Device category identification method, device and computer readable storage medium

Abstract

The application provides a device category identification method and device and a computer readable storage medium, which can be used in the technical field of network. The method comprises the following steps: acquiring a plurality of log records, each log record comprising a domain name of a request access, a request address, a destination address and a resolution time; wherein the request address is the address of the device requesting to access the domain name, the destination address is the address of the device resolving the domain name, and the resolution time is the time of obtaining the resolution result, the resolution result being the address obtained by resolving the domain name; identifying the device category of the device corresponding to each address based on the domain name, the request address, the destination address and the resolution time in each log record, the device category comprising a domain name server and an access terminal; and recording the correspondence between each address in each log record and the device category. The method of the application can accurately identify the category of network assets.

Description

TECHNICAL FIELD

[0001] The present application relates to the network technical field, and particularly relates to a device category identification method and device and a computer readable storage medium. BACKGROUND

[0002] Assets are information or resources with value to an organization, and are objects protected by security policies. With the popularity of networks and the development of businesses, a large number of network assets are generated in various industries. Network assets refer to various devices used in computer networks or communication networks, mainly including hosts, network devices (such as routers and switches), and security devices (such as firewalls).

[0003] However, because different categories of assets have different impacts on networks when they are damaged to the same extent, it is necessary to accurately identify the categories of network assets in order to perform asset mapping on the network assets, thereby ensuring network security. SUMMARY

[0004] The present application provides a device category identification method, device and computer readable storage medium, to solve the problem of identifying network asset categories.

[0005] In a first aspect, the present application provides a device category identification method, comprising: obtaining a plurality of log records, each of the plurality of log records comprising a domain name of a request access, a request address, a destination address and a resolution time; wherein the request address is an address of a device requesting to access the domain name, the destination address is an address of a device resolving the domain name, and the resolution time is a time of obtaining a resolution result, the resolution result being an address obtained by resolving the domain name; identifying a device category of a device corresponding to each address based on the domain name, the request address, the destination address and the resolution time in each log record, the device category comprising a domain name server and an access terminal; and recording a correspondence between each address in the log record and the device category.

[0006] In the present application, the domain name, the request address, the destination address and the resolution time in each of the obtained plurality of log records are analyzed to determine the device category to which the device corresponding to the request address and the destination address belongs, thereby accurately identifying the network asset category. In addition, the correspondence between each address and the device category corresponding thereto is recorded, thereby facilitating subsequent mapping of the network assets.

[0007] With reference to the first aspect, in some implementations of the first aspect, the identifying, based on the domain name, the request address, the destination address and the resolving time in each log record, the device category of the device corresponding to each address, comprises: determining, based on the plurality of log records, an association graph in a graph computing manner, the association graph comprising a plurality of points for identifying different domain names, a plurality of points for identifying different addresses and a plurality of edge arrows for connecting the domain name, the request address and the destination address in a same log record, for describing the pointing relationship between the domain name, the request address and the destination address in the plurality of log records; wherein the domain name in a same log record points to the request address, and the request address points to the destination address, and when the same address exists in a plurality of log records, the address in a log record with earlier resolving time is upstream of the address in a log record with later resolving time; and identifying, based on the association graph, the device category of the device corresponding to each address.

[0008] With reference to the first aspect, in some implementations of the first aspect, the identifying, based on the association graph, the device category of the device corresponding to each address, comprises: the device category of the device corresponding to the address identified by a first target point in the association graph is the domain name server, the first target point being a point pointed to by one or more points identifying addresses; and the device category of the device corresponding to the address identified by a second target point in the association graph is the access terminal, the second target point being a point pointed to by a point identifying a domain name.

[0009] With reference to the first aspect, in some implementations of the first aspect, the domain name server comprises a cross-domain domain name server and a cascaded domain name server; the device category of the device corresponding to the address identified by a point in the first target point pointed to by one point identifying an address and not pointed to by other points identifying addresses is the cross-domain domain name server; or the device category of the device corresponding to the address identified by a point in the first target point pointed to by a plurality of points identifying addresses is the cascaded domain name server; or the device category of the device corresponding to the address identified by a point in the first target point pointed to by one or more points identifying addresses and simultaneously pointed to by other one or more points identifying addresses is the cascaded domain name server.

[0010] In some implementations of the first aspect, before the obtaining the plurality of log records, the method further includes: obtaining a plurality of original log records from the network; grouping the plurality of original log records based on the resolution time of each original log record in the plurality of original log records, to obtain at least one log record group, each log record group including a plurality of log records, and the time interval between the resolution time of any two log records in the plurality of log records not exceeding a preset value; and the obtaining the plurality of log records includes: obtaining the plurality of log records in any one of the at least one log record group.

[0011] In some implementations of the first aspect, before the grouping the plurality of original log records, the method further includes: screening out a target log record from the plurality of original log records, the device category of the device corresponding to the request address or the destination address in the target log record being a cross-domain domain name server; and the grouping the plurality of original log records includes: grouping the plurality of original log records from which the target log record is screened out.

