domain name data can be to select the latest historical domain name data as the target domain name according to the recording time of each historical domain name data, or, it can be to select the historical domain name data with the highest frequency as the target domain name according to the frequency of appearance of each historical domain name data. The specific setting can be made according to actual needs, and the embodiment of the present invention does not limit this.

[0051] In an embodiment of the present invention, the historical record data includes the historical correspondence between address data and domain name data within multiple domain name refresh cycles, and based on the target address data, multiple historical domain name data corresponding to the target address data are obtained from the historical correspondence between the address data and the domain name data; the target domain name is determined from the multiple historical domain name data. In this way, the domain name data corresponding to the target address data in the historical record data can be obtained, so that the domain name backfill ratio can be increased by determining the target domain name from the historical domain name data.

[0052] Optionally, the historical record data further includes the historical data time, and the operation of determining the target domain name from the plurality of historical domain name data may specifically include the following steps in this embodiment of the present invention:

[0053] Step 401: For any of the historical domain name data, determine the number of occurrences of the historical domain name data per day based on the historical data time of the historical domain name data within a preset period.

[0054] The preset period can be set according to actual needs, for example, 30 days, 60 days or 15 days, etc., and the embodiment of the present invention does not limit this. Specifically, the historical data time refers to the access time of each data, and the appearance time and frequency of the multiple historical domain name data can be obtained according to the historical data time.

[0055] Specifically, the historical domain name data within a preset period may be divided according to different dates, and statistics may be collected on each historical domain name data on each date, so as to obtain the number of occurrences of different historical domain name data per day.

[0056] Step 402: Determine the probability score of the historical domain name data based on the number of occurrences per day.

[0057] Step 403: determine the historical domain name data with the largest probability score as the target domain name.

[0058] The above probability score can represent the probability value of the historical domain name data being the target domain name. The higher the score, the higher the possibility that the historical domain name data is the target domain name. Specifically, the probability score can be calculated for each historical domain name data according to the number of times different historical domain name data appear every day. The calculation can be performed according to the time sequence and the number of times it appears every day. The closer the time is to the current time, the higher the probability score. Correspondingly, the more times it appears every day, the higher the probability score.

[0059] Furthermore, according to the probability scores of the historical domain name data, the historical domain name data with the largest probability score can be determined as the target domain name, thereby ensuring the accuracy of the determined target domain name to a certain extent.

[0060] In an embodiment of the present invention, the historical record data also includes the historical data time, and for any of the historical domain name data, the number of occurrences of the historical domain name data per day is determined based on the historical data time of the historical domain name data within a preset period; the probability score of the historical domain name data is determined based on the number of occurrences per day; and the historical domain name data with the largest probability score is determined as the target domain name. In this way, the historical domain name data with the largest probability score can be selected as the target domain name based on the multiple historical domain name data corresponding to the target address data. Since the probability score is obtained based on the number of occurrences of each historical domain name data per day, the probability score can characterize the effectiveness of the historical domain name data to a certain extent, thereby improving the effectiveness of domain name backfilling.

[0061] Optionally, the operation of determining the probability score of the historical domain name data based on the number of occurrences per day may specifically include the following steps in this embodiment of the present invention:

[0062] Step 501: Determine the time decay score of the historical domain name data according to the preset period, the number of occurrences per day, and the preset decay coefficient.

[0063] Step 502: Determine the time decay score as the probability score of the historical domain name data.

[0064] The time decay score may be obtained by a preset time decay formula. Specifically, the time decay formula may be as follows:

[0065]

[0066] Among them, the scorei can represent the time decay score corresponding to the i-th historical domain name data, t represents the t-th day from the current time to T, and T represents the above-mentioned preset period, which refers to the decay period, which can be set according to actual needs, for example, it can be set to 30 days. numit is used to represent the number of times the i-th historical domain name data appears on the t-th day, and σ represents the decay coefficient. The larger the decay coefficient, the greater the influence of time on the probability score. The specific value of the decay coefficient can be set according to actual needs, for example, it can be set to 1.