[0012] In some implementations of the first aspect, the resolution result is further included in each log record.

[0013] In a second aspect, the present application provides a device category identification apparatus, including an obtaining module, a processing module and a storage module.

[0014] The obtaining module is configured to: obtain a plurality of log records, each log record in the plurality of log records including a domain name requested to be accessed, a request address, a destination address and a resolution time; wherein the request address is the address of a device requesting to access the domain name, the destination address is the address of a device resolving the domain name, and the resolution time is the time at which a resolution result is obtained, the resolution result being the address obtained by resolving the domain name; the processing module is configured to: identify the device category of the device corresponding to each address based on the domain name, the request address, the destination address and the resolution time in each log record, the device category including a domain name server and an access terminal; and the storage module is configured to: record the correspondence between each address in the log record and the device category.

[0015] With reference to the second aspect, in some implementations of the second aspect, the processing module is specifically configured to: determine, in a graph computing manner, an association graph based on the plurality of log records, the association graph including a plurality of points for identifying different domain names, a plurality of points for identifying different addresses, and a plurality of edge arrows for connecting the domain name, the request address, and the destination address in a same log record, so as to describe the pointing relationship between the domain name, the request address, and the destination address in the plurality of log records; wherein the domain name in a same log record points to the request address, and the request address points to the destination address, and when the same address exists in a plurality of log records, the address in a log record with earlier parsing time is upstream of the address in a log record with later parsing time; and identify the device category of the device corresponding to each address based on the association graph.

[0016] With reference to the second aspect, in some implementations of the second aspect, the processing module is specifically configured to: the device category of the device corresponding to the address identified by a first target point in the association graph is the domain name server, the first target point being a point pointed to by one or more points identifying addresses; and the device category of the device corresponding to the address identified by a second target point in the association graph is the access terminal, the second target point being a point pointed to by a point identifying a domain name.

[0017] With reference to the second aspect, in some implementations of the second aspect, the domain name server includes a cross-domain domain name server and a cascading domain name server; the device category of the device corresponding to the address identified by the point in the first target point pointed to by one point identifying an address and not pointed to by other points identifying addresses is the cross-domain domain name server; or the device category of the device corresponding to the address identified by the point in the first target point pointed to by a plurality of points identifying addresses is the cascading domain name server; or the device category of the device corresponding to the address identified by the point in the first target point pointed to by one or more points identifying addresses and simultaneously pointed to by other one or more points identifying addresses is the cascading domain name server.

[0018] With reference to the second aspect, in some implementations of the second aspect, the obtaining module is further configured to: obtain a plurality of original log records from a network; the processing module is further configured to: group the plurality of original log records based on the parsing time of each original log record in the plurality of original log records, to obtain at least one log record group, each log record group including a plurality of log records, and the interval between the maximum value and the minimum value of the parsing time in the plurality of log records in each log record group not exceeding a preset value; and the obtaining module is specifically configured to: obtain the plurality of log records in any one of the at least one log record group.

[0019] With reference to the second aspect, in some implementations of the second aspect, the processing module is further configured to: filter out target log records from the plurality of original log records, the device category of the device corresponding to the destination address in the target log records being a cross-domain name server; and group the plurality of original log records from which the target log records are filtered out.

[0020] In a third aspect, the present application provides a device category identification apparatus, comprising a processor configured to implement the method in the first aspect and any possible implementation of the first aspect.

[0021] The apparatus can further include a memory configured to store instructions and data. The memory is coupled to the processor, and the processor implements the method described in the above aspects when executing the instructions stored in the memory.

[0022] The apparatus can further include a communication interface configured to enable communication between the apparatus and other devices. Exemplarily, the communication interface can be a transceiver, a circuit, a bus, a module, or other types of communication interfaces.

[0023] In a fourth aspect, the present application provides a chip system, comprising at least one processor configured to support the functions involved in the first aspect and any possible implementation of the first aspect.

[0024] In a possible design, the chip system further includes a memory configured to store program instructions and data, the memory being located in or out of the processor.

[0025] The chip system can be composed of a chip, or can include a chip and other discrete devices.

[0026] In a fifth aspect, the present application provides a computer readable storage medium, including a computer program, which, when executed on a computer, causes the computer to implement the method in the first aspect and any possible implementation of the first aspect.

[0027] In a sixth aspect, the present application provides a computer program product, comprising a computer program (also referred to as code or instructions), which, when executed, causes a computer to perform the method in the first aspect and any possible implementation of the first aspect.

[0028] It should be understood that the second aspect to the sixth aspect of the present application correspond to the technical solution of the first aspect of the present application, and the beneficial effects achieved by each aspect and the corresponding possible implementation are similar, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0029] The accompanying drawings, which are incorporated herein and constitute part of the specification, illustrate embodiments consistent with the application and, together with the description, further serve to explain the principles of the application.

[0030] Figure 1 is a schematic flowchart of a device category identification method provided by the application;

[0031] Figure 2 is an association relationship diagram provided by an embodiment of the application;

[0032] Figure 3 is another association relationship diagram provided by an embodiment of the application;

[0033] Figure 4 is another schematic flowchart of a device category identification method provided by the application;

[0034] Figure 5 is a schematic block diagram of a device category identification apparatus provided by the application;

[0035] Figure 6 is another schematic block diagram of a device category identification apparatus provided by the application.

[0036] The specific embodiments of the application have been shown and described in the above-described drawings, and will be described in more detail hereinafter. These drawings and the written description are not intended to restrict the scope of the inventive concept in any way, but to illustrate the inventive concept to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0037] The technical solutions in the application will be described below with reference to the drawings.

[0038] Before introducing the method provided by the embodiments of the application, the following points will be explained first.

[0039] First, in the embodiments shown below, each term and English abbreviation, such as cascaded domain name server, cross-domain domain name server, etc., are exemplary examples given for the convenience of description, and should not constitute any limitation on the application. The application does not exclude the possibility of other terms that can achieve the same or similar functions being defined in the future.

[0040] Second, in the embodiments shown below, the use of prefixes such as “first”, “second”, etc., is only for the convenience of distinguishing and describing different things belonging to the same name category, and does not constrain the order, size or quantity of the things. For example, “first target point” and “second target point” are only different points, and there is no time sequence, size relationship or priority relationship between them.

[0041] Third, "at least one" means one or more, "multiple" means two or more. "And / or" describes the association between the associated objects, which means that there can be three relationships, for example, A and / or B, which means that A exists alone, A and B exist together, and B exists alone, where A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after it. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b and c, which means a, or b, or c, or a and b, or a and c, or b and c, or a, b and c, where a, b and c can be single or multiple.

[0042] Assets are information or resources that have value to an organization and are the objects protected by security policies. With the popularity of the network and the development of business, a large number of network assets have emerged in various industries. Network assets refer to various devices used in computer networks or communication networks, mainly including hosts, network devices (such as routers and switches), and security devices (such as firewalls).

[0043] However, because different categories of assets have different impacts on the network when they are damaged to the same extent, it is necessary to accurately identify the categories of network assets in order to facilitate asset mapping of network assets and thus ensure network security.

[0044] Among them, asset mapping is a statistical analysis of network assets in the whole network to obtain information. Through asset mapping of assets in the network, customers can always understand network assets and actively and timely control asset dynamics to alleviate enterprise security risks.

[0045] Therefore, the embodiments of the present application provide a device category identification method, device and computer readable storage medium. In the method, the association relationship between the request address, the destination address and the domain name in the obtained multiple domain name resolution log records is analyzed to determine the device category to which the device corresponding to the request address and the destination address belongs, thereby achieving accurate identification of the network asset category.

[0046] The device category identification method provided by the embodiments of the present application will be described in detail below with reference to the accompanying drawings. The method of the embodiments of the present application can be executed by a data processing device or a chip in the data processing device, and the embodiments of the present application do not limit this.

[0047] Figure 1 is a schematic flowchart of the device category identification method 100 provided by the embodiments of the present application. The method 100 can include S101-S103. The steps shown in the following detailed description. Figure 1 The steps shown in the following detailed description.

[0048] S101, acquire a plurality of log records, each of which comprises a domain name requested to be accessed, a request address, a destination address, and a resolution time.

[0049] The request address is an address of a device requesting to access the domain name, the destination address is an address of a device resolving the domain name, and the resolution time is a time when a resolution result is acquired.

[0050] Optionally, each log record can further comprise the resolution result.

[0051] It should be understood that the above-mentioned address can be an IP address or other address that can distinguish different devices. Hereinafter, for the convenience of understanding and description, the log record is described by taking the IP address as an example of the request address and the destination address.

[0052] Table 1

[0053] Request address Destination address Resolution time Domain name Resolution result 333.10.10.10 222.10.10.10 20230111223343 a.111.com 111.111.111.111 222.10.10.10 111.10.10.10 20230111223344 a.111.com 111.111.111.111 333.10.10.10 111.10.10.10 20230111223345 a.111.com 111.111.111.111

[0054] Table 1 shows three log records. As shown in Table 1, the domain name requested to be accessed by the devices corresponding to the request addresses in the three log records is a.111.com, and the IP address corresponding to the domain name a.111.com is 111.111.111.111.

[0055] For the first log record, the IP address of the device requesting to access the domain name a.111.com (i.e., an example of the request address) is 333.10.10.10, the IP address of the device resolving the domain name a.111.com (i.e., an example of the destination address) is 222.10.10.10, and the time when the device corresponding to the request address 333.10.10.10 acquires the resolution result 111.111.111.111 is 20230111223343.