[0067] Specifically, the time decay score obtained by the time decay formula can characterize the change trend of each historical domain name data. The higher the time decay score, the higher the probability of correspondence between the corresponding historical domain name data and the target address data. Therefore, the time decay score can be used as the above-mentioned probability score. The time decay formula can be used to realize the accumulation of DestinationIP and DomainName mapping relationship based on the time decay algorithm.

[0068] In the embodiment of the present invention, the time decay score of the historical domain name data is determined according to the preset period, the number of occurrences per day, and the preset decay coefficient; the time decay score is determined as the probability score of the historical domain name data. In this way, the time decay score determined by the preset period, the number of occurrences per day, and the preset decay coefficient can characterize the change trend of each historical domain name data to a certain extent, thereby ensuring the validity of the determined target domain name to a certain extent while ensuring the domain name backfill ratio.

[0069] Optionally, the embodiment of the present invention may further include the following steps:

[0070] Step 601: Store the correspondence between the historical domain name data with the largest probability score and the target address data in a cache database.

[0071] The cache database may be a remote dictionary service database (redis database), which has a faster data reading and writing speed than a memory.

[0072] Specifically, the target address data may be used as a primary key to form a key-value pair with the historical domain name data with the largest probability score, and stored in a redis database.

[0073] The operation of backfilling the target domain name into the domain name field that does not meet the preset requirement may specifically include the following steps in this embodiment of the present invention:

[0074] Step 602: Read the target domain name corresponding to the target address data from the cache database, and write the target domain name into the domain name field that does not meet the preset requirement.

[0075] Furthermore, when backfilling the target domain name, the target domain name corresponding to the target address data can be obtained according to the key-value pair in the cache database and then backfilled, thereby eliminating the need to occupy temporary memory for reading and writing data, and achieving high processing efficiency.

[0076] In the embodiment of the present invention, the correspondence between the historical domain name data with the largest probability score and the target address data is stored in a cache database; the target domain name corresponding to the target address data is read from the cache database, and the target domain name is written into the domain name field that does not meet the preset requirements. In this way, by storing the correspondence in the cache database, data is read and written through the cache database, and temporary memory is not required for processing. The cache database has a faster reading and writing speed than the memory, thereby improving the efficiency of domain name backfilling to a certain extent.

[0077] Optionally, the embodiment of the present invention may further include the following steps:

[0078] Step 701: Generate a user tag for a user corresponding to each piece of encrypted transmission data based on the historical record data and the domain name data in the encrypted transmission data that meets the preset requirements.

[0079] Step 702: Perform corresponding processing operations based on the user tag.

[0080] Among them, the DPI-http data and the https data after the domain name backfilling both contain a large amount of domain name data, and the specified field in the domain name data can usually characterize the type of website or application accessed by the data, such as entertainment, business, information, etc. Therefore, in the embodiment of the present invention, the access type of each transmission data can be determined through the above historical record data and the domain name data in the encrypted transmission data that meets the preset requirements.

[0081] Among them, the above-mentioned user refers to the user who initiates the access request. Specifically, since an encrypted transmission data often contains the source IP, destination IP and domain name that initiates the access request, different access users can be represented by the source IP in each encrypted transmission data. Furthermore, a corresponding user tag can be generated for each source IP through the source IP in each encrypted transmission data and the access type in each encrypted transmission data. Specifically, the access type with the number of accesses of each source IP within a preset time threshold greater than the preset number threshold can be used as the user tag corresponding to the source IP, or the access type with the most accesses within the preset time threshold can be directly used as the user tag, wherein the above-mentioned preset time threshold and preset number threshold can be set according to actual needs. For example, the above-mentioned preset time threshold can be 1 month, so that the user tag can be generated based on the access data of the user in the past 1 month.