[0056] For the second log record, the IP address of the device requesting to access the domain name a.111.com is 222.10.10.10, the IP address of the device resolving the domain name a.111.com is 111.10.10.10, and the time when the device corresponding to the request address 222.10.10.10 acquires the resolution result 111.111.111.111 is 20230111223344.

[0057] For the third log record, the IP address of the device requesting to access the domain name a.111.com is 333.10.10.10, the IP address of the device resolving the domain name a.111.com is 111.10.10.10, and the time at which the device with the request address 333.10.10.10 obtains the resolution result 111.111.111.111 is 20230111223343.

[0058] For example, the resolution time 20230111223343 can be expressed as 22:33:43 on January 11, 2023, and similarly, the resolution time 20230111223344 can be expressed as 22:33:44 on January 11, 2023, and the resolution time 20230111223345 can be expressed as 22:33:45 on January 11, 2023. Thus, the recording interval of each domain name resolution record is 1 second.

[0059] S102, based on the domain name, request address, destination address and resolution time in each log record, identifying the device category of the device corresponding to each address. The device category includes domain name servers and access terminals.

[0060] Among them, the domain name server refers to a device with domain name resolution function, that is, the device corresponding to the destination address in each log record; the access terminal refers to a device that can request to access the domain name, that is, the device corresponding to the request address in each log record.

[0061] For example, based on the domain name, request address, destination address and resolution time in each log record, identifying the device category of the device corresponding to each address, including: using graph computing, determining an association graph based on multiple log records; based on the association graph, identifying the device category of the device corresponding to each address.

[0062] Graph computing refers to a process of modeling data in the form of a graph to express and solve problems. A graph is defined as a multiset consisting of points and edges, and several points are connected by edges to express the association and interaction between points.

[0063] In this application, the association graph determined by graph computing includes a plurality of points for identifying different domain names, a plurality of points for identifying different addresses, and a plurality of edges with arrows for connecting the domain name, request address and destination address in the same log record, to describe the pointing relationship between the domain name, request address and destination address in the log record in the plurality of log records.

[0064] In the association relationship graph, the domain name in the same log record refers to the request address, and the request address refers to the destination address. However, it should be noted that when the same address exists in multiple log records, the address in the log record with earlier parsing time is upstream of the address in the log record with later parsing time.

[0065] In combination with the example shown in Table 1, the graph calculation method is adopted, and the point identifying the domain name is taken as the root node. According to the first log record, it is obtained that the root node points to the point identifying 333.10.10.10, and further points to the point identifying 222.10.10.10. According to the second log record, it is obtained that the root node points to the point identifying 222.10.10.10, and further points to the point identifying 111.10.10.10. According to the third log record, it is obtained that the root node points to the point identifying 333.10.10.10, and further points to the point identifying 111.10.10.10. Since the destination address in the first log record is the request address in the second log record, and the parsing time of the first log record is earlier, after the root node in the first log record points to the point identifying 333.10.10.10, and further points to the point identifying 222.10.10.10, it can continue to point to the point identifying 111.10.10.10, so that the association relationship graph as shown in Table 1 can be obtained. Figure 2

[0066] It should be understood that if the parsing time of the second log record is earlier than the parsing time of the first log record in the example shown in Table 1, after the root node in the first log record points to the point identifying 333.10.10.10, and further points to the point identifying 222.10.10.10, it cannot continue to point to the point identifying 111.10.10.10.

[0067] Next, in combination with Example 1 and Example 2, the device category of the device corresponding to each address identified based on the association relationship graph is introduced.

[0068] In Example 1, the device category of the device corresponding to the address identified by the first target point in the association relationship graph is a domain name server, and the first target point is a point pointed to by one or more points identifying addresses.

[0069] Since the address identified by the point that can be pointed to by one or more points identifying addresses in the association relationship graph can only be a destination address, the device category of the device corresponding to the destination address in the multiple log records is a domain name server.

[0070] Optionally, the above-mentioned domain name server can include a cross-domain domain name server and a cascading domain name server. Therefore, the device category of the device corresponding to the address identified by the first target point can be a cross-domain domain name server, or a cascading domain name server.​

[0071] Exemplarily, the device category of the device corresponding to the address identified by the address pointed by the point in the first target point which is pointed by the points of multiple identified addresses is a cascading domain name server; or, the device category of the device corresponding to the address identified by the address pointed by the point in the first target point which is pointed by the point of one or more identified addresses and simultaneously pointed by the points of one or more other identified addresses is a cascading domain name server.

[0072] In combination with the above Figure 2 The association relationship diagram shown in the table can be obtained: the point for identifying 111.10.10.10 is pointed by the point for identifying 333.10.10.10 and the point for identifying 222.10.10.10, so the device category of the device corresponding to 111.10.10.10 is a cascading domain name server; the point for identifying 222.10.10.10 is pointed by the point for identifying 333.10.10.10 and simultaneously pointed by the point for identifying 111.10.10.10, so the device category of the device corresponding to 222.10.10.10 is a cascading domain name server.

[0073] Exemplarily, the device category of the device corresponding to the address identified by the address pointed by the point in the first target point which is pointed by the point of one identified address and is not pointed by the point of other identified address is a cross-domain domain name server.

[0074] Table II

[0075]

[0076]

[0077] Table II shows three log records. Taking the three log records shown in Table II as an example, in a graph computing manner, taking the point for identifying the domain name as a root node, according to the first log record, it is obtained that the root node points to the point for identifying 333.10.10.10, and further points to the point for identifying 222.10.10.10; according to the second log record, it is obtained that the root node points to the point for identifying 444.10.10.10, and further points to the point for identifying 666.10.10.10; according to the third log record, it is obtained that the root node points to the point for identifying 555.10.10.10, and further points to the point for identifying 111.10.10.10. Thus, the association relationship diagram shown in the table can be obtained. Figure 3

[0078] As shown in Figure 3 ​As shown, the point for identifying 222.10.10.10 is pointed to by the point for identifying a.111.com and is no longer pointed to by other points for identifying addresses, thus the device category of the device corresponding to 222.10.10.10 is a cross-domain domain name server; the point for identifying 666.10.10.10 is pointed to by the point for identifying 444.10.10.10 and is no longer pointed to by other points for identifying addresses, thus the device category of the device corresponding to 666.10.10.10 is a cross-domain domain name server; the point for identifying 111.10.10.10 is pointed to by the point for identifying 555.10.10.10 and is no longer pointed to by other points for identifying addresses, thus the device category of the device corresponding to 111.10.10.10 is a cross-domain domain name server.

[0079] In Example Two, the device category of the device corresponding to the address identified by the second target point in the association relationship graph is an access terminal, and the second target point is a point pointed to by a point for identifying a domain name.

[0080] Since the point pointed to by the point for identifying a domain name in the association relationship graph is used to identify a request address, the device category of the device corresponding to the request address in the plurality of log records is an access terminal.

[0081] In combination with the above Figure 2 As shown in the association relationship graph, the point for identifying 333.10.10.10 is pointed to by the point for identifying a.111.com, and the point for identifying 222.10.10.10 is pointed to by the point for identifying a.111.com, thus the device category of the devices corresponding to 333.10.10.10 and 222.10.10.10 is an access terminal.

[0082] S103, record the correspondence between each address in each log record and the device category.

[0083] The application can update the correspondence between each address in the plurality of log records and the device category in the network terminal information database, so as to facilitate asset mapping of network assets.

[0084] In the embodiment of the application, the domain name, the request address, the destination address, and the resolution time in each log record in the plurality of log records obtained by analysis are used to determine the device category to which the device corresponding to the request address and the destination address belongs, so as to accurately identify the network asset category, and in addition, the correspondence between each address and the device category corresponding thereto is recorded, so as to facilitate subsequent mapping of network assets.

[0085] Optionally, before S102, the method 100 further includes: obtaining a plurality of original log records from the network; grouping the plurality of original log records based on the resolving time of each original log record in the plurality of original log records to obtain at least one log record group. Then, S101 can be replaced by: obtaining the plurality of log records in any one of the at least one log record group.

[0086] Each log record group in the at least one log record group includes a plurality of log records, and the time interval of the resolving time of any two log records in the plurality of log records does not exceed a preset value.

[0087] Since the domain name requested to be accessed, the request address, the destination address and the resolving time are included in each original log record, the application can group the plurality of original log records based on the time sequence relationship of the resolving time of the plurality of original log records with the preset value as a time unit.

[0088] In combination with the example shown in Table 1, if the preset value is two seconds, the three log records shown in Table 1 can be recorded as one log record group.

[0089] Optionally, before grouping the plurality of original log records, the method 100 further includes: screening a target log record from the plurality of original log records. Then, grouping the plurality of original log records can be replaced by: grouping the plurality of original log records from which the target log record is screened.

[0090] The device category of the device corresponding to the destination address in the target log record is a cross-domain domain name server, and the device corresponding to the request address in the target log record is an access terminal.

[0091] Similarly, the correspondence between each address in the target log record and the device category can be recorded.

[0092] The following describes an embodiment shown in Table 1, in combination with Table 2. Figure 1 The following describes an embodiment shown in Table 1, in combination with Table 2. Figure 4 The device category identification method provided by the embodiment of the application is described in detail. It should be understood that the content described in the embodiment shown in Table 1 is not repeated. Figure 1 The device category identification method provided by the embodiment of the application is described in detail. It should be understood that the content described in the embodiment shown in Table 1 is not repeated.

[0093] Figure 4 FIG. 4 is another schematic flowchart of the device category identification method 400 provided by the embodiment of the application. The method 400 can include S401 to S408. The following describes each step shown in Table 4 in detail. Figure 4

[0094] S401, obtaining N original log records from the network.