[0082] Furthermore, the corresponding processing operation may be an operation of creating a user portrait or an operation of performing data statistics, which may be set according to actual needs, and the embodiment of the present invention does not limit this. Specifically, the user portrait may be a description of the user's attributes through user tags, or the user tags may be directly used as tags for the user portrait, thereby concretizing the user image. The data statistics may be to obtain the distribution of user tags of different users at different times, and then perform statistical analysis on the user's access preferences and historical change trends.

[0083] In the embodiment of the present invention, based on the historical record data and the domain name data in the encrypted transmission data that meets the preset requirements, a user tag is generated for the user corresponding to each encrypted transmission data; and a corresponding processing operation is performed based on the user tag. In this way, by generating a user tag through domain name data, each encrypted transmission data can be classified according to the domain name data, which facilitates the subsequent execution of corresponding processing operations through user tags, thereby improving the utilization rate of domain name data.

[0084] Optionally, the embodiment of the present invention may further include the following steps:

[0085] Step 801: When the domain name field in the encrypted transmission data meets at least one preset condition, determine that the domain name field does not meet the preset requirement; wherein the preset conditions include that the field value is a null value, an invalid value, and the field length is greater than a preset length threshold.

[0086] The above field value being a null value refers to a situation where there is no data in the field value part of the domain name field, and the above field value being an invalid value refers to a situation where there is data in the field value part of the domain name field but the data is not domain name data. For example, when the field value is 0, NULL or a timestamp, the field value can be considered to be an invalid value. Further, the above preset length threshold can be the maximum length value of the domain name data (for example, 100 characters), so that when the field length is greater than the preset length threshold, it indicates that the data of the current domain name field is invalid.

[0087] Furthermore, other preset conditions may be set according to actual needs, which is not limited in the embodiment of the present invention.

[0088] In the embodiment of the present invention, when the domain name field in the encrypted transmission data meets at least one preset condition, it is determined that the domain name field does not meet the preset requirement; wherein the preset condition includes that the field value is a null value, an invalid value, and the field length is greater than a preset length threshold. In this way, the domain name field that meets any preset condition can be further processed through the above steps, thereby reducing the null value rate and inefficiency of the domain name data in the encrypted transmission data, facilitating further increasing the amount of effective data and improving the data application value.

[0089] Optionally, the embodiment of the present invention may further include the following steps:

[0090] Step 901: Regularly clean up the data in the cache database according to a preset cleanup cycle.

[0091] The preset cleaning period may be consistent with the aforementioned decay period, or may be longer than the aforementioned decay period, and may be half a year, three months, or one month, and the embodiment of the present invention does not impose any limitation on this.

[0092] Specifically, in an embodiment of the present invention, according to the writing time of the data in the cache database, data whose time span between the writing time and the current time is greater than a preset cleaning period is deleted.

[0093] In the embodiment of the present invention, the data in the cache database is cleaned up regularly according to a preset cleaning cycle, so as to avoid invalid data caused by excessive historical data accumulated in the cache database and ensure the referenceability of the data in the cache database.

[0094] Figure 2 is a schematic diagram of a domain name backfilling scenario provided by an embodiment of the present invention, such as Figure 2 As shown, the scene may include a collection module, a cleaning module and a marking module.

[0095] First, the collection module can collect the perceived DPI-DNS data, mobile DPI-http data, and mobile DPI-https data through the signaling collection system. Secondly, according to the DestinationIP and DomainName in the perceived DPI-DNS, backfill the data with empty / non-compliant domain names (field values ​​are 0 / NULL / timestamps, or field lengths are greater than 100 characters) in the mobile DPI-https.

[0096] Next, count the relationship between DestinationIP and DomainName in mobile DPI-http, calculate the number of occurrences of each domain name corresponding to each IP, and calculate the score of each domain name within the decay period T.

[0097]

[0098] Where T = 30, σ is the decay coefficient, which can be 1. Get the DomainName with the largest score and establish a key-value pair with the DestinationIP to form a mapping between IP and DomainName, and store it in the cache database redies. Backfill the domain names in redies with empty / non-compliant https. Finally, use the http data and the backfilled https data to input into the label application module to generate labels for each piece of data.

[0099] The embodiment of the present invention has carried out a large number of experiments through the above operations. By sensing DPI-DNS data for backfilling and relying on domain name resolution data, the timeliness of the backfilled data can be guaranteed, and the backfill rate can reach 34%. The http data backfilling method based on the time decay algorithm assigns different weights to historical data, takes into account the changing trend of historical data, ensures the effectiveness of backfilling while ensuring that the backfill ratio can reach 85%. Since there is partial overlap between DNS backfilling and http backfilling, executing these two operations in succession can make the https domain name backfill rate reach more than 90%. The calculation method is more flexible, effectively increases the amount of data, and improves the value of data use.

[0100] Figure 3 is a structural block diagram of a domain name backfilling device 100 provided in an embodiment of the present invention. Figure 3 As shown, the device may include:

[0101] The data acquisition module 1001 is used to acquire encrypted transmission data, domain name real-time record data and historical record data based on network transmission data;

[0102] The target address acquisition module 1002 is used to determine the address data corresponding to the domain name field that does not meet the preset requirements as the target address data when the domain name field in the encrypted transmission data does not meet the preset requirements;

[0103] A target domain name acquisition module 1003 is used to acquire a target domain name corresponding to the target address data based on the domain name real-time record data and the historical record data;

[0104] The domain name backfill module 1004 is used to backfill the target domain name into the domain name field that does not meet the preset requirement, so as to obtain encrypted transmission data that meets the preset requirement.

[0105] Optionally, the domain name real-time record data includes a real-time correspondence between address data and domain name data within a domain name refresh cycle; the target domain name acquisition module 1003 is specifically used to:

[0106] Based on the target address data, determining whether there is domain name data uniquely corresponding to the target address data in the real-time correspondence between the address data and the domain name data;

[0107] If it exists, determining the domain name data uniquely corresponding to the target address data as the target domain name;

[0108] If not, the target domain name corresponding to the target address data is acquired based on the historical record data.

[0109] Optionally, the historical record data includes a historical correspondence between address data and domain name data in multiple domain name refresh cycles; the target domain name acquisition module 1003 is further specifically used to:

[0110] Based on the target address data, acquiring a plurality of historical domain name data corresponding to the target address data from a historical correspondence between the address data and the domain name data;

[0111] The target domain name is determined from the plurality of historical domain name data.

[0112] Optionally, the historical record data further includes the historical data time, and the target domain name acquisition module 1003 is further specifically used for:

[0113] For any of the historical domain name data, determining the number of occurrences of the historical domain name data per day based on the historical data time of the historical domain name data within a preset period;

[0114] Determining a probability score of the historical domain name data based on the number of occurrences per day;

[0115] The historical domain name data with the largest probability score is determined as the target domain name.

[0116] Optionally, the target domain name acquisition module 1003 is further specifically configured to:

[0117] Determine the time decay score of the historical domain name data according to the preset period, the number of occurrences per day, and the preset decay coefficient;

[0118] The time decay score is determined as a probability score of the historical domain name data.

[0119] Optionally, the device 100 further includes:

[0120] A storage module, used for storing the correspondence between the historical domain name data with the largest probability score and the target address data in a cache database;

[0121] The domain name backfill module 1004 is specifically configured to read a target domain name corresponding to the target address data from the cache database, and write the target domain name into the domain name field that does not meet the preset requirement.

[0122] Optionally, the device 100 further includes:

[0123] A label generation module, used to generate a user label for a user corresponding to each piece of encrypted transmission data based on the historical record data and the domain name data in the encrypted transmission data that meets the preset requirements;

[0124] A processing module is used to perform corresponding processing operations based on the user tag.