[0095] ​The N original log records each include a domain name requested, a request address, a destination address, and a resolving time, and N is an integer greater than 0.

[0096] Optionally, each original log record further includes a resolving result.

[0097] The request address, the destination address, the resolving time, and the resolving result are described above and will not be repeated here.

[0098] S402, determining whether the destination address in the N original log records is a cross-domain domain name server.

[0099] Since there can be a plurality of domain name resolving servers in the network, such as a domestic operator's domain name resolving server, a domestic other manufacturer's domain name resolving server, or an overseas domain name resolving server, the destination address included in the N original log records can be determined to determine whether the device corresponding to the destination address is a cross-domain domain name server.

[0100] The cross-domain domain name server in the present application can be a domain name resolving server of another operator or an overseas domain name resolving server.

[0101] 1. If it is not determined whether the destination address is a cross-domain domain name server, S403 and S406 to S408 can be continuously executed.

[0102] 2. If the destination address is a cross-domain domain name server, S404 to S408 can be continuously executed.

[0103] S403, grouping the N original log records to obtain at least one log record group.

[0104] Exemplarily, the at least one log record group can be obtained through the following steps 1 and 2.

[0105] Step 1, determining the time sequence relationship of M resolving times in the N original log records. Or, arranging the M resolving times in the N original log records in time sequence to obtain the M resolving times in the first order.

[0106] Wherein, M is an integer greater than 0 and less than or equal to N. When M is less than N, it means that there are multiple original log records with the same resolving time in the N original log records.

[0107] Step 2, based on the time sequence relationship determined in step 1, the M resolving times are divided into n groups in a first time length unit, to obtain n log record groups, each of which includes multiple log records. Or, the M resolving times in the first order are divided into n groups in a first time length unit.

[0108] wherein n is an integer greater than 0 and less than or equal to N.

[0109] Since each original log record includes a resolution time, grouping the resolution times can obtain n groups of log records corresponding to the resolution times.

[0110] It should be understood that the time interval of the resolution times of any two log records in the at least one group of log records obtained based on S403 does not exceed the first time length.

[0111] S404, filtering the target log records from the N original log records to obtain Z original log records. Wherein Z is an integer greater than 0 and less than N.

[0112] The description of the target log record can refer to the foregoing description.

[0113] S405, grouping the Z original log records to obtain at least one group of log records.

[0114] The process can refer to the description of S403, which will not be repeated here.

[0115] S406, using a graph computing method, determining an association relationship graph based on the multiple log records included in each group of log records in the at least one group of log records.

[0116] The description of the association relationship graph can refer to the foregoing description, which will not be repeated here.

[0117] Exemplarily, the at least one group of log records in S406 can be obtained through S403 or S405.

[0118] S407, based on the association relationship graph, identifying the device category of the device corresponding to each address.

[0119] The process can refer to the related description in S102, which will not be repeated here.

[0120] Optionally, if the device category of the device corresponding to the address identified by the first target point is a cross-domain name server, the N (or Z) original log records can be grouped again to obtain at least one group of log records; and using a graph computing method, determining an association relationship graph based on the multiple log records included in each group of log records in the at least one group of log records obtained by grouping again; and based on the association relationship graph, identifying the device category of the device corresponding to each address.

[0121] It should be noted that the difference between the at least one log record group obtained by the re-grouping and the at least one log record group obtained by S403 (or S405) is that the time interval of the analysis time of any two log records in the at least one log record group obtained by the re-grouping should not exceed the second time length, and the second time length is greater than the first time length.

[0122] It should be understood that the first time length and the second time length can be two different preset values.

[0123] The process of the re-grouping can refer to the description of S403, and the description of identifying the device category can refer to the description of S406, which are not described here again.

[0124] S408, record the correspondence between each address in each log record and the device category.

[0125] The process is the same as S103, which is not described here again.

[0126] It should be understood that the recorded correspondence can include the correspondence between the request address in the target log record and the device category, and the correspondence between the destination address in the target log record and the device category.

[0127] It should also be understood that the size of the serial number of the above processes does not mean the order of execution, and the execution order of each process should be determined according to its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0128] The above describes the method of the embodiments of the present application in combination with Figure 1 and Figure 4 , and the following will describe the device of the embodiments of the present application in combination with Figure 5 and Figure 6 .

[0129] Figure 5 is a schematic block diagram of a device category identification device 500 provided by the embodiments of the present application, the device 500 includes an acquisition module 510, a processing module 520, and a storage module 530.

[0130] The acquisition module 510 is configured to acquire a plurality of log records, each of the plurality of log records comprising a domain name of a request for access, a request address, a destination address, and a resolution time; the request address is an address of a device requesting to access the domain name, the destination address is an address of a device resolving the domain name, and the resolution time is a time of obtaining a resolution result, the resolution result being an address resolved by resolving the domain name. The processing module 520 is configured to identify a device category of a device corresponding to each address based on the domain name, the request address, the destination address, and the resolution time in each log record, the device category comprising a domain name server and an access terminal. The storage module 530 is configured to record a correspondence between each address in each log record and the device category.

[0131] Optionally, the processing module 520 is specifically configured to determine an association graph based on the plurality of log records in a graph computing manner, the association graph comprising a plurality of points for identifying different domain names, a plurality of points for identifying different addresses, and a plurality of edges with arrows for connecting the domain name, the request address, and the destination address in a same log record, so as to describe a pointing relationship between the domain name, the request address, and the destination address in the plurality of log records; the domain name in the same log record points to the request address, and the request address points to the destination address; when the same address exists in a plurality of log records, the address in a log record with earlier resolution time is upstream of the address in a log record with later resolution time; and identify the device category of the device corresponding to each address based on the association graph.

[0132] Optionally, the processing module 520 is further configured to: the device category of the device corresponding to the address identified by a first target point in the association graph is a domain name server, the first target point being a point pointed to by one or more points identifying addresses; and the device category of the device corresponding to the address identified by a second target point in the association graph is an access terminal, the second target point being a point pointed to by a point identifying a domain name.

[0133] Optionally, the domain name server comprises a cross-domain domain name server and a cascaded domain name server; the device category of the device corresponding to the address identified by a point in the first target point pointed to by one point identifying an address and not pointed to by other points identifying addresses is a cross-domain domain name server; or the device category of the device corresponding to the address identified by a point in the first target point pointed to by a plurality of points identifying addresses is a cascaded domain name server; or the device category of the device corresponding to the address identified by a point in the first target point pointed to by one or more points identifying addresses and simultaneously pointed to by other one or more points identifying addresses is a cascaded domain name server.

[0134] Optionally, the obtaining module 510 is further configured to obtain a plurality of original log records from the network; and the processing module 520 is further configured to group the plurality of original log records based on the parsing time of each original log record in the plurality of original log records, to obtain at least one log record group, each log record group including a plurality of log records, and the interval between the maximum value and the minimum value of the parsing time in the plurality of log records not exceeding a preset value; and the obtaining module 510 is specifically configured to obtain the plurality of log records in any one of the at least one log record group.

[0135] Optionally, the processing module 520 is further configured to filter out a target log record from the plurality of original log records, the device category of the device corresponding to the destination address in the target log record being a cross-domain domain name server; and group the plurality of original log records from which the target log record is filtered out.

[0136] It should be understood that the above-mentioned obtaining module can also be referred to as a data collection module. For example, the obtaining module can collect log records in the network based on the request information sent by the processing module, and send the collected log records to the processing module for data processing.

[0137] It should also be understood that the apparatus 500 herein is embodied in the form of functional modules. The term "module" herein can refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor (for example, a shared processor, a dedicated processor, or a group processor, etc.) and a memory for executing one or more software or firmware programs, a combination of logic circuitry and / or other suitable components that support the described functions. In an optional example, those skilled in the art can understand that the apparatus 500 can be specifically a data processing device in the above-mentioned embodiments, or the functions of the data processing device in the above-mentioned embodiments can be integrated in the apparatus 500, and the apparatus 500 can be used to execute the respective processes and / or steps corresponding to the data processing device in the above-mentioned method embodiments. To avoid repetition, details are not described here.

[0138] The apparatus 500 described above has the functions of implementing the respective steps performed by the data processing device in the above-mentioned method. The above-mentioned functions can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions. For example, the above-mentioned obtaining module 510 can be a communication interface, such as a transceiver interface.

[0139] In the embodiments of the present application, Figure 5 The apparatus 500 in the above-mentioned embodiments can also be a chip or a chip system, such as a system on chip (SoC). Correspondingly, the obtaining module 510 can be a transceiver circuit of the chip, which is not limited here.

[0140] Figure 6 is another schematic block diagram of the device category identification apparatus 600 provided by the embodiments of the present application. The apparatus 600 includes a processor 610, a communication interface 620 and a memory 630.

[0141] The processor 610, the communication interface 620 and the memory 630 communicate with each other through internal connection paths, the memory 630 is configured to store instructions, and the processor 610 is configured to execute the instructions stored in the memory 630 to control the communication interface 620 to acquire data.

[0142] It should be understood that the data processing apparatus 600 can be used to execute each step and / or process corresponding to the data processing apparatus in the above-mentioned method embodiments. Optionally, the memory 630 can include a read-only memory and a random access memory, and provide instructions and data for the processor 610. A part of the memory 630 can also include a non-volatile random access memory. For example, the memory can also store device category information. The processor 610 can be used to execute the instructions stored in the memory, and when the processor 610 executes the instructions, the processor 610 can execute each step and / or process corresponding to the data processing apparatus in the above-mentioned method embodiments.

[0143] It should be understood that in the embodiments of the present application, the processor can be a central processing unit (CPU), and the processor can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0144] The embodiments of the present application provide a computer readable storage medium, and the computer readable storage medium stores computer execution instructions. When the processor executes the computer execution instructions, the method provided in the foregoing embodiments is implemented.