[0125] Optionally, the device 100 further includes:

[0126] A determination module, configured to determine that the domain name field in the encrypted transmission data does not meet the preset requirement when the domain name field meets at least one preset condition;

[0127] The preset conditions include that the field value is a null value, an invalid value, and the field length is greater than a preset length threshold.

[0128] Optionally, the device 100 further includes:

[0129] The data cleaning module is used to regularly clean up the data in the cache database according to a preset cleaning cycle.

[0130] In summary, the embodiment of the present invention obtains encrypted transmission data, domain name real-time record data and historical record data based on network transmission data; when the domain name field in the encrypted transmission data does not meet the preset requirements, the address data corresponding to the domain name field that does not meet the preset requirements is determined as the target address data; based on the domain name real-time record data and the historical record data, the target domain name corresponding to the target address data is obtained; the target domain name is backfilled into the domain name field that does not meet the preset requirements to obtain the encrypted transmission data that meets the preset requirements. In this way, when the domain name field in the encrypted transmission data does not meet the preset requirements, the corresponding target domain name can be obtained through the domain name real-time record data and the historical record data, and by backfilling the target domain name into the domain name field that does not meet the preset requirements, the domain name data in the encrypted transmission data can be made more accurate, thereby ensuring the validity of the domain name data in the encrypted transmission data and improving the use value of the data.

[0131] In another embodiment of the present invention, an electronic device is provided, including a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus;

[0132] Memory, used to store computer programs;

[0133] The processor is used to perform any of the above-mentioned domain name processing methods when executing the program stored in the memory.

[0134] In another embodiment provided by the present invention, a computer-readable storage medium is provided, in which instructions are stored. When the instructions are executed on a computer, the computer performs the domain name backfilling method described in any one of the above embodiments.

[0135] In another embodiment provided by the present invention, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to perform the domain name backfilling method described in any one of the above embodiments.

[0136] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0137] It should be noted that the various data-related processes in the embodiments of the present application are all carried out in compliance with the corresponding data protection laws and policies of the country where the device is located, and with the authorization given by the owner of the corresponding device.

[0138] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0139] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0140] The above description is only a preferred embodiment of the present invention and is not intended to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are included in the protection scope of the present invention.

Claims

1. A domain name backfilling method, characterized in that: The method comprises: Acquire encrypted transmission data, domain name real-time record data and historical record data based on network transmission data, wherein the domain name real-time record data includes a real-time mapping relationship between a DNS domain name corresponding to a user's access request generated through the user's real-time access data and the accessed address data, and the historical record data includes a corresponding relationship between address data and domain names accumulated through historical log data, and the encrypted transmission data is https data; In the case where the domain name field in the encrypted transmission data does not meet the preset requirements, determining the address data corresponding to the domain name field that does not meet the preset requirements as the target address data; Acquire a target domain name corresponding to the target address data based on the domain name real-time record data and the historical record data; The target domain name is backfilled into the domain name field that does not meet the preset requirements to obtain encrypted transmission data that meets the preset requirements.

2. The method according to claim 1, characterized in that The domain name real-time record data includes a real-time correspondence between address data and domain name data within a domain name refresh cycle; The step of obtaining a target domain name corresponding to the target address data based on the domain name real-time record data and the historical record data includes: Based on the target address data, determining whether there is domain name data uniquely corresponding to the target address data in the real-time correspondence between the address data and the domain name data; If it exists, determining the domain name data uniquely corresponding to the target address data as the target domain name; If not, the target domain name corresponding to the target address data is acquired based on the historical record data.

3. The method according to claim 2, characterized in that The historical record data includes a historical correspondence between address data and domain name data in a plurality of domain name refresh cycles; and obtaining a target domain name corresponding to the target address data based on the historical record data includes: Based on the target address data, acquiring a plurality of historical domain name data corresponding to the target address data from a historical correspondence between the address data and the domain name data; The target domain name is determined from the plurality of historical domain name data.