[0145] The embodiments of the present application provide a computer program product, which includes a computer program. When the computer program is executed by the processor, the method provided in the foregoing embodiments is implemented.

[0146] Those skilled in the art can clearly understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0147] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

[0148] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the above-described device embodiments are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0149] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or can be distributed on a plurality of network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0150] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit.

[0151] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0152] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for identifying equipment categories, characterized in that, include: Multiple log records are retrieved, each of which includes the requested domain name, the requested address, the destination address, and the resolution time; wherein, the requested address is the address of the device requesting access to the domain name, the destination address is the address of the device resolving the domain name, and the resolution time is the time when the resolution result is obtained, and the resolution result is the address obtained by resolving the domain name; Based on the domain name, request address, destination address, and resolution time in each log record, the device category corresponding to each address is identified. The device category includes: domain name server and access terminal. Record the correspondence between each address and device category in each log record; The process of identifying the device category corresponding to each address based on the domain name, request address, destination address, and resolution time in each log record includes: A graph computing approach is used to determine a relationship graph based on the multiple log records. This relationship graph includes multiple points identifying different domain names, multiple points identifying different addresses, and multiple arrowed edges connecting the domain name, request address, and destination address within the same log record. This describes the pointing relationships between the domain name, request address, and destination address in the multiple log records. Specifically, in the same log record, the domain name points to the request address, and the request address points to the destination address. When the same address exists in multiple log records, the address in the log record with the earlier resolution time is upstream of the address in the log record with the later resolution time. Based on the aforementioned relationship graph, the device category corresponding to each address is identified.

2. The method according to claim 1, characterized in that, The step of identifying the device category corresponding to each address based on the association graph includes: The device category of the device corresponding to the address identified by the first target point in the association diagram is the domain name server. The first target point is a point pointed to by one or more points identifying addresses. The device category of the device corresponding to the address identified by the second target point in the association diagram is the access terminal, and the second target point is the point pointed to by the point of the identified domain name.

3. The method according to claim 2, characterized in that, The domain name servers include cross-domain domain name servers and cascading domain name servers; The device category of the device corresponding to the address of the point pointed to by one identifier address in the first target point and no longer pointing to other identifier addresses is the cross-domain domain name server; or The device category of the device corresponding to the address pointed to by the points of multiple identifier addresses in the first target point is the cascading domain name server; or The device category of the device corresponding to the address of the first target point that is pointed to by one or more identifier addresses and simultaneously points to one or more other identifier addresses is the cascading domain name server.

4. The method according to any one of claims 1 to 3, characterized in that, Before retrieving multiple log records, the method further includes: Retrieve multiple raw log records from the network; Based on the parsing time of each original log record in the plurality of original log records, the plurality of original log records are grouped to obtain at least one log record group. Each log record group includes a plurality of log records, and the time interval between the parsing times of any two log records in the plurality of log records does not exceed a preset value. The process of obtaining multiple log records includes: Retrieve multiple log records from any one of the at least one log record groups.

5. The method according to claim 4, characterized in that, Before grouping the plurality of original log records, the method further includes: Target log records are filtered out from the multiple original log records, where the device category of the device corresponding to the destination address in the target log record is a cross-domain name server; And the grouping of the multiple original log records includes: Group the original log records that have been filtered out of the target log record.

6. The method according to claim 1, characterized in that, Each log record also includes the parsing result.

7. A device for identifying equipment categories, characterized in that, include: The acquisition module is used to acquire multiple log records. Each log record includes the domain name requested for access, the request address, the destination address, and the resolution time. The request address is the address of the device requesting access to the domain name, and the destination address is the address of the device resolving the domain name. The resolution time is the time when the resolution result is obtained, and the resolution result is the address obtained by resolving the domain name. The processing module is used to identify the device category of the device corresponding to each address based on the domain name, request address, destination address and resolution time in each log record. The device categories include: domain name server and access terminal. The storage module is used to record the correspondence between each address and the device category in each log record; The processing module is specifically used to determine a relationship graph based on the multiple log records using a graph computing approach. The relationship graph includes multiple points for identifying different domain names, multiple points for identifying different addresses, and multiple arrowed edges for connecting the domain name, request address, and destination address in the same log record, to describe the pointing relationship between the domain name, request address, and destination address in the multiple log records. Specifically, in the same log record, the domain name points to the request address, and the request address points to the destination address. When the same address exists in multiple log records, the address in the log record with the earlier resolution time is upstream of the address in the log record with the later resolution time. Based on the aforementioned relationship graph, the device category corresponding to each address is identified.

8. A device for identifying equipment categories, characterized in that, include: A processor coupled to a memory for storing a computer program, which, when invoked by the processor, causes the apparatus to perform the method of any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when run on a computer, causes the computer to perform the method of any one of claims 1 to 6.

Images