4. The method according to claim 3, characterized in that The historical record data also includes the historical data time, and the determining the target domain name from the plurality of historical domain name data includes: For any of the historical domain name data, determining the number of occurrences of the historical domain name data per day based on the historical data time of the historical domain name data within a preset period; Determining a probability score of the historical domain name data based on the number of occurrences per day; The historical domain name data with the largest probability score is determined as the target domain name.

5. The method according to claim 4, characterized in that Determining the probability score of the historical domain name data based on the number of occurrences per day includes: Determine the time decay score of the historical domain name data according to the preset period, the number of occurrences per day, and the preset decay coefficient; The time decay score is determined as a probability score of the historical domain name data.

6. The method according to claim 4, characterized in that The method further comprises: The corresponding relationship between the historical domain name data with the largest probability score and the target address data is stored in a cache database; The backfilling of the target domain name into the domain name field that does not meet the preset requirement includes: reading the target domain name corresponding to the target address data from the cache database, and writing the target domain name into the domain name field that does not meet the preset requirement.

7. The method according to claim 1, characterized in that The method further comprises: Based on the historical record data and the domain name data in the encrypted transmission data that meets the preset requirements, generate a user tag for the user corresponding to each piece of encrypted transmission data; A corresponding processing operation is performed based on the user tag.

8. The method according to claim 1, characterized in that The method further comprises: When the domain name field in the encrypted transmission data meets at least one preset condition, determining that the domain name field does not meet the preset requirement; The preset conditions include that the field value is a null value, an invalid value, and the field length is greater than a preset length threshold.

9. The method according to claim 6, characterized in that The method further comprises: The data in the cache database is cleaned up regularly according to a preset cleaning cycle.

10. A domain name backfilling device, characterized in that: The device comprises: A data acquisition module is used to acquire encrypted transmission data, domain name real-time record data and historical record data based on network transmission data, wherein the domain name real-time record data includes a real-time mapping relationship between a DNS domain name corresponding to a user's access request generated through the user's real-time access data and the accessed address data, and the historical record data includes a corresponding relationship between address data and domain names accumulated through historical log data, and the encrypted transmission data is https data; A target address acquisition module, configured to determine, when a domain name field in the encrypted transmission data does not meet a preset requirement, address data corresponding to the domain name field that does not meet the preset requirement as target address data; A target domain name acquisition module, used to acquire a target domain name corresponding to the target address data based on the domain name real-time record data and the historical record data; The domain name backfill module is used to backfill the target domain name into the domain name field that does not meet the preset requirements to obtain encrypted transmission data that meets the preset requirements.

11. The device according to claim 10, characterized in that The domain name real-time record data contains a real-time correspondence between address data and domain name data within a domain name refresh cycle; the target domain name acquisition module is specifically used to: Based on the target address data, determining whether there is domain name data uniquely corresponding to the target address data in the real-time correspondence between the address data and the domain name data; If it exists, determining the domain name data uniquely corresponding to the target address data as the target domain name; If not, the target domain name corresponding to the target address data is acquired based on the historical record data.

12. The device according to claim 11, characterized in that The historical record data includes the historical correspondence between address data and domain name data in multiple domain name refresh cycles; the target domain name acquisition module is also specifically used to: Based on the target address data, acquiring a plurality of historical domain name data corresponding to the target address data from a historical correspondence between the address data and the domain name data; The target domain name is determined from the plurality of historical domain name data.

13. The device according to claim 12, characterized in that The target domain name acquisition module is further specifically used for: For any of the historical domain name data, determining the number of occurrences of the historical domain name data per day based on the historical data time of the historical domain name data within a preset period; Determining a probability score of the historical domain name data based on the number of occurrences per day; The historical domain name data with the largest probability score is determined as the target domain name.

14. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing any of the methods of claims 1-9 when executing a program stored in a memory.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 9 is implemented.

Images